clementnuss

#!/bin/bash

# Script to reproduce the read-only clone export policy bug in Trident nas-economy driver
#
# Bug Description:
# When a read-only clone is deleted on the same node as its source volume, the unpublish
# operation incorrectly removes export policy rules that are still needed by the source.
# This is NOT a race condition - it's a deterministic logic bug where the code fails to
# check for remaining publications of the source volume before removing export rules.
#

clementnuss

NFSv3 Lock Testing on Kubernetes

Test NFSv3 file locking with persistent locks across multiple pods using Trident ONTAP-NAS storage.

Quick Start

kubectl apply -k .
kubectl exec -it deployment/nfs-test-nfs-lock-tester -- nfs-lock.sh test myfile.txt

clementnuss

asciinema server deployment

The few following manifests present how asciinema-server on Kubernetes, with a caching nginx reverse proxy (which also does the requests against the S3 endpoint, for cases where the S3 server is not publicly accesible).

For more details regarding the S3 proxying, check https://github.com/asciinema/asciinema-server/pull/363/files#diff-10557452cffb1028618b3bc1bfdd9f01d79642fe2823dc078f5208a0121b8495

clementnuss

Kubernetes CronJob to backup, compress (with gzip --rsyncable), and finally use restic to backup your DBs to an S3 endpoint.

more details in my blog post

Advantages:

• using mariadb:latest Docker image, to ensure I don't use an outdated mariadb-dump binary
• backing up each database in a separate file, to make for easier restore
• compressing the backups with gzip and the --rsyncable option (details here), which makes gzip "regularly reset his compression algorithm to what it was at the beginning of the file", so that changes to a portion of the file do not alter the whole compressed output, which permits to make incremental backups.
• using restic to store the backups on an S3 endpoint (Cloudflare R2, with a generous free tier!), which makes for simple management and rotation, as well as for simple restores.

clementnuss

Using eBPF to print argv and envp when running a specific file

With bpftrace on Linux, it's quite simple to monitor when a specific binary is run, and to print it's args and the environment variables passed to it.

This can be done with the following bpftrace "program":

tracepoint:syscalls:sys_enter_execve
/str(args->filename) == "/etc/network/if-up.d/resolved" /
{

clementnuss

etcd - moving the leader away

When patching some Kubernetes control-plane nodes on which etcd also happens to be running, you might want to gracefully transfer the leadership of the etcd cluster away before patching and eventually patching the node.

This can be achieved with the following script, provided you specify the adequate environment variables in /etc/profile.d/etcd-all:

set -o pipefail && \
source /etc/profile.d/etcd-all && \
AM_LEADER=$(etcdctl endpoint status | grep $(hostname) | cut -d ',' -f 5 | tr -d ' ') && \

clementnuss

Batch deletion of S3 objects

If you ever tried to delete more than a few hundred files on S3, you might have noticed how slow it was.

To speed-up the deletion, we can use a few bash commands to parallelize the deletion, and we can also use some json description of the objets we want to delete.

Concretely, it permits us to delete e.g. 1000 files with a single s3 API request.

How ?

clementnuss

package main

import (
	"fmt"
	"os"
	"strings"
	"time"

	"github.com/bitfield/script"
)

clementnuss

#!/bin/bash

stdin="$([[ -p /dev/stdin ]] && cat -)"
lemonade copy $stdin

clementnuss

#fish
function yqblank;
  yq eval "$argv[1]" "$argv[2]" | diff -B "$argv[2]" - | patch "$argv[2]" -o -
end

#bash
yqblank() {
  yq "$1" "$2" | diff -B "$2" - | patch "$2" -
}