Renew k8s certificates

Check If certificate expires:

amikum@~:03:06:54(⎈ |local-cluster:default):sudo kubeadm certs check-expiration

CERTIFICATE                EXPIRES                  RESIDUAL TIME   CERTIFICATE AUTHORITY   EXTERNALLY MANAGED

admin.conf                 Jan 12, 2024 03:08 UTC   1y                                      no

apiserver                  Jun 08, 2023 09:36 UTC   364d            ca                      no

apiserver-etcd-client      Apr 15, 2022 06:46 UTC   <invalid>       etcd-ca                 no

apiserver-kubelet-client   Apr 15, 2022 06:46 UTC   <invalid>       ca                      no

controller-manager.conf    Apr 15, 2022 06:46 UTC   <invalid>                               no

etcd-healthcheck-client    Apr 15, 2022 06:46 UTC   <invalid>       etcd-ca                 no

etcd-peer                  Apr 15, 2022 06:46 UTC   <invalid>       etcd-ca                 no

etcd-server                Apr 15, 2022 06:46 UTC   <invalid>       etcd-ca                 no

front-proxy-client         Apr 15, 2022 06:46 UTC   <invalid>       front-proxy-ca          no

scheduler.conf             Apr 15, 2022 06:46 UTC   <invalid>                               no

CERTIFICATE AUTHORITY   EXPIRES                  RESIDUAL TIME   EXTERNALLY MANAGED

ca                      Apr 13, 2031 06:46 UTC   8y              no

etcd-ca                 Apr 13, 2031 06:46 UTC   8y              no

front-proxy-ca          Apr 13, 2031 06:46 UTC   8y              no

===========================================

renew the certificate

amikum@~:03:07:35(⎈ |local-cluster:default):sudo kubeadm certs renew apiserver-etcd-client

[renew] Reading configuration from the cluster...

[renew] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -o yaml'

[renew] Error reading configuration from the Cluster. Falling back to default configuration

certificate the apiserver uses to access etcd renewed

amikum@~:03:09:06(⎈ |local-cluster:default):sudo kubeadm certs check-expiration

CERTIFICATE                EXPIRES                  RESIDUAL TIME   CERTIFICATE AUTHORITY   EXTERNALLY MANAGED

admin.conf                 Jan 12, 2024 03:08 UTC   1y                                      no

apiserver                  Jun 08, 2023 09:36 UTC   364d            ca                      no

apiserver-etcd-client      Jun 08, 2023 09:37 UTC   364d            etcd-ca                 no

apiserver-kubelet-client   Jun 08, 2023 09:38 UTC   364d            ca                      no

controller-manager.conf    Jun 08, 2023 09:38 UTC   364d                                    no

etcd-healthcheck-client    Jun 08, 2023 09:38 UTC   364d            etcd-ca                 no

etcd-peer                  Jun 08, 2023 09:38 UTC   364d            etcd-ca                 no

etcd-server                Jun 08, 2023 09:38 UTC   364d            etcd-ca                 no

front-proxy-client         Jun 08, 2023 09:38 UTC   364d            front-proxy-ca          no

scheduler.conf             Jun 08, 2023 09:38 UTC   364d                                    no

CERTIFICATE AUTHORITY   EXPIRES                  RESIDUAL TIME   EXTERNALLY MANAGED

ca                      Apr 13, 2031 06:46 UTC   8y              no

etcd-ca                 Apr 13, 2031 06:46 UTC   8y              no

front-proxy-ca          Apr 13, 2031 06:46 UTC   8y              no

=======================

Regenerate new admin kubeconfig

root@NO2ECIVM03:/etc/kubernetes# kubeadm init phase kubeconfig admin

I0608 15:27:16.743911   30150 version.go:254] remote version is much newer: v1.24.1; falling back to: stable-1.21

[kubeconfig] Writing "admin.conf" kubeconfig file

Allow internet access through proxy and ssh port forwarding

Step 1) install squid on 132.1.16.100 box

dev@kvm2:~$ sudo apt-get install squid3

dev@kvm2:~$ ps ax|grep squid

11700 ?        Ss     0:00 /usr/sbin/squid3 -N -YC -f /etc/squid3/squid.conf

11704 ?        Ss     0:00 (logfile-daemon) /var/log/squid3/access.log

11783 pts/3    S+     0:00 grep --color=auto squid

dev@kvm2:~$ telnet localhost 3128

Trying 127.0.0.1...

Connected to localhost.

Escape character is '^]'.

^]

dev@kvm2:~$ export HTTP_PROXY="localhost:3128"

dev@kvm2:~$ wget --proxy=on google.com

 [ <=>                                                                           ] 14,396      --.-K/s   in 0.01s

2018-10-19 11:32:09 (1.21 MB/s) - ‘index.html’ saved [14426]

dev@kvm2:~$ export HTTPS_PROXY="localhost:3128"

dev@kvm2:~$ wget --proxy=on google.com

    [ <=>                                                                           ] 14,396      --.-K/s   in 0.01s

2018-10-19 11:32:26 (1.19 MB/s) - ‘index.html.1’ saved [14396]

root@kvm2:~# grep "http_access allow all" /etc/squid3/squid.conf

http_access allow all

root@kvm2:~#

restart the squid service

root@kvm2:~# ps -ef | grep squid

root     13143     1  0 11:38 ?        00:00:00 sudo /usr/sbin/squid3 -N -YC -f /etc/squid3/squid.conf

proxy    13144 13143  0 11:38 ?        00:00:07 /usr/sbin/squid3 -N -YC -f /etc/squid3/squid.conf

proxy    13145 13144  0 11:38 ?        00:00:00 (logfile-daemon) /var/log/squid3/access.log

root     37164 37034  0 16:44 pts/6    00:00:00 grep --color=auto squid

root@kvm2:~#

step 2) ssh port forward on 172.16.30153

C:\Users\opsadmin>ssh -R 9002:132.1.16.100:3128 ansible@172.16.30.153

Last login: Fri Oct 19 11:45:22 2018 from 10.212.134.202

ansible@ubuntuTest:~$ telnet localhost 9002

Trying ::1...

Connected to localhost.

Escape character is '^]'.

^]

ansible@ubuntuTest:~$ export http_proxy="localhost:9002"

ansible@ubuntuTest:~$ export https_proxy="localhost:9002"

ansible@ubuntuTest:~$ wget --proxy=on google.com

--2018-10-19 11:49:20--  http://google.com/

Resolving localhost (localhost)... ::1, 127.0.0.1

Connecting to localhost (localhost)|::1|:9002... connected.

Proxy request sent, awaiting response... 301 Moved Permanently

Location: http://www.google.com/ [following]

--2018-10-19 11:49:21--  http://www.google.com/

Reusing existing connection to [localhost]:9002.

Proxy request sent, awaiting response... 200 OK

Length: unspecified [text/html]

Saving to: ‘index.html’

    [ <=>                                                                           ] 14,393      --.-K/s   in 0.03s

2018-10-19 11:49:21 (550 KB/s) - ‘index.html’ saved [14393]

root@ubuntuTest:/var/www/html/zabbix# cat /etc/apt/apt.conf

Acquire::http::Proxy "http://localhost:9002";

Acquire::https::Proxy "https://localhost:9002";

Acquire::ftp::Proxy "ftp://localhost:9002";

root@ubuntuTest:/var/www/html/zabbix#

Apache access control via Ldap

Friend,

We have an application (Logsniffer) running And We were looking for some access control on it.

Below are config file for Apache access control via ldap.

root@ip-10-101-2-145:/etc/apache2/sites-enabled# cat logsniffer-ssl.conf
Listen 443
<VirtualHost *:443>
  ServerName logsniffer-cme.atpl.com
  ServerAlias logsniffer-cme.atpl.com
  SSLEngine On
  SSLCertificateFile /etc/apache2/ssl/crt/8b47601b81cb83cf.crt
  SSLCertificateKeyFile /etc/apache2/ssl/key/acceletrade.key
  SSLCertificateChainFile /etc/apache2/ssl/key/gd_bundle-g2-g1.crt

  ProxyRequests     Off
  ProxyPass         /  http://localhost:8082/
  ProxyPassReverse  /  http://localhost:8082/
#  ProxyPassReverse  /  http://www.logsniffer.my.domain/
  <Proxy http://localhost:8082/*>
        Order deny,allow
        Deny from All
        AuthName "Valid Ldap Authorisation for LDap Domain"
        AuthType Basic
        AuthBasicProvider ldap
#        AuthzLDAPAuthoritative on
        AuthLDAPUrl "ldap://132.1.16.104:389/cn=users,cn=accounts,dc=atpl,dc=com?uid"
        Require ldap-group cn=cme,cn=groups,cn=accounts,dc=atpl,dc=com
        Satisfy any
</Proxy>
  ProxyPreserveHost on
</VirtualHost>
# vim: syntax=apache ts=4 sw=4 sts=4 sr noet

Assign fix netwrk interface name

Hi Friends,

After network hardware or os up-gradation, We normally loose network interface names.

And If you are working in remote location, It become pain to change interfaces settings (ex- ip, rx-tx settings).

Please use below settings to avoid this:-

1) # In /etc/default/grub - ensures eth0/1/2/x like names

GRUB_CMDLINE_LINUX="net.ifnames=0 biosdevname=0"

2) # MAC address can be read using following command

root@abc:~# ls /sys/class/net/ | xargs -IX sh -c 'echo X $(cat /sys/class/net/X/address)'

eth0 88:d7:f6:d4:be:37

eth1 88:d7:f6:d4:be:36

eth2 64:3f:5f:01:5a:dc

eth3 64:3f:5f:01:5a:dd

eth4 64:3f:5f:01:5a:c8

eth5 64:3f:5f:01:5a:c9

lo 00:00:00:00:00:00

3) Create /etc/udev/rules.d/70-persistent-net.rules !! FIX MAC ADDRESSES LIST !!

# Create /etc/udev/rules.d/70-persistent-net.rules !! FIX MAC ADDRESSES LIST !!

SUBSYSTEM=="net", ACTION=="add", DRIVERS=="?*", ATTR{address}=="2c:4d:54:46:60:49", ATTR{dev_id}=="0x0", ATTR{type}=="1", KERNEL=="eth*", NAME="eth0"

SUBSYSTEM=="net", ACTION=="add", DRIVERS=="?*", ATTR{address}=="2c:4d:54:46:60:4a", ATTR{dev_id}=="0x0", ATTR{type}=="1", KERNEL=="eth*", NAME="eth1"

SUBSYSTEM=="net", ACTION=="add", DRIVERS=="?*", ATTR{address}=="64:3f:5f:01:2e:d8", ATTR{dev_id}=="0x0", ATTR{type}=="1", KERNEL=="eth*", NAME="eth2"

SUBSYSTEM=="net", ACTION=="add", DRIVERS=="?*", ATTR{address}=="64:3f:5f:01:2e:d9", ATTR{dev_id}=="0x0", ATTR{type}=="1", KERNEL=="eth*", NAME="eth3"

SUBSYSTEM=="net", ACTION=="add", DRIVERS=="?*", ATTR{address}=="64:3f:5f:01:2d:af", ATTR{dev_id}=="0x0", ATTR{type}=="1", KERNEL=="eth*", NAME="eth4"

SUBSYSTEM=="net", ACTION=="add", DRIVERS=="?*", ATTR{address}=="64:3f:5f:01:2d:ae", ATTR{dev_id}=="0x0", ATTR{type}=="1", KERNEL=="eth*", NAME="eth5"

Keepalived configure for Failover

Friends,

Today I am showing Haproxy setup along with Keepalived. In this blog I will setup Keep alive. HaProxy setup will be done on my next blog.

Keepalived is used to achieve high availability by assigning a VIP to two or more servers.

Installation:-
I am doing this on two ubuntu servers having ip 172.16.1.209 and 172.16.1.211. The virtual IP will be 172.16.1.210.

Install packages

apt-get install keepalived

Configuring keepalived

Create the config file on the first server (172.16.1.209):

vim /etc/keepalived/keepalived.conf




global_defs {

  router_id NM-PRD-HAPROXY-209

}

vrrp_script haproxy {

script "killall -0 haproxy"

interval 1

weight 2

}

vrrp_instance 50 {

virtual_router_id 50

advert_int 1

priority 101

state MASTER

interface eth0

virtual_ipaddress {

172.16.1.210

  }

  track_script {

haproxy

  }

authentication {

        auth_type PASS

        auth_pass We$,J)Og&

    }

}

Create the config file on the second server (172.16.1.211)

vim /etc/keepalived/keepalived.conf




global_defs {

  router_id NM-PRD-HAPROXY-211

}

vrrp_script haproxy {

  script "killall -0 haproxy"

  interval 1

  weight 2

}

vrrp_instance 50 {

  virtual_router_id 50

  advert_int 1

  priority 102

  state MASTER

  interface eth0

  virtual_ipaddress {

    172.16.1.210

  }

  track_script {

    haproxy

  }

authentication {

        auth_type PASS

        auth_pass We$,J)Og&




    }

}

Note :-

We need to enable sysctl setting for no local ip binding allow on the Kernel.

Temporary:

echo 1 > /proc/sys/net/ipv4/ip_nonlocal_bind

Permanent:

Add this to /etc/sysctl.conf:

net.ipv4.ip_nonlocal_bind = 1

Enable with:

sysctl -p

Start service
When our Haproxy setup done, We need to start Keepalived on both servers:

service keepalived start

Run Rsync as daemon

Friends,

We all know rsync is a good tool to sync files/directories.
Every time your want to sync, you need to run rsync commands. But what if you want to run rsync as a  daemon? Every change in the source will be synced to destination location manually?

Below is a small script to do this

On source location 

archival@cme103:~$ mkdir rsync-as-daemon ;cd rsync-as-daemon

archival@cme103:~$touch /home/archival/rsync-as-daemon/rsync.lock;touch /home/archival/rsync-as-daemon/rsync.log

archival@cme103:~$ cat rsyncd.conf

pid file = /home/archival/rsync-as-daemon/rsyncd.pid

lock file = /home/archival/rsync-as-daemon/rsync.lock

log file = /home/archival/rsync-as-daemon/rsync.log

use chroot = false

port = 15000

reverse lookup = no

[app_logs]

path = /home/archival/log/

comment = Logs Rsync

read only = true

timeout = 300

Now run rsync as a daemon

archival@cme103:~$ rsync --daemon --config=/home/archival/rsync-as-daemon/rsyncd.conf

On Destination Please configure as below

logmanager@ip-10-101-2-145:~ mkdir rsync-client;cd rsync-client

logmanager@ip-10-101-2-145:~ cat rsync_client.sh

#!/bin/bash
SCRIPT_DIR=$(dirname $0)
cd $SCRIPT_DIR
TARGET_BASE_DIR="/opt/rsync_logs/"
RSYNC_INCLUDES="$SCRIPT_DIR/rsync_includes.cfg"
while true ;
do
    SERVER_URL=($(cat "$SCRIPT_DIR/rsync_url.list" | xargs))
    for URL in "${SERVER_URL[@]}"
    do
        IP=$(echo $URL | cut -d':' -f 1)
        TARGET_DIR="$TARGET_BASE_DIR/$IP"
        if [ ! -f $TARGET_DIR ]; then
            mkdir -p $TARGET_DIR
        fi
        rsync -rtm --append --include-from $RSYNC_INCLUDES --exclude '*' rsync://${URL} ${TARGET_DIR}
    done
done

logmanager@ip-10-101-2-145:~/rsync-client$ cat rsync_includes.cfg
### Directories and file that should be synced  
*/
platform*.log

logmanager@ip-10-101-2-145:~/ rsync-client$ cat rsync_url.list
## URL for Rsync
192.168.201.103:15000/app_logs/

Now run rsync client

logmanager@ip-10-101-2-145:~/rsync-client$/home/logmanager/rsync-client/rsync_client.sh

Bash to save history with time stamp

Some Useful bashrc stuff

Please put below in /etc/bash.bashrc

## No duplicates in the history

export HISTCONTROL=ignoredups

## for setting history length see HISTSIZE and HISTFILESIZE in bash

export HISTSIZE=100000

export HISTFILESIZE=100000

## Timestamp history

export HISTTIMEFORMAT="%b %d %a %T "

## Don't Overwrite. Append to bash history.

shopt -s histappend

##Adding costume $PATH

export PATH="/usr/local/zabbix/bin:$PATH"

##Adding Vim as default editor

export EDITOR=vim