OpenStack: Neutron (network)

CLI
https://developer.openstack.org/firstapp-libcloud/networking.html

# search server by port ID
openstack port show -c device_id -f value ${PORT_ID}
openstack show show ${PORT_ID}
openstack router show ${PORT_ID}

Port
https://docs.openstack.org/python-openstackclient/latest/cli/command-objects/port.html

# get port ID for OVS interface
openstack port list -c id -f value | grep $(awk '{print substr($OVS_INTERFACE,4,8)}')

# list all port by subnet
openstack port list --fixed-ip subnet=mgmt-dev-net --sort-column Name

# list all devices by network
openstack port list --network mgmt-dev -c device_id -f value

# allow incomming (ingress) SSH for specific IP / subnet
openstack security group rule create default \
    --protocol tcp \
    --dst-port 22 \
    --remote-ip 10.20.30.40/32

# allow incomming http traffic
openstack security group rule create default --protocol tcp --dst-port 80

# create port without security
openstack port create openstack-net-port1 --network openstack-net --no-security-group --disable-port-security --no-fixed-ip
openstack port set --disable-port-security openstack-net-port1

# get all port by subnet
openstack port list -c ID -f value --fixed-ip subnet=dev-net1

# search ports (filter with json)
openstack port list -c ID -c "Fixed IP Addresses" -f json | jq -r '.[] | select(."Fixed IP Addresses"[].ip_address | startswith("10.11")).ID'

Creat and assign port

Install: tinyproxy 

sudo apt-get install -y tinyproxy

sed -i 's|#Allow 192.168.0.0/16|Allow 192.168.0.0/16|g' /etc/tinyproxy.conf
sed -i 's|Port 8888|Port 8080|g' /etc/tinyproxy.conf

Port 80
Allow 10.0.0.0/8

FilterExtended On
FilterURLs On
FilterDefaultDeny Yes
Filter "/etc/tinyproxy/whitelist"
#Filter "/etc/tinyproxy/filter"


service tinyproxy restart

KVM: Create Windows 7 VM

Virtio driver
#https://fedorapeople.org/groups/virt/virtio-win/deprecated-isos/stable/virtio-win-0.1-81.iso
https://fedorapeople.org/groups/virt/virtio-win/direct-downloads/archive-virtio/virtio-win-0.1.285-1/virtio-win-0.1.285.iso

Create VM

DISKIMG=win7.img
WIN7IMG=../iso/de_windows_7_professional_with_sp1_x64_dvd_u_676919.iso
VIRTIMG=../iso/virtio-win-0.1-81.iso

sudo qemu-system-x86_64 \
    --enable-kvm \
    -m 4096 \
    -smp cores=2 \
    -drive file=${DISKIMG},if=virtio \
    -net nic,model=virtio \
    -net user \
    -rtc base=localtime,clock=host \
    -usbdevice tablet \
    -soundhw ac97 \
    -cpu host \
    -vga std

    -vga qxl \

    -drive file=${VIRTIMG},index=3,media=cdrom \
    -cdrom ${WIN7IMG} \

    -vga vmware

Docker: HAProxy

Container
https://hub.docker.com/_/haproxy

Configuration
/tmp/haproxy/haproxy.cfg

global
  maxconn 4096
  #stats timeout 30s
  #debug

defaults
  log global
  mode http
  option httplog
  option dontlognull
  timeout connect 5000
  timeout client 50000
  timeout server 50000
  log 127.0.0.1 local0
  #option httpchk

frontend frontend1
  bind :80
  mode http
  use_backend backend1

backend backend1
  mode http
  balance roundrobin
  option httpchk GET / HTTP/1.1
  http-check expect status 400
  server www1 172.17.0.2:80 check
  server www2 172.17.0.4:80 check
  server www3 172.17.0.6:80 check

listen stats 
  bind :9000
  mode http
  stats enable
  stats hide-version
  stats realm Haproxy\ Statistics
  stats refresh 60s
  stats show-node
  stats auth haproxy:password
  stats uri /

Deploy

docker run -d --name haproxy -v /tmp/haproxy:/usr/local/etc/haproxy:ro -p 8080:80 -p 9000:9000 haproxy:latest
docker logs -f  haproxy

YouTube download and convert to mp3

https://yt-dl.org/update
https://github.com/ytdl-org/youtube-dl/releases

Installation
https://github.com/ytdl-org/youtube-dl#installation

wget -q https://yt-dl.org/downloads/latest/youtube-dl -O ~/.local/bin/youtube-dl
sudo chmod a+x ~/.local/bin/youtube-dl
# download audio (mp3) only
youtube-dl --extract-audio --audio-format mp3 -o "%(uploader)s/%(title)s.%(ext)s" https://www.youtube.com/watch?v=XXX

# download whole channel starting from 3 months
youtube-dl --extract-audio --audio-format mp3 -o "%(uploader)s/%(upload_date)s_%(title)s.%(ext)s" --dateafter now-3months -v https://www.youtube.com/user/OpenStackFoundation/videos

# update
sudo youtube-dl -U

# output template
https://github.com/ytdl-org/youtube-dl/blob/master/README.md#output-template

Install tftp server

Install tftp server package
sudo apt-get install -y xinetd tftpd tftp

Create xinetd tftp configuration

cat < /etc/xinetd.d/tftp
service tftp
{
protocol        = udp
port            = 69
socket_type     = dgram
wait            = yes
user            = nobody
server          = /usr/sbin/in.tftpd
server_args     = /tftpboot
disable         = no
}
EOF

Create /tftpboot folder

sudo mkdir /tftpboot
sudo chmod -R 777 /tftpboot
sudo chown -R nobody /tftpboot

Restart the xinetd service

sudo service xinetd restart

Testing our tftp server

ip a add 192.168.1.1/24 dev eth0:1
echo foo > /tftpboot/testfile
tftp 192.168.1.1
get testfile
quit

Links
https://askubuntu.com/questions/201505/how-do-i-install-and-run-a-tftp-server

OpenStack: VPNaaS (VPN) 

# show VPN objects
openstack vpn ipsec site connection list
openstack vpn endpoint group list
openstack vpn service list
openstack vpn ipsec policy list
openstack vpn ike policy list

# show IP
openstack vpn service list --long
openstack vpn service list -c ID -f value | xargs -i openstack vpn service show {}
openstack vpn ipsec site connection list -c ID -f value | xargs -L1 openstack vpn ipsec site connection show

Restart VPN

openstack vpn ipsec site connection set --disable vpn-conn1
openstack vpn ipsec site connection set --enable vpn-conn1

Check VPN peer address

PRIVATE_PEER_ADDRESSES=$(openstack vpn ipsec site connection list -c "Peer Address" -f value | egrep "^10.|^172.|^192.")
for PRIVATE_PEER_ADDRESSE in ${PRIVATE_PEER_ADDRESSES}; do
    echo "PRIVATE_PEER_ADDRESSES: ${PRIVATE_PEER_ADDRESSE}"

    CONNECTION_ID=$(openstack vpn ipsec site connection list | grep ${PRIVATE_PEER_ADDRESSE} | cut -d" " -f2)
    openstack vpn ipsec site connection show ${CONNECTION_ID}

    VPN_SERVICE_ID=$(openstack vpn ipsec site connection show ${CONNECTION_ID} -c "VPN Service" -f value)
    openstack vpn service show ${VPN_SERVICE_ID}

    PROJECT_ID=$(openstack vpn service show ${VPN_SERVICE_ID} -c project_id -f value)
    openstack project show ${PROJECT_ID}
done

OpenStack IpSec VPN ports

UDP 500
UDP 4500
ESP IP Protocol 50

IPSec VPN – Diffie-Hellman Groups

DH Group 1:    768-bit Key
DH Group 2:   1024-bit Key
DH Group 5:   1536-bit Key
DH Group 14:  2048-bit Key

Links
https://docs.openstack.org/neutron/rocky/admin/vpnaas-scenario.html

OpenStack: cinder (volume) 

# List your volumes
openstack volume list

openstack volume type list --public --long
openstack volume backend pool list
cinder --os-volume-api-version 3.50 attachment-delete 

openstack volume set --non-bootable

Search for multiple volume attachment ids

# search for double attachments
openstack volume list --all-projects -c ID -c "Attached to" | egrep "Attached.*Attached"

# search in DB
DB_PASS=$(grep nova_database_password /etc/kolla/passwords.yml | cut -d " " -f2)

mysql -h db.service.example.com --password=${DB_PASS} -P 3306 -u nova -D nova -e "
    select *
    FROM block_device_mapping
    where attachment_id in (
        SELECT attachment_id
        FROM block_device_mapping
        where attachment_id is not null
        and deleted = 0
        group by attachment_id
        having count(*) > 1
    )
"

# SQL
mysql -h db.service.example.com --password=${DB_PASS} -P 3306 -u nova -D nova -e "select * from block_device_mapping"  | grep 1234567890-1111-33333-a400-111111111111
mysql -h db.service.example.com --password=${DB_PASS} -P 3306 -u nova -D nova -e "select * from block_device_mapping where volume_id = '1234567890-1111-33333-a400-111111111111"

SELECT volume_id
FROM block_device_mapping
where volume_id is not null
and deleted = 0
group by volume_id
having count(*) > 1

(Force) delete volume

cinder reset-state --state available ${VOLUME_ID}
cinder reset-state --attach-status detached ${VOLUME_ID}
openstack volume delete ${VOLUME_ID}

Backup / Snapshot
https://docs.openstack.org/python-openstackclient/latest/cli/command-objects/volume-snapshot.html

OpenStack: rescue / recovery system

Download rescure iso
wget https://download.grml.org/grml64-small_2022.11.iso

Create rescure system

openstack image create systemrescuecd \
  --file grml64-small_2022.11.iso \
  --disk-format iso \
  --container-format bare \
  --min-ram 512 \
  --property hw_cdrom_bus=scsi

# show image
openstack image list --name systemrescuecd

Attach rescure system

openstack server rescue --image systemrescuecd ${SERVER_ID}

# Login to VM console and fix issues
Detach rescure system

openstack server unrescue ${SERVER_ID}

Links
https://help.switch.ch/engines/documentation/rescue-vm/
https://grml.org/