Drux's questions

I want to place Prometheus behind an Apache reverse proxy for authentication and access control. This is for the version of Prometheus that comes with Debian Stretch (prometheus --version indicates version 1.5.2+ds (branch: debian/sid, revision: 1.5.2+ds-2+b3)) and for Apache 2.4.

I already have Prometheus listening on 127.0.0.1:9090 (e.g. according to netstat -tlpn) and I have this in my VirtualHost configuration:

<Location "/prometheus">
  ProxyPass "http://localhost:9090"
  ProxyPassReverse "http://localhost:9090"
</Location>

However, when I visit https://my-server.com/prometheus a redirect to https://my-server.com/graph occurs (by way of HTTP status code 302 and Location: /graph), which cannot be served by the reverse proxy in its current configuration.

How can I change the configuration for this version of Prometheus) such that a visit to https://my-server.com/prometheus will successfully redirect to https://my-server.com/prometheus/graph, i.e. all Prometheus-related "things" will be served under a common URL prefix /prometheus?

UPDATE One thing that currently puzzles me is that Prometheus' CHANGELOG.md indicates that command line flag -web.route-prefix was introduced back in version 1.0.0, but the Debian package's /etc/default/prometheus does not mention this flag, although it mentions many others (as if it would not support it despite ostensibly being based on version 1.5.2).

I have a situation where Kubernetes apparently can no longer assign an external IP address to a service upon kubectl create -f Deployment.yaml. kubectl describe service <my-service> reports the following error:

CreatingLoadBalancerFailed    
Error creating load balancer (will retry): Failed to create load balancer 
for service default/<my-service>: requested ip <my-address> is 
neither static nor assigned to LB <id>(default/<my-service>): <nil>

But gcloud compute addresses list indicates that my-address is a static IP address:

NAME          REGION        ADDRESS       STATUS
<my-address>  europe-west1  <ip-address>  RESERVED

And Deployment.yaml contains a spec for <my-service> that assigns <my-address> to a load balancer:

kind: Service
apiVersion: v1
metadata:
  name: my-service
spec:
  selector:
    app: my-app
ports:
  - protocol: UDP
    port: <my-port>
type: LoadBalancer
loadBalancerIP: <my-address>

What is especially strange: the (almost) same deployment has worked before. I have already tried to recreate my cluster, but this also did not help. What else could be wrong and how can I overcome the error to make my service reachable from the outside again?

UPDATE I have reserved a new static (this time also global) IP address with gcloud compute addresses create test-address --global and changed the assignment to LB accordingly: loadBalancerIP: test-address. But the same error remains still.

UPDATE If I don't specify loadBalancerIP in Deployment.yaml, deployment succeeds without errors an a new external IP address is assigned to my-service. The service can be pinged from outside at this address.

UPDATE If I delete my former address with gcloud compute addresses delete my-address --region europe-west1, promote the new external address with gcloud compute addresses create --addresses <ip-address> --region europe-west1, and then redeploy with the original line loadBalancerIP: my-address restored in Deployment.yaml, the same error surfaces again.

I had hoped that I would be able to use an SQL view instead of a table to provide e.g. iaxusers and iaxpeers to Asterisk via dynamic realtime (ARA).

I have just noticed that iaxpeers apparently requires several columns for Asterisk to store peer-specific information: ipaddr, port, regseconds. Therefore a simple view won't do.

Is there a way to still get by with a view e.g. for iaxpeers or do I have to create a table and perhaps sync it with my core data structures (also tables) with triggers instead of a view's (more convenient) SELECT statement -- push instead of pull, so to speak. (I am using PostgreSQL, whose views are apparently read-only.)

After configuring Asterisk dynamic realtime by adding the following lines to /etc/asterisk/extconfig.conf, is there any way of checking the resulting settings on the level of Asterisk CLI?

[settings]
iaxusers => odbc,mydb,iaxusers
extensions => odbc,mydb,extensions

For instance, iax2 show users and dialplan show still return what are apparently static configurations from /etc/asterisk/iax.conf and /etc/asterisk/extensions.conf respectively, even though odbc show reports Connected: Yes and tables (actually views) iaxusers and extensions in the SQL database mydb contain what should be appropriate rows.

I can see that dynamic realtime is at least partly active, because if I add another line e.g. for iaxpeers to /etc/asterisk/extconfig.conf while the corresponding table does not yet exists and then (restart Asterisk gracefully from CLI and) issue module unload chan_iax2.so, module load chan_iax2.so I receive this warning:

WARNING[1426]: res_odbc.c:471 ast_odbc_find_table: 
Unable to retrieve database handle for table description 'iaxpeers@mydb'

I have a PD that is shared between two Kubernetes services. Once service runs a server application inside a container currently as root (I will probably change this to, say, user1), the other service runs Docker's Postgres image as postgres. I would like to make sure that both root (eventually user1) and postgres have read-write access to certain directories below the PD's mount point, for instance postgres should "own" the directory /mnt/disk/my-pd/pgdata.

Can this be configured on the level of a Kubernetes spec? If not and if I have to configure it manually "outside", can I make assumptions about how UIDs and GIDs relate to each other throughout the cluster, i.e. does Kubernetes (or do standard Docker images such as postgres) include some kind of directory service that would keep the UID e.g. for postgres in sync throughout the cluster?

Here is the Postgres-related portion of my spec in its current form:

kind: Deployment
apiVersion: extensions/v1beta1
metadata:
  name: postgres-deployment
spec:
  template:
    metadata:
      labels:
        app: postgres-app
    spec:
      containers:
      - name: postgres-container
        image: postgres
        env:
        - name: POSTGRES_PASSWORD
          valueFrom:
            secretKeyRef:
              name: my-secret
              key: postgres-password.txt
        - name: PGDATA
          value: /mnt/disk/my-pd/pgdata
        - name: POSTGRES_DB
          value: mydb
        ports:
        - protocol: TCP
          containerPort: 5432
        volumeMounts:
        - name: my-volume
          mountPath: /mnt/disk/my-pd
      volumes:
      - name: my-volume
        gcePersistentDisk:
          pdName: my-pd
          fsType: ext4

I run two containers in a pod: one is based on debian:wheezy, the other one is mysql:5.6.

When I log into the 2nd container, I can invoke the MySQL client mysql without problems.

When I log into the 1st container and invoke the MySQL client mysql (after apt-get install -y mysql-client), I get this error message:

ERROR 2002 (HY000): 
Can't connect to local MySQL server through socket 
'/var/run/mysqld/mysqld.sock' (2)

I assume this is because the two containers use their own file systems, and the socket exists only in the 2nd one's.

Is there a simple way for getting the MySQL client to work in the 1st container while the MySQL server runs in the 2nd and still using sockets?

I am working with two block devices in a situation where one works with a certain configuration and the other does not. I assume this must be related to subtle differences in the extended options that were passed into respective calls of mkfs.ext4.

How can I inspect those options for existing block devices for a detailed comparison. What other (subtle) differences could perhaps play a role?

I currently use a Kubernetes spec Deployment.yaml for deploying a service. The spec includes a verbatim reference to a specific IP address (marked as <static-ip-address> below):

spec:
  type: LoadBalancer
  loadBalancerIP: <static-ip-address>

I am concerned about pushing information such as passwords or IP addresses into remote Git repositories. Can I avoid this e.g. by making use of environment variables, e.g. with a deployment spec and actual deployment roughly as follows:

spec:
   type: LoadBalancer
   loadBalancerIP: ${SERVICE_ADDRESS}

and

export SERVICE_ADDRESS=<static-ip-address>
kubectl create -f Deployment.yaml

Obviously this specific syntax does not work yet. But is something like this possible and if so how?

I'd prefer not relying on a separate provisioning tool. Secrets and ConfigMaps seem promising, but apparently they cannot be consumed in a way that suits this purpose. If I could directly reference a static IP address that was defined with gcloud compute addresses create service-address that would be best.

I would like to build a Docker container and then run it in GKE after mounting some directories from GCE persistent disks (PDs). For instance, I'd like for the application's (read-write) configuration files in /etc/<application>/ to live longer than its pods (which may restart at any time.)

The regular build puts default configuration files into /etc/<application>/ and it is imperative that these are somehow "copied" once from the image's ephemeral disk into the PD, such that the application can start in its expected environment.

Is there a best practice for making this happen? For instance, would I have to mount PDs also in my Dockerfile, or can I somehow request that PDs be "synced" with files from another directory/volume/disk when they are first mounted by a VM instance during deployment?

I am running a service in GKE/Kubernetes that exposes a single UDP port at a staric IP address. (I've promoted the static IP address from an ephemeral one in GCE.) If I deploy it with fields as follows the service is reachable.

spec:
  type: LoadBalancer
  loadBalancerIP: <static-ip-address>

However, I don't plan to run more than a single replica of my service and I am not even sure if GKE's load balancers work with UDP, hence I'd like to try without one.

The following alternative configuration does not yet work. With it, the service comes up, but at a different IP address and hence not reachable from external as desired.

spec:
  type: NodePort
  externalIPs:
  - <static-IP-address>

So is running an externally visible service at an "own" static IP address without load balancer even possible, and if so how?

UPDATE Further progress indicates that the work balancer also works with UDP, but it still seems redundant.

I am trying to configure a Zoiper softphone (iOS app version) so that it can connect to my Asterisk PBX. The Zoiper configuration is as follows:

Account name: Account1
Server: <ip-address-of-my-asterisk-server>
User name: guest
Password: test
Caller ID: guest

On the Asterisk server, /etc/asterisk/iax.conf contains these lines:

[guest]
username=guest
type=friend
context=public
callerid="Guest IAX User"
secret=test
auth=md5

iax2 show users indicates that Asterisk is aware of these settings. With extra logging enabled I get the following log messages. In effect, Zoiper's registration to Asterisk is refused (with cause code 29). What could be wrong, and which IAX authentication method is Zoiper using (I tried both md5 and plaintext with same results.)

(Further questions: Does Asterisk even provide the (optional) IAX2 registration facility and why is Zoiper apparently sending REGREL?)

Rx-Frame Retry[ No] -- OSeqno: 000 ISeqno: 000 Type: IAX     Subclass: REGREQ 
   Timestamp: 00002ms  SCall: 00209  DCall: 00000 [10.0.7.1:51130]
   USERNAME        : guest
   REFRESH         : 60
   CALLTOKEN       : Present
   FW BLOCK DATA   : 14 bytes

Tx-Frame Retry[ No] -- OSeqno: 000 ISeqno: 001 Type: IAX     Subclass: CTOKEN 
   Timestamp: 00002ms  SCall: 00001  DCall: 00209 [10.0.7.1:51130]
   CALLTOKEN       : 51 bytes

Rx-Frame Retry[ No] -- OSeqno: 000 ISeqno: 000 Type: IAX     Subclass: REGREL 
   Timestamp: 00003ms  SCall: 00208  DCall: 00001 [10.0.7.1:51130]
   USERNAME        : guest
   CALLTOKEN       : 51 bytes
   FW BLOCK DATA   : 14 bytes

Tx-Frame Retry[ No] -- OSeqno: 000 ISeqno: 001 Type: IAX     Subclass: REGREJ 
   Timestamp: 00003ms  SCall: 00001  DCall: 00208 [10.0.7.1:51130]
Rx-Frame Retry[ No] -- OSeqno: 000 ISeqno: 000 Type: IAX     Subclass:   REGREQ 
   Timestamp: 00003ms  SCall: 00209  DCall: 00000 [10.0.7.1:51130]
   USERNAME        : guest
   REFRESH         : 60
   CALLTOKEN       : 51 bytes
   FW BLOCK DATA   : 14 bytes

Tx-Frame Retry[-01] -- OSeqno: 000 ISeqno: 001 Type: IAX     Subclass: ACK    
   Timestamp: 00003ms  SCall: 06363  DCall: 00209 [10.0.7.1:51130]
Tx-Frame Retry[000] -- OSeqno: 000 ISeqno: 001 Type: IAX     Subclass: REGREJ 
   Timestamp: 00001ms  SCall: 06363  DCall: 00209 [10.0.7.1:51130]
   Timestamp: 00003ms  SCall: 00001  DCall: 00208 [10.0.7.1:51130]
   CAUSE           : Registration Refused
   CAUSE CODE      : 29

I am trying to register a VoIP softphone (Zoiper app for iOS) with an Asterisk installation via IAX2.

At present, this results in an error message "Registration Refused (29)" on the side of the softphone.

Can I obtain more information about this error from the side of Asterisk? At present I don't see anything related in /var/log/asterisk/messages.

I have managed to deploy Asterisk to Google Container Engine (GKE) currently to the extent that a VoIP softphone can register. I'd now like to attach to Asterisk's container.

kubectl attach -it <pod-id>

however leads fast repetitions of Asterisk's CLI prompt (*CLI> *CLI> *CLI ...) without a chance for me to type in anything. It looks as if there is an endless cycle of attach/detach happening. How can I resolve this situation so that I can obtain clean access to the CLI (with a single *CLI> prompt)?

UPDATE The same repetitions happen when to try to attach in two steps:

gcloud compute ssh <instance-id>
<instance># sudo docker attach <image-id>

I am defining my first Kubernetes deployment and would like to define a container that mounts persistent storage at two points, say like this (in Deployment.yaml inside spec.template.spec.containers.-):

volumeMounts:
- name: volume1
  mountPath: /var/log/app
- name: volume2
  mountPath: /var/lib/app

I understand from Kubernetes' MEAN stack sample that I should be able to create two corresponding GCE disks, say like this:

gcloud compute disks create --size 10GB volume1
gcloud compute disks create --size 10GB volume2

I currently contemplate two disks instead of one only because I need to mount at two different paths. Can a Kubernetes service mount different "portions" (possibly partitions) of a single volume/disk at different paths?

The specification of v1.VolumeMount suggests that this may not be possible at the level of the service specification, because it supports only the fields name, readOnly, and mountPath.

These answers suggests that it might be possible on the level of EXT4 partitions, but that this would require the the volume to be read-only. Even in the read-only case (which does not meet my requirements), how would I go about creating a GCE disk with partitions?

(migrated from StackOverflow)