Istio Explained - Getting Started with Service Mesh

This popped up on Twitter a short while ago: -

Istio Explained - Getting Started with Service Mesh

Microservices can be complicated and difficult to manage, but with this practical guide, you'll learn how service meshes can help you control interactions between the services in your application. Explore what a service mesh is and how it works using Istio—an open source service mesh for managing and securing microservices.

Istio Explained - Getting Started with Service Mesh

It's a free ebook available from my employer, IBM, written by two colleagues, Lin Sun and Daniel Berg

Enjoy !

Kubernetes - Now the learning really really begins ...

As we hasten towards the end of 2019, my ongoing voyage of discovery that is Kubernetes really really kicks into gear ....

To that end, I've followed a number of useful sources, including: -

Kubernetes on bare-metal in 10 minutes

How to Install and Configure Kubernetes and Docker on Ubuntu 18.04 LTS

Kubernetes Concepts

Quickstart for Calico on Kubernetes

to get a basic four node Kubernetes 1.17 cluster up and running across four Ubuntu VMs.

I'm now starting to play with various aspects of K8s, including labels and taints ...

I also found this to be rather fun: -

What even is a kubelet?

which explained how one can drop a YAML such as this: -

apiVersion: v1
kind: Pod
metadata:
  name: nginx
spec:
  containers:
  - name: nginx
    image: nginx
    ports:
    - containerPort: 80

into here: -

/etc/kubernetes/manifests

and have K8s automagically spin up a pod ( collection of containers ) without fanfare ...

kubectl get pods -A

NAMESPACE     NAME                                            READY   STATUS    RESTARTS   AGE

default       nginx-hatches1.fyre.ibm.com                     1/1     Running   0          13m

kube-system   calico-kube-controllers-74c9747c46-vdp6w        1/1     Running   0          21h

kube-system   calico-node-cf4mb                               0/1     Running   0          21h

kube-system   calico-node-h55m5                               1/1     Running   0          21h

kube-system   calico-node-jdcs5                               1/1     Running   0          21h

kube-system   calico-node-m6c9k                               1/1     Running   0          21h

kube-system   coredns-6955765f44-2gp8k                        1/1     Running   0          22h

kube-system   coredns-6955765f44-rhnww                        1/1     Running   0          22h

kube-system   etcd-hatches1.fyre.ibm.com                      1/1     Running   0          22h

kube-system   kube-apiserver-hatches1.fyre.ibm.com            1/1     Running   0          22h

kube-system   kube-controller-manager-hatches1.fyre.ibm.com   1/1     Running   0          22h

kube-system   kube-proxy-4fxwb                                1/1     Running   0          21h

kube-system   kube-proxy-j6h5z                                1/1     Running   0          21h

kube-system   kube-proxy-tzxrt                                1/1     Running   0          21h

kube-system   kube-proxy-xzzqx                                1/1     Running   0          22h

kube-system   kube-scheduler-hatches1.fyre.ibm.com            1/1     Running   0          22h

which is nice ....

Final thanks to Julia Evans ( @b0rk on Twitter ) for her awesome blog, including: -

A few things I've learned about Kubernetes

A container networking overview

and 'twas she who introduced me to Kamal Marhubi who has written a series of blog posts: -

Kubernetes from the ground up: the API server

Kubernetes from the ground up: the scheduler

and the aforementioned: -

What even is a kubelet?

In case you wondered, I LOVE MY JOB!!!

Now we are live - IBM Cloud Hyper Protect Virtual Server

As mentioned before, this is an adjunct to some work that my team and I are doing right now .....

IBM Cloud Hyper Protect Virtual Server

Summary

Create and run virtual servers on IBM LinuxONE, the industry’s most secure Linux-based platform. With an SSH key pair under your control, you have complete authority over your sensitive workloads.

Features

    Security

    Ability to deploy a Virtual Server in a Secure Service Container ensuring confidentiality of data and code running within the VS

    Z Capabilities on the cloud

    Ability to deploy workload into the most secure, highly performant, Linux virtual server with extreme vertical scale

    Easy to use, open, and flexible

    User experience at parity with market leaders both when buying and using the VS; with the openness and flexibility of a public cloud

    No Z skills required

    Access Z technology without having to purchase, install, and maintain unique hardware

with a set of enablement materials here: -

Getting started tutorial

This just in - RHEL 8.1: A minor release with major new container capabilities

This on the Red Hat Blog: -

The release of Red Hat Enterprise Linux 8.1 is a minor update to RHEL, but a major step forward with containers. The container-tools:rhel8 application stream has been updated with new versions of Podman, Buildah, Skopeo, runc, container selinux policies and other libraries. The core set of base images in Red Hat Universal Base Image (UBI) have been updated to 8.1, and UBI has expanded to include Go 1.11.5 as a developer use case. There are now 37 images released as part of UBI - they can all be seen on the UBI product page. Finally, we have released some really good updated documentation covering rootless, and other new features in the container-tools module.

Now, let’s jump in and cover some major features a bit deeper.

RHEL 8.1: A minor release with major new container capabilities

Off to have a play .....

"WARNING:root:could not open file '/etc/apt/sources.list'"

We saw this: -

WARNING:root:could not open file '/etc/apt/sources.list'

during a complex series of Docker builds.

After a LOT of investigation, we concluded that it was a combination of a slightly malformed /etc/apt/sources.list file AND the use of the add-apt-repository command.

In essence, sources.list was being slightly truncated by a previous build process, meaning that the very last character of the file was NOT a CR/LF, but was some "special character".

The subsequent use of the add-apt-repository in a Dockerfile: -

add-apt-repository "deb [arch=s390x] https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable"

was completely over-writing the sources.list file with the following TWO lines: -

deb [arch=s390x] https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable

# deb-src [arch=s390x] https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable

I've not quite reproduced the problem manually, despite my best efforts with a hex editor ...

However, the TL;DR; of the situation is that malformed lines in sources.list may be the root cause of all sorts of problems .....

IBM Cloud Hyper Protect Virtual Servers

This is, in part, upon what I've been working this past six months or so ....

Glad to see a useful rundown of the services and it's capabilities : -

IBM Cloud Hyper Protect Virtual Servers 

Gain complete authority over workloads with sensitive data or your business IP 

What are IBM Cloud Hyper Protect Virtual Servers?

IBM Cloud™ Hyper Protect Virtual Servers provides complete authority over workloads with sensitive data within a secure virtual server environment. No one, not even cloud admins, can access your workloads.

Built on the security and reliability of the LinuxONE platform, your business IP is protected through data-at-rest and runtime encryption. You can extend and consume on-prem LinuxONE resources in the cloud for faster development, testing and backup, without sacrificing security.

Fun with OpenSSL Certificate Requests and space characters in Subject Names

I've got a command within a Dockerfile that generates a Certificate Service Request, via the openssl req command.

This references an environment variable that contains the required Subject Name: -

export CRT_SUBJ="/C=US/ST=New York/L=Armonk/O=International Business Machines Corporation/CN=securebuildserver"

When I reference this variable in my Dockerfile: -

RUN openssl req -new -x509 -nodes -out server.crt -keyout server.key -subj $CRT_SUBJ

this fails with: -

unknown option York/L=Armonk/O=International
req [options] outfile

Note that it's failing to digest the Subject Name, specifically at the first space character, between New and York.

The solution ?

Wrap the environment variable in double-quotes: -

RUN openssl req -new -x509 -nodes -out server.crt -keyout server.key -subj "$CRT_SUBJ"

which works a treat ......