DOCSEARCHbyAlgolia
Submit Docs

Yasith AB Technical Blog

website·Indexed 32 days ago

https://blog.yasithab.com/

A collection of technical guides and tutorials covering system administration and troubleshooting across Ubuntu, CentOS, Windows, macOS, and AWS. Topics include Kubernetes cluster setup on CentOS 8, ESXi upgrades via SSH, S3 bucket replication, and various OS-specific configuration fixes.

Tokens
66.3K
Snippets
364
Records
388
Agent score
52%

What's inside Yasith AB Blog

  1. Network and DNS planning for Kubernetes cluster

    The cluster architecture utilizes a Virtual IP for the load balancer and a specific IP pool for MetalLB. Ensure the following DNS entries and IP allocations are configured.

    IP Allocation

    • Load Balancer Virtual IP: 192.168.16.80
    • VM IP Range: 192.168.16.100 - 192.168.16.108
    • MetalLB IP Pool: 192.168.16.200 - 192.168.16.250

    DNS Entries

    • kube-api.example.local -> 192.168.16.80
    • kubelb01.example.local -> 192.168.16.100
    • kubelb02.example.local -> 192.168.16.101
    • kubemaster01.example.local -> 192.168.16.102
    • kubemaster02.example.local -> 192.168.16.103
    • kubemaster03.example.local -> 192.168.16.104
    • kubeworker01.example.local -> 192.168.16.105
    • kubeworker02.example.local -> 192.168.16.106
    • kubeworker03.example.local -> 192.168.16.107

  2. Upgrade ESXi host using esxcli and VMware online depot

    To upgrade ESXi via the command line, you must temporarily enable the httpClient firewall rule to allow the host to communicate with the VMware online depot. After identifying the desired profile and applying the update, the firewall rule should be disabled and the host rebooted.
    # 1. Enable HTTP traffic through the firewall
esxcli network firewall ruleset set -e true -r httpClient

# 2. List available ESXi 6.7 profiles from the online depot
esxcli software sources profile list -d https://hostupdate.vmware.com/software/VUM/PRODUCTION/main/vmw-depot-index.xml | grep -i ESXi-6.7

# 3. Apply the upgrade using a specific profile
esxcli software profile update -p ESXi-6.7.0-20191204001-standard -d https://hostupdate.vmware.com/software/VUM/PRODUCTION/main/vmw-depot-index.xml

# 4. Disable HTTP traffic through the firewall
esxcli network firewall ruleset set -e false -r httpClient

# 5. Exit maintenance mode
vim-cmd /hostsvc/maintenance_mode_exit

# 6. Reboot the server
reboot

  3. Secure MariaDB configuration and encryption key files

    After configuring MariaDB and its encryption keys, set strict permissions to ensure only the mysql user can access the configuration and key files. Use restorecon to maintain correct SELinux contexts on CentOS 7.
    # Set permissions for config file
sudo chmod 0600 /etc/my.cnf.d/galera.cnf
sudo chown -R mysql:mysql /etc/my.cnf.d
sudo restorecon -RvF /etc/my.cnf.d

# Set permissions for encryption keys
sudo chmod 0600 /etc/mysql/encryption/*
sudo chown -R mysql:mysql /etc/mysql/encryption
sudo restorecon -RvF /etc/mysql/encryption

  5. Create a custom Certificate Authority (CA)

    To establish a custom CA, you must first generate a private key and then a self-signed root certificate. The root certificate is used to sign other SSL certificates.
    # 1. Generate the CA private key (remember the passphrase)
openssl genrsa -des3 -out ca.key 4096

# 2. Generate the CA root certificate (ca.pem)
openssl req -x509 -new -nodes -key ca.key -sha256 -days 10950 -out ca.pem -subj "/C=LK/ST=Western Province/L=Colombo/O=Example (Private) Limited/OU=Development/CN=Example Development Certificate Authority"

# 3. Verify the CA certificate data
openssl x509 -in ca.pem -text -noout

  6. Configure local DNS records for Kubernetes nodes

    Set up local DNS resolution by adding the IP addresses and hostnames of the load balancer, master nodes, and worker nodes to the /etc/hosts file. This ensures nodes can communicate via hostnames before a formal DNS server is configured.
    cat <<EOF | sudo tee /etc/hosts > /dev/null
# localhost
127.0.0.1     localhost        localhost.localdomain

# Kubernetes Cluster Nodes
192.168.16.80  kube-api.example.local
192.168.16.102 kubemaster01  kubemaster01.example.local
192.168.16.103 kubemaster02  kubemaster02.example.local
192.168.16.104 kubemaster03  kubemaster03.example.local
192.168.16.105 kubeworker01  kubeworker01.example.local
192.168.16.106 kubeworker02  kubeworker02.example.local
192.168.16.107 kubeworker03  kubeworker03.example.local
EOF

  7. Install EMQTT Broker as a Windows Service using NSSM

    To run the EMQTT Broker as a persistent Windows service, use the NSSM (Non-Sucking Service Manager) to wrap the executable. This ensures the broker starts automatically and runs in the background.

    Prerequisites

    • EMQTT Broker binaries
    • NSSM Service Manager
    • Process Explorer (used to identify the exact runtime path and arguments of the broker process)

    Installation Steps

    1. Extract the EMQTT Broker to C:\emqttd.
    2. Verify the broker runs manually by executing .\bin\emqttd console from an administrator command prompt in the C:\emqttd directory.
    3. Use Process Explorer (run as Administrator) to locate the running werl.exe process (under explorer.exe > cmd.exe). Right-click the process and open Properties to record the following values:
      • Path
      • Command line
      • Current directory
    4. Extract NSSM to C:\Program Files\nssm-2.24.
    5. Open an administrator command prompt, navigate to the NSSM directory, and run the installation command: nssm install emqttd
    6. In the NSSM Service Installer window, enter the Path, Startup Directory, and Arguments recorded from Process Explorer in step 3.
    7. Open services.msc, locate the EMQTT Broker service, and start it.
    # Run from C:\Program Files\nssm-2.24
nssm install emqttd

  8. Prepare an ESXi host for upgrade via CLI

    Before upgrading an ESXi host, you must ensure the host has shell access and a working internet connection. All virtual machines (VMs) must be shut down and the host must be placed in maintenance mode. Use vim-cmd to manage VM states and maintenance mode.
    # List all registered VMs to find their VMIDs
vim-cmd vmsvc/getallvms

# Check the power state of a specific VM
vim-cmd vmsvc/power.getstate <VMID>

# Gracefully shut down a VM
vim-cmd vmsvc/power.shutdown <VMID>

# Force power off a VM if shutdown fails
vim-cmd vmsvc/power.off <VMID>

# Enter host maintenance mode
# Note: This will fail if VMs are still running
vim-cmd /hostsvc/maintenance_mode_enter

  9. Configure SELinux and Firewall for Nginx and Nexus

    To allow Nginx to connect to the network (required for reverse proxying) and to allow external traffic to reach the server, you must update the SELinux boolean and open the standard HTTP/HTTPS ports in the firewall.
    # Allow Nginx to connect to the network
setsebool -P httpd_can_network_connect 1

# Open TCP ports 80 and 443
firewall-cmd --permanent --add-port=80/tcp
firewall-cmd --permanent --add-port=443/tcp
firewall-cmd --reload

# Start and enable Nginx
systemctl start nginx
systemctl enable nginx

  10. Join additional master nodes to a Kubernetes cluster

    When joining additional master nodes (e.g., kubemaster02, kubemaster03), ensure the first master node (kubemaster01) is in READY status and all pods are running via kubectl get po,svc --all-namespaces. Nodes must be joined one by one. Use the --v=5 flag for verbose output during the join process.
    # Example control plane join command
kubeadm join kube-api.example.local:6443 --token <token> \
    --discovery-token-ca-cert-hash sha256:<hash> \
    --control-plane --certificate-key <key> \
    --v=5

# Configure kubectl for the current user
mkdir -p $HOME/.kube
sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
sudo chown $(id -u):$(id -g) $HOME/.kube/config

  11. Initialize the first Kubernetes Master node

    Initialize the first control plane node using a kubeadm configuration file. The controlPlaneEndpoint should point to the load balancer DNS/IP. After initialization, the admin.conf must be copied to the user's home directory to use kubectl.
    # 1. Create config file /etc/kubernetes/kubeadm.conf
# (Ensure controlPlaneEndpoint and podSubnet are correct)

# 2. Initialize cluster
kubeadm init --config /etc/kubernetes/kubeadm.conf --upload-certs --v=5

# 3. Setup kubectl access
mkdir -p $HOME/.kube
sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
sudo chown $(id -u):$(id -g) $HOME/.kube/config