Immutable OS Fedora CoreOS SaaS Architecture

Immutable OS + SaaS Architecture

Immutable OS Fedora CoreOS SaaS Container Kubernetes Ignition Auto-update rpm-ostree Production Infrastructure

Ignition Configuration

# === Butane Config (YAML) → Ignition (JSON) ===

# config.bu (Butane format)
# variant: fcos
# version: "1.5.0"
# passwd:
#   users:
#     - name: core
#       ssh_authorized_keys:
#         - "ssh-ed25519 AAAA... admin@company.com"
#     - name: deploy
#       ssh_authorized_keys:
#         - "ssh-ed25519 AAAA... deploy@ci.company.com"
#
# storage:
#   files:
#     - path: /etc/hostname
#       mode: 0644
#       contents:
#         inline: "k8s-node-01"
#     - path: /etc/zincati/config.d/55-updates-strategy.toml
#       mode: 0644
#       contents:
#         inline: |
#           [updates]
#           strategy = "periodic"
#           [[updates.periodic.window]]
#           days = ["Sat"]
#           start_time = "02:00"
#           length_minutes = 120
#
# systemd:
#   units:
#     - name: podman-app.service
#       enabled: true
#       contents: |
#         [Unit]
#         Description=App Container
#         After=network-online.target
#         [Service]
#         Restart=always
#         ExecStartPre=-/usr/bin/podman pull registry.company.com/app:latest
#         ExecStart=/usr/bin/podman run --rm --name app -p 8080:8080 registry.company.com/app:latest
#         ExecStop=/usr/bin/podman stop app
#         [Install]
#         WantedBy=multi-user.target

# Convert: butane --strict config.bu > config.ign

from dataclasses import dataclass

@dataclass
class IgnitionSection:
    section: str
    purpose: str
    example: str
    production_tip: str

sections = [
    IgnitionSection("passwd.users",
        "สร้าง User และ SSH Key",
        "core user + deploy user + SSH authorized_keys",
        "ใช้ SSH Key เท่านั้น ไม่ใช้ Password"),
    IgnitionSection("storage.files",
        "เขียนไฟล์ Config ลงระบบ",
        "hostname, zincati config, sysctl, containerd config",
        "ใส่ทุก Config ที่ต้องการ ไม่ SSH เข้าไปแก้"),
    IgnitionSection("storage.disks",
        "Partition และ Format Disk",
        "Data disk สำหรับ Container Storage",
        "แยก Disk สำหรับ /var/lib/containers"),
    IgnitionSection("systemd.units",
        "สร้าง Systemd Service",
        "Container service, monitoring agent",
        "ใช้ Podman Quadlet สำหรับ Container"),
    IgnitionSection("networkd",
        "ตั้งค่า Network",
        "Static IP, VLAN, Bond, DNS",
        "Production ใช้ Static IP เสมอ"),
]

print("=== Ignition Sections ===")
for s in sections:
    print(f"  [{s.section}] {s.purpose}")
    print(f"    Example: {s.example}")
    print(f"    Tip: {s.production_tip}")

SaaS Infrastructure

# === SaaS Architecture with FCOS ===

@dataclass
class InfraComponent:
    component: str
    implementation: str
    fcos_config: str
    scaling: str
    monitoring: str

components = [
    InfraComponent("Kubernetes Control Plane",
        "3x FCOS nodes with kubeadm/k3s",
        "Ignition: etcd data disk, kubelet config, API server",
        "Fixed 3 nodes (HA) ไม่ Scale",
        "etcd health, API server latency, cert expiry"),
    InfraComponent("Worker Nodes",
        "N x FCOS nodes (Auto-scaling Group)",
        "Ignition: kubelet join config, container runtime",
        "HPA: 3-50 nodes ตาม Workload",
        "CPU/Memory utilization, Pod scheduling"),
    InfraComponent("Container Registry",
        "Harbor on FCOS / ECR / GCR",
        "Ignition: Harbor container + storage",
        "Single instance + S3 backend",
        "Storage usage, pull latency, vulnerability scan"),
    InfraComponent("Monitoring Stack",
        "Prometheus + Grafana on FCOS",
        "Ignition: Prometheus + Grafana containers",
        "Fixed dedicated nodes",
        "Self-monitoring: scrape targets, storage"),
    InfraComponent("Load Balancer",
        "HAProxy/Nginx on FCOS or Cloud LB",
        "Ignition: HAProxy config, SSL certs",
        "2 nodes Active-Passive HA",
        "Connection count, latency, error rate"),
]

print("=== SaaS Infrastructure ===")
for c in components:
    print(f"  [{c.component}] {c.implementation}")
    print(f"    FCOS: {c.fcos_config}")
    print(f"    Scale: {c.scaling}")
    print(f"    Monitor: {c.monitoring}")

Operations

# === Day-2 Operations ===

# OS Update (automatic via Zincati)
# rpm-ostree status           # ดู Current + Previous deployment
# rpm-ostree upgrade          # Manual upgrade
# rpm-ostree rollback         # Rollback to previous version
# systemctl status zincati    # Check auto-update status

# Container Management
# podman ps -a                # List containers
# podman logs app             # View logs
# podman pull registry/app:v2 # Pull new version
# systemctl restart podman-app.service  # Restart service

@dataclass
class OpsTask:
    task: str
    frequency: str
    method: str
    automation: str
    rollback: str

tasks = [
    OpsTask("OS Update",
        "ทุกสัปดาห์ (Auto via Zincati)",
        "Zincati auto-update Saturday 02:00",
        "Zincati + FleetLock (Kubernetes drain ก่อน reboot)",
        "rpm-ostree rollback ทันที"),
    OpsTask("Container Update",
        "ทุก Release (CI/CD)",
        "Kubernetes Rolling Update / Podman pull",
        "CI/CD Pipeline → Registry → Deploy",
        "Rollback to previous image tag"),
    OpsTask("Certificate Renewal",
        "ทุก 60-90 วัน",
        "cert-manager (K8s) / Certbot (standalone)",
        "cert-manager auto-renew",
        "N/A (renew ใหม่)"),
    OpsTask("Backup",
        "ทุกวัน",
        "etcd snapshot + PV backup to S3",
        "CronJob in Kubernetes",
        "Restore from snapshot"),
    OpsTask("Node Replacement",
        "เมื่อมีปัญหา",
        "Drain → Delete → Create new with same Ignition",
        "Terraform/Pulumi auto-recreate",
        "Ignition Config สร้างเครื่องใหม่เหมือนเดิม"),
]

print("=== Operations ===")
for t in tasks:
    print(f"  [{t.task}] Frequency: {t.frequency}")
    print(f"    Method: {t.method}")
    print(f"    Automation: {t.automation}")
    print(f"    Rollback: {t.rollback}")

เคล็ดลับ

• Ignition: ใส่ทุก Config ใน Ignition อย่า SSH เข้าไปแก้ด้วยมือ
• Zincati: ตั้ง Update Window นอกเวลา Peak ใช้ FleetLock กับ Kubernetes
• Rollback: ทดสอบ Rollback ให้แน่ใจว่าทำได้จริง ก่อน Production
• Cattle: ถ้า Node มีปัญหา ลบสร้างใหม่ อย่าซ่อม
• GitOps: เก็บ Ignition Config ใน Git ทุก Change ต้อง Review

Immutable OS คืออะไร

Root Filesystem Read-only ปลอดภัย Consistent Reproducible Atomic Update Rollback Fedora CoreOS Flatcar Bottlerocket Talos NixOS

สรุป

Immutable OS Fedora CoreOS SaaS Ignition rpm-ostree Zincati Auto-update Container Kubernetes GitOps Cattle Infrastructure Production