Philip Schmid PhilipSchmid

How to disable Kube-Proxy in RKE2

Example use case: Running the Cilium CNI without any kube-proxy

On all RKE2 servers (master nodes), add the following configuration to your /etc/rancher/rke2/config.yaml file:

disable-kube-proxy: "true"

Now the important step: If you already had stared the RKE2 service before (without this flag and with kube-proxy enabled), ensure to also delete the kube-proxy.yaml static pod manifest:

Grafana Dashboards for Kubernetes Environments

Helpful Kubernetes Grafana dashboards. Tested with kube-state-metrics v2.0.0 & Grafana 8.0.3.

Original sources of the JSONs:

Alacritty, Tmux, Fish Setup

A short tutorial how to setup a nice terminal environment using Alacritty, Tmux, Fish, OMF and the Fish theme bobthefish.

Tested on Pop_OS 20.04.

Basic Installation

Install the required packages:

sudo apt install alacritty tmux fish fonts-powerline fonts-hack-ttf

Prometheus Operator Custom Resource (CR) Testing Manifests

Ever searched for a simple setup to test the exposure of a /metrics endpoint and tried to add this endpoint to Prometheus using a ServiceMonitor CR? Well, use the manifests below and you are good to go :).

Creation

---
apiVersion: v1
kind: Namespace
metadata:
  name: testing

	<!DOCTYPE NETSCAPE-Bookmark-file-1>
	<!-- This is an automatically generated file.
	It will be read and overwritten.
	DO NOT EDIT! -->
	<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=UTF-8">
	<TITLE>Bookmarks</TITLE>
	<H1>Bookmarks</H1>
	<DL><p>
	<DT><H3 ADD_DATE="1639761932" LAST_MODIFIED="1639906307" PERSONAL_TOOLBAR_FOLDER="true">Bookmarks bar</H3>
	<DL><p>

	---
	apiVersion: apps/v1
	kind: Deployment
	metadata:
	labels:
	app: kuard
	name: kuard
	namespace: kuard
	spec:
	replicas: 1

	# NS
	kubectl create ns cadvisor-issue-test

	# PV
	echo "
	apiVersion: v1
	kind: PersistentVolume
	metadata:
	name: pvc-cadvisor-issue-test
	spec:

	- name: custom_certmanager_monitoring
	rules:
	- alert: CertManagerAbsent
	expr: absent(up{job="cert-manager"})
	for: 1h
	annotations:
	message: "Cert Manager has dissapeared from Prometheus service discovery."
	labels:
	severity: critical
	- alert: CertManagerACMEProxyReachability

	#!/bin/bash

	# Usage: ./minio-upload my-bucket my-file.zip

	bucket=$1
	file=$2

	host=minio.example.com
	s3_key=svc_example_user
	s3_secret=svc_example_user_password

	---
	# https://kubernetes.io/docs/concepts/policy/pod-security-policy/
	# Attention: This PSP has quite some loose restrictions! Do not just copy & paste it!
	apiVersion: policy/v1beta1
	kind: PodSecurityPolicy
	metadata:
	name: example
	spec:
	allowPrivilegeEscalation: true
	allowedCapabilities: