30/03/23 - Ansiblifying CAPI

Looking at ansiblifying the deployment of capi management/workload clusters.

29/03/23 - Redeploying site directory

Pretty much followed https://serversforhackers.com/c/letsencrypt-with-haproxy.

haproxy configuration:

# LE frontend
#frontend fe
#    bind *:80

    # Test URI to see if its a letsencrypt request
    #acl letsencrypt-acl path_beg /.well-known/acme-challenge/
    #use_backend letsencrypt-backend if letsencrypt-acl

# LE backend
#backend letsencrypt-backend
#    server letsencrypt 127.0.0.1:8888

#---------------------------------------------------------------------
# http(s) frontend
#---------------------------------------------------------------------
frontend http-in
    bind *:80 
    bind *:443 ssl crt /etc/ssl/srcdev.skao.int/srcdev.skao.int.pem
    acl site_directory hdr_sub(host) -i sited.srcdev.skao.int
    use_backend srcdev_sited if site_directory

    # Redirect if HTTPS is *not* used
    redirect scheme https code 301 if !{ ssl_fc }

    acl letsencrypt-acl path_beg /.well-known/acme-challenge/
    use_backend letsencrypt-backend if letsencrypt-acl

#---------------------------------------------------------------------
# srcdev_sited backend
#---------------------------------------------------------------------
backend srcdev_sited
    mode http
    option forwardfor
    server srcdev_sited 130.246.213.230:80

After installing certbot, need to request certs for all subdomains by creating a temporary server for acme:

sudo certbot certonly --standalone -d srcnet.skao.int -d srcdev.skao.int -d sited.srcdev.skao.int 
--non-interactive --agree-tos --email rob.barnsley@skao.int --expand --http-01-port=8888

Certificate chain is then concatenated, e.g.

sudo cat /etc/letsencrypt/live/srcdev.skao.int/fullchain.pem /etc/letsencrypt/live/srcdev.skao.int/privkey.pem 
| sudo tee /etc/ssl/srcdev.skao.int/srcdev.skao.int.pem

The following script can be cronned for renewal:

#!/usr/bin/env bash

# Renew the certificate
certbot renew --force-renewal

# Concatenate new cert files, with less output (avoiding the use tee and its output to stdout)
bash -c "sudo cat /etc/letsencrypt/live/srcdev.skao.int/fullchain.pem /etc/letsencrypt/live/srcdev.skao.int/privkey.pem | sudo tee /etc/ssl/srcdev.skao.int/srcdev.skao.int.pem"

# Reload  HAProxy
service haproxy reload

28/03/23 - Architecture doc, RSE debugging

Reading through SRCNet arch doc. Debugging some broken RSEs and informing site managers.

27/03/23 - Architecture doc, RSE debugging

Reading through SRCNet arch doc. Debugging some broken RSEs and informing site managers.

24/03/23 - AL

23/03/23 - cluster api

LB working with ingress-nginx and fip (without external access). Waiting on support for bridging subnets.

22/03/23 - cluster api

Progress being made but problems with Ceph being on a different private network.

21/03/23 - cluster api

20/03/23 - cluster api

Looking at deploying capi via Helm. Got it working but needed to assign a FIP to the LB to access the private network that the payload cluster is deployed on.

17/03/23 - cluster api

Looking at deploying capi via manifests (not through helm). Can't get access to the payload cluster from mgmt.

16/03/23 - cluster api

Looking at deploying capi via manifests (not through helm). Can't get access to the payload cluster from mgmt.

15/03/23 - cluster api

Looking at deploying capi.

14/03/23 - Rucio metadata PRs

https://github.com/rucio/rucio/pull/6132 https://github.com/rucio/rucio/pull/6133

13/03/23 - Resource directory

Created repo src-site-directory and committed. Made README.

10/03/23 - PI18 planning

09/03/23 - PI18 planning

08/03/23 - PI18 planning

07/03/23 - PI18 planning

06/03/23 - AL

03/03/23 - AL

02/03/23 - Meetings & resource directory

Finished and deployed (src-dev). Overrode some paths on src-proxy (/ and /static/).

Feature planning for PI18.

01/03/23 - Meetings & resource directory

More refactoring. Added default data. Now at the point of looking at visualisation.