IKO Plus: VIP in Kubernetes on IrisClusters

#!/usr/bin/env bash
set -e

PARENT_NIC="eno1"         # if dynamic
VIP_IP="192.168.1.152/32" # available address on our lan

sudo bash -c "cat > /etc/systemd/system/vip0.service <<'EOF'
[Unit]
Description=Virtual interface vip0 for kube-vip
After=network-online.target
Wants=network-online.target

[Service]
Type=oneshot
ExecStartPre=-/sbin/ip link delete vip0
ExecStart=/sbin/ip link add vip0 link ${PARENT_NIC} type macvlan mode bridge
ExecStart=/sbin/ip addr add ${VIP_IP} dev vip0
ExecStart=/sbin/ip link set vip0 up
RemainAfterExit=yes

ExecStop=/sbin/ip link set vip0 down
ExecStop=/sbin/ip link delete vip0

[Install]
WantedBy=multi-user.target
EOF"

sudo systemctl daemon-reload
sudo systemctl enable vip0 --now
sudo systemctl status vip0 --no-pager

​
#!/usr/bin/env bash
set -e

PARENT_NIC="enps05"         # if dynamic
VIP_IP="192.168.1.152/32" # available address on our lan

sudo bash -c "cat > /etc/systemd/system/vip0.service <<'EOF'
[Unit]
Description=Virtual interface vip0 for kube-vip
After=network-online.target
Wants=network-online.target

[Service]
Type=oneshot
ExecStartPre=-/sbin/ip link delete vip0
ExecStart=/sbin/ip link add vip0 link ${PARENT_NIC} type macvlan mode bridge
ExecStart=/sbin/ip addr add ${VIP_IP} dev vip0
ExecStart=/sbin/ip link set vip0 up
RemainAfterExit=yes

ExecStop=/sbin/ip link set vip0 down
ExecStop=/sbin/ip link delete vip0

[Install]
WantedBy=multi-user.target
EOF"

sudo systemctl daemon-reload
sudo systemctl enable vip0 --now
sudo systemctl status vip0 --no-pager


​

apiVersion: v1
kind: ServiceAccount
metadata:
  name: kube-vip
  namespace: kube-system
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: kube-vip
rules:
  - apiGroups: [""]
    resources: ["services","services/status","endpoints","nodes","pods","configmaps"]
    verbs: ["get","list","watch","update","patch","create"]
  - apiGroups: ["coordination.k8s.io"]
    resources: ["leases"]
    verbs: ["get","list","watch","create","update","patch"]
  - apiGroups: ["discovery.k8s.io"]
    resources: ["endpointslices"]
    verbs: ["get","list","watch"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: kube-vip
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: kube-vip
subjects:
  - kind: ServiceAccount
    name: kube-vip
    namespace: kube-system
#---
# (Optional) a tiny IP pool; you can also skip this and use per-Service annotation
# apiVersion: v1
# kind: ConfigMap
# metadata:
#  name: kubevip
#  namespace: kube-system
#data:
#  range-global: "192.168.1.152-192.168.1.152"   ### Your VIP (or a range) for the IrisCluster !!!!
---
apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: kube-vip
  namespace: kube-system
spec:
  selector:
    matchLabels:
      app: kube-vip
  template:
    metadata:
      labels:
        app: kube-vip
    spec:
      serviceAccountName: kube-vip
      hostNetwork: true
      tolerations:
        - operator: "Exists"
      containers:
        - name: kube-vip
          image: ghcr.io/kube-vip/kube-vip:v0.8.0
          args: ["manager"]
          securityContext:
            capabilities:
              add: ["NET_ADMIN","NET_RAW"]
          env:
            - name: vip_interface           #### Your VIP interface on Nodes for the IrisCluster !!!!
              value: "vip0"
            - name: vip_cidr
              value: "32"
            - name: vip_arp                 # ARP advertising (L2)
              value: "true"
            - name: bgp_enable
              value: "false"
            - name: lb_enable               # kube-vip LB controller
              value: "true"
            - name: svc_enable              # watch Services of type LoadBalancer
              value: "true"
            - name: cp_enable               # NOT using API server VIP here
              value: "false"

# full IKO documentation:
# https://docs.intersystems.com/irislatest/csp/docbook/Doc.View.cls?KEY=PAGE_deployment_iko
apiVersion: intersystems.com/v1alpha1
kind: IrisCluster
metadata:
  name: ikoplus-kubevip
  namespace: ikoplus
spec:
  imagePullSecrets:
  - name:  containers-pull-secret
  licenseKeySecret:
    name: license-key-secret
  tls:
    webgateway:
      secret:
        secretName: cert-secret
  topology:
    arbiter:
      image: containers.intersystems.com/intersystems/arbiter:2025.1
      podTemplate:
        metadata: {}
        spec:
          resources: {}
      updateStrategy: {}
    data:
      compatibilityVersion: 2025.1.0
      image: containers.intersystems.com/intersystems/irishealth:2025.1
      mirrorMap: primary,backup
      mirrored: true
      podTemplate:
        metadata: {}
        spec:
          securityContext:
            fsGroup: 51773
            runAsGroup: 51773
            runAsNonRoot: true
            runAsUser: 51773
      webgateway:
        replicas: 1
        alternativeServers: LoadBalancing
        applicationPaths:
        - /*
        ephemeral: true
        image: containers.intersystems.com/intersystems/webgateway-lockeddown:2025.1
        loginSecret:
          name: webgateway-secret
        podTemplate:
          metadata: {}
          spec:
            resources: {}
        #replicas: 1
        storageDB:
          resources: {}
        type: apache-lockeddown
        updateStrategy: {}
      storageDB:
        resources: {}
      storageJournal1:
        resources: {}
      storageJournal2:
        resources: {}
      storageWIJ:
        resources: {}
      updateStrategy: {}
  serviceTemplate:
    spec:
      type: LoadBalancer
      externalTrafficPolicy: Local
---
apiVersion: v1
kind: Namespace
metadata:
  name: ikoplus

apiVersion: v1
kind: Pod
metadata:
  name: podvip
  namespace: ikoplus
spec:
  restartPolicy: Always
  containers:
    - name: curl-loop
      image: curlimages/curl:8.10.1
      command:
        - /bin/sh
        - -c
        - |
          echo "Starting curl loop against https://192.168.1.152:52774/csp/sys/UtilHome.csp ..."
          while true; do
            status=$(curl -sk -o /dev/null -w "%{http_code}" https://192.168.1.152:52774/csp/sys/UtilHome.csp)
            echo "$(date -u) HTTP $status"
            sleep 5
          done
      resources:
        requests:
          cpu: 50m
          memory: 32Mi
        limits:
          cpu: 100m
          memory: 64Mi