PhilipSchmid

# https://github.com/bloomberg/goldpinger
---
apiVersion: v1
kind: Namespace
metadata:
  name: goldpinger
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:

PhilipSchmid

kubectl run -it --rm tshoot --overrides='
{
  "spec": {
    "containers": [
      {
        "name": "tshoot",
        "image": "nicolaka/netshoot:latest",
        "command": ["/bin/bash"],
        "stdin": true,
        "stdinOnce": true,

PhilipSchmid

Rancher K8s Cluster on VMware vSphere

Prerequisites

vCenter Configuration

• Configure the Network Protocol Profile on the vCenter according to: https://www.virtualthoughts.co.uk/2020/03/29/rancher-vsphere-network-protocol-profiles-and-static-ip-addresses-for-k8s-nodes/
• Ensure to create a service user with the regarding global and folder specific permissions: https://rancher.com/docs/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/vsphere/provisioning-vsphere-clusters/creating-credentials/
  • Beside the vCenter role permissions from the official Rancher documentation, the following ones need to be provided in order to configure the Nodes via vApp options:
    • Content Library: Read storage
    • Extension: Register extension
• vSphere Tagging: Assign or Unassign vSphere Tag on Object

PhilipSchmid

apiVersion: apps/v1
kind: Deployment
metadata:
  name: iperf3
spec:
  replicas: 2
  selector:
    matchLabels:
      app: iperf3
  template:

PhilipSchmid

kubeadm Cluster Setup

• kubeadm Cluster Setup
  • Prerequisites
  • Installation
    • Crictl
    • Containerd
    • Kubeadm
  • Cluster Creation
    • Init

PhilipSchmid

Single-host Minio Setup

Docker-Compose single-host Minio S3 setup using Traefik (Let's Encrypt with DNS-01 challenge via Cloudflare) for TLS offloading.

Tested on Ubuntu 20.04.

Host Prerequisites

Run all commands shown here with root or prepend a sudo to the regarding commands which require higher privileges.

Install Docker

PhilipSchmid

General Commands

Delete history and exit bash

cat /dev/null > ~/.bash_history && history -c && exit

Print all uncommented config file lines (without the empty ones)

cat file.txt | egrep -v '^#|^$'

PhilipSchmid

Rancher v2.X KeyCloak Authentication Backend Configuration

Ranchers official documentation about how to configure the Rancher <> KeyCloak setup is fine but definitely not sufficient to successfully configure it (https://rancher.com/docs/rancher/v2.x/en/admin-settings/authentication/keycloak/). That's the reason why here every single required step is documented down here.

KeyCloak Configuration

I simply use the default master realm for the Rancher client. Nevertheless, it would sometimes absolutely make sense to use a custom KeyCloak realm.

1. Login as admin on https://keycloak.example.com/. Important: It's crucial that in KeyCloak the same username exists as you use as admin user on Rancher. Since I just use the admin account in this guide, this prerequisite is already achieved.
2. Create a new client under https://keycloak.example.com/auth/admin/master/console/#/realms/master/clients
   • Client ID: https://rancher.example.com/v1-saml/keycloak/saml/metadata

PhilipSchmid

Optional: Disable PSA

k label ns default pod-security.kubernetes.io/enforce=privileged
k label ns default pod-security.kubernetes.io/audit=privileged # optional
k label ns default pod-security.kubernetes.io/warn=privileged # optional

Start tshoot pod:

echo '

PhilipSchmid

- name: custom_certmanager_monitoring
  rules:
    - alert: CertManagerAbsent
      expr: absent(up{job="cert-manager"})
      for: 1h
      annotations:
        message: "Cert Manager has dissapeared from Prometheus service discovery."
      labels:
        severity: critical
    - alert: CertManagerACMEProxyReachability