Install System (AWS EKS)

# general cluster
22,80,443,2379,2380,5000,6443,10250,10251,10252
# api
5005,8011,8080
# istio
15000,15001,15006,15008,15009,15010,15012,15014,15017,15020,15021,15090,15443,20001
# clickhouse
8123
# WSO2
4000,9443,9763

# set kernel parameters as required by Istio
# avoid ztunnel container restarts due to load
# append to end of file
cat <<EOF >> /etc/security/limits.conf
soft nofile 131072
hard nofile 131072
EOF
cat <<EOF >> /etc/systemd/system.conf
DefaultLimitNOFILE=131072
EOF

# kernel params for k8s
bash -c 'cat <<EOF | sudo tee /etc/modules-load.d/k8s.conf
overlay
br_netfilter
nf_nat
xt_REDIRECT
xt_owner
iptable_nat
iptable_mangle
iptable_filter
EOF'

modprobe overlay
modprobe br_netfilter
modprobe nf_nat
modprobe xt_REDIRECT
modprobe xt_owner
modprobe iptable_nat
modprobe iptable_mangle
modprobe iptable_filter

bash -c 'cat <<EOF | sudo tee /etc/sysctl.d/k8s.conf
net.bridge.bridge-nf-call-iptables  = 1
net.bridge.bridge-nf-call-ip6tables = 1
net.ipv4.ip_forward                 = 1
EOF'

sysctl --system
echo "Kernel parameters configured."

# Disable swap
echo "Disabling swap..."
swapoff -a
sed -e '/swap/s/^/#/g' -i /etc/fstab
echo "Swap disabled."

# Disable SELinux
echo "Disabling SELinux..."
sudo setenforce 0
sudo sed -i 's/^SELINUX=enforcing$/SELINUX=permissive/' /etc/selinux/config
echo "SELinux disabled."

# Configure vm.max_map_count for Elasticsearch
echo "Configuring vm.max_map_count for Elasticsearch..."
echo "vm.max_map_count=262144" | sudo tee -a /etc/sysctl.conf
echo "vm.max_map_count configured."

export RELEASE_TAG="lilt-enterprise-2025.03.11"

aws s3 sync s3://lilt-enterprise-releases/$RELEASE_TAG/ ./$RELEASE_TAG/
mkdir -p ./$RELEASE_TAG/install_dir
tar -xzf ./$RELEASE_TAG/install_packages/on-prem-installer* -C ./$RELEASE_TAG/install_dir

export AWS_ACCOUNT="1234567890"
export AWS_REGION="us-east-1"

aws ecr get-login-password --region $AWS_REGION | docker login --username AWS --password-stdin $AWS_ACCOUNT.dkr.ecr.$AWS_REGION.amazonaws.com

# Loop over all Docker image tar files
for image in $(find "./$RELEASE_TAG/docker_images" -type f); do
  echo "Processing image file: $image"

  # Load the Docker image
  loaded_image=$(docker load < "$image" | awk '/Loaded image:/ {print $3}')
  if [ -z "$loaded_image" ]; then
    echo "Failed to load image from $image, skipping..."
    continue
  fi
  echo "Loaded image: $loaded_image"
  
  # Construct the new ECR image name, replace default LILT registry
  new_image="${AWS_ACCOUNT}.dkr.ecr.${AWS_REGION}.amazonaws.com/${loaded_image#lilt-registry.local.io:80/gcr.io/lilt-service-48916b30/}"
  
  # Retag the image
  docker tag "$loaded_image" "$new_image"
  echo "Tagged $loaded_image as $new_image"

  # Push the new tagged image to ECR
  docker push "$new_image"
  echo "Pushed $new_image to ECR"
done

# create yaml
vi storageclass.yaml

# paste the following code
apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
  name: ebs-csi-gp3
parameters:
  fsType: ext4
  type: gp3
provisioner: ebs.csi.aws.com
reclaimPolicy: Delete
volumeBindingMode: WaitForFirstConsumer
allowVolumeExpansion: true

# apply yaml
kubectl apply -f sc.yaml

find /install_dir -type f -exec sed -i 's|lilt-registry.local.io:80|$AWS_ACCOUNT.dkr.ecr.$AWS_REGION.amazonaws.com|g' {} +

find /install_dir -type f -exec sed -i 's|openebs-hostpath|ebs-csi-gp3|g' {} +

kubectl label nodes worker node-type=worker

kubectl label nodes gpu capability=gpu

# open script
vi install_dir/install-lilt.sh

# comment out
# kubectl label --overwrite ns kube-flannel pod-security.kubernetes.io/enforce=privileged
# sh install_scripts/install-flannel.sh
# wait until pod ready
# kubectl wait --namespace kube-flannel --for=condition=ready pod -l app=flannel --timeout=180s

# storage class
# sh install_scripts/install-localpv-provisioner.sh
# wait until pod ready
# kubectl wait --namespace lilt --for=condition=ready pod -l app=localpv-provisioner --timeout=180s

sh install_dir/install-lilt.sh

kubectl get pods -n lilt

# Rollback to docker-registry version
helm rollback lilt 1 
# Clean-up jobs
kubectl delete jobs -n lilt --all 
# Remove statefulset PVCs, elasticsearch as an example
kubectl get pvc -n lilt | grep elasticsearch
kubectl delete pvc -n lilt <elasticsearch pvc as per previous command>