-
How to Build Multi-Arch Docker Images for MacBook M1
At work, I currently use a MacBook Pro with an Intel chipset and some of my colleagues have upgraded to ones with M1 chipset which is of arm64 or aarch64 architecture. Then expectedly I need to build some Docker images for both architectures. I’ve done some multi-arch Docker stuff before so this is not really […]
-
How To Renew Certificates in Kubernetes Clusters, Revisited
There is a lot of TLS certificates used by the core of a Kubernetes cluster and a popular one is the client-server pair used by kubectl to authenticate to the cluster control plane. In my previous notes on how to renew certificates in a Kubernetes cluster with kubeadm, I found that the steps are quite […]
-
Blog Deployed With Jsonnet, Grafana Tanka and ArgoCD
It’s been a year since I did the ‘Hello World’ with Jsonnet and Tanka, then I made a simple side-loader container to install Tanka as a plugin to ArgoCD and finally deployed an httpbin container with ArgoCD + Tanka + Jsonnet. However since Jsonnet wasn’t used in my work, those things were shelved afterwards. Recently […]
-
Easy Kubernetes Secret Integration with ExternalSecrets
In a Kubernetes cluster, A Kubernetes Secret is a resource type to hold sensitive data for the apps to use, such as an API key or database password. Secrets are namespaced so if I have RBAC access to a namespace, I can pretty much see all the secrets there, as the secrets are only base64 […]
-
Better Resilience for Kubernetes Pods
I happened to notice that all 3 pods serving this blog in my Kubernetes cluster were allocated to a same node. I thought Kubernetes will try its best to shuffle pods of a deployment into different nodes by default but guess I expected too much. Note the knode3 below Have you spotted the problem? In […]
-
Regulate Egress Access in Kubernetes with Istio
Usually I don’t mind to give pods unlimited egress access, ie. the pods I deployed can access the whole internet if it needs to. However when the pods take input from users it’s a whole different story. For example, running some sandbox applications such as an online Python learning environment, the workload can be abused […]
-
Flyway Container, MySQL and SSL/mTLS
Flyway is a handy utility to manage database schema migrations. Very similar to the schema migration mechanism in Ruby on Rails or Django, but Flyway is a standalone tool. So it’s best suited for some project which doesn’t have database schema management yet. I needed to use Flyway for a project I worked with, the […]
-
Some Field Test with Google Cloud Run
Recently I got a chance to migrate on-premise applications to GCP(Google Cloud Platform), and ran the apps in containers via Cloud Run. Here are some pros and cons that I think about the fully managed Cloud Run. Pros: Very easy to get started. As long as the app can run in a container, it can […]