Today I Learned - IBM Container Registry - Formatting the output ...

Having got into the use of JSON to format the output from various different IBM Cloud CLI tools, using jq and jsonpath as per this example: -

JQ vs jsonpath

However, for reasons known to them, the Container Registry (CR) plugin uses a different mechanism to format output, namely Go templates.

This is well documented here: -

Formatting and filtering the CLI output for IBM Cloud Container Registry commands

So, as an example, if I want to look for images that are greater than 1,000,000 bytes ( 1 Mb ) and wish to display the repository, tag and security status, this is what I'd run: -

ic cr image-list --format "{{ if gt .Size 1000000 }}{{ .Repository }}:{{ .Tag }} {{ .SecurityStatus.Status }}{{end}}"

Similarly, if I want to list all images, regardless of size, but including the namespace: -

ic cr image-list --format "{{ .Repository }}:{{ .Tag }} {{ .Namespace }} {{ .SecurityStatus.Status }}"

The documentation covers the formatting options in WAAAAAY more detail: -

Go template options and data types in the ibmcloud cr image-list command

IBM Cloud - Cleaning things up

I've been looking through my IBM Cloud account, with a view to nuking unwanted / unused components, services, capabilities etc.

Today I'm targeting Cloud Foundry (CF), and, via the web UI, I found that I had a Cloud Foundry Org harking back to 2014, named david_hay@uk.ibm.com which contains a space called dev.

However, I was trying / failing to find / delete it from the command-line.

I ran: -

ic cf spaces

which returned: -

Invoking 'cf spaces'...

Getting spaces in org david_hay@uk.ibm.com as david_hay@uk.ibm.com...

No spaces found.

Similarly, when I tried to delete the dev space: -

ic cf delete-space dev

Invoking 'cf delete-space dev'...

Really delete the space dev? [yN]: y

Deleting space dev in org david_hay@uk.ibm.com as david_hay@uk.ibm.com...

Space 'dev' not found.

FAILED

And then ... looking back at the web UI, I saw: -

Region: US South

and thought "Ah, hah"

From the CLI, I ran: -

ic target 

which reported: -

Region:            eu-gb   

So I switched my region: -

ic target -r us-south

and re-ran: -

ic cf spaces

Invoking 'cf spaces'...

Getting spaces in org david_hay@uk.ibm.com as david_hay@uk.ibm.com...

name

dev

and then: -

ic cf delete-space dev

Invoking 'cf delete-space dev'...

Really delete the space dev? [yN]: y

Deleting space dev in org david_hay@uk.ibm.com as david_hay@uk.ibm.com...

OK

Nice!

Hey Aptitude, where's my disk space gone ?

Whilst upgrading an Ubuntu 20.04.3 LTS box, I hit messages such as: -

...

Ign:25 http://ubuntu.example.net/ubuntu-ports focal-security/universe s390x Packages

Err:27 http://ubuntu.example.net/ubuntu-ports focal-security/universe s390x c-n-f Metadata

  Write error - write (28: No space left on device)

Ign:14 http://ubuntu.example.net/ubuntu-ports focal-updates/universe Translation-en

Get:28 http://ubuntu.example.net/ubuntu-ports focal-security/multiverse s390x Packages [3,232 B]

Get:26 http://ubuntu.example.net/ubuntu-ports focal-security/universe Translation-en [154 kB]

Err:26 http://ubuntu.example.net/ubuntu-ports focal-security/universe Translation-en

  

Err:9 http://ubuntu.example.net/ubuntu-ports focal-updates/main Translation-en

  Write error - write (28: No space left on device)

...

which was somewhat worrying.

I checked my available disk space: -

df -kmh

and noticed that /var was full: -

/dev/mapper/basevg-var   2.9G  2.8G  8.8M 100% /var

Noting that that file-system has 2.9 GB of space, I wanted to see what was eating it: -

du -hs /var/* | sort -h

0 /var/lock

0 /var/run

4.0K /var/local

12K /var/opt

16K /var/lost+found

32K /var/spool

40K /var/tmp

648K /var/mail

2.0M /var/backups

405M /var/log

1.2G /var/lib

1.3G /var/cache

I took a random guess, and assumed that /var/cache was somehow related to Aptitude ( apt ), given the error that I was seeing.

Thankfully, the internet ( as ever ) has the answer: -

How to Clear Apt Cache and Reclaim Precious Disk Space

The trick is to run: -

sudo apt-get clean

Given that I'm already running as root, I ran: -

apt-get clean

which returns nothing but ....

du -hs /var/* | sort -h

0 /var/lock

0 /var/run

4.0K /var/local

12K /var/opt

16K /var/lost+found

32K /var/spool

40K /var/tmp

648K /var/mail

2.0M /var/backups

8.6M /var/cache

405M /var/log

1.2G /var/lib

so /var/cache is now 8.6 MB rather than 1.3 GB, and /var is way smaller: -

df -kmh

/dev/mapper/basevg-var   2.9G  1.6G  1.3G  56% /var

and, perhaps, more importantly, my upgrade runs to completion : -

apt-get update && apt-get upgrade -y

Nice!

Kubernetes - messing about with nodes and taints

I've probably blogged about this before, but, today, I'm tinkering with Kubernetes ( well, OpenShift Container Platform ) nodes, in terms of understanding what taints are applied to what nodes, in order that I can assign pods accordingly.

This command was immensely useful: -

kubectl get nodes -o custom-columns=NAME:.metadata.name,TAINTS:.spec.taints

NAME           TAINTS
192.168.0.4    <none>
192.168.16.4   [map[effect:NoExecute key:dedicated value:transit]]
192.168.20.4   [map[effect:NoExecute key:dedicated value:transit]]
192.168.24.4   [map[effect:NoExecute key:dedicated value:transit]]
192.168.32.4   [map[effect:NoExecute key:dedicated value:edge]]
192.168.36.4   [map[effect:NoExecute key:dedicated value:edge]]
192.168.4.4    <none>
192.168.40.4   [map[effect:NoExecute key:dedicated value:edge]]
192.168.8.4    <none>

with thanks to StackOverflow: -

How can I list the taints on Kubernetes nodes?

The official Kubernetes documentation has much to say about taints: -

Taints and Tolerations

JQ vs jsonpath

Not sure why I'm not doing more with jsonpath but I do admire the elegance and simplicity of this: -

kubectl get service cluster-proxy -n default -o=jsonpath='{.spec.clusterIP}'

as compared to my default muscle memory using jq : -

kubectl get service cluster-proxy -n default --output JSON | jq -r .spec.clusterIP

The jsonpath alternate definitely requires fewer keystrokes AND doesn't require me to install jq 

Although, to be honest, I'm not going to stop using jq for all my other JSON wrangling ....

TIL: Logging into RedHat OpenShift Container Platform using an API key

So I've been logging into various OpenShift Container Platform (OCP) clusters for the longest time now, mostly using an API key.

To facilitate this, I have an alias in my current shell ( I'm using macOS 12.1 and mainly live in Terminal ) that parses a JSON document containing said API key and pulls it out: -

alias apikey='export APIKEY=$(cat ~/key_file_production.json | jq -r .apikey) && echo $APIKEY'

Now this handily dumps the result of the operation out to the screen - which can be problematic.

Therefore, wouldn't it be nice if I could use that alias inside another command when I login to my cluster ?

Well, I can: -

oc login -u apikey -p $(apikey)

Login successful.

You have access to 68 projects, the list has been suppressed. You can list all projects with 'oc projects'

Using project "default".

Now I could've combined the two things together: -

oc login -u apikey -p $(cat ~/key_file_production.json | jq -r .apikey)

Login successful.

You have access to 68 projects, the list has been suppressed. You can list all projects with 'oc projects'

Using project "default".

which is way more typing ...

Unless I create another alias ...

code ~/.bash_profile 

...

alias oclogin='oc login -u apikey -p $(cat ~/key_file_production.json | jq -r .apikey)'

...

source ~/.bash_profile

and now I have this: -

oclogin 

Login successful.

You have access to 68 projects, the list has been suppressed. You can list all projects with 'oc projects'

Using project "default".

I love my shell!!!

TIL: Tracing IBM Cloud CLI

For no particular reason, I've "discovered" how to trace the IBM Cloud Command Line Interface (CLI) tool, which is useful.

I'm mainly running on macOS and Linux and, in both cases, I can trace the CLI by setting the variable IBMCLOUD_TRACE to true: -

export IBMCLOUD_TRACE=true

and now I see the HTTP request and response headers: -

ic plugin list

Listing installed plug-ins...

REQUEST: [2022-01-07T12:56:22Z]

GET /ibm-cloud-cli-plugin-metadata/bluemix-repo-index.yml HTTP/1.1

Host: download.clis.cloud.ibm.com

Accept: application/json

Accept-Language: en-US

Accept-Language: en

Content-Type: application/json

User-Agent: IBM Cloud CLI 2.3.0 / darwin

RESPONSE: [2022-01-07T12:56:24Z] Elapsed: 1618ms

HTTP/1.1 200 OK

Content-Length: 666352

Accept-Ranges: bytes

Connection: keep-alive

Content-Type: binary/octet-stream

Date: Fri, 07 Jan 2022 12:56:24 GMT

Etag: "863b7cd704c756d503a86834edab6709"

Last-Modified: Thu, 06 Jan 2022 15:15:24 GMT

Server: Cleversafe

X-Amz-Request-Id: c96d5071-20db-485e-9245-4ffb4b52e66b

X-Clv-Request-Id: c96d5071-20db-485e-9245-4ffb4b52e66b

X-Clv-S3-Version: 2.5

[SKIP BINARY OCTET-STREAM CONTENT]

Plugin Name                                  Version   Status             Private endpoints supported   

container-service[kubernetes-service]        1.0.353                      false   

key-protect                                  0.6.9                        true   

logging                                      0.0.8                        false   

sdk-gen                                      0.1.12                       false   

vpc-infrastructure[infrastructure-service]   2.1.0                        true   

cloud-functions[wsk/functions/fn]            1.0.56    Update Available   false   

cloud-object-storage                         1.3.1                        false   

container-registry                           0.1.553   Update Available   true   

which is nice

And now to update my plugins: -

ic plugin update