How Do You Create Nodes for EKS That Are Accessible to Log in?

Problem scenario
You want to create EC-2 instances (nodes) for Kubernetes in AWS using EKS. You want to be able to connect to them or log into them for the sake of troubleshooting. You want to configure the Kubernetes nodes to use a .pem or .ppk file for SSHing into them. You analyzed the create node group documentation on the internet, but found a vague reference to a --remote-access flag and a ec2Sshkey pointing to a string. You want to provide an identifier or otherwise supply credentials when the nodes are created. What do you do to have the aws eks commands create underlying EC-2 servers for Kubernetes nodes that can be logged into [for the purpose of troubleshooting the kubelet etc.]?

Solution
Prerequisites
i. This assumes you have an EKS cluster already created -- even though it may have no nodes yet. If you need help with this, see this posting if you want to use the CLI or this posting if you want to use the GUI.

ii. This assumes you have installed and configured the AWS CLI. If you need help with this, see this posting.

Procedures
Run a command like this:

aws eks create-nodegroup --cluster-name cnfoo --nodegroup-name "ngbar" --subnets subnet-0abcd1234 --node-role arn:aws:iam::123456:role/romeo --remote-access ec2SshKey=juliet,sourceSecurityGroups=sg-01234abcd,sg-9876zxy

# replace "cnfoo" with the name of the EKS cluster that has already been created.
# replace "ngbar" with the name you want to give to this new node group.

# replace "subnet-0abcd1234" with a subnet.  For ease of setting it up, you may want to configure the subnet to  
# automatically proved a public IP address.  In the AWS GUI, you would just modify the subnet.  It is easy to do this.

# replace "arn:aws:iam::123456:role/romeo" with the ARN of the role for the nodes.  If you need help, see this posting. 

# replace "juliet" with the key pair name that AWS has to log in.  For example, when you create an EC-2 instance, you are asked what key pair to choose.  This name (not any other string) is used where "juliet" is in the example command above.  
# To find the "juliet" value, run this command: aws ec2 describe-key-pairs | grep KeyName

# replace "sg-01234abcd" with a security group ID of your choice
# either delete or replace "sg-9876zxy" with a security group ID of your choice

How Do You Know the Syntax of the JSON for the –policy-document Flag for Adding Policies to a Role in AWS?

One of the following scenarios apply:

Problem scenario #1
You want to run a command like this:
aws iam put-role-policy --role-name contintdelete-role --policy-name DELETEPOLICY --policy-document file://adminPolicy.json

But you do not know the syntax of the adminPolicy.json.

Problem scenario #2
You are trying to use the --policy-document flag with the command "aws iam put-role-policy". But you get this error:

An error occurred (MalformedPolicyDocument) when calling the PutRolePolicy operation: Syntax errors in policy.

Problem scenario #3
You created a role with this command. aws iam create-role --role-name contintdelete-role --assume-role-policy-document file://Test-Role-Trust-Policy.json How do you create a role that works (and uses other AWS managed policies) using the AWS CLI?

Solution
Make sure your adminPolicy.json file, which is consumed by the mandatory option of --policy-document, has syntax like this:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "",
      "Effect": "Allow",
      "Action": [
          "iam:AmazonEKSClusterPolicy",
          "iam:AmazonEKSWorkerNodePolicy",
          "iam:AmazonEC2ContainerRegistryReadOnly"],
      "Resource": "arn:aws:iam::123456789:role/contintdelete-role"
    }
  ]
}

(The input file does not have to have the extension .json. The above example has the policies for a role to create a node in EKS.)

How Do You Troubleshoot the Python Error “NameError: name ” is not defined”?

Problem scenario
You are trying to run a Python program with a class. You get this message:

File "foobar.py", line 11, in
class Building(param1, param2):
NameError: name 'param1' is not defined

What should you do?

Solution
Use the word "object" instead of one or more parameters that you are passing in the parentheses () of the class.

Change "class Building(param1, param2):" to "class Building(object):".

For more information on why this works, see this posting:
https://stackoverflow.com/questions/32005839/how-to-pass-multiple-parameters-to-class-during-initialization

How Do You Use Ansible to Have Retrievable Double Quotes ‘”‘ in a Variable?

Problem scenario
You are using Ansible, and you want a playbook to have a variable with double quotes. The double quotes are disappearing from your echo var1.stdout[:] invocations. How do you get shell/bash commands to have double quotes?

Solution
Rather than "echo" a string with double quotes, use a variable assignment. Do not use this: echo "a \"long string\" for a \"test\" "

Use something like this: coolstring="a \"long string\" for a \"test\" " && echo $coolstring > /tmp/basicfile

Now /tmp/basicfile will have the double quotes the way you want them. (You do not always have to do this to preserve the double quotes. We find it can be difficult sometimes to preserve the double quotes in a string.

How Do You Troubleshoot the Presto Error “‘PK\003\004’: command not found”?

Problem scenario
You try to start Presto from a command line interface. But you get an error message with garbled output like this:

./presto: line 1: $'PK\003\004': command not found
./presto: line 2: $'ܢ\327H': command not found
./presto: line 3: syntax error near unexpected token `)'
./presto: line 3: ۢ▒H▒▒W▒META-INF/MANIFEST.MF▒P▒j!▒▒▒?▒8▒▒ɸK)'

Possible solution #1
You may have downloaded a .jar file that could be unpacked. You could try unpacking it. Here are four potential links to help you:
https://blog.packagecloud.io/eng/2017/03/15/extract-jar-command-line-linux/
https://stackoverflow.com/questions/1079693/how-do-you-extract-a-jar-in-a-unix-filesystem-with-a-single-command-and-specify (This above link is ideal if you are using Linux)
https://docs.oracle.com/javase/tutorial/deployment/jar/unpack.html
https://stackoverflow.com/questions/8453543/extracting-jar-file-with-command-line (We aren't sure if Presto can be used on Windows. This link above is for Windows users.)

Possible solution #2
Alternatively you could try downloading a different jar file. Ty using an "executable" jar like this one: https://repo1.maven.org/maven2/com/facebook/presto/presto-cli/0.149/presto-cli-0.149-executable.jar

The word "executable" is important for which .jar file you download and use.

How Do You Troubleshoot an Error Trying to Delete a VPC, Network Interface, or Subnet ID?

One (or more) of the following problems is applicable:

Problem scenario #1
You are trying to delete an network interface in AWS. But you get an error "You are not allowed to manage 'ela-attach' attachments." What should you do?

Problem scenario #2
You are trying to delete a subnet from AWS' VPC. But you get this error:

Note that the following subnets cannot be deleted: The following subnets contain one or more network interfaces, and cannot be deleted until those network interfaces have been deleted. Click here to view your network interfaces.    subnet-1234abcd | foobar

What should you do?

Possible Solution #1
Go to Lambda functions. In the "Configuration" tab of the function, search for the "VPC" section. Detach the relevant VPC. (This can easily prevent the deletion of a Network Interface or Subnet.)

Possible Solution #2
Remove unused VPC links from the API gateway.

Possible Solution #3
Remove unused VPC Endpoint services.

Possible Solution #4
Remove unused NAT gateways.

Possible Solution #5
Remove unused ECS/EKS clusters.

Possible Solution #6
Remove unused load balancers.

Possible Solution #7
Remove unused Elastic IP addresses (go to EC2 -> Network & Security).

Possible Solution #8
Remove unused Route Tables.

Possible Solution #9
Remove unnecessary Internet Gateways

Possible Solution #10
Remove unnecessary Endpoints.

Possible Solution #11
Remove unnecessary Peering Connections

Citation: Possible solutions #2 through 6 came from this StackOverflow.com posting.

How Do You Troubleshoot the Message “/usr/share/rubygems/rubygems/core_ext/kernel_require.rb:83:in `require’: cannot load such file — foobar (LoadError)”?

Problem scenario
You are running Vagrant, Ruby or a Ruby application, but you get this error: "/usr/share/rubygems/rubygems/core_ext/kernel_require.rb:83:in `require': cannot load such file -- foobar (LoadError)"

What should you do?

Possible Solution #1
Try to run the original command with "sudo". If that doesn't work, use "gem list" to verify "foobar" is installed.

For Windows users, try to run the command or application as Administrator.

Possible Solution #2
Run both of these commands:

gem install foobar
sudo gem install foobar

How Can You Use CloudTrail for the First Time in Your AWS Account?

Problem scenario
You want to log or monitor AWS activity (e.g., AWS Management Console, AWS CLI, and/or AWS SDK actions). You do not want encryption because you are just testing it out. How do you use CloudTrail to do this?

Solution

  1. Log into AWS.
  2. Go to this link: https://console.aws.amazon.com/cloudtrail/
  3. Click "Create a trail"
  4. Enter a descriptive name for your trail.
  5. Click "Create trail"
  6. Do some operations in AWS (e.g., create an EC-2 instance).
  7. Go here: https://console.aws.amazon.com/cloudtrail/
  8. Click on "Event history"
  9. Click the "30m" or "1h" to filter the events.

(We recommend using encryption for production uses. The above is just for a proof-of-concept.)