Kubernetes - Tag - Gene.Tech

Kubernetes Cluster Installation

gene.liu@live.com (Gene Liu) — Sun, 08 May 2022 00:00:00 +0000

To learn some of the details about the kubeadm toolbox, the best way is to use it to manage a k8s cluster. This includes the whole life cycle management: new installation (HA), scale up/down, and upgrade. All information was current as of May 2022.

Preparations

You will need these preparations on all of your nodes.

https://kubernetes.io/docs/setup/production-environment/tools/kubeadm/install-kubeadm/#before-you-begin I use terraform to setup 5 Ubuntu 20.04 nodes (2 vCPU, 6Gi RAM).

Kubernetes (k3s) Certs Expired

gene.liu@live.com (Gene Liu) — Tue, 19 Apr 2022 00:00:00 +0000

There is a bug in some older k3s releases that causes certificate auto-renewal to fail.

        
kubectl --insecure-skip-tls-verify=true delete secret -n kube-system k3s-serving
stop k3s
remove/backup /var/lib/rancher/k3s/server/tls/dynamic-cert.json
remove/backup /etc/rancher/k3s/k3s.yaml
restart k3s

Add Missing Indices After Nextcloud Upgrade

gene.liu@live.com (Gene Liu) — Sat, 26 Mar 2022 00:00:00 +0000

Upgrade Nextcloud

Remove all other folders except /config and /data (due to an unsuccessful major version jump upgrade).
Upgrade one major version at a time (cannot jump upgrade two major versions).

System Warning About Missing Indices

        
        
        
    
kubectl exec -it -n nextcloud nextcloud-6864c47cf4-58vrl -- /bin/sh
# sudo -u www-data php occ db:add-missing-indices
/bin/sh: 1: sudo: not found
# su www-data
This account is currently not available.
# id
uid=0(root) gid=0(root) groups=0(root),33(www-data)

# su www-data -s /bin/sh
$ php occ db:add-missing-indices
Check indices of the share table.
Check indices of the filecache table.
Adding additional size index to the filecache table, this can take some time...
Filecache table updated successfully.
Adding additional size index to the filecache table, this can take some time...
Filecache table updated successfully.
Adding additional path index to the filecache table, this can take some time...
Filecache table updated successfully.
Check indices of the twofactor_providers table.
Check indices of the login_flow_v2 table.
Check indices of the whats_new table.
Check indices of the cards table.
Adding cards_abiduri index to the cards table, this can take some time...
cards table updated successfully.
Check indices of the cards_properties table.
Check indices of the calendarobjects_props table.
Check indices of the schedulingobjects table.
Check indices of the oc_properties table.
Adding properties_pathonly_index index to the oc_properties table, this can take some time...
oc_properties table updated successfully.
Check indices of the oc_jobs table.
Adding job_lastcheck_reserved index to the oc_jobs table, this can take some time...
oc_properties table updated successfully.
$ exit
# exit

About SELinux

gene.liu@live.com (Gene Liu) — Mon, 17 Jan 2022 00:00:00 +0000

A few readings from the internet.

Docker Default Security Option

https://docs.docker.com/engine/security/seccomp/

        
        
        
    
# docker info
Client:
 Context:    default
 Debug Mode: false
 Plugins:
  app: Docker App (Docker Inc., v0.9.1-beta3)
  buildx: Build with BuildKit (Docker Inc., v0.6.1-docker)
  scan: Docker Scan (Docker Inc., v0.8.0)

Server:
 Containers: 17
  Running: 15
  Paused: 0
  Stopped: 2
 Images: 16
 Server Version: 20.10.8
 Storage Driver: overlay2
  Backing Filesystem: extfs
  Supports d_type: true
  Native Overlay Diff: true
  userxattr: false
 Logging Driver: json-file
 Cgroup Driver: systemd
 Cgroup Version: 1
 Plugins:
  Volume: local
  Network: bridge host ipvlan macvlan null overlay
  Log: awslogs fluentd gcplogs gelf journald json-file local logentries splunk syslog
 Swarm: inactive
 Runtimes: runc io.containerd.runc.v2 io.containerd.runtime.v1.linux
 Default Runtime: runc
 Init Binary: docker-init
 containerd version: e25210fe30a0a703442421b0f60afac609f950a3
 runc version: v1.0.1-0-g4144b63
 init version: de40ad0
 Security Options:
  seccomp
   Profile: default
 Kernel Version: 3.10.0-1160.42.2.el7.x86_64
 Operating System: Red Hat Enterprise Linux Server 7.9 (Maipo)
 OSType: linux
 Architecture: x86_64
 CPUs: 8
 Total Memory: 23.39GiB
 Name: gene-k8s-k8sc-node1
 ID: VGBN:P5LX:RTQG:OX67:INYM:ZUHD:W6NQ:FWWL:KUV5:NZ6N:2DKH:ZIYL
 Docker Root Dir: /opt/nsp/docker
 Debug Mode: false
  Registry: https://index.docker.io/v1/
 Labels:
 Experimental: false
 Insecure Registries:
   127.0.0.0/8
 Live Restore Enabled: false

WARNING: API is accessible on http://0.0.0.0:2375 without encryption.
         Access to the remote API is equivalent to root access on the host. Refer
         to the 'Docker daemon attack surface' section in the documentation for
         more information: https://docs.docker.com/go/attack-surface/
[root@gene-k8s-k8sc-node1 ~]# sestatus 
SELinux status:                 enabled
SELinuxfs mount:                /sys/fs/selinux
SELinux root directory:         /etc/selinux
Loaded policy name:             targeted
Current mode:                   permissive
Mode from config file:          permissive
Policy MLS status:              enabled
Policy deny_unknown status:     allowed
Max kernel policy version:      31
[root@gene-k8s-k8sc-node1 ~]# ps -eZ | grep docker
system_u:system_r:unconfined_service_t:s0 1254 ? 00:00:00 docker
system_u:system_r:container_runtime_t:s0 30862 ? 00:02:10 dockerd
system_u:system_r:container_runtime_t:s0 30976 ? 00:00:00 docker
[root@gene-k8s-k8sc-node1 ~]# docker context ls
NAME        DESCRIPTION                               DOCKER ENDPOINT               KUBERNETES ENDPOINT                ORCHESTRATOR
default *   Current DOCKER_HOST based configuration   unix:///var/run/docker.sock   https://127.0.0.1:6443 (default)   swarm

https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html

Upgrade/Update a Helm Chart

gene.liu@live.com (Gene Liu) — Sat, 27 Feb 2021 14:55:56 +0000

I have installed a few charts from ChartCenter, but I would like to switch to each chart’s original repo later on, in case ChartCenter becomes unavailable.

        
helm list -n hass
WARNING: Kubernetes configuration file is group-readable. This is insecure. Location: /etc/rancher/k3s/k3s.yaml
WARNING: Kubernetes configuration file is world-readable. This is insecure. Location: /etc/rancher/k3s/k3s.yaml
NAME     	NAMESPACE	REVISION	UPDATED                                	STATUS  	CHART               	APP VERSION
hass     	hass     	1       	2021-01-22 16:01:56.958870812 -0500 EST	deployed	home-assistant-5.4.1	2020.12.1
mosquitto	hass     	1       	2021-01-22 14:37:06.899630717 -0500 EST	deployed	mosquitto-0.7.0     	2.0.4

helm upgrade -n hass hass home-assistant --repo https://k8s-at-home.com/charts/ -f hass/hass-values.yml

Upgrade Home Assistant

gene.liu@live.com (Gene Liu) — Wed, 05 Feb 2020 00:00:00 +0000

Upgrade Home Assistant to use the latest chart and application version.

Check Existing Chart

        
helm list
NAME     	NAMESPACE	REVISION	UPDATED                                	STATUS  	CHART                	APP VERSION
emqx     	default  	1       	2020-01-15 09:50:07.876751946 -0500 EST	deployed	emqx-v4.0.0          	v4.0.0     
hass     	default  	3       	2020-01-22 14:40:55.119051419 -0500 EST	deployed	home-assistant-0.9.11	0.101.2    
nextcloud	default  	1       	2019-12-24 16:39:19.78369805 -0500 EST 	deployed	nextcloud-1.9.1      	17.0.0

Update Helm Repo

        
        
        
    
helm repo update
Hang tight while we grab the latest from your chart repositories...
...Successfully got an update from the "geneliu" chart repository
...Successfully got an update from the "emqx" chart repository
...Successfully got an update from the "stable" chart repository
Update Complete. ⎈ Happy Helming!⎈ 

Upgrade Home Assistant Chart

        
        
        
    
helm upgrade hass stable/home-assistant -f ./hass.yaml 
Release "hass" has been upgraded. Happy Helming!
NAME: hass
LAST DEPLOYED: Wed Feb  5 13:10:39 2020
NAMESPACE: default
STATUS: deployed
REVISION: 4
TEST SUITE: None
NOTES:
1. Get the application URL by running these commands:
  http://myhome.example.com/

Kubernetes as IoT Base (for Home Assistant, etc.)

gene.liu@live.com (Gene Liu) — Tue, 04 Feb 2020 00:00:00 +0000

I have quite a few applications that are already containerized and managed by Docker Compose. Maintaining the application-level Docker Compose YAML files is a minor task. However, there are a few small pieces of the puzzle that still require manual updates or upgrades from time to time. So, I’ve made the decision to migrate, and this is my first blog post documenting the process.

Install k3s

        
curl -sfL https://get.k3s.io | sh -s - --no-deploy=traefik --default-local-storage-path=/opt/k3s
# setup kubectl autocompletion
echo "source <(kubectl completion bash)" >> ~/.bashrc

I have enabled only the minimum services: