Minor modifications (#1)

Keep `setup_firecracker.sh` separate and mark it experimental in README.
Fix modules load, needed to run k8s without reboot. Fix runtimeclass to
add fire.

Signed-off-by: Saikrishna Edupuganti <saikrishna.edupuganti@intel.com>

clr-k8s-examples/README.md

@@ -20,6 +20,11 @@ This script ensures the following
 * Customizes the system to ensure correct defaults are setup (IP Forwarding, Swap off,...)
 * Ensures all the dependencies are loaded on boot (kernel modules)
 
+> EXPERIMENTAL: Optionally run [`setup_firecracker.sh`](setup_firecracker.sh) to be
+able to use firecracker VMM with Kata.
+
+> NOTE: These steps are already done if using vagrant
+
 ## Bring up the master
 
 Run [`create_stack.sh`](create_stack.sh) on the master node. This sets up the

clr-k8s-examples/Vagrantfile

@@ -74,8 +74,8 @@ Vagrant.configure("2") do |config|
       end
       # Bad hack for the vagrant libvirt boxes. WIll be removed once they are fixed.
       c.vm.provision "shell", privileged: false, inline: "sudo usermod --password vagrant root"
-
       c.vm.provision "shell", privileged: false, path: "setup_system.sh"
+      c.vm.provision "shell", privileged: false, path: "setup_firecracker.sh"
     end
   end
 end

clr-k8s-examples/create_stack.sh

@@ -45,7 +45,7 @@ function runtimeclass_kata() {
 		echo "Waiting for runtime class CRD"
 		sleep 2
 	done
-	kubectl apply -f 8-kata/kata-runtimeClass.yaml
+	kubectl apply -f 8-kata/
 }
 
 function cni() {

clr-k8s-examples/setup_firecracker.sh

@@ -1,9 +1,13 @@
 #!/bin/bash
 
-mkdir -p /etc/kata-containers
+set -o errexit
+set -o pipefail
+set -o nounset
+
+sudo mkdir -p /etc/kata-containers
 
 # Setup a configuration to be used by firecracker
-cat <<EOT | tee /etc/kata-containers/configuration_firecracker.toml
+cat <<EOT | sudo tee /etc/kata-containers/configuration_firecracker.toml
 [hypervisor.firecracker]
 path = "/usr/bin/firecracker"
 kernel = "/usr//share/kata-containers/vmlinux.container"
@@ -29,14 +33,14 @@ EOT
 
 # Firecracker can only work with devicemapper
 # Setup a sparse disk to be used for devicemapper
-rm -f /var/lib/crio/devicemapper/disk.img
-mkdir -p /var/lib/crio/devicemapper
-truncate /var/lib/crio/devicemapper/disk.img --size 10G
+sudo rm -f /var/lib/crio/devicemapper/disk.img
+sudo mkdir -p /var/lib/crio/devicemapper
+sudo truncate /var/lib/crio/devicemapper/disk.img --size 10G
 
 # Ensure that this disk is loop mounted at each boot
-mkdir -p /etc/systemd/system
+sudo mkdir -p /etc/systemd/system
 
-cat <<EOT | tee /etc/systemd/system/devicemapper.service
+cat <<EOT | sudo tee /etc/systemd/system/devicemapper.service
 [Unit]
 Description=Setup CRIO devicemapper
 DefaultDependencies=no
@@ -53,34 +57,36 @@ Type=oneshot
 WantedBy=local-fs.target
 EOT
 
-systemctl daemon-reload
-systemctl start devicemapper
+sudo systemctl daemon-reload
+sudo systemctl enable --now devicemapper
 
 # For now till we address https://github.com/kubernetes-sigs/cri-o/issues/1991
 # use a shell script to expose firecracker through kata
-cat <<EOT | tee /usr/bin/kata-runtime-fire
+cat <<EOT | sudo tee /usr/bin/kata-runtime-fire
 #!/bin/bash
 
 /usr/bin/kata-runtime --kata-config /etc/kata-containers/configuration_firecracker.toml "\$@"
 EOT
 
-chmod +x /usr/bin/kata-runtime-fire
+sudo chmod +x /usr/bin/kata-runtime-fire
 
 # Add firecracker as a second runtime
 # Also setup crio to use devicemapper
 
-mkdir -p /etc/crio/
-cp /usr/share/defaults/crio/crio.conf /etc/crio/crio.conf
+sudo mkdir -p /etc/crio/
+sudo cp /usr/share/defaults/crio/crio.conf /etc/crio/crio.conf
 
-echo -e "\n[crio.runtime.runtimes.kata]\nruntime_path = \"/usr/bin/kata-runtime\"" >> /etc/crio/crio.conf
-echo -e "\n[crio.runtime.runtimes.fire]\nruntime_path = \"/usr/bin/kata-runtime-fire\"" >> /etc/crio/crio.conf
+echo -e "\n[crio.runtime.runtimes.kata]\nruntime_path = \"/usr/bin/kata-runtime\"" | sudo tee -a /etc/crio/crio.conf
+echo -e "\n[crio.runtime.runtimes.fire]\nruntime_path = \"/usr/bin/kata-runtime-fire\"" | sudo tee -a /etc/crio/crio.conf
 
-sed -i 's|\(\[crio\.runtime\]\)|\1\nmanage_network_ns_lifecycle = true|' /etc/crio/crio.conf
+sudo sed -i 's|\(\[crio\.runtime\]\)|\1\nmanage_network_ns_lifecycle = true|' /etc/crio/crio.conf
 
-sed -i 's/storage_driver = \"overlay\"/storage_driver = \"devicemapper\"\
+sudo sed -i 's/storage_driver = \"overlay\"/storage_driver = \"devicemapper\"\
 storage_option = [\
   \"dm.basesize=8G\",\
   \"dm.directlvm_device=\/dev\/loop8\",\
   \"dm.directlvm_device_force=true\",\
   \"dm.fs=ext4\"\
 ]/g' /etc/crio/crio.conf
+
+sudo systemctl restart crio || true

clr-k8s-examples/setup_system.sh

@@ -3,9 +3,6 @@
 set -o errexit
 set -o nounset
 
-CUR_DIR=$(pwd)
-SCRIPT_DIR="$(dirname "${BASH_SOURCE[0]}")"
-
 ADD_NO_PROXY="10.244.0.0/16,10.96.0.0/12"
 ADD_NO_PROXY+=",$(hostname -I | sed 's/[[:space:]]/,/g')"
 
@@ -53,7 +50,7 @@ sudo mkdir -p /usr/libexec/cni /opt/cni
 [ ! -e /opt/cni/bin/cni ] && sudo ln -s /usr/libexec/cni /opt/cni/bin
 #Ensure that the system is ready without requiring a reboot
 sudo swapoff -a
-sudo modprobe br_netfilter vhost_vsock overlay
+sudo systemctl restart systemd-modules-load.service
 
 set +o nounset
 if [[ ${http_proxy} ]] || [[ ${HTTP_PROXY} ]]; then
@@ -81,8 +78,6 @@ EOF
 fi
 set -o nounset
 
-sudo $SCRIPT_DIR/setup_firecracker.sh
-
 # We have potentially modified their env files, we need to restart the services.
 sudo systemctl daemon-reload
 sudo systemctl restart crio || true