Set up our ORKA environment

[AshCripps]

Creating this issue to track the steps needed to get us set up and using the new orka environment

• Create user accounts

We want seperate accounts for test and release - should these be admin accounts? (note the email associated with them does not need to be real

• Build example VMs to test deployment
• Connect to the firewall
• Edit the firewall to allow for external connection to these vms
• Create a Release machine and create an image off it (for easier redeployment)
• Create a Test machine and create an image off it

Creating these images will save us having to ansible every machine we create as they can all be stood up with all the tools needed installed on them

• Export current Macos VMs from vSphere (This should be possible with pulling a VMDK off vSphere and importing to ORKA)

Do we want all 4 current machines replicated or one of each to ensure we have testing coverage?

• Look into kube sandboxing to allow us to make use of the kube environment to connect to the VMs (Still needs firewall edits) - https://orkadocs.macstadium.com/docs/kubernetes-sandbox

• Install jenkins plugin - https://orkadocs.macstadium.com/docs/integrating-jenkins

• Set up jenkins plugin to create empheral hosts for each test run

@rvagg @mhdawson @sam-github anything else Im missing? Also does anyone have experience with CISCO ASA firewalls? Otherwise I might take Wills offer up and ask for a sit down with one of their CISCO engineers.

[sam-github]

Do we want all 4 current machines replicated or one of each to ensure we have testing coverage?

You mean, do we have to export x-1, x-2, and x-3, or just x-1 and then spin up 3 of them in Orka? If that's the question, the latter, I suggest, is fine.

[AshCripps]

You mean, do we have to export x-1, x-2, and x-3, or just x-1 and then spin up 3 of them in Orka? If that's the question, the latter, I suggest, is fine.

More If I export 10.10-1 and 10.11-1 do we want two as both to replicate the coverage we have now or focus on having more modern machines?

[sam-github]

Get something working with 10.15 and notarization, first, healthy and happily running in our CI, then consider what's next would be my suggested order of business.

[mhdawson]

We want seperate accounts for test and release - should these be admin accounts? (note the email associated with them does not need to be real

Would making the test one not admin allow us to limit who can get at/configure the release machines?

[mhdawson]

I think you have most of the things needed. For:

Edit the firewall to allow for external connection to these vms

As discussed in the meeting if we can do this through kubernetes files we can check into github that would be good.

[AshCripps]

Would making the test one not admin allow us to limit who can get at/configure the release machines?

Potentially. Ill have to test it out.

As discussed in the meeting if we can do this through kubernetes files we can check into github that would be good.

That still requires editing the firewall to allow for those connections

[mhdawson]

@AshCripps Iassume that would be a one time enable of a range instead of having to update every time we add a new machine.

[AshCripps]

@AshCripps Iassume that would be a one time enable of a range instead of having to update every time we add a new machine.

Either way its something I have no experience with, so unless anyone here knows what to do ill ask macstadium if they can set me up with one of their engineers to help set it up and understand it

[mhdawson]

@AshCripps +1 since they offered to do that we might as well take advantage of it. If you want to invite me to the discussion with them I'm happy to help agree on what we think makes the most sense as well.

[AshCripps]

Email sent to ask for them to talk us through it

[AshCripps]

I have currently set up an ansibled a 10.15 vm inside orka which I will use to create our base image from for 10.15. ATM it is only accessible on the 10. address when logged into the VPN but hopefully this week I will be able to expose it to the outside world.

I am currently running a test build on to make sure the ansible worked properly. EDIT: Build and test passed except for known failures

[AshCripps]

Just had a meeting with macstadium, we now have a nat in place for all three of our nodes to allow us to ssh into the boxes from the outside

[AshCripps]

First PR for ORKA macs: #2253

[github-actions]

This issue is stale because it has been open many days with no activity. It will be closed soon unless the stale label is removed or a comment is made.

[AshCripps]

The ORKA environment is up and working, closing as the jenkins plugin isnt on a priority list atm but can be revisted at a later date.