From 6af3ace0a1431b6273d0791f96df434776094bee Mon Sep 17 00:00:00 2001 From: openoms Date: Tue, 3 May 2022 14:13:01 +0100 Subject: [PATCH] k8s: generate galoy secrets --- k8s/README.md | 209 ++++++++++++++++++++++++++++++++++++++++++-------- 1 file changed, 175 insertions(+), 34 deletions(-) diff --git a/k8s/README.md b/k8s/README.md index 7d0ff4f..466feb4 100644 --- a/k8s/README.md +++ b/k8s/README.md @@ -1,6 +1,7 @@ # Kubernetes - Helm tips +- [kubectl cheat sheet](#kubectl-cheat-sheet) - [Install microk8s and helm on Debian 11 - RaspiBlitz](#install-microk8s-and-helm-on-debian-11---raspiblitz) - [Install on a working raspiblitz system: install.microk8s.sh](#install-on-a-working-raspiblitz-system-installmicrok8ssh) - [install on pure Debian 11 (eg Digital Ocean)](#install-on-pure-debian-11-eg-digital-ocean) @@ -32,6 +33,9 @@ - [stateful set](#stateful-set) - [cli](#cli) - [Secrets](#secrets) + - [create](#create) + - [Decode to view](#decode-to-view) + - [Edit](#edit) - [Debug](#debug) - [Troubleshooting](#troubleshooting) - [Check pods](#check-pods) @@ -43,19 +47,25 @@ - [Free space without restart](#free-space-without-restart) - [Directories taking space](#directories-taking-space) - [Change microk8s default-storage path in config](#change-microk8s-default-storage-path-in-config) -- [External Service ports](#external-service-ports) - [Networking](#networking) + - [External Service ports](#external-service-ports) - [check local tbitcoind](#check-local-tbitcoind) -- [Testnet LND connected to the bitcoin nodeon the host](#testnet-lnd-connected-to-the-bitcoin-nodeon-the-host) +- [Testnet LND connected to the bitcoin node on the host](#testnet-lnd-connected-to-the-bitcoin-node-on-the-host) - [install](#install-1) - [save seed and unlock password](#save-seed-and-unlock-password) - [change the wallet unlock password](#change-the-wallet-unlock-password) - [logs](#logs) - [cli](#cli-1) - [remove pods and data](#remove-pods-and-data) -- [Galoy](#galoy) +- [testnet Galoy](#testnet-galoy) - [Install](#install-2) +- [monitor](#monitor-3) - [remove](#remove) +- [Galoy with bitcoin and lnd on mainnet](#galoy-with-bitcoin-and-lnd-on-mainnet) + +# kubectl cheat sheet +* https://kubernetes.io/docs/reference/kubectl/cheatsheet/ + # Install microk8s and helm on Debian 11 - RaspiBlitz @@ -65,14 +75,21 @@ ## install on pure Debian 11 (eg Digital Ocean) ``` sudo adduser --disabled-password --gecos "" k8s + +sudo usermod -a -G sudo,bitcoin,debian-tor k8s + +sudo su - k8s + sudo apt update sudo apt install -y snapd sudo snap install microk8s --classic -echo 'export PATH=/snap/bin:$PATH' >> ~/.bashrc +echo 'export PATH=/snap/bin:$PATH' >> ~/.bashrc echo "alias kubectl='microk8s.kubectl'" >> ~/.bashrc +echo 'export KUBE_EDITOR="nano"' >> ~/.bashrc source ~/.bashrc + sudo usermod -a -G microk8s k8s sudo chown -f -R k8s ~/.kube newgrp microk8s @@ -179,9 +196,9 @@ echo "\ configmap: customValues: - bitcoin.mainnet=true - - bitcoind.rpchost=host-tunnel:8332 - - bitcoind.zmqpubrawblock=tcp://host-tunnel:28332 - - bitcoind.zmqpubrawtx=tcp://host-tunnel:28333 + - bitcoind.rpchost=bitcoind:8332 + - bitcoind.zmqpubrawblock=tcp://bitcoind:28332 + - bitcoind.zmqpubrawtx=tcp://bitcoind:28333 - minchansize=200000 - db.bolt.auto-compact=true @@ -363,8 +380,52 @@ loop -n mainnet terms # Secrets * https://kubernetes.io/docs/tasks/configmap-secret/managing-secret-using-kubectl/ + +## create ``` -microk8s kubectl edit secrets +# galoy-mongodb as in https://github.com/GaloyMoney/charts/blob/cc000d4f11e215892b11fc7407a4440fd4d200c8/dev/galoy/main.tf#L64 + +mkdir -p ~/test-secrets/galoy-mongodb +cd ~/test-secrets/galoy-mongodb + +#echo -n 'testGaloy' >./username +echo -n "$(openssl rand -hex 64)" > ./mongodb-password +echo -n "$(openssl rand -hex 64)" > ./mongodb-root-password +echo -n "$(openssl rand -hex 64)" > ./mongodb-replica-set-key + +kubectl create secret generic galoy-mongodb \ + --from-file=./mongodb-password \ + --from-file=./mongodb-root-password \ + --from-file=./mongodb-replica-set-key + +# galoy-price-history-postgres-creds as in https://github.com/GaloyMoney/charts/blob/cc000d4f11e215892b11fc7407a4440fd4d200c8/dev/galoy/main.tf#L214 + +mkdir -p ~/test-secrets/galoy-price-history-postgres-creds +cd ~/test-secrets/galoy-price-history-postgres-creds + +# The password cannot be longer than 100 characters. +echo -n "$(openssl rand -hex 48)" > ./password + +echo -n 'price-history' > ./username +echo -n 'price-history' > ./database + +kubectl create secret generic galoy-price-history-postgres-creds \ + --from-file=./password \ + --from-file=./username \ + --from-file=./database +``` + +## Decode to view +``` +kubectl get secret galoy-price-history-postgres-creds -o jsonpath='{.data.password}' | base64 -d, echo + +## compare +cat ~/test-secrets/galoy-price-history-postgres-creds/password +``` + +## Edit +``` +kubectl edit secrets ``` # Debug @@ -466,8 +527,11 @@ Change in: name: pv-volume ``` +# Networking +* https://webapp.io/blog/container-tcp-tunnel/ +* https://betterprogramming.pub/how-to-ssh-into-a-kubernetes-pod-from-outside-the-cluster-354b4056c42b -# External Service ports +## External Service ports * https://stackoverflow.com/questions/37648553/is-there-anyway-to-get-the-external-ports-of-the-kubernetes-cluster ``` kubectl describe service --all-namespaces | grep -i nodeport @@ -479,9 +543,6 @@ kubectl get svc --all-namespaces -o go-template='{{range .items}}{{range.spec.po kubectl get svc --all-namespaces -o go-template='{{range .items}}{{range.spec.ports}}{{if .nodePort}}{{.nodePort}}{{.}}{{"\n"}}{{end}}{{end}}{{end}}' ``` -# Networking -* https://webapp.io/blog/container-tcp-tunnel/ -* https://betterprogramming.pub/how-to-ssh-into-a-kubernetes-pod-from-outside-the-cluster-354b4056c42b ## check local tbitcoind ``` @@ -511,7 +572,7 @@ k8stunnel tlnd-0 lnd 21332 21332 k8stunnel tlnd-0 lnd 21333 21333 ``` -# Testnet LND connected to the bitcoin nodeon the host +# Testnet LND connected to the bitcoin node on the host * bitcoind on the raspiblitz node needs: ``` @@ -572,7 +633,6 @@ sudo tail -f /var/snap/microk8s/common/default-storage/default-tlnd-pvc-*/logs/b ``` kubectl -n default exec -it tlnd-0 -c lnd -- bash lncli -n testnet getinfo - ``` ## remove pods and data @@ -581,33 +641,114 @@ helm uninstall tlnd sudo rm -r /var/snap/microk8s/common/default-storage/default-tlnd-* ``` -# Galoy +# testnet Galoy ## Install - +* create custom values +``` +echo "\ +global: + network: testnet +galoy: + name: "Testnet Galoy Wallet" +bitcoind: + port: 18332 +needFirebaseServiceAccount: false +twilio: false +" | tee tgaloyvalues.yaml +``` +* install +``` +helm install tgaloy -f tgaloyvalues.yaml galoy-repo/galoy ``` - -helm install galoy galoy-repo/galoy - -helm install galoy \ - --set needFirebaseServiceAccount=false \ - galoy-repo/galoy --debug - -# needFirebaseServiceAccount: true -needFirebaseServiceAccount=false - -helm install bitcoind galoy-repo/bitcoind -helm install lnd galoy-repo/lnd - -helm install bitcoin galoy-repo/bitcoin - # monitor -microk8s kubectl get pod -n galoy -w +``` +kubectl get pod -n galoy -w -microk8s kubectl get service -n galoy +kubectl get service -n galoy ``` ## remove ``` -helm uninstall galoy -n galoy +helm uninstall galoy + +# check pvc -s +kubectl get pvc + +## CAREFUL HERE +# delete all pending +for i in $(kubectl get pvc | grep Pending | awk '{print $1}' ); do kubectl delete pvc ${i}; done + +# delete galoy storage +for i in $(kubectl get pvc | grep galoy | awk '{print $1}' ); do kubectl delete pvc ${i}; done + +# in filesystem +for i in $(sudo ls /var/snap/microk8s/common/default-storage/ | grep galoy); do sudo rm -rf /var/snap/microk8s/common/default-storage/${i}; done + + +# delete galoy storage +for i in $(kubectl get pvc | grep galoy| awk '{print $1}' ); do kubectl delete pvc ${i}; done + +# delete the manually generated secrets +kubectl delete secret galoy-mongodb +kubectl delete secret galoy-price-history-postgres-creds + +sudo rm -rf /home/k8s/test-secrets ``` + +# Galoy with bitcoin and lnd on mainnet +``` +# bitcoind +helm install bitcoind galoy-repo/bitcoin + +# lnd +echo "\ +configmap: + customValues: + - bitcoin.mainnet=true + - bitcoind.rpchost=bitcoind:8332 + - bitcoind.zmqpubrawblock=tcp://bitcoind:28332 + - bitcoind.zmqpubrawtx=tcp://bitcoind:28333 + - minchansize=200000 + - db.bolt.auto-compact=true +autoGenerateSeed: + enabled: true +" | tee -a lndvalues.yaml + +helm install lnd -f lndvalues.yaml galoy-repo/lnd + +# galoy +# secrets +mkdir -p ~/test-secrets/galoy-mongodb +cd ~/test-secrets/galoy-mongodb +echo -n "$(openssl rand -hex 64)" > ./mongodb-password +echo -n "$(openssl rand -hex 64)" > ./mongodb-root-password +echo -n "$(openssl rand -hex 64)" > ./mongodb-replica-set-key +kubectl create secret generic galoy-mongodb \ + --from-file=./mongodb-password \ + --from-file=./mongodb-root-password \ + --from-file=./mongodb-replica-set-key + +mkdir -p ~/test-secrets/galoy-price-history-postgres-creds +cd ~/test-secrets/galoy-price-history-postgres-creds +echo -n "$(openssl rand -hex 48)" > ./password +echo -n 'price-history' > ./username +echo -n 'price-history' > ./database +kubectl create secret generic galoy-price-history-postgres-creds \ + --from-file=./password \ + --from-file=./username \ + --from-file=./database + +cd + +echo "\ +global: + network: mainnet +bitcoind: + port: 8332 +needFirebaseServiceAccount: false +twilio: false +" | tee galoyvalues.yaml + +helm install galoy -f galoyvalues.yaml galoy-repo/galoy +``` \ No newline at end of file