spoovy's questions

I'm using metallb to assign IPs to LoadBalancers in a home lab k8s cluster. I've had to shrink the IP pool though as I need to use some of them in another test cluster.

I've done this but the IPs of the existing LB svcs have remained the same afterwards -- I need to give the LB svcs a kick somehow to get them to request new IPs. How can I do this?

From my workstation I can list pods, check component status etc.

[dude@bionic K8s]$ kubectl get componentstatuses
NAME                 STATUS    MESSAGE             ERROR
controller-manager   Healthy   ok
scheduler            Healthy   ok
etcd-2               Healthy   {"health":"true"}
etcd-0               Healthy   {"health":"true"}
etcd-1               Healthy   {"health":"true"}

[dude@bionic K8s]$ kubectl get svc -A
NAMESPACE     NAME         TYPE        CLUSTER-IP   EXTERNAL-IP   PORT(S)                  AGE
default       kubernetes   ClusterIP   10.32.0.1    <none>        443/TCP                  41d
kube-system   kube-dns     ClusterIP   10.32.0.10   <none>        53/UDP,53/TCP,9153/TCP   49m

[dude@bionic K8s]$ kubectl get pod -n kube-system coredns-574fc576d6-4hbl4
NAME                       READY   STATUS             RESTARTS   AGE
coredns-574fc576d6-4hbl4   0/1     CrashLoopBackOff   13         46m

But when I want to view logs (to debug the CrashLoop above), I get a certificate error:

[dude@bionic K8s]$ kubectl logs -n kube-system coredns-574fc576d6-4hbl4
plugin/kubernetes: Get "https://10.32.0.1:443/version?timeout=32s": x509: certificate is valid for 172.16.68.221, 172.16.68.222, 172.16.68.223, 172.16.68.69, 127.0.0.1, not 10.32.0.1

Why is this? My setup is a haproxy in front of three control nodes. The haproxy is on 172.16.68.69, which is configured in my kubeconfig:

apiVersion: v1
clusters:
- cluster:
    server: https://172.16.68.69:6443

It's like for some reason 'kubectl logs' decides to discover the ClusterIP somehow and use that directly, while other kubectl commands use the properly configured server.

I've set up roaming profiles (client insists) as per this doc: https://docs.microsoft.com/en-us/windows-server/storage/folder-redirection/deploy-roaming-user-profiles and it works, but there's something I don't get.

Step 2 - Creating a security group. It seems like roaming profile should be created for any User that I put in this group regardless of what machine they are accessing, but it doesn't work like that for me. In my environment roaming profiles are only applied if the User AND Computer are added to the security group.

Is there something wrong with my setup, or is this expected behaviour? If expected, why, what am I missing? It seems to me that the policy should apply to any object that is in that group, be it a user or a computer.

Thanks in advance.

I have an existing Windows domain using Windows 2016, and I want to set up roaming profiles. I would like however to use a linux box (CentOS 8 ideally) for the actual fileshare to save a license.

I can see in the samba wiki notes on how to do this (eg https://wiki.samba.org/index.php/Roaming_Windows_User_Profiles), but that assumes that the linux file server will be a member of a Samba domain, rather than an existing Windows domain.

I could potentially join the linux box to the Windows domain using realmd, but it seems overcomplex to me and I'd rather keep it simpler if possible.

So, has anyone done this before, and if so, how?

Thanks in advance.

I'm configuring a CRL online responder, but running into a problem. The configuration is a simple as could be I would think -- a fresh Server 2016 install, Enterprise root CA. I go through the revocation config creation wizard as described in an MCSA guide book, signing the config with the CA certificate. There are no other certs to use, and this one is valid.

But when complete the status is "Bad signing certificate on array controller". I have googled this and the fix seems to be to click "Assign Signing Certificate" and select the cert again there, but for me this is greyed out.

Any ideas?

I'm reading an exam guide from a well-known publisher at the moment for a Windows 2016 cert and trying to get my head around domain/forest trusts. It seems to me that this section/table in the book is wrong, that the outgoing and incoming words are the wrong way around, but as I don't really grok this area yet I can't be sure. Can someone confirm pls?

Trust Direction     Description

One-way outgoing    The local domain is the trusted domain and the remote domain is the trusting domain. Unidirectional.
One-way incoming    The local domain is the trusting domain and the remote domain is the trusted domain. Unidirectional.
Two-way             Both domains are trusted and trusting. Bidirectional.

thanks

I have created a bond using netplan (ubuntu 18.04) which shows the same MAC address for the two member physical NICs and the bond itself. I configured a bridge on top of that, for use with KVM/Qemu VMs.

2: eno1: <BROADCAST,MULTICAST,SLAVE,UP,LOWER_UP> mtu 1500 qdisc mq master 
   bond0 state UP mode DEFAULT group default qlen 1000
   link/ether 2a:5b:a6:18:e7:40 brd ff:ff:ff:ff:ff:ff
3: eno2: <BROADCAST,MULTICAST,SLAVE,UP,LOWER_UP> mtu 1500 qdisc mq master 
   bond0 state UP mode DEFAULT group default qlen 1000
   link/ether 2a:5b:a6:18:e7:40 brd ff:ff:ff:ff:ff:ff
4: bridge0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state 
   UP mode DEFAULT group default qlen 1000
   link/ether 6e:2b:1c:0e:af:6e brd ff:ff:ff:ff:ff:ff
5: bond0: <BROADCAST,MULTICAST,MASTER,UP,LOWER_UP> mtu 1500 qdisc noqueue 
   master bridge0 state UP mode DEFAULT group default qlen 1000
   link/ether 2a:5b:a6:18:e7:40 brd ff:ff:ff:ff:ff:ff

All looks OK and seems to work, but I'm getting tons of these errors in the log:

kernel: bridge0: received packet on bond0 with own address as source 
address (addr:6e:2b:1c:0e:af:6e, vlan:0)

My netplan config:

network:
version: 2
renderer: networkd
ethernets:
  eno1:
    match:
      macaddress: 74:46:a0:fe:ee:7c
  eno2:
    match:
      macaddress: 74:46:a0:fe:ee:7d
bonds:
  bond0:
    interfaces: [eno1, eno2]
bridges:
  bridge0:
    interfaces: [bond0]
    dhcp4: false
    addresses: [172.16.62.200/24]
    gateway4: 172.16.62.1

What is going wrong here? Why the errors?

Thanks in advance

My real patterns are more complex but I have tried to boil the problem down to the core issue. Something I don't understand. Please try this out on http://grokconstructor.appspot.com/do/match

I'm trying to match the following lines:

Start-Date: 2017-08-07  06:48:12
End-Date: 2017-08-07  06:48:12

Start-Date: 2017-08-07  12:55:16
End-Date: 2017-08-07  12:56:01

Using the additional patterns:

DATE_EU2 %{YEAR}-%{MONTHNUM}-%{MONTHDAY}[\s]+?%{HOUR}:?%{MINUTE}(?::?%{SECOND})?%{ISO8601_TIMEZONE}?
DATE_COMB %{DATE_EU2}?%{DATE_EU}?%{DATE_US}?

And the following main pattern:

Start-Date: %{DATE_COMB:starttime}\nEnd-Date: %{DATE_COMB:endtime}

With the multiline filter:

^\n (negated)

Run that and you should (hopefully!) get:

Start-Date: 2017-08-07 06:48:12 End-Date: 2017-08-07 06:48:12 Start-Date: 2017-08-07 12:55:16 End-Date: 2017-08-07 12:56:01
MATCHED
starttime   2017-08-07··06:48:12
endtime 2017-08-07··06:48:12
after match:    Start-Date: 2017-08-07 12:55:16 End-Date: 2017-08-07 12:56:01

So it's matched the first record but not matched the second. If I add a '\z' to the end of the main pattern then it will match the second record but not the first. So it's clearly treating the whole thing as one line. But why? My multiline filter states that if a line does not start with a newline it's part of the previous record, right? Well that should leave a blank line in the middle which clearly does start with a newline and should therefore comprise a seperate event, no?

Any pointers gratefully accepted.

I know that the following custom fact matches the string I want, as if I add a 'puts' or 'print' ahead of the $1 it prints the correct string. But as show the fact returns nothing. A blank.

  Facter.add(:myhost) do
    confine :kernel => "Linux"
    setcode do
      fh = File.open('/etc/enc_params.conf')
      fh.each_line do |line|
        if line =~ /\Amyhost.*\s(\w+)\Z/
          $1
        end
      end
    end
  end

For reasons I won't go into I often have to set up multiple SSH tunnels to a remote box -- often enough that it would be nice to be able to initiate it with a single command from a desktop launcher (I use GNOME Do).

Currently I have .ssh/config set up with the following (snipped a little and anonymised):

Host hawkeye
  Hostname hawkeye.avengers.com
  Port 22
  User thedudeabides
  IdentityFile ~/.ssh/id_rsa
  LocalForward 8888 webproxy.avengers.com:888
  LocalForward 4845 irc.avengers.com:7434
  LocalForward 4093 git.avengers.com:3329

..and I open a terminal and run 'ssh hawkeye', which sets up tunnelling and leaves me ssh'd into hawkeye.

Problem is (small problem, granted) is that I often don't want the remote console session opened, and I'd like to be able to set these tunnels up with a single command from GNOME Do, so the tunnels are set up and backgrounded, but no terminal is opened.

I've tried scripts using various SSH flags but it never works as intended.

Any help appreciated.

I find it pretty common for a Linux server to slow down to the point of complete unresponsiveness (LA 150+ etc), which when looking at it later using sar or munin or whatever it will show a sudden rapid increase in the number of processes. I generally need to reboot the machine at this point but it always leaves me wondering what caused the problem in the first place.

I'm assuming there is a rogue process going into some kind of loop creating loads of new processes, which then eat up the ram etc and cause the lockup. But how, after the event, can I determine which is the offending application/ process?

Thanks