Skip to main content

Place sandboxes with CN traits and labels

This guide sets compute node (CN) traits so that sandboxes and VMs land where you want them. Pick one of three layouts: sandbox-only nodes, VM-only nodes, or mixed nodes. For the rule and the trade-offs, see Sandbox nodes.

Run every command on an operator workstation with a configured tritonadm. <CN> is a hostname, UUID, or UUID prefix.

warning

Platform zones (NAT gateways, SSH relays, load balancers, NAS gateways) place like VMs with no package traits. Keep at least one CN that takes placement.default_vm_traits, or a VPC gets no NAT gateway and sandbox egress fails.

See the current traits​

tritonadm cn traits show <CN>

The output shows the CN's traits and labels. tritonadm cn list shows the traits of every CN.

Layout 1: sandbox-only nodes​

Give each sandbox CN the trait that the seeded sandbox packages carry:

tritonadm cn traits set <CN> sandbox=true

Sandboxes now go only to these CNs. VMs go only to CNs with no traits. The seeded packages need no change.

Layout 2: VM-only nodes​

Leave the CN with no traits. To remove traits it already has:

tritonadm cn traits unset <CN> sandbox pool

The CN takes free-form VMs and packages with no traits, and no sandbox.

Layout 3: mixed nodes​

  1. Give the CN a list trait:

    tritonadm cn traits set <CN> 'pool=[vm,sandbox]'

  2. Give each sandbox package one member. An update replaces every field, and --description and --group default to empty, so give them all:

    tritonadm silo package update <SILO> --name sandbox-2g --kind sandbox \
      --cpu 2 --memory-bytes 2147483648 --disk-bytes 8589934592 --trait pool=sandbox \
      --group sandbox --description 'Sandbox: 2 vCPU, 2 GiB memory, 8 GiB disk'

    Do the same for sandbox-4g and sandbox-8g, each with its own sizes and description.

  3. Give each VM package the other member, with all its fields and --trait pool=vm.

  4. Send free-form VMs and platform zones to pool=vm:

    tritonadm config set placement.default_vm_traits '{"pool":"vm"}'

A CN with only pool=vm takes VMs and no sandbox.

Check placement​

  1. Create a sandbox as a tenant:

    tritonctl sandbox create --package sandbox-2g --ttl 10m

  2. Confirm which CN it landed on:

    tritonadm instance list --cn <CN>

  3. Do the same for a VM create, on a VM CN.

A refused placement names the trait in the explain report, under cn-traits-match.

Set labels​

Labels select a CN and never reserve it. Use them for the NoCloud build tag and for the capacity view:

tritonadm cn label set <CN> rack=r12 cluster=east
tritonadm cn label unset <CN> rack

label set merges the pairs into the CN's labels.

Roll back​

  1. Remove the traits on every CN with tritonadm cn traits unset <CN> <KEY>....

  2. Set each package's traits back with tritonadm silo package update.

  3. Reset the VM default:

    tritonadm config reset placement.default_vm_traits

See also​