I found that some cached items are being lost on production once in a while, the test and production environment settings are practically the same, so I am suspecting it is Redis running out of "space" but I am not sure what to look for.
The following is a 3-day range (I did a removal of some bad entries where the TTL was forgotten about 4 days ago) but I don't really see anything special
I want to track and alert if my logs go awry. But I can't find a way of tracking the stored bytes for a log group. Is it possible to even add that as a metric?
I was trying to set up VPC peering in AWS. I got most of it working but the network connectivity didn't work. I narrowed down the difference to the routes.
In my previous working system I had the VPC peering route in the main routing table, but when I terraformed a new system I tried to create a separate routing table with the VPC peering route but that didn't work.
I had to manually go to AWS console to add the route on the main route table for the communications to work.
When deploying a swarm to kubernetes are swarm labels secrets, config still available and accessible through /var/run/docker.sock?
I am asking since I have a custom Spring Cloud Gateway implementation that uses Docker Swarm metadata to configure the routing much like Traefik does.
Docker supports the notion of using SSH to connect to the Docker daemon, but I was wondering is it possible to chain the connection so we connect to a bastion server which then connects to the real docker daemon via SSH?
This is the reverse of How to Convert o365 Group to Security Group?
This is a security group NOT a distribution list in which case I would've done Upgrade distribution lists to Microsoft 365 Groups in Outlook
Or perhaps I just convert "the security group" to "mail-enabled security group" first then do the "upgrade" I would accept that as an answer too. Note this is Office 365 so I don't have Exchange installed locally otherwise I would just do this Mail-enable or mail-disable existing security groups.
How to mail-enable an existing Azure AD security group? tried to go through this intermediate step as well. Though the current answer indicates this is not possible.
I basically want to retain the object ID since some external systems (specifically Sonarqube) uses the Object ID of my security group but I want the members of Developers (which are basically Internal Developers and Contractors groups) to be converted so I can use them with Microsoft Teams.
Is it possible?
I also don't have a local AD so I cannot avail of AD Group and Distribution Group with O365
What's the typical process to roll out an upgrade of Docker and other OS updates to a Docker Swarm cluster?
Since I want it rolled out, I was thinking of just doing a full Terraform build which will contain the latest security patches and upgrades. The way I am presently doing it is manually taint a set and upgrade accordingly then prune the left over node definitions.
https://registry.terraform.io/modules/trajano/swarm-aws/docker/
The thing is this is still pretty manual, I would like to be able to say "upgrade swarm" and it will do the work for me with minimal downtime.
I am looking at the plugins for Logstash and I noticed it had both an input and output plugin for kafka. For a single topic, can Logstash be used to forward kafka topic messages to another kafka server or should I expect there to be some data loss?
I made a mistake in my configuration and set up my VPC to 10.0.0.0/16 and that conflicts with some of the services run in docker which created an internal network which now has a few containers at 10.0.0.0/24.
I was wondering if I can simply change the DNS to point somewhere else or do some routing to enable it like
route 10.253.0.2/32 to 10.0.0.2/32 on the management console and change /etc/resolv.conf? I tried to see if I can add the route, but won't give me the option of setting an IP
I am trying to set up a Nexus repository for use by a Docker Swarm. However, I am seeing some weird behaviour and I am not sure if it is something I did or if it is a bug because it appears to be present since 3.12 (that's the first version that had the S3 blob store so that was the first time I used Nexus)
The behaviour I am seeing is docker pull works but when I do a docker swarm deploy it says the image could not be accessed. I don't have the issue with the registry:2 image.
Here's the output from docker pull which shows it working successfully. It also means that I have authenticated correctly.
$ sudo docker pull repo.devhaus.com/mylj-api:latest
latest: Pulling from mylj-api
Digest: sha256:e6ca3333cbe6d8c1761b2af2548610b068e1a268dac437598fb76a5b4102f9eb
Status: Downloaded newer image for repo.devhaus.com/mylj-api:latest
The docker-compose.yml file used for deployment is
version: '3.4'
services:
apidoc:
image: repo.devhaus.com/mylj-api
However, when I attempted to deploy I got
$ sudo docker stack deploy apidoc -c apidoc.yml --with-registry-auth --prune
Updating service apidoc_apidoc (id: odj2sgw8zugthjfk4jom1erms)
image repo.devhaus.com/mylj-api:latest could not be accessed on a registry to record
its digest. Each node will access repo.devhaus.com/mylj-api:latest independently,
possibly leading to different nodes running different
versions of the image.
I have also attempted to give the users nx-admin rights which they really shouldn't because all they need to do is read from the repository, not write.
In /var/log/messages the following appears on docker stack deploy but not in docker pull
Oct 17 01:25:59 ip-10-70-1-11 dockerd: time="2018-10-17T01:25:59.853065022Z" level=error msg="Handler for GET /v1.38/distribution/repo.devhaus.com/mylj-api:latest/json returned error: missing or empty Content-Length header"
I am thinking that docker stack deploy may be doing a HEAD request.
The following works:
curl --user XXXX:YYYY https://repo.devhaus.com/v2/mylj-api/manifests/latest
The following which is basically the HEAD request equivalent gives a 404 :
curl -I --user XXXX:YYYY https://repo.devhaus.com/v2/mylj-api/manifests/latest does not and gives a 404
I also confirmed that it was not a proxy issue as I hit the exposed port directly and yielded the same results as above.
I am trying to create a TLS certificate for server authentication on Docker on a Terraformed system. To create the TLS server certificate I did the following
resource "tls_private_key" "master-1" {
algorithm = "RSA"
rsa_bits = "2048"
}
resource "tls_cert_request" "master-1" {
key_algorithm = "RSA"
private_key_pem = "${tls_private_key.master-1.private_key_pem}"
subject {
common_name = "${aws_instance.master-1.public_dns}"
}
dns_names = [
"${aws_instance.master-1.public_dns}",
"${aws_instance.master-1.private_dns}",
]
ip_addresses = [
"${aws_instance.master-1.public_ip}",
"${aws_instance.master-1.private_ip}",
]
}
resource "tls_locally_signed_cert" "master-1" {
ca_key_algorithm = "RSA"
cert_request_pem = "${tls_cert_request.master-1.cert_request_pem}"
ca_private_key_pem = "${tls_private_key.devops.private_key_pem}"
ca_cert_pem = "${tls_self_signed_cert.devops.cert_pem}"
validity_period_hours = 8760
allowed_uses = [
"server_auth",
"digital_signature",
"key_encipherment",
]
}
In the resource "tls_cert_request" "master-1" section I added references to the master-1 aws_instance
In the instance I have the following provisioner which uses the values from the signed certificate
provisioner "remote-exec" {
inline = [
"echo ${tls_self_signed_cert.devops.cert_pem} > /tmp/ca.pem",
"echo ${tls_locally_signed_cert.master-1.cert_pem} > /tmp/cert.pem",
"echo ${tls_private_key.master-1.private_key_pem} > /tmp/key.pem",
]
}
I know it's technically a cycle and when doing a terraform plam it errors out with
Error: Error asking for user input: 1 error(s) occurred:
* Cycle: aws_instance.master-1, tls_cert_request.master-1, tls_locally_signed_cert.master-1
So I wanted to ask if there's a way to avoid that other than using openssl and doing the TLS generation in the provisioner script?
This is what I did for my Vagrant environment which I am about to port to terraform
mkdir -p /var/lib/docker
openssl genrsa -out /var/lib/docker/key.pem 4096 2> /dev/null
openssl req -subj "/CN=$(hostname)" -sha256 -new -key /var/lib/docker/key.pem -out /tmp/server.csr
echo subjectAltName = DNS:$(hostname),IP:$(hostname -I | awk '{print $1}'),IP:127.0.0.1 >> extfile.cnf
echo extendedKeyUsage = serverAuth >> /tmp/extfile.cnf
openssl x509 -req -days 365 -sha256 -in /tmp/server.csr -CA /vagrant/ca/ca.pem -CAkey /vagrant/ca/ca-key.pem -CAcreateserial -out /var/lib/docker/cert.pem -extfile extfile.cnf -passin file:/vagrant/ca/passphrase
rm /tmp/server.csr /tmp/extfile.cnf
I know a volume can span multiple bricks. I was wondering is the converse true where a single brick is used with multiple volumes.
Or we should just use the subdir option.
I have a docker swarm configuration and in there I deployed two stacks (main and mon) I can expose a port in one stack and I can refer to it from another. However, I was trying to find a way of not doing that but instead have it access it using the 127.0.0.11 DNS.
In mon I have a service called grafana
Using https://docs.docker.com/docker-cloud/apps/service-links/#discovering-services-or-containers-on-another-stack which indicated that I can use the stack name to refer to it didn't work when I tried to ping grafana.mon it just returned invalid host name.
I am trying to install GlusterFS and I see all the instructions utilize the creation of an XFS mount point, is it a limitation that GlusterFS requires XFS? Can it work with vfat or ntfs mounts?