devnullify

I've been testing signed OpenSSH certificates for authentication in my lab network (Certificate-Based Authentication). I created a user CA and used that to sign user certificates. After modifying my /etc/ssh/sshd_config with the appropropriate path for TrustedUserCAKeys, I can use SSH to log in between my Linux hosts without having to check and approve the key fingerprint in known_hosts or adding a public key to authorized_keys.

However, my Macbook is causing me issues. I can access my Linux hosts from my Macbook without a password or needing the public key in authorized_keys, but I cannot access the Linux

Is it possible to hide a particular split pane instead of bringing a single pane to fullscreen? I had a situation where I have a horizontal split, and then in one half, I have a vertical split. I would like to hide the single horizontal pane while bringing the 2 vertical panes left so they use the full screen. Like this picture here (hope it formats ok), I want to hide panel 1 so 2 & 3 are left.

2 | 3            |  
------    -->  2 | 3
  1              |

I created a certificate authority on my MacBook, and I'm using it to create a wildcard certificate. I have the root CA added as trusted into my system keychain. On Safari, it complains that the certificate is not standards compliance, and I'm not sure what piece I am missing. I'm not sure if I scrubbed all sensitive information from this or not, but it's my internal lab and not accessible from the internet.

I have my wildcard name in the Subject Alternative Name section. I used sha256 for the signature algorithm. The public key is 4096 bit. The duration of the certificate is 825 days.

Any idea what I am missing still?

Certificate:
    Data:
        Version: 3 (0x2)
       

I am running on Fedora 36.

As root, I can connect to my OpenShift API with my rootCA installed on my system.

[root@fedora ~]# oc login -u kubeadmin https://api.ocp4.example.com:6443 Authentication required for https://api.ocp4.example.com:6443 (openshift) 
Username: kubeadmin 
Password:

As a non-root user, I get prompted due to an untrusted certificate.

[user@fedora ~]$ oc login -u kubeadmin https://api.ocp4.example.com:6443 
The server uses a certificate signed by an unknown authority. 
You can bypass the certificate check, but any data you send to the server could be intercepted by others. 
Use insecure connections? (y/n): n

But, if I tell the command to

Can someone explain the difference between PreferDualStack and RequireDualStack for ipFamilyPolicy? I don't really see the distinction between these from reading the docs. When I created two services using the different ipFamilyPolicy, I don't see a difference at all in the corresponding services.

# kubeadm describe svc prefer-ipv6-dualstack
Name: prefer-ipv6-dualstack
Namespace: sample-app
Labels: app=golang-http
Annotations: <none>
Selector: app=golang-http,deploymentconfig=golang-http,name=golang-http
Type: ClusterIP
IP Family Policy: PreferDualStack
`IP Families: IPv6,IP

Sorry if this is not appropriate. No charge if goal is not met.

https://www.kickstarter.com/projects/casualpenguins/casual-penguins-hawaiian-shirts

I have 6.7u2 installed. I can connected to my vCenter host at its URL by hostname, and I can launch the HTML5 client and get connected to the login screen. Once I login, I just get a spinner and never connect. If I connect to the vCenter URL by IP address, I am able to connect all the way into the UI. Any ideas what's wrong? Since I can get to the login screen by hostname, it does not seem to be DNS related.

I'm getting this issue where web pages in Chrome (88.0.4324.96) on macOS Catalina (10.15.7) get all blurry and unreadable. I don't have this issue in Safari or Firefox. I don't show any available updates to Chrome, but this is a corporate managed system.

https://preview.redd.it/t8dnwgxzn5f61.png?width=1920&format=png&auto=webp&s=deb7e79aebfec803dad5bbefaade1af44aced459

Where is the certificate signed by the internal CA for https://api.cluster.example.com:6443? I know I can just tell it to use an untrusted connection, but I would like to know where to grab the CA if I want to add it to my local trust store.

Can anyone tell me what this annotation on an object means? It suggests to me that you can't patch this object, but I'm not sure. Is it safe to change to false?

release.openshift.io/create-only: "true"

CLI, I would add a label to a node with kubectl label node nodename.example.com node-role.kubernetes.io/my-role=. Can this be done with the k8s module?

I have tried this which doesn't work. This task doesn't seem to affect things under metadata. The examples I've found are for key/value pairs at the same level as metadata.

k8s:
  definition:
    apiversion: v1
    kind: Node
    metadata:
      name: nodename.example.com
      label:
        node-role.kubernetes.io.my-role: ""

I have a series of roles that will all be reusing a couple of environment variables for authentication. The value for one of those environment variables is being set in a pre_task before the roles execute. Is there a way I can set this at a role level without having to define it when I include each role? Just trying to reduce the duplication of code. I could do it without environment variables by just adding the extra parameters to the tasks that need those values, but I'm trying to see if I can avoid that.

Currently I am doing this:

- name: Do some tasks that require authentication
  hosts: localhost
  
  environment:
    ENV_VAR2: false

  pre_tasks:
  - name: Get auth token dy

I need to create a secret that will be mounted as a config file in a pod. The config file includes clear text username/password (yuck, not my choice). I already have those same credentials in an existing secret.

Is there a way to create an object for this config file that re-uses the credentials I already have in the other secret? I'm trying to avoid having to update credentials in two places when the password for that username has to be rotated.

Documentation states that cluster-admin is required for installing operators. Has anyone come up with an RBAC policy that allows a user to install operators without cluster-admin?

It just seems somewhat limiting for a developer to need to ask a cluster-admin to install an operator to just be able to test something out. Sure, it doesn't take hardly any effort to install, but the process and timing that can be wrapped around something like that might be extremely limiting.

EDIT: After reading the docs more closely, TIL you can grant cluster-admin at the namespace level. That actually helps for the use case we had in mind.

So, as I recall, we used to be able to use oc export -o yaml to get the definition of an object without things like status. They deprecated that and said use oc get --export -o yaml.

Now, oc get --export -o yaml says --export is deprecated. How do you get the definition of an object without all of the extra information you don't need to create a new object?

EDIT: As far as I can find, as mentioned this flag is removed as of 1.18, and there is nothing to replace it. I guess that leaves it to the user to remove status info and other unnecessary metadata from the output if you plan to use the output to create new objects.