ArtemLeave a comment on GKE – Issuer DNS01GCP

GKE – Issuer DNS01

 

GCP will be the DNS provider.

 

YOUR_GCP_PROJECT – Replace with the name of your GCP project

 

Create an account:

gcloud iam service-accounts create dns01-solver \
 --display-name "dns01-solver"

 

We give him access to the DNS service:

gcloud projects add-iam-policy-binding YOUR_GCP_PROJECT \
 --member serviceAccount:dns01-solver@YOUR_GCP_PROJECT.iam.gserviceaccount.com \
 --role roles/dns.

 

We generate the key:

gcloud iam service-accounts keys create key.json \
 --iam-account dns01-solver@YOUR_GCP_PROJECT.iam.gserviceaccount.com

 

Create a secret based on the generated key:

kubectl create secret generic clouddns-dns01-solver-svc-acct -n cert-manager \
 --from-file=key.json

 

Create 2 YAML files for ClusterIssuer.

 

letsencrypt-staging.yml

apiVersion: certmanager.k8s.io/v1alpha1
kind: ClusterIssuer
metadata:
  name: letsencrypt-staging
spec:
  acme:
    # The ACME server URL
    server: https://acme-staging-v02.api.letsencrypt.org/directory
    # Email address used for ACME registration
    email: [email protected]
    # Name of a secret used to store the ACME account private key
    privateKeySecretRef:
      name: letsencrypt-staging
    solvers:
    - dns01:
        clouddns:
          # The ID of the GCP project
          project: YOUR_GCP_PROJECT
          # This is the secret used to access the service account
          serviceAccountSecretRef:
            name: clouddns-dns01-solver-svc-acct
            key: key.json

 

letsencrypt-production.yml

apiVersion: certmanager.k8s.io/v1alpha1
kind: ClusterIssuer
metadata:
  name: letsencrypt-production
  namespace: cert-manager
spec:
  acme:
    server: https://acme-v02.api.letsencrypt.org/directory
    # This will register an issuer with LetsEncrypt.  Replace
    # with your admin email address.
    email: [email protected]
    privateKeySecretRef:
      # Set privateKeySecretRef to any unused secret name.
      name: letsencrypt-production
    dns01:
      providers:
      - name: dns
        clouddns:
          # Set this to your GCP project-id
          project: YOUR_GCP_PROJECT
          # Set this to the secret that we publish our service account key
          # in the previous step.
          serviceAccountSecretRef:
            name: clouddns-dns01-solver-svc-acct
            key: key.json

 

Do not forget to specify the name of your GCP project and mailbox.

 

Create a ClusterIssuer:

kubectl create -f letsencrypt-staging.yml
kubectl create -f letsencrypt-production.yml

 

 

Ingress example:

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  annotations:
    kubernetes.io/ingress.class: nginx
    certmanager.k8s.io/cluster-issuer: letsencrypt-production
    certmanager.k8s.io/acme-challenge-type: dns01
    certmanager.k8s.io/acme-dns01-provider: dns
  name: artem-service-ing
  namespace: staging
spec:
  tls:
  - hosts:
    - artem.services
    secretName: artem.services-tls
  rules:
  - host: artem.services
    http:
      paths:
      - path: /
        backend:
          serviceName: artem-services-svc
          servicePort: 80

 

artem-services-svc – service name
80 – service port

ArtemLeave a comment on GKE – Installation of Cert Manager using HELMGCP

GKE – Installation of Cert Manager using HELM

Installation instructions can be found here.

 

Run:

kubectl apply -f https://raw.githubusercontent.com/jetstack/cert-manager/release-0.8/deploy

kubectl label namespace cert-manager certmanager.k8s.io/disable-validation="true"

 

If there is no namespace, then create it.

 

Add the HELM repository and update:

helm repo add jetstack https://charts.jetstack.io

helm repo update

 

Install Cert Manager using HELM:

helm install \
  --name cert-manager \
  --namespace cert-manager \
  --version v0.8.1 \
  jetstack/cert-manager
ArtemLeave a comment on Linux – Restoring standard file and directory permissionBASH

Linux – Restoring standard file and directory permission

 

Find all the directories that are on the path “/home/artem” and set them with the standard rights to the directory “755“, also find all the files and set the rights “644“

find /home/artem -type d -exec chmod 755 {} \;
find /home/artem -type f -exec chmod 644 {} \;

 

Not all directories use the rights “755“, for example for the directory “.ssh” the rights “600” are necessary

ArtemLeave a comment on GKE – Nginx Ingress Installation Using HELMGCP

GKE – Nginx Ingress Installation Using HELM

 

Installation instructions can be found here.

 

Install HELM locally:

curl -o get_helm.sh https://raw.githubusercontent.com/kubernetes/helm/master/scripts/get
chmod +x get_helm.sh
./get_helm.sh

helm init

 

Installing Tiller with RBAC enabled

Начиная с Kubernetes v1.8+, RBAC включен по умолчанию.

 

kubectl create serviceaccount --namespace kube-system tiller
kubectl create clusterrolebinding tiller-cluster-rule --clusterrole=cluster-admin --serviceaccount=kube-system:tiller
helm init --service-account tiller

 

Checking:

kubectl get deployments -n kube-system | grep tiller

 

Create Nginx Ingress Controller:

helm install --name nginx-ingress stable/nginx-ingress --set rbac.create=true --set controller.publishService.enabled=true

 

If the following error occurs:

Error: release nginx-ingress failed: namespaces "default" is forbidden: User "system:serviceaccount:kube-system:default" cannot get resource "namespaces" in API group "" in the namespace "default"

 

Run the following command:

helm init --service-account tiller --upgrade

 

We look at the external IP address of Ingress:

kubectl --namespace default get services -o wide -w nginx-ingress-controller

 

You can reserve it immediately.

ArtemLeave a comment on Kubernetes – Status: EvictedKubernetes

Kubernetes – Status: Evicted

The status “Evicted” means that Pod was “evicted” from the node, as he lacked the resources. This can be observed if you display the following:

kubectl get pod -n staging
NAME                                      READY   STATUS             RESTARTS   AGE
artem-client-app-5bb855b7-ccfmz           1/1     Running            0          63m
artem-instance-app-64584c56d4-4g5qh       0/1     Evicted            0          16m
artem-instance-app-64584c56d4-knc9z       0/1     Evicted            0          16m
artem-instance-app-64584c56d4-ld8h9       0/1     Evicted            0          25m
artem-instance-app-64584c56d4-lstt9       0/1     Evicted            0          16m
artem-instance-app-64584c56d4-sksrg       0/1     Evicted            0          16m
artem-instance-app-c67d9b8b9-7ppsg        1/1     Running            0          14m

 

In order to remove all pods in the status “Evicted“, do the following:

kubectl get pods --all-namespaces -o json | jq '.items[] | select(.status.reason!=null) | select(.status.reason | contains("Evicted")) | "kubectl delete pods \(.metadata.name) -n \(.metadata.namespace)"' | xargs -n 1 bash -c
ArtemLeave a comment on Kubernetes – CORS enableKubernetes

Kubernetes – CORS enable

To enable CORS in ingress, add the following:

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  annotations:
    ...
    nginx.ingress.kubernetes.io/enable-cors: "true"
    nginx.ingress.kubernetes.io/cors-allow-methods: "PUT, GET, POST, OPTIONS"
    nginx.ingress.kubernetes.io/cors-allow-origin: "*"
    nginx.ingress.kubernetes.io/cors-allow-credentials: "true"

 

* – allows requests from anywhere, replace it with the domain you need

ArtemLeave a comment on FIX ERROR – phpMyAdmin+Apache 2.4: client denied by server configuration: /usr/share/phpMyAdmin/Fix Error

FIX ERROR – phpMyAdmin+Apache 2.4: client denied by server configuration: /usr/share/phpMyAdmin/

When I tried to log in to phpMyAdmin using Apache 2.4 I received a 403 error, in the logs the following message:

client denied by server configuration: /usr/share/phpMyAdmin/

The reason is that the configuration for Apache version 2.2

 

Solution:

Open the configuration file:

vim /etc/httpd/conf.d/phpMyAdmin.conf

 

And we change this part:

<Directory /usr/share/phpMyAdmin/>
   AddDefaultCharset UTF-8

 

To the following:

<Directory /usr/share/phpMyAdmin/>
   AddDefaultCharset UTF-8
   Options Indexes FollowSymLinks MultiViews
   DirectoryIndex index.php
   AllowOverride all
   Require all granted

 

Restart the httpd service:

<Directory /usr/share/phpMyAdmin/>
systemctl restart httpd
ArtemLeave a comment on FIX ERROR – WordPress: The server requested authentication method unknown to the client [caching_sha2_password]Fix Error

FIX ERROR – WordPress: The server requested authentication method unknown to the client [caching_sha2_password]

When installing WordPress using MySQL 8, the following error may occur:

Warning: mysqli_real_connect(): The server requested authentication method unknown to the client [caching_sha2_password]

The reason is the default authorization method.

 

Solution:

In the file “/etc/my.cnf” in the block “mysqld” add the following:

default-authentication-plugin=mysql_native_password

 

And restart the mysqld service:

systemctl restart mysqld

 

If the user has already been created using the “caching_sha2_password” method, then you need to log in to mysql and do the following:

alter user 'username'@'localhost' identified with mysql_native_password by 'password';