Linux / Open Source Forum

Installing Helm by a specific version

2022-08-11T15:33:00.000+05:30

While creating a duplicate deployment system for testing purposes we may require to install a very old version of helm

I have done this by using the below steps.

# curl -fsSL -o get_helm.sh https://raw.githubusercontent.com/helm/helm/master/scripts/get-helm-3
# chmod +x get_helm.sh
# ./get_helm.sh -v v3.1.2
# helm version
version.BuildInfo{Version:"v3.1.2", GitCommit:"d878d4d45863e42fd5cff6743294a11d28a9abce", GitTreeState:"clean", GoVersion:"go1.13.8"}

Vagrant issue with Ubuntu16.04

2022-05-14T00:45:00.002+05:30

While executing the command "vagrant up" you will see the following error message.

Box 'generic/ubuntu2004' could not be found. Attempting to find and install...

servername: Box Provider: virtualbox

servername: Box Version: 3.3.0

The box 'generic/ubuntu2004' could not be found or

could not be accessed in the remote catalog. If this is a private

box on HashiCorp's Atlas, please verify you're logged in via

`vagrant login`. Also, please double-check the name. The expanded

URL and error message are shown below:

URL: ["https://atlas.hashicorp.com/generic/ubuntu2004"]

Error: The requested URL returned error: 404 Not Found

So the issue is with your vagrant version (1.8.7), so here we would require the last Vagrant version 2

On your Ubuntu 16.04LTS vagrant binay download will show the following error.

ajeesh@Aspire-A515-51G:~/Downloads/vagr$ ./vagrant --help

/tmp/.mount_vagranhKrhmD/usr/bin/ruby2.6: /lib/x86_64-linux-gnu/libc.so.6: version `GLIBC_2.25' not found (required by /tmp/.mount_vagranhKrhmD/usr/lib/x86_64-linux-gnu/libruby-2.6.so.2.6)

Fix:

# apt-get remove vagrant

# apt-get install vagrant

root@Aspire-A515-51G:~# vagrant --version

Vagrant 2.2.19

Unhealthy status for controller-manager and scheduler

2021-03-12T17:11:00.003+05:30

[vagrant@kmaster ~]$ kubectl get cs
Warning: v1 ComponentStatus is deprecated in v1.19+
NAME STATUS MESSAGE ERROR
scheduler Unhealthy Get "http://127.0.0.1:10251/healthz": dial tcp 127.0.0.1:10251: connect: connection refused
controller-manager Unhealthy Get "http://127.0.0.1:10252/healthz": dial tcp 127.0.0.1:10252: connect: connection refused
etcd-0 Healthy {"health":"true"}

And other commands everything works fine.

[ajeesh@kmaster ~]$ kubectl cluster-info
Kubernetes master is running at https://172.42.42.100:6443
KubeDNS is running at https://172.42.42.100:6443/api/v1/namespaces/kube-system/services/kube-dns:dns/proxy
[ajeesh@kmaster ~]$ kubectl get pods --all-namespaces
NAMESPACE NAME READY STATUS RESTARTS AGE
kube-system calico-kube-controllers-56b44cd6d5-27smn 1/1 Running 0 6m43s
kube-system calico-kube-controllers-56b44cd6d5-g6gfw 0/1 NodeAffinity 0 118d
kube-system calico-node-rv52x 1/1 Running 0 6m42s
kube-system calico-node-tq84v 1/1 Running 4 118d
kube-system calico-node-wg8h9 1/1 Running 0 6m42s
kube-system coredns-f9fd979d6-69dhx 1/1 Running 2 118d
kube-system coredns-f9fd979d6-rff6t 1/1 Running 2 118d
kube-system etcd-kmaster.example.com 1/1 Running 3 118d
kube-system kube-apiserver-kmaster.example.com 1/1 Running 3 118d
kube-system kube-controller-manager-kmaster.example.com 1/1 Running 2 118d
kube-system kube-proxy-7psvh 1/1 Running 2 118d
kube-system kube-proxy-mf4hx 1/1 Running 2 118d
kube-system kube-proxy-ndnk6 1/1 Running 2 118d
kube-system kube-scheduler-kmaster.example.com 1/1 Running 2 118d
[vagrant@kmaster ~]$

This issue is shown in my test Kubernetes cluster and while checking the kube-controller-manager.yaml and kube-scheduler.yaml 0 is the default port number used. So I have commented on that line and fixed the issue.

vi /etc/kubernetes/manifests/kube-controller-manager.yaml

- --leader-elect=true
- --node-cidr-mask-size=24
# - --port=0
- --requestheader-client-ca-file=/etc/kubernetes/pki/front-proxy-ca.crt

vi /etc/kubernetes/manifests/kube-scheduler.yaml

- --kubeconfig=/etc/kubernetes/scheduler.conf
- --leader-elect=true
# - --port=0
image: k8s.gcr.io/kube-scheduler:v1.19.4
imagePullPolicy: IfNotPresent
livenessProbe:
failureThreshold: 8

@kmaster vagrant]# service kubelet restart

@kmaster ~]$ kubectl get cs
Warning: v1 ComponentStatus is deprecated in v1.19+
NAME STATUS MESSAGE ERROR
controller-manager Healthy ok
scheduler Healthy ok
etcd-0 Healthy {"health":"true"}

Kubernetes is deprecating Docker?

2020-12-18T00:01:00.003+05:30

Kubernetes is deprecating Docker?

NO, Kubernetes is deprecating Docker as a container runtime after v1.20.

Docker support is not going away, it is just deprecating the "Dockershim"

Kubernetes using CRI(Kubernetes created a standard interface called CRI for all runtime implementations.) for all runtime and here docker is most widely used. Moreover, docker is not only the container runtime , but also we can use contained, CRI-O, Rkt etc. So kubelet is not directly talking to Container runtime, instead, it is talking to container runtime through a Container Runtime Interface. In the case of docker Kubernetes cannot use CRI to communicate with docker runtime. Since docker is not implemented with any CRI. So Kubernetes developed a wrapper like application called "dockershim" for communicating with docker runtime, which speaks CRI protocol on one side and Dockerd protocol on the other.

When this will fully be removed.

As of now 12-17-2020 K8S V1.20 - Kubelet start showing a warning message
1.21 - will also show the same warning message
1.22 - will also show the same warning message
1.23 - dockershim will remove

Questions:

Q1: Do we need to install docker?

Ans: No, you don't need to install docker , instead we need to install "containerd" or CRI-O

Q2: Your docker images will work?

Ans: Yes, you can push the image to your registry, "docker ps" can't see stuff created by CRI. Instead, there is a separate tool "crictl"

docker ps --> crictl ps, docker info --> crictl info etc

Q3: What about performance and security?

Ans: For docker runtime, K8S has lots of unwanted docker modules like API, CLI, and Server( in the server, we have container runtime, Volume, and network) but K8S only needs the runtime. So removing the docker runtime makes better performance and thus fewer components fewer security risks.

Q4: What is the name of container runtime for docker?

Ans: Containerd, which is already under the part of CNCF which is maintained and developed as a separate project. ContainerD is the second most alternative of using docker as a runtime.

Q5: Containerd is using any of the service providers?

Ans: Containerd is already used by major Cloud platforms ( AWS EKS, Google Kubernetes Service)

Q6: Do I need to make any modifications for my managed K8S cluster running on AWS,GCP?

Ans: Cloud providers will take care of installing the binaries and container runtime on K8S worker node.

Q7: On-prem K8S cluster?

Yes, Action required, there are two options: 1st. Change the container runtime as "containerd" or CRI-O , 2nd. We still want to use "dockershim" manually install it on your cluster, since Miratis now take control of dockershim https://www.mirantis.com/blog/mirantis-to-take-over-support-of-kubernetes-dockershim-2/

EIA 2020 Draft Withdrawal request

2020-08-06T11:05:00.004+05:30

Sample Letter body:

========================================

To,

C.K.Mishra

Secretary

Ministry of Environment, Forests and climate

Indira Pariyavaran Bhavan

Jor Bagh, New Delhi

Date : XX-XX-2020

From,

Your_name

Address

Dear Mr. Mishra,

Subject: Withdraw the draft EIA notification, 2020 [F.N.2-50/2018/IA.III] and defer the process of public comments in the light of the COVID-2019 pandemic.

I am Your_Name, as a citizen of India, writing this mail with reference to the draft EIA notification, 2020 which has been uploaded on the environment ministry’s website on 12.3.2020 seeking public comments within sixty days of the issuance of the notification. I am happy to hear that the same has been extended to August 11. I am deeply concerned that the draft notification has been put out in the midst of a national health crisis. Due to the prevailing situation of global pandemic spread, offices and public movement have been restricted.

The EIA notification is an important regulation through which the impacts of land-use change, water extraction, tree felling, pollution, waste and effluent management for industrial and infrastructure projects are to be studied and used in developmental decisionmaking. Any change in this law has a direct bearing on the living and working conditions of people and the ecology.

As per the design and implementation of EIA notification, it is crucial that the government provides a suitable and adequate opportunity for those impacted or likely to be affected. Opportunities to understand and discuss the implications of the proposed amendments may be severely hindered due to the present health emergency with restricted public movement, social distancing, and challenges to everyday life activities. These restrictions also make it impossible to disseminate information about the notification to communities who deserve to know and influence the notification.

So I genuinely requesting the environment of ministry to :

1. Withdraw the proposed amendments of the Draft EIA notification 2020 as early as possible.

2. Consider reissuing the draft only after health conditions related to Covid19 and civic life is normalized across the country.

3. Ensure that there are widespread and informed public discussions on the implication of these amendments.

4. Full disclosure of the nature of comments received and the reasons for acceptance and rejection of these comments, prior to the issuance of the final amendments.

I hope that the environment ministry will uphold its obligations towards informed public participation like the commitment to Principle 10 of the Rio Declaration and also the Principles of Natural Justice, while taking a considered view on the proposed amendments to the EIA notification, 2020.

Copy to: 1. Geeta Menon, Jt Secy, MoEFF (menong@cag.gov.in)

Yours faithfully

Your_Name

========================================

To address : eia2020-moefcc@gov.in

CC : menong@cag.gov.in

Email subject : Withdraw EIA 2020 draft

AWS Certified Solutions Architect – Associate C02 Tips and Tricks

2020-07-29T19:46:00.003+05:30

Recently I have passed AWS Certified Solutions Architect - Associate[SAA-C02]. I would like to share some of my experience regarding the latest exam and its preparations.
Now you can schedule your exam at your Home(Pearson Vue only support this opportunity at the moment)

Requirements for writing your Exam from your Home:

Windows 10 OS( Linux OS will not work)
I have used my cousin sister's Laptop[4GB DDR3, 500HDD,i3]
Broadband internet connection ( My JIO connection failed during the start of my exam so I changed the connection, it's maybe because of my home location, It is too dangerous to do this during the Exam)
Passport or Driving license.
Test your Machine [Network, Audio, Camara] from here: https://home.pearsonvue.com/aws/onvue

I have done the following for preparing my exam:

A Cloud Guru CEO Ryan Kroonenburg's course
Solve Dumps/Questions in between 200 - 500(min)
Attended AWS meetups + AWS webinars ( Optional )[I am an active member of AWS Users Kochi]
Do some discussion with your friend who already attended the exam before[ For me it was Muhasin-Urolime, AWS Expert, Thanks, dude.. ]
However, you should have some LUCK anyways...You should have to keep in mind we need to crack the AWS exam pattern[ NB: For beginners and Intermediates ]

Some of the exam topics came for my SAA-C02:

VPC (more than 4)
EFS
AutoScaling ( more than 5 )
EBS (more than 2 )
RDS (more than 5)
S3 (more than 3 )
Storage Gateway (more than 2)
Data Sync (more than 2)
DynamoDB
ElastiCache
RedShift
Kinesis
ServerLESS (more than 3 )
SQS (more than 2 )
Cloudfront (more than 3 )
Cognito
Key management
etc others i am not sure...

Tips and Tricks

AWS Organizations

1. single point of maintenance + limiting access to specific services or actions in all of the team members AWS accounts = Use Service control policies

EFS

2. Shared storage between multiple EC2 instances + file locking capabilities= EFS

3. high availability + POSIX-compliant and access concurrently from EC2 instances.= EFS

VPC

4. HA , we need two AZ and each AZ contains 3 subnets (1 public for ALB + 1 private for Web servers + 1 private for Database).

5. to provide VPC private connection to AWS services = Use VPC endpoint

6. IPv6 traffic =Egress-only internet gateway

AutoScaling

7. High availability + Scalability + Web server + Session Stickiness = Auto Scaling group + ALB + multiple AZs

8. prevent any scaling delay = Use a Scheduled scaling to scale-out EC2 instances

9. HA = Auto Scaling group(ASG) + ELB + multi EC2 instances in each AZ

10. Scaling based on high demand at peak times = Dynamic Scaling

11. Scheduled workloads = use schedule scaling.

EBS

12. I/O intensive + relational databases = EBS Provisioned IOPS SSD (io1)

13. Improve the performance of EBS volume + handle workloads = use EBS Provisioned IOPS SSD (io1)

14. SAN disc = Object Store = EBS

15. log processing + sequentially + throughput rate 500 MB/s = EBS Throughput Optimized HDD (st1)

16. Proprietary File System = EBS

RDS

17. For performance = Add more read replica to Amazon RDS

18. Transactional + High performance + Data size range 16 TB to 64 TB = Amazon Aurora

19. RDS Reserved Instance's Region, DB Engine, DB Instance Class, Deployment Type and term length cannot be changed later.

20. backup data less frequently + rapid access + low cost = Amazon S3 Standard-IA

21. restrict access = generate S3 pre-signed URLs

The pre-signed URLs are valid only for the specified duration.

22. To restrict access to content that you serve from Amazon S3 buckets

Create a special CloudFront user called an origin access identity (OAI) and associate it with your distribution.

Configure your S3 bucket permissions so that CloudFront can use the OAI to access the files in your bucket and serve them to your users.

23. PUT Request prefixes = 3,500

24. Encrypt S3 bucket + Encrypt Redshift + Move data = Data at rest.

25. Secure + Salable + High available = S3

26. Short-term/Temporary access = Amazon S3 pre-signed URL

27. Enable versioning in both source and destination buckets is prerequisites for cross-region replication in Amazon S3

28. Object Store + Immutable = Amazon Glacier

29. bypass web servers and store the files directly into S3 bucket = pre-signed URL.

30. Expedited retrieval within 1 - 5 minutes

31. bulk retrieval within 5 - 12 hours

32. The Vault Lock and Standard Retrieval - with 3-5 hours

Storage Gateway

32. Storage Gateway with the cached mode is the best option to migrate iSCSI to Cloud

33. NFS supported by File Gateway only

DynamoDB

32. 50 ms latency + increasing exponentially = Amazon DynamoDB

33. S3, DynamoDB and Lambda all have HA

34. Centralized database + strong consistency + scalable + cost optimized = Amazon DynamoDB

35. Enable Amazon DynamoDB Auto Scaling = LESS changes

36. data in chunks + little latency = NoSQL DB = DynamoDB

37. Big Data + flexible schema + indexed data + scalable =Amazon DynamoDB

38. Lowest latency data retrieval + highest scalability = DynamoDB

ElastiCache

39. Repeated Complex Queries = Caching = Amazon ElastiCache.

40. Real data + in-memory = Use Redis.

41. Memcached -> simplicity , Redis -> rich sets of features.

RedShift

42. High Performance + Big Historical Data + business intelligence tools = data warehouse= Amazon Redshift

43. run different queries types on big data = Amazon Redshift workload management

44. data warehouse + Big Data + fast = Amazon Redshift

Kinesis

45. 1000 bid per second + process in order + no losing messages + multiple services to process each bid= Amazon Kinesis Data Streams

46. real-time stream +large-volume+ AWS Serverless + custom SQL = Amazon Kinesis Data Analytics

47. Real-time + BIG data streaming = Amazon Kinesis Data Streams

48. Data Analytics + SQL = Amazon Kinesis Data Analytics

49. 100,000 requests per second + Sequential events + click stream analyzing = Use Amazon Kinesis Stream

50. IOT data + streams+ Partition by equipment + s3 =Use Amazon Kinesis Data Streams

ServerLESS [ Lambda, ]

51. Migration to AWS + Stateless application + Static Content + Less operation overhead = ServerLess solution = Amazon Cognito + Amazon S3 + Amazon API Gateway+ and AWS Lambda

52. Lambda has a limitation of 1000 concurrent requests

53. AWS compute solution + no special hardware + use 512 MB of memory to run = AWS Lambda functions

54. Lambda is the best option to handle S3 events

55. Scalable + cost-effective + ServerLess = Amazon API Gateway with AWS Lambda Function

56. securely store database passwords + customer master key + Lambda Function = Lambda Environment Variables

SQS

57. SQS prevent losing orders

58. sold old items first = Use Amazon SQS with FIFO Queue

59. MOST efficient + cost-effective = Decouple the two tiers using Amazon SQS.

60. handle failed messages = Amazon SQS dead-letter queue

Cloudfront

61. CloudFront has a geo-restriction, not a geo routing

62. Custom Origin "On-Premises" + enhance the performance of downloading static files = Amazon CloudFront

Clodformation:

63. Pilot light DR scenario= DB replication + AWS CloudFormation

CloudTrail

64. for API calls monitoring

Elastic Beanstalk

65. easy deploying + without managing infrastructure = Elastic Beanstalk

66. simple deployment + scalable + running on IIS = AWS Elastic Beanstalk

Amazon Cognito

67. MFA +Mobile = Amazon Cognito

68. block suspicious sign-ins = Amazon Cognito user pools

AWS Shield

69. protect the application from DDOS attack = Use AWS Shield

KEY:

70. AWS manages both data key and master key + automatically manage both encryption and decryption = SSE-S3

71. automated rotation of the encryption keys+ track the usage of encryption key = use SSE-KMS

Misc:

72. machine learning, high-performance computing, video processing, and financial modeling = Amazon FSx for Lustre

5 less than K8S = K3S Lightweight Kubernetes

2020-05-06T00:35:00.000+05:30

5 less than K8S = K3S Lightweight Kubernetes
Installing and configure a Lightweight Kubernetes cluster.

This is a Lightweight Kubernetes distribution for production workloads.

You can complete the Kubernetes installation in less than 5 Minutes

Document for reference: https://rancher.com/docs/k3s/latest/en/installation/install-options/server-config/

Installation Steps:

Master : curl -sfL https://get.k3s.io | sh -
Worker : curl -sfL https://get.k3s.io | K3S_URL=https://myserver:6443 K3S_TOKEN=mynodetoken sh -

Here I am taking 1GB RAM Master and Worker Node(Ubuntu18) in my Virtual Box, The main advantage for the installation is there are no Pre-requisites.

Properties:

- You can install in Raspberry Pi Hardware
- By default, the data is keeping in SQLite no ETCD, But you can configure
- It is using Flannel network
- It is using Containerd not Docker
- Just needs Linux Kernel and Cgroup

Master Node:
==============

root@master:/home# curl -sfL https://get.k3s.io | INSTALL_K3S_EXEC="--node-ip=Master_IP --flannel-iface=enp0s8" sh -
[INFO] Finding release for channel stable
[INFO] Using v1.17.4+k3s1 as release
[INFO] Downloading hash https://github.com/rancher/k3s/releases/download/v1.17.4+k3s1/sha256sum-amd64.txt
[INFO] Downloading binary https://github.com/rancher/k3s/releases/download/v1.17.4+k3s1/k3s
[INFO] Verifying binary download
[INFO] Installing k3s to /usr/local/bin/k3s
[INFO] Creating /usr/local/bin/kubectl symlink to k3s
[INFO] Creating /usr/local/bin/crictl symlink to k3s
[INFO] Creating /usr/local/bin/ctr symlink to k3s
[INFO] Creating killall script /usr/local/bin/k3s-killall.sh
[INFO] Creating uninstall script /usr/local/bin/k3s-uninstall.sh
[INFO] env: Creating environment file /etc/systemd/system/k3s.service.env
[INFO] systemd: Creating service file /etc/systemd/system/k3s.service
[INFO] systemd: Enabling k3s unit
Created symlink /etc/systemd/system/multi-user.target.wants/k3s.service → /etc/systemd/system/k3s.service.
[INFO] systemd: Starting k3s
root@master:/home#

root@master:/home# kubectl get nodes
NAME STATUS ROLES AGE VERSION
master Ready master 9m27s v1.17.4+k3s1
root@master:/home/#

Kuberctl is installed by Racher script
root@msater:/home# which kubectl
/usr/local/bin/kubectl

root@master:/var/lib# cd /var/lib/rancher/
root@master:/var/lib/rancher# ls
k3s

root@master:/var/lib/rancher# cd /etc/rancher/
root@master:/etc/rancher# ls
k3s node

root@master:/etc/rancher# cd /var/lib/rancher/k3s/server/
root@master:/var/lib/rancher/k3s/server# ls
cred db kine.sock manifests node-token static tls token

TOCKEN LOCATION:
root@master:/var/lib/rancher/k3s/server# cat token
K10e08a165e58554e19bf1f0eab12dd06e8345655b7efe52bcd04029a76226b2034::server:5d82295abb1eb943c32bbcd1fec959d3

KUBE-CONFIG FILE LOCATION:
root@master:~# cd /etc/rancher/k3s/
root@master:/etc/rancher/k3s# ls
k3s.yaml

WORKER NODE Installation:
=========================

curl -sfL https://get.k3s.io | INSTALL_K3S_EXEC="--node-ip=Master_IP --flannel-iface=enp0s8" K3S_URL="https://Master_IP:6443" K3S_TOKEN="xxxxxxxxxxx034::server:5d82295abxxxxxxxc959d3" sh -

vagrant@worker:~$ sudo su
root@worker:/home# curl -sfL https://get.k3s.io | INSTALL_K3S_EXEC="--node-ip=Master_IP --flannel-iface=enp0s8" K3S_URL="https://Master_IP:6443" K3S_TOKEN="K1xxx6b2034::server:5xxxxxxx59d3" sh -
[INFO] Finding release for channel stable
[INFO] Using v1.17.4+k3s1 as release
[INFO] Downloading hash https://github.com/rancher/k3s/releases/download/v1.17.4+k3s1/sha256sum-amd64.txt
[INFO] Downloading binary https://github.com/rancher/k3s/releases/download/v1.17.4+k3s1/k3s
[INFO] Verifying binary download
[INFO] Installing k3s to /usr/local/bin/k3s
[INFO] Creating /usr/local/bin/kubectl symlink to k3s
[INFO] Creating /usr/local/bin/crictl symlink to k3s
[INFO] Creating /usr/local/bin/ctr symlink to k3s
[INFO] Creating killall script /usr/local/bin/k3s-killall.sh
[INFO] Creating uninstall script /usr/local/bin/k3s-agent-uninstall.sh
[INFO] env: Creating environment file /etc/systemd/system/k3s-agent.service.env
[INFO] systemd: Creating service file /etc/systemd/system/k3s-agent.service
[INFO] systemd: Enabling k3s-agent unit
Created symlink /etc/systemd/system/multi-user.target.wants/k3s-agent.service → /etc/systemd/system/k3s-agent.service.
[INFO] systemd: Starting k3s-agent
root@worker:/home#

After this, you can see your new worker node is added into your Kubernetes cluster.
root@master:/etc/rancher/k3s# kubectl get nodes
NAME STATUS ROLES AGE VERSION
worker Ready 39s v1.17.4+k3s1
master Ready master 27m v1.17.4+k3s1
root@master:/etc/rancher/k3s#

So we have completed the cluster installation.

For testing, we can deploy an Nginx application and check the cluster further.

root@master:/etc/rancher/k3s# kubectl get all
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
service/kubernetes ClusterIP 10.43.0.1 443/TCP 29m

root@master:/etc/rancher/k3s# kubectl run urolime --image nginx
kubectl run --generator=deployment/apps.v1 is DEPRECATED and will be removed in a future version. Use kubectl run --generator=run-pod/v1 or kubectl create instead.
deployment.apps/urolime created
root@master:/etc/rancher/k3s#

root@master:/etc/rancher/k3s# kubectl get all
NAME READY STATUS RESTARTS AGE
pod/urolime-5b47968689-f4qnj 0/1 ContainerCreating 0 26s

NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
service/kubernetes ClusterIP 10.43.0.1 443/TCP 32m

NAME READY UP-TO-DATE AVAILABLE AGE
deployment.apps/urolime 0/1 1 0 26s

NAME DESIRED CURRENT READY AGE
replicaset.apps/urolime-5b47968689 1 1 0 26s
root@master:/etc/rancher/k3s#

Expose the service into a NodePort and try accessing it.

root@master:/etc/rancher/k3s# kubectl expose deployment urolime --port 80 --type NodePort
service/urolime exposed
root@master:/etc/rancher/k3s# kubectl get svc
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
kubernetes ClusterIP 10.43.0.1 443/TCP 33m
urolime NodePort 10.43.143.95 80:32623/TCP 7s
root@master:/etc/rancher/k3s#

root@master:/etc/rancher/k3s# curl Master_IP:32623

Welcome to nginx!

Welcome to nginx!

If you see this page, the nginx web server is successfully installed and
working. Further configuration is required.

For online documentation and support please refer to
nginx.org.
Commercial support is available at
nginx.com.

Thank you for using nginx.

root@master:/etc/rancher/k3s#

Backup and restore Kubernetes cluser

2020-04-26T23:06:00.001+05:30

I am checking how can I back up and restore my Kubernetes cluster.

First, we need Object storage like S3.
Minio is opensource Object storage which is compatible for Amazon S3

Setting Up a Minio:
====================
We can run Minio in a docker environment
Stable
docker pull minio/minio
docker run -p 9000:9000 minio/minio server /data

root@testing:/home/ubuntu# docker pull minio/minio
Using default tag: latest
latest: Pulling from minio/minio
4167d3e14976: Already exists
275c32df8f5e: Pull complete
cf0c84ce4772: Pull complete
70885164616a: Pull complete
Digest: sha256:6f8db3d7a1060cb1fcd6855791e9befe2d7f51644be65183680c1189eb196177
Status: Downloaded newer image for minio/minio:latest
root@testing:/home/ubuntu# docker run --name minio -p 9000:9000 -v data:/data minio/minio server /data
Endpoint: http://172.17.0.3:9000 http://127.0.0.1:9000
Browser Access:
http://172.17.0.3:9000 http://127.0.0.1:9000
Object API (Amazon S3 compatible):
Go: https://docs.min.io/docs/golang-client-quickstart-guide
Java: https://docs.min.io/docs/java-client-quickstart-guide
Python: https://docs.min.io/docs/python-client-quickstart-guide
JavaScript: https://docs.min.io/docs/javascript-client-quickstart-guide
.NET: https://docs.min.io/docs/dotnet-client-quickstart-guide
Detected default credentials 'minioadmin:minioadmin', please change the credentials immediately using 'MINIO_ACCESS_KEY' and 'MINIO_SECRET_KEY'

VELERO SETUP:
==========================
Installing the Velero binary
ajeesh@Aspire-A515-51G:~/Downloads/valero$ wget https://github.com/vmware-tanzu/velero/releases/download/v1.3.2/velero-v1.3.2-linux-amd64.tar.gz
--2020-04-26 21:27:41-- https://github.com/vmware-tanzu/velero/releases/download/v1.3.2/velero-v1.3.2-linux-amd64.tar.gz
Resolving github.com (github.com)... 13.234.176.102
Connecting to github.com (github.com)|13.234.176.102|:443... connected.

velero-v1.3.2-linux-amd64.tar.gz 100%[=======================================================================>] 23.39M 1.30MB/s in 25s

2020-04-26 21:28:08 (956 KB/s) - ‘velero-v1.3.2-linux-amd64.tar.gz’ saved [24528427/24528427]

ajeesh@Aspire-A515-51G:~/Downloads/valero$ tar zxf velero-v1.3.2-linux-amd64.tar.gz
ajeesh@Aspire-A515-51G:~/Downloads/valero$ sudo mv velero-v1.3.2-linux-amd64/velero /usr/local/bin/

Next, you need to update your Minio logins for Velero to configure.

# cat <> minio.credentials
> [default]
> aws_access_key_id=minioadmin
> aws_secret_access_key=minioadmin
> EOF

root@Aspire-A515-51G:
root@Aspire-A515-51G:/velero# ls
minio.credentials

velero$ echo $KUBECONFIG
/home/ajeesh/.kube/config

velero$ /usr/local/bin/velero install --provider aws --plugins velero/velero-plugin-for-aws:v1.0.0 --bucket bucketone --secret-file ./minio.credentials --backup-location-config region=minio,s3ForcePathStyle=true,s3Url=http://myip:9000

CustomResourceDefinition/backups.velero.io: attempting to create resource
CustomResourceDefinition/backups.velero.io: created
CustomResourceDefinition/backupstoragelocations.velero.io: attempting to create resource
CustomResourceDefinition/backupstoragelocations.velero.io: created
CustomResourceDefinition/deletebackuprequests.velero.io: attempting to create resource
CustomResourceDefinition/deletebackuprequests.velero.io: created
CustomResourceDefinition/downloadrequests.velero.io: attempting to create resource
CustomResourceDefinition/downloadrequests.velero.io: created
CustomResourceDefinition/podvolumebackups.velero.io: attempting to create resource
CustomResourceDefinition/podvolumebackups.velero.io: created
CustomResourceDefinition/podvolumerestores.velero.io: attempting to create resource
CustomResourceDefinition/podvolumerestores.velero.io: created
CustomResourceDefinition/resticrepositories.velero.io: attempting to create resource
CustomResourceDefinition/resticrepositories.velero.io: created
CustomResourceDefinition/restores.velero.io: attempting to create resource
CustomResourceDefinition/restores.velero.io: created
CustomResourceDefinition/schedules.velero.io: attempting to create resource
CustomResourceDefinition/schedules.velero.io: created
CustomResourceDefinition/serverstatusrequests.velero.io: attempting to create resource
CustomResourceDefinition/serverstatusrequests.velero.io: created
CustomResourceDefinition/volumesnapshotlocations.velero.io: attempting to create resource
CustomResourceDefinition/volumesnapshotlocations.velero.io: created
Waiting for resources to be ready in cluster...
Namespace/velero: attempting to create resource
Namespace/velero: created
ClusterRoleBinding/velero: attempting to create resource
ClusterRoleBinding/velero: created
ServiceAccount/velero: attempting to create resource
ServiceAccount/velero: created
Secret/cloud-credentials: attempting to create resource
Secret/cloud-credentials: created
BackupStorageLocation/default: attempting to create resource
BackupStorageLocation/default: created
VolumeSnapshotLocation/default: attempting to create resource
VolumeSnapshotLocation/default: created
Deployment/velero: attempting to create resource
Deployment/velero: created
Velero is installed! ⛵ Use 'kubectl logs deployment/velero -n velero' to view the status.
ajeesh@Aspire-A515-51G:~/test

ajeesh@Aspire-A515-51G:~$ kubectl get all -n velero

NAME READY STATUS RESTARTS AGE

pod/velero-795c8d58cd-fc86d 1/1 Running 2 5m17s

NAME READY UP-TO-DATE AVAILABLE AGE

deployment.apps/velero 1/1 1 1 5m17s

NAME DESIRED CURRENT READY AGE

replicaset.apps/velero-795c8d58cd 1 1 1 5m17s

ajeesh@Aspire-A515-51G:~$

ajeesh@Aspire-A515-51G:~$ kubectl -n velero get crds

NAME CREATED AT

backups.velero.io 2020-04-26T16:42:32Z

backupstoragelocations.velero.io 2020-04-26T16:42:32Z

bgpconfigurations.crd.projectcalico.org 2019-11-06T07:35:55Z

bgppeers.crd.projectcalico.org 2019-11-06T07:35:55Z

blockaffinities.crd.projectcalico.org 2019-11-06T07:35:55Z

clusterinformations.crd.projectcalico.org 2019-11-06T07:35:55Z

deletebackuprequests.velero.io 2020-04-26T16:42:32Z

downloadrequests.velero.io 2020-04-26T16:42:32Z

felixconfigurations.crd.projectcalico.org 2019-11-06T07:35:55Z

globalnetworkpolicies.crd.projectcalico.org 2019-11-06T07:35:55Z

globalnetworksets.crd.projectcalico.org 2019-11-06T07:35:55Z

hostendpoints.crd.projectcalico.org 2019-11-06T07:35:55Z

ipamblocks.crd.projectcalico.org 2019-11-06T07:35:55Z

ipamconfigs.crd.projectcalico.org 2019-11-06T07:35:55Z

ipamhandles.crd.projectcalico.org 2019-11-06T07:35:55Z

ippools.crd.projectcalico.org 2019-11-06T07:35:55Z

networkpolicies.crd.projectcalico.org 2019-11-06T07:35:55Z

networksets.crd.projectcalico.org 2019-11-06T07:35:55Z

podvolumebackups.velero.io 2020-04-26T16:42:32Z

podvolumerestores.velero.io 2020-04-26T16:42:32Z

resticrepositories.velero.io 2020-04-26T16:42:32Z

restores.velero.io 2020-04-26T16:42:32Z

schedules.velero.io 2020-04-26T16:42:32Z

serverstatusrequests.velero.io 2020-04-26T16:42:32Z

volumesnapshotlocations.velero.io 2020-04-26T16:42:32Z

ajeesh@Aspire-A515-51G:~$

Here I have used the following values and variables for configuring the Velero installation.

=========

Velero Version: v1.3.2

velero plugin for AWS = velero/velero-plugin-for-aws:v1.0.0

http://myip:9000 = is the address for Minio container

$KUBECONFIG= home/ajeesh/.kube/config

===========

ajeesh@Aspire-A515-51G:~$ kubectl get ns

NAME STATUS AGE

default Active 172d

kube-node-lease Active 172d

kube-public Active 172d

kube-system Active 172d

kubernetes-dashboard Active 146d

metallb-system Active 161d

velero Active 14m

ajeesh@Aspire-A515-51G:~$

For Velero commands to autocomplete:

ajeesh@Aspire-A515-51G:~$ source <(velero completion bash)

ajeesh@Aspire-A515-51G:~$ velero backup

backup backup-location

For testing I am creating a test namespace for Velero backup:

ajeesh@Aspire-A515-51G:~$ kubectl create ns nginxtest

namespace/nginxtest created

ajeesh@Aspire-A515-51G:~$ kubectl get ns

NAME STATUS AGE

default Active 172d

kube-node-lease Active 172d

kube-public Active 172d

kube-system Active 172d

kubernetes-dashboard Active 146d

metallb-system Active 161d

nginxtest Active 4s

velero Active 20m

ajeesh@Aspire-A515-51G:~$ kubectl -n nginxtest run nginx --image nginx --replicas 2

kubectl run --generator=deployment/apps.v1 is DEPRECATED and will be removed in a future version. Use kubectl run --generator=run-pod/v1 or kubectl create instead.

deployment.apps/nginx created

ajeesh@Aspire-A515-51G:~$

Create a VELERO BACKUP

----------------------

ajeesh@Aspire-A515-51G:~$ velero backup create namespacenginx --include-namespaces=nginxtest

Backup request "namespacenginx" submitted successfully.

Run `velero backup describe namespacenginx` or `velero backup logs namespacenginx` for more details.

ajeesh@Aspire-A515-51G:~$

ajeesh@Aspire-A515-51G:~$ velero backup get

NAME STATUS CREATED EXPIRES STORAGE LOCATION SELECTOR

namespacenginx New 29d

ajeesh@Aspire-A515-51G:~$

ajeesh@Aspire-A515-51G:~$ kubectl -n velero get backups

NAME AGE

namespacenginx 97s

ajeesh@Aspire-A515-51G:~$

While checking the logs i can see the following

ajeesh@Aspire-A515-51G:~$ velero backup logs namespacenginx

Logs for backup "namespacenginx" are not available until it's finished processing. Please wait until the backup has a phase of Completed or Failed and try again.

ajeesh@Aspire-A515-51G:~$

This seems to be some issue and my backup has some issue, I need to further check this.

ajeesh@Aspire-A515-51G:~$ velero backup describe namespacenginx
Name: namespacenginx
Namespace: velero
Labels:
Annotations:
Phase: New
Namespaces:
Included: nginxtest
Excluded:
Resources:
Included: *
Excluded:
Cluster-scoped: auto
Label selector:
Storage Location:
Snapshot PVs: auto
TTL: 720h0m0s
Hooks:
Backup Format Version: 0
Started:
Completed:
Expiration:
Persistent Volumes:
ajeesh@Aspire-A515-51G:~$

ajeesh@Aspire-A515-51G:~$ velero restore create -help

Error: unknown shorthand flag: 'e' in -elp

Usage:

velero restore create [RESTORE_NAME] [--from-backup BACKUP_NAME | --from-schedule SCHEDULE_NAME] [flags]

Examples:

# create a restore named "restore-1" from backup "backup-1"

velero restore create restore-1 --from-backup backup-1

# create a restore with a default name ("backup-1-") from backup "backup-1"

velero restore create --from-backup backup-1

# create a restore from the latest successful backup triggered by schedule "schedule-1"

velero restore create --from-schedule schedule-1

# create a restore from the latest successful OR partially-failed backup triggered by schedule "schedule-1"

velero restore create --from-schedule schedule-1 --allow-partially-failed

# create a restore for only persistentvolumeclaims and persistentvolumes within a backup

velero restore create --from-backup backup-2 --include-resources persistentvolumeclaims,persistentvolumes

For a stand-alone cluster we would require the following data for the backup
1. The root certificate files /etc/kubernetes/pki/ca.crt and /etc/kubernetes/pki/ca.key
2. ECTD backup

ECTD backup:
I have followed below steps:

$ kubectl get pods -n kube-system | grep etcd
etcd-kmaster.example.com 1/1 Running 21 186d

$ kubectl exec -it -n kube-system etcd-kmaster.example.com -- /bin/sh

# etcdctl snapshot save
No help topic for 'snapshot'

In this case, I would require to issue the following command.

# export ETCDCTL_API=3

Then our backup command

# export ETCDCTL_API=3
# etcdctl --endpoints=https://127.0.0.1:2379 --cacert=/etc/kubernetes/pki/etcd/ca.crt --cert=/etc/kubernetes/pki/etcd/healthcheck-client.crt --key=/etc/kubernetes/pki/etcd/healthcheck-client.key snapshot save etcd-snapshot-$(date +%Y-%m-%d_%H:%M:%S_%Z).db
{"level":"warn","ts":"2020-05-10T17:01:10.150Z","caller":"clientv3/retry_interceptor.go:116","msg":"retry stream intercept"}
Snapshot saved at etcd-snapshot-2020-05-10_17:01:10_UTC.db
#du -shc etcd-snapshot-2020-05-10_17:01:10_UTC.db
3.9M etcd-snapshot-2020-05-10_17:01:10_UTC.db
3.9M total
#

HELM 3 The new chages and an overview

2019-12-04T12:04:00.001+05:30

Helm3 has entirely changed its fundamentals, like tiller pods and service account permissions which we have used in version2.

So in the version3, it is quite easy for installing and moreover security aspect, In earlier versions, everyone installed it with proving full admin privileges. Those who are using Helm version 2 you must make sure you are using a separate and RBAC for the tiller Service Account.

In the new version Helm will use the same Kube config file permission you are using for managing your Kubernetes cluster.

Here I am providing the useful commands and configuration for Helm version 3.

Installation:

We can download the latest stable release from here: https://github.com/helm/helm/releases

ajeesh@Aspire-A515-51G:~/Downloads/helm$ tar -zxvf helm-v3.0.0-linux-amd64.tar.gz
linux-amd64/
linux-amd64/helm
linux-amd64/README.md
linux-amd64/LICENSE
ajeesh@Aspire-A515-51G:~/Downloads/helm$ cd linux-amd64/
ajeesh@Aspire-A515-51G:~/Downloads/helm/linux-amd64$ ls
helm LICENSE README.md
ajeesh@Aspire-A515-51G:~/Downloads/helm/linux-amd64$ sudo mv helm /usr/local/bin/
ajeesh@Aspire-A515-51G:~/Downloads/helm/linux-amd64$ helm --help
The Kubernetes package manager
Common actions for Helm:
- helm search: search for charts
- helm pull: download a chart to your local directory to view
- helm install: upload the chart to Kubernetes
- helm list: list releases of charts
ajeesh@Aspire-A515-51G:~/Downloads/helm/linux-amd64$ helm version --short
v3.0.0+ge29ce2a

If you have helm2 version and you can easily migrate your version2 repos to helm version 3 using a helm plugin.

ajeesh@Aspire-A515-51G:~$ helm plugin install https://github.com/helm/helm-2to3Downloading and installing helm-2to3 v0.2.0 ...
https://github.com/helm/helm-2to3/releases/download/v0.2.0/helm-2to3_0.2.0_linux_amd64.tar.gz
Installed plugin: 2to3
ajeesh@Aspire-A515-51G:~$ helm plugin listNAME VERSION DESCRIPTION
2to3 0.2.0 migrate and cleanup Helm v2 configuration and releases in-place to Helm v3
ajeesh@Aspire-A515-51G:~$ helm 2to3 --helpMigrate and Cleanup Helm v2 configuration and releases in-place to Helm v3

Usage:
2to3 [command]

Available Commands:
cleanup cleanup Helm v2 configuration, release data and Tiller deployment
convert migrate Helm v2 release in-place to Helm v3
help Help about any command
move migrate Helm v2 configuration in-place to Helm v3

Here if you are in version 2 first you need to convert the configuration files from version 2 to verion2 using the command

helm 2to3 move

Then you can move your installed repos one by one using the command.

helm 2to3 convert jenkins
helm 2to3 convert wordpress

After migrated all the repo then you can clean up your old helm version 2

helm 2to3 cleanup : this will delete your tiller pods from your Kubernetes cluster.

ajeesh@Aspire-A515-51G:~$ helm search repo

Error: no repositories configured

Here we need to add our helm repo:

ajeesh@Aspire-A515-51G:~$ helm repo add stable https://kubernetes-charts.storage.googleapis.com"stable" has been added to your repositories
ajeesh@Aspire-A515-51G:~$ helm repo listNAME URL
stable https://kubernetes-charts.storage.googleapis.com

ajeesh@Aspire-A515-51G:~$ helm search repo jenkins
NAME CHART VERSION APP VERSION DESCRIPTION
stable/jenkins 1.9.7

If you search for a new repo using our old helm version 2 command you will get an error , since in version three it is different.

ajeesh@Aspire-A515-51G:~$ helm install stable/wordpress --name myblog

Error: unknown flag: --name

Here you need to use the helm command as like this,

ajeesh@Aspire-A515-51G:~$ helm install myblog stable/wordpress
NAME: myblog
LAST DEPLOYED: Tue Dec 3 22:48:56 2019
NAMESPACE: default
STATUS: deployed
REVISION: 1
NOTES:
1. Get the WordPress URL:

Run your Kubernetes Application in Didicated Hosting servers with Loadbalancer

2019-11-16T21:16:00.000+05:30

After creating your Kubernetes cluster you will think how can I configure a load balancer, like load balancers in AWS GCP, Azure, etc.

Here we can make use of Metallb https://metallb.universe.tf/ as our load balancer.
NFS as storage

This is my K8S cluster:

myk8s-tests/metallb$ kubectl get node -o wide

NAME STATUS ROLES AGE VERSION INTERNAL-IP EXTERNAL-IP OS-IMAGE KERNEL-VERSION CONTAINER-RUNTIME
kmaster.example.com Ready master 10d v1.16.2 172.42.42.100    CentOS Linux 7 (Core) 3.10.0-957.12.2.el7.x86_64 docker://19.3.4
kworker1.example.com Ready 10d v1.16.2 172.42.42.101    CentOS Linux 7 (Core) 3.10.0-957.12.2.el7.x86_64 docker://19.3.4
kworker2.example.com Ready 10d v1.16.2 172.42.42.102    CentOS Linux 7 (Core) 3.10.0-957.12.2.el7.x86_64 docker://19.3.4

Setup MetalLB in your K8S cluster.

1.

kubectl apply -f https://raw.githubusercontent.com/google/metallb/v0.8.3/manifests/metallb.yaml

2. cat metallb.yml

apiVersion: v1
kind: ConfigMap
metadata:
namespace: metallb-system
name: config
data:
config: |
address-pools:
- name: default
protocol: layer2
addresses:
- 172.42.42.110-172.42.42.120 --> Add your IP ranges

Creating a NFS server for our K8S cluster storage:

# apt-get install nfs-kernel-server
# mkdir -p /srv/nfs/kubedata
# chmod -R 777 /srv/nfs/
# cat /etc/exports
/srv/nfs/kubedata *(rw,sync,no_subtree_check,insecure)
# exportfs -rav
exporting *:/srv/nfs/kubedata
# exportfs -v
/srv/nfs/kubedata
(rw,wdelay,insecure,root_squash,no_subtree_check,sec=sys,rw,insecure,root_squash,no_all_squash)
# showmount -e
Export list for ubuntu-01:
/srv/nfs/kubedata *
Then you need to test the NFS mounting in all your k8s nodes.
# showmount -e 172.42.42.10
Export list for 172.42.42.10:
/srv/nfs/kubedata *
# mount -t nfs 172.42.42.10:/srv/nfs/kubedata /mnt
# mount | grep kubedata
172.42.42.10:/srv/nfs/kubedata on /mnt type nfs4 (rw,relatime,vers=4.1,rsize=262144,wsize=262144,namlen=255,hard,proto=tcp,timeo=600,retrans=2,sec=sys,clientaddr=172.42.42.101,local_lock=none,addr=172.42.42.10)

Now configure our k8s cluster with our NFS server.

1. We need to create a physical volume in our NFS server.

cat pv-nfs.yml

apiVersion: v1
kind: PersistentVolume
metadata:
name: pv-nfs-manual
labels:
type: local
spec:
storageClassName: manual
capacity:
storage: 1Gi
accessModes:
- ReadWriteMany
nfs:
server: 172.42.42.10
path: "/srv/nfs/kubedata/nfs_manual"

2. After that, we will create a volume claim that matches our PV

cat pvc-nfs.yml

apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: pvc-nfs-manual
spec:
storageClassName: manual
accessModes:
- ReadWriteMany --> need to check
resources:
requests:
storage: 800Mi --> need check

Verify both manual creations are working fine at your cluster.

nfs$ kubectl get pv,pvc

NAME CAPACITY ACCESS MODES RECLAIM POLICY STATUS CLAIM STORAGECLASS REASON AGE
persistentvolume/pv-nfs-manual 1Gi RWX Retain Bound default/pvc-nfs-manual manual 53m
NAME STATUS VOLUME CAPACITY ACCESS MODES STORAGECLASS AGE
persistentvolumeclaim/pvc-nfs-manual Bound pv-nfs-manual 1Gi RWX manual 53m

Now we can deploy our app.

cat nfs-nginx.yml

apiVersion: apps/v1
kind: Deployment
metadata:
labels:
run: nginx
name: nginx-deploy
spec:
replicas: 1
selector:
matchLabels:
run: nginx
template:
metadata:
labels:
run: nginx
spec:
volumes:
- name: www --> this name should be same as Volumemounts name
persistentVolumeClaim:
claimName: pvc-nfs-manual
containers:
- image: nginx
name: nginx
volumeMounts:
- name: www --> need to be same as above name
mountPath: /usr/share/nginx/html

Create a service for our app using type as LoadBalancer

cat nfs-nginx-svc.yml

apiVersion: v1
kind: Service
metadata:
name: nginx
spec:
ports:
- name: http
port: 8080
protocol: TCP
targetPort: 80
selector:
app: nginx
type: LoadBalancer

kubectl create -f nfs-nginx-svc.yml

nfs$ kubectl get all

NAME READY STATUS RESTARTS AGE
pod/nginx-deploy-f5bd4749b-nftg9 1/1 Running 0 51m
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
service/kubernetes ClusterIP 10.96.0.1 443/TCP 10d
service/nginx LoadBalancer 10.103.153.86 172.42.42.110 8080:32012/TCP 11s
NAME READY UP-TO-DATE AVAILABLE AGE
deployment.apps/nginx-deploy 1/1 1 1 51m
NAME DESIRED CURRENT READY AGE
replicaset.apps/nginx-deploy-f5bd4749b 1 1 1 51m

KIND - Kubernetes IN Docker

2019-11-11T00:09:00.002+05:30

We can easily up and running K8S cluster for testing, This very lightweight as compared to other local setups.

This post is a reference for those who are trying to install the Kubernetes cluster on your ubuntu machine.

My Ubuntu 18.04 TLS server is a VirtualBox VM and I have installed the following dependencies on that server.

1. Install Docker

sudo apt-get update
sudo apt-get install apt-transport-https ca-certificates curl gnupg-agent software-properties-common
curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo apt-key add -
sudo apt-key fingerprint 0EBFCD88
sudo add-apt-repository "deb [arch=amd64] https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable"
sudo apt-get update
sudo apt-get install docker-ce docker-ce-cli containerd.io

2. Install GO Language
https://golang.org/dl/

$ wget https://dl.google.com/go/go1.13.4.linux-amd64.tar.gz
$sudo tar -C /usr/local -xzf go1.13.4.linux-amd64.tar.gz
$ export PATH=$PATH:/usr/local/go/bin
$ go version
go version go1.13.4 linux/amd64

3. kubectl

$ curl -LO https://storage.googleapis.com/kubernetes-release/release/`curl -s https://storage.googleapis.com/kubernetes-release/release/stable.txt`/bin/linux/amd64/kubectl
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
100 44.5M 100 44.5M 0 0 1209k 0 0:00:37 0:00:37 --:--:-- 1182k
$ chmod +x ./kubectl
$ sudo mv ./kubectl /usr/local/bin/kubectl

Now install KIND

https://github.com/kubernetes-sigs/kind

$ GO111MODULE="on" go get sigs.k8s.io/kind@v0.5.1
go: finding sigs.k8s.io v0.5.1
$ rm go1.13.4.linux-amd64.tar.gz
$ export PATH=$PATH:/home/ajeesh/go/bin
$ kind version
v0.5.1
$ kind create cluster
Creating cluster "kind" ...
✓ Ensuring node image (kindest/node:v1.15.3) 🖼
✓ Preparing nodes 📦
✓ Creating kubeadm config 📜
✓ Starting control-plane 🕹️
✓ Installing CNI 🔌
✓ Installing StorageClass 💾
Cluster creation complete. You can now use the cluster with:
export KUBECONFIG="$(kind get kubeconfig-path --name="kind")"
kubectl cluster-info

$ export KUBECONFIG="$(kind get kubeconfig-path --name="kind")"
$ kind get kubeconfig-path
/home/ajeesh/.kube/kind-config-kind

$ docker ps
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
b52ee9180210 kindest/node:v1.15.3 "/usr/local/bin/entr…" 14 minutes ago Up 13 minutes 35507/tcp, 127.0.0.1:35507->6443/tcp kind-control-plane

$ kubectl get nodes

NAME STATUS ROLES AGE VERSION

kind-control-plane Ready master 17m v1.15.3

But this is a single node cluster. But if you want to create a multi-node HA cluster we need to do the following settings.

First, delete the current cluster.

$ kind delete cluster
Deleting cluster "kind" ...
$KUBECONFIG is still set to use /home/ajeesh/.kube/kind-config-kind even though that file has been deleted, remember to unset it
$ unset KUBECONFIG
This will delete the kubeconfig file on your .kube folder.
/.kube$ ls
cache http-cache

$ docker ps
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES

A cluster with 3 control-plane nodes and 3 workers

$ cat multi-node-kind.yml
kind: Cluster
apiVersion: kind.sigs.k8s.io/v1alpha3
nodes:
- role: control-plane
- role: control-plane
- role: control-plane
- role: worker
- role: worker
- role: worker
~$ kind create cluster --config multi-node-kind.yml
Creating cluster "kind" ...
✓ Ensuring node image (kindest/node:v1.15.3) 🖼
✓ Preparing nodes 📦📦📦📦📦
✓ Configuring the external load balancer ⚖️
✓ Creating kubeadm config 📜
✓ Starting control-plane 🕹️
✓ Installing CNI 🔌
✓ Installing StorageClass 💾
✓ Joining more control-plane nodes 🎮
✓ Joining worker nodes 🚜
Cluster creation complete. You can now use the cluster with:
export KUBECONFIG="$(kind get kubeconfig-path --name="kind")"
kubectl cluster-info

I have some issue with resources so I have reduced worker node to 1 from 3

$ kubectl get nodes
NAME STATUS ROLES AGE VERSION
kind-control-plane Ready master 2m20s v1.15.3
kind-control-plane2 Ready master 106s v1.15.3
kind-worker Ready 46s v1.15.3
:~$ docker ps
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
a0e52dd3effa kindest/node:v1.15.3 "/usr/local/bin/entr…" 4 minutes ago Up 3 minutes kind-worker
2a6c8833c3cb kindest/node:v1.15.3 "/usr/local/bin/entr…" 4 minutes ago Up 3 minutes 35213/tcp, 127.0.0.1:35213->6443/tcp kind-control-plane2
4e38366ad4a7 kindest/haproxy:2.0.0-alpine "/docker-entrypoint.…" 4 minutes ago Up 4 minutes 37331/tcp, 127.0.0.1:37331->6443/tcp kind-external-load-balancer
8a0ce1959722 kindest/node:v1.15.3 "/usr/local/bin/entr…" 4 minutes ago Up 3 minutes 36145/tcp, 127.0.0.1:36145->6443/tcp kind-control-plane

:~$ kind get nodes
kind-worker
kind-control-plane2
kind-external-load-balancer
kind-control-plane
~$ kubectl -n kube-system get all
NAME READY STATUS RESTARTS AGE
pod/coredns-5c98db65d4-hmrxc 1/1 Running 0 4m31s
pod/coredns-5c98db65d4-vgj9w 1/1 Running 0 4m31s
pod/etcd-kind-control-plane 1/1 Running 0 3m36s
pod/etcd-kind-control-plane2 1/1 Running 0 4m12s
pod/kindnet-7754r 1/1 Running 1 4m13s
pod/kindnet-9c4rt 1/1 Running 1 4m31s
pod/kindnet-b2td4 1/1 Running 1 3m13s
pod/kube-apiserver-kind-control-plane 1/1 Running 0 3m36s
pod/kube-apiserver-kind-control-plane2 1/1 Running 0 4m12s
pod/kube-controller-manager-kind-control-plane 1/1 Running 1 3m58s
pod/kube-controller-manager-kind-control-plane2 1/1 Running 0 3m58s
pod/kube-proxy-c628w 1/1 Running 0 4m13s
pod/kube-proxy-p9787 1/1 Running 0 4m31s
pod/kube-proxy-zf6pm 1/1 Running 0 3m13s
pod/kube-scheduler-kind-control-plane 1/1 Running 1 3m58s
pod/kube-scheduler-kind-control-plane2 1/1 Running 0 4m12s
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
service/kube-dns ClusterIP 10.96.0.10 53/UDP,53/TCP,9153/TCP 4m46s
NAME DESIRED CURRENT READY UP-TO-DATE AVAILABLE NODE SELECTOR AGE
daemonset.apps/kindnet 3 3 3 3 3 4m43s
daemonset.apps/kube-proxy 3 3 3 3 3 beta.kubernetes.io/os=linux 4m45s
NAME READY UP-TO-DATE AVAILABLE AGE
deployment.apps/coredns 2/2 2 2 4m46s
NAME DESIRED CURRENT READY AGE
replicaset.apps/coredns-5c98db65d4 2 2 2 4m31s

VirtualBox 6 upgrade and issues for the latest version

2019-10-08T22:24:00.001+05:30

Upgrade your VirtualBox to the latest release 6

Here I am showing how i have upgraded/downgrade my VirtualBox on Ubuntu machine.
NB: You need to backup your virtual servers before you perform the steps.

Please find the below steps where i have followed for upgrading my virtualbox version 5.1.38 to latest stable version 6.0.12. I didn't take any backup :)

ajeesh@ajeesh-Aspire-A515-51G:~$ ps aux | grep virt
ajeesh   19129 0.1 0.1 167452 12920 ?        S    21:52   0:00 /usr/lib/virtualbox/VBoxXPCOMIPCD
ajeesh   19134 0.4 0.2 761312 23784 ?        Sl   21:52   0:01 /usr/lib/virtualbox/VBoxSVC --auto-shutdown

ajeesh@ajeesh-Aspire-A515-51G:~$ kill -9 19129 19134

root@ajeesh-Aspire-A515-51G:/etc/apt/sources.list.d# apt-get install virtualbox-6.0
Reading package lists... Done
Building dependency tree
Reading state information... Done
The following additional packages will be installed:
libsdl-ttf2.0-0
The following packages will be REMOVED:
virtualbox virtualbox-ext-pack virtualbox-qt
The following NEW packages will be installed:
libsdl-ttf2.0-0 virtualbox-6.0
0 upgraded, 2 newly installed, 3 to remove and 258 not upgraded.
Need to get 109 MB of archives.
After this operation, 147 MB of additional disk space will be used.
Do you want to continue? [Y/n] y

Setting up virtualbox-6.0 (6.0.12-133076~Ubuntu~xenial) ...
addgroup: The group `vboxusers' already exists as a system group. Exiting.
Processing triggers for libc-bin (2.23-0ubuntu10) ...
root@ajeesh-Aspire-A515-51G:

But this version 6.0.12 is causing some issue for my Vagrant containers.

vagrant-container$ vagrant up

The provider 'virtualbox' that was requested to back the machine
'kmaster' is reporting that it isn't usable on this system. The
reason is shown below:

Vagrant has detected that you have a version of VirtualBox installed
that is not supported by this version of Vagrant. Please install one of
the supported versions listed below to use Vagrant:

4.0, 4.1, 4.2, 4.3, 5.0, 5.1

A Vagrant update may also be available that adds support for the version
you specified. Please check www.vagrantup.com/downloads.html to download
the latest version.
ajeesh@ajeesh-Aspire-A515-51G:

So i have downgraded the VirtualBox version to 5.1.38

sources.list.d# apt-get install virtualbox-5.1
Reading package lists... Done
Building dependency tree
Reading state information... Done
Do you want to continue? [Y/n] y
Get:1 http://download.virtualbox.org/virtualbox/debian xenial/contrib amd64 virtualbox-5.1 amd64 5.1.38-122592~Ubuntu~xenial [66.0 MB]
Fetched 66.0 MB in 57s (1,147 kB/s)
Preconfiguring packages ...

Setting up virtualbox-5.1 (5.1.38-122592~Ubuntu~xenial) ...
addgroup: The group `vboxusers' already exists as a system group. Exiting.
root@ajeesh-Aspire-A515-51G:

vagrant-container$ kubectl get nodes
NAME                   STATUS    ROLES     AGE       VERSION
kmaster.example.com    Ready     master    2d21h     v1.16.1
kworker1.example.com   Ready         2d21h     v1.16.1
kworker2.example.com   Ready         2d21h     v1.16.1

LND Lighning Network Vulnerability reported

2019-10-03T19:59:00.002+05:30

LND Lighning Network Vulnerability reported

Recently lightning network developer Russel updated a serious vulnerability for the old versions. The versions which is less than v0.7.0

    CVE-2019-12998 c-lightning < 0.7.1
    CVE-2019-12999 lnd < 0.7
    CVE-2019-13000 eclair <= 0.3

The issue he described as below:

A lightning node accepting a channel must check that the funding transaction
output does indeed open the channel proposed. Otherwise an attacker can claim
to open a channel but either not pay to the peer, or not pay the full amount.
Once that transaction reaches the minimum depth, it can spend funds from the
channel. The victim will only notice when it tries to close the channel and none
of the commitment or mutual close transactions it has are valid.

Solution
--------

Once the funding transaction is seen, peers MUST check that the outpoint as
described in `funding_created`[1] is a funding transaction output[2] with
the amount described in `open_channel`[3].

Fixed versions:
c-lightning: v0.7.1 and above
lnd: v0.7.1 and above
eclair: v0.3.1 and above

So the best way to fix the issue is you need t upgrade to the latest release, While right this i can see the latest version for the lnd is v0.8.0-Beta. From this release onwards, lnd will only support database upgrades from the previous major release. So that means those who are running on v0.6.0 would be required to upgrade v0.7.0 first and then to v0.8.0.

VMWare Tools : Not Running

2019-10-03T19:37:00.001+05:30

In VMWare vSphere Client you will see the following errors.

VMWare Tools : Not Running ( Not Installed)

We can easily fix this issue by installing open-vm-tools package in linux machine.

root@testing:/home/ubuntu# apt-get install open-vm-tools

Reading package lists... Done
Building dependency tree
Reading state information... Done
The following extra packages will be installed:
libdumbnet1 libicu52 zerofree
Suggested packages:
open-vm-tools-desktop
The following NEW packages will be installed:
libdumbnet1 libicu52 open-vm-tools zerofree
0 upgraded, 4 newly installed, 0 to remove and 218 not upgraded.
Need to get 7,237 kB of archives.
After this operation, 30.8 MB of additional disk space will be used.
Do you want to continue? [Y/n] y

After installing this package you can see your IP address and MAC address using this vmware tool.

upgrade Visual Studio Code version in Ubuntu

2019-09-28T22:30:00.002+05:30

It is very easy for upgrading your Visual Studio Code in your Ubuntu desktop machine.

ajeesh@ajeesh-Aspire-A515-51G:~$ code --version
1.35.1
c7d83e57cd18xxx2843bda1bcf21f
x64

root@ajeesh-Aspire-A515-51G:/home/ajeesh# apt-get install code
Reading package lists... Done
Building dependency tree
Reading state information... Done
The following packages will be upgraded:
code
1 upgraded, 0 newly installed, 0 to remove and 265 not upgraded.
Need to get 55.4 MB of archives.
After this operation, 45.8 MB of additional disk space will be used.
Get:1 https://packages.microsoft.com/repos/vscode stable/main amd64 code amd64 1.38.1-1568209190 [55.4 MB]
Fetched 55.4 MB in 23min 10s (39.9 kB/s)
(Reading database ... 379957 files and directories currently installed.)
Preparing to unpack .../code_1.38.1-1568209190_amd64.deb ...
Unpacking code (1.38.1-1568209190) over (1.35.1-1560350270) ...
Processing triggers for gnome-menus (3.13.3-6ubuntu3.1) ...
Processing triggers for desktop-file-utils (0.22-1ubuntu5.1) ...
Processing triggers for bamfdaemon (0.5.3~bzr0+16.04.20160824-0ubuntu1) ...
Rebuilding /usr/share/applications/bamf-2.index...
Processing triggers for mime-support (3.59ubuntu1) ...
Setting up code (1.38.1-1568209190) ... root@ajeesh-Aspire-A515-51G:/home/ajeesh# exit

ajeesh@ajeesh-Aspire-A515-51G:~$ code --version
1.38.1
b37e54c98e1xxe5a3761284e3ffb0
x64
ajeesh@ajeesh-Aspire-A515-51G:~$

How can we reduce the docker image size

2019-02-28T20:02:00.001+05:30

DIVE

This tool provides a way to discover and explore the contents of a docker image. Additionally the tool estimates
the amount of wasted space and identifies the offending files from the image.

root@ajeesh-desktop:/home/ajeesh# wget https://github.com/wagoodman/dive/releases/download/v0.6.0/dive_0.6.0_linux_amd64.deb

root@ajeesh-desktop:/home/ajeesh# apt install ./dive_0.6.0_linux_amd64.deb

root@ajeesh-desktop:/home/ajeesh# dive test_frontend:v1
Fetching image...
Parsing image...
├─ [layer: 1] 02c8cd0778ef78e : [==============================>] 100 % (29046/29046)
├─ [layer: 2] 0e24a3d04ebc058 : [==============================>] 100 % (4149/4149)
├─ [layer: 3] 1fbf962f1faa79c : [==============================>] 100 % (268/268)
├─ [layer: 4] 263da0d188f39bc : [==============================>] 100 % (20812/20812)
├─ [layer: 5] 2c6d59c15b5a74f : [==============================>] 100 % (22112/22112)
├─ [layer: 6] 4a3e40ad2625f55 : [==============================>] 100 % (6/6)
├─ [layer: 7] 5f67701353f1632 : [==============================>] 100 % (23/23)
├─ [layer: 8] 6e9ac776b0f4ad8 : [==============================>] 100 % (2/2)
├─ [layer: 9] 71f81c9582dbf66 : [==============================>] 100 % (25/25)
├─ [layer: 10] 84a49a835b59732 : [==============================>] 100 % (2/2)
├─ [layer: 11] 9a9aa5f37fdc24c : [==============================>] 100 % (9285/9285)
├─ [layer: 12] bb8588e06b91e7b : [==============================>] 100 % (3/3)
├─ [layer: 13] cacd4f0f725d2c5 : [==============================>] 100 % (4/4)
├─ [layer: 14] d107e0074bfc596 : [==============================>] 100 % (7010/7010)
├─ [layer: 15] d7ecfda03fa2ea7 : [==============================>] 100 % (6293/6293)
├─ [layer: 16] f08e6b62ac1a1d3 : [==============================>] 100 % (1354/1354)
├─ [layer: 17] ff6cffce858c4c9 : [==============================>] 100 % (1428/1428)
├─ [layer: 18] ffa2599ac9ec53e : [==============================>] 100 % (885/885)
╧
Analyzing image...
Building cache...

Export a Linux virtual machine from VMWare EXSI server and Import to AWS

2016-04-12T14:56:00.001+05:30

We can export our EXSI virtual machine images to aws and create the exact same machine as your are running on your EXSI machine.

For this process we need to do the following steps.

1. Download and install AWS CLI
2. Configure the access key with your aws console (IAM access)
3. Export the virtual machine from EXSI machine to your local machine as ova formate
4. Import the OVA image file to your aws S3 bucket

Setup AWS CLI

Download the AWS CLI here:
https://s3.amazonaws.com/aws-cli/AWSCLI64.msi
After that complete the installation.

[root@ip-172-31-56-125 ec2-user]# aws configure
AWS Access Key ID [None]: AKIAXXXXXXXWHTA
AWS Secret Access Key [None]: svcngBGXXXnijOWPLDXXXXXXXHaqs
Default region name [None]: us-east-1
Default output format [None]:
[root@ip-172-31-56-125 ec2-user]#

After the configuration we can test and confirm everything seems to be working fine.

[root@ip-172-31-56-125 ec2-user]# aws ec2 create-security-group --group-name AJVMGRP --description "testing vmtestimptest"
{
    "GroupId": "sg-2a250452"
}
[root@ip-172-31-56-125 ec2-user]#

So we have successfully configured the AWS CLI on this machine

[root@ip-172-31-56-125 ec2-user]# aws ec2 import-image --cli-input-json "{ \"Description\": \"Kalilinux-2016\", \"DiskContainers\": [ {\"Description\": \"Kalilinux-2016\", \"UserBucket\": { \"S3Bucket\": \"vmimportajeesh\", \"S3Key\" : \"CentOS-6.4-i386-minimal.ova\" } } ]}"

{
    "Status": "active",
    "Description": "Kalilinux-2016",
    "Progress": "2",
    "SnapshotDetails": [
        {
            "UserBucket": {
                "S3Bucket": "vmimportajeesh",
                "S3Key": "CentOS-6.4-i386-minimal.ova"
            },
            "DiskImageSize": 0.0
        }
    ],
    "StatusMessage": "pending",
    "ImportTaskId": "import-ami-fggrwl9r"
}
[root@ip-172-31-56-125 ec2-user]#

On Our EXSI Box
We need to create a vm. The VM should be capable of accepting DHCP assign IP address and remove vmware-tool if we installed any.

Export VM in OVA format

File > Export > Export OVF Template [Single format]

Create a S3 bucket

Create a S3 bucket and make note the ARN

Import the OVA file to S3 Bucket

You can upload the particular OVA file to your S3 bucket

We need to change the service name to vmie.amazoneaws.com(Trust Relationship) and add the following condition

Create a new role[eg: vmimport] and assign administrative privilege

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "vmie.amazonaws.com"
},
"Action": "sts:AssumeRole",
"Condition": {
"StringEquals": {
"sts:ExternalId": "vmimport"
}
}
}
]
}

Import the OVA to AWS

[root@ip-172-31-56-125 ec2-user]# aws ec2 import-image --cli-input-json "{ \"Description\": \"Kalilinux-2016\", \"DiskContainers\": [ {\"Description\": \"Kalilinux-2016\", \"UserBucket\": { \"S3Bucket\": \"vmimportajeesh\", \"S3Key\" : \"CentOS-6.4-i386-minimal.ova\" } } ]}"
-----
{
    "Status": "active",
    "Description": "Kalilinux-2016",
    "Progress": "2",
    "SnapshotDetails": [
        {
            "UserBucket": {
                "S3Bucket": "vmimportajeesh",
                "S3Key": "CentOS-6.4-i386-minimal.ova"
            },
            "DiskImageSize": 0.0
        }
    ],
    "StatusMessage": "pending",
    "ImportTaskId": "import-ami-fggrwl9r"
}
---

We will get a image ID [ import-ami-fggrwl9r ]

to check the status::
aws ec2 describe-import-image-tasks --image-task-ids “import-ami-fggrwl9r”

[root@ip-172-31-56-125 ec2-user]# aws ec2 describe-import-image-tasks --import-task-ids "import-ami-fggrwl9r"
{
    "ImportImageTasks": [
        {
            "Status": "active",
            "Description": "Kalilinux-2016",
            "Progress": "28",
            "SnapshotDetails": [
                {
                    "UserBucket": {
                        "S3Bucket": "vmimportajeesh",
                        "S3Key": "CentOS-6.4-i386-minimal.ova"
                    },
                    "DiskImageSize": 346110976.0,
                    "Format": "VMDK"
                }
            ],
            "StatusMessage": "converting",
            "ImportTaskId": "import-ami-fggrwl9r"
        }
    ]
}
[root@ip-172-31-56-125 ec2-user]#

then this will change to

   "StatusMessage": "updating",
   "ImportTaskId": "import-ami-fggrwl9r"

   "StatusMessage": "booting",
   "ImportTaskId": "import-ami-fggrwl9r"

"StatusMessage": "preparing ami",
"ImportTaskId": "import-ami-fggrwl9r"

[root@ip-172-31-56-125 ec2-user]# aws ec2 describe-import-image-tasks --import-task-ids "import-ami-fggrwl9r"
{
    "ImportImageTasks": [
        {
            "Status": "completed",
            "LicenseType": "BYOL",
            "Description": "Kalilinux-2016",
            "ImageId": "ami-4e6e7924",
            "Platform": "Linux",
            "Architecture": "x86_64",
            "SnapshotDetails": [
                {
                    "UserBucket": {
                        "S3Bucket": "vmimportajeesh",
                        "S3Key": "CentOS-6.4-i386-minimal.ova"
                    },
                    "SnapshotId": "snap-649ee37d",
                    "DiskImageSize": 346110976.0,
                    "DeviceName": "/dev/sda1",
                    "Format": "VMDK"
                }
            ],
            "ImportTaskId": "import-ami-fggrwl9r"
        }
    ]
}
Finally this image is available on your AWS console. Using this you can launch a new vps.

Setting monit on your Ubuntu

2016-03-23T19:14:00.000+05:30

Monit will watch around the clock in your server and can do the following capabilities :

* Monitoring the running server and have the ability to stop , start and restart
* Send email alerts
* Have the ability to monitor the service depends on the cpu,RAM disk, cut-off values

Install::
/home/ubuntu# apt-get install monit
:/etc/monit/conf.d# /etc/init.d/monit restart
* Restarting daemon monitor monit

/etc/monit/conf.d# service monit status
* monit is running

Monit configuration file :: /etc/monit/monitrc

/etc/monit/conf.d# monit status
monit: error connecting to the monit daemon
You will found this error

Actually Monit has an embedded web server which can be used to view status of
services monitored and manage services from a web interface. So we need to enable apache interface in monit configuration file in order to fix this error.

open /etc/monit/monitrc and add the following lines under enable web server.

set httpd port 2812 and
use address localhost
allow localhost
allow admin:monit

/etc/monit/conf.d# /etc/init.d/monit restart
* Restarting daemon monitor monit

/etc/monit/conf.d# netstat -lpn | grep 2812
tcp        0      0 127.0.0.1:2812          0.0.0.0:*               LISTEN      418/monit

root@ip-172-31-56-245:/etc/monit/conf.d# monit summary
The Monit daemon 5.6 uptime: 0m

Process 'mysqld'                    Running
System 'ip-172-31-56-245.ec2.internal' Running

Check out if mysql service is down on the server.

/etc/monit/conf.d# service mysql status
mysql stop/waiting

root@ip-172-31-56-245:/etc/monit/conf.d# monit summary
The Monit daemon 5.6 uptime: 1m

Process 'mysqld'                    Does not exist
System 'ip-172-31-56-245.ec2.internal' Running

After 5 minute monit will automatically restart mysql service.

root@ip-172-31-56-245:/etc/monit/conf.d# monit summary
The Monit daemon 5.6 uptime: 5m

Process 'mysqld'                    Running
System 'ip-172-31-56-245.ec2.internal' Running

DROWN - Decrypting RSA using Obsolete and Weakened eNcryption

2016-03-02T17:10:00.002+05:30

Here I am describing DROWN vulnerability along with affected Operating systems and steps for identification and remediation:

DROWN is a serious vulnerability that affects HTTPS and other services that rely on SSL and TLS, some of the essential cryptographic protocols for Internet security. DROWN allows attackers to break the encryption and read or steal sensitive communications, including passwords, credit card numbers, trade secrets, or financial data.

Most of the web sites are now vulnerable to DROWN including yahoo , icicibank , snapdeal etc

CVE-2016-0800 , known as DROWN

Vulnerable in:
- SSLv2 (Secure Sockets Layer protocol version 2.0)
- TLS (Transport Layer Security) version (1.0 - 1.2)
- Services which do not use SSLv2 , but share their RSA keys with those services which have SSLv2 support, are also vulnerable.

CVE-2016-0703 : which affected OpenSSL versions prior to 1.0.2a, 1.0.1m, 1.0.0r, and 0.9.8z
CVE-2016-0704 : This issue affected OpenSSL versions 1.0.2, 1.0.1l, 1.0.0q, 0.9.8ze and all
earlier versions.

The following OS versions are now effected to DROWN [ RHEL and CentOS)
Red Hat Enterprise Linux 4*
Red Hat Enterprise Linux 5
Red Hat Enterprise Linux 6
Red Hat Enterprise Linux 7

Obuntu 14 and AWS OS are not affected with DOWN vulnerability.

How to check our server is infected or not:
RedHat is providing a script for this: Download the bash script from here : https://access.redhat.com/labs/drown/DROWN-test.sh

Or via a website https://test.drownattack.com

#wget https://access.redhat.com/labs/drown/DROWN-test.sh
#chmod 755 DROWN-test.sh
# ./DROWN-test.sh

WARNING: The installed version of openssl (openssl-1.0.1e-30.el6_6.5) is vulnerable to both general and special DROWN attack and should be upgraded!
See https://access.redhat.com/security/vulnerabilities/drown for more information.

The installed version of openssl-libs (package openssl-libs is not installed) is not vulnerable to DROWN.

===========================
]# yum info openssl
Installed Packages
Name        : openssl
Arch        : x86_64
Version     : 1.0.1e
Release     : 30.el6_6.5
Size        : 4.0 M
Repo        : installed

Available Packages
Name        : openssl
Arch        : x86_64
Version     : 1.0.1e
Release     : 42.el6_7.4
================================================

Red Hat patched OpenSSL lists:

Red Hat Enterprise Linux 4      openssl-0.9.7a-43.23.el4        RHSA-2016:0306
Red Hat Enterprise Linux 5      openssl-0.9.8e-39.el5_11        RHSA-2016:0302
Red Hat Enterprise Linux 5.6   openssl-0.9.8e-12.el5_6.13      RHSA-2016:0304
Red Hat Enterprise Linux 5.9   openssl-0.9.8e-26.el5_9.5       RHSA-2016:0304
Red Hat Enterprise Linux 6      openssl-1.0.1e-42.el6_7.4       RHSA-2016:0301
Red Hat Enterprise Linux 6.2   openssl-1.0.0-20.el6_2.8        RHSA-2016:0303
Red Hat Enterprise Linux 6.4   openssl-1.0.0-27.el6_4.5        RHSA-2016:0303
Red Hat Enterprise Linux 6.5   openssl-1.0.1e-16.el6_5.16      RHSA-2016:0303
Red Hat Enterprise Linux 6.6   openssl-1.0.1e-30.el6_6.12      RHSA-2016:0305
Red Hat Enterprise Linux 7      openssl-1.0.1e-51.el7_2.4       RHSA-2016:0301
Red Hat Enterprise Linux 7.1   openssl-1.0.1e-42.el7_1.10, openssl-1.0.1e-42.ael7b_1.10        RHSA-2016:0305
Red Hat JBoss Web Server 2      openssl Patch Pending
Red Hat JBoss Web Server 3      openssl Patch Pending
Red Hat JBoss Enterprise Application Platform 6 openssl Patch Pending

==================================================

Follow the steps below to disable SSLv2 in aws:

- Select your load balancer (EC2 > Load Balancers).
- In the Listeners tab, click "Change" in the Cipher column.
- Ensure that the radio button for "Predefined Security Policy" is selected
- In the dropdown, select the "ELBSecurityPolicy-2015-05" policy.
- Click "Save" to apply the settings to the listener.
- Repeat these steps for each listener that is using HTTPS or SSL for each load balancer.

Fixing the DROWN on your Centos rpm based server.

1. Upgrade openssl
yum update openssl
2. Check for CVE information after openssl upgrade
rpm -qa openssl --changelog | grep CVE-2016-0800

OR

You can once again run the DROWN scripts from RedHat

A patched system will show

[/usr/local/src]# ./DROWN-test.sh
The installed version of openssl (openssl-1.0.1e-42.el6_7.4.x86_64) is not known to be vulnerable to DROWN.

SAR [Specific Absorption Rate]

2015-07-21T16:58:00.002+05:30

Now everyone interested to buy Smart Phones. We are also known to the excess usage of these phones will cause health issues.

Here the most important thing you may need to understand the SAR value rate for your phone. This will give you a clearer picture of the amount of radio frequency energy absorbed by the body when using a mobile phone.

The neutral value is calculated as 1.6 watts per kilogram (1.6 W/kg). So the value below this number will be considered as safe [ actually not 100%].

You can check Radiation level on your smart phone by dialing *#07#

So the main advantage of using Apple iPhone is its low SAR Value, it's below 0.01

shred and scrub

2015-05-29T18:24:00.001+05:30

Scrub and shred commands are useful when you are installing Linux/Unix operating systems , when the previous tech/person has used windows or other copyright softwares on that drive.

We don't know what are the pirated software, whether he/she has installed on the disk. It would be better to wipe out all data , so that the third party recovery (Micro-Soft inspections, etc )makes them very difficult.

wget http://mirrors.kernel.org/ubuntu/pool/universe/s/scrub/scrub_2.2-2_amd64.deb

dpkg -i scrub_2.2-2_amd64.deb

Command:
scrub -p dod -f /dev/

root@Ajeesh-desktop:~# scrub -p dod -f /dev/sdb1
scrub: using DoD 5220.22-M patterns
scrub: please verify that device size below is correct!
scrub: scrubbing /dev/sdb1 75391565824 bytes (~70GB)
scrub: random |................................................|
scrub: 0x00 |................................................|
scrub: 0xff |................................................|
scrub: verify |................................................|
root@Ajeesh-desktop:~#

named.run using huge size

2015-01-09T03:09:00.000+05:30

On a cpanel server we can see /var/named/data/named.run is using huge size. This is a log file and we can safely truncate this file.

cd /var/named/data
[/var/named/data]# >named.run

exit from mysql shell

2014-07-30T18:41:00.001+05:30

Sometimes you may struck in the mysql shell and you cannot exit from the shell using /q or exit command.

Solution:
use single quotes and then quit from your mysql console.

`> \q
`>
`> ;

'> ''' ( use 3 single quotes)
-> \q
Bye
[root@test ~]#

phpMyAdmin installation

2014-07-18T02:35:00.003+05:30

Steps:

cd /usr/local/src/

wget http://sourceforge.net/projects/phpmyadmin/files/phpMyAdmin/4.2.5/phpMyAdmin-4.2.5-all-languages.tar.gz

tar -xzvf phpMyAdmin-4.2.5-all-languages.tar.gz

mv phpMyAdmin-4.2.5-all-languages /home/ajeesh/public_html/

cd /home/ajeesh/public_html/

mv phpMyAdmin-4.2.5-all-languages phpMyAdmin

cd phpMyAdmin

mkdir config

chmod o+rw config

cp config.inc.php config/ (For migration we need to copy this file and access the web panel, for new installation just visit the web panel and the config file will create automatically.)

: Web Panel access http://ajeesh.com/phpMyAdmin/setup/

Error:

[Fri Jul 18 00:31:06 2014] [error] [client IP] File does not exist: /home/ajeesh/public_html/favicon.ico

[Fri Jul 18 00:31:07 2014] [error] [client IP] PHP Fatal error: Call to undefined function mb_detect_encoding() in /home/ajeesh/public_html/phpMyAdmin/libraries/php-gettext/gettext.inc on line 177

Fix:

yum install php-mbstring

yum install php-mcrypt

/etc/init.d/httpd restart

mv config/config.inc.php /home/ajeesh/public_html/phpMyAdmin/

chmod 644 config.inc.php

rm -rf setup

Latest phpMyadmin needs mysql5.5 version. So I have updated the latest version using the following steps:

rpm -Uvh http://rpms.famillecollet.com/enterprise/remi-release-5.rpm

yum --enablerepo=remi list mysql mysql-server

yum --enablerepo=remi upgrade mysql mysql-server

Missing Word Edit tools : wordpress

2014-06-23T16:25:00.002+05:30

Text Editors and Missing Buttons in wordpress.

You can fix this issue by adding the following line on your wp-config.php file.

You should add this line at the beginning of your php opening tag

Linux / Open Source Forum

Installing Helm by a specific version

Vagrant issue with Ubuntu16.04

Unhealthy status for controller-manager and scheduler

Kubernetes is deprecating Docker?

Kubernetes is deprecating Docker?

EIA 2020 Draft Withdrawal request

AWS Certified Solutions Architect – Associate C02 Tips and Tricks

5 less than K8S = K3S Lightweight Kubernetes

Welcome to nginx!

Backup and restore Kubernetes cluser

HELM 3 The new chages and an overview

Run your Kubernetes Application in Didicated Hosting servers with Loadbalancer

KIND - Kubernetes IN Docker

VirtualBox 6 upgrade and issues for the latest version

LND Lighning Network Vulnerability reported

VMWare Tools : Not Running

upgrade Visual Studio Code version in Ubuntu

How can we reduce the docker image size

Export a Linux virtual machine from VMWare EXSI server and Import to AWS

Setting monit on your Ubuntu

DROWN - Decrypting RSA using Obsolete and Weakened eNcryption

Fixing the DROWN on your Centos rpm based server.

1. Upgrade openssl
yum update openssl
2. Check for CVE information after openssl upgrade
rpm -qa openssl --changelog | grep CVE-2016-0800

OR

You can once again run the DROWN scripts from RedHat

A patched system will show

[/usr/local/src]# ./DROWN-test.sh
The installed version of openssl (openssl-1.0.1e-42.el6_7.4.x86_64) is not known to be vulnerable to DROWN.

SAR [Specific Absorption Rate]

shred and scrub

named.run using huge size

exit from mysql shell

phpMyAdmin installation

Missing Word Edit tools : wordpress

`define('CONCATENATE_SCRIPTS', false);`

`OR`

`Install Google Libraries plugin, which will use common java script libraries from google's not from wordpress.`

Linux / Open Source Forum

Installing Helm by a specific version

Vagrant issue with Ubuntu16.04

Unhealthy status for controller-manager and scheduler

Kubernetes is deprecating Docker?

Kubernetes is deprecating Docker?

EIA 2020 Draft Withdrawal request

AWS Certified Solutions Architect – Associate C02 Tips and Tricks

5 less than K8S = K3S Lightweight Kubernetes

Welcome to nginx!

Backup and restore Kubernetes cluser

HELM 3 The new chages and an overview

Run your Kubernetes Application in Didicated Hosting servers with Loadbalancer

KIND - Kubernetes IN Docker

VirtualBox 6 upgrade and issues for the latest version

LND Lighning Network Vulnerability reported

VMWare Tools : Not Running

upgrade Visual Studio Code version in Ubuntu

How can we reduce the docker image size

Export a Linux virtual machine from VMWare EXSI server and Import to AWS

Setting monit on your Ubuntu

DROWN - Decrypting RSA using Obsolete and Weakened eNcryption

Fixing the DROWN on your Centos rpm based server.

1. Upgrade openssl yum update openssl2. Check for CVE information after openssl upgraderpm -qa openssl --changelog | grep CVE-2016-0800

OR

You can once again run the DROWN scripts from RedHat

A patched system will show

[/usr/local/src]# ./DROWN-test.sh The installed version of openssl (openssl-1.0.1e-42.el6_7.4.x86_64) is not known to be vulnerable to DROWN.

SAR [Specific Absorption Rate]

shred and scrub

named.run using huge size

exit from mysql shell

phpMyAdmin installation

Missing Word Edit tools : wordpress

define('CONCATENATE_SCRIPTS', false);

OR

Install Google Libraries plugin, which will use common java script libraries from google's not from wordpress.

1. Upgrade openssl
yum update openssl
2. Check for CVE information after openssl upgrade
rpm -qa openssl --changelog | grep CVE-2016-0800

[/usr/local/src]# ./DROWN-test.sh
The installed version of openssl (openssl-1.0.1e-42.el6_7.4.x86_64) is not known to be vulnerable to DROWN.

`define('CONCATENATE_SCRIPTS', false);`

`OR`

`Install Google Libraries plugin, which will use common java script libraries from google's not from wordpress.`