clementnuss

asciinema server deployment

The few following manifests present how asciinema-server on Kubernetes, with a caching nginx reverse proxy (which also does the requests against the S3 endpoint, for cases where the S3 server is not publicly accesible).

For more details regarding the S3 proxying, check https://github.com/asciinema/asciinema-server/pull/363/files#diff-10557452cffb1028618b3bc1bfdd9f01d79642fe2823dc078f5208a0121b8495

clementnuss

Kubernetes CronJob to backup, compress (with gzip --rsyncable), and finally use restic to backup your DBs to an S3 endpoint.

more details in my blog post

Advantages:

• using mariadb:latest Docker image, to ensure I don't use an outdated mariadb-dump binary
• backing up each database in a separate file, to make for easier restore
• compressing the backups with gzip and the --rsyncable option (details here), which makes gzip "regularly reset his compression algorithm to what it was at the beginning of the file", so that changes to a portion of the file do not alter the whole compressed output, which permits to make incremental backups.
• using restic to store the backups on an S3 endpoint (Cloudflare R2, with a generous free tier!), which makes for simple management and rotation, as well as for simple restores.

clementnuss

Using eBPF to print argv and envp when running a specific file

With bpftrace on Linux, it's quite simple to monitor when a specific binary is run, and to print it's args and the environment variables passed to it.

This can be done with the following bpftrace "program":

tracepoint:syscalls:sys_enter_execve
/str(args->filename) == "/etc/network/if-up.d/resolved" /
{

clementnuss

etcd - moving the leader away

When patching some Kubernetes control-plane nodes on which etcd also happens to be running, you might want to gracefully transfer the leadership of the etcd cluster away before patching and eventually patching the node.

This can be achieved with the following script, provided you specify the adequate environment variables in /etc/profile.d/etcd-all:

set -o pipefail && \
source /etc/profile.d/etcd-all && \
AM_LEADER=$(etcdctl endpoint status | grep $(hostname) | cut -d ',' -f 5 | tr -d ' ') && \

clementnuss

#fish
function yqblank;
  yq eval "$argv[1]" "$argv[2]" | diff -B "$argv[2]" - | patch "$argv[2]" -o -
end

#bash
yqblank() {
  yq "$1" "$2" | diff -B "$2" - | patch "$2" -
}

clementnuss

Batch deletion of S3 objects

If you ever tried to delete more than a few hundred files on S3, you might have noticed how slow it was.

To speed-up the deletion, we can use a few bash commands to parallelize the deletion, and we can also use some json description of the objets we want to delete.

Concretely, it permits us to delete e.g. 1000 files with a single s3 API request.

How ?

clementnuss

package main

import (
	"fmt"
	"os"
	"strings"
	"time"

	"github.com/bitfield/script"
)

clementnuss

#!/bin/bash

stdin="$([[ -p /dev/stdin ]] && cat -)"
lemonade copy $stdin

clementnuss

the following ffmpeg permits to save images in highest quality to generate a timelapse:

export RTSP_STREAM='rtsps://abcdeffhijklmnop:1234/asdlfkjasdlf'
ffmpeg -loglevel error -rtsp_transport tcp \
  -i $RTSP_STREAM \
  -vf fps=1/120 \
  -q:v 1 -strftime 1 \
  "%Y-%m-%d_%H-%M-%S.jpg"

clementnuss

#!/bin/bash
# Auther Clément Nussbaumer <clement@astutus.org>, Aug 2020
#
# CNI interception script: permits to do live debugging of CNI calls.
# Usage: rename the real cni binary file with by prepending the orginal binary name with real_
# E.g. for multus, real_multus. Now put this script in place the binary: 
# Concretely, name it `multus` if you want to intercept multus calls.

cni=$(echo $0 | awk '{split($0,r,"/"); print r[length(r)]}')
echo 'intercepted '$cni' cni with command: ' $CNI_COMMAND ' and caller: ' $(ps -o comm= $PPID) | logger -t cni