Home | panticz.de

Ping VM from IP namespace

Ping VM from IP namespace

SSH reverse tunel over public host

@Office

cat < ~/bin/proxy-ssh-forward.sh
#!/bin/bash

PROXY_SERVER=proxy.example.com

eval \$(ssh-agent) && ssh-add

while true; do
    echo "Connect to proxy ..."
    ssh -a -v -N -R 7422:localhost:22 -o ServerAliveInterval=30 -o ServerAliveCountMax=10 \${PROXY_SERVER}
    sleep 10
done
EOF

chmod +x ~/bin/proxy-ssh-forward.sh
nohup ~/bin/proxy-ssh-forward.sh

@Home

cat <> ~/.ssh/config.d/office
Host proxy.example.com
Hostname 1.2.3.4
User foo

Host proxy-ssh-office
Hostname 127.0.0.1
Port 7422
User bar
#ForwardAgent yes
ProxyCommand ssh proxy.example.com -W %h:%p
EOF

ssh proxy-ssh-office

# forward DNS
cat <> ~/bin/vpn-mr-proxy.sh
#!/bin/bash

/usr/bin/sshuttle \
  --dns \
  192.168.1.0/24 \
  --exclude 192.168.178.0/24 \
  --remote proxy-ssh-office
EOF

router / dnsmasq

Install LXD

LXD container

Create Ubuntu minimal image container

lxc remote add --protocol simplestreams ubuntu-minimal https://cloud-images.ubuntu.com/minimal/releases/
lxc launch ubuntu-minimal:lts ults
lxc launch ubuntu-minimal:jammy u2204m
# lxc exec u2004m -- apt install -y dnsutils vim inetutils-ping

#!/bin/bash

if [ $# -lt 1 ]; then
  echo "Usage $0 "
  exit 1
else
  CONTAINER=$1
fi

OS_VERSION=${2-lts}

# create container
lxc launch ubuntu:${OS_VERSION} ${CONTAINER}
sleep 10

# deploy SSH key
lxc file push --uid 0 --gid 0 --mode 600 ~/.ssh/id_rsa.pub ${CONTAINER}/root/.ssh/authorized_keys

# configure http(s) proxy inside of container (if set on host)
[ -z ${http_proxy} ] || echo "export http_proxy=$http_proxy" | lxc shell ${CONTAINER} -- tee -a /etc/environment
[ -z ${https_proxy} ] || echo "export https_proxy=$https_proxy" | lxc shell ${CONTAINER} -- tee -a /etc/environment

# update APT repository
lxc exec ${CONTAINER} -- bash -c ". /etc/environment && apt update -qq && apt -qqq -y dist-upgrade"

# Optional: install applications
#lxc exec ${CONTAINER} -- bash -c ". /etc/environment && apt install -y haproxy"

Create default container

Deploy OpenStack host with Ironic and Redfish

Define node variables

NODE=com4-dev
NODE_BMC_HOST=com4-dev.ipmi.dev.i.example.com
NODE_MAC_NIC1=00:11:22:33:44:55

Define env variables

NODE_BMC_USER=ADMIN
NODE_BMC_PASS=ADMIN

Create now node with Redfish (pxe device boot broken)
https://docs.openstack.org/ironic/latest/admin/drivers/redfish.html

openstack baremetal node create \
  --name ${NODE} \
  --driver redfish \
  --driver-info redfish_address="https://${NODE_BMC_HOST}" \
  --driver-info redfish_username=${NODE_BMC_USER} \
  --driver-info redfish_password=${NODE_BMC_PASS} \
  --driver-info redfish_verify_ca=false \
  --driver-info redfish_system_id=/redfish/v1/Systems/1

Create now node with IPMI
https://docs.openstack.org/ironic/latest/admin/drivers/ipmitool.html

openstack baremetal node create \
  --name ${NODE} \
  --driver ipmi \
  --driver-info ipmi_address=${NODE_BMC_HOST} \
  --driver-info ipmi_username=${NODE_BMC_USER} \
  --driver-info ipmi_password=${NODE_BMC_PASS}

iPXE
https://docs.openstack.org/ironic/latest/admin/interfaces/boot.html#pxe-boot

openstack baremetal node set ${NODE} \
  --boot-interface ipxe \
  --driver-info deploy_kernel="http://10.33.33.40:8080/ansible_ubuntu.vmlinuz" \
  --driver-info deploy_ramdisk="http://10.33.33.40:8080/ansible_ubuntu.initramfs"

Image
https://docs.openstack.org/ironic/latest/admin/interfaces/boot.html#pxe-boot

Update Intel NIC firmware

# Intel Ethernet Connections Boot Utility, Preboot Images und EFI-Treiber

wget https://downloadmirror.intel.com/29137/eng/Preboot.tar.gz

tar xzf Preboot.tar.gz -C /tmp

cd /tmp/APPS/BootUtil/Linux_x64
chmod +x bootutil64e 
./bootutil64e

ansible-galaxy

Ansible galaxy

ansible-galaxy install 

ansible-galaxy role install  --roles-path /tmp https://github.com/avanov/ansible-galaxy-pyenv/archive/refs/tags/1.2.0.tar.gz
mv /tmp/1.2.0 ~/.ansible/roles/avanov.pyenv

https://galaxy.ansible.com/bennojoy/network_interface/ - Network configuration
https://github.com/Oefenweb/ansible-postfix
https://galaxy.ansible.com/geerlingguy/gitlab/

Linux software RAID (mdadm)
https://galaxy.ansible.com/mrlesmithjr/mdadm

ansible-galaxy install mrlesmithjr.mdadm

Ubuntu multipass

# install  multipass
sudo snap install multipass --edge --classic

snap info multipass
multipass version

# create VM
multipass launch --name vm1

multipass launch --name vm5 --disk 4G --mem 256M core18

multipass exec vm3 -- lsb_release -a

multipass mount /tmp/mp vm3

multipass transfer /etc/fstab vm3:/tmp/y

multipass exec vm3 -- sudo apt update && sudo apt dist-upgrade -y

SSH login to VM

sudo ssh ubuntu@ -i /var/snap/multipass/common/data/multipassd/ssh-keys/id_rsa

multipass delete vm2
multipass purge 

sudo multipass set local.driver=libvirt

Links
https://multipass.run/
https://multipass.run/docs/launch-command

Check OpenvSwitch

#!/bin/bash

export OS_ENV="@globals.environment@"


if [ "${OS_ENV}" == "dev" ]; then
    export PYENV_ROOT="$HOME/.pyenv"
    export PATH="$PYENV_ROOT/bin:$PATH"
    eval "$(pyenv init -)"
fi

source /etc/kolla/admin-openrc.sh

EXIT_CODE=0

# search for broken ovs entry in DB
for NODE in $(openstack compute service list -c Host -f value | sort -u); do
    OUTPUT=$(ssh ${NODE} docker exec openvswitch_vswitchd ovsdb-client dump | grep qvo | egrep -v "tag|mac" | cut -d "\"" -f2)
    for PORT in ${OUTPUT}; do
        printf "%-20s %s\n" "${NODE}" "${PORT}"

        EXIT_CODE=1
    done
done

# Search for "No such device" OpenvSwitch ports
for NODE in $(openstack compute service list -c Host -f value | sort -u); do
    OUTPUT="$(ssh ${NODE} docker exec -i openvswitch_vswitchd ovs-vsctl show | grep "No such device")"
    if [ -n "${OUTPUT}" ]; then
        echo "${NODE}"
        echo "${OUTPUT}"

        EXIT_CODE=1
    fi
done

# search for unnecessary Open vSwitch interfaces on physical hosts
for NODE in $(openstack compute service list -c Host -f value | sort -u); do
    for PORT_TOKEN in $(ssh ${NODE} brctl show | egrep "qvb|tap" | sed '$!N;/\n.*tap/d;P;D' | awk '{print substr($1,4,8)}'); do
        PORT_ID=$(openstack port list -c id -f value | grep ${PORT_TOKEN})
        if [ -n "${PORT_ID}" ]; then
            SERVER_ID=$(openstack port show -c device_id -f value ${PORT_ID})
            SERVER_STATUS=$(openstack server show -c status -f value ${SERVER_ID})
            if [ "${SERVER_STATUS}" != "SHUTOFF" ] && [ "${SERVER_STATUS}" != "VERIFY_RESIZE" ]; then
                echo "NODE: ${NODE}"
                echo "PORT_TOKEN: ${PORT_TOKEN}"
                openstack server show -c name -c id -c project_id -c status ${SERVER_ID}

                EXIT_CODE=1
            fi
        else

Check server

#!/bin/bash

source /etc/kolla/admin-openrc.sh

EXIT_CODE=0

# search for server with status ERROR
OUTPUT="$(openstack server list --all --status=ERROR -c ID -c Name -c Status -f value)"
#openstack server show ${SERVER_ID} -c fault -f value
if [ -n "${OUTPUT}" ]; then
    echo "${OUTPUT}"

    EXIT_CODE=1
fi

# search for server with status VERIFY_RESIZE
OUTPUT="$(openstack server list --all --status=VERIFY_RESIZE -c ID -c Name -c Status -f value)"
if [ -n "${OUTPUT}" ]; then
    echo "${OUTPUT}"

    EXIT_CODE=1
fi

# search for server processes on wrong compute node
for COMPUTE_NODE in $(openstack compute service list --service nova-compute -c Host -f value); do
    for SERVER_ID in $(ssh ${COMPUTE_NODE} pgrep qemu -a | grep -o -P '(?<=-uuid ).*(?= -smbios)'); do
        VM_HOST=$(openstack server show -c "OS-EXT-SRV-ATTR:host" -f value ${SERVER_ID})
        if [ -n "${VM_HOST}" ]; then
            if [ "${VM_HOST}" != "${COMPUTE_NODE}" ]; then
                echo "VM ${SERVER_ID} on wrong compute node ${COMPUTE_NODE}"
                openstack server show ${SERVER_ID} -c OS-EXT-SRV-ATTR:hostname -c name -c id -c status -c OS-EXT-SRV-ATTR:instance_name

                EXIT_CODE=1
            fi
        else
            echo "Server process ${SERVER_ID} on ${COMPUTE_NODE} not available in OpenStack"

            EXIT_CODE=1
        fi
    done
done

# send notification
echo
exit ${EXIT_CODE}