bolha.us is one of the many independent Mastodon servers you can use to participate in the fediverse.
We're a Brazilian IT Community. We love IT/DevOps/Cloud, but we also love to talk about life, the universe, and more. | Nós somos uma comunidade de TI Brasileira, gostamos de Dev/DevOps/Cloud e mais!

Server stats:

250
active users

#kubernetes

57 posts45 participants2 posts today

I wonder if any #Kubernetes controller experts could give me a tip (boosts appreciated).

I need to watch a secret that is an input for my custom resource (TLS certificate). We don't create it and we don't own it.

The whole machinery around Watches() in controller-runtime expects that the resource is either owned or there is an obvious way to trace it back to the "parent" resource (e.g. by matching name). If there are none, is my only option to abuse OwnerReferences or am I missing something?

Gentle reminder 👉 If you're looking to level up your #kubernetes security skills, check out this guide!

reynardsec.com/en/kubernetes-s

It's a free, no-BS resource filled with practical tips and even comes with a tool to spin up your own local lab cluster

ReynardSec · Kubernetes Security Guide (Kubernetes Hardening) - ReynardSecThis article discusses the topic of securing the configuration of Kubernetes clusters. This software is considered quite challenging to manage due to the multitude of settings and areas that need to be addressed. The challenges associated with this can impact the security level of the applied configuration. As usual, my goal is not merely to present a dry list of parameters and ready-made configuration snippets but to provide the reader with a fuller context. I want the reader to understand why certain modifications are necessary and what benefits their implementation will bring. Theory and practice must go hand in hand! Therefore, I have prepared a tool that will allow you to test everything I write about here in your local environment. You will find a script here that will easily start your Kubernetes cluster. The information contained in this text should be treated as a set of basic issues that need to be addressed in the context of securely configuring a Kubernetes cluster. It is possible that your specific application will require additional work.

Well, this one was unexpected: github.com/tarampampam/error-p

I just discovered that some of my services were open to the internet, thanks to the default-backend for my ingress-nginx changing the status codes when switching from v2 to v3 of the backend container…

It's not really a vulnerability, but somehow a security issue for potentially more people. My monitoring caught it, but I didn't really understand until I looked deeper into it.

After upgrading to v3, I noticed that some of my pages, running behind oauth2-proxy in combination with ingress-nginx were experiencing strange problems. API calls would fail, some things wouldn't ...
GitHub--send-same-http-code=false considered harmful · tarampampam error-pages · Discussion #336After upgrading to v3, I noticed that some of my pages, running behind oauth2-proxy in combination with ingress-nginx were experiencing strange problems. API calls would fail, some things wouldn't ...