Home | panticz.de

OpenStack: User

CLI

# change user password
openstack user set --password pass123 user1

# list user (for domain)
openstack --os-cloud=dev-admin user list --domain my_dom_1

openstack user list
openstack user show USER_ID
openstack domain show DOMAIN_ID
openstack project list --user USER_ID

Role

# list
openstack role assignment list --names --user ${USER_ID}

# add
openstack role add --user ${USER_ID} --project ${PROJECT_ID} creator

# remove
openstack role remove --user ${USER_ID} --project ${PROJECT_ID} admin

Get unpriviliged user ID

# get unpriviliged user project ID
openstack project list -c id -f value

# as admin
openstack user list --project ${PROJECT_ID}

roles

# show user roles
MGMT_USER_ID=b912ba4325fbb6c18483602245f9b515b
openstack role assignment list --user ${MGMT_USER_ID} --names

LXD: Migrate / copy / move container to remote host

Configure LXD

# old server (lxd-old.example.com, 10.0.0.11)
lxc config set core.https_address 10.0.0.11:8443
lxc config set core.trust_password ${MY_PASS}

# new server (lxd-new.example.com, 10.0.0.22)
lxc remote add lxd-old.example.com 10.0.0.11:8443
#lxc config set core.https_address 10.0.0.22:8443
#lxc config set core.trust_password pass1234

Migrate profile

PROFILE=nic-dev-mgmt
lxc profile copy ${REMODE_LXD_NODE}:${PROFILE} ${PROFILE}

Migrate container

# @ new LXD node
REMODE_LXD_NODE=lxd-old.example.com
CONTAINER=container1

# list container on remote host
lxc ls ${REMODE_LXD_NODE}:

lxc stop ${REMODE_LXD_NODE}:${CONTAINER}
lxc copy ${REMODE_LXD_NODE}:${CONTAINER}
#lxc start ${REMODE_LXD_NODE}:${CONTAINER}
lxc start ${CONTAINER}

# start new container
lxc start ${CONTAINER}
lxc shell ${CONTAINER}

# OPTIONAL: disable autostart on old container
lxc config set ${OLD_LXD_NODE}:${CONTAINER} boot.autostart false

# @ old LXD node
CONTAINER=www
#lxc config show ${CONTAINER}

lxc config set ${CONTAINER} boot.autostart false
lxc stop ${CONTAINER}

# copy whole container
lxc copy lxd-old.example.com:${CONTAINER} ${CONTAINER} --verbose

# move only snapshot (copy container)
# lxc snapshot ${CONTAINER}
# lxc move ${CONTAINER}/snap0 lxd2.example.com:${CONTAINER} --verbose

# @ new server
CONTAINER=www
#lxc config set ${CONTAINER} volatile.eth0.hwaddr 00:11:22:33:44:70
lxc start ${CONTAINER}

Debug

OpenStack: Extend public IP range

Show subnet details

openstack subnet list --network public
openstack subnet show public-10.0.0.0/24

Modify database

DB_PASS=$(grep neutron_database_password /etc/kolla/passwords.yml | cut -d " " -f2)
mysql -h db.service.example.com --password=${DB_PASS} -P 6033 -u neutron -D neutron
select * from neutron.subnets where cidr like '10.0.0%';
update subnets set cidr='10.0.0.0/23' WHERE cidr = '10.0.0.0/24';
exit;

# update subnet name
openstack subnet set --name public-10.0.0.0/23 public-10.0.0.0/24

# extend allocation-pool
openstack subnet set --allocation-pool start=10.0.0.255,end=10.0.1.254 public-10.0.0.0/23

# show subnet details
openstack subnet show public-10.0.0.0/23

Restart network agent

Mellanox: automatic firmware update

Auto / Online firmware update
# Search latest mlxup version
http://www.mellanox.com/page/mlxup_firmware_tool

URL=https://www.mellanox.com/downloads/firmware/mlxup/4.26.0/SFX/linux_x64/mlxup

# Download mlxup
wget ${URL} -qO /tmp/mlxup
chmod +x /tmp/mlxup

# auto flash all Mellanox network cards
/tmp/mlxup -y

Manual firware update

Download firmware
http://www.mellanox.com/supportdownloader/

mst start

# get card description
flint -d /dev/mst/mt4103_pci_cr0 dc | grep Desc

for MST in $(mst status | grep "mst" | cut -d" " -f1); do
    flint -d ${MST} query #| egrep "FW Version|UEFI|PSID"
    echo
done

wget http://www.mellanox.com/downloads/firmware/fw-ConnectX3-rel-2_34_5000-MCX311A-XCA_Ax-FlexBoot-3.4.521.bin.zip -P /tmp
apt-get install -y unzip
unzip /tmp/fw-ConnectX3-rel-*-MCX312A-XCB_A2-A6-FlexBoot-*.bin.zip -d /tmp/

Update firmware

for MST in $(ls /dev/mst/mt*_pci_cr*); do
    echo ${MST}
    flint -y -d ${MST} -i /tmp/fw-ConnectX3Pro-rel-2_42_5000-MCX312B-XCC_Ax-FlexBoot-3.4.752-UEFI-14.11.46.bin b
done

Hot reload firmware (without reboot)
https://docs.mellanox.com/pages/viewpage.action?pageId=25137354

#mlxfwreset -d /dev/mst/mt4117_pciconf0 query
mlxfwreset -d /dev/mst/mt4117_pciconf0 reset

# show firmware version
for MST in $(mst status | grep "mst" | cut -d" " -f1); do     flint -d ${MST} query | egrep "FW Version"; done

Links
http://www.mellanox.com/supportdownloader/
http://www.mellanox.com/page/firmware_table_ConnectX3EN

OpenStack: server (VM)

Get VM data

openstack server show -c name -c id -c addresses -c OS-EXT-SRV-ATTR:host ${SERVER_ID}
nova interface-list ${SERVER_ID}
nova migration-list --instance-uuid ${SERVER_ID} | grep -v "2019-"

Create VM
https://docs.openstack.org/python-openstackclient/latest/cli/command-objects/server.html#server-create

openstack server create u2204-vm1 \
  --image "Ubuntu 22.04" \
  --flavor m1.small \
  --key-name foo-key \
  --network foo-net \
  --security-group default \
  --availability-zone=eu1-az1

CLI

Nginx: Log client ip behind NAT with http_x_forwarded_for (X-Forwarded-For Header)

Use nginx real_ip module

nginx -V | grep with-http_realip_module

# /etc/nginx/nginx.conf
...
http {
    ...
    # set_real_ip_from 0.0.0.0/0;
    set_real_ip_from x.x.x.x/x; # LB subnet
    real_ip_header X-Forwarded-For;
    ...
}
...

Option 2: customize log_format

cat /etc/nginx/nginx.conf
...
log_format  main  '$http_x_forwarded_for - $remote_user [$time_local] "$request" $status $body_bytes_sent "$http_referer" "$http_user_agent"';
access_log /var/log/nginx/access.log main;
...

Reload Nginx configuration

service nginx reload

Links
http://www.loadbalancer.org/blog/nginx-and-x-forwarded-for-header/
https://serverfault.com/questions/729128/overriding-nginx-access-log-directive-duplicate-log-entries
http://nginx.org/en/docs/http/ngx_http_log_module.html
https://www.nginx.com/resources/wiki/start/topics/examples/full/

Fix Octavia / Amphora VMs

List Amphora VMs

openstack server list --project service

Fix broken/out Amphora VMs / Ports
http://eavesdrop.openstack.org/irclogs/%23openstack-lbaas/%23openstack-lbaas.2019-05-17.log.html

OpenStack: flavor

List all flavors

openstack flavor list --sort-column Name --all

Formated output

for FLAVOR in $(openstack flavor list --sort-column Name -c Name -f value); do
    echo ${FLAVOR}
    openstack flavor show ${FLAVOR}
    echo
done

Delete all flavors

openstack flavor list --all -c ID -f value | xargs openstack flavor delete

Resize / switch flavor
https://docs.openstack.org/mitaka/user-guide/cli_change_the_size_of_your_server.html

nova resize ${SERVER_ID} 4

nova resize-confirm ${SERVER_ID}
# or
nova resize-revert ${SERVER_ID}

OpenStack: Allow user access to tanent projects

Get mgmt user data

USER_ID=$(openstack user list -c ID -c Name -f value | grep ${OS_USERNAME} | cut -d" " -f1)
echo ${USER_ID}

# grep project ID by VM
openstack server show -c project_id -f value ${SERVER_ID}

# get projects
openstack project list --long | grep safyievOokEgavUtdytPeurmebKowEff

# get assignments
openstack role assignment list --user JekUvyeijHaDrithWianvestUtevLiUk --project e72c94c20b4d40e3b971bc510d536e87 --names

# get Domain name
openstack domain list | grep safyievOokEgavUtdytPeurmebKowEff

Search tanent data

# get user domain ID
openstack domain list | grep yrgsonova

# get user id
openstack user list --long  | grep 6dac5139fa41465e89766746cec640e4

# get project id
openstack project list --long | grep 6dac5139fa41465e89766746cec640e4

# get assignments
openstack role assignment list --user 0749e19d1af349509c7941fd2d60a358  --project odWejBicHajIvtakeytPiUsGeJajyood --names

Add user to tanent project

USER_ID=x0a10xb0aafa4e8aax50caa04b0afxb0
PROJECT_ID=2435bbb1ec5d40b08254ce11382b178d

ROLES="
creator
heat_stack_owner
load-balancer_member
member
_member_
"

for ROLE in ${ROLES}; do
    openstack role add --user ${USER_ID} --project ${PROJECT_ID} ${ROLE}
done

# list existing role
openstack role assignment list --user ${USER_ID} --project ${PROJECT_ID} --names

Remove user access from tanent project

kubectl - Kubernetes CLI client

Client

sudo apt-get update
sudo apt-get install -y apt-transport-https
curl -s https://packages.cloud.google.com/apt/doc/apt-key.gpg | sudo apt-key add -
echo "deb https://apt.kubernetes.io/ kubernetes-xenial main" | sudo tee -a /etc/apt/sources.list.d/kubernetes.list
sudo apt-get update
sudo apt-get install -y kubectl kubeadm

Bash completion

kubectl completion bash | sudo tee /etc/bash_completion.d/kubectl

Manual installation

curl -LO https://storage.googleapis.com/kubernetes-release/release/$(curl -s https://storage.googleapis.com/kubernetes-release/release/stable.txt)/bin/linux/amd64/kubectl
chmod +x ./kubectl
sudo mv ./kubectl /usr/local/bin/kubectl

Test

kubectl get nodes -o wide
kubectl get all --insecure-skip-tls-verify

kubectl-commands
https://kubernetes.io/docs/reference/generated/kubectl/kubectl-commands

Links
https://kubernetes.io/docs/tasks/tools/install-kubectl/
https://kubernetes.io/docs/reference/setup-tools/kubeadm/kubeadm-init/