04-15-2019, 10:26 PM
Kubernetes on Fedora IoT with k3s
<div><p>Fedora IoT is an upcoming Fedora edition targeted at the Internet of Things. It was introduced last year on Fedora Magazine in the article <a href="https://fedoramagazine.org/turnon-led-fedora-iot/">How to turn on an LED with Fedora IoT</a>. Since then, it has continued to improve together with Fedora Silverblue to provide an immutable base operating system aimed at container-focused workflows.</p>
<p>Kubernetes is an immensely popular container orchestration system. It is perhaps most commonly used on powerful hardware handling huge workloads. However, it can also be used on lightweight devices such as the Raspberry Pi 3. Read on to find out how.</p>
<p> <span id="more-25824"></span> </p>
<h2>Why Kubernetes?</h2>
<p>While Kubernetes is all the rage in the cloud, it may not be immediately obvious to run it on a small single board computer. But there are certainly reasons for doing it. First of all it is a great way to learn and get familiar with Kubernetes without the need for expensive hardware. Second, because of its popularity, there are <a href="https://hub.helm.sh/">tons of applications</a> that comes pre-packaged for running in Kubernetes clusters. Not to mention the large community to provide help if you ever get stuck.</p>
<p>Last but not least, container orchestration may actually make things easier, even at the small scale in a home lab. This may not be apparent when tackling the the learning curve, but these skills will help when dealing with any cluster in the future. It doesn’t matter if it’s a single node Raspberry Pi cluster or a large scale machine learning farm.</p>
<h3>K3s – a lightweight Kubernetes</h3>
<p>A “normal” installation of Kubernetes (if such a thing can be said to exist) is a bit on the heavy side for IoT. The recommendation is a minimum of 2 GB RAM per machine! However, there are plenty of alternatives, and one of the newcomers is <a href="https://k3s.io">k3s</a> – a lightweight Kubernetes distribution.</p>
<p>K3s is quite special in that it has replaced etcd with SQLite for its key-value storage needs. Another thing to note is that k3s ships as a single binary instead of one per component. This diminishes the memory footprint and simplifies the installation. Thanks to the above, k3s should be able to run k3s with just 512 MB of RAM, perfect for a small single board computer!</p>
<h2>What you will need</h2>
<ol>
<li>Fedora IoT in a virtual machine or on a physical device. See the excellent getting started guide <a href="https://docs.fedoraproject.org/en-US/iot/getting-started/">here</a>. One machine is enough but two will allow you to test adding more nodes to the cluster.</li>
<li><a href="https://github.com/rancher/k3s#open-ports--network-security">Configure the firewall</a> to allow traffic on ports 6443 and 8472. Or simply disable it for this experiment by running “systemctl stop firewalld”.</li>
</ol>
<h2>Install k3s</h2>
<p>Installing k3s is very easy. Simply run the installation script:</p>
<pre class="wp-block-preformatted">curl -sfL https://get.k3s.io | sh -<br /></pre>
<p>This will download, install and start up k3s. After installation, get a list of nodes from the server by running the following command:</p>
<pre class="wp-block-preformatted">kubectl get nodes<br /></pre>
<p>Note that there are several options that can be passed to the installation script through environment variables. These can be found in the <a href="https://github.com/rancher/k3s#systemd">documentation</a>. And of course, there is nothing stopping you from installing k3s manually by downloading the binary directly.</p>
<p>While great for experimenting and learning, a single node cluster is not much of a cluster. Luckily, adding another node is no harder than setting up the first one. Just pass two environment variables to the installation script to make it find the first node and avoid running the server part of k3s</p>
<pre class="wp-block-preformatted">curl -sfL https://get.k3s.io | K3S_URL=https://example-url:6443 \<br /> K3S_TOKEN=XXX sh -<br /></pre>
<p>The example-url above should be replaced by the IP address or fully qualified domain name of the first node. On that node the token (represented by XXX) is found in the file /var/lib/rancher/k3s/server/node-token.</p>
<h2>Deploy some containers</h2>
<p>Now that we have a Kubernetes cluster, what can we actually do with it? Let’s start by deploying a simple web server.</p>
<pre class="wp-block-preformatted">kubectl create deployment my-server --image nginx</pre>
<p>This will create a <a href="https://kubernetes.io/docs/concepts/workloads/controllers/deployment/">Deployment</a> named “my-server” from the container image “nginx” (defaulting to docker hub as registry and the latest tag). You can see the Pod created by running the following command.</p>
<pre class="wp-block-preformatted">kubectl get pods</pre>
<p>In order to access the nginx server running in the pod, first expose the Deployment through a <a href="https://kubernetes.io/docs/concepts/services-networking/service/">Service</a>. The following command will create a Service with the same name as the deployment.</p>
<pre class="wp-block-preformatted">kubectl expose deployment my-server --port 80</pre>
<p>The Service works as a kind of load balancer and DNS record for the Pods. For instance, when running a second Pod, we will be able to <em>curl</em> the nginx server just by specifying <em>my-server</em> (the name of the Service). See the example below for how to do this.</p>
<pre class="wp-block-preformatted"># Start a pod and run bash interactively in it<br />kubectl run debug --generator=run-pod/v1 --image=fedora -it -- bash<br /># Wait for the bash prompt to appear<br />curl my-server<br /># You should get the "Welcome to nginx!" page as output</pre>
<h2>Ingress controller and external IP</h2>
<p>By default, a Service only get a ClusterIP (only accessible inside the cluster), but you can also request an external IP for the service by setting its type to <a href="https://kubernetes.io/docs/concepts/services-networking/service/#loadbalancer">LoadBalancer</a>. However, not all applications require their own IP address. Instead, it is often possible to share one IP address among many services by routing requests based on the host header or path. You can accomplish this in Kubernetes with an <a href="https://kubernetes.io/docs/concepts/services-networking/ingress/">Ingress</a>, and this is what we will do. Ingresses also provide additional features such as TLS encryption of the traffic without having to modify your application.</p>
<p>Kubernetes needs an ingress controller to make the Ingress resources work and k3s includes <a href="https://traefik.io/">Traefik</a> for this purpose. It also includes a simple service load balancer that makes it possible to get an external IP for a Service in the cluster. The <a href="https://github.com/rancher/k3s/blob/master/README.md#service-load-balancer">documentation</a> describes the service like this:</p>
<blockquote class="wp-block-quote">
<p>k3s includes a basic service load balancer that uses available host ports. If you try to create a load balancer that listens on port 80, for example, it will try to find a free host in the cluster for port 80. If no port is available the load balancer will stay in Pending.</p>
<p><cite>k3s README</cite></p></blockquote>
<p>The ingress controller is already exposed with this load balancer service. You can find the IP address that it is using with the following command.</p>
<pre class="wp-block-preformatted">$ kubectl get svc --all-namespaces<br />NAMESPACE NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE<br /> default kubernetes ClusterIP 10.43.0.1 443/TCP 33d<br /> default my-server ClusterIP 10.43.174.38 80/TCP 30m<br /> kube-system kube-dns ClusterIP 10.43.0.10 53/UDP,53/TCP,9153/TCP 33d<br /> kube-system traefik LoadBalancer 10.43.145.104 10.0.0.8 80:31596/TCP,443:31539/TCP 33d</pre>
<p>Look for the Service named traefik. In the above example the IP we are interested in is 10.0.0.8.</p>
<h2>Route incoming requests</h2>
<p>Let’s create an Ingress that routes requests to our web server based on the host header. This example uses <a href="http://xip.io/">xip.io</a> to avoid having to set up DNS records. It works by including the IP adress as a subdomain, to use any subdomain of 10.0.0.8.xip.io to reach the IP 10.0.0.8. In other words, my-server.10.0.0.8.xip.io is used to reach the ingress controller in the cluster. You can try this right now (with your own IP instead of 10.0.0.8). Without an ingress in place you should reach the “default backend” which is just a page showing “404 page not found”.</p>
<p>We can tell the ingress controller to route requests to our web server Service with the following Ingress.</p>
<pre class="wp-block-preformatted">apiVersion: extensions/v1beta1<br />kind: Ingress<br />metadata:<br /> name: my-server<br />spec:<br /> rules:<br /> - host: my-server.10.0.0.8.xip.io<br /> http:<br /> paths:<br /> - path: /<br /> backend:<br /> serviceName: my-server<br /> servicePort: 80<br /></pre>
<p>Save the above snippet in a file named <em>my-ingress.yaml</em> and add it to the cluster by running this command:</p>
<pre class="wp-block-preformatted">kubectl apply -f my-ingress.yaml<br /></pre>
<p>You should now be able to reach the default nginx welcoming page on the fully qualified domain name you chose. In my example this would be my-server.10.0.0.8.xip.io. The ingress controller is routing the requests based on the information in the Ingress. A request to my-server.10.0.0.8.xip.io will be routed to the Service and port defined as backend in the Ingress (my-server and 80 in this case).</p>
<h2>What about IoT then?</h2>
<p>Imagine the following scenario. You have dozens of devices spread out around your home or farm. It is a heterogeneous collection of IoT devices with various hardware capabilities, sensors and actuators. Maybe some of them have cameras, weather or light sensors. Others may be hooked up to control the ventilation, lights, blinds or blink LEDs.</p>
<p>In this scenario, you want to gather data from all the sensors, maybe process and analyze it before you finally use it to make decisions and control the actuators. In addition to this, you may want to visualize what’s going on by setting up a dashboard. So how can Kubernetes help us manage something like this? How can we make sure that Pods run on suitable devices?</p>
<p>The simple answer is labels. You can label the nodes according to capabilities, like this:</p>
<pre class="wp-block-preformatted">kubectl label nodes <node-name> <label-key>=<label-value><br /># Example<br />kubectl label nodes node2 camera=available</pre>
<p>Once they are labeled, it is easy to select suitable nodes for your workload with <a href="https://kubernetes.io/docs/concepts/configuration/assign-pod-node/">nodeSelectors</a>. The final piece to the puzzle, if you want to run your Pods on <em>all</em> suitable nodes is to use <a href="https://kubernetes.io/docs/concepts/workloads/controllers/daemonset/">DaemonSets</a> instead of Deployments. In other words, create one DaemonSet for each data collecting application that uses some unique sensor and use nodeSelectors to make sure they only run on nodes with the proper hardware.</p>
<p>The service discovery feature that allows Pods to find each other simply by Service name makes it quite easy to handle these kinds of distributed systems. You don’t need to know or configure IP addresses or custom ports for the applications. Instead, they can easily find each other through named Services in the cluster.</p>
<h3>Utilize spare resources</h3>
<p>With the cluster up and running, collecting data and controlling your lights and climate control you may feel that you are finished. However, there are still plenty of compute resources in the cluster that could be used for other projects. This is where Kubernetes really shines.</p>
<p>You shouldn’t have to worry about where exactly those resources are or calculate if there is enough memory to fit an extra application here or there. This is exactly what orchestration solves! You can easily deploy more applications in the cluster and let Kubernetes figure out where (or if) they will fit.</p>
<p>Why not run your own <a href="https://nextcloud.com/">NextCloud</a> instance? Or maybe <a href="https://gitea.io/en-us/">gitea</a>? You could also set up a CI/CD pipeline for all those IoT containers. After all, why would you build and cross compile them on your main computer if you can do it natively in the cluster?</p>
<p>The point here is that Kubernetes makes it easier to make use of the “hidden” resources that you often end up with otherwise. Kubernetes handles scheduling of Pods in the cluster based on available resources and fault tolerance so that you don’t have to. However, in order to help Kubernetes make reasonable decisions you should definitely add <a href="https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/">resource requests</a> to your workloads.</p>
<h2>Summary</h2>
<p>While Kubernetes, or container orchestration in general, may not usually be associated with IoT, it certainly makes a lot of sense to have an orchestrator when you are dealing with distributed systems. Not only does is allow you to handle a diverse and heterogeneous fleet of devices in a unified way, but it also simplifies communication between them. In addition, Kubernetes makes it easier to utilize spare resources.</p>
<p>Container technology made it possible to build applications that could “run anywhere”. Now Kubernetes makes it easier to manage the “anywhere” part. And as an immutable base to build it all on, we have Fedora IoT.</p>
</div>
<div><p>Fedora IoT is an upcoming Fedora edition targeted at the Internet of Things. It was introduced last year on Fedora Magazine in the article <a href="https://fedoramagazine.org/turnon-led-fedora-iot/">How to turn on an LED with Fedora IoT</a>. Since then, it has continued to improve together with Fedora Silverblue to provide an immutable base operating system aimed at container-focused workflows.</p>
<p>Kubernetes is an immensely popular container orchestration system. It is perhaps most commonly used on powerful hardware handling huge workloads. However, it can also be used on lightweight devices such as the Raspberry Pi 3. Read on to find out how.</p>
<p> <span id="more-25824"></span> </p>
<h2>Why Kubernetes?</h2>
<p>While Kubernetes is all the rage in the cloud, it may not be immediately obvious to run it on a small single board computer. But there are certainly reasons for doing it. First of all it is a great way to learn and get familiar with Kubernetes without the need for expensive hardware. Second, because of its popularity, there are <a href="https://hub.helm.sh/">tons of applications</a> that comes pre-packaged for running in Kubernetes clusters. Not to mention the large community to provide help if you ever get stuck.</p>
<p>Last but not least, container orchestration may actually make things easier, even at the small scale in a home lab. This may not be apparent when tackling the the learning curve, but these skills will help when dealing with any cluster in the future. It doesn’t matter if it’s a single node Raspberry Pi cluster or a large scale machine learning farm.</p>
<h3>K3s – a lightweight Kubernetes</h3>
<p>A “normal” installation of Kubernetes (if such a thing can be said to exist) is a bit on the heavy side for IoT. The recommendation is a minimum of 2 GB RAM per machine! However, there are plenty of alternatives, and one of the newcomers is <a href="https://k3s.io">k3s</a> – a lightweight Kubernetes distribution.</p>
<p>K3s is quite special in that it has replaced etcd with SQLite for its key-value storage needs. Another thing to note is that k3s ships as a single binary instead of one per component. This diminishes the memory footprint and simplifies the installation. Thanks to the above, k3s should be able to run k3s with just 512 MB of RAM, perfect for a small single board computer!</p>
<h2>What you will need</h2>
<ol>
<li>Fedora IoT in a virtual machine or on a physical device. See the excellent getting started guide <a href="https://docs.fedoraproject.org/en-US/iot/getting-started/">here</a>. One machine is enough but two will allow you to test adding more nodes to the cluster.</li>
<li><a href="https://github.com/rancher/k3s#open-ports--network-security">Configure the firewall</a> to allow traffic on ports 6443 and 8472. Or simply disable it for this experiment by running “systemctl stop firewalld”.</li>
</ol>
<h2>Install k3s</h2>
<p>Installing k3s is very easy. Simply run the installation script:</p>
<pre class="wp-block-preformatted">curl -sfL https://get.k3s.io | sh -<br /></pre>
<p>This will download, install and start up k3s. After installation, get a list of nodes from the server by running the following command:</p>
<pre class="wp-block-preformatted">kubectl get nodes<br /></pre>
<p>Note that there are several options that can be passed to the installation script through environment variables. These can be found in the <a href="https://github.com/rancher/k3s#systemd">documentation</a>. And of course, there is nothing stopping you from installing k3s manually by downloading the binary directly.</p>
<p>While great for experimenting and learning, a single node cluster is not much of a cluster. Luckily, adding another node is no harder than setting up the first one. Just pass two environment variables to the installation script to make it find the first node and avoid running the server part of k3s</p>
<pre class="wp-block-preformatted">curl -sfL https://get.k3s.io | K3S_URL=https://example-url:6443 \<br /> K3S_TOKEN=XXX sh -<br /></pre>
<p>The example-url above should be replaced by the IP address or fully qualified domain name of the first node. On that node the token (represented by XXX) is found in the file /var/lib/rancher/k3s/server/node-token.</p>
<h2>Deploy some containers</h2>
<p>Now that we have a Kubernetes cluster, what can we actually do with it? Let’s start by deploying a simple web server.</p>
<pre class="wp-block-preformatted">kubectl create deployment my-server --image nginx</pre>
<p>This will create a <a href="https://kubernetes.io/docs/concepts/workloads/controllers/deployment/">Deployment</a> named “my-server” from the container image “nginx” (defaulting to docker hub as registry and the latest tag). You can see the Pod created by running the following command.</p>
<pre class="wp-block-preformatted">kubectl get pods</pre>
<p>In order to access the nginx server running in the pod, first expose the Deployment through a <a href="https://kubernetes.io/docs/concepts/services-networking/service/">Service</a>. The following command will create a Service with the same name as the deployment.</p>
<pre class="wp-block-preformatted">kubectl expose deployment my-server --port 80</pre>
<p>The Service works as a kind of load balancer and DNS record for the Pods. For instance, when running a second Pod, we will be able to <em>curl</em> the nginx server just by specifying <em>my-server</em> (the name of the Service). See the example below for how to do this.</p>
<pre class="wp-block-preformatted"># Start a pod and run bash interactively in it<br />kubectl run debug --generator=run-pod/v1 --image=fedora -it -- bash<br /># Wait for the bash prompt to appear<br />curl my-server<br /># You should get the "Welcome to nginx!" page as output</pre>
<h2>Ingress controller and external IP</h2>
<p>By default, a Service only get a ClusterIP (only accessible inside the cluster), but you can also request an external IP for the service by setting its type to <a href="https://kubernetes.io/docs/concepts/services-networking/service/#loadbalancer">LoadBalancer</a>. However, not all applications require their own IP address. Instead, it is often possible to share one IP address among many services by routing requests based on the host header or path. You can accomplish this in Kubernetes with an <a href="https://kubernetes.io/docs/concepts/services-networking/ingress/">Ingress</a>, and this is what we will do. Ingresses also provide additional features such as TLS encryption of the traffic without having to modify your application.</p>
<p>Kubernetes needs an ingress controller to make the Ingress resources work and k3s includes <a href="https://traefik.io/">Traefik</a> for this purpose. It also includes a simple service load balancer that makes it possible to get an external IP for a Service in the cluster. The <a href="https://github.com/rancher/k3s/blob/master/README.md#service-load-balancer">documentation</a> describes the service like this:</p>
<blockquote class="wp-block-quote">
<p>k3s includes a basic service load balancer that uses available host ports. If you try to create a load balancer that listens on port 80, for example, it will try to find a free host in the cluster for port 80. If no port is available the load balancer will stay in Pending.</p>
<p><cite>k3s README</cite></p></blockquote>
<p>The ingress controller is already exposed with this load balancer service. You can find the IP address that it is using with the following command.</p>
<pre class="wp-block-preformatted">$ kubectl get svc --all-namespaces<br />NAMESPACE NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE<br /> default kubernetes ClusterIP 10.43.0.1 443/TCP 33d<br /> default my-server ClusterIP 10.43.174.38 80/TCP 30m<br /> kube-system kube-dns ClusterIP 10.43.0.10 53/UDP,53/TCP,9153/TCP 33d<br /> kube-system traefik LoadBalancer 10.43.145.104 10.0.0.8 80:31596/TCP,443:31539/TCP 33d</pre>
<p>Look for the Service named traefik. In the above example the IP we are interested in is 10.0.0.8.</p>
<h2>Route incoming requests</h2>
<p>Let’s create an Ingress that routes requests to our web server based on the host header. This example uses <a href="http://xip.io/">xip.io</a> to avoid having to set up DNS records. It works by including the IP adress as a subdomain, to use any subdomain of 10.0.0.8.xip.io to reach the IP 10.0.0.8. In other words, my-server.10.0.0.8.xip.io is used to reach the ingress controller in the cluster. You can try this right now (with your own IP instead of 10.0.0.8). Without an ingress in place you should reach the “default backend” which is just a page showing “404 page not found”.</p>
<p>We can tell the ingress controller to route requests to our web server Service with the following Ingress.</p>
<pre class="wp-block-preformatted">apiVersion: extensions/v1beta1<br />kind: Ingress<br />metadata:<br /> name: my-server<br />spec:<br /> rules:<br /> - host: my-server.10.0.0.8.xip.io<br /> http:<br /> paths:<br /> - path: /<br /> backend:<br /> serviceName: my-server<br /> servicePort: 80<br /></pre>
<p>Save the above snippet in a file named <em>my-ingress.yaml</em> and add it to the cluster by running this command:</p>
<pre class="wp-block-preformatted">kubectl apply -f my-ingress.yaml<br /></pre>
<p>You should now be able to reach the default nginx welcoming page on the fully qualified domain name you chose. In my example this would be my-server.10.0.0.8.xip.io. The ingress controller is routing the requests based on the information in the Ingress. A request to my-server.10.0.0.8.xip.io will be routed to the Service and port defined as backend in the Ingress (my-server and 80 in this case).</p>
<h2>What about IoT then?</h2>
<p>Imagine the following scenario. You have dozens of devices spread out around your home or farm. It is a heterogeneous collection of IoT devices with various hardware capabilities, sensors and actuators. Maybe some of them have cameras, weather or light sensors. Others may be hooked up to control the ventilation, lights, blinds or blink LEDs.</p>
<p>In this scenario, you want to gather data from all the sensors, maybe process and analyze it before you finally use it to make decisions and control the actuators. In addition to this, you may want to visualize what’s going on by setting up a dashboard. So how can Kubernetes help us manage something like this? How can we make sure that Pods run on suitable devices?</p>
<p>The simple answer is labels. You can label the nodes according to capabilities, like this:</p>
<pre class="wp-block-preformatted">kubectl label nodes <node-name> <label-key>=<label-value><br /># Example<br />kubectl label nodes node2 camera=available</pre>
<p>Once they are labeled, it is easy to select suitable nodes for your workload with <a href="https://kubernetes.io/docs/concepts/configuration/assign-pod-node/">nodeSelectors</a>. The final piece to the puzzle, if you want to run your Pods on <em>all</em> suitable nodes is to use <a href="https://kubernetes.io/docs/concepts/workloads/controllers/daemonset/">DaemonSets</a> instead of Deployments. In other words, create one DaemonSet for each data collecting application that uses some unique sensor and use nodeSelectors to make sure they only run on nodes with the proper hardware.</p>
<p>The service discovery feature that allows Pods to find each other simply by Service name makes it quite easy to handle these kinds of distributed systems. You don’t need to know or configure IP addresses or custom ports for the applications. Instead, they can easily find each other through named Services in the cluster.</p>
<h3>Utilize spare resources</h3>
<p>With the cluster up and running, collecting data and controlling your lights and climate control you may feel that you are finished. However, there are still plenty of compute resources in the cluster that could be used for other projects. This is where Kubernetes really shines.</p>
<p>You shouldn’t have to worry about where exactly those resources are or calculate if there is enough memory to fit an extra application here or there. This is exactly what orchestration solves! You can easily deploy more applications in the cluster and let Kubernetes figure out where (or if) they will fit.</p>
<p>Why not run your own <a href="https://nextcloud.com/">NextCloud</a> instance? Or maybe <a href="https://gitea.io/en-us/">gitea</a>? You could also set up a CI/CD pipeline for all those IoT containers. After all, why would you build and cross compile them on your main computer if you can do it natively in the cluster?</p>
<p>The point here is that Kubernetes makes it easier to make use of the “hidden” resources that you often end up with otherwise. Kubernetes handles scheduling of Pods in the cluster based on available resources and fault tolerance so that you don’t have to. However, in order to help Kubernetes make reasonable decisions you should definitely add <a href="https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/">resource requests</a> to your workloads.</p>
<h2>Summary</h2>
<p>While Kubernetes, or container orchestration in general, may not usually be associated with IoT, it certainly makes a lot of sense to have an orchestrator when you are dealing with distributed systems. Not only does is allow you to handle a diverse and heterogeneous fleet of devices in a unified way, but it also simplifies communication between them. In addition, Kubernetes makes it easier to utilize spare resources.</p>
<p>Container technology made it possible to build applications that could “run anywhere”. Now Kubernetes makes it easier to manage the “anywhere” part. And as an immutable base to build it all on, we have Fedora IoT.</p>
</div>