How to expose non http(s) service (Redis, MySql) outside k8s|openshift cluster?

Image you deployed a redis in memory data structure server in your cluster. The redis server instance can be accessed no doubt for the pods within the cluster. What you should do if you want it be public accessed from outside. OpenShift Container Platform provides multiple methods for communicating from outside the cluster with services running in the cluster. The recommendation, in order or preference, is: If you have HTTP/HTTPS, use a router. If you have a TLS-encrypted protocol other than

Post, Code and Quiet Time. How to expose non http(s) service (Redis, MySql) outside k8s|openshift cluster? By Errong Leng – 17 Apr 2023 – View online → Photo by martin bennie / Unsplash Image you deployed a redis in memory data structure server in your cluster. The redis server instance can be accessed no doubt for the pods within the cluster. What you should do if you want it be public accessed from outside. OpenShift Container Platform provides multiple methods for communicating from outside the cluster with services running in the cluster. The recommendation, in order or preference, is: If you have HTTP/HTTPS, use a router. If you have a TLS-encrypted protocol other than HTTPS (for example, TLS with the SNI header), use a router. Otherwise, use a Load Balancer, an External IP, or a NodePort. redis(s):// is not http(s):// Since redis use TCP 6379 port by default, we cannot use a router to expose it or even use nginx reverse proxy to bypass the service. Because http protocol can't work with redis protocol. use a Load Balancer, an External IP both requires external IP pool. you need extra configuration for IP resources. If you are the cluster admin, you definitely can try any of these methods. Using a Load Balancer - Getting Traffic into a Cluster | Developer Guide | OpenShift Container Platform 3.11 OpenShift Using a Service ExternalIP - Getting Traffic into a Cluster | Developer Guide | OpenShift Container Platform 3.11 OpenShift Lifesaver: NodePort well, the third and last option, let't try use a NodePort.  check below sample yaml and configure the NodePort service for your none http(s) TCP port service accordingly. Remember use a port in range 30000~32767. I used 32123 in my case. You should be able to access the service using the <NodeIP>:<NodePort> address. Now your redis server is able to be accessed publicly from outside of the cluster where the pod deployed. Then question comes: How do you know the node ip? Viewing and listing the nodes in your OpenShift Container Platform cluster I give the openshift command: oc get nodes -o wide You can use the host name or external ip from any node in the cluster. Then you can test the connection from outside of your cluster via redis-cli redis-cli -h <NodeIp> -p <NodePort> -a password PS: use 32123 NodePort to connect rather 6379 the port that exposed by the redis service. References: Overview - Getting Traffic into a Cluster | Developer Guide | OpenShift Container Platform 3.11 OpenShift Viewing and listing the nodes in your cluster - Working with nodes | Nodes | OpenShift Container Platform 4.11 OpenShift Post, Code and Quiet Time. © 2023 – Unsubscribe

New Logo

Hope you like it. Designed by Vista Print. Vistaprint CA Online Printing: Business Cards, Signage & MoreVistaprint helps small businesses to market themselves effectively. Create and order printed marketing materials, business signs, and promotional products directly from your office. Satisfaction Absolutely Guaranteed.VistaVistaCreateWebsites by Vista x WixCorporate PricingReseller Program

Post, Code and Quiet Time. New Logo By Errong Leng – 04 Apr 2023 – View online → Hope you like it. Designed by Vista Print. Vistaprint CA Online Printing: Business Cards, Signage & More Vistaprint helps small businesses to market themselves effectively. Create and order printed marketing materials, business signs, and promotional products directly from your office. Satisfaction Absolutely Guaranteed. VistaVistaCreateWebsites by Vista x WixCorporate PricingReseller Program Post, Code and Quiet Time. © 2023 – Unsubscribe

How to address Let's Encrypt renew failure?

recently certificate for this site somehow got expired. It should got auto renewed. Since I added schedule event manually via crontab, Ghost cli also added one cron event while you run `ghost setup ssl`. I checked via `crontab -e`: 1 1 1 * * /home/errong_leng/.acme.sh/acme.sh --issue --home /etc/letsencrypt --domain errong.win --webroot /home/errong_leng/www/blog/system/nginx-root --reloadcmd "nginx -s reload" --accountemail errong.leng@gmail.com --force 2 2 2 * * /home/errong_leng/.acme.sh/ac

Post, Code and Quiet Time. How to address Let's Encrypt renew failure? By Errong Leng – 04 Apr 2023 – View online → Photo by Marek Piwnicki / Unsplash recently certificate for this site somehow got expired. It should got auto renewed. Since I added schedule event manually via crontab, Ghost cli also added one cron event while you run `ghost setup ssl`. I checked via `crontab -e`: 1 1 1 * * /home/errong_leng/.acme.sh/acme.sh --issue --home /etc/letsencrypt --domain errong.win --webroot /home/errong_leng/www/blog/system/nginx-root --reloadcmd "nginx -s reload" --accountemail errong.leng@gmail.com --force 2 2 2 * * /home/errong_leng/.acme.sh/acme.sh --issue --home /etc/letsencrypt --domain coca.errong.win --webroot /home/errong_leng/www/coca --reloadcmd "nginx -s reload" --accountemail errong.leng@gmail.com --force 53 0 * * * "/etc/letsencrypt"/acme.sh --cron --home "/etc/letsencrypt" > /dev/null Then I tried manually run /etc/letsencrypt/acme.sh --home /etc/letsencrypt/ --cron, it did not work due to .well-know/acme-challenge/xxx 404 not found. Acme.sh basic working practice it takes 7 steps: generate new intermediate CA certificate generate /.well-known/acem-challenge/xxx to your server root renew via acme Le API, submit intermediate order to CA verifying the new cert by hitting http://{yourdomain}/.well-known/acem-challenge/xxx path Lets Encrypt finalize the cert once verification pass download the new cert issued by Lets Encrypt CA restart your server For my case, it failed at step 4. My site uses nginx and .well-known path has been allow all in its conf. location ~ /.well-known { allow all; } Then check the /etc/letsencrypt/acme.sh.log, I found the root cause. Let's Encrypt acme.sh was still using the old root path /home/errong_leng/blog/system/nginx-root. In fact, I moved it to /home/errong.leng/blog/system/nginx-root since January. [Tue Apr 4 17:14:52 UTC 2023] _currentRoot='/home/errong_leng/blog/system/nginx-root' [Tue Apr 4 17:14:52 UTC 2023] wellknown_path='/home/errong_leng/blog/system/nginx-root/.well-known/acme-challenge' [Tue Apr 4 17:14:52 UTC 2023] writing token:M5Hp4j3ELNj9t2x76zEF-bOMZzE4ZIVFLHTdm_T3Y5U to /home/errong_leng/blog/system/nginx-root/.well-known/acme-challenge/M5Hp4j3ELNj9t2x76zEF-bOMZzE4ZIVFLHTdm_T3Y5U [Tue Apr 4 17:14:52 UTC 2023] Changing owner/group of .well-known to root:root Where does Let's Encrypt acme.sh read the root path for your server? I thought acme.sh would read the root directive from nginx configuration. below is the nginx ssl conf for my website. No, Let's Encrypt has its own configuration for your domain. I finally figure it out by checking '/etc/letencrypt' home directory. "Le_Webroot" defines the server root for your domain. There was a typo error, so I fixed it and renew again, finally the cert got renewed successfully. I believe I don't need to work about certs ever more. Failed Validation Limit by the way, You should receive the following error message from your ACME client when you’ve exceeded the Failed Validation limit: too many failed authorizations recently: see https://letsencrypt.org/docs/failed-validation-limit/ All issuance requests are subject to a Failed Validation limit of 5 failures per account, per hostname, per hour. To avoid reach failures rate, you can using let's encrypt's staging api to verify your SSL configuration before you set up for prod. In a word, add extra parameter to the acme.sh, --staging --test Failed Validation Limit Description All issuance requests are subject to a Failed Validation limit of 5 failures per account, per hostname, per hour. You should receive the following error message from your ACME client when you’ve exceeded the Failed Validation limit:too many failed authorizations recently: see https://le… Let's Encrypt Knowledge base: Ghost SSL setup The CLI generates a free SSL certificate from Let’s Encrypt using acme.sh and a secondary NGINX config file to serve https traffic via port 443. SSL configuration After a successful ssl setup, you can find your ssl certificate in /etc/letsencrypt. SSL for additional domains You may wish to have multiple domains that redirect to your site, e.g. to have an extra TLD or to support www. domains. Ghost itself can only ever have one domain pointed at it. This is intentional for SEO purposes, however you can always redirect extra domains to your Ghost install using nginx. If you want to redirect an HTTPS domain, you must have a certificate for it. If you want to use Ghost-CLI to generate an extra SSL setup, follow this guide: Post, Code and Quiet Time. © 2023 – Unsubscribe

2023 March Adsense Report

RPM CA$0.31 presenting 583 times. income increase CA0.06$ Only 8 posts published errong.win still wait for reviewing Summary March always has Spring Break for kids. Kids were having fun, they learned swimming, skating and had a tour to sea to sky gondola. The whole family slept late during that period. So not that productivity in March. April, fighting!!!

Post, Code and Quiet Time. 2023 March Adsense Report By Errong Leng – 04 Apr 2023 – View online → Photo by Daniel Seßler / Unsplash RPM CA$0.31 presenting 583 times. income increase CA0.06$ Only 8 posts published errong.win still wait for reviewing Summary March always has Spring Break for kids. Kids were having fun, they learned swimming, skating and had a tour to sea to sky gondola. The whole family slept late during that period. So not that productivity in March. April, fighting!!! Post, Code and Quiet Time. © 2023 – Unsubscribe