IKO Plus: VIP in Kubernetes on IrisClusters

#!/usr/bin/env bash
set -e

PARENT_NIC="eno1"         # if dynamic
VIP_IP="192.168.1.152/32" # available address on our lan

sudo bash -c "cat > /etc/systemd/system/vip0.service <<'EOF'
[Unit]
Description=Virtual interface vip0 for kube-vip
After=network-online.target
Wants=network-online.target

[Service]
Type=oneshot
ExecStartPre=-/sbin/ip link delete vip0
ExecStart=/sbin/ip link add vip0 link ${PARENT_NIC} type macvlan mode bridge
ExecStart=/sbin/ip addr add ${VIP_IP} dev vip0
ExecStart=/sbin/ip link set vip0 up
RemainAfterExit=yes

ExecStop=/sbin/ip link set vip0 down
ExecStop=/sbin/ip link delete vip0

[Install]
WantedBy=multi-user.target
EOF"

sudo systemctl daemon-reload
sudo systemctl enable vip0 --now
sudo systemctl status vip0 --no-pager

​
#!/usr/bin/env bash
set -e

PARENT_NIC="enps05"         # if dynamic
VIP_IP="192.168.1.152/32" # available address on our lan

sudo bash -c "cat > /etc/systemd/system/vip0.service <<'EOF'
[Unit]
Description=Virtual interface vip0 for kube-vip
After=network-online.target
Wants=network-online.target

[Service]
Type=oneshot
ExecStartPre=-/sbin/ip link delete vip0
ExecStart=/sbin/ip link add vip0 link ${PARENT_NIC} type macvlan mode bridge
ExecStart=/sbin/ip addr add ${VIP_IP} dev vip0
ExecStart=/sbin/ip link set vip0 up
RemainAfterExit=yes

ExecStop=/sbin/ip link set vip0 down
ExecStop=/sbin/ip link delete vip0

[Install]
WantedBy=multi-user.target
EOF"

sudo systemctl daemon-reload
sudo systemctl enable vip0 --now
sudo systemctl status vip0 --no-pager


​

apiVersion:v1kind:ServiceAccountmetadata:  name:kube-vip  namespace:kube-system---apiVersion:rbac.authorization.k8s.io/v1kind:ClusterRolemetadata:  name:kube-viprules:  - apiGroups:[""]    resources:["services","services/status","endpoints","nodes","pods","configmaps"]    verbs:["get","list","watch","update","patch","create"]  - apiGroups:["coordination.k8s.io"]    resources:["leases"]    verbs:["get","list","watch","create","update","patch"]  - apiGroups:["discovery.k8s.io"]    resources:["endpointslices"]    verbs:["get","list","watch"]---apiVersion:rbac.authorization.k8s.io/v1kind:ClusterRoleBindingmetadata:  name:kube-viproleRef:  apiGroup:rbac.authorization.k8s.io  kind:ClusterRole  name:kube-vipsubjects:  - kind:ServiceAccount    name:kube-vip    namespace:kube-system#---# (Optional) a tiny IP pool; you can also skip this and use per-Service annotation# apiVersion: v1# kind: ConfigMap# metadata:#  name: kubevip#  namespace: kube-system#data:#  range-global: "192.168.1.152-192.168.1.152"   ### Your VIP (or a range) for the IrisCluster !!!!---apiVersion:apps/v1kind:DaemonSetmetadata:  name:kube-vip  namespace:kube-systemspec:  selector:    matchLabels:      app:kube-vip  template:    metadata:      labels:        app:kube-vip    spec:      serviceAccountName:kube-vip      hostNetwork:true      tolerations:        - operator:"Exists"      containers:        - name:kube-vip          image:ghcr.io/kube-vip/kube-vip:v0.8.0          args:["manager"]          securityContext:            capabilities:              add:["NET_ADMIN","NET_RAW"]          env:            - name:vip_interface#### Your VIP interface on Nodes for the IrisCluster !!!!              value:"vip0"            - name:vip_cidr              value:"32"            - name:vip_arp# ARP advertising (L2)              value:"true"            - name:bgp_enable              value:"false"            - name:lb_enable# kube-vip LB controller              value:"true"            - name:svc_enable# watch Services of type LoadBalancer              value:"true"            - name:cp_enable# NOT using API server VIP here              value:"false"

# full IKO documentation:# https://docs.intersystems.com/irislatest/csp/docbook/Doc.View.cls?KEY=PAGE_deployment_ikoapiVersion:intersystems.com/v1alpha1kind:IrisClustermetadata:  name:ikoplus-kubevip  namespace:ikoplusspec:  imagePullSecrets:  - name:containers-pull-secret  licenseKeySecret:    name:license-key-secret  tls:    webgateway:      secret:        secretName:cert-secret  topology:    arbiter:      image:containers.intersystems.com/intersystems/arbiter:2025.1      podTemplate:        metadata:{}        spec:          resources:{}      updateStrategy:{}    data:      compatibilityVersion:2025.1.0      image:containers.intersystems.com/intersystems/irishealth:2025.1      mirrorMap:primary,backup      mirrored:true      podTemplate:        metadata:{}        spec:          securityContext:            fsGroup:51773            runAsGroup:51773            runAsNonRoot:true            runAsUser:51773      webgateway:        replicas:1        alternativeServers:LoadBalancing        applicationPaths:        -/*        ephemeral:true        image:containers.intersystems.com/intersystems/webgateway-lockeddown:2025.1        loginSecret:          name:webgateway-secret        podTemplate:          metadata:{}          spec:            resources:{}#replicas: 1        storageDB:          resources:{}        type:apache-lockeddown        updateStrategy:{}      storageDB:        resources:{}      storageJournal1:        resources:{}      storageJournal2:        resources:{}      storageWIJ:        resources:{}      updateStrategy:{}  serviceTemplate:    spec:      type:LoadBalancer      externalTrafficPolicy:Local---apiVersion:v1kind:Namespacemetadata:  name:ikoplus

apiVersion:v1kind:Podmetadata:  name:podvip  namespace:ikoplusspec:  restartPolicy:Always  containers:    - name:curl-loop      image:curlimages/curl:8.10.1      command:        -/bin/sh        --c        -|
          echo "Starting curl loop against https://192.168.1.152:52774/csp/sys/UtilHome.csp ..."
          while true; do
            status=$(curl -sk -o /dev/null -w "%{http_code}" https://192.168.1.152:52774/csp/sys/UtilHome.csp)
            echo "$(date -u) HTTP $status"
            sleep 5
          done
      resources:        requests:          cpu:50m          memory:32Mi        limits:          cpu:100m          memory:64Mi