felixkrohn

How to install CentOS 9 STREAM on OVH/SoYouStart/Kimsufi

• The idea behind this is to install your own custom OS from official/trusted sources, even on a cheap server where you don't have a SOL/IPMI graphical console.
• connect to the OVH/SoYouStart/Kimsufi API and create a ipxe script under https://api.ovh.com/console/#/me/ipxeScript~POST, see centos9.ipxe below
• boot your server from this netboot, and ping it to follow the process. If you can observe the webserver's logs you will se your server's IP pulling kernel and initrd with "iPXE" user agent, then it will start pinging, and retrieve the kickstart.cfg a bit later (with "curl" user agent). This is the moment when you could set your server back to "Boot from Hard Disk".
• Also at this point you can connect to your server with SSH using the key/password set in the kickstart file. type tmux a to attach the install's tmux session and follow the progress. For debugging, check the logs in /tmp and those sent over syslog.

upstream documentation

• [kernel/

felixkrohn

This script iterates through all released PVs, and does the following:

• add an annotation with today's timestamp if missing
• check if a present annotation indicates a date older than $KEEPDAYS days, and deletes the PV if yes

It's triggered by an ansile-managed cronjob on a bastion host.

felixkrohn

centos8 @ OVH/SoYouStart/Kimsufi

How to install CentOS 8 on OVH/SoYouStart/Kimsufi

• connect to the OVH/SoYouStart/Kimsufi API and create a ipxe script under https://eu.api.kimsufi.com/console/#/me/ipxeScript#POST or equivalent, see centos8.ipxe below
• boot your server from this netboot, and ping it to follow the process. If you can observe the webserver's logs you will se your server's IP pulling kernel and initrd with "iPXE" user agent, then it will start pinging, and retrieve the kickstart.cfg a bit later (with "curl" user agent). This is the moment when you could set your server back to "Boot from Hard Disk".
• Also at this point you can connect to your server with SSH using the key/password set in the kickstart file. type tmux a to attach the install's tmux session and follow the progress. For debugging, check the logs in /tmp and those sent over syslog.

upstream documentation

• [kernel/installer boot params in ipxe script](https://access.redhat.com/documentation/en-us/red_hat_enterprise_li

felixkrohn

How to install Fedora CoreOS on OVH/SoYouStart/Kimsufi

• get the kernel and initrd from https://getfedora.org/en/coreos/download/ -> "bare metal" -> PXE and put them on a webserver.
• connect to the OVH/SoYouStart/Kimsufi API and create a ipxe script under https://eu.api.kimsufi.com/console/#/me/ipxeScript#POST or equivalent, see coreos.ipxe below
• create a basic ignition yaml file, convert it to ignition using the fcct tool as described here: https://docs.fedoraproject.org/en-US/fedora-coreos/producing-ign/
• Put this resulting file (config.ign) in the same webroot as kernel & initrd
• (see https://docs.fedoraproject.org/en-US/fedora-coreos/fcct-config/ for more details, and https://github.com/keithy/ign-tool/wiki/plug:goss for some more examples.
• boot your server from this netboot, and ping it to follow the process. If you can observe the webserver's logs you will se your server's IP pulling kernel and initrd with "iPXE" user agent, then it will start pinging, and retrieve the config.ign a bit

felixkrohn

groups:
- name: datetime
  rules:
  - record: daily_saving_time_belgium
    expr: |
      (vector(0) and (month() < 3 or month() > 10))
      or
      (vector(1) and (month() > 3 and month() < 10))
      or
      (

felixkrohn

# after an accidental "oc delete pv --all" all PVs on the cluster are marked as "Terminating".
# As a result all PV have to be re-created, which is done by the script.
# Before force-deleting the PV, all deployments accessing the PV via PVC are being scaled down, and scaled up again afterwards.
#
# (by the way, the "Terminating" status is not a real status, but is what oc/kubectl print out
# when an object has a DeletionTimestamp, which is immutable and cannot be deleted anymore. See
# https://github.com/kubernetes/kubernetes/blob/master/pkg/kubectl/describe/versioned/describe.go#L1374-L1378
#           if pv.ObjectMeta.DeletionTimestamp != nil {
#                 w.Write(LEVEL_0, "Status:\tTerminating (lasts %s)\n", translateTimestampSince(*pv.ObjectMeta.DeletionTimestamp))
#       		} else {

felixkrohn

• log into a router pod (oc rsh -n default router-YY-XXXXX)
• confirm the socket used by haproxy is /var/lib/haproxy/run/haproxy.sock (using ps ax)
• connect to the socket with socat socat /var/lib/haproxy/run/haproxy.sock stdio
• use "prompt" and "help" for the corrsponding actions, or directly call echo "prompt" | socat /var/lib/haproxy/run/haproxy.sock stdio echo "help" | socat /var/lib/haproxy/run/haproxy.sock stdio
• get raw stats in CSV format. note the "iid" value for the backend you're debugging echo "show stat" | socat /var/lib/haproxy/run/haproxy.sock stdio
• get "typed" stats in the format [BS].IID.x.FIELD-ID.FIELD-Description with the value in the last column

felixkrohn

#!/bin/sh
# this script takes care of removing the i2c_hid kernel module (touchpad driver) before suspending,
# and loading it again after resuming.
# This avoids spurious messages issued by the driver that interrupt the suspend process:
# i2c_hid i2c-DLL07A0:01: i2c_hid_get_input: incomplete report (83/2)
# HowTo: copy it for example to /etc/pm/sleep.d/11_i2c_hid, then run chmod +x /etc/pm/sleep.d/11_i2c_hid

case "${1}" in
        sleep|suspend|hibernate)
                rmmod i2c_hid

felixkrohn

delete pod via API - from https://access.redhat.com/solutions/3536141

echo '{ "propagationPolicy": "Background" }' | curl -k -X DELETE -d @-  -H "Authorization: Bearer $TOKEN" -H 'Accept: application/json' -H 'Content-Type: application/json'  https://openshift-master.$DOMAIN/api/v1/namespaces/$NAMESPACE/pods/$PODNAME

kill haproxy processes older than 12h

ps -eo pid,etimes,comm,user | awk '{if ($3 = /haproxy/ && $2>43200) print $1}' | xargs kill -15

add infra nodeselector to namespace with oc patch

oc patch namespace $NAMESPACE -p '{"metadata":{"annotations":{"openshift.io/node-selector":"region=infra"}}}'

get a table of canonical nodenames together with their name label:

oc get nodes -Lname --output=jsonpath='{range .items[*].metadata}{.name}{" "}{.labels.name}{"\n"}'

translate canonical nodename to inventory name

alias nn="oc get node --output=jsonpath='{range .metadata}{.labels.name}{"\n"}' ${1}"