Blogs on Blog · Muhammad Fauzi Islami

K8S-thing: How Linux Namespace Plays a Role in Kubernetes

Mon, 27 Feb 2023 00:00:00 +0000

Linux Network Namespace

Before we look into how Linux Network Namespace works in Kubernetes Pod, we need to know from the basic what it is and what the purpose of it. Network namespace in linux provides an isolated system resources associated with networking-related stuff within a single host such as IP (Internet Protocol) either it is IPv4 or IPv6, NAT rules, firewall rules, and routing table.

Let’s imagine you are a parent who have children and live in a house. Take the computer host as a house and namespaces are rooms within that house. You assign those rooms to each of your children. They have their own privacy, so each child can only see what’s within his or her room and they can’t see what happens outside their room. However, as a parent you have a visibility to all rooms in the house. If you wish, you can visit each room.

K8S-thing: How Linux Namespace Works in a Pod

Mon, 27 Feb 2023 00:00:00 +0000

Linux Network Namespace

FluxCD: Image Watcher

Wed, 01 Feb 2023 00:00:00 +0000

This time I want to bring up a cool GitOps tool beside ArgoCD named FluxCD. But I won’t discuss about what it is and the comparison between ArgoCD and FluxCD just yet. Instead, I find FluxCD has a cool feature of many features it provides which I don’t find this in ArgoCD (at least as the time as I write this topic). Probably, the introduction topic of FluxCD itself is worth having later on and it’s generally similar to ArgoCD as both work in the same area for Continous Deployment. But yet again, now let’s have a go with one of its sophisticated feature 😄

FluxCD: Image Watcher

Wed, 01 Feb 2023 00:00:00 +0000

This time I want to bring up a cool GitOps tool beside ArgoCD named FluxCD. But I won’t discuss about what it is and the comparison between ArgoCD and FluxCD just yet. Instead, I find FluxCD has a cool feature of many features it provides which I don’t find this in ArgoCD (at least as the time as I write this topic). Probably, the introduction topic of FluxCD itself is worth having later on and it’s generally similar to ArgoCD as both work in the same area for Continuous Deployment. But yet again, now let’s have a go with one of its sophisticated feature 😄

Distribute Pods Across Nodes With topologySpreadConstraints

Tue, 01 Nov 2022 00:00:00 +0000

Intro

I had several works related to evenly spreading out pods across nodes in order to prevent potentially Kubernetes schedule the replicas of pods on the same node which will lead to a problem if that particular node falls over. I comprehended the case because there are some ways to schedule pods and the solution must be suitable to the environment in my case. As we might already know, Kubernetes has its own built-in mechanism to schedule a pod into a node named scheduler. But Kubernetes gives us flexibility on how and where a pod is scheduled on which node, it depends on our needs. Let’s take an example such as taints & tolerations, nodeSelector, and even a more advanced way like podAntiAffinity. Basically, it allows us to dictate the scheduler on where pods should be put on.

Golang\'s Linter Aggregator: Golangci-lint

Tue, 06 Sep 2022 00:00:00 +0000

Note

Terratest: Introduction to Automation Test For Infrastructure-as-Code

Sun, 07 Aug 2022 00:00:00 +0000

Note

JCasC (Jenkins Configuration as Code) : Setting up Jenkins in a fully reproducible way

Fri, 18 Feb 2022 00:00:00 +0000

Info

Immutable Infrastructure, treating servers like “cattle”. Does it sound ridiculous ?

Sun, 06 Feb 2022 00:00:00 +0000

Info

Highly Available Kubernetes Cluster Using HAproxy and Keepalived

Sun, 17 Oct 2021 00:00:00 +0000

Kubernetes provides us a convenient way to make our application easier to maintain and more scalable. Since kubernetes is only an abstraction that runs on a set of machines and consists of many components, we have some work to do to keep our kubernetes cluster well-established and healthy, especially to make that cluster highly available. In this case, I use two HAproxy instances to balance the load over the network or we usually say that as load balancing. Not only that, I also use Keepalived which will make it redundant between the two HAproxy instances. The diagram below depicts how HAproxy and Keepalived play their role :

Proxying Docker Registry Through Nexus Repository Manager

Thu, 14 Oct 2021 00:00:00 +0000

Info

Proxying PyPI Repository in Nexus Repository Manager

Fri, 08 Oct 2021 00:00:00 +0000

Info

Securing K8S Secret Object Using SealedSecret

Sun, 26 Sep 2021 00:00:00 +0000

Managing kubernetes manifest on Git or any other SCM is a common task nowadays. It makes life easier if we talk about continuous deployment. However, there is a manifest that should not be stored on SCM, it’s secret object. Secret object on Kubernetes was made to hide any sensitive data including user credentials and key. Unfortunately, secret object is not completely secure, it does not encrypt but only uses base64 encoding scheme to hide the data and it can be easily decoded. Therefore, Sealed Secret is one of the solution to make the secret more secure and can be securely stored on SCM.

Service Mesh : Istio and Kiali Setup

Sun, 01 Aug 2021 00:00:00 +0000

It’s the first time for me to learn what service mesh is, how it works, and how to start the lab to deep dive on this stuff. In this article, there will be some of my notes about how to install Istio and see the visualization of some microservices that will have been monitored by Istio and I’m going to write it up now.

As usual, it would be better if we have good comprehension on what we’re going to learn.

Collecting Network Traffic Using TCPDump on POD Level in Openshift

Fri, 23 Jul 2021 00:00:00 +0000

Ada kalanya ketika sebuah aplikasi mengalami masalah dan tidak mengeluarkan log pada stdout secara lengkap dan cenderung tidak membantu untuk kebutuhan troubleshooting. Sehingga diperlukan analisa lebih dalam untuk mendapatkan petunjuk dari masalah tersebut, terutama jika masalahnya dalam ruang lingkup network yang perlu dilakukan analisa dari network traffic yang ada. Maka dari itu kita bisa melakukan TCPDump di level POD, namun pada umumnya tidak semua image aplikasi dibekali utilitas untuk melakukan hal itu. Oleh karena itu berikut adalah cara bagaimana melakukan TCPDump pada level POD di Openshift :

CI/CD Labs Part 3: Integrate Jenkins with Openshift

Fri, 26 Mar 2021 00:00:00 +0000

In this part 3 CI / CD lab the author will document how to integrate Jenkins with the OpenShift.

What should be prepared:

1 VM Jenkins
Spec:
OS: Centos 7.9 (optional)
• RAM: 16GB (this will be used until labs finish)
• CPU: 4vCPU
• HDD: 100GB
• Internet connection
1 VM CRC (CodeReady Container) Mini OpenShift
Spec:
OS: Centos 7.9 (optional)
• RAM: 16GB (this will be used until labs finish)
• CPU: 4vCPU
• HDD: 100GB
• Internet connection

MachineConfigPool degraded saat updating : “Error when evicting pod”

Sat, 20 Mar 2021 00:00:00 +0000

Kejadian ini seringkali terjadi ketika melakukan sebuah perubahan cluster yang mengharuskan setiap nodes pada cluster konsolidasi dengan perubahan yang baru saja diterapkan. Pada masalah yang penulis alami, penulis ingin menambahkan private registry ke dalam cluster agar bisa dikenali sebagai insecure registry. Namun setelah selesai dikonfigurasi dan cluster otomatis melakukan konsolidasi konfigurasi ke setiap nodes (menambahkan insecure registry), terdapat suatu hal yang janggal ketika melihat kondisi salah satu node stuck di status “Ready,SchedulingDisabled“ dengan waktu yang lama dan tidak normal. Setelah dilakukan pengecekan pada node ternyata terdapat 1 pod yang bermasalah yang tidak bisa dihapus dari node tersebut :

Menambahkan Trusted Certificate Pada JVM di Jenkins

Wed, 10 Mar 2021 00:00:00 +0000

Pada tulisan ini membahas sebuah kendala yang dialami penulis ketika melakukan integrasi Jenkins dengan Jira, Bitbucket dan Nexus yang menggunakan HTTPS sebagai protokolnya. Pada saat melakukan test connection terdapat error : “_ unable to find valid certification path to requested target jenkins_ “

Error itu berasal JVM ( Java Virtual Machine ). Ini karena environment pada Java tidak mempunyai informasi tentang HTTPS server yang ada pada Jira, Bitbucket dan Nexus tersebut untuk dilakukan verifikasi apakah itu merupakan website valid atau tidak. Biasanya sertifikat dapat diperoleh dari internal Root CA atau secara Self-Signed dan hal ini yang biasanya seolah membuat JVM bingung karena tidak satupun yang masuk “trusted list” nya. Oleh karena itu kita perlu melakukan import sertifikat secara manual pada JVM. Dengan begitu, artinya kita memberitahu JVM bahwa sertifikat tersebut terpercaya.

Namespace OpenShift Tidak Dapat Dihapus

Wed, 10 Mar 2021 00:00:00 +0000

Ada sebuah kejadian di project yang cukup membuat frustasi penulis ketika melakukan penghapusan sebuah project/namespace pada openshift, yaitu namespace yang akan dihapus tidak terhapus walaupun sudah dipaksa untuk dihapus dengan menggunakan parameter –force –grace-period=0 , proses penghapusan stuck seperti gambar di bawah ini :

dan pada saat dilakukan describe namespace tersebut, stuck di status terminating

Setelah bergoogling-googling ria dan bertanya pada ahlinya cc : mas @alan-prasetyo , titik terang untuk menghapus mulai terlihat. Hal itu bisa terjadi karena ketika melakukan penghapusan namespace, masih terdapat objek yang belum dihapus di dalamnya. Penulis baru tersadar bahwa objek yang masih ada hanyalah StorageCluster .

StorageCluster OCS tidak dapat dihapus

Wed, 10 Mar 2021 00:00:00 +0000

Ada kalanya keanehan terjadi ketika sedang mengerjakan tasks di project. Salah satu hal aneh tersebut yang penulis adalah menghapus sebuah objek yang tidak berhasil terhapus tanpa alasan yang diketahui sampai saat ini oleh penulis.

Setelah mencari-cari tahu cara menghapusnya secara paksa, cukup melakukan patch secara manual

oc patch -n openshift-storage storagecluster/ocs-storagecluster --type=merge -p '{"metadata": {"finalizers":null}}'

Pada command di atas , terlihat jelas finalizers dibuat valuenya menjadi null. Namun sebenarnya, sebelum mengeksekusi command tersebut penulis mencoba untuk melakukannya dengan mengedit StorageCluster tersebut secara manual dengan menggunakan perintah oc edit storagecluster ocs-storagecluster, lalu merubah value pada key finalizers menjajdi null, namun ketika konfigurasi tersebut disimpan tidak terjadi apa-apa dan StorageCluster tetap stuck pada status Deleting. Lalu setelah, barulah solusi di atas dieksekusi dan StorageCluster berhasil dihapus.

CI/CD Labs Part 2: Integrate Jenkins with Bitbucket Server

Fri, 05 Mar 2021 00:00:00 +0000

In this part 2 of the CI / CD labs, I will document how to do Jenkins integration with the Bitbucket server (not the cloud).

What should be prepared :

1 VM (Jenkins + Bitbucket Server)
Specifications :
• OS Centos 7.9 (optional)
• RAM: 16GB (this will be used until labs get finished)
• CPU: 4vCPU
• HDD: 100GB
• Internet connection

Inside the VM are installed as follows :

CI/CD Labs Part 1: Integrate Jenkins with Nexus Repository OSS

Wed, 03 Mar 2021 00:00:00 +0000

This is the first lab of lab series to learn CI/CD. In this lab, I will only focus on documenting the implementations step by step and not on the installation. Maybe on another occasion, I may also include how to install each of the tools used in this lab.

The following are some of the parts of this series :

Integrate Jenkins with Nexus Repository OSS
Integrate Jenkins with Bitbucket
Integrate Jenkins with OpenShift
Integrate Jenkins with Jira
Full CI / CD Pipeline

*Note : These labs don’t involve any tests.

Automating K8S Cluster Installation with Kubespray

Mon, 18 Jan 2021 00:00:00 +0000

There are various ways to perform a kubernetes installation. If you look at the environment in which kubernetes will be installed on, you have options that can be done, namely:

Learning purposes :

Kind tools ( Kubernetes In Docker )
Minikube

Production purposes :

Bootstrapping K8S with kubeadm
Installing K8S with kubespray
Installing K8S with kops

In this opportunity, I will do the installation of a kubernetes cluster using kubespray. Kubespray itself is a way to install Kubernetes cluster by automating it using ansible playbook.