I am trying to bootstrap a Centos7 EC2 instance (ami-02eac2c0129f6376b) with bash user-data. Because it runs as root and I need to create a lot of things as the centos user, I use sudo -Hu centos <cmd> many times. Each call introduces a 25 second delay. I have hundreds. What can I do to speed this up?

This is a known issue, but I cannot find any solutions.

I have tried:

• Add and /etc/hosts entry for my hostname

printf "\n127.0.0.1   %s %s\n" "$(hostname -f)" "$(hostname -s)" | tee -a /etc/hosts

• Remove myhostname from /etc/nsswitch.conf

sed -Ei 's/\s*myhostname//' /etc/nsswitch.conf

• Update systemd to systemd-219-36.el7
• Update systemd to 234

These delays are EXTREMELY painful because I am currently in the Trial and Error phase of building out new user-data scripts.

What can I do?

In order to allow my developers to use the Serverless Framework to deploy new AWS Lambda functions, they have to be able to create roles. I'd like to give them permissions to create roles that can only do a limited number of things. For example s3:, dynamodb:, cloudfront:Update*

But I don't want them (RoleA) to be able to create roles (RoleB) that can do anything with EC2, IAM, etc. How might you limit this permission?

Note: This is NOT a Raspberry Pi specific question. It is a Linux System Administration question. Please do not try to have it removed from Server Fault.

I see many "Hello, World" level demos that are specific to [insert cloud hosting platform here], but none that are geared to being used on a single local machine. I was encouraged to see that Raspbian has cloud-init in its repository. That is exactly what I want to do. However, I cannot find any information on how to do it without a AWS, OpenStack, etc.

So, I guess what I really want to know is after you apt-get install cloud-init, where do you put your config/userdata?

Update: I found some info on the NoCloud datasource, but I cannot add a volume labeled cidata. So, that is out for me. (The volume that will hold my user-data is labeled boot.)

Setup

I have a OpenVPN server working well in AWS. Everyone on my team can use it to reach any of the servers in AWS.

Need

Now I have a new need. Now servers in AWS need to be able to reach one (but all would be fine) of the machines that connected via VPN. From the VPN server itself, I can reach the machine (which is a router) and all the machines it can see on its network. However, none of the other servers in AWS can.

Questions

Where is the correct place to advertise (to machines in the datacenter) that requests for 10.10.10.0/16 (remote VPN connected site) should be routed through my VPN server?

Which interface on the VPN server address do I use?

Details

• AWS VPC CIDR: 172.31.0.0/16
  • openvpn.conf: push "route 172.31.0.0 255.255.0.0"
• OpenVPN Server IP: 172.31.17.151
• OpenVPN Server client CIDR: 172.141.0.0/17
  • openvpn.conf: server 172.141.0.0 255.255.128.0
• Client to be reached: 10.10.10.1
  • openvpn.conf: route 10.10.10.0 255.255.255.0
  • openvpn.conf: push "route 10.10.10.0 255.255.255.0"
  • ccd/commonname: ifconfig-push 10.10.10.1 10.10.10.2
  • ccd/commonname: iroute 10.10.10.0 255.255.255.0
• Client peer to be reached: 10.10.10.101

OpenVPN ifconfig:

eth0      Link encap:Ethernet  HWaddr 06:52:B7:00:71:F9
          inet addr:172.31.17.151  Bcast:172.31.17.255  Mask:255.255.255.0

lo        Link encap:Local Loopback
          inet addr:127.0.0.1  Mask:255.0.0.0

tun0      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
          inet addr:172.141.0.1  P-t-P:172.141.0.2  Mask:255.255.255.255

OpenVPN iptables:

Chain INPUT (policy ACCEPT)
num  target     prot opt source               destination
1    ACCEPT     udp  --  0.0.0.0/0            0.0.0.0/0           udp dpt:1194
2    ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:22
3    ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:80

Chain FORWARD (policy ACCEPT)
num  target     prot opt source               destination
1    ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           state RELATED,ESTABLISHED
2    ACCEPT     all  --  172.31.0.0/16        0.0.0.0/0
3    ACCEPT     tcp  --  172.127.0.0/20       172.31.6.110        tcp dpt:22
4    REJECT     tcp  --  172.127.0.0/20       0.0.0.0/0           tcp dpt:22 reject-with icmp-host-prohibited
5    ACCEPT     all  --  172.127.0.0/20       0.0.0.0/0
6    ACCEPT     tcp  --  172.141.0.0/17       172.31.6.110        tcp dpt:22
7    REJECT     tcp  --  172.141.0.0/17       0.0.0.0/0           tcp dpt:22 reject-with icmp-host-prohibited
8    ACCEPT     all  --  172.141.0.0/17       0.0.0.0/0
9    REJECT     all  --  0.0.0.0/0            0.0.0.0/0           reject-with icmp-port-unreachable

Chain OUTPUT (policy ACCEPT)

Preface

Just like everything in Linux I'm sure there are a lot of ways to get an intended result with iptables. I'd like to limit answers to the following categories:

1. What is the difference between the options?
2. Which option is best (or are they the same)?
3. Why do you prefer one over the other?

And please be clear what category you are speaking to. It's okay to state preferences, but don't imply that it is best.

e.g.

I prefer to put --jump as the first argument because I think it reads better to have the intent first and I like to vertically align like arguments of multiple commands.

Question

Is one of these better than the other?

iptables -I INPUT --jump ACCEPT --in-interface lo
iptables -I INPUT --jump ACCEPT --source localhost

Is one of these better than the other?

iptables -A INPUT --jump REJECT
iptables -P INPUT REJECT

As described here https://aws.amazon.com/blogs/aws/new-amazon-ec2-feature-idempotent-instance-creation/ AWS CLI enforces idempotency of the aws ec2 run-instances --cli-input-json command. Unfortunately there is no documentation on how a client-token is generated.

I did find that there is a ClientToken field in the aws ec2 describe-instances results, but of course you still get the following error if you try to use one:

An error occurred (IdempotentParameterMismatch) when calling the RunInstances operation: Arguments on this idempotent request are inconsistent with arguments used in previous request(s).

How do I get a token to use with --client-token?

I'm a Linux guy trying to save a Windows guy from getting on a plane to check on a server that "appears to not be running".

The setup

1. Windows server on a remote network with IP 10.55.0.56 (you don't know anything else about it)
2. You can get** TCP port forwarding from a Windows workstation in your office to any port on 10.55.0.56
3. You do not have access to any Linux/Unix machines on the remote network.

** There is a piece of commercial hardware on the remote network that can be used for port forwarding. It has a clunky web interface with several steps required to add each port. Doing a full port scan is unfeasible.

The question

1. How do you check to see if it is alive?

The Docs say...

A pod (as in a pod of whales or pea pod) is a group of one or more containers (such as Docker containers), the shared storage for those containers, and options about how to run the containers. Pods are always co-located and co-scheduled, and run in a shared context. A pod models an application-specific “logical host” - it contains one or more application containers which are relatively tightly coupled — in a pre-container world, they would have executed on the same physical or virtual machine.

But I'm unsure if "co-location" means on the same P̶o̶d̶ Node. When satellites are co-located they are "in close proximity so that to reception equipment on the ground they 'appear' to occupy a single orbital position." So, that could be on the same Cluster, not on the same Node.

At the time of posting this, the only info I can find on this issue is at https://platform9.com/blog/compare-kubernetes-vs-ecs/ where it says...

Containers in a single Pod are guaranteed to run on a single Kubernetes node.

Now that sounds pretty conclusive, but I haven't been able to get any corroboration on that anywhere. I want to make sure that they are correct and didn't just misunderstand and spread misinformation.

The reason I'm asking is that it seems like Kubernetes is inherently wasteful if this is true. It is almost certain that your nodes with pods deployed will have resources left over. It is likely that you will have a pod whose needs could be satisfied by the combination of these left over resources. However, if a pod cannot span multiple nodes, you will have to create a new node and have even more un-utilized resources.

I've been trying to be cautious and not adopt early. I am an Enterprise Gold subscriber. I have app clusters for each of Python/Django, Ruby on Rails, and PHP (mostly WordPress). (edit: All servers are Linux.) I'm now considering taking the plunge. I have hosts to spare, so it's not the logistics of the conversion that I fear. (Unless you have a 5.0 Master + 5.1 Slave horror story to share.) I was reluctant due to a rant by Monty, but I really want a few of the new features. (Especially the additions to the information_schema.) I'm a full time DBA, so I like knowing what is happening to my servers and my data. I work for a news organization, so we don't have the freedom to experience down time like your average LAMP user. It feels like the time for 5.1 has come.

What say you?

I'm usually a purist when it comes to vimming. I don't like remapping keys, or learning to rely on a bunch of plugins. I like to feel just as powerful on foreign boxen as I do on my own dev box. I do, however, believe in syntax files. Even though the solution may not be a syntax file (bindzone.vim is what I use), I want it bad enough to do whatever.

I regularly view or edit tab (or comma, but that would be a bonus) delimited data. I hate having to set my tabstop to some ridiculous number in order to have everything line up. Example: The BIND zone files are ~40+,6,2,5,15+. So, even though I could view them on a single screen, if I set ts=40, I cannot. I have been searching for a "dynamic tab size" solution for years, but no luck.

I hate that my only good way of editing or even visualizing tabular data is to scp it to my work station and open it in Open Office. There has to be a better way.