Cluster-IT

Tips, musings and linux *spits*

[thetroyfontaine]

KVM/Ansible/Docker/HAProxy Project

It's been a while-I know! So, I've made plenty of progress on my KVM hosted VM cluster project. I have set up (currently) 6 VMs (or "domains" in KVM parlance) running on a Core2Quad with 8GB of RAM. I love that I can overcommit resources with impunity-this is perfect for a lab environment. After spending weeks of what free time I could muster-I got Ubuntu cloud images to run with cloud-configs on .IMG files for automatic set up, I templated the VMs so that my router could automatically assign static IPs to each VM. All using bash scripting and pre-built KVM XML files to get a handle on things. Next came Ansible, with that I've completed the set up of my Ansible VM that will manage the pile of VMs on the server. I have also scripted in Ansible the foundation playbook for relaunching the entire cluster-which was previously written in bash. I still need to write the Jinja2 template for the VMs though-using a shell command to side step that need for now. So today I've got the updating of the VMs without tear down (destroying the VMs and rebuilding from a fresh image-I built this complete option in Bash-including the pull of the most recent image from Ubuntu's servers) scripted. I'm now at the point where I have to step back and get the security figured out. I have to firewall the host server and all the VMs-and also look at moving the switch that the server and Raspberry Pi farm are plugged into behind a router... I may also look at an intrusion detection server in the group in addition to my planned ELK server... I really wish Shaw hadn't done away with the two dynamic IPs you used to get on Residential Internet... #firstworldproblems

[thetroyfontaine]

Windows Wonders: Hyper-V without the domain

Today I finally found the time to try once again to get a HyperVisor system up and running on a dedicated machine. Woo Hoo!  A few things to note: No domain (haven’t gotten there yet!); No DNS server (well, obviously); Not enough cowbell!

A few things discovered along the way while making my hand-me-down parts do the server cha-cha-cha:

1) Certain ASUS motherboards don’t allow you to use configure the boot order to use multiple “HDDs” (you can’t choose a USB stick as a separate boot option as it shows up as a hard drive) it is a single option of HDD, Removable Devices and Optical Drive.  This presents an issue for installing Hyper-V Server-the installer will flat out refuse to do anything to the drive beyond letting you delete or add partitions-it will not install the OS because it says it cannot make changes to the drive.  Solution: Tap the F8 key during POST to get the boot device options dialog and choose your USB device this way instead to get past this hurdle.

2) Hyper-V Server 2016 requires SLAT support to even run the HyperVisor.  The Core 2 Quad I’m trying to use obviously does not have that feature *sadface*  Hyper-V Server 2012 R2 however does not require SLAT unless you are running a client OS.  I do not plan on it.  Awesome possum.

3) To connect a non-domain joined Windows client to a non-domain joined Hyper-V server, you must do the following: 

A) Ensure you’ve turned the firewall off on your Hyper-V server (this is a test lab, right?) you can do this from the Hyper-V Server using the command prompt and entering the following command: NetSh Advfirewall set allprofiles state off 

B) On the client, enter the following command at an elevated PowerShell prompt: winrm s winrm/config/client '@{TrustedHosts="RemoteComputerName"}' 

C) Install RSAT on your client 

D) From the Server Manager, add the Hyper-V Server (you will have to specify different credentials to talk to it! 

E) Add the Hyper-V Manager to Windows via the Add or Remove Windows Features panel

F) Download hvremote and save it on your client stations somewhere you can conveniently open it from a command prompt.

G) Open the command prompt as an administrator, navigate to where you saved hvremote and execute the following command:

 Windows 7 - 8.1: hvremote /anondcom:grant

Windows 10: cscript hvremote.wsf /anondcom:grant /override

F) FINALLY!  Open the Server Manager, right click on the Hyper-V server and choose Hyper-V Manager and then connect to the server-do NOT specify credentials.  BAM!  Done

Now I only need to wait on the updates to install before I can reboot and hope that fixes the problem with the RPC error the Hyper-V Manager is giving me on my client :P

Once this is all working, I’ll be building a closer to reality VM network based on AMD64 compatible Ubuntu VMs to run Docker and Docker Swarm.  My poor little Pis don’t have Docker 1.8 yet and ETCD doesn’t even run on 32-bit hardware without some more under the hood diving that I just don’t have the patience for right now.

Happy Computing!

[thetroyfontaine]

Mac Musings: Ansible system passwords or salted peanuts

In the last 2 months I’ve been using what free time I can spare (and some I can’t) to learn Ansible as I want in on the whole DevOps/Infrastructure as Code craze.  I’m using a Mac as my Ansible host platform and targeting my Raspberry Pi 2 systems.

One of the stumbling blocks I encountered was the requirements for passing passwords from a playbook to a managed system in an encrypted hashed form.  The instructions I first found weren’t ideal:

Fiddling with it I found some odd behaviour with the salting:

python -c 'import crypt; print crypt.crypt("yWLE8D46VukpgjXnWL4JYuiyePB’", "salty")' 

gives the same results as:

python -c 'import crypt; print crypt.crypt("yWLE8D46VukpgjXnWL4JYuiyePB’", "sa")'

So then I came upon an example using OpenSSL which worked beautifully:

openssl passwd -1 -salt ca yWLE8D46VukpgjXnWL4JYuiyePB

This would spit out the exact format for the password that Ansible needed and was much easier to work with.

Breaking it down-the salt in the example is only “ca” but can be up to 8 characters.  The password meanwhile is “yWLE8D46VukpgjXnWL4JYuiyePB” and is limited to 30 characters at most before spitting our errors.  I’ve used this method and it works like a charm to drop the output straight into the playbook or passed to a playbook via an encrypted variable.

Alternatively, following the instructions on Ansible’s FAQ, you need to:

-First install PIP

sudo easy_install pip

Install Python Passlib

sudo pip install passlib

Then run the following command:

python -c "from passlib.hash import sha512_crypt; import getpass; print sha512_crypt.encrypt(getpass.getpass())"

Then enter the password into the prompt.

I haven’t tested the output of this command to know whether it does work in a playbook as it is-but it is in the official FAQ.

Now I have a craving for those Picards cookie nuts...

[thetroyfontaine]

New Blog

So, yes, this is a new blog! Yes, it isn't WordPress! What am I doing? I figured this is probably the better way to share my findings compared to an obscure blog hosted on some server where I'm not sure anyone will benefit (or miss out on some of my ramblings). I will do my very best to keep this: a) technical b) not too serious (Office tradition: say "Ubuntu" *spits*) see what I did there? c) leave the extent of electronic under garments to the blog title only. Enjoy!

[thetroyfontaine]

Mac Musings: Code Editing!

So I downloaded GitHub desktop for Mac today.  I finally did some fiddling around with it to get a bit more familiar and found that trying to open Dockerfile files that are without extensions only open in Text Edit.  I prefer Sublime Text, so I started trying the normal methods of associating a file with an application.  This ended poorly.  After some annoyance and googling I found a quick fix to open files without file extensions in your preferred editor! 

Step 1) Download RCDefaultApp 

Step 2) Install it using the instructions in the readme file 

Step 3) Open System Preferences -> Default Apps 

Step 4) Click on Extensions, scroll to Text and then in the Default Application drop down, click on "Other..." then navigate to your apps folder and choose Sublime Text (or your preferred editor)

That's it! Now you can open files (via the Open in external editor right click menu) without extensions in Sublime Text directly from GitHub for Mac