Skip to content

Instantly share code, notes, and snippets.

View ruo91's full-sized avatar

Yongbok Kim ruo91

39 followers · 5 following
View GitHub Profile
@ruo91
ruo91 / openshif4-cpu-L1-cache–aware-configuration-strategy-for-haproxy-performance-optimization.md
Created December 26, 2025 04:55
OpenShift 4 - HAProxy 성능 최적화를 위한 CPU L1 Cache 기반 설정 전략

OpenShift 4.18 환경에서 오픈소스 HAProxy를 기반으로 사용자 정의 컨테이너 이미지를 구성하여
CPU 최적화 및 성능 향상을 실현한 사례를 정리한 내용이다.

1. HAProxy 성능 최적화를 위한 CPU L1 Cache 기반 설정 전략

HAProxy를 순수 TCP Pass-through 모드로 사용하며, 데이터 패킷 크기를 최신 CPU의 L1 Cache 사이즈에 맞춤으로써
Memory Access Latency와 Context Switching을 Zero에 수렴하게 만드는 전략이다.

HAProxy의 주요 버퍼 설정 값들을 16KB(16,384 bytes) 수준으로 맞추면, L1 Cache 구조에 최적화되어 처리 성능이 크게 향상된다.

1.1. CPU 최적화: L1 캐시 기반 최적화

@ruo91
ruo91 / openshif-4-etcd-performance-test.md
Last active November 17, 2025 16:35
OpenShift 4.x - ETCD Performance Test

1. ETCD 인증서 저장

1.1. Server CA Bundle

$ ssh core@master01.ocp4.local "sudo cat /etc/kubernetes/static-pod-resources/etcd-certs/configmaps/etcd-all-bundles/server-ca-bundle.crt" > certs/server-ca-bundle.crt

1.2. ETCD Serving Cert / Key

$ ssh core@master01.ocp4.local "sudo cat /etc/kubernetes/static-pod-resources/etcd-certs/secrets/etcd-all-certs/etcd-serving-master01.ocp4.local.crt" > certs/etcd-serving.crt
$ ssh core@master01.ocp4.local "sudo cat /etc/kubernetes/static-pod-resources/etcd-certs/secrets/etcd-all-certs/etcd-serving-master01.ocp4.local.key" > certs/etcd-serving.key
@ruo91
ruo91 / istio-envoyfilter.yaml
Last active November 11, 2025 07:57
ISTIO - EnvoyFilter(X-Forwared-For, SNI, SAN Validation)
apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
name: proxy-protocol
namespace: istio-system
spec:
workloadSelector:
labels:
istio: ingressgateway
configPatches:
@ruo91
ruo91 / openshift4-ingress-controller-crl-error.txt
Created November 10, 2025 03:23
OpenShift 4 - Ingress Controller CRL Error
I1110 03:21:47.432925 1 template.go:560] "msg"="starting router" "logger"="router" "version"="majorFromGit: \nminorFromGit: \ncommitFromGit: d8058949aaf91dcdea050c58e6a34ef5f6670c67\nversionFromGit: 4.0.0-563-gd8058949\ngitTreeState: clean\nbuildDate: 2025-08-21T15:43:32Z\n"
I1110 03:21:47.435962 1 metrics.go:156] "msg"="router health and metrics port listening on HTTP and HTTPS" "address"="0.0.0.0:11936" "logger"="metrics"
I1110 03:21:47.443029 1 router.go:217] "msg"="creating a new template router" "logger"="template" "writeDir"="/var/lib/haproxy"
I1110 03:21:47.443121 1 router.go:302] "msg"="router will coalesce reloads within an interval of each other" "interval"="5s" "logger"="template"
I1110 03:21:47.443641 1 router.go:372] "msg"="watching for changes" "logger"="template" "path"="/etc/pki/tls/private"
I1110 03:21:47.444393 1 router.go:372] "msg"="watching for changes" "logger"="template" "path"="/etc/pki/tls/client-ca"
I1110 03:21:47.444450 1 router.go:283] "msg
@ruo91
ruo91 / keycloak.yaml
Last active August 18, 2025 04:03
Example - KeyCloak Operator
# Step 1. Create Secret
# oc create secret generic keycloak-temp-admin --from-literal=username=temp-admin --from-literal=password='Test12#$' -n keycloak
# oc create secret generic keycloak-db --from-literal=username=keycloak --from-literal=password='Test12#$' -n keycloak
#
# Step 2. Initialize the Admin Account
# oc rsh keycloak-0
# /opt/keycloak/bin/kcadm.sh config credentials --server http://localhost:8080 --realm master --user temp-admin
# /opt/keycloak/bin/kcadm.sh create users -r master -s username=admin -s enabled=true
# /opt/keycloak/bin/kcadm.sh set-password -r master --username admin --new-password 'Test12#$'
# /opt/keycloak/bin/kcadm.sh add-roles --uusername admin --rolename admin
@ruo91
ruo91 / quay-registry-operator-postgresql-backup-restore-procedure-with-odf.md
Last active April 22, 2025 10:56
OpenShift 4.x - Quay Registry PostgreSQL 백업 및 복구 절차 (ODF 기반)

OpenShift 4.x - Quay Registry PostgreSQL 백업 및 복구 절차 (ODF 기반)

OpenShift 4.16 버전에 구성된 Quay Registry Operator에서 managed 형태로 구성되는 PostgreSQL Pod가 있다.
PostgreSQL DB용 저장 용도로 PV가 NAS가 아닌 ODF(OpenShift Data Foundation, Ceph 기반)의 RBD(Rados Block Device) 볼륨을 사용하고 있다.

기존의 PV(Persistens Volume), PVC(Persistens Volume Claim)가 deattach 되고 새로운 PV, PVC가 Attached 되었을 경우
기존 데이터를 백업하고 신규 RBD에 데이터를 복구하는 절차에 대해서 정리한다.

1. 기존 PV 정보 조회(Bastion)

$ oc get pv| grep pvc-f050101-e4c0-447e-9198-759793a64f0e
@ruo91
ruo91 / ms-azure-ocp4-role.json
Created March 8, 2025 06:54
OpenShift 4.x - Required Azure permissions for installer-provisioned infrastructure
{
"Name": "ocp4-role",
"IsCustom": true,
"Description": "Custom role with specified permissions",
"Actions": [
"Microsoft.Authorization/policies/audit/action",
"Microsoft.Authorization/policies/auditIfNotExists/action",
"Microsoft.Authorization/roleAssignments/read",
"Microsoft.Authorization/roleAssignments/write",
"Microsoft.Authorization/roleAssignments/delete",
@ruo91
ruo91 / paloalto-firewall-basic-setup-and-upgrade-guide.md
Last active March 2, 2025 03:47
Palo Alto Firewall - Basic Setup and Upgrade Guide

Palo Alto Firewall - Basic Setup and Upgrade Guide

Palo Alto Networks의 방화벽에 대한 기본 설정 및 업그레이드 방법에 대해서 정리한다.
기본적인 사항은 모두 CLI 또는 GUI로 진행하며, Serial Console 접근은 LAN to USB를 통해 Rocky Linux에서 진행한다.

1. Serial Console 접근

1.1. 패키지 설치

[root@rockylinux ~]# dnf install -y minicom
@ruo91
ruo91 / ocp4-nginx-ingress-controller-operator.yaml
Last active February 28, 2025 10:11
OpenShift 4x - Example: Nginx Ingress Controller
kind: Secret
apiVersion: v1
metadata:
name: default-tls
namespace: nginx-ingress
data:
tls.crt: base64-encode
tls.key: base64-encode
type: kubernetes.io/tls
---
@ruo91
ruo91 / ocp4-cluster-monitoring-config.yaml
Created February 26, 2025 14:34
OpenShift 4.x - cluster-monitoring-config
apiVersion: v1
kind: ConfigMap
metadata:
name: cluster-monitoring-config
namespace: openshift-monitoring
data:
config.yaml: |
alertmanagerMain:
# topologySpreadConstraints
topologySpreadConstraints: