Forem: Kunal Parikh

Docker on macOS via minikube with support for corporate proxies with custom certificate authority

Kunal Parikh — Thu, 23 Sep 2021 17:25:30 +0000

# Set proxy
export HTTPS_PROXY='host:port'
export https_proxy=$HTTPS_PROXY
export HTTP_PROXY=$HTTPS_PROXY
export http_proxy=$HTTPS_PROXY
export NO_PROXY='localhost,127.0.0.1,10.96.0.0/12,192.168.64.112/32,192.168.39.0/24,192.168.49.0/24,192.168.99.0/24'
export no_proxy=$NO_PROXY

# Add Custom Root CAs to
mkdir -p ~/.minikube/certs
# cp /path/to/custom.pem ~/.minikube/certs

# Install
brew install hyperkit
brew install minikube

# Start minikube
minikube start --embed-certs --container-runtime=docker --driver=hyperkit --docker-env HTTP_PROXY=$HTTP_PROXY --docker-env HTTPS_PROXY=$HTTPS_PROXY --docker-env NO_PROXY=$NO_PROXY --docker-env http_proxy=$http_proxy --docker-env https_proxy=$https_proxy --docker-env no_proxy=$no_proxy

# Add minikube's ip to the no proxy list
export NO_PROXY=`minikube ip`,$NO_PROXY
export no_proxy=$NO_PROXY

# Set up Docker
curl -L https://download.docker.com/mac/static/stable/x86_64/docker-20.10.8.tgz | tar -xz  --strip-components=1 -C /usr/local/bin docker/docker
eval $(minikube -p minikube docker-env)

Set Bazel BUILD_EMBED_LABEL to git commit SHA with state of uncommitted changes

Kunal Parikh — Wed, 08 Jan 2020 16:43:52 +0000

The following git command:

git describe --always --dirty

produces this output:

a3da1ee # when working tree does not have uncommitted changed
a3da1ee-dirty # when working tree has uncommitted changed

Next, we plug the git describe command into --workspace_status_command flag

bazel build target --workspace_status_command='echo "BUILD_EMBED_LABEL `git describe --always --dirty`"'

For convenience of not having to repeat the flag, I've placed the following in .bazelrc

build --workspace_status_command='echo "BUILD_EMBED_LABEL `git describe --always --dirty`"'

Helm2 in GKE

Kunal Parikh — Thu, 14 Nov 2019 16:40:16 +0000

$ kubectl create serviceaccount -n kube-system tiller

$ kubectl create clusterrolebinding tiller-cluster-admin --clusterrole=cluster-admin --serviceaccount=kube-system:tiller

$ kubectl --namespace kube-system patch deploy tiller-deploy -p '{"spec":{"template":{"spec":{"serviceAccount":"tiller"}}}}'

gcloud SSLHandshakeError

Kunal Parikh — Wed, 13 Nov 2019 21:05:52 +0000

If you find yourself behind a corporate proxy and need to disable SSL validation for google-cloud-sdk, here's the setting for it

$ gcloud config set auth/disable_ssl_validation True

Ideally, you should set the path to custom trusted certs using this command:

$ gcloud config set core/custom_ca_certs_file /path/to/certs.pem