Pages

Monday, August 8, 2022

PodMan

Podman is a container engine that allows you to create, run, and manage containers on a Linux host. It is similar to other container runtimes such as Docker, Rocket, Drawbridge, and LXC. Podman has a command-line interface that is similar to Docker, making it easy to switch from Docker to Podman.

If you're new to Podman, here are some basic commands that will help you get started:


  • podman login -u username -p password registry.access.redhat.com: Log in to a container registry.
  • podman pull <image-name>: Download a container image.
  • podman ps -a: List all containers, both running and stopped.
  • podman search <image-name>: Search for a container image.
  • podman images: List all container images.
  • podman run <image-name> echo 'Hello world!': Run a container with a specific image and command.
  • podman run -d -p 8080 httpd: Run a container with an image in the background and map port 8080.
  • podman port -l: Display the port details of the last used container.
  • podman run -it ubi8/ubi:8.3 /bin/bash: Run a container and enter into its bash shell.
  • podman run --name MySQL-custom -e MYSQL_USER=Ruser -e MYSQL_PASSWORD=PASS -e MYSQL_ROOT_PASSWORD=PASS -d MySQL: Run a container with a custom name and environment variables.
  • podman ps --format "{{.ID}} {{.Image}} {{.Names}}": List containers with custom output formatting.


In Podman, you can create both root and rootless containers. Root containers run with elevated privileges, while rootless containers run without elevated privileges and are isolated from the host system.


Here are some commands to create and manage root and rootless containers using Podman:


  • sudo podman run --rm --name asroot -ti httpd /bin/bash: Run a container as root.
  • podman run --rm --name asuser -ti httpd /bin/bash: Run a container as a regular user.
  • podman run --name my-httpd-container httpd: Run a container with a custom name.
  • podman exec httpd-container cat /etc/hostname: Run a command inside a running container.
  • podman stop my-httpd-container: Stop a running container.
  • podman kill -s SIGKILL my-httpd-container: Send a custom kill signal to a running container.
  • podman restart my-httpd-container: Restart a container that has been stopped.
  • podman rm my-httpd-container: Remove a container.
  • podman rm -a: Remove all containers.
  • podman stop -a: Stop all running containers.
  • podman exec mysql /bin/bash -c 'mysql -uuser1 -pmypa55 -e "select * from items.Projects;"': Run a command inside a running container.

 

Sharing a local directory with a container is a common task in containerization. Podman makes this process simple by allowing you to mount a local directory to a container using the -v option.

Create a local directory with proper SELinux permissions

mkdir /home/student/dbfiles
podman unshare chown -R 27:27 /home/student/dbfiles
sudo semanage fcontext -a -t container_file_t '/home/student/dbfiles(/.*)?'
sudo restorecon -Rv /home/student/dbfiles
ls -ldZ /home/student/dbfiles
The mount the path with -v location_in_local:location_in_container 
podman run -v /home/student/dbfiles:/var/lib/mysql rhmap47/mysql
podman unshare chown 27:27 /home/student/local/mysql

 

Port management

Port management is an important aspect of containerization, and Podman provides a simple way to manage ports for containers. You can use the -p option to map ports between the container and the host system.

Here's an explanation of the commands used in port management with Podman:


  • podman run -d --name apache1 -p 8080:8080 httpd: Run a container with the httpd image, map port 8080 on the host system to port 8080 in the container, and name the container apache1.
  • podman run -d --name apache2 -p 127.0.0.1:8081:8080 httpd: Run a container with the httpd image, map port 8081 on the localhost interface of the host system to port 8080 in the container, and name the container apache2.
  • podman run -d --name apache3 -p 127.0.0.1::8080 httpd: Run a container with the httpd image, map a random port on the localhost interface of the host system to port 8080 in the container, and name the container apache3.


podman port apache3: Display the port details of the apache3 container.

In the first command, the -p option is used to map port 8080 on the host system to port 8080 in the container. This means that if you access port 8080 on the host system, you will be accessing the container's port 8080.

In the second command, the -p option is used to map port 8081 on the localhost interface of the host system to port 8080 in the container. This means that if you access port 8081 on the localhost interface of the host system, you will be accessing the container's port 8080.

In the third command, the -p option is used to map a random port on the localhost interface of the host system to port 8080 in the container. This means that a random port on the host system will be mapped to the container's port 8080.

The podman port command displays the port details of a container, including the mapping between the container's ports and the host system's ports.

By using these commands, you can easily manage ports for containers in Podman.


Podman Image Management

Podman is available on a RHEL host with the following entry in /etc/containers/registries.conf file:

[registries.search] 
registries = ["registry.redhat.io","quay.io"]
  • podman save [-o FILE_NAME] IMAGE_NAME[:TAG]: Save an image to a file. You can use the -o option to specify the output file name. For example, podman save -o mysql.tar quay.io/mysql:latest saves the quay.io/mysql:latest image to a file named mysql.tar.
  • podman load [-i FILE_NAME]: Load an image from a file. You can use the -i option to specify the input file name. For example, podman load -i mysql.tar loads the mysql.tar file and creates an image.
  • podman rmi [OPTIONS] IMAGE [IMAGE...]: Remove one or more images. You can use the -a option to remove all images. For example, podman rmi -a removes all images.
  • podman commit [OPTIONS] CONTAINER [REPOSITORY[:PORT]/]IMAGE_NAME[:TAG]: Create a new image from a container. You can use the -a option to specify the author name. For example, podman commit -a 'Your Name' httpd httpd-new creates a new image named httpd-new from the httpd container with author name Your Name.


Here's an explanation of the few of the Podman commands:

  • podman diff container-name: This command shows the differences between the container's current state and its original state at the time of its creation. The diff subcommand tags any added file with an A, any changed ones with a C, and any deleted file with a D. This is useful for troubleshooting issues or for auditing the changes made to a container.
  • podman tag [OPTIONS] IMAGE[:TAG] [REGISTRYHOST/][USERNAME/]NAME[:TAG]: This command is used to tag an image with a new name or repository. You can use the [REGISTRYHOST/][USERNAME/] part to specify the registry where you want to tag the image. For example, podman tag mysql-custom devops/mysql tags the mysql-custom image with the name devops/mysql.
  • podman rmi devops/mysql:snapshot: This command removes an image with the specified name and tag. For example, podman rmi devops/mysql:snapshot removes the devops/mysql image with the snapshot tag.
  • podman push [OPTIONS] IMAGE [DESTINATION]: This command pushes an image to a specified destination, such as a container registry. You can use the [DESTINATION] part to specify the registry where you want to push the image. For example, podman push quay.io/bitnami/nginx pushes the quay.io/bitnami/nginx image to the specified registry.








Friday, August 5, 2022

Kubernets Components

 Kubernetes, also known as K8s, is a popular container orchestration tool that automates the deployment, scaling, and management of containerized applications. The Kubernetes environment is made up of several core components that work together to provide a scalable and robust container management system. While there are other optional components available, these core components are essential to the Kubernetes environment.


 

  • Kubernetes API Server: The Kubernetes API server acts as the primary management hub for the Kubernetes cluster. It exposes the Kubernetes API, which is used by other components to interact with the cluster. The API server validates and processes API requests, and updates the cluster state accordingly.
  • etcd: etcd is a distributed key-value store that stores the configuration data and state of the Kubernetes cluster. It provides a reliable and consistent data store that is used by the Kubernetes API server and other components to store and retrieve data.
  • kubelet: The kubelet is responsible for managing and monitoring individual nodes (worker machines) in the Kubernetes cluster. It communicates with the Kubernetes API server to ensure that the containers running on a node are healthy and running as intended.
  • kube-proxy: The kube-proxy is responsible for managing network communication within the Kubernetes cluster. It sets up and maintains network routes and load balancing for Kubernetes services running on the cluster.
  • Kubernetes Scheduler: The Kubernetes scheduler is responsible for scheduling workloads (containers) onto worker nodes in the cluster. It considers factors such as resource availability, workload constraints, and affinity rules to make optimal scheduling decisions.

 

Data Plane: Worker Nodes, Where the Pods or Containers with workload run
Control Plane: Master Node, where the k8s components run

Following are the Components of the Control Plane
  • Apiserver
    • Apiserver service act as the connection between all the components in the Control Plane and Data Plane
    • Orchestrating all operations in the cluster
    • Expose the K8s API which end users use for operation and monitoring
    • Collect data from Kubelet for Monitoring
    • Authenticates - Validates - retrieve data
    • Give data or do the operations with data
    • Pass data to kubelet to perform operations in the Worker node
  • etcd
    • etcd service is mainly used for the storage of all the details. Etcd is basically a key-value pair data store. 
    • Store Data not limited to the following details
      • Registry
      • Nodes
      • Pods
      • Config
      • Secrets
      • Accounts
      • Roles
      • -- other components as well
  • Kube scheduler
    • Identify the right worker nodes in which containers can be deployed and give data back to API Servers, then kubelet get data from API server and deploys the container. 
    • Keeps on monitoring the API Server for operations 
    • Identify the right worker node for mentioned operation and give it back to API Server
    • Filter nodes
    • Ranks nodes : 
      • Resource requirements, resources left after container placement
      • Taints and Tolerations
      • Node Selectors/Affinity
      • Labels and Selectors
      • Resource limits
      • Manual Scheduling 
      • Daemon Sets
      • Multiple Schedulers
      • Scheduler Events
  • Kube-controller-Manager
    • Watch Status
    • Remediate Situations
    • Monitor the state of the system and try to bring it to the desired state

Following are the Components of the Data Plane
  • Kubectl
    • Client used to connect to API Server
  • Kubelet
    • Agent runs on each Worker nodes
    • Listens to the Kube APIs and Performs the Operation 
    • give back data to Kube API Server for monitoring of operation
  • Kube-proxy
    • Enable communication between services in Worker nodes
    • Pod-Network
      • by Default All pods connect to each other
    • Create Iptable rules to allow communication between pods and services





Wednesday, August 3, 2022

Quick OpenVPN Server

The easiest way to set up an OpenVPN server, the script is very helpful to manage the client keys

First, we need to download the script, then make it executable and run with bash


wget https://git.io/vpn -O openvpn-install.sh
chmod +x openvpn-install.sh 
bash openvpn-install.sh


Following will be output and options to choose to create the VPN server and Client Certificates.

Welcome to this OpenVPN road warrior installer!
Which protocol should OpenVPN use?
   1) UDP (recommended)
   2) TCP
Protocol [1]: 1
What port should OpenVPN listen to?
Port [1194]: 
Select a DNS server for the clients:
   1) Current system resolvers
   2) Google
   3) 1.1.1.1
   4) OpenDNS
   5) Quad9
   6) AdGuard
DNS server [1]: 2
Enter a name for the first client:
Name [client]: rahul
OpenVPN installation is ready to begin.
Press any key to continue...
Finished!
The client configuration is available in: /root/XXXX.ovpn
New clients can be added by running this script again.


Once the client configuration is done we can copy it and move it to the device we need to use as the client. Configure the Ovpn client app with the client key and can start using the VPN.