jayunit100's questions

Today I needed to remove a file, but I couldn't:

[capv@TKG-VC-ANTREA-M]: C:\Users\capv> rm 'C:\Program Files\containerd\containerd-shim-runhcs-v1.exe'
rm : Cannot remove item C:\Program Files\containerd\containerd-shim-runhcs-v1.exe: Access to the path 'C:\Program Files\containerd\containerd-shim-runhcs-v1.exe' is denied.

Oddly, I found a workaround: Just mv it instead, and it worked.

[capv@TKG-VC-ANTREA-M]: C:\Users\capv> mv 'C:\Program Files\containerd\containerd-shim-runhcs-v1.exe' a

After this I was able to accomplish my original goal of untarring the contents of a tarball into this directory..

[capv@TKG-VC-ANTREA-M]: C:\Users\capv> cmd /c tar -zxvf containerd.tar.gz -C "c:/program files/containerd" --strip-components 1
x containerd-shim-runhcs-v1.exe
x containerd-revision.txt
x containerd.exe
x hcsshim-revision.txt
x ctr.exe

Out of curiosity, after moving the file, I tried, but still couldn't delete the moved version of the file:

[capv@TKG-VC-ANTREA-M]: C:\Users\capv> rm a
rm : Cannot remove item C:\Users\capv\a: Access to the path 'C:\Users\capv\a' is denied.
At line:1 char:1

Why would Windows Server allow me to move but not delete this file?

In general, how should one debug a failure related to CmdletizationQuery_NotFound messages, and why would the MSFT_NetRoute based queries register such an error?

Details

Specifically, my Kubernetes CNI provider (antrea) is posting an error message related to MSFT_NetRoute when it starts up, because it can't succesfully run a powershell query necessary for bootstrapping itself. The error message has a suspicious string, which:

• Might be related to powershell version (I disconfirmed later in this post, but its a reasonable hypothesis)
• Im also considering that maybe this error came from external things i havent installed...
• Finally, without fully understanding the nature of cmdletizationQuery error messages, its reasonable to assume this is related to a lower level networking setup issue.

   + FullyQualifiedErrorId : CmdletizationQuery_NotFound,Get-NetRoute

The above snippet of this message, highlights the Get-NetRoute Related error which occurs below, which is puzzling because it seems to be indicating that Get-NetRoute is not a valid query to run. But https://docs.microsoft.com/en-us/powershell/module/nettcpip/get-netroute?view=windowsserver2019-ps seems to imply thet Get-NetRoute is available by default in powershell.

The error message

ROOT/StandardCimv2/MSFT_NetRoute class on the  CIM server: SELECT * FROM MSFT_NetRoute  WHERE ((DestinationPrefix LIKE
'0.0.0.0/0')) AND ((InterfaceIndex = 26)). Verify query parameters and retry.
At line:1 char:3
+ $(Get-NetRoute -InterfaceIndex 26 -DestinationPrefix 0.0.0.0/0 ).Next ...
+   ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : ObjectNotFound: (MSFT_NetRoute:String) [Get-NetRoute], CimJobException
    + FullyQualifiedErrorId : CmdletizationQuery_NotFound,Get-NetRoute

Powershell version

The powershell version on this machine is seemlingy pretty up to date... (5.1 i think is normal on windows server 2019)...

Name                           Value
----                           -----
PSVersion                      5.1.17763.1852
PSEdition                      Desktop
PSCompatibleVersions           {1.0, 2.0, 3.0, 4.0...}
BuildVersion                   10.0.17763.1852
CLRVersion                     4.0.30319.42000
WSManStackVersion              3.0
PSRemotingProtocolVersion      2.3
SerializationVersion           1.1.0.1

Note: I've tested this in similar versions of windows server 2019 with a similar 5.1.x powershell version (5.1.17763.1490) and not seen this failure. So,

Questions

• is there something i need to do to make Get-NetRoute work properly on my machines?
• is this related to something else (i.e. the way network interfaces are configured on the individual VM) ? Note that this is a VirtualBox VM, so if there was a issue with bridged or NAT networking, I woudln't be totally shocked.

The Linux kernel has the ability to route traffic using nftables, iptables, and ipvs. Ive collected 3 related questions here, in order to generally ask the broader overall question of how precedence is determined with regard to kernel routing and firewalling rules:

• In general, is there an order of precedence for when these load balancing / packet filtering constructs are ordered ?
• NFT and iptables, if not managed properly from an installation perspective, can result in “collisions” (unpredictable results). The solution to this seems to be making sure iptables-legacy is installed. Is it possible to run both NFT and iptables together, and if so, what order would the given iptables “tables” (Mangle, Filter, NAT), be applied with respect to NFT tables rules ?
• IPVS is capable of implementing load balancing. In general, is it meant to occur before, or after iptables rules are applied to an incoming packet ?
• How does firewalld play into all of this?
• How does precedence work with regard to SELinux and these various rules?

For context, I recently noticed that some iptables rules on a system where NFT was installed weren’t working as expected, and , even though here are great diagrams online of how default iptables chains are ordered with regard to their resident tables, I became curious about how one would reason about these chains and their traversal if other rules from NFT, IPVS, eBPF, and so on were present.

When running packer to create new VM images on ubuntu (focal fossa, 20.04) I found that the ISO seems to be not detected by the windows installer when booting:

That is, windows server installation initialization sais that "No images are available". This is odd to me because, after all, how would the windows server installation even start if there was no iso to begin with?

• How can i determine why it is that the windows OS installation doesn't see any OS images, and is the ability to properly load guest extensions or OS images related somehow?
• Is it possible that, some portions of the ISO arent readable by VMWare Workstation for some reason?
• Or, is the initial windows server installation step something that is controlled by an external program from the ISO (i.e. something in the BIOS of the VM)?

I recently installed Windows Server 2019, but I noticed it doesn't have an option for installing Containers. I assumed any Windows Server OS would have the ability to add a Containers channel, however I don't see anything online to do this.

This version is actually "Microsoft Hyper-V Server", however, its not clear that Hyper-V server is fundamentally different from regular Windows Server OS installations.

• Is there a way to enable the 'Containers' feature on Microsoft Hyper-V Server 2019 (1809) ?
• Is there a way to upgrade Micrsoft's Hyper-V Server to a Containers compatible 1909 server ?
• What is the fundamental difference between Microsoft's Hyper-V Server and a regular Microsoft 2019 Windows Server OS?

Note: I installed this onto a laptop over a USB stick, and did a lot of work to upgrade drivers and so on to support laptop features like Wi-Fi, hence my reluctance to completely reinstall the operating system .

In the image below, i have several services running, including some ovs services. I found however that when i try to list these services (i was going to try to find their dependencies through the UI), the "Services" application on Windows doesn't show them.

Why is it that some services only show up in my powershell Get-Services output, but not in the corresponding "Services" window on windows 2019 ?

Note: I am logged in as an administrator, so I assume that there is no permissions issue here.

What knobs are available for configuring the IP Addresses of VMs in vsphere, without NSX, as compared to with NSX? I see in my VSphere clusters that

• VMs have multiple IPs
• These presumeably are randomly assigned by a DHCP host somehow

Is there a way to influence or lock down a specific IP for a VM in vsphere, or should we use nSX for this kind of behaviour?

I have a wide open security group which I rely on for instances to be able to connect. I also have a private network of 172.*. addresses, as shown here:

What do I need to do in order to allow servers launched with the same subnet id to talk to one another? Currently, they can ssh to each other, but they cannot ping - even though I have opened up all firewall rules.

Im noticing that in Fedora 20, if I modify the HOSTNAME=.... parameter to include a typical hostname:

HOSTNAME=machine1.local

It actually replaces the "." with a "-" character , and machine1.local is not pingable.

Why is fedora interchanging the "." character with a dash, given that the "." in a hostname has a very specific meaning, and is usually deliberate?

And my more important question: Whats the right way to set a fully qualified hostname on a local computer (I dont have DNS set up).

I've found that in KVM, my networking is acting funny. Oddly

(1) I can resolve external internet locations using nslookup or ping , but I cannot actually receive a ping back.

(2) I cannot ping (even from my host) into my VM. Nor can I ping my host from my VM. So, networking is clearly, severely messed up.

However, my networking doesn't look particularly bad - eth0 seems to have a reasonable address etc...

Any thoughts on how to troubleshoot a KVM box which is able to resolve, but not connect/ping, to a domain on the web ? I've tested multiple domains (google,yahoo, etc...) and all seem to resolve no problem - indicating that the resolution process is not broken.

UPDATE

route -n output is shown below:

192.168.122.0    0.0.0.0  255.255.255.0  U   0 0 0 eth0
169.254.0.0      0.0.0.0  255.255.0.0   U   1002 0 0 eth0
0.0.0.0        192.168.122.1      UG  0 0 0 eth0

UPDATE 2

Actually, I cant even ping within my host into my VM, so something is definetly broke - and its not necessarily related to any external networking - its broken at the host->guest level.

In my authconfig setup, I always use :

--ldapbasedn='ou=users,o=Directory' 

I thought by using:

--ldapbasedn='o=Directory' 

groups would also be included, but no luck.

My LDAP schema looks like this:

But it doesn't seem that this includes group information.

What's the idiomatic way to include group information into authconfig?

Normally when i run virt install, I boot initially from the network, by installing from source, and also including a "--disk" option. The way i do it is described here ( in the "root" of this question which i dont have the answer to).

KVM: Machines unbootable after host reboot

So im facing an issue: My VMs dont boot after i reboot the host, and I beleive maybe it is because I dont create a proper bootable disk when i do the initial install.

UPDATE

Ive confirmed that i can reboot guests without restarting the host. Thus, somewhere, something must be going wrong with my disks between host reboots. but how could that be?

That is, how is it that rebooting my HOST, results in a GUEST VM not recognizing its own boot disk anymore?

Im finding that my KVM guests are unusable after i reboot my host. Specifically, I always get this error:

Booting from hard disk

Boot failed: not a bootable disk

What causes this error? I've tried toggling the VM disk type between qcow2 and raw, because a few articles online mentioned that this can happen if virt doesnt know the type of image to load, but that did not help.

** some more details **

I create My VMs from source using a command somewhat like this:

    base="http://mirror.pnl.gov/fedora/linux/releases/20/Fedora/x86_64/os/"
nohup sudo virt-install --hvm --name $vm_name$i --ram 4000 \
--disk path=/VirtualMachines/$vm_name$i,size=30 \
--location $base -x  "ks=http://xxx.os21.ks$kx"&

My virsh file looks like this:

      1 <domain type='kvm'>
  2   <name>testFriApr11092714EDT2014_1</name>
  3   <uuid>d4c86892-fb15-04ed-f4ab-7e3c76974ffc</uuid>
  4   <memory unit='KiB'>4096000</memory>
  5   <currentMemory unit='KiB'>4096000</currentMemory>
  6   <vcpu placement='static'>1</vcpu>
  7   <os>
  8     <type arch='x86_64' machine='rhel6.4.0'>hvm</type>
  9     <boot dev='hd'/>
 10   </os>
 11   <features>
 12     <acpi/>
 13     <apic/>
 14     <pae/>
 15   </features>
 16   <clock offset='utc'/>
 17   <on_poweroff>destroy</on_poweroff>
 18   <on_reboot>restart</on_reboot>
 19   <on_crash>restart</on_crash>
 20   <devices>
 21     <emulator>/usr/libexec/qemu-kvm</emulator>
 22     <disk type='file' device='disk'>
 23       <driver name='qemu' type='raw' cache='none'/>
 24       <source file='/VirtualMachines/testFriApr11092714EDT2014_1'/>
 25       <target dev='hda' bus='ide'/>
 26       <address type='drive' controller='0' bus='0' target='0' unit='0'/>
 27     </disk>
 28     <controller type='usb' index='0'>
 29       <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x2'/>
 30     </controller>
 31     <controller type='ide' index='0'>
 32       <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x1'/>
 33     </controller>
 34     <interface type='network'>
 35       <mac address='52:54:00:81:bd:fe'/>
 36       <source network='default'/>

I've applied a puppet manifest, which in turn included a puppet module that added several entities to /opt/...

Is there a way to undo the effects of an applied puppet module ?

i.e. "puppet module uninstall ..."

I recently applied a puppet transaction:

puppet resource cron puppet-apply ensure=present user=root minute=30 command='/usr/bin/puppet apply $(puppet --configprint manifest)

To undo it, I simply went and edited my crontab

crontab -e ...

I'm sure that this is the "wrong" way to undo the transaction, but I couldn't find any metadata about the transaction inside of /etc/puppet/...

So - my question - is how can I find the and modify/decommision/delete puppet installed resources without having underlying knowledge of the resources themselves?

That is, where is the list of puppet created resources?

I always thought that puppet resources were defined in the site.pp file, but now I am finding that there are more than one way to modify the state of a system using, for example, by using the "puppet resource" tool.

If I have a misunderstanding of the way puppet works, please note that also - as Im somewhat new to it.

I have a domain name registered with http://www.registryrocket.com/

The "main" site, which is called rudolfcode.net, is registered under godaddy, and forwards to a heroku site (rudolfcode.herokuapp.com).

I have found that the main site, rudolfcode.net works, but the hostgator forwarding has stopped working (firefox simply fails when you point to http://www.rudolflabs.com, which is the domain name registered by hostgator).

How can I debug this issue ?

Finally, I have tried to run some DNS tests, and here are the results :

Im not sure what the failures mean .... But Im pretty sure that "Conecting to WWW Home Page" failed is a pretty bad sign !

Thanks.

Hi : What is the minimilistic way to setup multiple emails (for domains I own) to all resolve to the same central email address ?

I know it is easy to use email-forwarding with typical domain server utilities found on sites such as godaddy... But I'd rather not simply automate forwarding, because I don't want my email stored on multiple servers for this particular project, due to legal issues related to data and attachment privacy for a client.