davidy - 🧑‍💻 Funky Penguin

🧑‍💻 Funky Penguin

Sign in Subscribe

davidy

Coming soon

This is Funky Penguin, a brand new site by davidy that's just getting started. Things will be up and running here shortly, but you can subscribe in the meantime if you'd like to stay up to date and receive emails when new content is published!

HAProxy health checks against kube-apiserver

HAProxy health checks against kube-apiserver

Most tutorials re using haproxy with kube-apiserver "check" the health of the backends with a simple TCP connection. Here's how I implemented more robust health checks using kube-apiserver's own /healthz endpoint with haproxy..

Is your pod bypassing istio-proxy? Check your GUID

After spending hours debugging why a particular pod can't properly communicate with another pod via Istio's service mesh, I stumbled into the answer.. Here's more details.. Istio creates iptables rules to intercept pod-to-pod traffic. The rules look something like this (from the istio-cni pod,

How to run Minio in legacy FS mode again

Has your bare-metal / single-node Minio deployment started creating .xl.meta files instead of the files you actually intended to transfer? This is happening because of a significant update / deprecation in June 2022. Here's a workaround to restore the previous behaviour.. Background Starting with RELEASE.2022-06-02T02-11-04Z, MinIO implements a

Nextcloud : Sexy on the outside ?, and boring(ly reliable) ? on the inside

The answer (to "what's sexy on the outside, and boring(ly) reliable on the inside?") is.. .. Nextcloud 24, which I reviewed this week, while modernizing the recipe. Read on for details... Collaboration is boring.. ? Back in 2012, the (overly-geeky) company I worked for employed rdiff-backup and

Run Harbor v2 with Istio mTLS behind a VirtualService

Harbor is an open source registry which can store and manage access to your OCI (Docker) images, helm charts, and other OCI artifacts. Istio is a service mesh which ensures that traffic between participating pods is encrypted and authenticated with mutual TLS. Harbor maintains a helm chart, which either deploys

Portainer's "Dark Mode" is my fault

Portainer's "Dark Mode" is my fault

True story: I once walked into the Portainer offices wearing an eye patch and a pirate hat. Here's the proof (the pirate hat didn't fit very well): Why? It's a longer story, but I'd contracted a viral eye infection thingy, making my

An ingress path is always required for k8s-at-home charts

An ingress path is always required for k8s-at-home charts

While working on adding a link shortener to my cluster, I created a helmrelease based on k8s-at-home's shlink chart. The helmrelease failed with: {"level":"error","ts":"2022-07-09T06:47:39.813Z","logger":"controller.helmrelease","msg"

Customizing Istio's trace sampling rate per-pod

Customizing Istio's trace sampling rate per-pod

We're using Istio across an increasing range of services, and occasionally we need to "dial up" the default sampling rate from 1% to 100% for debug / analysis reasons (we send our traces to Jaeger). I wanted to know whether it's possible to change sampling

How to transfer data between Kubernetes Persistent Volumes (quick and dirty hack)

How to transfer data between Kubernetes Persistent Volumes (quick and dirty hack)

I've recently been using fluxv2's helm controller to deploy applications into multiple clusters. In one instance I was replacing a manually-created 2Gb PVC for a postgres database with a new one created with a statefulset deployed by helm. The original PVC had been created outside of

Giving KeyCloak users Admin privileges in Grafana with OIDC

Paid-members only

Giving KeyCloak users Admin privileges in Grafana with OIDC

I manage a production Kubernetes cluster which is increasingly relying on Grafana dashboarding and instrumentation. Initially, we integrated Grafana with our KeyCloak instance using the following excerpt in grafana.ini: [auth.generic_oauth] allow_sign_up = true api_url = https://keycloak.example.com/auth/realms/kube-cluster/protocol/openid-connect/userinfo auth_

JAJC Manual

In preparing an author bio (harder than it sounds!) for a PHPList book I've been authoring, I dug up this old copy of a JAJC manual (a crusty ol' win32 jabber client) I authored in 2003, using Docbook XML. It's probably no longer valid, but

Applying PSPs to istio-cni-node pods

Applying PSPs to istio-cni-node pods

I work on Kubernetes cluster which are a whole lot more locked-down than typical installation instructions / application defaults would suggest. In one such cluster, we use PodSecurityPolicies to apply a minimal set of privileges to each pod, and make exceptions on a case-by-case basis. On the same cluster, we use

Pin a Kubernetes pod to the current node to avoid (hostPath) data loss

kubernetes Featured

Pin a Kubernetes pod to the current node to avoid (hostPath) data loss

TL;DR here's a handy one-liner to pin a running pod to the node it's currently on: kubectl patch deployment -n $NAMESPACE $DEPLOYMENT -p '{"spec": {"template": {"spec": {"nodeSelector": {"kubernetes.io/hostname": "'$(kubectl get

Integrated OSS Platform

Integrated OSS Platform

In 2009, a national ISP employed a simple Nagios instance to alarm to core network issues. Oncall pages were sent to all staff at all hours, and a nominated engineer was “on call” every week. As the ISP (and parent, managed-services company) extended our managed services to customers, engineers initially

Scalable, secure, always-on VPN solution for managed services clients

Scalable, secure, always-on VPN solution for managed services clients

As we (customer) expanded our customer base and extended our monitoring more customers, managing remote access for our engineers / monitoring towards customer infrastructure became cumbersome. We already employed an OpenVPN solution, permitting remote access for staff to internal resources, using per-device certificates. Engineers started building bespoke solutions per-customer, involving either

Why I won't be returning the (UK English) iPad Magic Keyboard I bought in error

Why I won't be returning the (UK English) iPad Magic Keyboard I bought in error

I bought the wrong iPad Magic Keyboard, but discovered a neat trick which made it worth hanging onto

Self-signed certificates on MutatingWebhooks require double-encryption

Self-signed certificates on MutatingWebhooks require double-encryption

I’m using Cybozu’s TopoLVM to provide local LVM-based storage to a bare-metal Kubernetes cluster, in an intelligent fashion. I’m also using Jetstack’s cert-manager with the --namespace argument, to watch for certificate resources in a particular namespace only, so I wasn’t able to use cert-manager with

Istio Namespace Isolation

Istio Namespace Isolation

I’m working on a project which requires a CockroachDB instance in multiple namespaces (prod/uat/dev), in an Isio-enabled Kubernetes cluster. There are currently some pretty significant drawbacks to using Istio with “headless TCP” services, one of which being you can only have a single instance of a service

Automatically convert deprecated APIs for Kubernetes 1.16

kubernetes Featured

Automatically convert deprecated APIs for Kubernetes 1.16

When Kubernetes 1.16 was released, several beta APIs were deprecated in favor of their stable counterparts. This means that your deployments will fail, if you’re still using the old APIs (as hundreds of public helm charts are!) As release manager Lachlan Evenson mentioned in his Kubernetes Podcast interview,

Geo-restricting Azure services with Front Door

Geo-restricting Azure services with Front Door

I’ve just finished a design for a client which required restricting various web endpoints to NZ IP addresses only. I hadn’t used Azure Front Door prior to this project, because frankly it seemed like overkill for a small, NZ-based platform. I figured, “meh, I’ll just whitelist the

Enabling DKIM on Office365 is easy (as bathing a cat)

Enabling DKIM on Office365 is easy (as bathing a cat)

How hard can it be? Super hard, it turns out. But I hope this post will make it easier for you. In order to produce some documentation for a client on setting up DKIM under Office365, I undertook to migrate a test domain of mine to Office365, and set it

Docker RBAC using Portainer

Docker RBAC using Portainer

I was recently invited by the Portainer team to speak at the Docker Auckland meetup, about the new RBAC extension for Portainer. RBAC is a standard feature of the super-expensive, super-enterprisey Docker Enterprise Edition, but if you want more than admin-only access to your Docker CE cluster, you’re (until

Making changes stick requires attention

Making changes stick requires attention

In The Design of Engineering Culture - DZone DevOps, a great read on “designing” your engineering culture, these two paragraphs jumped out at me: In addition to motivation, change requires attention. A fair amount of people’s attention is devoted to doing their work when everything is business as usual.

The PowerPoint-Killer

The PowerPoint-Killer

This post by James Thomas struck a chord with me. The post details the loss of the space shuttle Columbia (including 7 humans) in 2006. The fact is we know that PowerPoint kills. Most often the only victims are our audience’s inspiration and interest. This, however, is the story