Host volume mount with nginx container deployment

root@K8S:~# cat test_nginx_dep.yaml 

apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx-deployment
spec:
  replicas: 1
  selector:
    matchLabels:
      app: nginx
  template:
    metadata:
      labels:
        app: nginx
    spec:
      containers:
      - name: nginx
        image: nginx:latest
        ports:
        - containerPort: 80
        volumeMounts:
        - name: host-volume
          mountPath: /var/www/html
      volumes:
      - name: host-volume
        hostPath:
          path: /var/www/html

Flush iptables for troubleshooting

iptables -P INPUT ACCEPT

iptables -P OUTPUT ACCEPT

iptables -P FORWARD ACCEPT

iptables -F

kubernetes arch chart

 

A dumb script

 It just does the job and forgive me for not having time to make it better (e.g ..at least putting the pswd in a variable!!!.) ..nah ...Im just too lazy to do it:

###Need sshpass installed , for passing over the password text

#!/bin/sh

SERVERLIST=serverlist.input
RCMD1='uptime'
RCMD2='cat /etc/passwd | grep hacker' 
while read SERVERNAME
 do
    echo "----------------------">>Remote_Exec_report.txt
    echo $SERVERNAME>>Remote_Exec_report.txt
    sshpass -p 'YourPassword'    ssh -o StrictHostKeyChecking=no -n root@$SERVERNAME $RCMD1 >>Remote_Exec_report.txt
    echo "------checking hacker user, no output expected-------">>Remote_Exec_report.txt
    sshpass -p 'YourPassword'    ssh -o StrictHostKeyChecking=no -n root@$SERVERNAME $RCMD2 >>Remote_Exec_report.txt
    echo "------Done checking-------">>Remote_Exec_report.txt
done < "$SERVERLIST"

iptables NAT

vim /etc/sysctl.conf 

net.ipv4.ip_forward = 1

sysctl -p

# iptables -t nat -P POSTROUTING DROP

# iptables -t nat -A POSTROUTING -o interfacename -j MASQUERADE

FirewallD

 Have been working on iptables for yrs and still cant get used to the more "friendly" firewalld, well, here it is the cheatsheet:

• -drop: The lowest level of trust. All incoming connections are dropped without reply and only outgoing connections are possible.
• -block: Similar to the above, but instead of simply dropping connections, incoming requests are rejected with an icmp-host-prohibited or icmp6-adm-prohibited message.
• -public: Represents public, untrusted networks. You don’t trust other computers but may allow selected incoming connections on a case-by-case basis.
• -external: External networks in the event that you are using the firewall as your gateway. It is configured for NAT masquerading so that your internal network remains private but reachable.
• -internal: The other side of the external zone, used for the internal portion of a gateway. The computers are fairly trustworthy and some additional services are available.
• -dmz: Used for computers located in a DMZ (isolated computers that will not have access to the rest of your network). Only certain incoming connections are allowed.
• -work: Used for work machines. Trust most of the computers in the network. A few more services might be allowed.
• -home: A home environment. It generally implies that you trust most of the other computers and that a few more services will be accepted.
• -trusted: Trust all of the machines in the network. The most open of the available options and should be used sparingly.

firewall-cmd --state

firewall-cmd --get-default-zone

firewall-cmd --get-active-zones

firewall-cmd --list-all

firewall-cmd --get-zones

firewall-cmd --zone=home --list-all

firewall-cmd --zone=home --list-all-zones

firewall-cmd --zone=home --change-interface=eth0

firewall-cmd --set-default-zone=home

firewall-cmd --get-services

Service Definition:

/usr/lib/firewalld/services

firewall-cmd --reload

firewall-cmd --get-services

firewall-cmd --zone=public --add-service=http

firewall-cmd --zone=public --permanent --add-service=http

firewall-cmd --zone=public --list-services

firewall-cmd --zone=public --add-port=5000/tcp

firewall-cmd --zone=public --permanent --add-port=4990-4999/udp

firewall-cmd --permanent --zone=public --remove-service=dhcpv6-client

firewall-cmd --zone=public --permanent --remove-port=443/tcp

firewall-cmd --zone=public --list-ports

firewall-cmd --runtime-to-permanent

Targets definition:

• ACCEPT: accept the packet.
• %%REJECT%%: reject the packet, returning a reject reply.
• DROP: drop the packet, returning no reply.
• default: don't do anything. The zone washes its hands of the problem, and kicks it "upstairs".

firewall-cmd --permanent --zone=public --set-target=DROP

Shell script with ps and kill

====Gotta love awk and shell!!!!======

# ps -ef | grep sshd
root      152725       1  0 Jul21 ?        00:00:46 sshd: /usr/sbin/sshd -D [listener] 0 of 10-100 startups
root      408824  152725  0 06:44 ?        00:00:00 sshd: root
root      408949  152725  0 06:44 ?        00:00:00 sshd: root
root      409031  152725  0 06:44 ?        00:00:00 sshd: root
root      409113  152725  0 06:44 ?        00:00:00 sshd: root
root      409194  152725  0 06:44 ?        00:00:00 sshd: root
root      409265  152725  0 06:44 ?        00:00:00 sshd: root
root      409266  152725  0 06:44 ?        00:00:00 sshd: root
root      409407  152725  0 06:44 ?        00:00:00 sshd: root
root      409478  152725  0 06:44 ?        00:00:00 sshd: root
root      409549  152725  0 06:45 ?        00:00:00 sshd: root
root      409630  152725  0 06:45 ?        00:00:00 sshd: root
root      409701  152725  0 06:45 ?        00:00:00 sshd: root
root      409785  152725  0 06:45 ?        00:00:00 sshd: root
root      410949  152725  0 18:56 ?        00:00:00 sshd: root@pts/0
root      411192  411077  0 19:15 pts/0    00:00:00 grep --color=auto sshd

# ps -ef | grep sshd | grep -v -e listener -e color -e pts | awk '{print $2}'

408824
408949
409031
409113
409194
409265
409266
409407
409478
409549
409630
409701
409785

# for pid in $(ps -ef | grep sshd | grep -v -e listener -e color -e pts | awk '{print $2}'); do kill -9  $pid; done