rjhowe

1. Allow unsafesysctls to be run on node: https://docs.openshift.com/container-platform/4.12/nodes/containers/nodes-containers-sysctls.html#nodes-containers-sysctls-unsafe_nodes-containers-using
   • If setting for all workers the workers, set label on worker mcp

   # oc label mcp worker custom-kubelet=sysctl
   

   • Create a kubeletconfig

   apiVersion: machineconfiguration.openshift.io/v1
   kind: KubeletConfig
   

rjhowe

apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
metadata:
  labels:
    machineconfiguration.openshift.io/role: worker
  name: recreate-backingfsblockdev
spec:
  config:
    ignition:
      version: 3.2.0

rjhowe

# kubectl-dev_tool audit --subresource="*" --verb=list -o top --by=user -f  audit-2023-02-07T15-02-18.917.log
count: 9201, first: 2023-02-07T09:46:41-05:00, last: 2023-02-07T10:02:18-05:00, duration: 15m37.691882s
4071x                system:serviceaccount:sysdig-agent:sysdig-agent
574x                 system:serviceaccount:openshift-machine-config-operator:machine-config-daemon
543x                 system:serviceaccount:openshift-dns:dns
456x                 system:apiserver
360x                 system:serviceaccount:openshift-cluster-node-tuning-operator:tuned
286x                 system:serviceaccount:openshift-monitoring:prometheus-k8s
275x                 system:serviceaccount:openshift-operator-lifecycle-manager:olm-operator-serviceaccount
177x                 system:serviceaccount:openshift-operators:jaeger-operator

rjhowe

oc get nodes -o template --template='{{ range .items }}{{ $desired := index .metadata.annotations "machineconfiguration.openshift.io/desiredConfig" }}{{ $current := index .metadata.annotations "machineconfiguration.openshift.io/currentConfig" }} {{ if $current }} {{ if eq $current $desired }} Node Name: {{ .metadata.name }} {{"\t"}}Machine Config: {{ index .metadata.annotations "machineconfiguration.openshift.io/currentConfig" }} {{ println }}{{ end }}{{ if ne $current $desired }} Current != Desired {{"\t"}} Node Name: {{ .metadata.name }} {{"\t"}} Current: {{ index .metadata.annotations "machineconfiguration.openshift.io/currentConfig" }} {{"\t"}} Desired: {{ index .metadata.annotations "machineconfiguration.openshift.io/desiredConfig" }}{{ println }}{{ end }}{{ end }}{{ end }}'

rjhowe

FROM quay.io/fedora/fedora

RUN dnf -y update && dnf clean all && \

    INSTALL_PKGS="\
                 ncat \
                 openssl \
                 && \

    dnf install -y --setopt=tsflags=nodocs $INSTALL_PKGS && \

rjhowe

ROUGH NOT FULLY TESTED

1. Create and Attach volume to masters at /dev/vdb via OpenStack

2. Create test machine-config

apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
metadata:
  labels:

rjhowe

4.8 +

# oc patch ingresscontroller default -n openshift-ingress-operator -p '[{"op": "add", "path": "/spec/tuningOptions/threadCount", "value" : 8}]' --type=json

4.7 and below

rjhowe

#/bin/bash

#USAGE   
# `ocpkg 4.8.34``   or with out y release and latest will be chosen `ocpkg 4.8``

DEPENDENCIES=("oc" "jq" "skopeo")
IFS=. read -r Ver4 VerX VerY <<< ${1}
STREAM=fast
CHANNEL="${STREAM}-4.${VerX}"

rjhowe

kind: List
apiVersion: v1
items:
- apiVersion: apps/v1
  kind: Deployment
  metadata:
    labels:
      name: hello-openshift
      app: hello-openshift
    name: hello-openshift

rjhowe

apiVersion: operator.openshift.io/v1
kind: IngressController
metadata:
 name: default
 namespace: openshift-ingress-operator
spec:
 replicas: 3
 endpointPublishingStrategy:
   type: HostNetwork
 nodePlacement: