Libvirt/KVM with DNS Service

Gene Liu published on 2021-12-06

Setup VMs with DNS service from the libvirt virtual network.

        
        
        
    
virsh net-dumpxml default
<network xmlns:dnsmasq='http://libvirt.org/schemas/network/dnsmasq/1.0' connections='4'>
  <name>default</name>
  <uuid>4b083743-ecc0-4c96-bd79-d8c1d7dc078f</uuid>
  <forward mode='nat'>
    <nat>
      <port start='1024' end='65535'/>
    </nat>
  </forward>
  <bridge name='virbr0' stp='on' delay='0'/>
  <mac address='52:54:00:69:9b:45'/>
  <domain name='okd.local'/>
  <dns>
    <forwarder addr='8.8.8.8'/>
    <host ip='192.168.122.20'>
      <hostname>provisioner</hostname>
    </host>
    <host ip='192.168.122.21'>
      <hostname>openshift-master-0</hostname>
    </host>
    <host ip='192.168.122.22'>
      <hostname>openshift-master-1</hostname>
    </host>
    <host ip='192.168.122.23'>
      <hostname>openshift-master-2</hostname>
    </host>
    <host ip='192.168.122.24'>
      <hostname>openshift-worker-0</hostname>
    </host>
    <host ip='192.168.122.250'>
      <hostname>api</hostname>
    </host>
    <host ip='192.168.122.251'>
      <hostname>apps</hostname>
    </host>
  </dns>
  <ip address='192.168.122.1' netmask='255.255.255.0'>
    <dhcp>
      <range start='192.168.122.20' end='192.168.122.240'/>
      <host mac='52:54:00:a3:dd:03' name='provisioner.okd.local' ip='192.168.122.20'/>
      <host mac='52:54:00:90:b8:19' name='openshift-master-0.okd.local' ip='192.168.122.21'/>
      <host mac='52:54:00:34:fc:9d' name='openshift-master-1.okd.local' ip='192.168.122.22'/>
      <host mac='52:54:00:8a:db:89' name='openshift-master-2.okd.local' ip='192.168.122.23'/>
      <host mac='52:54:00:5a:7f:a4' name='openshift-worker-0.okd.local' ip='192.168.122.24'/>
    </dhcp>
  </ip>
  <dnsmasq:options>
    <dnsmasq:option value='cname=*.apps.okd.local,apps.okd.local'/>
    <dnsmasq:option value='auth-zone=apps.okd.local'/>
    <dnsmasq:option value='auth-server=apps.okd.local,*'/>
  </dnsmasq:options>
</network>

Reference:

Upgrade/Update a Helm Chart

Gene Liu published on 2021-02-27

I have installed a few charts from ChartCenter, but I would like to switch to each chart’s original repo later on, in case ChartCenter becomes unavailable.

        
helm list -n hass
WARNING: Kubernetes configuration file is group-readable. This is insecure. Location: /etc/rancher/k3s/k3s.yaml
WARNING: Kubernetes configuration file is world-readable. This is insecure. Location: /etc/rancher/k3s/k3s.yaml
NAME     	NAMESPACE	REVISION	UPDATED                                	STATUS  	CHART               	APP VERSION
hass     	hass     	1       	2021-01-22 16:01:56.958870812 -0500 EST	deployed	home-assistant-5.4.1	2020.12.1
mosquitto	hass     	1       	2021-01-22 14:37:06.899630717 -0500 EST	deployed	mosquitto-0.7.0     	2.0.4

helm upgrade -n hass hass home-assistant --repo https://k8s-at-home.com/charts/ -f hass/hass-values.yml

k8s Certificates Renewal Verification

Gene Liu published on 2021-02-18

Change to a Past Time

        
        
        
    
/opt/pnt/venv/bin/ansible-playbook -i /opt/pnt/kubespray/inventory/nsp-deployer-default/hosts.yml /opt/pnt/kubespray/change-notes-time.yml -e new_time="2020-02-17 16:27:00"

[root@nsp-k8s-deployer ~]# cat /opt/pnt/kubespray/change-notes-time.yml 
- name: Prepare and reset the required environment for a new build
  hosts: all
  gather_facts: yes
  user: root
  vars:
    new_time: "2021-02-18 12:50:00"
  tasks:
    - name: Disable ntp
      command: "timedatectl set-ntp no"

    - name: Set the new time
      command: "timedatectl set-time '{{ new_time }}'"

    - name: Enable ntp
      command: "timedatectl set-ntp yes"

Deploy a New Cluster

        
nsp-kubernetes-deployer.bash -i 135.121.159.105 -l node-labels-standard-3nodes.yml

Change Time to Now

        
/opt/pnt/venv/bin/ansible-playbook -i /opt/pnt/kubespray/inventory/nsp-deployer-default/hosts.yml /opt/pnt/kubespray/change-notes-time.yml -e new_time="2021-02-17 16:27:00"

Renew Certificates (On All Master Nodes)

https://v1-16.docs.kubernetes.io/docs/tasks/administer-cluster/kubeadm/kubeadm-certs/ For 1.16.3, somehow renew all does not work well. Renew each component one-by-one.

Ansible from_yaml Filter

Gene Liu published on 2021-01-28

The Ansible from_yaml filter can be used to simplify data manipulation with formatted data.

An example of the list data type:

Without a filter

I have to use both strip and split functions, which is error-prone.

        
glusterfs_node_hostname_base: |
  {% for item in glusterfs_node|unique %}
  {{ hostvars[item].get('ansible_hostname') }}
  {% endfor %}

## gluster requires unique hostname or nodename while probing peers, here glusterfs_node_hostname 
## stores all glusterfs node's hostname for a validation purpose
glusterfs_node_hostname: "{{ glusterfs_node_hostname_base.strip().split('\n') | default([]) }}"

With `from_yaml` filter

        
        
        
    
glusterfs_node_hostname_base: |
  ---
  {% for item in glusterfs_node|unique %}
  - {{ hostvars[item].get('ansible_hostname') }}
  {% endfor %}

## gluster requires unique hostname or nodename while probing peers, here glusterfs_node_hostname 
## stores all glusterfs node's hostname for a validation purpose
glusterfs_node_hostname: "{{ glusterfs_node_hostname_base | from_yaml }}"

Example of Reset/Cleanup Debian/Ubuntu Packages

Gene Liu published on 2021-01-27

Installation via .deb Package

Add the Rancher Desktop repository and install Rancher Desktop with:

        
curl https://download.opensuse.org/repositories/isv:/Rancher:/stable/deb/Release.key | sudo apt-key add -
sudo add-apt-repository 'deb https://download.opensuse.org/repositories/isv:/Rancher:/stable/deb/ ./'
sudo apt update
sudo apt install rancher-desktop

Uninstalling .deb Package

You can remove the package, repository, and key with:

        
sudo apt remove --autoremove rancher-desktop
sudo add-apt-repository -r 'deb https://download.opensuse.org/repositories/isv:/Rancher:/stable/deb/ ./'
sudo apt-key del <keyid>

Where keyid is the line above the one containing isv:Rancher:stable when you run apt-key list. So if I have the following block for the Rancher Desktop Key:

Setup Harbor with Self-Signed Certificates

Gene Liu published on 2021-01-25

I previously had a docker-registry setup for images and a simple httpd service for a Helm chart repo. It worked as expected most of the time until we found that a layered (aka prefix) chart does not work. The solution is to replace the above two services with Harbor (2.0+). Harbor is an OCI-compliant registry capable of serving OCI-compliant artifacts, including Helm charts (requires Helm 3.0+).

The general setup should work with other Ingress controllers like Nginx/nginx-ingress.