Posts

3 min read

setup external ETCD install docker, kubelet, and kubeadm Configure the kubelet to be a service manager for etcd Create configuration files for kubeadm /tmp/${HOST0}/kubeadmcfg.yaml apiVersion: "kubeadm.k8s.io/v1beta1" kind: ClusterConfiguration etcd: local: serverCertSANs: - "192.168.1.10" peerCertSANs: - "192.168.1.10" extraArgs: initial-cluster: infra0=https://192.168.1.10:2380 initial-cluster-state: new name: infra0 listen-peer-urls: https://192.168.1.10:2380 listen-client-urls: https://192.168.1.10:2379 advertise-client-urls: https://192.168.1.10:2379 initial-advertise-peer-urls: https://192.168.1.10:2380 Generate the certificate authority sudo kubeadm init phase certs etcd-ca export HOST0="192.168.1.10" sudo kubeadm init phase certs etcd-server --config=/tmp/${HOST0}/kubeadmcfg.
1 min read

tl;dr

uget https://osdn.net/projects/systemrescuecd/storage/releases/6.0.2/systemrescuecd-6.0.2.iso
sudo mount -t tmpfs  tmpfs /takeover/
sudo mount -o loop,ro -t iso9660 ~/systemrescuecd-6.0.2.iso /mnt/cd
cp -rf /mnt/cd/* /takeover/
curl -L https://www.busybox.net/downloads/binaries/1.26.2-defconfig-multiarch/busybox-x86_64 > busybox
chmod u+x /takeover/busybox
git clone https://github.com/marcan/takeover.sh.git
gcc takeover.sh/fakeinit.c -o ./fakeinit
3 min read

准备 docker pull istio/proxyv2:1.0.6 docker tag istio/proxyv2:1.0.6 gcr.io/istio-release/proxyv2:release-1.0-latest-daily docker push registry.cn-beijing.aliyuncs.com/co1/istio_proxyv2:1.0.6 docker pull istio/pilot:1.0.6 docker tag istio/pilot:1.0.6 gcr.io/istio-release/pilot:release-1.0-latest-daily docker pull istio/mixer:1.0.6 docker tag istio/mixer:1.0.6 gcr.io/istio-release/mixer:release-1.0-latest-daily docker pull istio/galley:1.0.6 docker tag istio/galley:1.0.6 gcr.io/istio-release/galley:release-1.0-latest-daily docker pull istio/citadel:1.0.6 docker tag istio/citadel:1.0.6 gcr.io/istio-release/citadel:release-1.0-latest-daily docker pull istio/sidecar_injector:1.0.6 docker tag istio/sidecar_injector:1.0.6 gcr.io/istio-release/sidecar_injector:release-1.0-latest-daily git clone https://github.com/istio/istio.git cd istio git checkout 1.0.6 -b 1.0.6 安装 Istio by default uses LoadBalancer service object types. Some platforms do not support LoadBalancer service objects.
1 min read

GITHUB两种主要的pull request的开发模式 分叉拉取模式 任何开发人员可以在项目源仓库(upstream)分叉，然后仓库该分叉(origin)到本地文件系统进行开发 测试，测试完毕提交到分叉origin，并发送pull request到源仓库upstream, 源仓库维护人员评审 更改，并最终决定是否合并该更改到源仓库 在发送pull request之前，好几个开发人员共同为一个特性协作开发， 互相从对方的仓库拉取代码。 这时，从对方的仓库拉取代码简化重新定义一个remote，该remote把本地的分叉指向对方仓库地址。 https://github.com/wubigo/wubigo.github.io 单击Fork按钮(右上角) GITHUB把该仓库代码复制到自己的github账号，建立分叉仓库 打开git命令行客户端，把分叉仓库克隆到本地环境 git clone https://github.com/$USER_NAME/wubigo.github.io.git cd wubigo.github.io git remote add upstream [email protected]:wubigo/wubigo.github.io.git # Never push to upstream master git remote set-url --push upstream no_push # Confirm that your remotes make sense: git remote -v origin https://github.com/Fuang/wubigo.github.io.git (fetch) origin https://github.com/Fuang/wubigo.github.io.git (push) upstream [email protected]:wubigo/wubigo.github.io.git (fetch) upstream [email protected]:wubigo/wubigo.github.io.git (push) 同步本地代码到upstream git fetch upstream git checkout master git rebase upstream/master git push 查看各个分支的最新提交ID
1 min read

准备 创建角色和授权 kubectl create clusterrolebinding "cluster-admin-faas" \ --clusterrole=cluster-admin \ --user="cluster-admin-faas" 分别为FAAS核心服务和函数创建名字空间 kubectl apply -f https://raw.githubusercontent.com/openfaas/faas-netes/master/namespaces.yml 创建凭证 # generate a random password PASSWORD=$(head -c 12 /dev/urandom | shasum| cut -d' ' -f1) kubectl -n openfaas create secret generic basic-auth \ --from-literal=basic-auth-user=admin \ --from-literal=basic-auth-password="$PASSWORD" 在本地helm仓库增加openfaas helm repo add openfaas https://openfaas.github.io/faas-netes/ "openfaas" has been added to your repositories 开始安装 helm repo update \ && helm upgrade openfaas --install openfaas/openfaas \ --namespace openfaas \ --set basic_auth=true \ --set functionNamespace=openfaas-fn 默认通过NodePorts方式访问openfaas控制台
0 min read

0 min read

1 min read

容器网络

容器网络方案 = 接入 + 流控 + 通道

docker默认的网络

桥接网络

Docker网络macvlan

网络macvlan

Docker宿主网络

宿主网络

Docker覆盖网络

宿主端口绑定

绑定方式： -p

绑定形式

ip:hostPort:containerPort| ip::containerPort
| hostPort:containerPort | containerPort

containerPort必须指定

docker run --rm --name web -p 80:80 -v /home/bigo/site:/usr/share/nginx/html:ro -d nginx:1.14-alpine

docker 会为端口绑定的容器自动启动docker-proxy进程

docker-proxy -proto tcp -host-ip 0.0.0.0 -host-port 80 -container-ip 172.17.0.2 -container-port 80
1 min read

Getting an SSL Certificate and CloudFront Create CloudFront Distribution Navigate to CloudFront in your AWS console and click “Create Distribution”. Click “Get Started” under the Web option (not the RTMP). You’ll arrive on the Create Distribution page. Here you need to change three things: 1. Click inside the input field for “Origin Domain Name”. A list of your Amazon S3 buckets should pop up. Select the S3 bucket you want to use.
2 min read

介绍 Macvlan支持从一个上层物理接口创建子接口，每个子接口有自己独立的MAC和IP地址。 应用程序，容器或虚机可以绑定到子接口，用子接口的IP和物理网络直接通信。 好处 现有的很多网络监控设备还不支持虚拟网络设备的监控，Macvlan支持 不需要新建iptable，nat，route单独管理容器网络 不足 交换机的每个端口上能连接的不同MAC有策略上限 网卡上过多的MAC会影响性能 Macvlan只支持LINUX 准备 需要4.0以上的内核 uname -r 4.15.0-45-generic 加载macvlan模块 sudo modprobe macvlan lsmod | grep macvlan ... macvlan 24576 0 ... 配置网卡为混杂模式 主机 IP PC 192.168.1.5/24 VM1 192.168.1.10/24 Container1 192.168.1.128/25 MACVLAN四种工作模式 Macvlan VEPA Macvlan Bridge Macvlan Passthru 创建macvlan ip addr show enp0s3 enp0s3: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UNKNOWN group default qlen 1000 link/ether 08:00:27:c0:91:4c brd ff:ff:ff:ff:ff:ff inet 192.
1 min read

How to allow unsafe ports in Chrome

http://douglastarr.com/how-to-allow-unsafe-ports-in-chrome

config

$ cat _config.yml
port: 6000

build for production

$rm site.tar (remove before build otherwise tar-self is repackaged too)
$JEKYLL_ENV=production bundle exec jekyll build
$tar zcvf site.tar _site/*

replace gem source mirror

gem sources --remove https://rubygems.org/
gem sources -a http://ruby.taobao.org/
gem sources -l
http://ruby.taobao.org/
1 min read

We can no longer assign a public IP address to your instance The auto-assign public IP address feature for this instance is disabled because you specified multiple network interfaces. Public IPs can only be assigned to instances with one network interface. To re-enable the auto-assign public IP address feature, please specify only the eth0 network interface. ip MAC=`curl http://169.254.169.254/latest/meta-data/mac` curl http://169.254.169.254/latest/meta-data/network/interfaces/macs/${MAC}/local-ipv4s 配置第二块网卡 ip a | grep ^[[:digit:]] tee -a /etc/network/interfaces.
0 min read

1 min read

Namecheap不支持根域(apex doamin/naked domain/bare domain)的ALIAS记录 在代码仓库的根目录创建CNAME文件 CNME文件包括根域域名 tee CNAME << EOF wubigo.com EOF 在DNS控制台创建域名记录 一条指向根域的A记录，一条指向子域的CNAME记录 AN A Record for @(apex doamin) and a cname record(Alias) for github 不要在github页使用通配符 dns 记录! 否则没有指定的子域将有被别人使用的风险 确认域名配置成功 dig www.wubigo.com +nostats +nocomments +nocmd ; <<>> DiG 9.10.3-P4-Ubuntu <<>> www.wubigo.com +nostats +nocomments +nocmd ;; global options: +cmd ;www.wubigo.com. IN A www.wubigo.com. 1 IN CNAME wubigo.github.io. wubigo.github.io. 3462 IN A 185.199.111.153 wubigo.github.io. 3462 IN A 185.199.110.153 wubigo.github.io. 3462 IN A 185.
1 min read IT

setup prometheus

  • prepare pv for prometheus

https://wubigo.com/post/2018-01-11-kubectlcheatsheet/#pvc–using-local-pv

  • install

    helm install --name prometheus1  stable/prometheus --set server.persistentVolume.storageClass=local-hdd,alertmanager.enabled=false
1 min read IT

/etc/default/locale

update-locale LANG=zh_CN.UTF-8
# File generated by update-locale
LANG="en_US.UTF-8"
LC_NUMERIC="zh_CN.UTF-8"
LC_TIME="zh_CN.UTF-8"
LC_MONETARY="zh_CN.UTF-8"
LC_PAPER="zh_CN.UTF-8"
LC_NAME="zh_CN.UTF-8"
LC_ADDRESS="zh_CN.UTF-8"
LC_TELEPHONE="zh_CN.UTF-8"
LC_MEASUREMENT="zh_CN.UTF-8"
LC_IDENTIFICATION="zh_CN.UTF-8"
LANGUAGE="zh_CN:en_US:en"
2 min read

Everything a containerized application writes to stdout and stderr is handled and redirected somewhere by a container engine. For example, the Docker container engine redirects those two streams to a logging driver The docker logs command is not available for drivers other than json-file and journald. docker-compose日志 docker-compose -f docker-compose-0.7.1.yml logs -f logging driver To configure the Docker daemon to default to a specific logging driver, set the value of log-driver to the name of the logging driver in the daemon.
9 min read

虚拟包版本 Untagged revisions can be referred to using a “pseudo-version” like v0.0.0-yyyymmddhhmmss-abcdefabcdef, where the time is the commit time in UTC and the final suffix is the prefix of the commit has go get github.com/vladimirvivien/go4vl@40b41ba go get: upgraded github.com/vladimirvivien/go4vl v0.0.1 => v0.0.2-0.20211216162907-40b41ba86c5c 类型转换操作 For every type T, there is a corresponding conversion operation T(x) that converts the value x to >type T. A conversion from one type to another is allowed if both have the same underlying type, or >if both are unnamed pointer types that point to variables of the same underlying type; these >conversions change the type but not the representation of the value.
1 min read

准备

1 min read

COOKIE & HTTP SESSION H5 addition that adds a key/value store to browsers and cookies stateful session Some examples of scaling stateful sessions: Once you run multiple backend processes on a server: A Redis daemon (on that server) for session storage. Once you run on multiple servers: A dedicated server running Redis just for session storage. Once you run on multiple servers, in multiple clusters: Sticky sessions. JWT session Stateless JWT: A JWT token that contains the session data, encoded directly into the token.