Load balancer dns url for EBS 12.2 in OCI

This is in continuation to my previous blog https://samappsdba.blogspot.com/2020/05/configuring-oci-load-balancer-for-ebs.html. In this post, we will go through the steps on how we can customize the Oracle Cloud Load balancer public IP with a custom URL. This is important, where we don't want to expose the IP of the Oracle Cloud LB to the end user.


As per my previous post, our Oracle Cloud Load Balancer is sitting infront of the two Oracle EBS 12.2 application server and as the policy is set to weighted round robin, hitting the public ip of Oracle Cloud Load Balancer  redirects  to the first web server and next to the second web server and so forth.

Now, i am going to construct the Oracle Cloud Load balancer URL as http://ebs.ebspoc.tech. In this post, I have not covered the SSL part. It will be taken up in the future posts.

In DNS Zone management of Oracle Cloud

Now create a A record with ebs.ebspoc.tech and lb public ip 150.XX.XX.XX and cname record with www.ebs.ebspoc.tech

And publish the changes.  Once the NS are added to the Domain Provider Zone management, it will take around 24 hours to get updated. We can do a nslookup to confirm if the changes have been updated or not.

Next, we need to modify the context file of the EBS web servers to point it to the LB.

s_webentryurlprotocol-http

s_webentryhost-ebs

s_webentrydomain-ebspoc.tech

s_active_webport-8001

s_login_page—http://ebs.ebspoc.tech/OA_HTML/AppsLogin

s_external_url- http://ebs.ebspoc.tech

shut down, autoconfig and start the services.

Now type the url

http://ebs.ebspoc.tech

next post, i will show how we can enable SSL and terminate it at the load balancer. 

Hope, this post helps someone. Happy learning cloud.

Launch Compute instance using OCI-CLI

This is continuation to my previous post of on how to set up OCI-CLI in Oracle Cloud. In this post, i am going to create a compute instance using OCI-CLI.

Before we create a compute instance in Oracle cloud, we need to have basic details in hand.

The list of cli command reference can be retrieved from:-

https://docs.cloud.oracle.com/en-us/iaas/tools/oci-cli/2.10.12/oci_cli_docs/index.html

1. Compartment id

oci iam user list –compartment-id

2. Availability Domain

[oracle@ebsapp01 .oci]$ oci iam availability-domain list --compartment-id ocid1.compartment.oc1..aaaaaaaallneylfbz5g5l53nnbdnalamdwprd6les4fzmc22ylf2zb5diu4a

{

  "data": [

    {

      "compartment-id": "ocid1.compartment.oc1..aaaaaaaallneylfbz5g5l53nnbdnalamdwprd6les4fzmc22ylf2zb5diu4a",

      "id": "ocid1.availabilitydomain.oc1..aaaaaaaatrwxaogr7dl4yschqtrmqrdv6uzis3mgbnomiagqrfhcb7mxsfdq",

      "name": "WDMA:US-ASHBURN-AD-1"

    },

    {

      "compartment-id": "ocid1.compartment.oc1..aaaaaaaallneylfbz5g5l53nnbdnalamdwprd6les4fzmc22ylf2zb5diu4a",

      "id": "ocid1.availabilitydomain.oc1..aaaaaaaauvt2n7pijol7uqgdnnsoojcukrijtmcltvfwxazmitk235wyohta",

      "name": "WDMA:US-ASHBURN-AD-2"

    },

    {

      "compartment-id": "ocid1.compartment.oc1..aaaaaaaallneylfbz5g5l53nnbdnalamdwprd6les4fzmc22ylf2zb5diu4a",

      "id": "ocid1.availabilitydomain.oc1..aaaaaaaaztunlny6ae4yw2vghp5go2zceaonwp6wiioe3tnh2vlaxjjl2n3a",

      "name": "WDMA:US-ASHBURN-AD-3"

    }

  ]

3. Compute Shape

oci compute shape list --compartment-id ocid1.compartment.oc1..aaaaaaaallneylfbz5g5l53nnbdnalamdwprd6les4fzmc22ylf2zb5diu4a

4. Image list

oci compute image list --compartment-id ocid1.compartment.oc1..aaaaaaaallneylfbz5g5l53nnbdnalamdwprd6les4fzmc22ylf2zb5diu4

5. Subnet id

oci network subnet list --compartment-id ocid1.compartment.oc1..aaaaaaaallneylfbz5g5l53nnbdnalamdwprd6les4fzmc22ylf2zb5diu4a --vcn-id ocid1.vcn.oc1.iad.amaaaaaaj6x6wyqagy3kmguyjlv3ljjbxdov7p2s667mebh6mpcqnigis6wq

Now, we have all the details. We can create a json script and pass the retrieved values generated above 

Json script can be generated using

oci compute instance launch --generate-full-command-json-input >compute_template.json

In this post, i am not going to use the json script. I am just forming the command as below:-

oci compute instance launch --availability-domain "WDMA:US-ASHBURN-AD-3" -c ocid1.compartment.oc1..aaaaaaaallneylfbz5g5l53nnbdnalamdwprd6les4fzmc22ylf2zb5diu4a --shape "VM.Standard.E2.1" --display-name " ebsautoscale3" --image-id ocid1.image.oc1.iad.aaaaaaaasxwd6pbz6py3shznyfxuxexiatoxse7zyd7tz4tmra27wle6ydwq --ssh-authorized-keys-file "/home/oracle/.ssh/id_rsa.pub" --subnet-id ocid1.subnet.oc1.iad.aaaaaaaawridc2p4pnlzpra2rvoijzjevxvewgx7pwjn4ma4wwyu6oo6qala

{

  "data": {

    "agent-config": {

      "is-management-disabled": false,

      "is-monitoring-disabled": false

    },

    "availability-domain": "WDMA:US-ASHBURN-AD-3",

    "compartment-id": "ocid1.compartment.oc1..aaaaaaaallneylfbz5g5l53nnbdnalamdwprd6les4fzmc22ylf2zb5diu4a",

    "dedicated-vm-host-id": null,

    "defined-tags": {},

    "display-name": " ebsautoscale3",

    "extended-metadata": {},

    "fault-domain": "FAULT-DOMAIN-1",

    "freeform-tags": {},

    "id": "ocid1.instance.oc1.iad.anuwcljsj6x6wyqcsl5v4tmkczngxzzi6wsc2wnzzkkvkx2jdx2i545ccjza",

    "image-id": "ocid1.image.oc1.iad.aaaaaaaasxwd6pbz6py3shznyfxuxexiatoxse7zyd7tz4tmra27wle6ydwq",

    "ipxe-script": null,

    "launch-mode": "PARAVIRTUALIZED",

    "launch-options": {

      "boot-volume-type": "PARAVIRTUALIZED",

      "firmware": "UEFI_64",

      "is-consistent-volume-naming-enabled": true,

      "is-pv-encryption-in-transit-enabled": false,

      "network-type": "PARAVIRTUALIZED",

      "remote-data-volume-type": "PARAVIRTUALIZED"

    },

    "lifecycle-state": "PROVISIONING",

    "metadata": {

      "ssh_authorized_keys": "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC7yczf1oJki5RnHH97Bb2GDAxkYWc0R2OTPGTAXTmbN9Nsqh0KmckgoUa86rk2B8xT2dR2gezpjOVArva53ebrm3ciWZ3kcKoETG63VNoDdXCYQWIshbAn23Yyi9TLuP03iy9FLtsPT1vWeFq1hnFtqqiSOaUX/h5mcisZRhG9CrsTv+n+2HZjnGHSyf5ocmfBvbmwFBJX+8AnNq8Vj3m7mQb9ITVaFNOOSei5x9t1Rdfk/JhX2aOEmhiVHn/a8yD6OM7t1y02uxx+aZCOAn+2PzV+/R3MGDa5X0QPLPW7G+EJ8F/ek7/tyb2TrPWv8Fs4DRidHpDHsEp/Sy2TmgKb opc@ebsapp01\n"

    },

    "region": "iad",

    "shape": "VM.Standard.E2.1",

    "shape-config": {

      "gpu-description": null,

      "gpus": 0,

      "local-disk-description": null,

      "local-disks": 0,

      "local-disks-total-size-in-gbs": null,

      "max-vnic-attachments": 2,

      "memory-in-gbs": 8.0,

      "networking-bandwidth-in-gbps": 0.7,

      "ocpus": 1.0,

      "processor-description": "2.0 GHz AMD EPYC\u2122 7551 (Naples)"

    },

    "source-details": {

      "boot-volume-size-in-gbs": null,

      "image-id": "ocid1.image.oc1.iad.aaaaaaaasxwd6pbz6py3shznyfxuxexiatoxse7zyd7tz4tmra27wle6ydwq",

      "kms-key-id": null,

      "source-type": "image"

    },

    "system-tags": {},

    "time-created": "2020-05-13T09:30:12.144000+00:00",

    "time-maintenance-reboot-due": null

  },

  "etag": "e2630b3946def3135a89744a2e7c1b97abbf177141aa014ba14ee739b1903f49",

  "opc-work-request-id": "ocid1.coreservicesworkrequest.oc1.iad.abuwcljs5gowykihovdespl5vpj3aczance5nxzxchr2krarhpj573fv4bya"

}

[oracle@ebsapp01 .ssh]$

We can verify it from the console now

Configuring OCI Load balancer for EBS 12.2

This is a step by step on how we can use Load balancer as a service for EBS 12.2 in OCI. I have a running EBS 12.2 instance running with two application nodes. The application is running on port number 8001 and to make it highly available, i will be using LbaaS sitting infront of them.

1. Create a load balancer security lists. We will not add any rules to it.

2. Create the route table and add the internet gateway to it.

3. Create two AD specific subnet

   

4.   Create load balancer. Here i am creating a public load balancer so it will be accepting requests from internet.

click on add backend servers

choose the port for ebs 8001

Click on submit.

Once the load balancer is created, add the below ingress and egress rule to the security list for load balancer(LB Security list)

Hope it helps someone. Happy learning.
 
  

Basics of CIDR notations in Oracle cloud OCI

Supposedly, my network admin has created a VCN for me with CIDR block  10.10.10.0/24.
Oops, i should have started with the notations for CIDR. Let's get started.

To prevent IPs exhaustion, a new scheme known as Classless Inter-Domain Routing(CIDR) was introduced in 1993. CIDR notation is based on an IPv4 or IPv6 network or routing prefix separated by a slash from a number indicating the prefix length. OCI networking uses IPv4 addressing so the address length is 32 bits. Consider the block of IPv4 addresses specified with the following CIDR notation:10.10.10.0/24

The first part is the network identifier and the second part is host address space.

network identifier/host address space

Decimal values/host address space.


The number of addresses available for host addresses may be derived using the formula 2 , where n is the network prefix. In OCI, the networking service reserves the first IP, known as the network address; the last IP, known as the broadcast address; as well as the first host address in the CIDR range, known as the subnet default gateway address; so the actual usable number of addresses in a VCN is 2 –3

Thus in my case, 10.10.10.0/24 will have 256 hosts(32-24=8. 2 ^8=256). Out of the 256 hosts, as per the explanation above, we can have 253 hosts available.

There is a site https://www.ipaddressguide.com/cidr using which we can find all the relevant details for the CIDR block.

Now, lets us go through one scenario which will help us in putting up the CIDR block for our subnets inside a particular vcn.


My VCN-10.10.10.0/24-total 256 hosts

First Ip-10.10.10.0
Last ip-10.10.10.255


Now if i create a subnet and use the CIDR value-10.10.10.0/26, it will be created. So if we calculate the total number of hosts utilized by this CIDR block, it will be 64 hosts. So inside the VCN, out of the total 256 hosts, 64 has been taken and thus next should start from 64 onwards. If i try to create a subnet with CIDR value below

I will get the above error mentioned in the screenshot because from 0-63, it has already been used by 10.10.10.0/26 and using 10.10.10.0/25 will overlap with 10.10.10.0/26. So i will have to use the CIDR blocks, for which the ip addresses start from 64 onwards.


If i use 10.10.10.64/26, it will reserve another 64 addresses starting from 10.10.10.64 to 10.10.10.127. If we don't want to reserve that much of addresses, it is always better to go for CIDR blocks which will have less number of hosts inside that. So we can use 10.10.10.64/30 which will have 4 IP addresses. Next CIDR can be used from 10.10.10.68/30 and so on. Thus we will be able to accommodate more number of CIDR blocks if we can calculate in a wise manner.

Another aspect is, if my VCN CIDR is 10.10.10.0/24 and if i need to create subnets, then my CIDR range also depends upon host address space. For example, if i decide that my host address space would be 4, then my CIDR can be 10.10.0.40/30 or 10.10.0.44/30 or 10.10.0.48/30 or 10.10.0.52/30. It can't be 10.10.0.50/30. Similarly, if i choose my host address space would be 8, then it would be like 10.10.10.32/29 or 10.10.10.24/29 etc.


Hope this will help someone. Happy learning cloud

Give sudo privilege to Oracle user in OCI

In my last post, https://samappsdba.blogspot.com/2020/02/create-ssh-keys-for-newly-provisioned.html i explained, how to generate ssh keys for newly provisioned instances in Oracle Cloud and using private key, we connect to those instances using putty. Normally there will be two user for connecting to the instances. One is opc and another one will be oracle user. If we connect via opc user,

opc is the master user and it has the sudo privileges to connect to oracle user and root user. It doesn't ask for any password.

But if connect to the instance via oracle user and try to do a sudo, it prompts for oracle's password.

By any chance if anyone tampers with opc user, we will not be able to connect to opc or root user.

Thus to resolve this squabble, using root user, we added the below line at the bottom of the file-/etc/sudoers


## Same thing without a password
oracle        ALL=(ALL)       NOPASSWD: ALL

And thereafter we were able to connect to opc and root from oracle user.

Hope it helps someone. Happy learning.

Create SSH keys for newly provisioned instance in Oracle Cloud

Recently, we did a lift and shift of on premise EBS 12.2 to OCI using oracle Cloud manager and as part of it, the automation script provisioned two compute instance from the backup of the on premise instances.

Say the newly created two instance are A and B. Initially to connect to these two provisioned instances, we first go the cloud manager instance and from there we have to ssh to the newly created A instance/B instance from cloud manager using A's/B's private IP. So to connect to these two instances directly without going through the cloud manager, we need the private keys if we are connecting via putty. In this blog, i will explain how we can create the new ssh keys and convert them to PPK format using puttygen in windows.

In Compute instance A/B

generate the ssh keys.

ssh-keygen

Accept the default values.

Once it completes, you will be able to see two files
id_rsa.pub
id_rsa

Now copy the content of id_rsa.pub to the authorized_keys.
cat id_rsa.pub >>authorized_keys

The above steps are for opc user.

ssh <private ip of A>

Now for Oracle user.

opc>hostname   sudo su - oracle

and follow the above steps for generating the rsa keys and adding the contents to the authorized keys.




The server part is complete. Now in order to connect to the server, we need the private ppk keys. Putty doesn't recognize the rsa keys. They have to converted to ppk format.


Copy the id_rsa to the windows and using puttygen, convert it to putty format.

open puttygen

click on Conversions and import key
choose the rsa file

       

and save it. It is important in terms with security to provide the passphrase.

Once we have the private key, we can go to putty and connect to the instance using this key

   Hope this helps someone. Happy learning cloud.

Monitor Compute instance in Oracle Cloud using metrics

The purpose of this particular blog is to demonstrate on how to setup and receive notifications via email when the compute instance goes down.


My running compute instance:-

And we have metrics associated with it also such as memory utilization, CPU utilization etc.

I have the tenancy admin rights enabled for this. If not, then we need to assign the below policies to the group which belongs to the user.

Allow group UserGroup1 to read metrics in tenancy
Allow group UserGroup1 to manage alarms in tenancy
Allow group UserGroup1 to manage ons-topics in tenancy
Allow group UserGroup1 to manage ons-subscriptions in tenancy


Once it is done, create the notification subscription

In the notifications page, create a topic

                     Now we will create a subscription using the topic which was created earlier.

                 

           

          

At this stage, we should be getting en email to confirm the subscription. Once the subscription is done, the color will change to green

               

Next, we will be creating an alarm definition

This will now trigger an email when the metrics will not be available for more than 2 minutes. At this moment, we will stop the compute instance.

After we waited for more than 2 minutes, we should see the alarm status as below

And the email snippet

Once the instance comes up and running, the alarm status will be in Ok status again.

Hope this will help someone. Happy learning