Alok – Page 8

xargs understanding – linux

xargs pass the output(stdout) of first command to second command as argument.

ls | xargs rm -f

This will remove all file listed by ls command

To understand properly what xargs is doing. use -p flag. It’s like dry-run.

[root@lp-k8control-1 xargs]# ls
test  test2  test3
[root@lp-k8control-1 xargs]# ls | xargs -p rm -f
rm -f test test2 test3 ?...

flag -n1 = one at a time

[root@lp-k8control-1 xargs]# ls | xargs -p -n1 rm -f
rm -f test ?...

flag -I % = run multiple command

[root@lp-k8control-1 xargs]# ls | xargs -p -n1 -I % /bin/bash -c 'ls %; ll %  '
/bin/bash -c ls test; ll test   ?...y
test

More : https://flaviocopes.com/linux-command-xargs/

32 GB SD card issue

One of the issue that i face with my raspberry pi 4 SD card. I removed it when it was in the pi case. Which broke the SD card chip in half internally.

Lesson : Always remove the SD carefully.

broke my 32 GB SD card while removing from Pi. I tried formatting with fdisk, mkfs.ext4 and Windows but none of them worked.

I have attached screenshot of fdisk /dev/sda where I have created 1 partition but when i try to delete the same it’s giving error No partition is defined yet!

Here is the lsblk output:

root@lp-arm-1:~# lsblk
NAME        MAJ:MIN RM  SIZE RO TYPE MOUNTPOINT
loop0         7:0    0 88.1M  1 loop /snap/core/11803
loop1         7:1    0 48.9M  1 loop /snap/core18/2127
loop2         7:2    0   49M  1 loop /snap/core18/2248
loop3         7:3    0 57.4M  1 loop /snap/core20/1171
loop4         7:4    0 88.1M  1 loop /snap/core/11996
loop5         7:5    0 60.4M  1 loop /snap/lxd/21544
loop6         7:6    0 28.2M  1 loop /snap/snapd/13269
loop7         7:7    0 57.4M  1 loop /snap/core20/1084
loop8         7:8    0   62M  1 loop /snap/lxd/21032
loop9         7:9    0 28.2M  1 loop /snap/snapd/13643
sda           8:0    1 30.6M  0 disk
mmcblk0     179:0    0 59.7G  0 disk
├─mmcblk0p1 179:1    0  256M  0 part /boot/firmware
└─mmcblk0p2 179:2    0 59.4G  0 part /

Note: mmcblk0 is another working SD card

When try to format it with widows OS.

Networking basic command for kubernetes

list namespace

lsns

all ns for process id

ps -ef | grep nginx

lsns -p 400055

pause pod creates ipc and net namespace

https://learnk8s.io/kubernetes-network-packets

Integrating Jenkins login with Keycloak

Run Keycloak with docker-compose

version: '3'
services:
  postgres:
      image: postgres:9.6
      volumes:
        - /opt/postgres/:/var/lib/postgresql/data
      environment:
        POSTGRES_DB: keycloak_db
        POSTGRES_USER: keycloak_user
        POSTGRES_PASSWORD: password
  keycloak:
      image: quay.io/keycloak/keycloak:latest
      environment:
        DB_VENDOR: POSTGRES
        DB_ADDR: postgres
        DB_DATABASE: keycloak_db
        DB_USER: keycloak_user
        DB_SCHEMA: public
        DB_PASSWORD: password
        KEYCLOAK_USER: admin
        KEYCLOAK_PASSWORD: admin
      ports:
        - 8080:8080
      depends_on:
        - postgres

Open Keycloak panel : http://192.168.0.184:8080 > add realm > Jenkins

Add client, Client > client-protocal=openid-connect > Root URL

Client > Jenkins-client > Installation > Keycloak OIDC JSON > Download

Note : Take the back up of /var/jenkins_home/config.xml or take a snapshot if it’s vm.

Manage Jenkins > Configure system > Global Keycloak Settings > add downloaded json data > Save

Manage Jenkins > Configure global security > Securiy Realm > Keycloak Authentication Plugin > Save and logout

Create Users in Keycloak realm “jenkins” and login with user(eg. admin1)

More – https://www.keycloak.org/getting-started/getting-started-docker

Custom Daemonset command based on host_ip in kubernetes

Why?
– When we need to add some extra functionally to daemonset based on which worker node it’s running on

apiVersion: apps/v1
kind: DaemonSet
metadata:
  labels:
    app: custom-daemonset
  name: custom-daemonset
spec:
  selector:
    matchLabels:
      app: custom-daemonset
  template:
    metadata:
      labels:
        app: custom-daemonset
    spec:
      containers:
      - command:
        - /bin/bash
        - -c
        - |
          echo "$STARTUP_SCRIPT" > /tmp/STARTUP_SCRIPT.sh
          /bin/bash /tmp/STARTUP_SCRIPT.sh
        env:
        - name: HOST_IP
          valueFrom:
            fieldRef:
              fieldPath: status.hostIP
        - name: STARTUP_SCRIPT
          value: |
            #!/bin/bash
            if [ $HOST_IP == "192.168.0.184" ]; then
              echo "HOST_IP is $HOST_IP"
            else
              echo "HOST_IP does not match $HOST_IP"
            fi
            sleep 600
        image: nginx
        imagePullPolicy: IfNotPresent
        name: custom-daemonset

Ref : https://github.com/kubernetes/kubernetes/issues/24657#issuecomment-577747926

AD integration with linux ssh login and sudo access

ad_join.sh

#!/bin/bash

#check if already joined to domain

if [[ $(realm list) != "" ]]
then
echo "This server is already joined to domain."
realm list | head -n 1
exit
fi

function update_sssd_config() {
    sed -i 's/use_fully_qualified_names = True/use_fully_qualified_names = False/g' /etc/sssd/sssd.conf
    sed -i 's|/home/%u@%d|/home/%u|g' /etc/sssd/sssd.conf
    systemctl restart sssd
}

function restrict_ssh_access_group() {
    if [[ $(cat /etc/ssh/sshd_config | grep -o "updated_by_ad_join") != "updated_by_ad_join" ]]
    then
    echo "###############updated_by_ad_join.sh###############" >> /etc/ssh/sshd_config
    echo "AllowGroups root ssh-access-group" >> /etc/ssh/sshd_config
    systemctl restart sshd
    fi
}

function sudo_access_level_group() {
    if [[ $(cat /etc/sudoers | grep -o "updated_by_ad_join") != "updated_by_ad_join" ]]
    then
    echo "###############updated_by_ad_join.sh###############" >> /etc/sudoers
    echo "Cmnd_Alias SUDO_ACCESS_LEVEL1 = /usr/bin/ls, /usr/bin/cat " >> /etc/sudoers
    echo "Cmnd_Alias SUDO_ACCESS_LEVEL2 = /usr/bin/vi, /usr/bin/nano " >> /etc/sudoers

    echo "%sudo-group-level1 ALL=(ALL) NOPASSWD: SUDO_ACCESS_LEVEL1"  >> /etc/sudoers
    echo "%sudo-group-level2 ALL=(ALL) NOPASSWD: SUDO_ACCESS_LEVEL2"  >> /etc/sudoers
    echo "%sudo-group-full-access ALL=(ALL) NOPASSWD: ALL"  >> /etc/sudoers
    fi
}

#check os 
if [[ $(cat /etc/os-release | egrep "centos|redhat|fedora|rhel|oracle|rocky") != "" ]]
then
yum install sssd realmd oddjob oddjob-mkhomedir adcli samba-common samba-common-tools krb5-workstation openldap-clients  -y
realm join -vvv --user=administrator ad.example.com

#call function
update_sssd_config

restrict_ssh_access_group

sudo_access_level_group

fi

Jenkins AD integration and access management

First take the back up of /var/jenkins_home/config.xml or take a snapshot if it’s vm.

Method 1: (all user have same admin access)

Manage jenkins > Configure Global Security > Active Directory

Domain name : example.com
Domain Controller : ad.exmaple.com
Bind DN : [email protected]
Bind Password : <jenkins-svc-account password>

Note: You may need to apply the setting and then click on Test Domain.

Else it will give Error: simple bind failed: ad.example.com:389 error

Also Domain Name(example.com) should be resolved from jenkins host or entry should be in /etc/hosts

192.168.122.6 example.com

Method 2: Matrix-based security

Method3: Role based strategy(pending)

AD user and jenkins screenshot for reference

Check ldap port in powershell

tnc example.com -port 389

Test-NetConnection -ComputerName example.com -Port 389

Build haskell static binary with docker

Why?
– Reduce surface attack
– Reduce docker image size

hola.sh

{-# LANGUAGE OverloadedStrings #-}
import Web.Scotty

import Data.Monoid (mconcat)

main = scotty 3000 $
    get "/:word" $ do
        beam <- param "word"
        html $ mconcat ["<h1>Scotty, ", beam, " me up!</h1>"]

alpine.Dockerfile

FROM haskell:8 AS build
WORKDIR /opt
RUN cabal update
RUN cabal install --lib scotty
COPY hola.hs .
#RUN ghc --make -threaded hola.hs  -o hola
RUN ghc --make -threaded -optl-static -optl-pthread hola.hs -o hola

FROM alpine:3.15.0
RUN addgroup -S group1 && adduser -S user1 -G group1
USER user1
WORKDIR /opt
COPY --from=build /opt/hola .
EXPOSE 3000
CMD ["/opt/hola"]

Add linux CRON entry non interactive

Useful when we need to add cron entry using shell script

cron.sh

crontab -l > /tmp/cron.bak
echo "* * * * * /opt/backup.sh" >> /tmp/cron.bak
crontab /tmp/cron.bak

DevOps questions

Docker

Explain Docker life cycle?
Explain/Write simple Dockerfile start to end.
What are layers in docker? how to reduce layer?
What is CMD and entry point? can we use both? When to use?
What is multistage dockerfile?
What’s Difference between ADD vs COPY, RUN vs CMD?
How to optimize docker image size?
How to optimize security in dockerfile?
Tools used for scanning docker file and image?
What is distroless image? when to use?
How to verify distroless image with cosign?
have you used tini ? why?
Can you run container with different kernel version than base kernel host?
What are the best practices to write Dockerfile?
what is docker buildkit?
What is docker-compose?
How container talks to other container in docker-compose?
Types of networks in docker-compose?
how to auto restart docker container?

Jenkins

Explain Your jenkins CICD pipeline?
Explain Jenkins DevSecOps Pipleine?
How you integrated sonarqube with your pipeline?
What are the ways we can start the build? OR type of build triggers?
How you add jenkins worker node? what are other ways to do?
How you manage credentials in Jenkins?
Diff between webhook and pool scm?
What plugins you used in Jenkins?
How do you take backup of Jenkins?
Have you written declarative or scripted pipeline? what’s difference?
How you pass env variable from one stage to another stage?

Kubernetes

What are the components of kuberntes?
What is pod and deployment, Daemonset
When do you use Daemonset?
What is sidecar container? when to use?
What is static pod?
How you have integrated CICD with Jenkins?
What is Kubeproxy? CoreDNS?
How you expose your service externally?
What will happen if k8 control node goes down?
have you upgraded your k8 cluster? what are the steps? explain
How you add security to k8 cluster?
How you scan your k8 deployment file?
Best practice to write k8 deployment file, explain componets?
What is taints, tolerance, node affinity, pod affinity , anti-affinity?
What is CNI? What CNI you have used? Why we choose different CNI?
Default scaling method available in kubernetes? What task are require to setup HPA?
What VPA? what kind of metrics we can use? from where?
How pod communicate with each other?
How kubernetes kube metrics works?
How you troubleshoot if pod is in pending/imagepullbackoff state?
what is service mesh ? when to use?
What is mTLS? how do you secure your pod to pod communication?
What is PV, PVC? what is storageclass?
If PV is 50GB and created 20GB PVC using that PV. can 30GB used for new PVC?
what is PVC accessModes and Reclaim Policy?

Terraform

what is terraform backend?
Where do you store your terraform state file? why?
Have you created custom module?
Explain your Iaac terraform pipeline

Ansible

What is ansible playbook?
What is ansible role?
What module you used in ansible?
What is register in ansible?
Difference between static and dynamic inventory?
How ansible works? how it do authentication?
What is ansible galaxy?
what is ansible vault? how you store your creds?
write playbook to install httpd and enabled it?
What is ansible tower?
what are handlers in ansible?

General questions

What do you mean by CI and CD?
What is continue development , continue deployment?
what is your git branch strategy? how do you resolve merge conflict?
How you optimize cost on aws? (amd, arm, cloudcustodian, aws lambda, s3 static website, s3 lifecycle)
How you will host static website?
Application is receiving millions of request ? how you will manage it?
What is blue-green deployment? tools required? strategy?
What is unit testing? how do you configure quality gates, code coverage in sonarqube?

AWS questions

AWS lambda time limit?
How many VPC and subnet we can create?
How do you secure your website, endpoints?
What is cloudfront distribution point?
How you can recover from wrong fstab configured ec2 which is not starting at all?

Linux questions

How do extend space in Linux? LVM? LVM striping?
RAID types?
Top 10 command that use for daily task?
SUID, GUID, Sticky Bit, special permission in linux?
which is faster cp or mv? why?
command not found? troubleshooting?
what is swap memory? why? how?
update time in linux?
linux boot process?