---
# System prepended metadata

title: Mosaic platform 2nd year
tags: [lab]

---

# Mosaic platform 2nd year

## Pfsense

*pfSense is an open source firewall and router based on FreeBSD*
* IPsec tunnel setting - static
    1. VPN -> IPsec -> tunnels
    2. add P1 (define which remote gateway to build the tunnel with)
    3. add P2 (define the local and remote site network)
        * mode: tunnel IPv4         
* IPsec tunnel setting - dynamic
    1. VPN -> IPsec -> tunnels
    2. add P1 (define which remote gateway to build the tunnel with)
    3. add P2 (define the local and remote site network)
        * mode: Routed(VTI)
        * Local network: choose Network and define the virtual interface IP
            * ex:10.10.10.1/30
        * Remote network: choose Address and define the remote virtual interface IP
            * ex:10.10.10.2
        * Note: 2 VTI(Virtual Tunnel Interface) need to be set in the same subnet
    4. System -> Package Manager -> download frr package
    5. Service -> FRR Global/Zebra -> enable
    6. Service -> FRR RIP -> enable -> set the network that you want the routers to communicate with
        * set the local network of this router (ex: 192.168.56.0/24()
        * set the neighbor of this router (remote site IP of the tunnel)
        * Note: FRR RIP need to click the distribution of the route to the neighbor
* Firewall Rule
    * needs to allow the traffic of IPsec
    * may need to set one more rule to allow TCP with port(BGP) -> I don't know why QQ 
    * needs to disable WAN (can be edit in Interface -> Wan)
        * Block private networks and loopback addresse
        * Block bogon networks 

## Quagga

*Quagga is a network routing software suite providing implementations of Open Shortest Path First (OSPF), Routing Information Protocol (RIP), Border Gateway Protocol (BGP) and so on.*

* installation
    1. install the package
    
        ```
        sudo apt install quagga
        ```
    2. modify the configuration
        * sudo vim /etc/quagga/daemons
        
        ```
        zebra=yes
	    ripd=yes
        ```
        * sudo vim /etc/quagga/zebra.conf (copy from [link](https://github.com/rwestphal/quagga-public/blob/master/zebra/zebra.conf.sample))
        ```
        ! -*- zebra -*-
        !
        ! zebra sample configuration file
        !
        ! $Id: zebra.conf.sample,v 1.1 2002/12/13 20:15:30 paul Exp $
        !
        hostname Router
        password zebra
        enable password zebra
        !
        ! Interface's description. 
        !
        !interface lo
        ! description test of desc.
        !
        !interface sit0
        ! multicast

        !
        ! Static default route sample.
        !
        !ip route 0.0.0.0/0 203.181.89.241
        !

        !log file zebra.log
        ```
        * sudo vim /etc/quagga/ripd.conf (copy from [link](https://github.com/rwestphal/quagga-public/blob/master/ripd/ripd.conf.sample))
        ```
        ! -*- rip -*-
        !
        ! RIPd sample configuration file
        !
        ! $Id: ripd.conf.sample,v 1.1 2002/12/13 20:15:30 paul Exp $
        !
        hostname ripd
        password zebra
        !
        ! debug rip events
        ! debug rip packet
        !
        router rip
        ! network 11.0.0.0/8 (**uncomment it to set the wanted network subnet**)
        ! network eth0
        ! route 10.0.0.0/8
        ! distribute-list private-only in eth0
        !
        !access-list private-only permit 10.0.0.0/8
        !access-list private-only deny any
        ! 
        !log file ripd.log
        !
        log stdout
        ```
        * Note: need to set the local IP subnet including virtual IP subnet
    
    3. start the service
        ```
        service zebra/ripd start
        ```
## Monit

*Monit is a free, open-source process supervision tool for Unix and Linux*

* Installation
    1. install the package
    
    ```
    sudo apt-get install monit
    ```
    2. modify the configuration
        * sudo vim /etc/monit/monitrc
        
        ```
        **uncomment the following line**
        
        set httpd port 2812 and
        use address localhost  # only accept connection from localhost
        allow localhost        # allow localhost to connect to the server and
        allow admin:monit
        ```
        ```
        set daemon 30 **check the process every 30 seconds**
        ```        
        ```
        **the process to monitor on**
        
        check process zebra with pidfile /var/run/quagga/zebra.pid
        start program = "/bin/systemctl start zebra"
        stop program = "/bin/systemctl stop zebra"
        if does not exist then exec "/bin/systemctl restart zebra"
        
        check process ripd with pidfile /var/run/quagga/ripd.pid
        start program = "/bin/systemctl start ripd"
        stop program = "/bin/systemctl stop ripd"
        if does not exist then exec "/bin/systemctl restart ripd"
        ```
    3. start the service
        ```
        service monit (re)start
        ```
    4. command to monitor the process
        ```
        monit summary
        ```
    * let systemd to handle restart
        
        1. go to the path of the service /lib/systemd/system or /etc/systemd/system
        2. find the service and edit (ex:ripd.service)
        3. add `Restart=always; RestartSec=<second>` at [Service]
        4. reload the daemon `systemctl daemon-reload`
        
## VIPArip

*Virtual IP Address by RIP2 protocol. This script manages IP alias in different subnet with quagga/ripd. It can add an IP alias, or remove one.*

* crm configure edit
```
primitive VIPArip VIPArip \
    params ip=<vip> nic=lo \
    op start interval=0 timeout=20s \
    op monitor interval=5s timout=20s depth=0 \ 
    op stop interval=5s timeout=20s \
    meta target-role=start
```
* some corosync commands
```
# crm resource cleanup <resource name> -> clean the resource error message
# crm node standby/online <node name> -> can be used to test the migration of the resource
# crm status -> check node/resource status
```
* corosync & pacemaker webUI
```
# sudo apt install pcs
# systemctl start pcsd
# systemctl enable pcsd
# passwd "username" -> setup the webUI username and password

*** WebUI url : https://<node IP>:2224 ***  
```

## Redis deployment with persistent volumes

*Create redis with storage class longhorn to provide persistent volumes across the nodes in k8s.*

* run the following commands in 3 nodes.
1. execute the registry image to provide local repository

     ```
     # docker run --rm -it -p 5000:5000 registry
     **this command needs to be running when executing the following commands**
     ```
2. create Redis docker image and push it to local repository
    ```
    # docker build -t dep-redis:1.0 .
    # docker image tag dep-redis:1.0 localhost:5000/dep-redis:1.0
    # docker push localhost:5000/dep-redis:1.0
    ```
* run the following commands in only one node
3. create PV for longhorn, so redis can store the data here

    ````
     # kubectl apply -f pvc-dep-redis.yaml
    ````
4. create redis service and deployment
    ````
    # kubectl apply -f redis-service.yaml
    # kubectl apply -f master-dep-redis.yaml
    ````
5. check the pod is running and has successfully attached to the pv
    ````
    # kubectl get po
    # kubectl get pvc
    ````
6. you can access the longhorn UI to check if it has successfully attached the redis with longhorn replica.

    ![](https://hackmd.io/_uploads/HyNKKFaLn.png)

* start to use redis
````
**enter the pod**
# kubectl exec -it <redis pod name> bash

**login redis**
# redis-cli -h 127.0.0.1 -p 6379 -a rpasswd
````

## Get node info inside k8s pod
*use python client to get the node info of k8s cluster*

1. add the config file of k8s in the docker container 
```
file postition : </root/.kube/config>
```
2. need to install k8s
```
# pip3 install kubernetes
```
3. Dockerfile example
```
FROM ubuntu:18.04
RUN apt-get update && apt-get install -y python3 python3-pip vim
RUN pip3 install redis kubernetes
RUN mkdir /root/.kube/
ADD ./config /root/.kube/
```
4. k8s node API ref.
    https://github.com/kubernetes-client/python/blob/master/kubernetes/docs/V1Node.md