spiarh

Quick test on how to run systemd inside a pod on Kubernetes

based from https://developers.redhat.com/blog/2016/09/13/running-systemd-in-a-non-privileged-container/

Create container image:

FROM opensuse/tumbleweed:latest
RUN zypper install -y systemd systemd-sysvinit
CMD ["/sbin/init"]

spiarh

HAProxy on SLE-HA from scratch

In this guide we will deploy HAProxy in Failover mode leveraging SUSE Linux Enterprise High Availability Extension 15 SP1.

This HAProxy instance will be used as a highly-available load-balancer for a CaaSP cluster with 3 masters.

The HA cluster will have two members:

spiarh

Deploy a cluster from scratch

The process before bootstrapping a new cluster from GM is defined in this order:

1. Accept the nodes in salt
2. Register the nodes
3. Update the packages
4. Reboot the nodes simultaneously
5. Deploy cluster

spiarh

Nginx TCP Load Balancer with passive checks

We can use the ngx_stream_module module (available since version 1.9.0) in order to use TCP load balancing. In this mode, nginx will just forward the tcp packets the masters.

/!\ The Open Source version of Nginx only allows one to use passive health checks so therefore using this configuration is only to consider in a PoC. The main issue with passive health-checks is that nginx will mark a node as unresponsive and not distribute traffic only after a failed request.

spiarh

Add additinal scrape configs to Prometheus k8s

This procedure takes into account Prometheus Operator has been installed using the manifests provided in prometheus-operator/contrib/kube-prometheus/manifests/ on https://github.com/coreos/prometheus-operator.git

This procedure is based on this documentation

spiarh

These commands must be run on all the masters

• override kube-controller-manager ExecStart in systemd service

# mkdir /etc/systemd/system/kube-controller-manager.service.d
# cat > /etc/systemd/system/kube-controller-manager.service.d/override.conf<<EOF
[Service]
ExecStart=
ExecStart=/usr/bin/hyperkube controller-manager \\

spiarh

EXTERNAL AUTH

In both directories, 'user-regular1' and 'user-regular2' are member of the 'k8s-users' group, 'user-admin' is member of 'k8s-admins' group.

For Active Direcoty, 'user-bind' is a simple user which is member of the default 'Domain Users' group in Active Directory. Hence, we can use it to authenticate because has read-only access to Active Directory.

The mail attribute is used to create the RBAC rules.

1. LDAP ACTIVE DIRECTORY