Category Archives: Sysadmin

Running a Container Registry Behind Apache HTTPD

Posted on by
2

I had originally run my container registry using a self signed certificate like this:

podman run --name mirror-registry -p 4000:5000     -v /opt/registry/data:/var/lib/registry:z      -v /opt/registry/auth:/auth:z      -e "REGISTRY_AUTH=htpasswd"      -e "REGISTRY_AUTH_HTPASSWD_REALM=Registry Realm"      -e REGISTRY_AUTH_HTPASSWD_PATH=/auth/htpasswd      -v /opt/registry/certs:/certs:z      -e REGISTRY_HTTP_TLS_CERTIFICATE=/certs/domain.crt      -e REGISTRY_HTTP_TLS_KEY=/certs/domain.key      -e REGISTRY_COMPATIBILITY_SCHEMA1_ENABLED=true -d docker.io/library/registry:2

But now that I am using FreeIPA for my Bastion host, I want to use the IPA CA cert for signing the HTTPS request. The easiest thing to do is to run the registry in the container still, but then to front it with mod_proxy.

Continue reading →

Syncing and Serving Yum Repos on RHEL 8

Posted on by
6

My Lab machines do not have direct access to the internet. This mirrors how my customers tend to run their environments. Instead, I run a single bastion host that can connect to the internet, and use that to perform all operations on my lab machines.

While it is great to be able to use the Install media to add packlages to PXE booted systems, after some time, the set of packages available is older than you want. For example, I hit a bug that required an update of Network Manager. So, I want to make a local yum repo from my RHEL 8 subscription. RHEL 8 makes this fairly easy.

Continue reading →

Network Policy to Explicitly Allow access from all Namespaces

Posted on by
Reply

The Default network policy in OpenShift allows all access from all pods in all namespaces via the cluster IP. However, once you start enforcing policy on a project, all policy decision need to be made explicit. If you want to still allow access from all projects, you can use the following policy file.

kind: NetworkPolicy
apiVersion: networking.k8s.io/v1
metadata:
  name: allow-all-namespaces
spec:
  ingress:
  - from:
    - namespaceSelector: {}

An Ansible Approach to Registering RHEL Systems

Posted on by
Reply

I am constantly creating and deleting virtual machines. These virtual machines often are RHEL systems, and need to be registered with Red Hat’s CDN. While In the past I had a Role that was wrapped into other provisioning playbooks to perform this task, I find that there are enough one-offs to make it useful to do this as a stand alone playbook. Here is how I set it up, including my rational.

Continue reading →

PXE Lessons learned

Posted on by
Reply

When provisioning goes wrong, it can eat up a lot of time. I need to install and configure a RHEL 8 machine to act as an HA proxy for an OpenShift install, and it was somewhat resistant to my efforts. I learned a couple things worth recording:

  1. The minimum size of a VM for a PXE install is roughtly 3 GB now, as that is what it takes to properly handle the initrd. If you make the VM too small, the Filesystem in the initrd gets corrupted.
  2. If the kickstart fails, you can change “graphical” or “cmdline” to text and get an interactive install, which should set you up with a properly formatted kickstart config in the VM /root/anaconda-ks.conf file when you are done.
  3. You are going to want to keep an index file based on the MAC addresses of the Hardware you are provisioning. Right now, I am using the symlinks in the tftp directory to play that role. The script I use to set the symlinks is below.
  4. I really should be using Cobbler to manage all this. I’ll learn it some day.
#!/bin/sh
 
function reset_link(){
 
MACHINE=$1
TARGET=$2
echo  ---------------------------------------
echo reset          $MACHINE
rm             $MACHINE
ln -s $TARGET  $MACHINE
}
 
r610s='01-00-21-9b-93-d0-90 01-00-21-9b-98-a3-1f 01-00-21-9b-9b-c4-21'
 
kvms='01-52-54-00-2d-74-f1 01-52-54-00-dc-37-cb 01-52-54-00-52-fa-3d'
 
LB=01-52-54-00-b1-5b-16
BOOTSTRAP=01-52-54-00-29-0b-bf
 
for MACHINE in $r610s
do
reset_link $MACHINE rhel8.2-r610
done
 
for MACHINE in $kvms
do
reset_link $MACHINE rhcoreos-4.4.3-kvm-control
done
 
reset_link $BOOTSTRAP rhcoreos-4.4.3-kvm-bootstrap
reset_link $LB rhel8.2-kvm

This is obviously ripe for a YAML type config file.

To convert a MAC to the appropriate form for pxelinux.cfg use this bash. note that I prepended 01: to the mac address so that it is ends up in the right place in the final file name:

echo  01:52:54:00:e0:f0:fd | sed 's!:!-!g