“I can do any thing. I can’t do everything.”
The sheer number of projects and problem domains covered by OpenStack was overwhelming. I never learned several of the other projects under the big tent. One project that is getting relevant to my day job is Ironic, the bare metal provisioning service. Here are my notes from spelunking the code.
The key piece of persisted data in an DHCP server is the lease. A lease is a the mapping between a MAC address and an IP address, limited in time. A Lease typically has a start time and an end time, but can be renewed. Because I am still living in an IPV4 world, I have to deal with arbitrarily small pools of IP addresses. Thus, the design needs to strike the balance between static and dynamic: a machine should generally get back the same IP address each time. However, if addresses get tight, address reuse should be aggressive.
To capture DHCP packets I ran:
tcpdump port 67 -i vnet0 -vvvv -w /tmp/packets.bin
That gave me a binary file 940 bytes long. This is actually 2 packets: the request and the response. This has the IP header, the UDP header, and the DHCP packet payload in it.
The Extract Function refactoring is the starting point for much of my code clean up. Once a “Main” function gets sufficiently complicated, I pull pieces of it out into their own functions, often with an eye to making them methods of the involved classes.
While working with some rust code, I encountered an opportunity to execute this refactoring on some logging code. Here’s how I executed it.
I had originally run my container registry using a self signed certificate like this:
podman run --name mirror-registry -p 4000:5000 -v /opt/registry/data:/var/lib/registry:z -v /opt/registry/auth:/auth:z -e "REGISTRY_AUTH=htpasswd" -e "REGISTRY_AUTH_HTPASSWD_REALM=Registry Realm" -e REGISTRY_AUTH_HTPASSWD_PATH=/auth/htpasswd -v /opt/registry/certs:/certs:z -e REGISTRY_HTTP_TLS_CERTIFICATE=/certs/domain.crt -e REGISTRY_HTTP_TLS_KEY=/certs/domain.key -e REGISTRY_COMPATIBILITY_SCHEMA1_ENABLED=true -d docker.io/library/registry:2
But now that I am using FreeIPA for my Bastion host, I want to use the IPA CA cert for signing the HTTPS request. The easiest thing to do is to run the registry in the container still, but then to front it with mod_proxy.
My Lab machines do not have direct access to the internet. This mirrors how my customers tend to run their environments. Instead, I run a single bastion host that can connect to the internet, and use that to perform all operations on my lab machines.
While it is great to be able to use the Install media to add packlages to PXE booted systems, after some time, the set of packages available is older than you want. For example, I hit a bug that required an update of Network Manager. So, I want to make a local yum repo from my RHEL 8 subscription. RHEL 8 makes this fairly easy.
M<y local PXE setup only puts the minimal set of RPMS on a machine. If want to install additional, I need to get access to the rest of the Repo. Here is what I did:
I seem to have a bad Ethernet port on the NUC. Since I have an external Ethernet adapter as well, this is not a show stopper, but it does change the approach I am going to make to my home network. As always: Simplification is preferred. Here’s the current approach:
I am constantly creating and deleting virtual machines. These virtual machines often are RHEL systems, and need to be registered with Red Hat’s CDN. While In the past I had a Role that was wrapped into other provisioning playbooks to perform this task, I find that there are enough one-offs to make it useful to do this as a stand alone playbook. Here is how I set it up, including my rational.
When provisioning goes wrong, it can eat up a lot of time. I need to install and configure a RHEL 8 machine to act as an HA proxy for an OpenShift install, and it was somewhat resistant to my efforts. I learned a couple things worth recording:
- The minimum size of a VM for a PXE install is roughtly 3 GB now, as that is what it takes to properly handle the initrd. If you make the VM too small, the Filesystem in the initrd gets corrupted.
- If the kickstart fails, you can change “graphical” or “cmdline” to text and get an interactive install, which should set you up with a properly formatted kickstart config in the VM /root/anaconda-ks.conf file when you are done.
- You are going to want to keep an index file based on the MAC addresses of the Hardware you are provisioning. Right now, I am using the symlinks in the tftp directory to play that role. The script I use to set the symlinks is below.
- I really should be using Cobbler to manage all this. I’ll learn it some day.
echo reset $MACHINE
ln -s $TARGET $MACHINE
r610s='01-00-21-9b-93-d0-90 01-00-21-9b-98-a3-1f 01-00-21-9b-9b-c4-21'
kvms='01-52-54-00-2d-74-f1 01-52-54-00-dc-37-cb 01-52-54-00-52-fa-3d'
for MACHINE in $r610s
reset_link $MACHINE rhel8.2-r610
for MACHINE in $kvms
reset_link $MACHINE rhcoreos-4.4.3-kvm-control
reset_link $BOOTSTRAP rhcoreos-4.4.3-kvm-bootstrap
reset_link $LB rhel8.2-kvm
This is obviously ripe for a YAML type config file.
To convert a MAC to the appropriate form for pxelinux.cfg use this bash. note that I prepended 01: to the mac address so that it is ends up in the right place in the final file name:
echo 01:52:54:00:e0:f0:fd | sed 's!:!-!g