带有 DNS 服务的 Libvirt/KVM

Gene Liu 发布于 2021-12-06

使用来自 libvirt 虚拟网络的 DNS 服务设置 VM。

        
        
        
    
virsh net-dumpxml default
<network xmlns:dnsmasq='http://libvirt.org/schemas/network/dnsmasq/1.0' connections='4'>
  <name>default</name>
  <uuid>4b083743-ecc0-4c96-bd79-d8c1d7dc078f</uuid>
  <forward mode='nat'>
    <nat>
      <port start='1024' end='65535'/>
    </nat>
  </forward>
  <bridge name='virbr0' stp='on' delay='0'/>
  <mac address='52:54:00:69:9b:45'/>
  <domain name='okd.local'/>
  <dns>
    <forwarder addr='8.8.8.8'/>
    <host ip='192.168.122.20'>
      <hostname>provisioner</hostname>
    </host>
    <host ip='192.168.122.21'>
      <hostname>openshift-master-0</hostname>
    </host>
    <host ip='192.168.122.22'>
      <hostname>openshift-master-1</hostname>
    </host>
    <host ip='192.168.122.23'>
      <hostname>openshift-master-2</hostname>
    </host>
    <host ip='192.168.122.24'>
      <hostname>openshift-worker-0</hostname>
    </host>
    <host ip='192.168.122.250'>
      <hostname>api</hostname>
    </host>
    <host ip='192.168.122.251'>
      <hostname>apps</hostname>
    </host>
  </dns>
  <ip address='192.168.122.1' netmask='255.255.255.0'>
    <dhcp>
      <range start='192.168.122.20' end='192.168.122.240'/>
      <host mac='52:54:00:a3:dd:03' name='provisioner.okd.local' ip='192.168.122.20'/>
      <host mac='52:54:00:90:b8:19' name='openshift-master-0.okd.local' ip='192.168.122.21'/>
      <host mac='52:54:00:34:fc:9d' name='openshift-master-1.okd.local' ip='192.168.122.22'/>
      <host mac='52:54:00:8a:db:89' name='openshift-master-2.okd.local' ip='192.168.122.23'/>
      <host mac='52:54:00:5a:7f:a4' name='openshift-worker-0.okd.local' ip='192.168.122.24'/>
    </dhcp>
  </ip>
  <dnsmasq:options>
    <dnsmasq:option value='cname=*.apps.okd.local,apps.okd.local'/>
    <dnsmasq:option value='auth-zone=apps.okd.local'/>
    <dnsmasq:option value='auth-server=apps.okd.local,*'/>
  </dnsmasq:options>
</network>

参考：

升级/更新 Helm Chart

Gene Liu 发布于 2021-02-27

我从 ChartCenter 安装了一些 chart，但想稍后切换到每个 chart 的原始仓库，以防 ChartCenter 以后不再可用。

        
helm list -n hass
WARNING: Kubernetes configuration file is group-readable. This is insecure. Location: /etc/rancher/k3s/k3s.yaml
WARNING: Kubernetes configuration file is world-readable. This is insecure. Location: /etc/rancher/k3s/k3s.yaml
NAME     	NAMESPACE	REVISION	UPDATED                                	STATUS  	CHART               	APP VERSION
hass     	hass     	1       	2021-01-22 16:01:56.958870812 -0500 EST	deployed	home-assistant-5.4.1	2020.12.1
mosquitto	hass     	1       	2021-01-22 14:37:06.899630717 -0500 EST	deployed	mosquitto-0.7.0     	2.0.4

helm upgrade -n hass hass home-assistant --repo https://k8s-at-home.com/charts/ -f hass/hass-values.yml

k8s 证书续期验证

Gene Liu 发布于 2021-02-18

更改为历史时间

        
        
        
    
/opt/pnt/venv/bin/ansible-playbook -i /opt/pnt/kubespray/inventory/nsp-deployer-default/hosts.yml /opt/pnt/kubespray/change-notes-time.yml -e new_time="2020-02-17 16:27:00"

[root@nsp-k8s-deployer ~]# cat /opt/pnt/kubespray/change-notes-time.yml 
- name: Prepare and reset the required environment for a new build
  hosts: all
  gather_facts: yes
  user: root
  vars:
    new_time: "2021-02-18 12:50:00"
  tasks:
    - name: Disable ntp
      command: "timedatectl set-ntp no"

    - name: Set the new time
      command: "timedatectl set-time '{{ new_time }}'"

    - name: Enable ntp
      command: "timedatectl set-ntp yes"

部署新集群

        
nsp-kubernetes-deployer.bash -i 135.121.159.105 -l node-labels-standard-3nodes.yml

将时间更改为现在

        
/opt/pnt/venv/bin/ansible-playbook -i /opt/pnt/kubespray/inventory/nsp-deployer-default/hosts.yml /opt/pnt/kubespray/change-notes-time.yml -e new_time="2021-02-17 16:27:00"

续期证书 (在所有主节点上)

https://v1-16.docs.kubernetes.io/docs/tasks/administer-cluster/kubeadm/kubeadm-certs/ 对于 1.16.3，renew all 似乎效果不佳。逐个续期每个组件。

Ansible from_yaml 过滤器

Gene Liu 发布于 2021-01-28

Ansible from_yaml 过滤器可用于简化带有格式的数据操作。

列表数据类型的示例：

没有过滤器

我必须同时使用 strip 和 split 函数，这很容易出错。

        
glusterfs_node_hostname_base: |
  {% for item in glusterfs_node|unique %}
  {{ hostvars[item].get('ansible_hostname') }}
  {% endfor %}

## gluster 在探测对等点时需要唯一的主机名或节点名，这里 glusterfs_node_hostname 
## 存储所有 glusterfs 节点的主机名以用于验证目的
glusterfs_node_hostname: "{{ glusterfs_node_hostname_base.strip().split('\n') | default([]) }}"

使用 `from_yaml` 过滤器

        
        
        
    
glusterfs_node_hostname_base: |
  ---
  {% for item in glusterfs_node|unique %}
  - {{ hostvars[item].get('ansible_hostname') }}
  {% endfor %}

## gluster 在探测对等点时需要唯一的主机名或节点名，这里 glusterfs_node_hostname 
## 存储所有 glusterfs 节点的主机名以用于验证目的
glusterfs_node_hostname: "{{ glusterfs_node_hostname_base | from_yaml }}"

重置/清理 Debian/Ubuntu 软件包的示例

Gene Liu 发布于 2021-01-27

通过 .deb 包安装

添加 Rancher Desktop 仓库并安装 Rancher Desktop：

        
curl https://download.opensuse.org/repositories/isv:/Rancher:/stable/deb/Release.key | sudo apt-key add -
sudo add-apt-repository 'deb https://download.opensuse.org/repositories/isv:/Rancher:/stable/deb/ ./'
sudo apt update
sudo apt install rancher-desktop

卸载 .deb 包

您可以使用以下命令删除软件包、仓库和密钥：

        
sudo apt remove --autoremove rancher-desktop
sudo add-apt-repository -r 'deb https://download.opensuse.org/repositories/isv:/Rancher:/stable/deb/ ./'
sudo apt-key del <keyid>

其中 keyid 是运行 apt-key list 时包含 isv:Rancher:stable 的行上方的行。因此，如果我有以下 Rancher Desktop Key 块：

使用自签名证书设置 Harbor

Gene Liu 发布于 2021-01-25

我之前为镜像设置了 docker-registry，并为 Helm chart 仓库设置了一个简单的 httpd 服务。大多数时候它都按预期工作，直到我们发现分层（又名前缀）chart 不起作用。解决方案是用 Harbor (2.0+) 替换上述两个服务。Harbor 是兼容 OCI 的注册表，能够提供包括 Helm chart 在内的符合 OCI 的工件（需要 Helm 3.0+）。