Inventory

Overview

The inventory, /etc/acd/deploy/inventory.ini, lists every machine in the cluster and its role. deploy init creates it as a commented example. Edit it before the first deploy, and again whenever you add a machine.

Each machine is one line under the heading for its role:

[server]
manager-1 ansible_host=192.0.2.11
manager-2 ansible_host=192.0.2.12
manager-3 ansible_host=192.0.2.13

[agent]
manager-4 ansible_host=192.0.2.14

[director]

• The first word is the machine’s name. Use its hostname.
• ansible_host is the address deploy reaches the machine on over SSH. It does not decide which network the cluster uses: see Site Settings for that.
• Everything after a # is a comment, and indentation does not matter.

Important: The inventory also has a [director] section. Leave it empty: adding machines under [director] is not currently supported. CDN Directors run on their own machines and are listed in external_directors in Site Settings.

Roles

Servers

Servers run the Kubernetes control plane and the cluster datastore, and by default also run the CDN Manager’s workloads.

• The first server listed is the one you run deploy on. It holds the ISO and the configuration folder.
• The number of servers must be odd, so the control plane can always reach a majority. Use three for production: the cluster then survives losing any one machine. One server is enough for a lab, with no redundancy.
• deploy stops with [ACD-INVENTORY-EVEN-SERVERS] on an even number, and with [ACD-INVENTORY-NO-SERVER] if there is none.

Agents

Agents run workloads only: they add capacity, but take no part in the control plane. List any machines beyond the servers under [agent], or leave the section empty.

To add an agent to a running cluster, add its line under [agent], set up passwordless SSH to it from the first server, and run deploy again. See Changing the Cluster.

A machine cannot be listed under both [server] and [agent] ([ACD-INVENTORY-SERVER-AND-AGENT]). Changing a machine’s role on a running cluster takes a few extra steps: see Changing a Machine’s Role.

How Many of Each

• Three servers are enough for most clusters. The cluster then survives losing any one server. You are unlikely to need more than five: five servers survive losing two, and more add little except overhead.
• Add servers to improve redundancy, two at a time, since the count must stay odd.
• Add agents to expand capacity. Agents take on workloads without adding to the control plane, so they are the way to grow a cluster.

Per-Machine Options

Each option is added to the end of a machine’s line, separated by a space. None is needed for a normal installation.

node_ip and node_external_ip

The machine’s cluster address (the one other machines reach it on) and its public address (the one clients use). Both are detected automatically:

• The public address is the address of the interface holding the default route.
• The cluster address is the machine’s address inside backplane_network if that is set, and otherwise its public address.

Set them only to correct one machine where the wrong address is chosen:

manager-2 ansible_host=192.0.2.12 node_ip=10.10.0.12

Every machine’s cluster address must be on one network that all of them share. deploy stops with [ACD-BACKPLANE-SPLIT] before changing anything if they are not.

Important: These addresses are locked at the first installation. Changing one later means reinstalling the cluster. See Locked at First Install.

node_labels

Your own Kubernetes labels for the machine, as a name-and-value mapping in single quotes:

manager-1 ansible_host=192.0.2.11 node_labels='{"rack": "a1"}'

For example, zone labels for Topology Aware Hints are described in the Performance Tuning Guide.

node_taints

Keeps ordinary workloads off the machine, for a server dedicated to the control plane. The platform’s own cluster services tolerate the taint below and keep running there. The value is a list in single quotes:

manager-1 ansible_host=192.0.2.11 node_taints='["CriticalAddonsOnly=true:NoSchedule"]'

Use it only when there are enough other machines to run the workloads, for example three tainted servers and at least three agents. Never taint every machine.

ansible_user

The account deploy logs in as on this machine. The default is root. Another account needs passwordless sudo:

manager-4 ansible_host=192.0.2.14 ansible_user=operator

To change the account for every machine at once, add it under an [all:vars] heading at the end of the file:

[all:vars]
ansible_user=operator

A setting on a machine’s own line still wins for that machine.

SSH Access

deploy logs in to every machine in the inventory from the first server, the first server included, without a password prompt. For each machine, on the first server:

ssh-copy-id root@<machine address>
ssh -o BatchMode=yes root@<machine address> true

The second command must succeed without a prompt. Otherwise deploy stops with UNREACHABLE for that machine.