Frederic Leger fredleger

Proxmox - SPICE client setup for MacOS

Install a working (and compiled) version of virt-viewer. You may view the homebrew package's upstream source on GitHub.
```
brew tap jeffreywildman/homebrew-virt-manager
brew install virt-viewer
```
Once that's installed should be able make a call remote-viewer with a pve-spice.vv file downloaded from proxmox web interface

How to register Rancher managed Kubernetes clusters in Argo CD

Registering Rancher managed clusters in Argo CD doesn't work out of the box unless the Authorized Cluster Endpoint is used. Many users will prefer an integration of Argo CD via the central Rancher authentication proxy (which shares the network endpoint of the Rancher API/GUI). So let's find out why registering clusters via Rancher auth proxy fails and how to make it work.

Hint: If you are just looking for the solution scroll to the bottom of this page.

Why do i get an error when running `argocd cluster add`?

Service Account tokens and the Rancher authentication proxy

OVH ingress LB

This gist describe how to deploy a K8S LB at OVH and preserve source IP

Howto

1. Install the NGINX Ingress Controller

kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/master/deploy/static/mandatory.yaml

kubectl multi-version brews

Applicability

The instructions below apply to older versions of Homebrew which still provide switch capability.

For current Homebrew, you'll likely need to keep Versions around, and build locally. Here's my versions repository https://github.com/rdump/homebrew-versions

MacPorts is now keeping versioned installations available as well, by default.

	apiVersion: kyverno.io/v1
	kind: ClusterPolicy
	metadata:
	name: mutate-rancher-secrets-webhookconfiguration
	annotations:
	policies.kyverno.io/title: Filter Rancher secrets WebhookConfiguration
	policies.kyverno.io/description: >-
	Filter Rancher WebhookConfiguration to match secrets not in the `kube-system` namespace
	spec:
	mutateExistingOnPolicyUpdate: true

	#!/usr/bin/env bash
	set -eu

	# This script change the rancher manager URL (same rancher server) for downstream clusters.
	# You need to access to the downstream cluster outside of rancher manager server, as you need to stop the cattle-agent deployment.
	RANCHER_URL=https://rancher.mycompany.com

	context=$(kubectl config current-context \| cut -d'@' -f 2) # My context name is user@cluster
	mkdir -p $context
	secretName=$(kubectl get deploy cattle-cluster-agent -n cattle-system -o jsonpath="{.spec.template.spec.volumes[0].secret.secretName}")

	# Ansible playbook to interact with OVH cloud API

	# Create a token
	# https://eu.api.ovh.com/createToken/
	# every methods: `/*`
	---

	# It requires a secret.yaml
	ovh:
	application_key:

	apiVersion: v1
	kind: ConfigMap
	metadata:
	name: maintenance-page
	data:
	maintenance.html: \|-
	<!--HTML GOES HERE-->
	<!doctype html>
	<title>Site Maintenance</title>
	<link rel="stylesheet" href="maintenance.css">

	#!/bin/bash
	INPUT_FILE=*.log
	OUTPUT_FILE=policy.json

	# get statements
	# group all permissions by group into one statement block
	# eg. ec2:CreateInstance and ec2:DeleteInstance will be in the same statement
	STATEMENTS=$(grep "DEBUG: Request" $INPUT_FILE \|awk '{print $(NF-1)}' \| awk -F "/" '{print $1}' \| sort \| uniq )
	LAST_STATEMENT=$(echo $STATEMENTS \| awk '{print $NF}')

	# Manually remove finalizers

	kubectl edit -n cattle-system secret tls-rancher
	kubectl patch secret tls-rancher -p '{"metadata":{"finalizers":[]}}' --type='merge' -n cattle-system

	kubectl patch namespace cattle-system -p '{"metadata":{"finalizers":[]}}' --type='merge' -n cattle-system
	kubectl delete namespace cattle-system --grace-period=0 --force

	kubectl patch namespace cattle-global-data -p '{"metadata":{"finalizers":[]}}' --type='merge' -n cattle-system
	kubectl delete namespace cattle-global-data --grace-period=0 --force