Macduff macduff23

% VXLAN lab based on OpenVSwitch and LXD containers

Preamble

The very first idea when I started writing this lab was to illustrate the Virtual Extensible LAN (VXLAN) technology. Now that OpenVSwitch configuration is smoothely integrated in the Debian networking configuration files, this should have resulted in somewhat easy-to-read gist.

Ingress MetalLB

Out of the box, the MicroK8s distribution of ingress-nginx installed as the MicroK8s addon ingress binds to ports 80+443 on the node's IP address using a hostPort, as we can see here:

microk8s kubectl -n ingress describe daemonset.apps/nginx-ingress-microk8s-controller
Name:           nginx-ingress-microk8s-controller
Selector:       name=nginx-ingress-microk8s

First install fish shell on your system

sudo apt-get update
sudo apt-get install fish

Or install fish via ppa

sudo apt-add-repository ppa:fish-shell/release-2
sudo apt-get update

sudo apt-get install fish``

	# -- mode: ruby --
	# vi: set ft=ruby :

	VAGRANTFILE_API_VERSION = "2"
	Vagrant.require_version ">=1.7.0"


	$bootstrap_ovn = <<SCRIPT

	# Add repo for where we can get OVS packages

	# always start with interface up
	auth eth0

	# Static
	iface eth0 inet static
	address 192.168.1.5
	netmask 255.255.255.0
	gateway 192.168.1.254
	dns-nameservers 192.168.1.250

	#!/usr/bin/env bash

	# netplan2NM.sh
	# Ubuntu server 20.04 Change from netplan to NetworkManager for all interfaces

	echo 'Changing netplan to NetowrkManager on all interfaces'
	# backup existing yaml file
	cd /etc/netplan
	cp 01-netcfg.yaml 01-netcfg.yaml.BAK

	# Install microk8s from the edge channel (Rancher requires Helm 2.15.1 or above)
	sudo snap install microk8s --classic
	# Enable useful plugins
	sudo microk8s.enable dns dashboard storage ingress helm

	# Allow running priviledged Pods (required by Rancher's `cattle-node-agent`)
	sudo sh -c 'echo "--allow-privileged=true" >> /var/snap/microk8s/current/args/kube-apiserver'
	sudo systemctl restart snap.microk8s.daemon-apiserver.service

	# Setup and install Tiller (part of Helm)

	#!/bin/bash
	sudo apt-get install -y \
	apt-transport-https \
	ca-certificates \
	curl \
	software-properties-common
	curl -fsSL https://download.docker.com/linux/ubuntu/gpg \| sudo apt-key add -
	sudo apt-key fingerprint 0EBFCD88
	sudo add-apt-repository \
	"deb [arch=amd64] https://download.docker.com/linux/ubuntu \

	---
	- hosts: all
	tasks:
	- name: Install prerequisites for Docker repository
	apt:
	name: ['apt-transport-https', 'ca-certificates', 'curl', 'gnupg2', 'software-properties-common']
	update_cache: yes

	- name: Add Docker GPG key
	apt_key:

	# changes from http://www.cyberciti.biz/faq/linux-kernel-etcsysctl-conf-security-hardening/

	# Protect ICMP attacks
	net.ipv4.icmp_echo_ignore_broadcasts = 1

	# Turn on protection for bad icmp error messages
	net.ipv4.icmp_ignore_bogus_error_responses = 1

	# Turn on syncookies for SYN flood attack protection
	net.ipv4.tcp_syncookies = 1