AskOverflow.Dev

AskOverflow.Dev Logo AskOverflow.Dev Logo

AskOverflow.Dev Navigation

  • 主页
  • 系统&网络
  • Ubuntu
  • Unix
  • DBA
  • Computer
  • Coding
  • LangChain

Mobile menu

Close
  • 主页
  • 系统&网络
    • 最新
    • 热门
    • 标签
  • Ubuntu
    • 最新
    • 热门
    • 标签
  • Unix
    • 最新
    • 标签
  • DBA
    • 最新
    • 标签
  • Computer
    • 最新
    • 标签
  • Coding
    • 最新
    • 标签
主页 / user-137203

Anadi Misra's questions

Martin Hope
Anadi Misra
Asked: 2021-07-24 02:26:38 +0800 CST

即使在 fargate 配置文件补丁之后,coredns 部署也无法查找节点

  • 1

安装 fargate 配置文件和 coreddns 插件的问题;我将 terraform 用于某些部分,而kubetctl对于其他部分,fargate 配置文件是通过 terraform 创建的:

fargate_profiles = {
  kube-system-profile = {
    name = "kube-system-profile"
    selectors = [
      {
        namespace = "kube-system"
        labels = {
          name = "kube-system"
          k8s-app = "kube-dns"
        }
      }
    ]
    tags = {
      Cost = "DaCost"
      Environment = "dev"
      Name = "coredns-fargate-profile"
    }
  },
  swiftalk-dev-profile = {
    name = "dev-profile"
    selectors = [
      {
        namespace = "dev"
        labels = {
          name = "dev"
        }
      }
    ]
    tags = {
      Cost = "DaCost"
      Environment = "dev"
      Name = "dev-profile"
    }
  },
}

然后我使用 terraform 再次安装 coredns 插件

resource "aws_eks_addon" "core_dns" {
  addon_name        = "coredns"
  addon_version     = "v1.8.3-eksbuild.1"
  cluster_name      = "${var.eks_cluster_name}-dev"
  resolve_conflicts = "OVERWRITE"
  tags              = { "eks_addon" = "coredns", name = "kube-system" }
  depends_on        = [kubernetes_namespace.dev]
}

我修补了 fargate 的 coredns 部署

kubectl patch deployment coredns \
  --namespace kube-system \
  --type=json \
  -p='[{"op": "remove", "path": "/spec/template/metadata/annotations/eks.amazonaws.com~1compute-type"}]'

然后重新启动

kubectl rollout restart -n kube-system deployment/coredns

但是,coredns pod 仍处于待处理状态

kubectl get pods -n kube-system
NAME                      READY   STATUS    RESTARTS   AGE
coredns-5766d4545-g6nxn   0/1     Pending   0          46m
coredns-5766d4545-xng48   0/1     Pending   0          46m
coredns-b744fccf4-hb726   0/1     Pending   0          77m

云监视日志指出 Pod 正在寻找要部署的节点,而不是fargate

I0723 10:24:38.059960       1 factory.go:319] "Unable to schedule pod; no nodes are registered to the cluster; waiting" pod="kube-system/coredns-b744fccf4-hb726"
I0723 10:24:38.060078       1 factory.go:319] "Unable to schedule pod; no nodes are registered to the cluster; waiting" pod="kube-system/coredns-5766d4545-xng48"
kubernetes terraform aws-fargate amazon-eks
  • 1 个回答
  • 1238 Views
Martin Hope
Anadi Misra
Asked: 2020-10-22 21:15:28 +0800 CST

即使 IAM 用户作为 S3FullAccess 策略,也无法删除 S3 存储桶

  • 0

我无法从使用虚拟 MFA 设备配置文件的 IAM 用户账户中删除存储桶

我已经生成了会话 toekns 并将其添加到文件profile部分~/.aws/credentials。并将配置文件配置添加到~/.aws/config文件中

❯ cat config
[default]
output = json
region = us-east-1
[mfa]
output = json
region = us-east-1

和

[default]
aws_access_key_id = XXXXXXXXXXXXXXXXXXXXX
aws_secret_access_key = XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
[mfa]
aws_access_key_id = XXXXXXXXXXXXXXXXXXXXX
aws_secret_access_key = XXXXXXXXXXXXXXXXXXXXX
aws_session_token = XXXXXXXXXXXXXXXXXXXXX

当我运行命令删除此存储桶时(它是空的)

❯ aws s3 rm s3://iac-bucket --recursive --region us-east-1 --endpoint-url https://s3.us-east-1.amazonaws.com --profile mfa
fatal error: An error occurred (AccessDenied) when calling the ListObjectsV2 operation: Access Denied

此外,存储桶不会显示在管理控制台中,也不会显示在ls命令中

❯ aws s3 mb s3://iac-bucket --profile mfa

没有输出,并且

❯ aws s3 ls s3://iac-bucket --profile mfa --region us-east-1 --endpoint-url https://s3.us-east-1.amazonaws.com

An error occurred (AccessDenied) when calling the ListObjectsV2 operation: Access Denied

我通过一个组将以下策略附加到该用户

通过组附加的 AWS 策略

如何删除此存储桶?为什么它根本不显示?我知道它的存在是因为

❯ aws s3 mb s3://iac-bucket --profile mfa --region us-east-1 --endpoint-url https://s3.us-east-1.amazonaws.com
make_bucket failed: s3://iac-bucket An error occurred (BucketAlreadyExists) when calling the CreateBucket operation: The requested bucket name is not available. The bucket namespace is shared by all users of the system. Please select a different name and try again.
amazon-web-services aws-cli
  • 1 个回答
  • 675 Views
Martin Hope
Anadi Misra
Asked: 2020-05-19 04:57:10 +0800 CST

为上游应用程序配置代理通行证时出错

  • 0

我有一个应用程序作为映射到端口 8080 的 docker 容器运行;在同一台服务器上,我还配置了 nginx 以服务于 Laravel 应用程序,该应用程序具有一些api位于上下文根目录https://example.com/api/news的 URL。docker 应用程序 URL 以一个web/或多个开头,api/以避免 URL 代理混淆我试图为所有 docker 容器应用程序/comments上下文路径提供服务,因此 Laravel 请求继续来自host/api和 docker app URLhost/comments/api等。我在配置中有以下位置(按照描述的顺序这里)

upstream remark42 {
    server 127.0.0.1:8080 weight=100 max_fails=5 fail_timeout=5;
}

server {
    listen 80;
    server_name www.example.com;
    return 301 https://$server_name$request_uri;
}

server {
    listen 443 ssl http2;
    access_log /var/www/example.com/storage/logs/access.log;
    error_log /var/www/example.com/storage/logs/error.log;

    ssl_certificate /etc/nginx/ssl/example_com_chain.crt;
    ssl_certificate_key /etc/nginx/ssl/example_com.key;

    root /var/www/example.com/public/;
    index index.php index.html index.htm;

    location ~ \.php$ {
        try_files $uri =404;
        fastcgi_split_path_info ^(.+\.php)(/.+)$;
        fastcgi_pass    unix:/run/php/php7.4-fpm.sock;
        fastcgi_index   index.php;
        fastcgi_param   SCRIPT_FILENAME $document_root$fastcgi_script_name;
        fastcgi_param   APP_ENV  production;
        include         fastcgi_params;
    }

    location /comments {
        proxy_set_header X-Forwarded-Host $host;
        proxy_set_header X-Forwarded-Server $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto https;
        rewrite ^/comments(.*) /$1 break;
        proxy_pass http://remark42/;
    }

    location ~* \.(?:css|js)$ {
        access_log        on;
        etag              on;
        if_modified_since exact;
        add_header Pragma "public";
        add_header        Cache-Control "max-age=31557600, public, must-revalidate, proxy-revalidate";
    }

然后在文件末尾

location / {
  try_files $uri $uri/ /index.php?$args;
}

我在访问时收到 404 错误https://www.example.com/comments/web/embed.js或https://www.example.com/comments/api/v1/user?blah

JS文件在日志中给出以下错误

2020/05/18 18:05:54 [error] 3047#3047: *5035 open() "/var/www/example.com/public/comments/web/last-comments.js" failed (2: No such file or directory), client: 49.207.48.221, server: , request: "GET /comments/web/last-comments.js HTTP/2.0", host: "www.example.com", referrer: "https://www.example.com/blogs/yet-another-svn-change-log-tool"

所以代理通行证不起作用,它会尝试从磁盘获取 js 文件。

nginx
  • 2 个回答
  • 195 Views
Martin Hope
Anadi Misra
Asked: 2012-12-06 05:48:22 +0800 CST

passenger(mod_rails) 无法在 nginx 下启动 puppet master

  • 3

在服务器上

[root@bangvmpllDA02 logs]# ruby -v
ruby 1.8.7 (2011-06-30 patchlevel 352) [x86_64-linux]

[root@bangvmpllDA02 logs]# puppet --version
3.0.1

和

[root@bangvmpllDA02 logs]# service nginx configtest
nginx: the configuration file /apps/nginx/nginx.conf syntax is ok
nginx: configuration file /apps/nginx/nginx.conf test is successful
[root@bangvmpllDA02 logs]# service nginx status
nginx (pid 25923 25921 25920 25917 25908) is running...
[root@bangvmpllDA02 logs]# 

但是我的代理人都无法连接到主服务器,它们都失败并出现这样的错误

[amisr1@blramisr195602 ~]$ puppet agent --test --verbose --server bangvmpllda02.XXX.com
Info: Creating a new SSL certificate request for blramisr195602.XXX.com
Info: Certificate Request fingerprint (SHA256): 26:EB:08:1F:82:32:E4:03:7A:64:8E:30:A3:99:93:26:E6:66:B9:B0:49:B6:08:F9:67:CA:1B:0C:00:B9:1D:41
Error: Could not request certificate: Error 405 on SERVER: <html>
<head><title>405 Not Allowed</title></head>
<body bgcolor="white">
<center><h1>405 Not Allowed</h1></center>
<hr><center>nginx</center>
</body>
</html>

Exiting; failed to retrieve certificate and waitforcert is disabled

当我检查木偶大师的日志时

[root@bangvmpllDA02 logs]# tail puppet_access.log
[05/Dec/2012:17:45:18 +0530] "GET /production/certificate/ca? HTTP/1.1" 404 162 "-" "Ruby"
[05/Dec/2012:18:32:23 +0530] "PUT /production/certificate_request/sl63anadi.XXX.com HTTP/1.1" 405 166 "-" "-"
[05/Dec/2012:18:33:33 +0530] "GET /production/certificate/sl63anadi.XXX.com? HTTP/1.1" 404 162 "-" "-"
[05/Dec/2012:18:33:33 +0530] "GET /production/certificate_request/sl63anadi.XXX.com? HTTP/1.1" 404 162 "-" "-"
[05/Dec/2012:18:33:33 +0530] "PUT /production/certificate_request/sl63anadi.XXX.com HTTP/1.1" 405 166 "-" "-"

并且错误日志显示 nginx 并不能很好地处理请求

2012/12/05 18:33:33 [error] 25920#0: *23 open() "/etc/puppet/rack/public/production/certificate/sl63anadi.XXX.com" failed (2: No such file or directory), client: 10.209.47.26, server: , request: "GET /production/certificate/sl63anadi.XXX.com? HTTP/1.1", host: "bangvmpllda02.XXX.com:8140"
2012/12/05 18:33:33 [error] 25920#0: *24 open() "/etc/puppet/rack/public/production/certificate_request/sl63anadi.XXX.com" failed (2: No such file or directory), client: 10.209.47.26, server: , request: "GET /production/certificate_request/sl63anadi.XXX.com? HTTP/1.1", host: "bangvmpllda02.XXX.com:8140"
2012/12/05 18:47:56 [error] 25923#0: *27 open() "/etc/puppet/rack/public/production/certificate/ca" failed (2: No such file or directory), client: 10.209.47.31, server: , request: "GET /production/certificate/ca? HTTP/1.1", host: "bangvmpllda02.XXX.com:8140"
2012/12/05 18:47:56 [error] 25923#0: *28 open() "/etc/puppet/rack/public/production/certificate_request/blramisr195602.XXX.com" failed (2: No such file or directory), client: 10.209.47.31, server: , request: "GET /production/certificate_request/blramisr195602.XXX.com? HTTP/1.1", host: "bangvmpllda02.XXX.com:8140"

乘客也没有显示任何应用程序组

[root@bangvmpllDA02 nginx]# passenger-status 
----------- General information -----------
max      = 15
count    = 0
active   = 0
inactive = 0
Waiting on global queue: 0

----------- Application groups -----------
[root@bangvmpllDA02 nginx]#

这是我的 nginx 配置

[root@bangvmpllDA02 logs]# cat ../nginx.conf

user  puppet;
worker_processes  4;

#error_log  logs/error.log;
#error_log  logs/error.log  notice;
error_log  logs/error.log  info;

#pid        logs/nginx.pid;


events {
    use epoll;
    worker_connections  1024;
}


    http {
        include       mime.types;
        default_type  application/octet-stream;

        log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                          '$status $body_bytes_sent "$http_referer" '
                          '"$http_user_agent" "$http_x_forwarded_for"';

        access_log  logs/access.log  main;

        sendfile        on;
        #tcp_nopush     on;
        server_tokens off;
        #keepalive_timeout  0;
        keepalive_timeout  120;

        gzip  on;
        gzip_http_version 1.1;
        gzip_disable "msie6";
        gzip_vary on;
        gzip_min_length 1100;
        gzip_buffers 64 8k;
        gzip_comp_level 3;
        gzip_proxied any;
        gzip_types text/plain text/css application/x-javascript text/xml application/xml;

        server {
            listen       80;
            server_name  bangvmpllda02.XXXX.com;

            charset utf-8;

            #access_log  logs/http.access.log  main;

            location / {
                root   html;
                index  index.html index.htm index.php;
            }

            #error_page  404              /404.html;

            # redirect server error pages to the static page /50x.html
            #
            error_page   500 502 503 504  /50x.html;
            location = /50x.html {
                root   html;
            }

            # proxy the PHP scripts to Apache listening on 127.0.0.1:80
            #
            #location ~ \.php$ {
            #    proxy_pass   http://127.0.0.1;
            #}

            # pass the PHP scripts to FastCGI server listening on 127.0.0.1:9000
            #
            location ~ \.php$ {
                root           html;
                fastcgi_pass   unix:/var/run/php-fpm/php-fpm.sock;
                fastcgi_index  index.php;
                fastcgi_param  SCRIPT_FILENAME  $document_root$fastcgi_script_name;
                fastcgi_param  SCRIPT_NAME  $fastcgi_script_name;
                include        fastcgi_params;
            }

            # deny access to .htaccess files, if Apache's document root
            # concurs with nginx's one
            #
            location ~ /\.ht {
            access_log off;
            log_not_found off; 
                deny  all;
            }

        location ~* \.(jpg|jpeg|gif|png|css|js|ico|xml)$ {
            access_log        off;
            log_not_found     off;
            expires           2d;
        }   
        }

        # Passenger needed for puppet
        passenger_root  /usr/lib/ruby/gems/1.8/gems/passenger-3.0.18;
        passenger_ruby  /usr/bin/ruby;
        passenger_max_pool_size 15;

        server {
        ssl                on;
        listen                     8140 default ssl;
            server_name                bangvmpllda02.XXXX.com; 
        passenger_enabled          on;
        passenger_set_cgi_param    HTTP_X_CLIENT_DN $ssl_client_s_dn; 
        passenger_set_cgi_param    HTTP_X_CLIENT_VERIFY $ssl_client_verify; 
        passenger_min_instances    5;

        access_log                 logs/puppet_access.log;
        error_log                  logs/puppet_error.log;

        root                       /etc/puppet/rack/public;

        ssl_certificate            /var/lib/puppet/ssl/certs/bangvmpllda02.XXX.com.pem;
        ssl_certificate_key        /var/lib/puppet/ssl/private_keys/bangvmpllda02.XXX.com.pem;
        ssl_crl                    /var/lib/puppet/ssl/ca/ca_crl.pem;
        ssl_client_certificate     /var/lib/puppet/ssl/certs/ca.pem;
        ssl_ciphers                SSLv2:-LOW:-EXPORT:RC4+RSA;
        ssl_prefer_server_ciphers  on;
        ssl_verify_client          optional;
        ssl_verify_depth           1;
        ssl_session_cache          shared:SSL:128m;
        ssl_session_timeout        5m;
        }
    }

和 puppet.conf

[main]
    # The Puppet log directory.
    # The default value is '$vardir/log'.
    logdir = /var/log/puppet

    # Where Puppet PID files are kept.
    # The default value is '$vardir/run'.
    rundir = /var/run/puppet
    dns_alt_names = devops.XXXX.com,devops
    confdir = /etc/puppet
    vardir = /var/lib/puppet
    storeconfigs = true
    storeconfigs_backend = puppetdb
    thin_storeconfigs = false
    async_storeconfigs = false
    ssl_client_header = SSL_CLIENT_S_D
    ssl_client_verify_header = SSL_CLIENT_VERIFY

    # Where SSL certificates are kept.
    # The default value is '$confdir/ssl'.
    ssldir = $vardir/ssl

任何想法我哪里出错了?我检查目录权限;/usr/share/puppet、/etc/puppet 和 /var/lib/puppet(以及其中的文件)归 puppet 用户所有。

解决了

我的复杂问题的简单解决方案是我将 config.ru 放在了错误的位置

将它移动到 /etc/puppet/rack ,它在 /etc/puppet/rack/public

出色地!!!:-/

nginx
  • 1 个回答
  • 2728 Views
Martin Hope
Anadi Misra
Asked: 2012-09-17 23:59:37 +0800 CST

Puppet master 无法在 nginx+passenger 配置下作为 rack app 运行,作为系统服务运行时有效

  • 2

我得到错误

[anadi@bangda ~]# tail -f /var/log/nginx/error.log 
[ pid=19741 thr=23597654217140 file=utils.rb:176 time=2012-09-17 12:52:43.307 ]: *** Exception LoadError in PhusionPassenger::Rack::ApplicationSpawner (no such file to load -- puppet/application/master) (process 19741, thread #<Thread:0x2aec83982368>):
    from /usr/local/lib/ruby/site_ruby/1.8/rubygems/custom_require.rb:31:in `gem_original_require'
    from /usr/local/lib/ruby/site_ruby/1.8/rubygems/custom_require.rb:31:in `require'
    from config.ru:13
    from /usr/local/lib/ruby/gems/1.8/gems/rack-1.4.1/lib/rack/builder.rb:51:in `instance_eval'
    from /usr/local/lib/ruby/gems/1.8/gems/rack-1.4.1/lib/rack/builder.rb:51:in `initialize'
    from config.ru:1:in `new'
    from config.ru:1

当我启动配置了 passenger 模块的 nginx 服务器时,puppet master 配置为通过机架运行。

这里是 config.ru

[anadi@bangda ~]# cat /etc/puppet/rack/config.ru
# a config.ru, for use with every rack-compatible webserver.
# SSL needs to be handled outside this, though.

# if puppet is not in your RUBYLIB:
#$:.unshift('/usr/share/puppet/lib')

$0 = "master"

# if you want debugging:
# ARGV << "--debug"

ARGV << "--rack"
require 'puppet/application/master'
# we're usually running inside a Rack::Builder.new {} block,
# therefore we need to call run *here*.
run Puppet::Application[:master].run

puppet master 的 nginx 配置如下

[anadi@bangda ~]# cat /etc/nginx/conf.d/puppet-master.conf 
server {
  listen                     8140 ssl;
  server_name                bangda.mycompany.com;

  passenger_enabled          on;
  passenger_set_cgi_param    HTTP_X_CLIENT_DN $ssl_client_s_dn; 
  passenger_set_cgi_param    HTTP_X_CLIENT_VERIFY $ssl_client_verify; 

  access_log                 /var/log/nginx/puppet/master.access.log;
  error_log                  /var/log/nginx/puppet/master.error.log;

  root                       /etc/puppet/rack/public;

  ssl_certificate            /var/lib/puppet/ssl/certs/bangda.mycompany.com.pem;
  ssl_certificate_key        /var/lib/puppet/ssl/private_keys/bangda.mycompany.com.pem;
  ssl_crl                    /var/lib/puppet/ssl/ca/ca_crl.pem;
  ssl_client_certificate     /var/lib/puppet/ssl/certs/ca.pem;
  ssl_ciphers                SSLv2:-LOW:-EXPORT:RC4+RSA;
  ssl_prefer_server_ciphers  on;
  ssl_verify_client          optional;
  ssl_verify_depth           1;
  ssl_session_cache          shared:SSL:128m;
  ssl_session_timeout        5m;
}

然而,当我通过常用的 puppetmasterd 守护进程运行 puppet 时,它可以完美无误地运行。

我能以某种方式看到 nginx+passenger+rack 设置无法初始化,而在运行 natvie puppetmaster 守护程序时同样有效。

我缺少任何配置吗?

更新: 由于@Shane Madden 的评论,解决了它的工作

傀儡位于

/usr/lib/ruby/site_ruby/1.8/puppet/application/master.rb

而 ruby​​ 库期望它从

/usr/local/lib/ruby/site_ruby/1.8/

因此像这样改变了config.ru

# a config.ru, for use with every rack-compatible webserver.
# SSL needs to be handled outside this, though.

# if puppet is not in your RUBYLIB:
$:.unshift('/usr/lib/ruby/site_ruby/1.8/')

$0 = "master"

# if you want debugging:
# ARGV << "--debug"

ARGV << "--rack"
require 'puppet/application/master'
# we're usually running inside a Rack::Builder.new {} block,
# therefore we need to call run *here*.
run Puppet::Application[:master].run

现在工作。

nginx
  • 1 个回答
  • 1570 Views

Sidebar

Stats

  • 问题 205573
  • 回答 270741
  • 最佳答案 135370
  • 用户 68524
  • 热门
  • 回答
  • Marko Smith

    新安装后 postgres 的默认超级用户用户名/密码是什么?

    • 5 个回答
  • Marko Smith

    SFTP 使用什么端口?

    • 6 个回答
  • Marko Smith

    命令行列出 Windows Active Directory 组中的用户?

    • 9 个回答
  • Marko Smith

    什么是 Pem 文件,它与其他 OpenSSL 生成的密钥文件格式有何不同?

    • 3 个回答
  • Marko Smith

    如何确定bash变量是否为空?

    • 15 个回答
  • Martin Hope
    Tom Feiner 如何按大小对 du -h 输出进行排序 2009-02-26 05:42:42 +0800 CST
  • Martin Hope
    Noah Goodrich 什么是 Pem 文件,它与其他 OpenSSL 生成的密钥文件格式有何不同? 2009-05-19 18:24:42 +0800 CST
  • Martin Hope
    Brent 如何确定bash变量是否为空? 2009-05-13 09:54:48 +0800 CST
  • Martin Hope
    cletus 您如何找到在 Windows 中打开文件的进程? 2009-05-01 16:47:16 +0800 CST

热门标签

linux nginx windows networking ubuntu domain-name-system amazon-web-services active-directory apache-2.4 ssh

Explore

  • 主页
  • 问题
    • 最新
    • 热门
  • 标签
  • 帮助

Footer

AskOverflow.Dev

关于我们

  • 关于我们
  • 联系我们

Legal Stuff

  • Privacy Policy

Language

  • Pt
  • Server
  • Unix

© 2023 AskOverflow.DEV All Rights Reserve