Devops - 标签 - Gene.Tech

在华硕路由器 (AC56U) 上安装 AdGuardHome

gene.liu@live.com (Gene Liu) — Sat, 12 Feb 2022 00:00:00 +0000

下载并刷入 Asuswrt-Merlin 固件 (v384.6)

https://www.asuswrt-merlin.net/ https://sourceforge.net/projects/asuswrt-merlin/files/RT-AC56U/Release/RT-AC56U_384.6_0.zip/download

准备 USB 驱动器

通过 SSH 登录到路由器 (ssh admin@router_ip)
fdisk /dev/sda
mkfs.ext3 /dev/sda[1,2]

启用 JFFS 自定义脚本和配置

Administration -> System -> Persistent JFFS2 partition -> Enable JFFS custom scripts and configs (‘yes’)

执行 Entware-Setup 以在 USB 驱动器上启用 /opt 挂载

新刷入的固件 (v384.6) 已经包含 entware-setup.sh。供参考：https://github.com/RMerl/asuswrt-merlin/blob/master/release/src/router/others/entware-setup.sh

vsftpd 访问 NFS 共享目录

gene.liu@live.com (Gene Liu) — Tue, 08 Feb 2022 00:00:00 +0000

问题

当将文件放入 NFS 共享目录时，出现 “Access failed: 553 Could not create file.” 错误。

解决方案

setsebool -P ftpd_full_access 1
确保挂载的目录具有正确的所有权。

添加 GitLab CI Runner

gene.liu@live.com (Gene Liu) — Thu, 20 Jan 2022 00:00:00 +0000

设置标准的 RHEL/AlmaLinux 8.5 VM

Docker 代理设置：

        
cat /etc/systemd/system/docker.service.d/http-proxy.conf 
[Service]
Environment="HTTP_PROXY=http://proxy.lbs.alcatel-lucent.com:8000" "HTTPS_PROXY=http://proxy.lbs.alcatel-lucent.com:8000" "NO_PROXY=orbw-artifactory.ca.alcatel-lucent.com"

不安全（私有）注册表：

        
cat /etc/docker/daemon.json 
{
    "insecure-registries" : [ "orbw-artifactory.ca.alcatel-lucent.com:8081" ]
}

安装 GitLab Runner

        
docker run -d --name gitlab-runner --restart always -v /home/cloud-user/config:/etc/gitlab-runner -v /var/run/docker.sock:/var/run/docker.sock orbw-artifactory.ca.alcatel-lucent.com:8081/nokia-nsp-docker-virtual/gitlab/gitlab-runner:latest

GitLab Runner 注册

        
docker run --rm -it -v /home/cloud-user/config:/etc/gitlab-runner orbw-artifactory.ca.alcatel-lucent.com:8081/nokia-nsp-docker-virtual/gitlab/gitlab-runner:latest register

配置示例：

使用 wget 下载文件列表

gene.liu@live.com (Gene Liu) — Wed, 19 Jan 2022 00:00:00 +0000

使用 wget 下载文件列表：

wget -x -P /data/temp/files --no-host-directories -i /data/temp/file.txt

关于 SELinux

gene.liu@live.com (Gene Liu) — Mon, 17 Jan 2022 00:00:00 +0000

来自互联网的一些阅读材料。

Docker 默认安全选项

https://docs.docker.com/engine/security/seccomp/

        
        
        
    
# docker info
Client:
 Context:    default
 Debug Mode: false
 Plugins:
  app: Docker App (Docker Inc., v0.9.1-beta3)
  buildx: Build with BuildKit (Docker Inc., v0.6.1-docker)
  scan: Docker Scan (Docker Inc., v0.8.0)

Server:
 Containers: 17
  Running: 15
  Paused: 0
  Stopped: 2
 Images: 16
 Server Version: 20.10.8
 Storage Driver: overlay2
  Backing Filesystem: extfs
  Supports d_type: true
  Native Overlay Diff: true
  userxattr: false
 Logging Driver: json-file
 Cgroup Driver: systemd
 Cgroup Version: 1
 Plugins:
  Volume: local
  Network: bridge host ipvlan macvlan null overlay
  Log: awslogs fluentd gcplogs gelf journald json-file local logentries splunk syslog
 Swarm: inactive
 Runtimes: runc io.containerd.runc.v2 io.containerd.runtime.v1.linux
 Default Runtime: runc
 Init Binary: docker-init
 containerd version: e25210fe30a0a703442421b0f60afac609f950a3
 runc version: v1.0.1-0-g4144b63
 init version: de40ad0
 Security Options:
  seccomp
   Profile: default
 Kernel Version: 3.10.0-1160.42.2.el7.x86_64
 Operating System: Red Hat Enterprise Linux Server 7.9 (Maipo)
 OSType: linux
 Architecture: x86_64
 CPUs: 8
 Total Memory: 23.39GiB
 Name: gene-k8s-k8sc-node1
 ID: VGBN:P5LX:RTQG:OX67:INYM:ZUHD:W6NQ:FWWL:KUV5:NZ6N:2DKH:ZIYL
 Docker Root Dir: /opt/nsp/docker
 Debug Mode: false
  Registry: https://index.docker.io/v1/
 Labels:
 Experimental: false
 Insecure Registries:
   127.0.0.0/8
 Live Restore Enabled: false

WARNING: API is accessible on http://0.0.0.0:2375 without encryption.
         Access to the remote API is equivalent to root access on the host. Refer
         to the 'Docker daemon attack surface' section in the documentation for
         more information: https://docs.docker.com/go/attack-surface/
[root@gene-k8s-k8sc-node1 ~]# sestatus 
SELinux status:                 enabled
SELinuxfs mount:                /sys/fs/selinux
SELinux root directory:         /etc/selinux
Loaded policy name:             targeted
Current mode:                   permissive
Mode from config file:          permissive
Policy MLS status:              enabled
Policy deny_unknown status:     allowed
Max kernel policy version:      31
[root@gene-k8s-k8sc-node1 ~]# ps -eZ | grep docker
system_u:system_r:unconfined_service_t:s0 1254 ? 00:00:00 docker
system_u:system_r:container_runtime_t:s0 30862 ? 00:02:10 dockerd
system_u:system_r:container_runtime_t:s0 30976 ? 00:00:00 docker
[root@gene-k8s-k8sc-node1 ~]# docker context ls
NAME        DESCRIPTION                               DOCKER ENDPOINT               KUBERNETES ENDPOINT                ORCHESTRATOR
default *   Current DOCKER_HOST based configuration   unix:///var/run/docker.sock   https://127.0.0.1:6443 (default)   swarm

https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html

Ansible from_yaml 过滤器

gene.liu@live.com (Gene Liu) — Thu, 28 Jan 2021 00:00:00 +0000

Ansible from_yaml 过滤器可用于简化带有格式的数据操作。

列表数据类型的示例：

没有过滤器

我必须同时使用 strip 和 split 函数，这很容易出错。

        
glusterfs_node_hostname_base: |
  {% for item in glusterfs_node|unique %}
  {{ hostvars[item].get('ansible_hostname') }}
  {% endfor %}

## gluster 在探测对等点时需要唯一的主机名或节点名，这里 glusterfs_node_hostname 
## 存储所有 glusterfs 节点的主机名以用于验证目的
glusterfs_node_hostname: "{{ glusterfs_node_hostname_base.strip().split('\n') | default([]) }}"

使用 `from_yaml` 过滤器

        
        
        
    
glusterfs_node_hostname_base: |
  ---
  {% for item in glusterfs_node|unique %}
  - {{ hostvars[item].get('ansible_hostname') }}
  {% endfor %}

## gluster 在探测对等点时需要唯一的主机名或节点名，这里 glusterfs_node_hostname 
## 存储所有 glusterfs 节点的主机名以用于验证目的
glusterfs_node_hostname: "{{ glusterfs_node_hostname_base | from_yaml }}"

重置/清理 Debian/Ubuntu 软件包的示例

gene.liu@live.com (Gene Liu) — Wed, 27 Jan 2021 00:00:00 +0000

通过 .deb 包安装

添加 Rancher Desktop 仓库并安装 Rancher Desktop：

        
curl https://download.opensuse.org/repositories/isv:/Rancher:/stable/deb/Release.key | sudo apt-key add -
sudo add-apt-repository 'deb https://download.opensuse.org/repositories/isv:/Rancher:/stable/deb/ ./'
sudo apt update
sudo apt install rancher-desktop

卸载 .deb 包

您可以使用以下命令删除软件包、仓库和密钥：

        
sudo apt remove --autoremove rancher-desktop
sudo add-apt-repository -r 'deb https://download.opensuse.org/repositories/isv:/Rancher:/stable/deb/ ./'
sudo apt-key del

其中 keyid 是运行 apt-key list 时包含 isv:Rancher:stable 的行上方的行。因此，如果我有以下 Rancher Desktop Key 块：

Ceph 地理复制模型

gene.liu@live.com (Gene Liu) — Tue, 18 Feb 2020 13:57:57 +0000

概述

Ceph 根据复制因子在 OSD 之间实现强一致性，并根据放置组 (CRUSH MAP) 实现可靠性/可用性。
跨站点 (异)步同步的集群将受到性能影响，并且需要高带宽且低延迟的管道，这强烈影响 Ceph RADOS 协议（在 RBD 和对象存储上）。

重置 Linux Root 密码

gene.liu@live.com (Gene Liu) — Thu, 13 Feb 2020 06:02:00 +0000

系统管理员可以轻松地为忘记密码的用户重置密码。但是如果系统管理员忘记了 root 密码会发生什么？本指南将向您展示如何在 Red Hat 兼容系统上重置丢失或忘记的 root 密码。