The Default network policy in OpenShift allows all access from all pods in all namespaces via the cluster IP. However, once you start enforcing policy on a project, all policy decision need to be made explicit. If you want to still allow access from all projects, you can use the following policy file.
kind: NetworkPolicy apiVersion: networking.k8s.io/v1 metadata: name: allow-all-namespaces spec: ingress: - from: - namespaceSelector: {} |
The first principle is that you must not fool yourself and you are the easiest person to fool.
Richard P. Feynman
Test before you deploy. Treat configuration as code. These are precepts of DevOps that we want to make real. When dealing with network policy, we want to test it out in a development context before deploying it in production.
Continue readingSome colleagues and I were discussing the network access policy of OpenShift. I realized it would be very helpful to have a trivial app that I could deploy to OpenShift that would then try to make a call to another service. So I wrote it using Python3 and Flask. Now that I have it working, I want to deploy it in OpenShift, again, in a trivial manner.
I would not deploy a Flask App into production without a Web server to front it. But that is what I am going to do for this test app.
Continue readingI use the term permutations loosely here. But for any given chord inversion, there are 6 variations of the tones in the pitch you can play in order to play each tone once. What makes this an impure use of the term permutations is that the second and third notes of the sequence can go both above the starting note in one variation, and below it in another.
Continue readingGeorge Garzone is the Sax players sax player. He is a teacher that has taught the best of the crop that is out there right now. I had the privilege of studying with George back in high school. I can honestly say that no subject I studied before or since taught me how to think better than Jazz improvisation.
Continue readingWell enough to be dangerous. I was able to get the JACK Daemon running on my Lenovo Laptop running Fedora 32, and us it to record MIDI-based music.
Continue readingI seem to have a bad Ethernet port on the NUC. Since I have an external Ethernet adapter as well, this is not a show stopper, but it does change the approach I am going to make to my home network. As always: Simplification is preferred. Here’s the current approach:
Continue readingHere is how I currently have my machines connected. Posted here for documentation, and to get it straight in my own head.
Continue readingI am constantly creating and deleting virtual machines. These virtual machines often are RHEL systems, and need to be registered with Red Hat’s CDN. While In the past I had a Role that was wrapped into other provisioning playbooks to perform this task, I find that there are enough one-offs to make it useful to do this as a stand alone playbook. Here is how I set it up, including my rational.
Continue readingWhen provisioning goes wrong, it can eat up a lot of time. I need to install and configure a RHEL 8 machine to act as an HA proxy for an OpenShift install, and it was somewhat resistant to my efforts. I learned a couple things worth recording:
#!/bin/sh function reset_link(){ MACHINE=$1 TARGET=$2 echo --------------------------------------- echo reset $MACHINE rm $MACHINE ln -s $TARGET $MACHINE } r610s='01-00-21-9b-93-d0-90 01-00-21-9b-98-a3-1f 01-00-21-9b-9b-c4-21' kvms='01-52-54-00-2d-74-f1 01-52-54-00-dc-37-cb 01-52-54-00-52-fa-3d' LB=01-52-54-00-b1-5b-16 BOOTSTRAP=01-52-54-00-29-0b-bf for MACHINE in $r610s do reset_link $MACHINE rhel8.2-r610 done for MACHINE in $kvms do reset_link $MACHINE rhcoreos-4.4.3-kvm-control done reset_link $BOOTSTRAP rhcoreos-4.4.3-kvm-bootstrap reset_link $LB rhel8.2-kvm |
This is obviously ripe for a YAML type config file.
To convert a MAC to the appropriate form for pxelinux.cfg use this bash. note that I prepended 01: to the mac address so that it is ends up in the right place in the final file name:
echo 01:52:54:00:e0:f0:fd | sed 's!:!-!g |