Skip to main content

Posts about docker

RSS feed

Kuberenetes NFS persistent volume

Comments

k8s_nfs_persistent_volume

Create nfs persistent volume:

What you need

  • NFS Server I have used NFS already installed on my QNAP NAS (You need to enable NO_ROOT_SQUASH on permissions)

  • K8s cluster

Now having your NFS share here 192.168.1.11/Persistentvolume/ you can try if it works with mount 

sudo mount -t nfs 192.168.1.11:/PersistentVolume /mnt/PersistentVolume

Later on you can secure access with password.

If everything works fine we need persistent volume on our cluster

persistentvolume.yml

apiVersion: v1
kind: PersistentVolume
metadata:
  name: pv0001
spec:
  capacity:
    storage: 100Gi
  accessModes:
  - ReadWriteMany
  mountOptions:
    - nfsvers=4.1
  nfs:
    path: /PersistentVolume/pv0001
    server: 192.168.1.11
  persistentVolumeReclaimPolicy: Retain

Apply above yaml to the cluster

kubectl apply -f persistentvolume.yml

Now we need to declare persistent volume claim

persistentvolumeclaim.yml

apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: mysql-pv-claim
spec:
  accessModes:
    - ReadWriteMany 
  resources:
    requests:
      storage: 10Gi

Apply

kubectl apply -f persistentvolumeclaim.yml

Check if it has been bound:

kubectl get pv

NAME     CAPACITY   ACCESS MODES   RECLAIM POLICY   STATUS   CLAIM                    STORAGECLASS   REASON   AGE
pv0001   100Gi      RWX            Retain           Bound    default/mysql-pv-claim                           2d4h

kubectl get pvc 
NAME              STATUS    VOLUME   CAPACITY   ACCESS MODES   STORAGECLASS   AGE
mysql-pv-claim    Bound     pv0001   100Gi      RWX                           2d4h

Build fully working zabbix server with database in seconds thanks to docker

Comments

To install zabbix server quickly zabbix comes with help as they have prebuild their product with docker images. There is lots of official zabbix images on dockerhub so it can just overwhelm you. There are mixes of all different possibilities like zabbix with mysql or postgres or either sqlite, zabbix served bt nginx or apache or java gateway. Depending on stack which is closest to you you can easily build docker-compose that will just run selected stack in seconds. My pick was nginx mysql so to set up fully running zabbix server we need 3 images

  • mysql-server

  • zabbix-web - web interface

  • zabbix-server - main zabbix process responsible for polling and trapping data and sending notifications to users.

In addition you can add postfix mail server for notifying users but its not a must as you can use your own mail server if so - just remove postfix service from example below.

Notice(you may want to use some specific versions or alpine versions for production env)

Create some directory (directory name is crucial here for visibility and future maitenance of your containers and volumes or networks as the name will be used as prefix for docker containers created by docker-compose and also volumes directories so it will be easier to identify in future which volume belongs to which stack In Ubuntu volumes are usually being kept in/var/lib/docker/volumes but you can mount any directory from host by just specifying absolute or relative path in service configuration so for instance for mysql in example to mount mysql_data_dir just outside of our containers folder

volumes:
  - '../mysql_data_dir:/var/lib/mysql'

Now within directory create docker-compose.yml with selected technologies in my case it is: #docker-compose.yml

version: '3'

services:
  db:
    image: mysql:latest
    restart: always
    expose:
      - '3336'
    environment:
      MYSQL_ROOT_PASSWORD: 'my_secret_password'
      MYSQL_USER: 'zabbixuser'
      MYSQL_PASSWORD: 'zabbix_password'
      MYSQL_ROOT_HOST: '%'
    volumes:
      - 'mysql_data_dir:/var/lib/mysql'


  zabbix-server:
    image: zabbix/zabbix-server-mysql
    links:
      - "db:mysql"
      - "postfix:postfix"
    environment:
      MYSQL_ROOT_PASSWORD: 'my_secret_password'
      MYSQL_USER: 'zabbixuser'
      MYSQL_PASSWORD: 'zabbixpassassword'
      DB_SERVER_HOST: 'mysql'


  zabbix-web:
    image: zabbix/zabbix-web-nginx-mysql
    ports:
      - '7777:80'
    links:
      - "db:mysql"
      - "zabbix-server:zabbix-server"
      - "postfix:postfix"
    environment:
      MYSQL_ROOT_PASSWORD: 'my_secret_password'
      MYSQL_USER: 'zabbixuser'
      MYSQL_PASSWORD: 'zabbixpassassword'
      DB_SERVER_HOST: 'mysql'
      ZBX_SERVER_HOST: "zabbix-server"
      PHP_TZ: "Europe/London"
  postfix:
    image: catatnight/postfix
    hostname: support
    environment:
      - maildomain=mydomain.com
      - smtp_user=admin:my_password
    ports:
      - "25:25"
    expose:
      - "25"
    volumes:
      - /etc/nginx/ssl/postfix:/etc/postfix/certs
      - /etc/nginx/ssl/postfix:/etc/opendkim/domainkeys
volumes:
  mysql_data_dir:
    driver: local

The above solution is just enough to start zabbix server up and running in couple seconds. To do it just run: .. code-block:: bash

sudo docker-compose up

Thats it!!! You now have your zabbix running on port 7777

So what happened here docker-compose up has build and runned 3 containers by running zabbix container it discovered there are no tables in mysql and has built them.

Now you just need to add agents/servers you want to monitor. Check out adding agent in separate post

Versions: (versions I've used in this example Feb 2018):

Docker-compose: 1.17.0, build ac53b73 Docker: 17.09.1-ce, build 19e2cf6 Kernel: 4.13.0-36-generic System: Ubuntu 16.04.3 LTS

Adding zabbix agent to server

Comments

Zabbix is very powerfull tool which its using agents (or SNMP) to monitor server resources. Adding agent is easy but I had couple problems doing that when I used agent straight from my ubuntus (16.04.3) repo as there was no encryption functionality in this agent well I guess so as agent didn't recognize tls psk configuration so not very nice as by installing agent straight form repo with "sudo apt-get update && sudo apt-get install zabbix-agent" I had limited functionality and unencrypted server-agent traffic. So there are 2 options we can install zabbix agent or use zabbix agent docker container. Adding zabbix agent to host system. For current day 3.2 is the latest so please change latest accordingly of how this artcile is old. wget http://repo.zabbix.com/zabbix/3.2/ubuntu/pool/main/z/zabbix-release/zabbix-release_3.2-1+xenial_all.deb sudo dpkg -i zabbix-release_3.2-1+xenial_all.deb sudo apt-get update apt-get purge zabbix-agent #remove previous if installed apt-get install zabbix-agent

Now there are 3 basic options that need to be changed in agent config file: /etc/zabbix/zabbix_agentd.conf

Server=ip of zabbix server ServerActive=ip of zabbix server Hostname=My host name

sudo service zabbix-agent restart

Add host to server through web interface:

In server go to Configuration-> Hosts -> Create host type in host name visible name public IP address opf your agent.Select group and add agent. Next is to select templates so add services you need to monitor (here linux + mysql : Template DB MySQL, Template OS Linux) after saving you should see green ZBX available label on Hosts screen Notice : I couldnt see zbx agent green icon until I added linux template / or zabbix agent template.

Seurity - Setting up PSK encryption:

sh -c "openssl rand -hex 32 > /etc/zabbix/zabbix_agentd.psk" Now add below lines to /etc/zabbix/zabbix_agentd.conf TLSConnect=psk TLSAccept=psk #each identity id must be different for each serverr connected to one zabbix server TLSPSKIdentity=PSK SOMETHING TLSPSKFile=/etc/zabbix/zabbix_agentd.psk sudo service zabbix-agent restart Get generated key string: cat /etc/zabbix/zabbix_agentd.psk and add encryption in zabbix server web interface : In server go to Configuration-> Hosts -> my host->encryption

Select: Connections to host PSK connections from host PSK PSK identity: PSK SOMETHING (same as in zabbixagent config file) PSK: the hash generated (content of /etc/zabbix/zabbix_agentd.psk file on agent ) now there should be greebn psk lablel and all our traffice will be encrypted

Adding mysql monitoring option:

add user credentials for mysqlclient on agent server: mysql > grant all privileges on . to zabbix@'%' identified by 'zabbixuserpassword'; use localhost or host you will be accessing mysql from % is just for test purpose to eliminate authentication problems.

Out of the topic - something about mysql remote connections and security: My best practice is not to have any remote access like @'%' to mysql on any server I manage its just dangerous and anyone can try bruteforcing and try to connect to our mysql server. Another way I saw in many places if admin creates @'%' accesses they use it without any encryption so there is plain text traffic comming from mysql-server/postgres straight to users computer which is not good (MITM etc). The best would be to have your mysql server set up with ssl certificate but its not popular practice as may be time consuming for setting up and for connecting to such server (preatty easu in mysql-workbench). Faster way to encrypt your mysql confidential data traffic is to use ssh tunnel but there is a limitation here user that needs access to mysql data needs to have ssh access to the server if this is an option just define users with localhost as source like my_db_user@localhost this is safer as you cant guarantee mysql users competence so best practice is to prevent having '%', to double secure this method do not to expose 3306 to the public and only allow localhost(unix socket) and 127.0.0.1 (remember mysqlclient unixsocket/ ip connection) to be able to connect through this port. In dockerized mysql instances when I need it to be visible I just do ports config like 127.0.0.0:3306:3306 then it will be visible to host machine only. but if user wont have ssh access to the server then only option you have is using ssl cert. So remember having user@'%' or even user@'some_ip' you still without ssl or ssh the traffic from mysql-server is still unencrypted.

Ok comming back to mysql monitoring config: add client to my.cnf in /etc/mysql or to /etc/mysql/conf.d/mysql.cnf

[client] user = zabbix password = zabbixuserpassword port = 3326 host = 127.0.0.1

add myu.cnf

mkdir -p /var/lib/zabbix/ cd /var/lib/zabbix ln -sv /etc/mysql/my.cnf

service zabbix-agent restart

Now you can add mysql template items in zabbix server .

select linux templates to see agent visibility

bug in default userparameter_mysql agent file

cat /etc/zabbix/zabbix_agentd.d/userparameter_mysql.conf redirect error to stdout to grep later

UserParameter=mysql.ping,HOME=/var/lib/zabbix mysqladmin ping 2>&1 | grep -c alive previously was UserParameter=mysql.ping,HOME=/var/lib/zabbix mysqladmin ping | grep -c alive so grep didnt work

Write your post here.

docker

Comments

First download download pre build image :

sudo docker pull ubuntu

run pseudo tty:

sudo docker run -t -i ubuntu /bin/bash

get image of running docker:

sudo docker ps

output: ➜ ~ sudo docker ps CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES c4fbc80d8926 ubuntu:14.04 /bin/bash 3 minutes ago Up 3 minutes berserk_nobel ➜ ~ save container as your image: ============================= sudo docker commit c4fbc80d8926 myimage_name

Running our image:

sudo docker run -t -i myimage_name /bin/bash

Deploying your app and dependicies:

watch out to save container before you quit bash inside docker instance find container id and save

Diff image container:

sudo docker diff

Start docker container with name:

sudo docker run -i -t --name="IWAPPS2" iwapps /bin/bash

Commit with name :

sudo docker commit IWAPPS2 local -a "greg" -m "First image commit"

Actually, images are stored within /var/lib/docker/aufs/diff

OUP sudo docker ps CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES 95585eb7ea3c cc68531a3552 /bin/bash About a minute ago Up About a minute mad_ptolemy ➜ OUP sudo docker commit 95585eb7ea3c iwps2 -a "greg" -m "First image commit" c86eeb858bedf779105f759ca62d10ea59e01884e985e447d9ddf7f65ee32e3c ➜ OUP sudo docker images REPOSITORY TAG IMAGE ID CREATED VIRTUAL SIZE iwps2 latest c86eeb858bed 5 seconds ago 617.5 MB local latest 539a99ee88ee 22 minutes ago 348.5 MB <none> <none> d8f374aecae4 2 hours ago 348.1 MB iwapps latest 85e0ae955062 4 hours ago 348.1 MB ubuntu utopic b8d67033ed07 23 hours ago 286.6 MB ubuntu 14.10 b8d67033ed07 23 hours ago 286.6 MB ubuntu trusty 1357f421be38 23 hours ago 192.7 MB ubuntu latest 1357f421be38 23 hours ago 192.7 MB ubuntu 14.04 1357f421be38 23 hours ago 192.7 MB ubuntu 14.04.1 1357f421be38 23 hours ago 192.7 MB ubuntu 12.04 2bed76595591 23 hours ago 120.2 MB ubuntu 12.04.5 2bed76595591 23 hours ago 120.2 MB ubuntu precise 2bed76595591 23 hours ago 120.2 MB <none> <none> 96864a7d2df3 3 weeks ago 205.1 MB ubuntu 12.10 c5881f11ded9 3 months ago 172.2 MB ubuntu quantal c5881f11ded9 3 months ago 172.2 MB ubuntu raring 463ff6be4238 3 months ago 169.4 MB ubuntu 13.04 463ff6be4238 3 months ago 169.4 MB ubuntu saucy 195eb90b5349 3 months ago 184.7 MB ubuntu 13.10 195eb90b5349 3 months ago 184.7 MB ubun

pt The images are stored in /var/lib/docker/graph/<id>/layer.

Note that images are just diffs from the parent image. The parent ID is stored with the image's metadata /var/lib/docker/graph/<id>/json.

When you docker run an image. AUFS will 'merge' all layers into one usable file system.

docker inspect docker images --no-trunc=true

Running an interactive shell sudo docker run -i -t ubuntu /bin/bash

sudo baobab /var/lib/docker

docker pull ubuntu docker run -i -t ubuntu:14.04 /bin/bash sudo docker info sudo docker version sudo docker search ubuntu sudo docker pull ubuntu sudo docker images