Kubernetes, secret and ingress

Hello,

Theses days I spent a lof of times to setup ingress and TLS, to keep the commands needed :
To create TLS secret used by the ingress :

kubectl create secret tls secret-tls-name --key private.key --cert bundle.pem

To create bundle :

cat cer_file chain_file root_file > bundle.pem

If certificate are CER convert them to PEM first

openssl x509 -inform der -in certificate.cer -out certificate.pem

Then in ingress configuration specify in spec, the host, the backend, the tls file for the host :

spec:
  rules:
  - host: myapp.myhost.net
    http:
      paths:
      - backend:
          serviceName: myservice
          servicePort: 8080
        path: /
  tls:
  - hosts:
    - myapp.myhost.net
    secretName: secret-tls-name

You can multiple host and tls cert by host.

Schedule stop and start VM in Google Cloud

Hello,

First month I check the invoice and What !!!
Oups why to run the staging and support environment during non working hours ?
How to do it ?
Schedule I cron from Cloud Shell, maybe ?
But a more elegant way is to use Cloud Scheduler to create a cron job, to trigger Pub/Sub to execute a Cloud Function to stop/start the VM.
I need to check the cost 😀 but at least I learn something new.

Tutorial is straight forward
https://cloud.google.com/scheduler/docs/start-and-stop-compute-engine-instances-on-a-schedule

I simply changed the memory to the function to 128Mo.
Maybe there is a way to pass a list of VM, instead to create a cron job by VM and tutorial uses Node JS 6.x backlevel in April 2020, so a change of the code will be need, but nonetheless is works like a charm.

Migrate DNS to Google Cloud Platform

Just done it, super easy to migrate your DNS service to GCP.

From your account, I use Cloud shell session directly.

Replace silverston.fr and silverston by your domain

Create your new zone :

gcloud dns managed-zones create --dns-name="silverston.fr." --description="My awesome domain" "silverston" 

Import your zone

gcloud dns record-sets import -z=silverston --zone-file-format silverston.fr.txt --delete-all-existing 

--delete-all-existing is necessary to delete existing NS records and use Google instead.

Get your GCP NS servers :

gcloud dns managed-zones describe silverston

You will get your NS servers, for example :

nameServers: 

- ns-cloud-a1.googledomains.com.
- ns-cloud-a2.googledomains.com.
- ns-cloud-a3.googledomains.com.
- ns-cloud-a4.googledomains.com.

gcloud dns managed-zones describe examplezonename

Update your NS in your current registar to use googledomains (use the servers you get in the previous step)

And you're done.
Control DNS propagation using :

watch dig +short NS silverston.fr

source: https://cloud.google.com/dns/docs/migrating

FTP to IBM System i

Sometimes you need still old school admin tricks, to upload files (WAS installation) to ISeries, the only native way, without to install SSH or other stuff is still FTP.
When it happens the easiest way is to use ftpclient.

ftp ipnode
login
password
change naming format because native DB format is limit 10 character long names
quote site namefmt 1
put
And you're done.

Previously you did create a new catalog and upload the files in this Catalog/directory.

Resolutions 2019

Hello,

I was thinking to the following resolutions since the beginning of 2019 but I rather to write them down because if I don't I will probably not complete, so I share them :

• Get Chef first certification : Chef Fluency, maybe less important than 2-3y ago compared to Kubernetes but I did begin so I must complete.    
• To get cloud certifications like AWS but most likely GCP because I use it more.
• To do my first mobile app probably based on Strava.
• To bike 12000km this year, including a backpacking weekend. I did 11000km in 2018.
• To share theses experiences on the blog and more.

Thank you

Proxmox, create external VNC access

Hello,

Sometimes using Proxmox, you can't connect to VM console, to troubleshot boot issues, slow network, java applet version, ...
To address thoses issues, the best solution is to create an external VNC session to login into your VM.
From your Proxmox server, open a VNC connection using NC (netcat) to forward port :

/bin/nc -l -p 5900 -w 100 -c '/usr/sbin/qm vncproxy VMID'

Install VNCTiger, very seasy and high-performance vnc client.

Connect to your Proxmox ip and port (ex: 5900), accept the certificats.
Login and password are the same to connect to your Proxmox, login : root@pam and your password.

Er voila, an emergency remote access to use when everything turns bad and your Windows VM does a BSOD.

Redirect HTTP to HTTPS using Apache and Google Cloud Platform Loadbalancer

Using Apache to redirect HTTP to HTTP, if https version of the site is not configured via Apache ModSSL it doesn't set %{HTTPS} variable to "on" and keeps redirecting infinitely.

The best way to do is to send X-Forwarded-Proto header from load balancer to Apache and configure RewriteCond as follow.

If not already done enablerewrite and ssl

a2enmod rewrite
a2enmod ssl

Then in HTTP vhost configure

<VirtualHost *:80>
....

RewriteEngine On
RewriteCond %{HTTP:X-Forwarded-Proto} !https
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [QSA,L,R=301]

...

</VirtualHost>

Instead of the common usage :

RewriteCond %{HTTPS} off

source : https://stackoverflow.com/a/19722706