AWS Installs
AWS Installs require installing the AWS command line client, used by the installer. For example, on Linux:
unix$ sudo apt-get install awscli
You need a PEM file to be used for accessing the instance, once created. The PEM file and the public key for it can be created with this command:
unix$ ssh-keygen -t rsa -m PEM -C "tkey" -f tkey
Here, we create a file tkey with the private PEM and a file
tkey.pub with the public key. Before proceeding, rename the PEM file
to use .pem:
unix$ mv tkey tkey.pem unix$ chmod 400 tkey.pem
When installing supply the path to the PEM file (without the .pem
extension) to flag -K, so that lxinst can find it and use its
base file name as the AWS key pair name).
Now, define your access and secret keys for the AWS account:
unix$ export AWS_ACCESS_KEY_ID=___your_key_here___ unix$ export AWS_SECRET_ACCESS_KEY=___your_secret_here___ ...
To install the public distribution, go to
https://artifactory.leanxcale.com/artifactory/lxpublic
and download the zip for the last version (for example, lx.2.1.231129.zip).
Before extracting the zip file contents,
make sure that there is no lxdist directory from previous
versions, or it will include packages that are not for this one.
unix$ rm -f lxdist/*
Extract the zip file:
unix$ unzip lx.2.1.231129.zip Archive: lx.2.1.231129.zip creating: lxdist/ inflating: lxdist/lxinst.v2.1.port.tgz inflating: lxdist/lxavatica.v2.1.libs.tgz ...
Verify that the process completed successfully and there is a directory
lxdist (with the distribution packages) and the lxinst program:
unix$ ls lx.2.1.231129.zip lxdist lxinst
To install in AWS, use lxinst using the aws property and the
-K option to supply the key file/name to use. For example:
unix$ lxinst -K tkey aws ... aws instance i-03885ca519e8037a1 IP 44.202.190.8 ... aws lx1 instance id i-0d2287deeb3d45a82
Or, specify one or more properties to set
the region, instance type, disk size, and AWS tag.
The disk size is in GiB.
The tag is a name and should not include blanks or dots.
It will be used for .aws.leanxcale.com domain names.
For example:
unix$ lxinst -K tkey aws awsregion us-west-1 awstype t3.large \ awsdisk 30 awstag 'client-tag' ... config: lxinst.conf install done. # To remove resources: ./lxinst.uninstall #To dial the instances: ssh -o StrictHostKeyChecking=no -i xkey.pem lx@18.232.95.251
Arguments follow the semantics of a configuration file. Therefore, if a host name is specified, it must come after global properties.
Try to follow the conventions and call lx1 the first host installed,
lx2 the second one, etc.
Also, do not specify directories and similar attributes, leave them to the AWS
install process.
If something fails, or the install completes, check for a lxinst.uninstall
command, created by the install process, to remove allocated resource when
so desired.
The detailed configuration file built by the install process is
saved at lxinst.conf, as a reference.
This is not a configuration file written by the user, but
a configuration file including all the install details.
This is an example:
#cfgfile lxinst.conf awstag client-tag awsvpc vpc-0147a6d8e9d6e6910 awssubnet subnet-0b738237bbce66037 awsigw igw-0a160524cf4edab30 awsrtb rtb-040894a1050b58a3f awsg sg-05ee9e0281599026d host lx1 awsinst i-0e0167a4233f76bb1 awsvol vol-01629a4b3694bb5fd lxdir /usr/local/leanxcale JAVA_HOME /usr/lib/jvm/java-1.11.0-openjdk-amd64 addr 10.0.120.100 kvms 100 addr lx1!14400 lxmeta 100 addr lx1!14410 lxqe 100 addr lx1!14420 mem 1024m kvds 100 addr lx1!14500 mem 1024m
In the installed system, the user running the DB is lx, and
LeanXcale is added to the UNIX system as a standard service (disabled by
default). The instance is left running. You can stop it on your own if
that is not desired.
The command lxinst.uninstall, created by the
installation, can be used to remove the created AWS resources:
unix$ lxinst.uninstall ...
To use an instance (and host) name other than lx1, supply your
desired host name. And use a name, not something with dots or special
characters. For example:
unix$ lxinst aws -K tkey lxhost1 lxhost2 ...
creates a network and two instances named lxhost1 and lxhost2,
and leaves them running.
Once installed, use lx as in any other system:
unix$ ssh -o StrictHostKeyChecking=no -i tkey.pem lx@44.202.190.8 lx1$ lx stop -v
Listing and removing AWS resources (lxaws)
The program lxaws is used to list or remove AWS installs.
This program is not built as such.
To create it, copy lxinst to lxaws and use it.
usage: lxaws [-h] [-e] [-v] [-d] [-D] [-r region] [-n] [-askpeer] [-yespeer]
[-netpeer] [-delpeer] [-p] [-o] [-c]
[tag [tag ...]]
lx AWS cmds
positional arguments:
tag aws tag|peer command args
optional arguments:
-h, --help show this help message and exit
-e define env vars
-v verbose
-d remove resources
-D enable debug diags
-r region AWS region
-n dry run
-askpeer ask peer: tag owner reg vpc
-yespeer accept peer:tag pcxid
-netpeer set peer net: tag pcxid cidr sec
-delpeer del peer: pcxid
-p print open ports
-o open ports: tag proto port0 portn cidr name
-c close ports: tag proto port cidr
Given a region, without any tags, it lists the tags installed:
unix$ lxaws -r us-east-1 xtest.aws.leanxcale.com
Given a tag, it lists the tag resources as found on AWS:
unix$ lxaws -r us-east-1 xtest.aws.leanxcale.com #xtest.aws.leanxcale.com: vpc vpc-0bb89fa4f83fc69c6 subnet subnet-0b5fb20a5372f89da igw igw-08c3cdec1dc865b84 rtb rtb-0e40ace79169b2e08 assoc rtbassoc-0248017196d4be19c sec sg-028614274a930d0ef inst i-041b70633666af01b xtest1.aws.leanxcale.com 18.209.59.230 vol vol-04310af65774fc5e7
It is also possible to supply just the base tag without the domain, as in
unix$ lxaws -r us-east-1 xtest
With flag -e prints commands to set environment variables with resources found,
as an aid to run other scripts.
unix$ lxaws -e -r us-east-1 xtest.aws.leanxcale.com #xtest.aws.leanxcale.com: export vpc='vpc-0bb89fa4f83fc69c6' export subnet='subnet-0b5fb20a5372f89da' export igw='igw-08c3cdec1dc865b84' export rtb='rtb-0e40ace79169b2e08' export assoc='rtbassoc-0248017196d4be19c' export sec='sg-028614274a930d0ef' export inst='i-041b70633666af01b' export addr='peer11.aws.leanxcale.com' export vol='vol-04310af65774fc5e7'
When more than one tag is asked for, or more than one instance/volume is found, variable names are made unique adding a number to the name, for example:
unix$ lxaws -e peer1 peer2 #peer1.aws.leanxcale.com: export vpc0='vpc-0a50a6e989aa9da9a' export subnet0='subnet-0d9fd3a7d03eca61b' export igw0='igw-0af4279169fd8cab6' export rtb0='rtb-0f5d93a83239c3ada' export assoc0='rtbassoc-0e7d0f74cd780e121' export sec0='sg-01afb3d3c985f7881' export inst0='i-072b16e86bcc77e9f' export addr0='peer11.aws.leanxcale.com' export vol0='vol-08ed1c4acdc0eae61' #peer2.aws.leanxcale.com: export vpc1='vpc-023ce3e3c47bbb48f' export subnet1='subnet-0f9af7190d758d6d6' export igw1='igw-0ae3c860a69969a83' export rtb1='rtb-0d45f2059b4696cf4' export assoc1='rtbassoc-0a365cb4472f0b89e' export sec1='sg-04b122e86debcd735' export inst1='i-0b9cf8cff4b46d657' export addr1='peer21.aws.leanxcale.com' export vol1='vol-0f9f344a3a2b9bf38'
With flag -d, it removes the resources for the tags given.
In this case, tags must be given explicitly in the command line.
unix$ lxaws -d -r us-east-1 xtest.aws.leanxcale.com
AWS Ports
To list, open, and close ports exported by the AWS install to the rest of the world,
use lxaws flags -p (print ports), -o (open ports), and -c (close ports).
In all cases, the first argument is the tag for the install.
The tag can be just the AWS install tag name, without .aws.leanxcale.com.
For example, this command lists the open ports:
unix$ lxaws -p xample.aws.leanxcale.com port: web: tcp 80 0.0.0.0/0 port: ssh: tcp 22 0.0.0.0/0 port: comp: tcp 14420 0.0.0.0/0
Here, the protocol and port (or port range) is printed for each set of open ports.
The CIDR printed shows the IP address range that can access the ports,
and is 0.0.0.0/0 when anyone can access them.
Before with each port range, the name for the open port range is printed. This name is set by the default install, and can be set when opening ports as shown next.
To open a port range, use -o and give as arguments the tag for the install,
the protocol, first and last port in range, the CIDR (or any if open to everyone),
and a name to identify why this port range is open (no spaces).
For example:
unix$ lxaws -o xample.aws.leanxcale.com tcp 6666 6666 any opentest
The new port will be shown as open if we ask for ports:
unix$ lxaws -p xample.aws.leanxcale.com port: web: tcp 80 0.0.0.0/0 port: opentest: tcp 6666 0.0.0.0/0 port: ssh: tcp 22 0.0.0.0/0 port: comp: tcp 14420 0.0.0.0/0
As another example:
unix$ lxaws -o xample tcp 8888 10000 212.160.1.0/24 another unix$ lxaws -p xample port: web: tcp 80 0.0.0.0/0 port: ssh: tcp 22 0.0.0.0/0 port: another: tcp 8888-10000 212.160.1.0/24 port: comp: tcp 14420 0.0.0.0/0
To close a port, use -c and give as arguments the tag for the install,
the protocol, a port within the range of interest, and the CIDR used to export the port.
Note that any can be used here too instead of the CIDR 0.0.0.0/0
For example:
unix$ lxaws -vc xample tcp 6666 any searching aws... close ports tcp 6666-6666 to 0.0.0.0/0
Here, we used the -v flag (verbose) to see what is going on.
As another example, this can be used to close the open port range 8888-10000
from the example above:
unix$ lxaws -c xample tcp 9000 212.160.1.0/24
AWS VPC Peering Connections
Peering connections can be used to bridge two VPCs at AWS.
One peer asks the other peer to accept a peering connection, the peer accepts the connection, and network routes and security group rules for access are configured.
Peering connections are handled using lxaws with the peering connection flags.
If you do not have lxaws, copy lxinst to a file named lxaws and give it
execution permissions.
These are the flags for peering connections:
-askpeer ask peer: tag owner reg vpc -yespeer accept peer:tag pcxid -netpeer set peer net: tag pcxid cidr sec -delpeer del peer: pcxid
-
With flag
-askpeer,lxawsrequests VPC peering connection. -
With flag
-yespeer,lxawsaccepts a VPC peering request. -
With flag
-netpeer,lxawssets up the routes and port access rules. -
With flag
-delpeer,lxawsremoves a peering connection.
To request a peering connection, supply as arguments
-
the tag for the installed system where to setup a peer VPC.
-
the peer AWS owner id (user id).
-
the peer region
-
the peer VPC id
For example:
unix$ lxaws -askpeer xample 231967442015 us-east-1 vpc-0cf1a3b5c1252d172 peervpc pcx-06548783d83ddaba9
Here, we could have used xample.aws.leanxcale.com instead.
The command prints the peering connection identifier,
to be used for setting up networking and asking
the peer administrator to accept the peering request.
To accept a peer request, supply as an argument the peering connection id, as in:
unix$ lxaws -yespeer pcx-06548783d83ddaba9
In either case, once the dialed peer accepts the request, networking must be set supplying as arguments
-
the tag for the installed system where to setup a peer VPC.
-
the peering connection identifier
-
the peer CIDR block
-
the peer security group id
For example:
unix$ lxaws -netpeer xample pcx-06548783d83ddaba9 10.0.130.0/24 sg-0f277658c2828a955
Our local CIDR block is 10.0.120.0/24.
This must be given to the peer,
so the peer system can setup routing for this block to our network, along with
the VPC id and our security group id.
This information can be
retrieved using lxaws as described in the previous section.
For example:
unix$ lxaws xample.aws.leanxcale.com #xample.aws.leanxcale.com: vpc vpc-0f69c4a92b0a78523 peervpc pcx-0e88c49635ed2e59e subnet subnet-0ca70fab7476c2a04 igw igw-0cd6a7bfa99981659 rtb rtb-06e4994a57d37a054 assoc rtbassoc-022b54b9a0216e9f5 sec sg-0df3a6ec01a4ee5ee inst i-0b8144548f0e0f1d8 peer11.aws.leanxcale.com 44.200.78.14 vol vol-0c40de22d908e40bd
Should it be necessary, the CIDR block used by the install can be set when installing
the system (but not later), using the property awsnet, as in
unix$ lxinst -K mykey aws awsnet 10.0.120 awstag xample
Note that only the network address bytes used are given, instead of using 10.0.120.0/24.
Once done with a peering connection, it can be dismantled supplying both the tag and the peering connection identifier. The identifier is always given because, when accepting a peering request, the peering connection does not belong to us. But, using the command above you can retrieve such identifier easily.
When peering is no longer desired, the peering connection can be removed.
unix$ lxaws -delpeer xample pcx-005c2b84b89377737
Removing the peering connection also removes the routing entries for it and the security group access rules added when it was setup.