All Questions(server)

I'm working on the migration of an existing 2 hosts vSphere 6.7 cluster to a new 8.0 vCenter Server Appliance. Both cluster's vSphere and ESXi hosts are at the latest available version.

New cluster: vSphere 8.0.3.00200 (Build: 24262322)

New host: ESXi, 8.0.3, 24280767

Old cluster: vSphere 6.7.0.55000 (Build: 22509723)

Old hosts: ESXi, 6.7.0, 20497097

In order to accomplish this task I bought a new Raptor Lake based (Xeon E-2468) host. The old hosts are identical, both Coffee Lake (Xeon E-2146G).

I'm unable to find an EVC compatibility that matches both type of hosts. Coffee Lake hosts are admitted succesfully into the Broadwell generation enabled cluster, but when I try to add the newer host I get an error stating:

The host's CPU hardware does not support the cluster's current Enhanced vMotion Compatibility mode. The host CPU lacks features required by that mode.

I expected only older processor would lack features available to newer ones, but it doesn't look like so. The older Broadwell Generation mode requires some features that the newer Raptor Lake E-2468 is apparently lacking.

I've found very few literature about this issue, including in Broadcom's KB, where surprisingly "Coffee Lake" Architecture isn't even mentioned. Also I'm unable to ask for VMware support because the 6.7 support contract is well gone, and the 8.0 vSphere is still in evaluation.

I'm about to give up on using EVC mode because I can't get it to work with this combination of hosts, so I'm asking here just to make sure I'm not missing anything important for the configuration. The older hosts will be decommissioned in any case, but since this will happen in 6-9 months, I didn't want to give up on EVC if possible.

Relevant note: all three hosts are Dell Enterprise hardware, R340 and R360.

I have installed RHEL 9.4, which is the latest version of RHEL available. The IT department found multiple vulnerabilities in the installed Apache software 2.4.57. From the official website, the latest version of Apache available for RHEL 9.4 is version 2.4.57.

How can I install a later version (e.g. >2.4.62) to fix the vulnerabilities? or what should I do if I cannot install a newer version?

I'm trying to run a podman quadlet defined by a kubernetes YML file. I want it to run rootless in systemd under a web user on the host: systemctl --user status pod-web.

Inside the container, the PHP process is running under the 33:33 user. I want the /home/web/data directory on the host to be owned by the web user, but at the same time to be readable and writable by the 33:33 user inside the container, where it is mounted to /var/www/html.

In the comments, you can see some things I tried. Unfortunatelly, I don't understand the user namespaces and subuid/subgid enough to be able to make it work with the documentation and Copilot keeps halucinating, so any help from real people will be appreciated.

My problem is similar to this one, but I want to use a podman kube quadlet defined in a YML file.

Environment:

• AlmaLinux release 9.4 (Seafoam Ocelot)
• podman version 4.9.4-rhel
• systemd 252 (252-32.el9_4.7)
• SELinux enabled enforcing
• chown -R web:web /home/web
• usermod --add-subuids 100000-165535 --add-subgids 100000-165535 web

/home/web/pod-web.yml:

apiVersion: v1
kind: Pod
metadata:
  name: pod-web
#  annotations:
#    io.podman.annotations.userns: "keep-id"
spec:
  containers:
  - name: pod-web
    image: docker.io/library/php:8.3-apache
#    securityContext:
#      runAsUser: 33
#      runAsGroup: 33
#      supplementalGroups: [65536]
#    ports:
#    - containerPort: 80
#      hostPort: 8000
    volumeMounts:
    - mountPath: /var/www/html
      name: web-data
  volumes:
  - name: web-data
    hostPath:
      path: /home/web/data
  restartPolicy: Always

With runAsUser: 33 the container was logging:

(13)Permission denied: AH00072: make_sock: could not bind to address [::]:80
(13)Permission denied: AH00072: make_sock: could not bind to address 0.0.0.0:80

With runAsUser: 0 the container seems to run, but it is a bad practice as it gives too many privileges if I understand it correctly.

/home/web/.config/containers/systemd/pod-web.kube:

[Unit]
Description=Podman Quadlet: %p

[Service]
# ExecStartPre=/usr/bin/podman unshare -- /bin/bash -c 'chown -R 33:33 /home/web/data'

[Kube]
Yaml=/home/web/%p.yml
LogDriver=journald
#UserNS=keep-id:uid=33,gid=33
#UserNS=auto

[Install]
WantedBy=multi-user.target default.target

I am currently trying to solve the following problem, but my google/SO searches have not yielded a matching scenario so far:

From my linux host, I must reach the destination host 172.19.28.152. However, due to corporate network complications, I must use a different IP address for that target: 10.187.19.132.

I must solve the problem in the IP layer because the application does not allow changing the target (it will always use the 172... IP address, and there is no way for me to change that behaviour in my scenario). Also, the application does not allow me to specify a DNS name instead.

Because of this, I want to configure nftables to do the following:

If a packet leaves my own host with the destination 172.19.28.152, replace the destination IP with 10.187.19.132. When the target replies, rewrite 10.187.19.132 with the original 172.19.28.152 (NAT) My problem is that I cannot figure out the syntax for such a rule.

In the end, after a LOT of time spent on configuration, I’m out of ideas. Something that’s supposed to be quite simple is becoming rather complicated. Hopefully, someone else can help me find the solution.

I’m trying to run a container with Traefik. Instead of putting all the configuration in the container's docker-compose file (docker-compose.yml), as many people do, I’m placing the configuration in a dedicated file (traefik.yml) since that’s more flexible for me.

I have the following docker-compose.yml file for Traefik:

version: "3.8"

services:
  traefik:
    image: traefik:latest
    hostname: traefik
    container_name: traefik
    restart: unless-stopped
    command:
      - "--configFile=/traefik.yml"
    networks:
      - traefik_gw_bridge
    ports:
      - 80:80
      - 443:443
      - 8080:8080
    volumes:
      - ./traefik.yml:/traefik.yml
      - logs:/logs
      - letsencrypt:/letsencrypt
      - /var/run/docker.sock:/var/run/docker.sock:ro
    healthcheck:
      test: ["CMD", "traefik", "healthcheck", "--ping"]
      interval: 10s
      timeout: 6s
      retries: 2
      start_period: 5s

networks:
  traefik_gw_bridge:
    driver: bridge
    external: true

volumes:
  letsencrypt:
  logs:

And these are the configuration parameters I am using for traefik.yml:

api:
  dashboard: true     
  insecure: false    

ping:
  entryPoint: web      

providers:
  docker:
    endpoint: "unix:///var/run/docker.sock"
    exposedByDefault: false 

entryPoints:
  web:
    address: ":80"   
  websecure:
    address: ":443"   
  traefik:
    address: ":8080" 

http:
  routers:
    dashboard:
      rule: "Host(`traefikdash.mydomain.com`)" 
      entryPoints:
        - traefik
      service: api@internal
      middlewares:
        - auth

  middlewares:
    auth:
      basicAuth:
        users:
          - "admin:$apr1$Nzj4xQwY$QiXQ/eYHzKTFS.Lx.6XG71"

log:                              
  filePath: "/logs/traefik.log"
  format: json
  level: DEBUG

accessLog:                        
  filePath: "/logs/access.log"
  bufferingSize: 150

certificatesResolvers:
  le:    
    acme:
      email: "[email protected]"    
      storage: "/letsencrypt/acme.json"  
      httpChallenge:
        entryPoint: "web" 

Logically, in the following part of the configuration file, I am trying to define a router to set up basic authentication with a username and password for the Dashboard:

http:
  routers:
    dashboard:
      rule: "Host(`traefikdash.mydomain.com`)"  # Reemplaza `yourdomain.com` con tu dominio
      entryPoints:
        - traefik
      service: api@internal
      middlewares:
        - auth

  middlewares:
    auth:
      basicAuth:
        users:
          - "admin:$apr1$Nzj4xQwY$QiXQ/eYHzKTFS.Lx.6XG71"

I am unable to get the result I want. When I access traefikdash.mydomain.com or traefikdash.mydomain.com:8080 or traefikdash.mydomain.com:8080/dashboard / traefikdash.mydomain.com/dashboard, I simply get the following responses from Traefik and my browser:

• HTTP 404 Page not found
• Error connection refused

After trying various types of configurations, I simply can't find much more information on how to implement HTTP basic auth to access the Traefik Dashboard.