Posts

Problem You need safe, predictable traffic control in prod. VirtualServices + DestinationRules give version routing, timeouts/retries, and circuit breaking without touching code. Approach Define versioned subsets in a DestinationRule. Route via VirtualService with weights (canary → rollout). Add timeout, retries, and outlier detection. Shift weights, watch metrics, then cut over. Example (Config) # vs-dr.yaml apiVersion: networking.istio.io/v1beta1 kind: DestinationRule metadata: name: svc namespace: prod spec: host: svc.prod.svc.cluster.local subsets: - name: v1 labels: version: v1 - name: v2 labels: version: v2 trafficPolicy: tls: mode: ISTIO_MUTUAL outlierDetection: consecutive5xx: 5 interval: 5s baseEjectionTime: 30s maxEjectionPercent: 50 --- apiVersion: networking....

Leadership Sync Positive Affirmations for Site Reliability Engineers Senior Engineer The Hustle MAKRO | Microsoft Excel Stream Highlights 3/19 Designer’s Table

Why do I need to build a docker container on every commit? Why do I need to download shit load of data every time my CI runs?

Implementing authentication from scratch often starts simple but quickly escalates into weeks of navigating RFC specifications and protocol implementations. Keycloak addresses this complexity by providing a comprehensive identity management solution. What is Keycloak? Keycloak is an open-source identity and access management solution that handles authentication and authorization at enterprise scale. Core capabilities include: Single Sign-On (SSO) - Centralized authentication across multiple applications User federation - Integration with LDAP, Active Directory, and other identity stores Identity brokering - Authentication through external providers including Google, GitHub, and SAML systems Authorization policies - Fine-grained permission management Standard protocols - OAuth 2....

The reason why newcomers try to do everything at once or add everything they can is to prove they can do anything with the new knowledge they acquire. Veterans tend to make things simpler.

Understanding how HTTP requests traverse an Istio service mesh is fundamental to effectively operating and troubleshooting microservices architectures. This technical analysis examines the complete request lifecycle, from external ingress through service-to-service communication, detailing the mechanisms that enable Istio’s traffic management, security, and observability capabilities. The Service Mesh Problem Statement Microservices need reliable communication, security, and observability. Without a service mesh: Each service manually implements load balancing, retries, and circuit breakers Security and certificate management are inconsistent Service-to-service communication lacks visibility Debugging network issues is complex Code duplicates resilience patterns Istio provides standard networking, security, and observability across services without code changes....

Just say no.

Have you ever asked an LLM, “Build me a CRUD API in FastAPI,” and just hoped for the best? LLMs are great at taking broad requests and letting us talk to computers like they’re people. But that freeform style can bring surprises and make it tough to get the same result twice. Behavior-Driven Development, or BDD, offers a clear framework. It guides you to: Define exactly what you expect Set clear boundaries for the solution Keep everything documented in plain language Creating a prompt plan using BDD A “prompt plan” is basically a roadmap for your LLM....

3 ideas that help me be a bit more happier every day: The journey is where the fun is, not at the destination Allow yourself to be happy Find a purpose in life

Understanding computer networks is like following the journey of a letter you send to your friend across a city, navigating streets, buildings, and neighborhoods until it reaches their hands I’m writing this for my younger (and admittedly less handsome) self back in university, who constantly struggled to grasp networking concepts, particularly subnetting. I chose analogies for this book because they’re powerful tools for understanding complicated ideas. There’s an old saying: “the map is not the territory....

Concept mapping table Concept Analogy Network Building Computer Room IP Address Room Number Subnet Floor Network Protocol Language Switch Floor Manager Router Building Concierge Gateway Elevator MAC Address Unique Door ID Bandwidth Hall Width Private IP Internal Room Number Public IP Building Street Address DNS Public Directory TCP Registered Mail Service UDP Untracked Mail Service Port Service-Specific Mail Slot HTTP/HTTPS Web Service Language SMTP/FTP/SSH Specialized Service Languages Data Packet Envelope with Metadata Checksum Data Integrity Check Internet City of Buildings ISP Road/Utility Builder Firewall Security Gate/Guard VPN Hidden Passageway Load Balancer Extra Reception Staff CDN Local Storage Hub QoS Priority Lane NAT Front Desk Clerk Routing Table Building/City Map IPv4 Limited Address System, IPv6 Unlimited Address System, Network Topology Building Blueprint Cloud Computing Rented Office Space Cloud Provider Property Manager Scalability (Cloud) Flexible Office Expansion Network Interface Door VLAN Private Hallway Dual-Stack System Translator for Old/New Address Systems Software-Defined Networking Virtual Architect License This draft is shared under CC BY-NC-ND 4....

What is a system? A set of pieces that work together to perform a function. When those pieces work together, emergence arises! Emergence as a concept refers to the idea that the whole is greater than the sum of its parts. New properties and behaviors emerge at the system level that cannot be understood by analyzing the parts in isolation. Systems thinking is bla bla bla, you can read it from wikipedia....

In AWS, in order to access resources in other accounts without creating new users or handling passwords, you can use sts:AssumeRole. Let’s say that you have some resources in AccountA (AWS Managed Prometheus for example) that you want to access from AccountB Account A In AccountA create a role account_a_role that has 2 types of policies: a Trust Relationship that define which entities can assume this role { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowAssumeRoleFromAccountB", "Effect": "Allow", "Principal": { "AWS": "arn:aws:iam::ACCOUNT_B_ID:role/account_b_role" }, "Action": "sts:AssumeRole" } ] } You can also set Conditions to filter which entities can AssumeRole and even configure AssumeRoleWithWebIdentity for users who have been authenticated with a web identity provider....

For me, lateral thinking is: Solving problems using an indirect and creative approach. Using reasoning that is not immediately obvious and involving ideas that might not be obtainable by using traditional step-by-step logic. One “simple” approach to “think outside the box” is: Understanding WHAT you want to achieve. Understanding WHY you want to achieve it. Knowing the rules of the game (constraints like environment, budget, physical limitations, etc.) Reframing WHAT you want in a way that ignores these rules of the game....

I’ve been thinking a lot about how we interact with technology, and I’ve come to realize that being familiar with something doesn’t always mean it’s simple. In fact, it can sometimes make things more complicated. For example, when I’m working on code or documentation, I find myself getting too close to the issue. It’s easy to lose sight of the bigger picture and get caught up in the details. That’s why it’s important for us to take a step back, look at our work from a different perspective, and ask for feedback....

In order to make it faster, we need to understand why it is slow.

Which architecture should I choose? I don’t think this is the right question to ask. A better question would be, given the current state of my service/product, which architecture will provide what I’m looking for? For example, performance, independent deployments, application boundaries, etc. For example, many people mention that we should start with a monolith and while I agree with some of the arguments (simplified development and deployment, consistent performance), it tends to ignore the fact that it might be better to prioritize freedom and experimentation at early stages rather than performance....

GitHub actions are a problem because they lock you by the balls and you cannot reproduce your pipelines. Getting to depend on all those small Actions saves 5 minutes today, only to make migrations immensely painful tomorrow. Build, package, and release software should be written as standalone scripts that in principle could even run in the developer’s machine. Moving them to CI is just changing the machine that will run the scripts....

A pattern of shared assumptions that groups have learned as they solve problems of external adaptation and internal integration, that has worked well enough in the past to be considered valid and therefore to be taught to new members as the correct way to PERCEIVE, THINK and FEEL – Edgar Schein Culture evolves over time, driven by both external influences and internal dynamics. It’s important to explore the factors driving these changes....

Innovation often springs from the most unexpected sources. – Me The ability to transfer domain knowledge from one field to another can breed a lot of creativity and gives you new perspectives and the opportunity to think outside the box. But what is Domain Knowledge Transfer? Domain knowledge transfer is the process of applying knowledge, principles, and solutions from one field of study or industry to another. By looking beyond the confines of a single domain, we can find new solutions to complex problems and drive progress in unexpected and transformative ways....

A made up mind is hard to change – Jeff Bezos or Confucius, I don’t know who, but the phrase got stuck with me Standing still is not an option. Progress, by its very nature, demands change. It beckons us to guess, to venture into the unknown, and to embrace risks with open arms. Why? Because without the courage to step beyond the familiar, innovation remains a distant dream....

Society seems to follow a cycle of moods that last around 20 years each. Each cycle is called “Turning” NOTE This is an unfalsifiable theory, so take it with a grain of salt. High The first turning is a high, which occurs after a crisis. During the high, institutions are strong and individualism is weak. Society is confident about where it wants to go collectively, though those outside the majoritarian center often feel stifled by conformity...

First of, congratulations! Few words before moving on: There is no such thing as DevOps Engineer, DevOps is a philosophy, a way of working. Your DevOps role will depend on your organization structure and maturity. Some organizations use DevOps, SRE and Platform engineering interchangeably, don’t worry. Focus on the goal. You will work in a team, empathy is mandatory. A lot of people ask, do I really need to know ___ALL OF THAT___ to work as a DevOps Engineer?...

As in the ship of Theseus… If you replace each Kubernetes component… what is it that you get at the end? An API, an ecosystem and the sum of its parts. BTW, is kubernetes an overkill? Yes and No I think is a necessary evil to avoid selling your soul to a cloud provider.

Or is it a perspective? is it the result of the human ego? or is it just a communication problem? If you look at biology, evolution has found a way to design its systems in a way that each component has a defined interface to communicate, and more importantly, each component is free to “experiment” or evolve independently from each other by random mutations. When changes in one component require a new interface it propagates those “requirements” to the other components in a trial-and-error mechanism....

Docker multi-stage build is a great way to build a container images with a minimal footprint. Compiled languages like Go or Rust can take advantage of this by just shipping a binary to a container This is an example from the official docs: FROM golang:1.16 WORKDIR /go/src/github.com/alexellis/href-counter/ RUN go get -d -v golang.org/x/net/html COPY app.go ./ RUN CGO_ENABLED=0 go build -a -installsuffix cgo -o app . FROM alpine:latest RUN apk --no-cache add ca-certificates WORKDIR /root/ COPY --from=0 /go/src/github....

Big O Notation (or the Big O) is used to describe how long and complex an operation will be based on its input. Complexity could mean that an operation takes N amount of time, or N amount of memory, N CPU resources, etc. There are some notations to describe this: O(n) -> The complexity grows linearly based on the size of the input. O(n^2) -> Grows at a square ratio of its input....

Ambient mesh is a new data plane mode for Istio that doesn’t rely on sidecars. It gives users the option to forgo sidecar proxies in favor of a mesh data plane that’s integrated into your infrastructure. Ambient mesh benefits are: Minimal configuration for traffic encryption. Same configuration for L7 policies as ”normal service mesh”. Take less resources because no sidecars are needed. Easier upgrades because pods don’t need to restart in order to upgrade the service mesh....

aka Pareto principle. After writing Python for over 10 years, I can code in it as naturally as I speak Spanish or English. The honeymoon period is over, though. Python has some disadvantages I’m no longer willing to tolerate: Distribution complexity: Sharing code requires the right interpreter + pip registry access on target environments. Air-gapped environments become nightmares. Tools like nuitka exist, but adoption remains limited. Performance bottlenecks: Python is slow....

Update Jan 2023: Is OpenStack Still Needed in 2022? - Thierry Carrez, Open Infrastructure Foundation And why Kubernetes “won”. I owe my career to OpenStack and to all its contributors. I have made excellent friends, I learned a lot from them and the project itself. For that and more, thanks a lot OpenStack. However… Even though OpenStack has never been better, I can’t shake the feeling that is fighting a lost battle....

TOOL Website TOOL - Lateralus Black Then White are All I see In my infancy Red and yellow then came to be Reaching out to me Lets me see As below so above and beyond I imagine Drawn beyond the lines of reason Push the envelope Watch it bend Over thinking, over analyzing, separates the body from the mind Withering my intuition, missing opportunities and I must Feed my will to feel my moment Drawing way outside the lines Black Then White are All I see In my infancy Red and yellow then came to be Reaching out to me Lets me see There is So Much More and Beckons me To look through to these Infinite possibilities As below so above and beyond I imagine Drawn outside the lines of reason Push the envelope Watch it bend Over thinking, over analyzing, separates the body from the mind Withering my intuition, leaving opportunities behind Feed my will to feel this moment Urging me to cross the line Reaching out to embrace the random Reaching out to embrace whatever may come I embrace my desire to I embrace my desire to Feel the rhythm To feel connected Enough to step aside and Weep like a widow To feel inspired To fathom the power To witness the beauty To bathe in the fountain To swing on the spiral To swing on the spiral To swing on the spiral Of our divinity and Still be a human With my feet upon the ground I lose myself between the sounds And open wide to suck it in I feel it move across my skin I'm reaching up and reaching out I'm reaching for the random or Whatever will bewilder me Whatever will bewilder me And following our will and wind We may just go where no one's been We'll ride the spiral to the end And may just go where no one's been Spiral out, keep going Spiral out, keep going Spiral out, keep going Spiral out, keep going

Define the scope of your system Start by asking this broad questions: Why is your system required? This will help you find the reason why this system or organization exists What is the goal of your system? These two questions will help you understand your organization’s requirements, use them as a starting place, then clarify as much as you can those answers so you can start building a clear picture of what components might be needed and more importantly, which ones won’t....

In no particular order: The wailing | Gokseong Noroi | The Curse The Medium Late Night with the Devil The Dark and the Wicked When Evil Lurks | Cuando Acecha La Maldad Perfect Blue | Pâfekuto burû Satan’s Slaves | Pengabdi Setan Satan’s Slaves: Communion | Pengabdi Setan 2: Communion Kairo | Pulse Aterrados Incantation | Zhou Gonjiam: Haunted Asylum | Gon-ji-am A Tale Of Two Sisters | Janghwa, Hongryeon...

Tools for better thinking The Catalog of Design Patterns Learn X in Y minutes XMind Amazon EKS Blueprints for Terraform AWS Architecture Blog Cloud Design Patterns AWS in plain English AWS Solutions AWS Well-Architected Distributed Load Testing on AWS Istio by example High scalability Kubernetes Failure Stories AWS Prescriptive Guidance Patterns

When installing GitLab in air-gapped mode using helm charts first you need to pull the required images for the target version to your private container registry. But is not straightforward to find which container tags map to which GitLab version. An easy way to find which tags you need is to print the helm templates first and get the values from there. helm \ -n gitlab \ template \ gitlab gitlab/gitlab \ --version 6....

I’m trying to learn everything at once. I’m trying to do everything at once. … Except what I should be doing right now. 一度にすべてを学ぼうとしています。 一度にすべてをやろうとしています。 … 今すぐやるべきことを除いて。

“Why is this important”? Good senior engineers always ask “why” this feature, or function or even project is necessary. Understanding “why” allows them to make decisions on “what” to do, “how” to do it and even how to take shortcuts to get there. They also understand “why” target users would want these features in the first place. Clear communication Good senior engineers always strive to be good communicators. They document everything, from code to the decision making process and agreements between people involved in a project....

Kubernetes is becoming a monster and as it grows it becomes more and more challenging for newcomers to understand it. My goal is to demystify its components. Main components There are two main components in a Kubernetes cluster. Master nodes Worker nodes The only difference is the workloads they run. You can assign metadata to these nodes to schedule specific workloads on each node or type of node. For Users Containers A container is a filesystem and process wrapped in a “box” with some labels on it....

Looming recession !! , third world war !!, climate change !! Meanwhile taquito…

At its core, TODOS are a real cognitive and spiritual burden of having to carry lots of unfulfilled promises into the future. その本質において、TODOリストは、未来に持ち込む未完の約束の重たい認知的および精神的な負担である。

The rapid development and adoption of cloud-native stacks that brings a better developer experience, security, reproducibility and speed at which organizations deliver value are leaving more traditional stacks behind. Hence, there is more pressure from the markets, organizations and developers to bring those stacks into a more modern era. We often wonder whether the same techniques and toolchains of these modern stacks can be used to configure not-so-modern applications or infrastructures....

Be very carrefull in your setup : any misconfiguration make all the git config to fail silently ! Setup multiple git ssh identities for git Generate your SSH keys as per your git provider documentation. Add each public SSH keys to your git providers acounts. In your ~/.ssh/config, set each ssh key for each repository as in this exemple: Host github.com HostName github.com User git IdentityFile ~/.ssh/github_private_key IdentitiesOnly=yes Host gitlab.com Hostname gitlab....

WSL configuration Install i3 sudo apt install i3 -y Create an init script vim ~/src/scripts/i3launch.sh #!/bin/zsh source ~/.zshrc # If not running interactively, don't do anything [ -z "$PS1" ] && return export DISPLAY=$(awk '/nameserver / {print $2; exit}' /etc/resolv.conf 2>/dev/null):0 export LIBGL_ALWAYS_INDIRECT=1 dbus_status=$(service dbus status) if [[ $dbus_status = *"is not running"* ]]; then sudo service dbus --full-restart fi i3 To run WSL2 as root wsl.exe -d Ubuntu-20.04 -u root -- /bin/bash Windows configuration Install vcxsrv from powershell...

Fuzzy Search documentation from the CLI. See it in action here https://terminalizer.com/view/2c3935cf1418 Disclaimer This tool was built to learn FZF capabilities. Feel free to use it or extend it. Usage doc-fzf ansible doc-fzf ansible -q yum Installation pip3 install doc-fzf Verify your installation: doc-fzf -h usage: doc-fzf.py [-h] [-q QUERY] module_name doc-fzf. positional arguments: module_name Name of the module to search optional arguments: -h, --help show this help message and exit -q QUERY Query the docs Extending Doc-FZF doc-fzf is a modular application....

Usage: pip install pynetbox ansible ansible all -i hosts/env -m setup --tree /tmp/facts/env #!/opt/netbox/bin/python import argparse import json import os import sys import pynetbox import yaml import urllib3 urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning) if sys.version_info < (3, 6): print("Python 3.6 is required") sys.exit(2) def to_json(in_dict): return json.dumps(in_dict, sort_keys=True, indent=4) def load_configuration(path="/etc/ansible/netbox.yml"): """ Load netbox configuration /etc/ansible/netbox.yml """ try: with open(path, "r") as fd: return yaml.safe_load(fd) except yaml.YAMLError as yml_error: print(yml_error) NETBOX_ENDPOINT = load_configuration()["netbox_endpoint"] NETBOX_TOKEN = load_configuration()["netbox_token"] if not NETBOX_ENDPOINT: raise OSError("environmet var NETBOX_ENDPOINT not set") if not NETBOX_TOKEN: raise OSError("environmet var NETBOX_TOKEN not set") nb = pynetbox....

The World from another point of view Fun to imagine Knowing versus Understanding

Waju or whatever is called is a game that until this day I don’t know from where it comes. But, is fun. Edit: The game is based on a German game called Mensch ärgere Dich nicht Goal The goal of the game is very simple: Move your marbles for one lap from your home to your goal. Don’t worry about winning but don’t let anyone else win. Have fun. Board The board has six main components:...

This laptop has very decent specs: 8th Generation Intel® Core™ i7-8550U processor GPU: NVIDIA® GeForce® MX150 with 2 GB GDDR5 / Intel® UHD Graphics 620 16 GB LPDDR3 2133 MHz BT 4.1 (compatible with 3.0 and 2.1+EDR) 512 GB NVMe PCIe SSD Don’t expect running workstation level workloads in this machine but it is a wonderful dev machine. Things I don’t like about the laptop Palm rejection on Linux Sound, it only outputs sound to two speakers on Linux and it has a werid noise under high volumes....

Note This is a Work-In-Progress Document and the most up-to-date information is available at: github.com/memogarcia/openstack-deployer Deploying OpenStack using containers allows easy customisation and flexibility on how to deploy the platform for development, testing and production environments. Current deployment: stable/queens Host configuration The default configuration for this environment is composed by 3 main components that need to run on the host: Docker Libvirtd OpenVSwitch Docker will act as the control plane for OpenStack while the host will provide the hypervisor, network and storage....

A Certificate Authority or CA is an entity that signs digital certificates. These digital certificates are used to validate the connection while using secure mechanisms. Generating a root CA We will use a root CA to create intermediate CA’s which are trusted to sign certificates on its behalf. First, prepare the environment. mkdir /root/ca && cd /root/ca mkdir certs crl newcerts private chmod 700 private touch index.txt echo 1000 > serial Then download the template for /root/ca/openssl....

Note This is a Work-In-Progress Document. Read the docs at memogarcia/pratai-docs Abstract Pratai provides an incredibly flexible and resilient platform to migrate workloads to the cloud that respond to events without having to manage any server or network. How it works The goal of Pratai is simple. Deploy “code” (disclaimer, from now on I will refer to code as functions), that will react to an event without worrying about anything else, the platform handles the execution....