Sergey Chulanov's site
Posts Tags Categories Series About me
Sergey Chulanov's site
Sergey Chulanov
My notes to remember

Generating self-signed certificates

Sergey Chulanov published on  included in Linux Devops Guide

Tested on: Ubuntu 22.04

At first, let’s set environment variables

DOMAIN=mongodb
SUBJ="/CN=Local trust issuer"
# format:
# SUBJ="/C=RU/ST=someobl/L=somecity/O=somecompany/CN=$DOMAIN"

Get a Certificate Authority certificate

openssl genrsa -out rootCA.key 4096
openssl req -x509 -new -nodes -key rootCA.key \
  -sha256 -days 1024 -subj "$SUBJ" -out rootCA.pem

Now we have public and private keys: rootCA.key and rootCA.pem. Let’s get information about our root Certificate Authority certificate:

Read More
 Tls

k8s rbac

Sergey Chulanov published on  included in Devops K8s

Script to create cluster-admin and approve trough k8s-cluster:

K8S_USER=your_user
GROUP=cluster-admin

openssl genrsa -out "$K8S_USER.key" 2048

openssl req -new -key "$K8S_USER.key" \
  -out "$K8S_USER.csr" \
  -subj "/CN=$K8S_USER/O=$GROUP"

openssl req -in "$K8S_USER.csr" -noout -text

BASE64_CSR=$(cat ./$K8S_USER.csr | base64 -w0 )

cat <<EOF | kubectl apply -f-
apiVersion: certificates.k8s.io/v1
kind: CertificateSigningRequest
metadata:
  name: $K8S_USER
spec:
  request: ${BASE64_CSR}
  signerName: kubernetes.io/kube-apiserver-client
  expirationSeconds: 31536000 # 1 year
  usages:
    - client auth
EOF

kubectl certificate approve $K8S_USER

kubectl get csr $K8S_USER -o jsonpath='{.status.certificate}' \
| base64 --decode > ${K8S_USER}.crt

kubectl get cm kube-root-ca.crt -o jsonpath="{['data']['ca\.crt']}" \
  > ca.crt

cat <<EOF | kubectl apply -f-
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: akkuyu:${K8S_USER}
subjects:
- kind: User
  name: ${K8S_USER}
  apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: ClusterRole
  name: cluster-admin
  apiGroup: rbac.authorization.k8s.io
EOF

# to disable, just delete clusterrolebinding
# kubectl delete ClusterRoleBinding tpetrov@akkuyu.com

### Generate KUBECONFIG
SERVER_ADDR_PORT=https://10.125.22.89:6443
CLUSTER_NAME=test

kubectl --kubeconfig ./$K8S_USER.yaml config set-credentials $K8S_USER \
  --client-certificate=./$K8S_USER.crt \
  --client-key=./$K8S_USER.key

kubectl --kubeconfig ./$K8S_USER.yaml config set-context $K8S_USER-$CLUSTER_NAME \
  --cluster=$CLUSTER_NAME --user=$K8S_USER

kubectl --kubeconfig ./$K8S_USER.yaml config use-context $K8S_USER-$CLUSTER_NAME

kubectl --kubeconfig ./$K8S_USER.yaml config set-cluster $CLUSTER_NAME --server=$SERVER_ADDR_PORT --certificate-authority=./ca.crt

export KUBECONFIG=./$K8S_USER.yaml

Based on a good person’s article

Read More
 K8s, Rbac, Krew

Install k3s with metallb

Sergey Chulanov published on  included in Linux Devops

Requirements

https://docs.k3s.io/installation/requirements

Spec Minimum Recommended
CPU 1 core 2 cores
RAM 512 MB 1 GB

Create cluster with 3 workers:

# map 443 and 80 ports to ethernet on node
k3d cluster create mycluster --agents 3 -p "443:443@loadbalancer" -p "80:80@loadbalancer" -p "8000:8000@loadbalancer" --wait
# k3d cluster create mycluster --agents 3 --k3s-arg "--disable=traefik@server:0" --wait
k cluster-info                                 
  Kubernetes control plane is running at https://0.0.0.0:39973
  CoreDNS is running at https://0.0.0.0:39973/api/v1/namespaces/kube-system/services/kube-dns:dns/proxy
  Metrics-server is running at https://0.0.0.0:39973/api/v1/namespaces/kube-system/services/https:metrics-server:https/proxy
k get nodes -o wide
  NAME                     STATUS   ROLES                  AGE   VERSION        INTERNAL-IP   EXTERNAL-IP   OS-IMAGE   KERNEL-VERSION      CONTAINER-RUNTIME
  k3d-mycluster-server-0   Ready    control-plane,master   42s   v1.26.4+k3s1   172.18.0.2    <none>        K3s dev    5.19.0-46-generic   containerd://1.6.19-k3s1
  k3d-mycluster-agent-0    Ready    <none>                 38s   v1.26.4+k3s1   172.18.0.4    <none>        K3s dev    5.19.0-46-generic   containerd://1.6.19-k3s1
  k3d-mycluster-agent-1    Ready    <none>                 37s   v1.26.4+k3s1   172.18.0.3    <none>        K3s dev    5.19.0-46-generic   containerd://1.6.19-k3s1
  k3d-mycluster-agent-2    Ready    <none>                 37s   v1.26.4+k3s1   172.18.0.5    <none>        K3s dev    5.19.0-46-generic   containerd://1.6.19-k3s1

MetalLB:

https://artifacthub.io/packages/helm/metallb/metallb?modal=install

Read More
 K3s, Go-Templates, Metallb, Traefik, Ingress, Tls

Creating link for gnome application launcher

Sergey Chulanov published on  included in Linux

| Ubuntu 22.04

Xelis wallet

Download the package and extract:

VER=0.0.2
curl -Lo /tmp/genesix_linux.zip https://github.com/xelis-project/xelis-genesix-wallet/releases/download/$VER/genesix_linux.zip
unzip -d ~/Apps/xel/ /tmp/genesix_linux.zip

We can download the icon and put it here as we will need to make desktop icon later For example save it from https://xelis.io/favicon.ico on /home/goto/Apps/xel/ with name favicon.ico

Read More
 Gnome

How to check disk write and read speed

Sergey Chulanov published on  included in Linux

I have k8s cluster and ceph cluster are connected to each other. Both are built on HDD. Let’s name them hdd-cluster. Also, I have k8s cluster and ceph cluster are built on SSD. They are connected to each other. Let’s name them ssd-cluster

Ok, we have

  • hdd-cluster: the first k8s cluster can create persistentVolume from ceph(hdd)
  • ssd-cluster: the second k8s cluster can create persistentVolume from ceph(ssd)

Let’s create pod connected with pv. Do it for each cluster.

Read More
 Dd, Fio, K8s

Obtain keycloak token

Sergey Chulanov published on  included in Linux Devops

Prepare info.json with data of your app:

{
  "host": "keycloak.your.domain.com",
  "realm": "your-realm-name",
  "username": "admin",
  "password": "admin123",
  "clientid": "name-of-your-client",
  "client_secret": "client_secret"
}

Prepare script.sh:

#!/usr/bin/env bash

set -eou pipefail

HOST=$(cat $1 | jq -r .host)
REALM=$(cat $1 | jq -r .realm)
USERNAME=$(cat $1 | jq -r .username)
PASSWORD=$(cat $1 | jq -r .password)
CLIENTID=$(cat $1 | jq -r .clientid)
CLIENTSECRET=$(cat $1 | jq -r .client_secret)

curl -s -X POST \
    https://$HOST/realms/$REALM/protocol/openid-connect/token \
    -H 'Content-Type: application/x-www-form-urlencoded' \
    -d username=$USERNAME \
    -d password=$PASSWORD \
    -d grant_type=password \
    -d client_id=$CLIENTID \
    -d client_secret=$CLIENTSECRET

And run:

Read More
 Keycloak