Comments from Taiga #234

Stephen Snow 03 Feb 2021 05:10
Hello *ashutoshbhakare ,
How are you coming along with this article? Can we anticipate a time?

Paul W. Frields 16 Dec 2020 05:15
One thing I would recommend with this article: Let's not cover CentOS 8, for two reasons: (1) this is the Fedora Magazine, not the CentOS Magazine. (2) With the recent announcements about CentOS 8, it would be preferable for us not to invite trolling in comments about CentOS.

Ashutosh Sudhakar Bhakare 01 Dec 2020 08:23
*jakfrost Thanks for understanding, will try my best to complete soon

Stephen Snow 30 Nov 2020 06:39
Hello *ashutoshbhakare ,

That's a great idea! Take all the time you need to rewrite. If you can't make it for this Wednesday, don't fret over it. Just move the card to review when you're ready.

Ashutosh Sudhakar Bhakare 30 Nov 2020 06:10
Hello All, Considering all the aspects and suggestions, I am going to rewrite this article on Fedora 33 with SElinux enabled ;) Pls allow me time till Wednesday . Thanks in Advance

Stephen Snow 26 Nov 2020 09:16
Hello,

sorry for any confusion for my part. We have scheduled posts for Monday and Wednesday of next week, this means you have more time to make your changes to have it ready for review next Wednesday. I'm sure once those small changes are done we will be ready to edit then publish it. Let me know here if you want me to look it over before then.

Ashutosh Sudhakar Bhakare 26 Nov 2020 08:19
*jakfrost - Hello, Will do till Monday, Some confusion was in the previous discussions. Thanks

Stephen Snow 23 Nov 2020 07:24
Hello,

You haven't changed the article yet to reflect the changes I requested. I am moving this back to in progress until those changes are made. Once complete you may move the card back to in review with an updated preview link to the changed post. The editorial board will review it if it is ready this coming Wednesday. Thank you for your patience with this.

Ashutosh Sudhakar Bhakare 22 Nov 2020 20:40
*jakfrost Yes Noted :) Many Thanks

Stephen Snow 21 Nov 2020 10:32
Well, as I was saying with one of my comments here, this is a Fedora Magazine blog. As such the preference is to use Fedora, especially for howto's etc… In the future it would be best to make an effort to have more than a superficial tie-in to Fedora.

_Ashutosh Sudhakar Bhakare 20 Nov 2020 21:46
Edited:20 Nov 2020 21:47-View historic

*jakfrost Yes will make sure, going forward will use Release 8 for any type of article idea. Thanks for Update :)

Stephen Snow 20 Nov 2020 07:55
Hello,

This article is scheduled to be published on Monday November 23. How are the changes coming (ie using CentOS v 8 and SELinux=enforcing?

Stephen Snow 19 Nov 2020 06:26

Definitely the Fedora Magazine likes to see content relevant to Fedora specific. Though this is not always possible with some topics, it is possible to use crio on Fedora editions. Having said all of that, it is generally easy to use the same techniques (mostly) on CentOS as used on Fedora for achieving the desired results. If you wish to base the article on CentOS, please do use release 8 since it is the latest and EOL is 2029. The SELinux enabled approach is certainly the only way to proceed, we don't want to present information that potentially can compromise someone's system simply by trying your howto.

Ashutosh Sudhakar Bhakare 18 Nov 2020 22:49
*jakfrost - Will take care of selinux with enabled state. I can write it for CENTOS8 as well, do you want me to stick to fedora only ?

Stephen Snow 18 Nov 2020 07:31
Hello Ashutosh,

I have a couple of recommendations I would like to see with this article. First is SELinux, there is no apparent reason to disable or set SELinux to permissive, and pointedly in Fedora it is considered taboo. Second, the article is using CentOS 7 for running Kubernetes on which is pretty old. Also, with Kubernetes, setting up ther master is the first of what 4 or 5 steps in the process. Finally, what is the Fedora tie in?

Ashutosh Sudhakar Bhakare 16 Nov 2020 19:49
*jakfrost - Thanks for update :)

Stephen Snow 16 Nov 2020 06:28
Hello,

Thank you for completing the article. This Wednesday is the next editorial board meeting and it will be reviewed then. If the editors find it needs some more work they may place it back into in progress with a comment/comments about what they think it needs. If it is complete but merely needs some editing, then it will be assigned an editor and elevated to the status of editing. At which point the chosen editor may or may not contact you about minor changes. Thank you for your patience.

Ashutosh Sudhakar Bhakare 12 Nov 2020 00:53
Hello All, My article is ready for review, It would be great if you can check and let me know if any correction or changes required. https://fedoramagazine.org/?p=31934&preview=true&preview_id=31934 Thanks Ashutosh

Ashutosh Sudhakar Bhakare 07 Nov 2020 21:51
*jakfrost Due to some personal issues i was not able to update on this. Will complete it till 12-Nov for sure. Thanks

Ashutosh Sudhakar Bhakare 07 Nov 2020 21:12
*stickster Sorry i was not able to update, i am planning to complete this article till 12-Nov. Hope this is ok ? Please accept my apologies for late replies

Stephen Snow 21 Oct 2020 07:38
Agreed.

Paul W. Frields 21 Oct 2020 05:18
*jakfrost I recommend this go back to the Article Spec status, since no contact back to this point.

Stephen Snow 19 Oct 2020 06:55
*ashutoshbhakare ,

I was wondering if you have made any progress on this? It is an interesting topic.

Paul W. Frields 30 Sep 2020 05:21
*ashutoshbhakare Are you planning to work on this article? Please let us know, thanks. If you can't get to this in the next week, we should consider moving this back to Article Spec status.

This is an awesome pitch. I look forward to reading the article.

@ashutoshbhakare I notice that there is now an article in WorkPress at https://fedoramagazine.org/?p=31934&preview=true and it appears you have been doing some work on it.

Another author has expressed interest in working on a similar article. If you are still planning on this article being published I will let them know you are still working on it. They indicate that they have other idea.

Please let us know your status and plans. If/when you have the article ready for review, please let us know by leaving a note here on this card indicating that status.

Thanks.

@rlengland Hello Richard, Yes i was planing to write the same. And after k8s is launched with the latest 1.24 version it looks like easy to write the same in details. If you can allow me 2 weeks of time max , i can complete the same .
Thanks
Ashutosh

Ashutosh,
Thanks for the quick response. That sounds great. We'll be looking forward to your article.

@ashutoshbhakare: Are you still working on this article?

@ashutoshbhakare: Are you still working on this article?

Do you have a status update on this artice @ashutoshbhakare ?

I notice that it indicates you are using CENTOS 7. Since this is the Fedora Magazine it would be much better if it addressed the Fedora user base.

@ashutoshbhakare Do you have update on the status of this article? if not, i would like to move it to the "stalled" category. It can be continued at any time, this will only mean the editors will not need to track it.

Thanks for your input.

Hi @rlengland , could I give this a try?

@romangherta I would tentatively say yes to having you continue with this article but using Fedora rather than CENTOS.

I think it only fair, however, if we get agreement from @ashutoshbhakare Perhaps a collaborative effort on the final article?

@rlengland Understood, thanks for updating the bulletpoints, I'll write a draft and if @ashutoshbhakare has time to review we can discuss then.

Hi @rlengland I wrote a draft here, tried to keep it as short as possible but it was a challenge.

https://fedoramagazine.org/?p=39038&preview=true&preview_id=39038

I reached out to @ashutoshbhakare without success. I sincerely hope he is somewhere on a beach sipping a martini and enjoying a well deserved vacation.

@buckaroogeek
Brad I am tagging you here, thank you for properly maintaining the packages, I had no issues installing and running kubernetes other than latest changes with swap/dns and it was a challenge to properly configure kubelet via kubeadm with the correct configuration.

There is a separate discussion about selinux.. there is a separate discussion about kata-containers... The draft seems too long as it is. Let me know your thoughts.

Roman - I will be glad to review and comment. Probably tomorrow.

Best regards

Brad

On Wed, Nov 1, 2023 at 2:29=E2=80=AFPM Roman Gherta pagure@pagure.io wrot=
e:

romangherta added a new comment to an issue you are following:
``
Hi @rlengland I wrote a draft here, tried to keep it as short as possible=
but it was a challenge.

https://fedoramagazine.org/?p=3D39038&preview=3Dtrue&preview_id=3D39038

I reached out to @ashutoshbhakare without success. I sincerely hope he is=
somewhere on a beach sipping a martini and enjoying a well deserved vacati=
on.

@buckaroogeek
Brad I am tagging you here, thank you for properly maintaining the packag=
es, I had no issues installing and running kubernetes other than latest cha=
nges with swap/dns and it was a challenge to properly configure kubelet via=
kubeadm with the correct configuration.

There is a separate discussion about selinux.. there is a separate discus=
sion about kata-containers... The draft seems too long as it is. Let me kno=
w your thoughts.
``

To reply, visit the link below or just reply to this email
https://pagure.io/fedora-magazine-newsroom/issue/33

Roman - I might also mention that I have a quick doc for kubernetes on
fedora in review (still a pull request).

The PR is at https://pagure.io/fedora-docs/quick-docs/pull-request/645

all the best

On Wed, Nov 1, 2023 at 2:29=E2=80=AFPM Roman Gherta pagure@pagure.io wrot=
e:

romangherta added a new comment to an issue you are following:
``
Hi @rlengland I wrote a draft here, tried to keep it as short as possible=
but it was a challenge.

https://fedoramagazine.org/?p=3D39038&preview=3Dtrue&preview_id=3D39038

I reached out to @ashutoshbhakare without success. I sincerely hope he is=
somewhere on a beach sipping a martini and enjoying a well deserved vacati=
on.

@buckaroogeek
Brad I am tagging you here, thank you for properly maintaining the packag=
es, I had no issues installing and running kubernetes other than latest cha=
nges with swap/dns and it was a challenge to properly configure kubelet via=
kubeadm with the correct configuration.

There is a separate discussion about selinux.. there is a separate discus=
sion about kata-containers... The draft seems too long as it is. Let me kno=
w your thoughts.
``

To reply, visit the link below or just reply to this email
https://pagure.io/fedora-magazine-newsroom/issue/33

There is a separate discussion about selinux..

Yeah, starting the article off with sudo setenforce 0 is not great. Is there something even a little less drastic that would work? E.g., maybe sudo semanage permissive -a container_t? That's just a guess; I've never messed with Kubernetes. For appearances sake, It'd also be good if that command (or whatever variant of it you can come up with that actually works) could be moved closer to whatever it is that actually needs it rather than having it as "step 1". It would also be good to undo the command (e.g. sudo semanage permissive -d container_t) as soon as it is no longer needed.

Thanks.

Hi @glb thank you for the guidelines. You know I put it temporarily in permissive mode and at the end I could not see any errors in AVC. I will redo everything with enforcing mode. You can notice we already label the new crio configuration files with container_config_t . Give me one or two days to re-test and address a little bit of selinux container context as far as I can.

I am getting a 404 response to the preview link.

brad

I am getting a 404 response to the preview link.

brad

Found it after logging into magazine dashboard.

Where is the best place for comments and suggestions? The original discussion link?

Hi Brad @buckaroogeek
I don't know, I am new here. I see there is also a discussion board on the wordpress page. Whatever suits you, I do not mind.

Where is the best place for comments and suggestions? The original discussion link?

Either place is fine. This area is meant to be to communicate with the editors and let them know that status of the article. If you want feedback from the general community, the discussion board is the better place.

@glb - thanks. I will start here. @romangherta - Roman thanks for asking for comments.

First, as general background there is an approved change for F40 which will alter the structure of kubernetes rpms. For F39 and earlier releases, 'sudo dnf install kubernetes-node kubernetes-kubeadm kubernetes-client' achieve the goal of the article. For F40 and later, 'sudo dnf install kubernetes kubernetes-client' will suffice.

Second, modules are going away for Fedora (F40 I think) so the instructions for cri-o will become moot. As an offset, there is a default version of cri-o in each Fedora release that version matches the version of kubernetes in that release. So for F38 sudo dnf install kubernetes-client kubernetes-kubeadm kubernetes-node cri-o' should just work.

Third, I have not needed to so anything with selinux in recent versions of fedora. Kubernetes seems to just work fine. There might be instances when specific application deployments trigger an selinux alert but in my limited experience that has not happened.

In an earlier post I refer to a draft quick doc (waiting for someone to review, edit and merge) that covers some of the same ground. If that gets through the process in a timely manner then it could potentially be referenced and overlapping content shortened or removed as deemed appropriate.

Interestingly, the prior maintainers for kubernetes in fedora had included a kubeadm flag to ignore the swap check; that flag is still there.

I like the idea of a new fedora magazine article on kubernetes. One that focuses on F38, F39 would be useful and then as F40 approaches another one updated to reflect changes?

Thanks for the heads up that there are significant changes in the pipeline. That being the case, I would recommend that the version of Fedora Linux the article applies to be strongly emphasized. It would also be good to add "... for Fedora Linux 39" to the title of the article so people will quickly be able to see which link to click on when they run Google searches (assuming you are going to publish one for F39).

Thanks!

Thank you both for the feedback, I will add the selinux part and will test again on fedora 39. Good reason to read the F40 changeset as well... I will update the draft in one or two days.

@romangherta Any change of status for this article?

Hi @rlengland sory for the delay, started a new project and a few days trasformed into a few weeks. I will get back with an update tomorrow as today is already late.

Hi @rlengland sory for the delay, started a new project and a few days trasformed into a few weeks. I will get back with an update tomorrow as today is already late.

I understand how that happens. Thanks for the update. We'll look forward to your "alert"!

Good evening, I did a small update to the draft, some kubelet arguments I forgot about... like --max-pods which is the number of maximum pods the kubelet should support and this is independent of the cidr size and has a default value of 100 which should be too small for bare metal setups.

Tried to make a sample container run in userspace but I am probably missing some configuration. Since crio has support for user namespaces and latest fedora has this kernel feature enabled, I think it would be an addition to the security argument since the article is supposed to be focused on crio.

As for SELinux, I started but I encountered some issues. Labelling files and ports is enough but if I use the same generic container label, this would mean that all containers would be able to access each others data. And this is where I am still reading at least to understand how to better explain this and make a small example.

I think I will work on these 2 points : userspace and selinux in the following few days. I will get back with an update at that point.

@romangherta That sounds good. We will await your update.
Take care.

Good evening, a small update

From the last chapter on security I finished writing the "containers in userns" paragraph although I realize I need to test again. CRI-O is very thin on documentation.

https://fedoramagazine.org/?p=39038&preview=true&preview_id=39038

As of now SELinux is the only unfinished paragraph, I will work on this in the following days...

As an FYI. the kubernetes quick doc is now live. I will be glad to adjust so that the content is aligned (or at least not contradicting :) ) this article.

https://docs.fedoraproject.org/en-US/quick-docs/using-kubernetes/

Hi @buckaroogeek thank you, it looks great and I will reference these docs in the article. Maybe writing articles was not a good first start for me at fedora but I would like to see this one through at least.

I am starting to follow your thought on loking kubernetes to fedora version... This eliminates the need for kubeadm. In some discussions about kubernetes an argument against fedora was that the OS is not stable enough, it changes too quickly. But hey, kubernetes is changes fast too. So there is the need to update easily and often both the os and the kubernetes packages to account for patches and latest features.

I like it and if the project goes in that direction it would be great. But for this version 39 installing manually the control plane components would be a nightmare and I am afraid would make things confusing and hard to follow. A lot of people just want to deploy a cluster with a few simple commands and understand some security considerations that will be useful when talking for example to a systems administrator making a case for kubernetes....

I will be back with an update these days, thank you for checking on this.

Good afternoon.... I tried to elaborate the security heading as best as I could... after re-reading some selinux docs I renamed the subchapter DAC and MAC. I had to rewrite a lot so I hope I did not make a logical mess... Please take a look and let me know if eveyrthing is ok. You can feel free to rewrite and adapt as you see fit.

Hi Roman:

I've finished editing your article. The SEO algorithm is still giving your article a poor readability score due to the passive voice. I edited the wording a bit in a few of the sentences to try to make it happy, but I was not successful. I wouldn't worry too much about it. Please double-check the changes I have made and feel free to undo/redo my changes if you want. If you are happy with the article, we can send it out on Wednesday.

Thanks for your contribution!

Looks good to me, Thank you for the time taken to correct my mistakes and for pointing out some issues in my firewalld commands. And I adapted some commands according to @buckaroogeek quickdocs (zram etc)

No wories about SEO. I think enough people will find the article just by searchign for Kubernetes with Fedora or Kubernetes with SELinux. I know I did my share of search on this matter.

Btw I tried reaching Ashutosh via the fedora email a few weeks ago but I was not successful. Probably daily life, work and family. Still a good idea for an article....

You're welcome. I was just doing a last-minute spot-check before scheduling the article and I think I might have spotted a small mistake in the article:

Controller Manager property --node-cidr-mask defines the size of this range.

Should that be ‐‐node-cidr-mask-size?

Yes you are right, in the above configuration file I used the correct one

apiVersion: kubeadm.k8s.io/v1beta3
kind: ClusterConfiguration
kubernetesVersion: "1.27.0"
networking:
podSubnet: "10.32.0.0/16"
serviceSubnet: "172.168.16.0/22"
controllerManager:
extraArgs:
node-cidr-mask-size: "20"
allocate-node-cidrs: "true"

And the extra args are the same as the controller-manager parameters ( https://kubernetes.io/docs/reference/command-line-tools-reference/kube-controller-manager/ ) but without the leading dashes... I must have mistaken when I wrote manually below the configuration.

What is interesting is that if you note the above configuration api version is in beta state... And a lot of kubeadm command line arguments are flagged as deprecated. So it seems like they are still changing the api and while I like this declarative way of passing the cluster wide and node local configuration, I did not find a comprehensive step by step tutorial explaining how to use these kubeadm configuration files and this is why I insisted on this approach because it seems this is the direction into which kubeadm is moving.

I just corrected this, thank you

Excellent! The post has been scheduled: https://fedoramagazine.org/kubernetes-with-cri-o-on-fedora-linux-39/

Note that now that it has been scheduled, you will not be able to make further revisions to it directly. But it is trivial to unschedule it if you discover that something needs to be revised. Or you can leave a comment here to request that an editor make the revision.

Thanks!

Hey Roman:

I just noticed another small problem in your article -- 172.168.16.0/22 is not in the IANA designated range of addresses for private use (https://www.arin.net/reference/research/statistics/address_filters/). Would you mind if I changed that to 172.16.16.0/22?

Of course, feel free to edit. I think this was the service cidr and there are not a lot of places mentioning it. It could be one or two console output blocks as well. Thanks for reminding me the correct cidr, it's been a while. If it's too many places let me know and I can edit it.

I've fixed it. I only saw it used in five places, but you might want to double-check yourself to make sure everything is still correct.

Thanks,
gb