script | Tom's Notes

Checking certificate expiration with PowerShell

By Tomica Kaniski in Other 05/01/2022 4 Comments

Had an idea to write some (PowerShell) script which will check and maybe notify me of certificates that are nearing expiration for a bunch of (public) sites that… somewhat matter to me. 😊

As it turns out, someone already had this idea and wrote very nice PowerShell script that does just that, available here – thank you!

While testing it, there were sites on which the script worked just fine, and there were sites on which I got errors like this one (Error: “String was not recognized as a valid DateTime.”):

# Exception while checking URL https://blog.kaniski.eu: Exception calling "GetResponse" with "0" argument(s): "The operation has timed out"
# Cannot convert value "26.4.2022. 1:59:59" to type "System.DateTime". Error: "String was not recognized as a valid DateTime."
# At line:17 char:5
#      +     [datetime]$expiration = $req.ServicePoint.Certificate.GetExpirati ...
#      +     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
#      + CategoryInfo          : MetadataError: (:) [], ArgumentTransformationMetadataException
#      + FullyQualifiedErrorId : RuntimeException

# Exception while checking URL https://blog.kaniski.eu: Exception calling "GetResponse" with "0" argument(s): "The operation has timed out"

# Cannot convert value "26.4.2022. 1:59:59" to type "System.DateTime". Error: "String was not recognized as a valid DateTime."

# At line:17 char:5

# + [datetime]$expiration = $req.ServicePoint.Certificate.GetExpirati ...

# + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

# + CategoryInfo : MetadataError: (:) [], ArgumentTransformationMetadataException

# + FullyQualifiedErrorId : RuntimeException

Seems to be connected to my regional settings (I know… who would ever use hr-HR instead of en-US, but… 😊) and date/time formatting:

PS C:\> (Get-Culture).DateTimeFormat
# AMDesignator                     :
# Calendar                         : System.Globalization.GregorianCalendar
# DateSeparator                    : .
# FirstDayOfWeek                   : Monday
# CalendarWeekRule                 : FirstDay
# FullDateTimePattern              : d. MMMM yyyy. H:mm:ss
# LongDatePattern                  : d. MMMM yyyy.
# LongTimePattern                  : H:mm:ss
# MonthDayPattern                  : d. MMMM
# PMDesignator                     :
# RFC1123Pattern                   : ddd, dd MMM yyyy HH':'mm':'ss 'GMT'
# ShortDatePattern                 : d.M.yyyy.
# ShortTimePattern                 : H:mm
# SortableDateTimePattern          : yyyy'-'MM'-'dd'T'HH':'mm':'ss
# TimeSeparator                    : :
# UniversalSortableDateTimePattern : yyyy'-'MM'-'dd HH':'mm':'ss'Z'
# YearMonthPattern                 : MMMM, yyyy
# AbbreviatedDayNames              : {ned, pon, uto, sri...}
# ShortestDayNames                 : {ne, po, ut, sr...}
# DayNames                         : {nedjelja, ponedjeljak, utorak, srijeda...}
# AbbreviatedMonthNames            : {sij, vlj, ožu, tra...}
# MonthNames                       : {siječanj, veljača, ožujak, travanj...}
# IsReadOnly                       : False
# NativeCalendarName               : gregorijanski kalendar
# AbbreviatedMonthGenitiveNames    : {sij, vlj, ožu, tra...}
# MonthGenitiveNames               : {siječnja, veljače, ožujka, travnja...}

PS C:\> (Get-Culture).DateTimeFormat

# AMDesignator :

# Calendar : System.Globalization.GregorianCalendar

# DateSeparator : .

# FirstDayOfWeek : Monday

# CalendarWeekRule : FirstDay

# FullDateTimePattern : d. MMMM yyyy. H:mm:ss

# LongDatePattern : d. MMMM yyyy.

# LongTimePattern : H:mm:ss

# MonthDayPattern : d. MMMM

# PMDesignator :

# RFC1123Pattern : ddd, dd MMM yyyy HH':'mm':'ss 'GMT'

# ShortDatePattern : d.M.yyyy.

# ShortTimePattern : H:mm

# SortableDateTimePattern : yyyy'-'MM'-'dd'T'HH':'mm':'ss

# TimeSeparator : :

# UniversalSortableDateTimePattern : yyyy'-'MM'-'dd HH':'mm':'ss'Z'

# YearMonthPattern : MMMM, yyyy

# AbbreviatedDayNames : {ned, pon, uto, sri...}

# ShortestDayNames : {ne, po, ut, sr...}

# DayNames : {nedjelja, ponedjeljak, utorak, srijeda...}

# AbbreviatedMonthNames : {sij, vlj, ožu, tra...}

# MonthNames : {siječanj, veljača, ožujak, travanj...}

# IsReadOnly : False

# NativeCalendarName : gregorijanski kalendar

# AbbreviatedMonthGenitiveNames : {sij, vlj, ožu, tra...}

# MonthGenitiveNames : {siječnja, veljače, ožujka, travnja...}

I’ve tried to fix it in a couple of ways, but the one that finally did it (for me) was explained on Dan Sheehan’s blog (thanks!), implemented on lines 25-26 below.

So, my adapted script looks like this (and works with my hr-HR culture):

$minimumCertAgeDays = 30
$timeoutMilliseconds = 6000
$urls = @(
    "https://blog.kaniski.eu/",
    "https://www.google.com/",
    "https://www.microsoft.com/"
)

# disabling the cert validation check. This is what makes this whole thing work with invalid certs...
[Net.ServicePointManager]::ServerCertificateValidationCallback = { $true }

foreach ($url in $urls) {
    Write-Host "Getting certificate information for $url ..." -ForegroundColor "Yellow"
    $req = [System.Net.WebRequest]::Create($url)
    $req.Timeout = $timeoutMilliseconds

    try {
        $req.GetResponse() | Out-Null
    }
    catch {
        Write-Host "Exception occurred while checking URL $url`: $_ ." -ForegroundColor "Red"
    }
    $expirationString = $req.ServicePoint.Certificate.GetExpirationDateString()

    $dateTimeFormat = "$((Get-Culture).DateTimeFormat.ShortDatePattern) $((Get-Culture).DateTimeFormat.LongTimePattern)"
    $expiration = [DateTime]::ParseExact($expirationString, $dateTimeFormat, [System.Globalization.DateTimeFormatInfo]::InvariantInfo, [System.Globalization.DateTimeStyles]::None)

    [int]$certExpiresIn = ($expiration - $(Get-Date)).Days
    if ($certExpiresIn -gt $minimumCertAgeDays){
        Write-Host "Certificate for site $url expires in $certExpiresIn days (on $('{0:dd.MM.yyyy.}' -f $expiration))." -ForegroundColor "Green"
    }
    else {
        Write-Host "ERROR: Certificate for site $url expires in $certExpiresIn days (on $('{0:dd.MM.yyyy.}' -f $expiration)) and query threshold is set to $minimumCertAgeDays days!" -ForegroundColor "Red"
    }
}

$minimumCertAgeDays = 30

$timeoutMilliseconds = 6000

$urls = @(

"https://blog.kaniski.eu/",

"https://www.google.com/",

"https://www.microsoft.com/"

)

# disabling the cert validation check. This is what makes this whole thing work with invalid certs...

[Net.ServicePointManager]::ServerCertificateValidationCallback = { $true }

foreach ($url in $urls) {

Write-Host "Getting certificate information for $url ..." -ForegroundColor "Yellow"

$req = [System.Net.WebRequest]::Create($url)

$req.Timeout = $timeoutMilliseconds

try {

$req.GetResponse() | Out-Null

}

catch {

Write-Host "Exception occurred while checking URL $url`: $_ ." -ForegroundColor "Red"

}

$expirationString = $req.ServicePoint.Certificate.GetExpirationDateString()

$dateTimeFormat = "$((Get-Culture).DateTimeFormat.ShortDatePattern) $((Get-Culture).DateTimeFormat.LongTimePattern)"

$expiration = [DateTime]::ParseExact($expirationString, $dateTimeFormat, [System.Globalization.DateTimeFormatInfo]::InvariantInfo, [System.Globalization.DateTimeStyles]::None)

[int]$certExpiresIn = ($expiration - $(Get-Date)).Days

if ($certExpiresIn -gt $minimumCertAgeDays){

Write-Host "Certificate for site $url expires in $certExpiresIn days (on $('{0:dd.MM.yyyy.}' -f $expiration))." -ForegroundColor "Green"

}

else {

Write-Host "ERROR: Certificate for site $url expires in $certExpiresIn days (on $('{0:dd.MM.yyyy.}' -f $expiration)) and query threshold is set to $minimumCertAgeDays days!" -ForegroundColor "Red"

}

It provides the following output (which can be further customized per your needs, of course… and I know – need to insert some line breaks, convert output to HTML, send it via e-mail, … it’s a start! 😊):

# ...
# Getting certificate information for https://blog.kaniski.eu/ ...
# Certificate for site https://blog.kaniski.eu/ expires in 110 days (on 26.04.2022.).
# Getting certificate information for https://www.google.com/ ...
# Certificate for site https://www.google.com/ expires in 46 days (on 21.02.2022.).
# Getting certificate information for https://www.microsoft.com/ ...
# Certificate for site https://www.microsoft.com/ expires in 204 days (on 28.07.2022.).
# ...

# ...

# Getting certificate information for https://blog.kaniski.eu/ ...

# Certificate for site https://blog.kaniski.eu/ expires in 110 days (on 26.04.2022.).

# Getting certificate information for https://www.google.com/ ...

# Certificate for site https://www.google.com/ expires in 46 days (on 21.02.2022.).

# Getting certificate information for https://www.microsoft.com/ ...

# Certificate for site https://www.microsoft.com/ expires in 204 days (on 28.07.2022.).

# ...

Note that I’m returning expiration date “the Croatian way”, by using the following formatting:

$('{0:dd.MM.yyyy.}' -f $expiration)

1	$('{0:dd.MM.yyyy.}' -f $expiration)

Hope it helps someone (and #kudos to original authors)!

Cheers!

Patch Tuesday with PowerShell

By Tomica Kaniski in Other 10/02/2021 0 Comment

It’s actually Wednesday here, but yesterday was another “Patch Tuesday” and Microsoft released its update packages.

So – it’s time to patch! 😊

Not sure how you’re patching your machines, but just wanted to make you aware of the nice PowerShell module called PSWindowsUpdate.

You can read more about it on the official PowerShell Gallery page and also here.

In short – this module takes care of controlling Windows Update from within PowerShell on your local and also remote machines.

And… I know it’s not nice like the Windows Update screen, but it does its job! 😊

To make use of it, you’ll have to take care of some minor prerequisites and install it via PowerShell Gallery.

Once done, you can use it to control Windows Update:

To make it easier for you, here is the installation script which takes care of… everything:

# check if you have PSGallery under your PowerShell repositories (and check the installation policy)
# if it's not, you can easily register it with "Register-PSRepository -Default"
Get-PSRepository
# Name                      InstallationPolicy   SourceLocation
# ----                      ------------------   --------------
# PSGallery                 Untrusted            https://www.powershellgallery.com/api/v2

# NuGet package provider is required - if not present, you'll be asked to install it
Install-PackageProvider -Name NuGet -MinimumVersion 2.8.5.201 -Force
# Name                           Version          Source           Summary
# ----                           -------          ------           -------
# nuget                          2.8.5.208        https://onege... NuGet provider for the OneGet meta-package manager

# mark PSGallery as trusted (optional)
Set-PSRepository -Name 'PSGallery' -InstallationPolicy Trusted

# are we ready?
Get-PSRepository
# Name                      InstallationPolicy   SourceLocation
# ----                      ------------------   --------------
# PSGallery                 Trusted              https://www.powershellgallery.com/api/v2

# install the PSWindowsUpdate module (from PSGallery)
Install-Module PSWindowsUpdate

# check what's available
Get-Command -Module PSWindowsUpdate
# CommandType     Name                                               Version    Source
# -----------     ----                                               -------    ------
# Alias           Clear-WUJob                                        2.2.0.2    PSWindowsUpdate
# Alias           Download-WindowsUpdate                             2.2.0.2    PSWindowsUpdate
# Alias           Get-WUInstall                                      2.2.0.2    PSWindowsUpdate
# Alias           Get-WUList                                         2.2.0.2    PSWindowsUpdate
# Alias           Hide-WindowsUpdate                                 2.2.0.2    PSWindowsUpdate
# Alias           Install-WindowsUpdate                              2.2.0.2    PSWindowsUpdate
# Alias           Show-WindowsUpdate                                 2.2.0.2    PSWindowsUpdate
# Alias           UnHide-WindowsUpdate                               2.2.0.2    PSWindowsUpdate
# Alias           Uninstall-WindowsUpdate                            2.2.0.2    PSWindowsUpdate
# Cmdlet          Add-WUServiceManager                               2.2.0.2    PSWindowsUpdate
# Cmdlet          Enable-WURemoting                                  2.2.0.2    PSWindowsUpdate
# Cmdlet          Get-WindowsUpdate                                  2.2.0.2    PSWindowsUpdate
# Cmdlet          Get-WUApiVersion                                   2.2.0.2    PSWindowsUpdate
# Cmdlet          Get-WUHistory                                      2.2.0.2    PSWindowsUpdate
# Cmdlet          Get-WUInstallerStatus                              2.2.0.2    PSWindowsUpdate
# Cmdlet          Get-WUJob                                          2.2.0.2    PSWindowsUpdate
# Cmdlet          Get-WULastResults                                  2.2.0.2    PSWindowsUpdate
# Cmdlet          Get-WUOfflineMSU                                   2.2.0.2    PSWindowsUpdate
# Cmdlet          Get-WURebootStatus                                 2.2.0.2    PSWindowsUpdate
# Cmdlet          Get-WUServiceManager                               2.2.0.2    PSWindowsUpdate
# Cmdlet          Get-WUSettings                                     2.2.0.2    PSWindowsUpdate
# Cmdlet          Invoke-WUJob                                       2.2.0.2    PSWindowsUpdate
# Cmdlet          Remove-WindowsUpdate                               2.2.0.2    PSWindowsUpdate
# Cmdlet          Remove-WUServiceManager                            2.2.0.2    PSWindowsUpdate
# Cmdlet          Reset-WUComponents                                 2.2.0.2    PSWindowsUpdate
# Cmdlet          Set-PSWUSettings                                   2.2.0.2    PSWindowsUpdate
# Cmdlet          Set-WUSettings                                     2.2.0.2    PSWindowsUpdate
# Cmdlet          Update-WUModule                                    2.2.0.2    PSWindowsUpdate

# check which update sources you have installed in your system 
Get-WUServiceManager
# ServiceID                            IsManaged IsDefault Name
# ---------                            --------- --------- ----
# 7971f918-a847-4430-9279-4a52d1efe18d False     True      Microsoft Update
# 8b24b027-1dee-babb-9a95-3517dfb9c552 False     False     DCat Flighting Prod
# 855e8a7c-ecb4-4ca3-b045-1dfa50104289 False     False     Windows Store (DCat Prod)
# 9482f4b4-e343-43b6-b170-9a65bc822c77 False     False     Windows Update

# install everything that's available via Microsoft Update
Install-WindowsUpdate -MicrosoftUpdate -AcceptAll -Verbose
# VERBOSE: N1 (10.2.2021. 8:31:41): Connecting to Microsoft Update server. Please wait...
# VERBOSE: Found [9] Updates in pre search criteria
# VERBOSE: Found [9] Updates in post search criteria

# X ComputerName Result     KB          Size Title
# - ------------ ------     --          ---- -----
# 1 N1           Accepted   KB4481252   13MB Microsoft Silverlight (KB4481252)
# 1 N1           Accepted   KB4598459  126MB 2021-02 .NET Core 3.1.12 Security Update for x64 Client
# 1 N1           Accepted   KB890830    33MB Windows Malicious Software Removal Tool x64 - v5.86 (KB890830)
# 1 N1           Accepted   KB4601050   65MB 2021-02 Cumulative Update for .NET Framework 3.5 and 4.8 for Windows 10, ...
# 1 N1           Accepted   KB4052623    6MB Update for Microsoft Defender Antivirus antimalware platform - KB4052623 ...
# 1 N1           Accepted   KB2267602  697MB Security Intelligence Update for Microsoft Defender Antivirus - KB2267602...
# 1 N1           Accepted   KB2267602  697MB Security Intelligence Update for Microsoft Defender Antivirus - KB2267602...
# 1 N1           Accepted                2MB Hewlett-Packard Development Company, L.P. - Keyboard - Standard 101/102-K...
# 1 N1           Accepted   KB4601319  103GB 2021-02 Cumulative Update for Windows 10 Version 20H2 for x64-based Syste...
# VERBOSE: Accepted [9] Updates ready to Download
# 2 N1           Downloaded KB4481252   13MB Microsoft Silverlight (KB4481252)
# 2 N1           Downloaded KB4598459  126MB 2021-02 .NET Core 3.1.12 Security Update for x64 Client
# 2 N1           Downloaded KB890830    33MB Windows Malicious Software Removal Tool x64 - v5.86 (KB890830)
# 2 N1           Downloaded KB4601050   65MB 2021-02 Cumulative Update for .NET Framework 3.5 and 4.8 for Windows 10, ...
# 2 N1           Downloaded KB4052623    6MB Update for Microsoft Defender Antivirus antimalware platform - KB4052623 ...
# 2 N1           Downloaded KB2267602  697MB Security Intelligence Update for Microsoft Defender Antivirus - KB2267602...
# 2 N1           Downloaded KB2267602  697MB Security Intelligence Update for Microsoft Defender Antivirus - KB2267602...
# 2 N1           Downloaded              2MB Hewlett-Packard Development Company, L.P. - Keyboard - Standard 101/102-K...
# 2 N1           Downloaded KB4601319  103GB 2021-02 Cumulative Update for Windows 10 Version 20H2 for x64-based Syste...
# VERBOSE: Downloaded [9] Updates ready to Install
# 3 N1           Installed  KB4481252   13MB Microsoft Silverlight (KB4481252)
# 3 N1           Installed  KB4598459  126MB 2021-02 .NET Core 3.1.12 Security Update for x64 Client
# 3 N1           Installed  KB890830    33MB Windows Malicious Software Removal Tool x64 - v5.86 (KB890830)
# 3 N1           Installed  KB4601050   65MB 2021-02 Cumulative Update for .NET Framework 3.5 and 4.8 for Windows 10, ...
# 3 N1           Installed  KB4052623    6MB Update for Microsoft Defender Antivirus antimalware platform - KB4052623 ...
# 3 N1           Installed  KB2267602  697MB Security Intelligence Update for Microsoft Defender Antivirus - KB2267602...
# 3 N1           Installed  KB2267602  697MB Security Intelligence Update for Microsoft Defender Antivirus - KB2267602...
# 3 N1           Installed               2MB Hewlett-Packard Development Company, L.P. - Keyboard - Standard 101/102-K...
# 3 N1           Installed  KB4601319  103GB 2021-02 Cumulative Update for Windows 10 Version 20H2 for x64-based Syste...
# VERBOSE: Installed [9] Updates
# Reboot is required. Do it now? [Y / N] (default is 'N')

100

101

102

103

104

105

106

# check if you have PSGallery under your PowerShell repositories (and check the installation policy)

# if it's not, you can easily register it with "Register-PSRepository -Default"

Get-PSRepository

# Name InstallationPolicy SourceLocation

# ---- ------------------ --------------

# PSGallery Untrusted https://www.powershellgallery.com/api/v2

# NuGet package provider is required - if not present, you'll be asked to install it

Install-PackageProvider -Name NuGet -MinimumVersion 2.8.5.201 -Force

# Name Version Source Summary

# ---- ------- ------ -------

# nuget 2.8.5.208 https://onege... NuGet provider for the OneGet meta-package manager

# mark PSGallery as trusted (optional)

Set-PSRepository -Name 'PSGallery' -InstallationPolicy Trusted

# are we ready?

Get-PSRepository

# Name InstallationPolicy SourceLocation

# ---- ------------------ --------------

# PSGallery Trusted https://www.powershellgallery.com/api/v2

# install the PSWindowsUpdate module (from PSGallery)

Install-Module PSWindowsUpdate

# check what's available

Get-Command -Module PSWindowsUpdate

# CommandType Name Version Source

# ----------- ---- ------- ------

# Alias Clear-WUJob 2.2.0.2 PSWindowsUpdate

# Alias Download-WindowsUpdate 2.2.0.2 PSWindowsUpdate

# Alias Get-WUInstall 2.2.0.2 PSWindowsUpdate

# Alias Get-WUList 2.2.0.2 PSWindowsUpdate

# Alias Hide-WindowsUpdate 2.2.0.2 PSWindowsUpdate

# Alias Install-WindowsUpdate 2.2.0.2 PSWindowsUpdate

# Alias Show-WindowsUpdate 2.2.0.2 PSWindowsUpdate

# Alias UnHide-WindowsUpdate 2.2.0.2 PSWindowsUpdate

# Alias Uninstall-WindowsUpdate 2.2.0.2 PSWindowsUpdate

# Cmdlet Add-WUServiceManager 2.2.0.2 PSWindowsUpdate

# Cmdlet Enable-WURemoting 2.2.0.2 PSWindowsUpdate

# Cmdlet Get-WindowsUpdate 2.2.0.2 PSWindowsUpdate

# Cmdlet Get-WUApiVersion 2.2.0.2 PSWindowsUpdate

# Cmdlet Get-WUHistory 2.2.0.2 PSWindowsUpdate

# Cmdlet Get-WUInstallerStatus 2.2.0.2 PSWindowsUpdate

# Cmdlet Get-WUJob 2.2.0.2 PSWindowsUpdate

# Cmdlet Get-WULastResults 2.2.0.2 PSWindowsUpdate

# Cmdlet Get-WUOfflineMSU 2.2.0.2 PSWindowsUpdate

# Cmdlet Get-WURebootStatus 2.2.0.2 PSWindowsUpdate

# Cmdlet Get-WUServiceManager 2.2.0.2 PSWindowsUpdate

# Cmdlet Get-WUSettings 2.2.0.2 PSWindowsUpdate

# Cmdlet Invoke-WUJob 2.2.0.2 PSWindowsUpdate

# Cmdlet Remove-WindowsUpdate 2.2.0.2 PSWindowsUpdate

# Cmdlet Remove-WUServiceManager 2.2.0.2 PSWindowsUpdate

# Cmdlet Reset-WUComponents 2.2.0.2 PSWindowsUpdate

# Cmdlet Set-PSWUSettings 2.2.0.2 PSWindowsUpdate

# Cmdlet Set-WUSettings 2.2.0.2 PSWindowsUpdate

# Cmdlet Update-WUModule 2.2.0.2 PSWindowsUpdate

# check which update sources you have installed in your system

Get-WUServiceManager

# ServiceID IsManaged IsDefault Name

# --------- --------- --------- ----

# 7971f918-a847-4430-9279-4a52d1efe18d False True Microsoft Update

# 8b24b027-1dee-babb-9a95-3517dfb9c552 False False DCat Flighting Prod

# 855e8a7c-ecb4-4ca3-b045-1dfa50104289 False False Windows Store (DCat Prod)

# 9482f4b4-e343-43b6-b170-9a65bc822c77 False False Windows Update

# install everything that's available via Microsoft Update

Install-WindowsUpdate -MicrosoftUpdate -AcceptAll -Verbose

# VERBOSE: N1 (10.2.2021. 8:31:41): Connecting to Microsoft Update server. Please wait...

# VERBOSE: Found [9] Updates in pre search criteria

# VERBOSE: Found [9] Updates in post search criteria

# X ComputerName Result KB Size Title

# - ------------ ------ -- ---- -----

# 1 N1 Accepted KB4481252 13MB Microsoft Silverlight (KB4481252)

# 1 N1 Accepted KB4598459 126MB 2021-02 .NET Core 3.1.12 Security Update for x64 Client

# 1 N1 Accepted KB890830 33MB Windows Malicious Software Removal Tool x64 - v5.86 (KB890830)

# 1 N1 Accepted KB4601050 65MB 2021-02 Cumulative Update for .NET Framework 3.5 and 4.8 for Windows 10, ...

# 1 N1 Accepted KB4052623 6MB Update for Microsoft Defender Antivirus antimalware platform - KB4052623 ...

# 1 N1 Accepted KB2267602 697MB Security Intelligence Update for Microsoft Defender Antivirus - KB2267602...

# 1 N1 Accepted 2MB Hewlett-Packard Development Company, L.P. - Keyboard - Standard 101/102-K...

# 1 N1 Accepted KB4601319 103GB 2021-02 Cumulative Update for Windows 10 Version 20H2 for x64-based Syste...

# VERBOSE: Accepted [9] Updates ready to Download

# 2 N1 Downloaded KB4481252 13MB Microsoft Silverlight (KB4481252)

# 2 N1 Downloaded KB4598459 126MB 2021-02 .NET Core 3.1.12 Security Update for x64 Client

# 2 N1 Downloaded KB890830 33MB Windows Malicious Software Removal Tool x64 - v5.86 (KB890830)

# 2 N1 Downloaded KB4601050 65MB 2021-02 Cumulative Update for .NET Framework 3.5 and 4.8 for Windows 10, ...

# 2 N1 Downloaded KB4052623 6MB Update for Microsoft Defender Antivirus antimalware platform - KB4052623 ...

# 2 N1 Downloaded KB2267602 697MB Security Intelligence Update for Microsoft Defender Antivirus - KB2267602...

# 2 N1 Downloaded 2MB Hewlett-Packard Development Company, L.P. - Keyboard - Standard 101/102-K...

# 2 N1 Downloaded KB4601319 103GB 2021-02 Cumulative Update for Windows 10 Version 20H2 for x64-based Syste...

# VERBOSE: Downloaded [9] Updates ready to Install

# 3 N1 Installed KB4481252 13MB Microsoft Silverlight (KB4481252)

# 3 N1 Installed KB4598459 126MB 2021-02 .NET Core 3.1.12 Security Update for x64 Client

# 3 N1 Installed KB890830 33MB Windows Malicious Software Removal Tool x64 - v5.86 (KB890830)

# 3 N1 Installed KB4601050 65MB 2021-02 Cumulative Update for .NET Framework 3.5 and 4.8 for Windows 10, ...

# 3 N1 Installed KB4052623 6MB Update for Microsoft Defender Antivirus antimalware platform - KB4052623 ...

# 3 N1 Installed KB2267602 697MB Security Intelligence Update for Microsoft Defender Antivirus - KB2267602...

# 3 N1 Installed 2MB Hewlett-Packard Development Company, L.P. - Keyboard - Standard 101/102-K...

# 3 N1 Installed KB4601319 103GB 2021-02 Cumulative Update for Windows 10 Version 20H2 for x64-based Syste...

# VERBOSE: Installed [9] Updates

# Reboot is required. Do it now? [Y / N] (default is 'N')

And that’s it – we’re done!

Happy patching!

Cheers!

Yet another “Kubernetes with Raspberry Pi” post

By Tomica Kaniski in Other 08/12/2020 4 Comments

There’s a ton of the tutorials on how to get Kubernetes installed onto your Raspberry Pi, so… let’s write another one. 😊

As mentioned in my last post, I’ve found my forgotten Raspberry Pi, and played around with installing and configuring Raspbian Buster on it.

Today, I wanted to check if it will be possible to install Kubernetes onto such small machine – they are many articles on the “widest of the world’s webs” that say “Yes, it can be done!“, so I’ve decided to give it a try! And I chose to follow one of them (seemed like a nice reference).

As you remember, I’m starting with a cleanly installed (and just slightly customized) Raspbian Buster and building it from there.

And I’ll be using kubeadm for installing my cluster.

So, once I had at least two machines (my Raspberry Pi for the “control plane” and Ubuntu 20.04 LTS Hyper-V virtual machine as the “node” – you can read more about it here), I prepared them like this:

install Docker (in my case)
change the default cgroups driver for Docker to systemd
add cgroups limit support (for my Raspberry Pi 3)
configure iptables
disable swap (this one was a bit challenging)
prepare for Kubernetes installation (source, keys, kubeadm)
install Kubernetes “control plane”
add flannel
add a node to the cluster
test with some workload

One thing that bothered me (on Buster) was disabling swap in a way that it also stays disabled after a reboot (I know, it’s the details that eventually get you) – after a while, I’ve stumbled on this forum post and the solution provided by “powerpete” did the trick! Thank you, @powerpete! 😊

And finally, details about the each step are here (outputs are commented and somewhat redacted/condensed):

# install Docker
sudo apt install -yqq docker.io
# The following additional packages will be installed:
#   cgroupfs-mount git git-man libcurl3-gnutls liberror-perl libintl-perl libintl-xs-perl libltdl7 libmodule-find-perl
#   libmodule-scandeps-perl libnspr4 libnss3 libproc-processtable-perl libsort-naturally-perl libterm-readkey-perl
#   needrestart runc tini
# ...
# The following NEW packages will be installed:
#   cgroupfs-mount docker.io git git-man libcurl3-gnutls liberror-perl libintl-perl libintl-xs-perl libltdl7
#   libmodule-find-perl libmodule-scandeps-perl libnspr4 libnss3 libproc-processtable-perl libsort-naturally-perl
#   libterm-readkey-perl needrestart runc tini
# 0 upgraded, 19 newly installed, 0 to remove and 0 not upgraded.
# ...

# check docker info and change the default cgroups driver for Docker to systemd
sudo docker info
# ...
# Server Version: 18.09.1
# Storage Driver: overlay2
# ...
# Logging Driver: json-file
# Cgroup Driver: cgroupfs
# ...
# Kernel Version: 5.4.79-v7+
# Operating System: Raspbian GNU/Linux 10 (buster)
# OSType: linux
# Architecture: armv7l
# CPUs: 4
# Total Memory: 974.4MiB
# Name: pimaster
# ...
#
# WARNING: No memory limit support
# WARNING: No swap limit support
# WARNING: No kernel memory limit support
# WARNING: No oom kill disable support

# create/edit the /etc/docker/daemon.json file (with the following content, uncommented) and restart docker service
sudo nano /etc/docker/daemon.json
# {
#   "exec-opts": ["native.cgroupdriver=systemd"],
#   "log-driver": "json-file",
#   "log-opts": {
#     "max-size": "100m"
#   },
#   "storage-driver": "overlay2"
# }

sudo systemctl restart docker

# docker info now showing the changed cgroup driver
sudo docker info
# ...
# Cgroup Driver: systemd
# ...
# 
# WARNING: No memory limit support
# WARNING: No swap limit support
# WARNING: No kernel memory limit support
# WARNING: No oom kill disable support

# add cgroups limit support and reboot
sudo sed -i '$ s/$/ cgroup_enable=cpuset cgroup_enable=memory cgroup_memory=1 swapaccount=1/' /boot/cmdline.txt
# console=tty1 root=PARTUUID=03f5b65e-02 rootfstype=ext4 elevator=deadline fsck.repair=yes rootwait cgroup_enable=cpuset cgroup_enable=memory cgroup_memory=1 swapaccount=1

sudo reboot

# recheck docker info (warnings should be gone)
sudo docker info
# ...
# Storage Driver: overlay2
# ...
# Logging Driver: json-file
# Cgroup Driver: systemd
# ...
# Operating System: Raspbian GNU/Linux 10 (buster)
# ...

# configure iptables
cat << EOF | sudo tee /etc/sysctl.d/k8s.conf
net.bridge.bridge-nf-call-ip6tables = 1
net.bridge.bridge-nf-call-iptables = 1
EOF

# configure iptables (add lines to the file, uncommented) and apply the configuration
sudo nano /etc/sysctl.d/k8s.conf
# net.bridge.bridge-nf-call-ip6tables = 1
# net.bridge.bridge-nf-call-iptables = 1

sudo sysctl --system
* Applying /etc/sysctl.d/98-rpi.conf ...
# kernel.printk = 3 4 1 3
# vm.min_free_kbytes = 16384
# * Applying /etc/sysctl.d/99-sysctl.conf ...
# * Applying /etc/sysctl.d/k8s.conf ...
# net.bridge.bridge-nf-call-ip6tables = 1
# net.bridge.bridge-nf-call-iptables = 1
# * Applying /etc/sysctl.d/protect-links.conf ...
# fs.protected_hardlinks = 1
# fs.protected_symlinks = 1
# * Applying /etc/sysctl.conf ...

# disable swap
# check current swap utilization/settings
free -m
#               total        used        free      shared  buff/cache   available
# Mem:            974          82         709           6         182         834
# Swap:            99           0          99

sudo cat /etc/fstab
# proc            /proc           proc    defaults          0       0
# PARTUUID=03f5b65e-01  /boot           vfat    defaults          0       2
# PARTUUID=03f5b65e-02  /               ext4    defaults,noatime  0       1

# disable swap (note - disabling the service as well!)
sudo dphys-swapfile swapoff
sudo dphys-swapfile uninstall
sudo update-rc.d dphys-swapfile remove
sudo systemctl disable dphys-swapfile.service
# Synchronizing state of dphys-swapfile.service with SysV service script with /lib/systemd/systemd-sysv-install.
# Executing: /lib/systemd/systemd-sysv-install disable dphys-swapfile
# Removed /etc/systemd/system/multi-user.target.wants/dphys-swapfile.service.

# optionally - reboot & recheck
free -m
#               total        used        free      shared  buff/cache   available
# Mem:            974          79         745          12         149         832
# Swap:             0           0           0

# prepare for Kubernetes installation (source, keys, kubeadm) and "lock" the kubelet, kubeadm and kubectl versions
curl -s https://packages.cloud.google.com/apt/doc/apt-key.gpg | sudo apt-key add -
# OK

echo "deb https://apt.kubernetes.io/ kubernetes-xenial main" | sudo tee /etc/apt/sources.list.d/kubernetes.list
# deb https://apt.kubernetes.io/ kubernetes-xenial main

sudo apt -qq update
# All packages are up to date.

sudo apt install -yqq kubeadm
# The following additional packages will be installed:
#   conntrack cri-tools ebtables kubectl kubelet kubernetes-cni socat
# Suggested packages:
#   nftables
# The following NEW packages will be installed:
#   conntrack cri-tools ebtables kubeadm kubectl kubelet kubernetes-cni socat
# 0 upgraded, 8 newly installed, 0 to remove and 0 not upgraded.
# ...

sudo apt-mark hold kubelet kubeadm kubectl
# kubelet set on hold.
# kubeadm set on hold.
# kubectl set on hold.

# install Kubernetes control plane
# generate token for the installation
TOKEN=$(sudo kubeadm token generate)
echo $TOKEN
# rqyytr.f3pvvz2yepq51b7h

sudo kubeadm init --token=${TOKEN} --kubernetes-version=v1.19.4 --pod-network-cidr=10.244.0.0/16
# W1208 16:59:02.624049     781 configset.go:348] WARNING: kubeadm cannot validate component configs for API groups [kubelet.config.k8s.io kubeproxy.config.k8s.io]
# [init] Using Kubernetes version: v1.19.4
# [preflight] Running pre-flight checks
#         [WARNING SystemVerification]: missing optional cgroups: hugetlb
# [preflight] Pulling images required for setting up a Kubernetes cluster
# [preflight] This might take a minute or two, depending on the speed of your internet connection
# [preflight] You can also perform this action in beforehand using 'kubeadm config images pull'
# [certs] Using certificateDir folder "/etc/kubernetes/pki"
# [certs] Generating "ca" certificate and key
# [certs] Generating "apiserver" certificate and key
# [certs] apiserver serving cert is signed for DNS names [kubernetes kubernetes.default kubernetes.default.svc kubernetes.default.svc.cluster.local pimaster] and IPs [10.96.0.1 192.168.12.101]
# [certs] Generating "apiserver-kubelet-client" certificate and key
# [certs] Generating "front-proxy-ca" certificate and key
# [certs] Generating "front-proxy-client" certificate and key
# [certs] Generating "etcd/ca" certificate and key
# [certs] Generating "etcd/server" certificate and key
# [certs] etcd/server serving cert is signed for DNS names [localhost pimaster] and IPs [192.168.12.101 127.0.0.1 ::1]
# [certs] Generating "etcd/peer" certificate and key
# [certs] etcd/peer serving cert is signed for DNS names [localhost pimaster] and IPs [192.168.12.101 127.0.0.1 ::1]
# [certs] Generating "etcd/healthcheck-client" certificate and key
# [certs] Generating "apiserver-etcd-client" certificate and key
# [certs] Generating "sa" key and public key
# [kubeconfig] Using kubeconfig folder "/etc/kubernetes"
# [kubeconfig] Writing "admin.conf" kubeconfig file
# [kubeconfig] Writing "kubelet.conf" kubeconfig file
# [kubeconfig] Writing "controller-manager.conf" kubeconfig file
# [kubeconfig] Writing "scheduler.conf" kubeconfig file
# [kubelet-start] Writing kubelet environment file with flags to file "/var/lib/kubelet/kubeadm-flags.env"
# [kubelet-start] Writing kubelet configuration to file "/var/lib/kubelet/config.yaml"
# [kubelet-start] Starting the kubelet
# [control-plane] Using manifest folder "/etc/kubernetes/manifests"
# [control-plane] Creating static Pod manifest for "kube-apiserver"
# [control-plane] Creating static Pod manifest for "kube-controller-manager"
# [control-plane] Creating static Pod manifest for "kube-scheduler"
# [etcd] Creating static Pod manifest for local etcd in "/etc/kubernetes/manifests"
# [wait-control-plane] Waiting for the kubelet to boot up the control plane as static Pods from directory "/etc/kubernetes/manifests". This can take up to 4m0s
# [kubelet-check] Initial timeout of 40s passed.
# [kubelet-check] It seems like the kubelet isn't running or healthy.
# [kubelet-check] The HTTP call equal to 'curl -sSL http://localhost:10248/healthz' failed with error: Get "http://localhost:10248/healthz": dial tcp [::1]:10248: connect: connection refused.
# [kubelet-check] It seems like the kubelet isn't running or healthy.
# [kubelet-check] The HTTP call equal to 'curl -sSL http://localhost:10248/healthz' failed with error: Get "http://localhost:10248/healthz": dial tcp [::1]:10248: connect: connection refused.
# [kubelet-check] It seems like the kubelet isn't running or healthy.
# [kubelet-check] The HTTP call equal to 'curl -sSL http://localhost:10248/healthz' failed with error: Get "http://localhost:10248/healthz": dial tcp [::1]:10248: connect: connection refused.
# [apiclient] All control plane components are healthy after 212.227971 seconds
# [upload-config] Storing the configuration used in ConfigMap "kubeadm-config" in the "kube-system" Namespace
# [kubelet] Creating a ConfigMap "kubelet-config-1.19" in namespace kube-system with the configuration for the kubelets in the cluster
# [upload-certs] Skipping phase. Please see --upload-certs
# [mark-control-plane] Marking the node pimaster as control-plane by adding the label "node-role.kubernetes.io/master=''"
# [mark-control-plane] Marking the node pimaster as control-plane by adding the taints [node-role.kubernetes.io/master:NoSchedule]
# [bootstrap-token] Using token: rqyytr.f3pvvz2yepq51b7h
# [bootstrap-token] Configuring bootstrap tokens, cluster-info ConfigMap, RBAC Roles
# [bootstrap-token] configured RBAC rules to allow Node Bootstrap tokens to get nodes
# [bootstrap-token] configured RBAC rules to allow Node Bootstrap tokens to post CSRs in order for nodes to get long term certificate credentials
# [bootstrap-token] configured RBAC rules to allow the csrapprover controller automatically approve CSRs from a Node Bootstrap Token
# [bootstrap-token] configured RBAC rules to allow certificate rotation for all node client certificates in the cluster
# [bootstrap-token] Creating the "cluster-info" ConfigMap in the "kube-public" namespace
# [kubelet-finalize] Updating "/etc/kubernetes/kubelet.conf" to point to a rotatable kubelet client certificate and key
# [addons] Applied essential addon: CoreDNS
# [addons] Applied essential addon: kube-proxy
#
# Your Kubernetes control-plane has initialized successfully!
# 
# To start using your cluster, you need to run the following as a regular user:
#   mkdir -p $HOME/.kube
#   sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
#   sudo chown $(id -u):$(id -g) $HOME/.kube/config
#
# You should now deploy a pod network to the cluster.
# Run "kubectl apply -f [podnetwork].yaml" with one of the options listed at:
#   https://kubernetes.io/docs/concepts/cluster-administration/addons/
#
# Then you can join any number of worker nodes by running the following on each as root:
#
# kubeadm join 192.168.12.101:6443 --token rqyytr.f3pvvz2yepq51b7h \
#     --discovery-token-ca-cert-hash sha256:5b04368aaee148fa3eb8c6aed3c3bc8041248590e2055a81617d16d8f796bb77

# start using the cluster
mkdir -p $HOME/.kube
sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
sudo chown $(id -u):$(id -g) $HOME/.kube/config

# check node status (something's missing - flannel)
kubectl get nodes
# NAME       STATUS     ROLES    AGE    VERSION
# pimaster   NotReady   master   14m    v1.19.4

# install flannel network plugin
kubectl apply -f https://raw.githubusercontent.com/coreos/flannel/master/Documentation/kube-flannel.yml
# podsecuritypolicy.policy/psp.flannel.unprivileged created
# clusterrole.rbac.authorization.k8s.io/flannel created
# clusterrolebinding.rbac.authorization.k8s.io/flannel created
# serviceaccount/flannel created
# configmap/kube-flannel-cfg created
# daemonset.apps/kube-flannel-ds created

# and now we're ready (check under STATUS)
kubectl get nodes
# NAME       STATUS     ROLES    AGE     VERSION
# pimaster   Ready      master   17m     v1.19.4

# add node to the cluster (pinode, 192.168.12.102)
sudo kubeadm join 192.168.12.101:6443 --token rqyytr.f3pvvz2yepq51b7h --discovery-token-ca-cert-hash sha256:5b04368aaee148fa3eb8c6aed3c3bc8041248590e2055a81617d16d8f796bb77
# [preflight] Running pre-flight checks
# [preflight] Reading configuration from the cluster...
# [preflight] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -oyaml'
# [kubelet-start] Writing kubelet configuration to file "/var/lib/kubelet/config.yaml"
# [kubelet-start] Writing kubelet environment file with flags to file "/var/lib/kubelet/kubeadm-flags.env"
# [kubelet-start] Starting the kubelet
# [kubelet-start] Waiting for the kubelet to perform the TLS Bootstrap...
#
# This node has joined the cluster:
# * Certificate signing request was sent to apiserver and a response was received.
# * The Kubelet was informed of the new secure connection details.
#
# Run 'kubectl get nodes' on the control-plane to see this node join the cluster.

# check nodes in the cluster (check the details... nice)
kubectl get nodes -o wide
# NAME       STATUS   ROLES    AGE     VERSION   INTERNAL-IP      EXTERNAL-IP   OS-IMAGE                         KERNEL-VERSION     CONTAINER-RUNTIME
# pimaster   Ready    master   18m     v1.19.4   192.168.12.101           Raspbian GNU/Linux 10 (buster)   5.4.79-v7+         docker://18.9.1
# pinode     Ready       6m15s   v1.19.4   192.168.12.102           Ubuntu 20.04.1 LTS               5.4.0-56-generic   docker://19.3.8

# test with some workload
kubectl apply -f https://k8s.io/examples/application/guestbook/redis-master-deployment.yaml
# deployment.apps/redis-master created

kubectl get pods
# NAME                           READY   STATUS    RESTARTS   AGE
# redis-master-f46ff57fd-9m9g9   1/1     Running   0          37s

kubectl apply -f https://k8s.io/examples/application/guestbook/redis-master-service.yaml
# service/redis-master created

kubectl get service
# NAME           TYPE        CLUSTER-IP       EXTERNAL-IP   PORT(S)    AGE
# kubernetes     ClusterIP   10.96.0.1                443/TCP    22m
# redis-master   ClusterIP   10.100.245.207           6379/TCP   4s

kubectl apply -f https://k8s.io/examples/application/guestbook/redis-slave-deployment.yaml
# deployment.apps/redis-slave created

kubectl get pods
# NAME                           READY   STATUS    RESTARTS   AGE
# redis-master-f46ff57fd-9m9g9   1/1     Running   0          2m30s
# redis-slave-bbc7f655d-dz895    1/1     Running   0          12s
# redis-slave-bbc7f655d-slnhv    1/1     Running   0          12s

kubectl apply -f https://k8s.io/examples/application/guestbook/redis-slave-service.yaml
# service/redis-slave created

kubectl get services
# NAME           TYPE        CLUSTER-IP       EXTERNAL-IP   PORT(S)    AGE
# kubernetes     ClusterIP   10.96.0.1                443/TCP    23m
# redis-master   ClusterIP   10.100.245.207           6379/TCP   91s
# redis-slave    ClusterIP   10.101.165.188           6379/TCP   13s

kubectl apply -f https://k8s.io/examples/application/guestbook/frontend-deployment.yaml
# deployment.apps/frontend created

kubectl get pods -l app=guestbook -l tier=frontend
# NAME                        READY   STATUS    RESTARTS   AGE
# frontend-6c6d6dfd4d-945hd   1/1     Running   0          7s
# frontend-6c6d6dfd4d-mm7vm   1/1     Running   0          7s
# frontend-6c6d6dfd4d-wllpx   1/1     Running   0          7s

kubectl apply -f https://k8s.io/examples/application/guestbook/frontend-service.yaml
# service/frontend created

kubectl get services
# NAME           TYPE        CLUSTER-IP       EXTERNAL-IP   PORT(S)        AGE
# frontend       NodePort    10.101.140.217           80:31597/TCP   4s
# kubernetes     ClusterIP   10.96.0.1                443/TCP        24m
# redis-master   ClusterIP   10.100.245.207           6379/TCP       2m45s
# redis-slave    ClusterIP   10.101.165.188           6379/TCP       87s

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

167

168

169

170

171

172

173

174

175

176

177

178

179

180

181

182

183

184

185

186

187

188

189

190

191

192

193

194

195

196

197

198

199

200

201

202

203

204

205

206

207

208

209

210

211

212

213

214

215

216

217

218

219

220

221

222

223

224

225

226

227

228

229

230

231

232

233

234

235

236

237

238

239

240

241

242

243

244

245

246

247

248

249

250

251

252

253

254

255

256

257

258

259

260

261

262

263

264

265

266

267

268

269

270

271

272

273

274

275

276

277

278

279

280

281

282

283

284

285

286

287

288

289

290

291

292

293

294

295

296

297

298

299

300

301

302

303

304

305

306

307

308

309

310

311

312

313

314

315

316

317

318

319

320

321

322

323

324

325

326

327

328

329

330

331

332

333

334

335

# install Docker

sudo apt install -yqq docker.io

# The following additional packages will be installed:

# cgroupfs-mount git git-man libcurl3-gnutls liberror-perl libintl-perl libintl-xs-perl libltdl7 libmodule-find-perl

# libmodule-scandeps-perl libnspr4 libnss3 libproc-processtable-perl libsort-naturally-perl libterm-readkey-perl

# needrestart runc tini

# ...

# The following NEW packages will be installed:

# cgroupfs-mount docker.io git git-man libcurl3-gnutls liberror-perl libintl-perl libintl-xs-perl libltdl7

# libmodule-find-perl libmodule-scandeps-perl libnspr4 libnss3 libproc-processtable-perl libsort-naturally-perl

# libterm-readkey-perl needrestart runc tini

# 0 upgraded, 19 newly installed, 0 to remove and 0 not upgraded.

# ...

# check docker info and change the default cgroups driver for Docker to systemd

sudo docker info

# ...

# Server Version: 18.09.1

# Storage Driver: overlay2

# ...

# Logging Driver: json-file

# Cgroup Driver: cgroupfs

# ...

# Kernel Version: 5.4.79-v7+

# Operating System: Raspbian GNU/Linux 10 (buster)

# OSType: linux

# Architecture: armv7l

# CPUs: 4

# Total Memory: 974.4MiB

# Name: pimaster

# ...

# WARNING: No memory limit support

# WARNING: No swap limit support

# WARNING: No kernel memory limit support

# WARNING: No oom kill disable support

# create/edit the /etc/docker/daemon.json file (with the following content, uncommented) and restart docker service

sudo nano /etc/docker/daemon.json

# {

# "exec-opts": ["native.cgroupdriver=systemd"],

# "log-driver": "json-file",

# "log-opts": {

# "max-size": "100m"

# },

# "storage-driver": "overlay2"

# }

sudo systemctl restart docker

# docker info now showing the changed cgroup driver

sudo docker info

# ...

# Cgroup Driver: systemd

# ...

# WARNING: No memory limit support

# WARNING: No swap limit support

# WARNING: No kernel memory limit support

# WARNING: No oom kill disable support

# add cgroups limit support and reboot

sudo sed -i '$ s/$/ cgroup_enable=cpuset cgroup_enable=memory cgroup_memory=1 swapaccount=1/' /boot/cmdline.txt

# console=tty1 root=PARTUUID=03f5b65e-02 rootfstype=ext4 elevator=deadline fsck.repair=yes rootwait cgroup_enable=cpuset cgroup_enable=memory cgroup_memory=1 swapaccount=1

sudo reboot

# recheck docker info (warnings should be gone)

sudo docker info

# ...

# Storage Driver: overlay2

# ...

# Logging Driver: json-file

# Cgroup Driver: systemd

# ...

# Operating System: Raspbian GNU/Linux 10 (buster)

# ...

# configure iptables

cat << EOF | sudo tee /etc/sysctl.d/k8s.conf

net.bridge.bridge-nf-call-ip6tables = 1

net.bridge.bridge-nf-call-iptables = 1

EOF

# configure iptables (add lines to the file, uncommented) and apply the configuration

sudo nano /etc/sysctl.d/k8s.conf

# net.bridge.bridge-nf-call-ip6tables = 1

# net.bridge.bridge-nf-call-iptables = 1

sudo sysctl --system

* Applying /etc/sysctl.d/98-rpi.conf ...

# kernel.printk = 3 4 1 3

# vm.min_free_kbytes = 16384

# * Applying /etc/sysctl.d/99-sysctl.conf ...

# * Applying /etc/sysctl.d/k8s.conf ...

# net.bridge.bridge-nf-call-ip6tables = 1

# net.bridge.bridge-nf-call-iptables = 1

# * Applying /etc/sysctl.d/protect-links.conf ...

# fs.protected_hardlinks = 1

# fs.protected_symlinks = 1

# * Applying /etc/sysctl.conf ...

# disable swap

# check current swap utilization/settings

free -m

# total used free shared buff/cache available

# Mem: 974 82 709 6 182 834

# Swap: 99 0 99

sudo cat /etc/fstab

# proc /proc proc defaults 0 0

# PARTUUID=03f5b65e-01 /boot vfat defaults 0 2

# PARTUUID=03f5b65e-02 / ext4 defaults,noatime 0 1

# disable swap (note - disabling the service as well!)

sudo dphys-swapfile swapoff

sudo dphys-swapfile uninstall

sudo update-rc.d dphys-swapfile remove

sudo systemctl disable dphys-swapfile.service

# Synchronizing state of dphys-swapfile.service with SysV service script with /lib/systemd/systemd-sysv-install.

# Executing: /lib/systemd/systemd-sysv-install disable dphys-swapfile

# Removed /etc/systemd/system/multi-user.target.wants/dphys-swapfile.service.

# optionally - reboot & recheck

free -m

# total used free shared buff/cache available

# Mem: 974 79 745 12 149 832

# Swap: 0 0 0

# prepare for Kubernetes installation (source, keys, kubeadm) and "lock" the kubelet, kubeadm and kubectl versions

curl -s https://packages.cloud.google.com/apt/doc/apt-key.gpg | sudo apt-key add -

# OK

echo "deb https://apt.kubernetes.io/ kubernetes-xenial main" | sudo tee /etc/apt/sources.list.d/kubernetes.list

# deb https://apt.kubernetes.io/ kubernetes-xenial main

sudo apt -qq update

# All packages are up to date.

sudo apt install -yqq kubeadm

# The following additional packages will be installed:

# conntrack cri-tools ebtables kubectl kubelet kubernetes-cni socat

# Suggested packages:

# nftables

# The following NEW packages will be installed:

# conntrack cri-tools ebtables kubeadm kubectl kubelet kubernetes-cni socat

# 0 upgraded, 8 newly installed, 0 to remove and 0 not upgraded.

# ...

sudo apt-mark hold kubelet kubeadm kubectl

# kubelet set on hold.

# kubeadm set on hold.

# kubectl set on hold.

# install Kubernetes control plane

# generate token for the installation

TOKEN=$(sudo kubeadm token generate)

echo $TOKEN

# rqyytr.f3pvvz2yepq51b7h

sudo kubeadm init --token=${TOKEN} --kubernetes-version=v1.19.4 --pod-network-cidr=10.244.0.0/16

# W1208 16:59:02.624049 781 configset.go:348] WARNING: kubeadm cannot validate component configs for API groups [kubelet.config.k8s.io kubeproxy.config.k8s.io]

# [init] Using Kubernetes version: v1.19.4

# [preflight] Running pre-flight checks

# [WARNING SystemVerification]: missing optional cgroups: hugetlb

# [preflight] Pulling images required for setting up a Kubernetes cluster

# [preflight] This might take a minute or two, depending on the speed of your internet connection

# [preflight] You can also perform this action in beforehand using 'kubeadm config images pull'

# [certs] Using certificateDir folder "/etc/kubernetes/pki"

# [certs] Generating "ca" certificate and key

# [certs] Generating "apiserver" certificate and key

# [certs] apiserver serving cert is signed for DNS names [kubernetes kubernetes.default kubernetes.default.svc kubernetes.default.svc.cluster.local pimaster] and IPs [10.96.0.1 192.168.12.101]

# [certs] Generating "apiserver-kubelet-client" certificate and key

# [certs] Generating "front-proxy-ca" certificate and key

# [certs] Generating "front-proxy-client" certificate and key

# [certs] Generating "etcd/ca" certificate and key

# [certs] Generating "etcd/server" certificate and key

# [certs] etcd/server serving cert is signed for DNS names [localhost pimaster] and IPs [192.168.12.101 127.0.0.1 ::1]

# [certs] Generating "etcd/peer" certificate and key

# [certs] etcd/peer serving cert is signed for DNS names [localhost pimaster] and IPs [192.168.12.101 127.0.0.1 ::1]

# [certs] Generating "etcd/healthcheck-client" certificate and key

# [certs] Generating "apiserver-etcd-client" certificate and key

# [certs] Generating "sa" key and public key

# [kubeconfig] Using kubeconfig folder "/etc/kubernetes"

# [kubeconfig] Writing "admin.conf" kubeconfig file

# [kubeconfig] Writing "kubelet.conf" kubeconfig file

# [kubeconfig] Writing "controller-manager.conf" kubeconfig file

# [kubeconfig] Writing "scheduler.conf" kubeconfig file

# [kubelet-start] Writing kubelet environment file with flags to file "/var/lib/kubelet/kubeadm-flags.env"

# [kubelet-start] Writing kubelet configuration to file "/var/lib/kubelet/config.yaml"

# [kubelet-start] Starting the kubelet

# [control-plane] Using manifest folder "/etc/kubernetes/manifests"

# [control-plane] Creating static Pod manifest for "kube-apiserver"

# [control-plane] Creating static Pod manifest for "kube-controller-manager"

# [control-plane] Creating static Pod manifest for "kube-scheduler"

# [etcd] Creating static Pod manifest for local etcd in "/etc/kubernetes/manifests"

# [wait-control-plane] Waiting for the kubelet to boot up the control plane as static Pods from directory "/etc/kubernetes/manifests". This can take up to 4m0s

# [kubelet-check] Initial timeout of 40s passed.

# [kubelet-check] It seems like the kubelet isn't running or healthy.

# [kubelet-check] The HTTP call equal to 'curl -sSL http://localhost:10248/healthz' failed with error: Get "http://localhost:10248/healthz": dial tcp [::1]:10248: connect: connection refused.

# [kubelet-check] It seems like the kubelet isn't running or healthy.

# [kubelet-check] The HTTP call equal to 'curl -sSL http://localhost:10248/healthz' failed with error: Get "http://localhost:10248/healthz": dial tcp [::1]:10248: connect: connection refused.

# [kubelet-check] It seems like the kubelet isn't running or healthy.

# [kubelet-check] The HTTP call equal to 'curl -sSL http://localhost:10248/healthz' failed with error: Get "http://localhost:10248/healthz": dial tcp [::1]:10248: connect: connection refused.

# [apiclient] All control plane components are healthy after 212.227971 seconds

# [upload-config] Storing the configuration used in ConfigMap "kubeadm-config" in the "kube-system" Namespace

# [kubelet] Creating a ConfigMap "kubelet-config-1.19" in namespace kube-system with the configuration for the kubelets in the cluster

# [upload-certs] Skipping phase. Please see --upload-certs

# [mark-control-plane] Marking the node pimaster as control-plane by adding the label "node-role.kubernetes.io/master=''"

# [mark-control-plane] Marking the node pimaster as control-plane by adding the taints [node-role.kubernetes.io/master:NoSchedule]

# [bootstrap-token] Using token: rqyytr.f3pvvz2yepq51b7h

# [bootstrap-token] Configuring bootstrap tokens, cluster-info ConfigMap, RBAC Roles

# [bootstrap-token] configured RBAC rules to allow Node Bootstrap tokens to get nodes

# [bootstrap-token] configured RBAC rules to allow Node Bootstrap tokens to post CSRs in order for nodes to get long term certificate credentials

# [bootstrap-token] configured RBAC rules to allow the csrapprover controller automatically approve CSRs from a Node Bootstrap Token

# [bootstrap-token] configured RBAC rules to allow certificate rotation for all node client certificates in the cluster

# [bootstrap-token] Creating the "cluster-info" ConfigMap in the "kube-public" namespace

# [kubelet-finalize] Updating "/etc/kubernetes/kubelet.conf" to point to a rotatable kubelet client certificate and key

# [addons] Applied essential addon: CoreDNS

# [addons] Applied essential addon: kube-proxy

# Your Kubernetes control-plane has initialized successfully!

# To start using your cluster, you need to run the following as a regular user:

# mkdir -p $HOME/.kube

# sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config

# sudo chown $(id -u):$(id -g) $HOME/.kube/config

# You should now deploy a pod network to the cluster.

# Run "kubectl apply -f [podnetwork].yaml" with one of the options listed at:

# https://kubernetes.io/docs/concepts/cluster-administration/addons/

# Then you can join any number of worker nodes by running the following on each as root:

# kubeadm join 192.168.12.101:6443 --token rqyytr.f3pvvz2yepq51b7h \

# --discovery-token-ca-cert-hash sha256:5b04368aaee148fa3eb8c6aed3c3bc8041248590e2055a81617d16d8f796bb77

# start using the cluster

mkdir -p $HOME/.kube

sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config

sudo chown $(id -u):$(id -g) $HOME/.kube/config

# check node status (something's missing - flannel)

kubectl get nodes

# NAME STATUS ROLES AGE VERSION

# pimaster NotReady master 14m v1.19.4

# install flannel network plugin

kubectl apply -f https://raw.githubusercontent.com/coreos/flannel/master/Documentation/kube-flannel.yml

# podsecuritypolicy.policy/psp.flannel.unprivileged created

# clusterrole.rbac.authorization.k8s.io/flannel created

# clusterrolebinding.rbac.authorization.k8s.io/flannel created

# serviceaccount/flannel created

# configmap/kube-flannel-cfg created

# daemonset.apps/kube-flannel-ds created

# and now we're ready (check under STATUS)

kubectl get nodes

# NAME STATUS ROLES AGE VERSION

# pimaster Ready master 17m v1.19.4

# add node to the cluster (pinode, 192.168.12.102)

sudo kubeadm join 192.168.12.101:6443 --token rqyytr.f3pvvz2yepq51b7h --discovery-token-ca-cert-hash sha256:5b04368aaee148fa3eb8c6aed3c3bc8041248590e2055a81617d16d8f796bb77

# [preflight] Running pre-flight checks

# [preflight] Reading configuration from the cluster...

# [preflight] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -oyaml'

# [kubelet-start] Writing kubelet configuration to file "/var/lib/kubelet/config.yaml"

# [kubelet-start] Writing kubelet environment file with flags to file "/var/lib/kubelet/kubeadm-flags.env"

# [kubelet-start] Starting the kubelet

# [kubelet-start] Waiting for the kubelet to perform the TLS Bootstrap...

# This node has joined the cluster:

# * Certificate signing request was sent to apiserver and a response was received.

# * The Kubelet was informed of the new secure connection details.

# Run 'kubectl get nodes' on the control-plane to see this node join the cluster.

# check nodes in the cluster (check the details... nice)

kubectl get nodes -o wide

# NAME STATUS ROLES AGE VERSION INTERNAL-IP EXTERNAL-IP OS-IMAGE KERNEL-VERSION CONTAINER-RUNTIME

# pimaster Ready master 18m v1.19.4 192.168.12.101 Raspbian GNU/Linux 10 (buster) 5.4.79-v7+ docker://18.9.1

# pinode Ready 6m15s v1.19.4 192.168.12.102 Ubuntu 20.04.1 LTS 5.4.0-56-generic docker://19.3.8

# test with some workload

kubectl apply -f https://k8s.io/examples/application/guestbook/redis-master-deployment.yaml

# deployment.apps/redis-master created

kubectl get pods

# NAME READY STATUS RESTARTS AGE

# redis-master-f46ff57fd-9m9g9 1/1 Running 0 37s

kubectl apply -f https://k8s.io/examples/application/guestbook/redis-master-service.yaml

# service/redis-master created

kubectl get service

# NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE

# kubernetes ClusterIP 10.96.0.1 443/TCP 22m

# redis-master ClusterIP 10.100.245.207 6379/TCP 4s

kubectl apply -f https://k8s.io/examples/application/guestbook/redis-slave-deployment.yaml

# deployment.apps/redis-slave created

kubectl get pods

# NAME READY STATUS RESTARTS AGE

# redis-master-f46ff57fd-9m9g9 1/1 Running 0 2m30s

# redis-slave-bbc7f655d-dz895 1/1 Running 0 12s

# redis-slave-bbc7f655d-slnhv 1/1 Running 0 12s

kubectl apply -f https://k8s.io/examples/application/guestbook/redis-slave-service.yaml

# service/redis-slave created

kubectl get services

# NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE

# kubernetes ClusterIP 10.96.0.1 443/TCP 23m

# redis-master ClusterIP 10.100.245.207 6379/TCP 91s

# redis-slave ClusterIP 10.101.165.188 6379/TCP 13s

kubectl apply -f https://k8s.io/examples/application/guestbook/frontend-deployment.yaml

# deployment.apps/frontend created

kubectl get pods -l app=guestbook -l tier=frontend

# NAME READY STATUS RESTARTS AGE

# frontend-6c6d6dfd4d-945hd 1/1 Running 0 7s

# frontend-6c6d6dfd4d-mm7vm 1/1 Running 0 7s

# frontend-6c6d6dfd4d-wllpx 1/1 Running 0 7s

kubectl apply -f https://k8s.io/examples/application/guestbook/frontend-service.yaml

# service/frontend created

kubectl get services

# NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE

# frontend NodePort 10.101.140.217 80:31597/TCP 4s

# kubernetes ClusterIP 10.96.0.1 443/TCP 24m

# redis-master ClusterIP 10.100.245.207 6379/TCP 2m45s

# redis-slave ClusterIP 10.101.165.188 6379/TCP 87s

Seems to be working (😊):

# cleanup
kubectl delete deployment -l app=redis
# deployment.apps "redis-master" deleted
# deployment.apps "redis-slave" deleted

kubectl delete service -l app=redis
# service "redis-master" deleted
# service "redis-slave" deleted

kubectl delete deployment -l app=guestbook
# deployment.apps "frontend" deleted

kubectl delete service -l app=guestbook
# service "frontend" deleted

kubectl get pods
# No resources found in default namespace.

# cleanup

kubectl delete deployment -l app=redis

# deployment.apps "redis-master" deleted

# deployment.apps "redis-slave" deleted

kubectl delete service -l app=redis

# service "redis-master" deleted

# service "redis-slave" deleted

kubectl delete deployment -l app=guestbook

# deployment.apps "frontend" deleted

kubectl delete service -l app=guestbook

# service "frontend" deleted

kubectl get pods

# No resources found in default namespace.

Cheers!

P.S. I’ve read about some having issues with flannel and using other network options (didn’t have this one). Also, if you’ll have issues with iptables (v1.8+), maybe you’ll need to switch to legacy version (didn’t have this one either).

Found my forgotten Raspberry Pi

By Tomica Kaniski in Other 07/12/2020 2 Comments

And, naturally, decided to put it to use (although, for exactly what… is currently unclear). 😊

So… how?

As there was already a micro SD card inside my Raspberry Pi, I was all set!

Basically, what I had to do:

download the OS image (Raspberry Pi OS Lite)
download imaging software (Etcher)
extract the OS onto micro SD card
enable SSH by adding an empty file called “ssh” (yes, without any extension) to the boot volume
boot it up
set it up as I like

Extracting the OS image onto micro SD card is a “breeze” with right tools – select OS image, select where do you want to put it and click Flash:

After it’s finished, don’t forget to enable yourself the SSH access (it’s easier that way):

Done.

Let’s put the card back into Raspberry Pi and boot it up.

Few seconds later, you can use (e.g.) Windows Terminal and included SSH client to access your Raspberry Pi (default networking option is DHCP, with default username of pi and password raspberry):

I wanted to “tweak” my installation a bit (with the provided raspi-config script), so I’ve used the following for disabling unnecessary devices, custom network settings, etc.:

# raspi-config script is located in /usr/bin/raspi-config
# settings (some of them) are located in /boot/config.txt

# update the raspi-config script (or you can use 'sudo raspi-config nonint do_update') and vim... is nice to have
sudo apt update
sudo apt install -y raspi-config vim

# set static ip address (configure in '/etc/dhcpcd.conf', can check interfaces with 'ip link' - can be done nicer, but... :))
echo 'interface eth0' | sudo tee -a /etc/dhcpcd.conf
echo 'static ip_address=192.168.12.101/24' | sudo tee -a /etc/dhcpcd.conf
echo 'static routers=192.168.12.1' | sudo tee -a /etc/dhcpcd.conf
echo 'static domain_name_servers=192.168.12.1' | sudo tee -a /etc/dhcpcd.conf

# set password (for user 'pi')
echo "pi:MyExtraSecretPass#123" | sudo chpasswd

# set boot options to my liking
sudo raspi-config nonint do_boot_behaviour B1
sudo raspi-config nonint do_boot_wait 1

# set/disable unnecessary interfaces
sudo raspi-config nonint do_camera 1
sudo raspi-config nonint do_ssh 0
sudo raspi-config nonint do_vnc 1
sudo raspi-config nonint do_spi 1
sudo raspi-config nonint do_i2c 1
sudo raspi-config nonint do_serial 1
sudo raspi-config nonint do_onewire 1
sudo raspi-config nonint do_rgpio 1
sudo raspi-config nonint do_memory_split 16
sudo raspi-config nonint do_expand_rootfs
sudo raspi-config nonint do_wifi_country HR
sudo raspi-config nonint do_change_timezone Europe/Zagreb

# upgrade packages and set hostname
sudo apt upgrade -y
sudo raspi-config nonint do_hostname pimaster
sudo reboot

# ssh back into your pimaster
ssh pi@192.168.12.101

# raspi-config script is located in /usr/bin/raspi-config

# settings (some of them) are located in /boot/config.txt

# update the raspi-config script (or you can use 'sudo raspi-config nonint do_update') and vim... is nice to have

sudo apt update

sudo apt install -y raspi-config vim

# set static ip address (configure in '/etc/dhcpcd.conf', can check interfaces with 'ip link' - can be done nicer, but... :))

echo 'interface eth0' | sudo tee -a /etc/dhcpcd.conf

echo 'static ip_address=192.168.12.101/24' | sudo tee -a /etc/dhcpcd.conf

echo 'static routers=192.168.12.1' | sudo tee -a /etc/dhcpcd.conf

echo 'static domain_name_servers=192.168.12.1' | sudo tee -a /etc/dhcpcd.conf

# set password (for user 'pi')

echo "pi:MyExtraSecretPass#123" | sudo chpasswd

# set boot options to my liking

sudo raspi-config nonint do_boot_behaviour B1

sudo raspi-config nonint do_boot_wait 1

# set/disable unnecessary interfaces

sudo raspi-config nonint do_camera 1

sudo raspi-config nonint do_ssh 0

sudo raspi-config nonint do_vnc 1

sudo raspi-config nonint do_spi 1

sudo raspi-config nonint do_i2c 1

sudo raspi-config nonint do_serial 1

sudo raspi-config nonint do_onewire 1

sudo raspi-config nonint do_rgpio 1

sudo raspi-config nonint do_memory_split 16

sudo raspi-config nonint do_expand_rootfs

sudo raspi-config nonint do_wifi_country HR

sudo raspi-config nonint do_change_timezone Europe/Zagreb

# upgrade packages and set hostname

sudo apt upgrade -y

sudo raspi-config nonint do_hostname pimaster

sudo reboot

# ssh back into your pimaster

ssh pi@192.168.12.101

And after a while, my Raspberry Pi is finally ready:

Cheers!

Scheduling a PowerShell script… with arguments

By Tomica Kaniski in Other 24/04/2017 20 Comments

Let’s say that you have a neat PowerShell script, which you want to run on some kind of a schedule (a script which will collect some data and send you an e-mail, every day in the same hour… ‘til the end of time – maybe this one) – how can you do it? Smile

The answer is simple. Yes, there is a tool included with Windows operating system, which can help you… and it’s called… well – Task Scheduler. Smile

And… if you never used the Task Scheduler in Windows, maybe this is the time to start.

It’s a rather simple tool – you click through a simple wizard, select what you need (a program) and when you need it, and you’ve created a scheduled task.

OK… so, I can run a program? What about a PowerShell script?

The real question here is “Who/what will run my PowerShell script?”. And then, the answer is simple – the PowerShell engine.

This means that your “program” is powershell.exe. This also means that in your scheduled task you should enter something like this:

(note the full path to powershell.exe – C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe)

Now we have a scheduled task which will start PowerShell in designated time, every single day. Usually, this is not enough, and we need to add some arguments to the command running (like the path to the script we want to execute).

(argument field in this case contains -Command “& ‘C:\Scripts\Get-HyperVReport.ps1‘“ – be really careful about the single/double quotes here!)

Configured like this, our scheduled task will execute the following command:

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -Command "& 'C:\Scripts\Get-HyperVReport.ps1'"

1	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -Command "& 'C:\Scripts\Get-HyperVReport.ps1'"

Two remaining things that we have to check is to have our Get-HyperVReport.ps1 script saved in C:\Scripts and that user, under whom this task is running, has the appropriate permissions to run it. Also, if task should be running unnatended (usually it should), make sure to configure it so.

One other thing that may be useful – with this script, we need to specify some additional parameters (like ClusterName or if it will send us an e-mail when completed). In this case, we can easily add the required parameters to the arguments field, like this:

(argument field in this case contains -Command “& ‘C:\Scripts\Get-HyperVReport.ps1‘ -ClusterName MyCluster -SendMail $true -SMTPServer smtp.mail.com -MailFrom [email protected] -MailTo [email protected]“)

The whole command is then:

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -Command "& 'C:\Scripts\Get-HyperVReport.ps1' -ClusterName MyCluster -SendMail $true -SMTPServer smtp.mail.com -MailFrom hyper-v@mail.com -MailTo some.mail@mail.com"

1	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -Command "& 'C:\Scripts\Get-HyperVReport.ps1' -ClusterName MyCluster -SendMail $true -SMTPServer smtp.mail.com -MailFrom [email protected] -MailTo [email protected]"

Hope this helps!

Cheers!

P.S. One other other thing (yes, it’s written twice… live with it Smile ) that can be useful – you can also use PowerShell to create scheduled task which will run this PowerShell script (instead of using “the lame wizard”). Pssst… take a look at the New-ScheduledTask command. Winking smile

P.P.S. You can also make use of Adam’s function, which will make your life easier – https://github.com/adbertram/Random-PowerShell-Work/blob/master/Scheduled%20Tasks/New-ScheduledScript.ps1. Thanks, Adam!

How PowerShell keeps my photo collection neat

By Tomica Kaniski in Other 23/04/2017 0 Comment

As I love taking photos, sometimes it might be difficult to keep my photo collection “neat”. My camera is set to save every photo in two formats (one for editing, and another one for “long term storage”, as I like to say Smile ) – .ARW and .JPG.

When I come home from a “photo trip”, I go through the photos taken and delete the ones I don’t really like. As I need to delete both copies, sometimes it happens that I forgot to delete .JPG or .ARW file of the same photo (which leads to “inconsistencies” in my collection… which is not “neat” Smile ).

To overcome this, I’ve come up with a solution – a simple PowerShell script to check if there are any .ARW files which are missing it’s corresponding .JPG file (basically, I’m looking for files sharing the same name, but with different extension):

$dir = "C:\Users\Tomica\Pictures\SuperCoolPictureFolder" 
$jpg = Get-ChildItem -Path $dir -Filter "*.JPG" | % {$_.BaseName} 
$arw = Get-ChildItem -Path $dir -Filter "*.ARW" | % {$_.BaseName} 
Compare-Object -ReferenceObject $jpg -DifferenceObject $arw

$dir = "C:\Users\Tomica\Pictures\SuperCoolPictureFolder"

$jpg = Get-ChildItem -Path $dir -Filter "*.JPG" | % {$_.BaseName}

$arw = Get-ChildItem -Path $dir -Filter "*.ARW" | % {$_.BaseName}

Compare-Object -ReferenceObject $jpg -DifferenceObject $arw

So, output will be something like this (with right arrow in results meaning that I have .ARW files for which I don’t have the corresponding .JPG file, which further means that I’ve deleted the .JPG file which I didn’t like and now I need to delete .ARW as well):

Arrow on the left side means that I have .JPG files for which I don’t have the corresponding .ARW file. No results will mean that I have the files in sync – for each .ARW file, there is a corresponding .JPG file.

Next step will be to tweak the script and probably automate the deletion process. For now, I’m satisfied with PowerShell providing me info about the duplicates and deleting the files manually. Smile

Cheers!

Reinstalling your Hyper-V hosts

By Tomica Kaniski in Other 10/10/2016 0 Comment

Have you ever reinstalled your Hyper-V hosts?

I know, there is not much need for it (as everything usually works just fine), but still… there is a “Windows Server 2016 re-installation wave” coming and maybe you’ll find the the next pieces interesting and useful.

One of the “messy” tasks with Windows reinstallation is networking… and by “messy” I mean “you have more than one network cable in your Hyper-V hosts” and you need to know which networks are connected where. Smile

What happens is that Windows somehow always forgets your network device order, all the pretty names you’ve applied and you get stuck with names like “Ethernet”, “Ethernet 2”, etc.

There is a way to fix this (there are many, actually) – we can ask our younger colleague to go to the server room and unplug the cables one by one and then plug them back in, following the rename on our (Windows) side. This way we are certain that all the corporate, DMZ, storage, live migration, etc. cables don’t get “confused” when added to their respective teams and if we labeled cables properly, everything will work with fresh Windows installation also.

But… there is another way. We can use what we already have – our documentation. Here I mean “our current setup” – we have our network adapters and teams already configured in our current Windows installation, why don’t we just export this info and use it after the reinstallation?

We can do this easily by using PowerShell!

The idea is to export network adapter names and MAC addresses of our physical network adapters (excluding the virtual and team adapters), in a CSV file, so that we can use it later, to rename our adapters after the reinstallation:

Get-NetAdapter | where {$_.InterfaceDescription -notlike "Microsoft*" -and $_.InterfaceDescription -notlike "Hyper-V*"} | Export-Csv C:\Hyper-V.csv -Delimiter ";"

1	Get-NetAdapter \| where {$_.InterfaceDescription -notlike "Microsoft" -and $_.InterfaceDescription -notlike "Hyper-V"} \| Export-Csv C:\Hyper-V.csv -Delimiter ";"

After reinstallation, we can use the following command to rename our adapters, as per our saved CSV file:

$networks = Import-Csv C:\Hyper-V.csv -Delimiter ";"
foreach($network in $networks){
    Get-NetAdapter | where {$_.InterfaceDescription -notlike "Microsoft*" -and $_.InterfaceDescription -notlike "Hyper-V*" -and $_.MacAddress -eq $network.MacAddress} | Rename-NetAdapter -NewName $network.Name
}

$networks = Import-Csv C:\Hyper-V.csv -Delimiter ";"

foreach($network in $networks){

Get-NetAdapter | where {$_.InterfaceDescription -notlike "Microsoft*" -and $_.InterfaceDescription -notlike "Hyper-V*" -and $_.MacAddress -eq $network.MacAddress} | Rename-NetAdapter -NewName $network.Name

}

And voilà – our networks are named nicely again (and our colleague didn’t need to go to the cold server room… this time). Smile

Cheers!

Missed the Microsoft Ignite 2016?

By Tomica Kaniski in Other 05/10/2016 0 Comment

Don’t be sad! Smile

In case you’ve missed the Microsoft Ignite conference this year (like me Smile ), all of its content is available online! You can visite the conference homepage (https://ignite.microsoft.com/) and catch video streams and…

… even better – there is a PowerShell script that can help you download the videos and slides of about 570 Ignite sessions!!! How cool is that???

Script was made by Michel de Rooij and Mattias Fors, and can be found here (read the “help” section to figure out what you need and how to use it).

When launched (properly), it looks something like this:

Happy downloading, watching and learning! Smile

Cheers!

P.S. With the script alone, you’ll need the YouTube downloader utility available here (it actually says so in the script’s “help”, but who reads the documentation, right? Smile ).

Playing with folders and permissions

By Tomica Kaniski in Other 11/01/2016 0 Comment

This one will be short and sweet. Smiješak

Imagine you have an Active Directory full of users. You also have a file server in your environment. And, as it happens, each of your users needs to have a folder created just for himself, on this file server. Each folder should have inheritance disabled and each user should get full permissions on his folder.

What do you do?

Well, we can manually create the required folders, or we can use a PowerShell script which will do it for us. Obviously, I’ve chosen PowerShell (maybe not the nicest script in the world, but it does the job), or this post would be… lame. Smiješak

So, the interesting part of this script goes like this (I’ve added a few empty lines to make comments more visible):

# get user/folder names from Active Directory (SamAccountName property)
$users = Get-ADUser -Filter * | Select SamAccountName

foreach($user in $users)
{
    $folder = "D:\Share\$user"
    
    # create a (sub)folder for each user
    New-Item -Path $folder -Type Directory
    
    # read the current access rules applied to a folder
    $acl = Get-Acl -Path $folder

    # disable the inheritance, but leave the inherited access rules in place
    $acl.SetAccessRuleProtection($True, $True)
    
    # add Full access rule for a specific user
    $rule = New-Object System.Security.AccessControl.FileSystemAccessRule("$user","FullControl", "ContainerInherit, ObjectInherit", "None", "Allow")

    # add this rule to existing ruleset
    $acl.AddAccessRule($rule)

    # and finally, apply the new ruleset to a folder
    Set-Acl -Path $folder -AclObject $acl
}

# get user/folder names from Active Directory (SamAccountName property)

$users = Get-ADUser -Filter * | Select SamAccountName

foreach($user in $users)

{

$folder = "D:\Share\$user"

# create a (sub)folder for each user

New-Item -Path $folder -Type Directory

# read the current access rules applied to a folder

$acl = Get-Acl -Path $folder

# disable the inheritance, but leave the inherited access rules in place

$acl.SetAccessRuleProtection($True, $True)

# add Full access rule for a specific user

$rule = New-Object System.Security.AccessControl.FileSystemAccessRule("$user","FullControl", "ContainerInherit, ObjectInherit", "None", "Allow")

# add this rule to existing ruleset

$acl.AddAccessRule($rule)

# and finally, apply the new ruleset to a folder

Set-Acl -Path $folder -AclObject $acl

}

Cheers!

Installing the KB2920189… successfully!

By Tomica Kaniski in Other 19/05/2014 1 Comment

The other day, I’ve written about an issue with installation of update KB2920189 for Windows Server 2012 R2 (post called [TIP] Latest “Patch Tuesday” & errors installing update). So, the problem I was facing was failing installation on Generation 2 virtual machines, with Secure Boot enabled.

Actually, you can overcome this problem easily by reading the documentation before it happens or… with PowerShell after (OK, you can use GUI also, but who uses it nowadays?)! Smile

As I’ve already mentioned, all you need to do is just one thing – install the BitLocker feature on your server.

Install-WindowsFeature BitLocker –Restart

1	Install-WindowsFeature BitLocker –Restart

(yes, “-Restart” is optional – if you want, you can restart your server manually, of course)

After that, BitLocker is installed, and you can successfully install the KB2920189 also.

Second (not official) approach on installing this update on Generation 2 virtual machine, as I’ve written in the mentioned post, is to uncheck Secure Boot, install the update, and then check the Secure Boot option again.

This can be easily done using the following script:

# stopping the VM 
Stop-VM "MyVirtualMachine" 
# disabling Secure Boot 
Set-VMFirmware -VMName "MyVirtualMachine" -EnableSecureBoot Off 
# starting the VM back again 
Start-VM "MyVirtualMachine"

# stopping the VM

Stop-VM "MyVirtualMachine"

# disabling Secure Boot

Set-VMFirmware -VMName "MyVirtualMachine" -EnableSecureBoot Off

# starting the VM back again

Start-VM "MyVirtualMachine"

We can now install this “problematic” update as the Secure Boot feature is disabled:

# once again, we are stopping the VM 
Stop-VM "MyVirtualMachine" 
# enabling Secure Boot 
Set-VMFirmware -VMName "MyVirtualMachine" -EnableSecureBoot On 
# and starting the VM 
Start-VM "MyVirtualMachine"

# once again, we are stopping the VM

Stop-VM "MyVirtualMachine"

# enabling Secure Boot

Set-VMFirmware -VMName "MyVirtualMachine" -EnableSecureBoot On

# and starting the VM

Start-VM "MyVirtualMachine"

…and Secure Boot is enabled again (“nothing” happened)!

Of course, you can do all of this manually, but then again – why do we have PowerShell? Smile

Cheers!

P.S. I’m no PowerShell expert… just like to automate some things. Smile