coreos | 易学教程

kubernetes + coreos cluster - replacing certificates

阅读更多关于 kubernetes + coreos cluster - replacing certificates

问题 I have a coreos kubernetes cluster, which I started by following this article: kubernetes coreos cluster on AWS TLDR; > kube-aws init > kube-aws render > kube-aws up Everything worked good and I had a kubernetes coreos cluster on AWS. In the article there is a warning that said: PRODUCTION NOTE: the TLS keys and certificates generated by kube-aws should not be used to deploy a production Kubernetes cluster. Each component certificate is only valid for 90 days, while the CA is valid for 365

How to copy /var/lib/docker with overlayfs directory structure with data as-is without increasing the storage space

阅读更多关于 How to copy /var/lib/docker with overlayfs directory structure with data *as-is* without increasing the storage space

问题 I have a docker installation with several images and about 150Gigs of data in /var/lib/docker . This setup uses overlayfs as its storage driver. There are several directories for each layer under /var/lib/docker/overlay holding the actual data. The partition size is 160G. My requirement is to copy the the docker directory from /var/lib/docker to a new disk of 1TB, so that I point docker to start from this new partition and continue to use my old images. Now the problem is, when I use an rsync

What is the correct way to install addons with Kubernetes 1.1?

阅读更多关于 What is the correct way to install addons with Kubernetes 1.1?

问题 What is the correct way to install addons with Kubernetes 1.1? The docs aren't as clear as I'd like on this subject; they seem to imply that one should copy addons' yaml files to /etc/kubernetes/addons on master nodes, but I have tried this and nothing happens. Additionally, for added confusion, the docs imply that addons are bundled with Kubernetes: So the only persistent way to make changes in add-ons is to update the manifests on the master server. But still, users are discouraged to do it

How do I enable snmp on CoreOS

阅读更多关于 How do I enable snmp on CoreOS

I cannot seem to find any useful info on the topic. Furthermore, what is the best way to monitor CoreOS (we use observium). If standard Linux SNMP metrics are most you need, you just want to deploy a container that runs SNMP daemon. For that purpose you will probably need to expose it to host's network namespace ( --net=host , if you are using Docker) and then you definitely need to bind-mount /proc (with -v /proc:/hostproc passed to docker run ). The only unusual thing you would need point the SNMP daemon at is the /hostproc instead of /proc . You can probably try using the polinux/snmpd

Iptables remove specific rules by comment

阅读更多关于 Iptables remove specific rules by comment

I need to delete some rules with same comment. For example I have rules with comment = "test it", so i can get list of them like this: sudo iptables -t nat -L | grep 'test it' But how can i delete all PREROUTING rules with comment 'test it'? UPD: As @hek2mgl said, i can do something like this: sudo bash -c "iptables-save > iptables.backup" sed -i '/PREROUTING.*--comment.* "test it"/d' iptables.backup sudo iptables-restore < iptables.backup sudo rm iptables.backup But between save and restore could be changes in iptables, so after restore there will be problems =/ You can use the following

Cannot ssh into remote machine after rsync

阅读更多关于 Cannot ssh into remote machine after rsync

I followed this page on Protecting the Docker daemon Socket with HTTPS to generate ca.pem, server-key.pem, server-cert.pem, key.pem and key-cert.pem I wanted a remote Docker daemon to use those keys so i used rsync via ssh to send three of the files(ca.pem, server-key.pem and key.pem) to the remote host's home directory. The identity file for ssh into the remote host is called dl-datatest-internal.pem ubuntu@ip-10-3-1-174:~$ rsync -avz -progress -e "ssh -i dl-datatest-internal.pem" dockerCer/ core@10.3.1.181:~/ sending incremental file list ./ ca.pem server-cert.pem server-key.pem sent 3,410

How can I get the IP address of a unit started on a machine and use it in another unit with fleet?

阅读更多关于 How can I get the IP address of a unit started on a machine and use it in another unit with fleet?

问题 I'm new to CoreOS and Docker and I'm facing with a problem with fleet. I have a standard unit launching a POSTGRES container and I would like to know the IP address of the machine where this unit is started . I have actually a cluster of 3 machines and the POSTGRES unit isn't always started on the same machine (which means the IP is not static). I need it when I start another unit (see below), which needs a POSTGRES. I'm using at the moment the Unit Parameter called BindsTo : [Unit]

Create docker base image for a linux iso image

阅读更多关于 Create docker base image for a linux iso image

How can i make a docker base image from a coreos iso image? i tried tar -cf the iso image to tar file, but it's failed. docker import ... just for .tar archive file? thanks It is untypical to go from a full OS image (even when it is a small OS) to a docker image. Actually CoreOS is more intended to run docker instead of beeing the appliance of a docker image. What base image you want to use and why? You might not need any if you pack your app with some dependencies (and run it on a Docker install in coreOS). I guess you would be able to extrace the ISO (some packers can do that) and remove the

Java JVM on Docker/CoreOS

阅读更多关于 Java JVM on Docker/CoreOS

问题 I'm learning CoreOS/Docker and am trying to wrap my mind around a few things. With Java infrastructure, is it possible to use the JVM in it's own container and have other Java apps/services use this JVM container? If not, I'm assuming the JVM would have to be bundled in each container, so essentially you have to pull the Java dockerfile and merge my Java services; essentially creating a Linux Machine + Java + Service container running on top of the CoreOS machine. The only other thought I had

ETCD：在容器中运行etcd集群

阅读更多关于 ETCD：在容器中运行etcd集群

原文地址： Docker container 以下指南显示了如何使用静态引导过程在rkt和Docker上运行etcd。 rkt 运行单节点的etcd 以下rkt run命令将在端口2379上公开etcd客户端API，并在端口2380上公开对等API。配置etcd时使用主机IP地址。 export NODE1=192.168.1.21 信任CoreOS App签名密钥。 sudo rkt trust --prefix quay.io/coreos/etcd # gpg key fingerprint is: 18AD 5014 C99E F7E3 BA5F 6CE9 50BD D3E0 FC8A 365E 运行etcd v3.2版本或指定其他发行版本。 sudo rkt run --net=default:IP=${NODE1} quay.io/coreos/etcd:v3.2 -- -name=node1 -advertise-client-urls=http://${NODE1}:2379 -initial-advertise-peer-urls=http://${NODE1}:2380 -listen-client-urls=http://0.0.0.0:2379 -listen-peer-urls=http://${NODE1}:2380 -initial