So I spent time with the best public material on cell-based architecture: Airbnb's zonal migration talk from KubeCon EU, Slack's engineering write-up of their AZ drain, New Relic's cell fleet program, Booking.com's vCluster cells, Neon's hard lessons from going cellular under pressure, and WSO2's take on cells for AI agents. I also worked through the AWS reference implementation for cell-based architecture on EKS.

##

My read, after all of it: cells are the mechanism that turns an incident's blast radius from "all of our customers" into "one Nth of our customers." A cell is a full vertical slice of the system, fixed in size, fully independent: its own services, data stores, networking, and security boundary. You scale by adding cells, never by enlarging them. The pattern has three parts: the cell, a thin stateless router that maps a partition key to a cell, and a control plane that stays out of the request path entirely.

This guide is what I would hand a customer architect who asks how to build that on EKS: when the investment is justified, the exact reference shape, and the mistakes to avoid.When cells are worth it, and when they are not

Airbnb’s lead architect opens his KubeCon talk with the rule: 99 times out of 100, do regional. A regional cluster is easier to reason about: one control plane, one deployment with HPA and pod topology spread. Cells are the exception, not the default.

Build cells when at least two of these are true:

• A single-tenant-impacting failure is a business-level event (regulated data, SLA penalties, revenue on the line)

• You have crossed, or are on a growth curve toward, concrete platform ceilings: ~10,000 active pods per cluster, the EKS etcd 8 GB ceiling, Kubernetes API rate limiting (Neon hit all of these)

• Your incidents are dominated by gray failures, bad deploys, or operator errors where recovery speed matters more than prevention (Airbnb’s thesis: regional clusters “don’t protect us from ourselves”)

• You have platform-engineering maturity to automate provisioning, wave deployments, and fleet health, because per-cell operational overhead multiplies

Do not build cells when:

• Your regional clusters are nowhere near their ceilings and your incidents are ordinary (Booking.com’s warning: cells are “comparatively costlier,” and she uses them only for payment workloads)

• Your data model cannot be partitioned without synchronous cross-cell calls (a cell with sync cross-cell dependencies is a distributed monolith with extra cost)

• You need it this quarter. Neon cellularized under pressure and had more incidents in two months than in the entire prior year. My take: cells are a proactive investment or an emergency liability. There is no middle option.The reference architecture on EKS

  The AWS-sanctioned shape comes from the AWS Solutions Architects’ reference implementation (guidance-for-cell-based-architecture-for-amazon-eks, MIT-0 Terraform).

  Cell = one EKS cluster confined to a single Availability Zone. Not a namespace, not a node group. The cluster boundary is the blast-radius boundary: its own control plane, compute, ALBs, IAM roles, and data stores. Multiple cells per AZ are allowed; cells spread across AZs so an AZ failure takes out only its cells.

  [DIAGRAM 1]

  Five hard rules inside each cell:

  1. Cross-zone load balancing stays off. The AWS Load Balancer Controller configures per-cell ALBs with cross-zone LB disabled. This preserves AZ isolation and removes inter-AZ data transfer for chatty workloads, which is also a cost win.

  2. Pods are pinned to the cell’s AZ. Node selectors (or AZ-scoped Karpenter provisioners) keep scheduling inside the cell. Pods must never drift across the cell boundar``

  3. Traffic enters through Route 53 weighted routing. Weighted records (reference split 33/33/34 across three cells) with health checks for automatic failover, plus Amazon Application Recovery Controller zonal shift as the break-glass. Per-cell DNS records (cell1/cell2/cell3.example.com) allow direct cell access for debugging.

  4. Karpenter handles node scaling. Managed node groups for baseline and system pods (CoreDNS, LB controller), Karpenter for dynamic scaling beyond. Karpenter also fixes the insufficient-capacity class of failures that static node groups leave you exposed to.

  5. Least-privilege IAM per cell, with EKS Pod Identity. Each cell gets its own roles; never share a role across cells. The trust policy sketch for a per-cell pod role:```

     {

     “Version”: “2012-10-17”,

     “Statement”: [{

     “Effect”: “Allow”,

     “Principal”: { “Service”: “pods.eks.amazonaws.com” },

     “Action”: [”sts:AssumeRole”, “sts:TagSession”]

     }]

     }Then scope the role’s permissions to resources inside that cell’s account or VPC only. A cell’s compromised credential must not reach another cell’s resources.

     The stack you can copy directly: AWS’s three-layer isolation template (AZ → Region → Account), the thin stateless router (hash function → DynamoDB mapping → Route 53 entry from a networking shared-services account), and HPA-over-VPA as the hyperscale autoscaler, because adding replicas also adds resiliency. Full working Terraform is in the guidance repo above; treat it as the starting point, not the finished product.

     The reference’s one compromise to fix: the README permits multi-AZ RDS/DynamoDB/ElastiCache shared across cells for persistence. That is shared data fate wearing a high-availability costume. Prefer per-cell data stores (see Data isolation below); use the shared variant only with an explicit, time-boxed migration plan to per-cell storage.The router: the one component allowed to be shared

     Every source treats the router as the single shared component, and invests its paranoia there. If the router fails, N cells become one logical cell.

     [DIAGRAM 2]

     Design rules, no exceptions:

     • Thin and stateless. It maps the partition key to a cell and nothing else. No auth, no rate limiting, no business logic (Hyperforce’s rule: the router stays “dumb” or it becomes the new single point of failure).

     • In a separate failure domain from the cells. Slack’s drains are driven from edge load balancers in other regions with a regionally replicated control plane, so draining works when the target AZ is completely offline. Your Route 53 layer and mapping store must survive the loss of any cell.

     • Static stability: it works with the control plane down. Cache the routing map locally at the router; use DNS for cell discovery rather than database lookups on the hot path. Test this explicitly: kill the mapping store and confirm requests still route.

     • Modeled on Slack’s pattern: the drain is reweighting, not reconfiguration. Two stock mechanisms do the whole job: weighted target clusters plus dynamic weight assignment. The reweight propagates in seconds, completes in-flight requests gracefully, and gives 1% granularity so operators can experimentally drain during an incident and undrain if it doesn’t help.

     For EKS, the concrete recipe is: Ro

     {

     “Name”: “api.example.com”,

     “Type”: “A”,

     “SetIdentifier”: “cell-1”,

     “Weight”: “33”,

     “AliasTarget”: {

     “DNSName”: “k8s-cell1-us-east-1a.elb.amazonaws.com”,

     “EvaluateTargetHealth”: true

     }

     }eat with SetIdentifier cell-2 / Weight 33 and cell-3 / Weight 34. A drain is a weight change to 0 on the failing cell’s record, propagated by DNS.

     4. Partitioning: the decision you will not get to redo

     Every source agrees: the partition key is the most critical decision and the hardest to change. Tenant ID, user geography, or user ID are the usual candidates. It determines data gravity, latency, and load balance for the life of the system. Choose it with the data architects in the room, not after the cluster design is done.

     Two cell models, pick one deliberately:

     • Per-AZ cells (AWS guidance, Slack, Airbnb): the cell boundary is the availability zone. Best when the threat is infrastructure failure and gray failures. Simplest to reason about, aligns with AWS’s own failure domains.

     • Per-tenant (or per-shard) cells (New Relic, Notion-style, GitHub-style): the cell boundary is the customer set. Best when the threat is noisy neighbors and blast radius must be expressed in customers, not zones. Harder routing, stronger isolation guarantees per customer.

     Shuffle sharding: the zero-cost noisy-neighbor layer. On top of cells, assign each tenant a small pseudo-random combination of cells from the pool instead of one cell. The math: 8 cells in virtual shards of 2 gives C(8,2) = 28 unique combinations, so a misbehaving tenant degrades 1/28th of the fleet instead of a whole cell. Route 53 runs this in production: 2,048 virtual name servers, customers assigned shuffle shards of 4, roughly 730 billion possible shards, no two customer domains sharing more than 2 servers. Effectiveness improves with scale, which makes it the rare technique that gets better as you grow. Reserve it for multi-tenant SaaS where tenant behavior, not cell failure, is the threat; it adds router complexity you do not need otherwise.

     [DIAGRAM 3]

     5. Deployments: waves, or a global single point of failure

     Deploying to all cells at once turns your deployment pipeline into the blast radius you built cells to avoid. The wave discipline is unanimous across every source.

     The required wave schedule:

     1. Canary cell first (lowest-traffic cell), automated health checks, soak 30 to 60 minutes

     2. 10% of cells, with canary analysis on error rate and latency

     3. 25% of cells

     4. 100%

     Automated rollback is non-negotiable at every staData isolation: enforced by tooling, not review boards

     Rule: every cell owns its data stores. Databases, caches, queues, all cell-local. Cross-cell needs travel through asynchronous replication or messaging (Kafka or equivalent), never synchronous calls on the request hot path. This is unanimous across sources, and the failure mode has a name: the leaky abstraction, a “quick” sync cross-cell API call, a shared read replica for analytics, a central cache. Each one erodes fault isolation until you are back to a distributed monolith, paying cell prices for regional reliability.

     [DIAGRAM 6]

     Enforce it mechanically:

     • Kubernetes NetworkPolicies that deny inter-cell egress by default in every cell:

     [YAML CODE BLOCK]

     Then add explicit allow rules only for the async messaging endpoints and the cell’s own stores. A new dependency requires a policy change, which is reviewable and auditable.

     • CI static analysis that flags cross-cell database connections before merge.

     • Paved roads over review boards: the platform team supplies managed async messaging, Terraform cell-stamping modules, and CI/CD templates with waves baked in. Compliance must be the path of least resistance, not a ticket queue.

     The one legitimate exception is genuinely global data (system configuration, identity), which needs async replication with explicit consistency models (CQRS/event sourcing), never synchronous sharing. Name the exception, bound it, and keep it out of the request hot path.8. Observability: per cell, or you are flying blind

     Global aggregates hide cell-level degradation. A fleet-wide p99 of 120 ms can mask one cell at 400 ms. Every source that ran cells in production converged on the same rule: each cell gets its own dashboards, its own alerts, and its own error-budget tracking, with a fleet-level aggregated view on top.

     Minimum per-cell instrumentation:

     • Request rate, error rate, and latency percentiles by cell

     • Cell router weights and traffic distribution (so a stuck drain is visible)

     • Per-cell saturation signals: CPU/memory, pod churn, Karpenter provisioning latency, etcd metrics

     • Per-cell error budgets with alerts that fire on the cell, not the fleet

     Airbnb rebuilt their developer tooling to operate at whole-unit or per-cell granularity: scale by cell, logs per cell, metrics and alerting by cell and by AZ instead of region-wide. If your current dashboards cannot answer “which cell is unhealthy right now,” the observability work is part of the cell migration, not an afterthought.

     9. Failure-mode checklist and acceptance tests

     The acceptance test for the whole architecture: deliberately kill a cell in production (with approvals) and verify that only 1/N of users are affected, with automatic evacuation. If the failure escapes the cell boundary, your isolation is fictional. Hyperforce runs exactly this test; so should you.

     Checklist of failure modes to design against:

     • Bad deploy: contained by wave schedule. Verify: a canary-cell failure stops the wave automatically.

     • Gray failure in one AZ: contained by the drain. Verify: quarterly production drain drills.

     • Noisy tenant: contained by shuffle sharding. Verify: load-test a poisoned tenant and measure impact at 1/28th of the fleet, not a whole cell.

     • Operator error: contained by per-cell IAM and per-cell tooling scope. Verify: a cell-scoped role cannot touch another cell’s resources.

     • Leaky abstraction: contained by default-deny NetworkPolicy and CI checks. Verify: chaos experiments that attempt cross-cell sync calls fail closed.

     • Router failure: contained by static stability. Verify: kill the mapping store; requests keep routing.

     • Cell failure: contained by design; verify with the kill-a-cell test above.

     Ceilings to respect:

     Cells do not make Kubernetes ceilings disappear, they keep one ceiling from being global. Neon measured degradation beyond 10,000 concurrent databases per cluster from the EKS etcd 8 GB ceiling, network confiCell drain runbook: the payoff of the whole architecture

     Slack’s drain button is the pattern to copy. Its four design goals are your acceptance criteria:

     1. Remove traffic from a cell within 5 minutes. Their 99.99% SLA allows under an hour of downtime per year; the drain must be fast enough to spend almost none of it.

     2. Zero user-visible errors during the drain. In-flight requests complete gracefully. The drain is a generic mitigation operators reach for before root cause is known, so it must be safe to use experimentally.

     3. Incremental in both directions. Drain and undrain at fine granularity (Slack: 1% on restore) so recovery can be verified before full traffic returns.

     4. Operable from outside the cell. The drain mechanism must not depend on any resource inside the drained AZ. If your drain needs the AZ to be healthy, it is not a drain.

     [DIAGRAM 5]

     Rehearse it in production. Slack exercises the drain regularly against real services, which is chaos engineering applied to the mitigation tool itself. A drain that has only ever run in staging will surprise you in the incident it was built for. Schedule quarterly drain drills; the drill result (minutes to drain, errors observed) is a reliability metric, reported like any other.. Migration path: go cellular proactively

     Neon’s story is the warning label: implementing cells under incident pressure, while keeping the service running, produced more incidents in two months than the entire previous year. The investment case is made while the system is healthy, keyed to the cost of one total outage.

     Airbnb’s automation lessons, in order:

     1. PoC first, and let it embarrass you. Two services in three months extrapolated to “1,000 migrations in 125 years.” That number is what forced the automation investment. Budget for it.

     2. Make the migration a normal deployment. Their platform refactor (hardcoded cluster context replaced with a cellset field) meant each service migration surfaced to the owning team as one PR review and one normal deploy, about half a day’s work. The platform team absorbed the complexity; service teams did not.

     3. Automate the batch. A batch job cloned each service’s source, ran the config-migration tooling, looked up the owning team and on-call in the service catalog, created the PR, and opened a Slack thread tagging the on-call. They did 10 to 20 critical services in parallel, 30 to 40 for less critical, roughly 3,000 PRs total.

     4. Phase per service: non-prod, then canary, then production. Non-prod caught sticky sessions and hardcoded cluster assumptions before production ever saw them.

     5. Expect the support burden to be underestimated anyway. Their words, despite the self-service design.

     Set expectations honestly:

     New Relic’s cellular program is a multi-year effort (started 2020, still evolving cell types in 2025), and their hardest ongoing pain is Cluster API version skew across cloud providers. If you go multi-cloud, that pain is yours too. The control-plane cell (their “C&C cell” with cell-modeling CRDs) is the pattern to copy for fleet lifecycle, but budget real engineering for it.

     11. Cost notes

     The AWS reference implementation prices a 3-cell deployment at roughly $800 to $1,000 per month: fixed costs around $722 (3 EKS clusters at $219, baseline nodes, 3 ALBs, NAT gateway, EBS, Route 53 hosted zone) plus $63 to $315+ variable (ALB LCU processing, NAT data processing, CloudWatch, DNS queries). Levers: Karpenter provisioner tuning, right-sizing baseline node groups, Spot via Karpenter, Savings Plans for the baseline.

     The honest framing for the business case: duplication raises baseline cost, always. The model pays off at scale through linear cost growth instead of step-function re-architecture, avoided global outages, and reduced need for expensive vertical scaling. Hyperforce’s framing is the one to use with leadership: cells are not a best practice, they are a scalin## 12. Sources

     - Slack engineering, “Slack’s Migration to a Cellular Architecture” (note: the promised follow-up post never shipped) → https://slack.engineering/slacks-migration-to-a-cellular-architecture/

     - Slack engineering, “Traffic 101: Packets Mostly Flow” → https://slack.engineering/traffic-101-packets-mostly-flow/

     - Airbnb, KubeCon EU 2026, “1000 Services, 1 Year, 0 Downtime: Airbnb’s Zonal Cluster Migration” (Sunny Beatteay) →

     - AWS Architecture Blog, “Journey to Cloud-Native Architecture Series #7: Using Containers and Cell-Based Design” → https://aws.amazon.com/blogs/architecture/journey-to-cloud-native-architecture-series-7-using-containers-and-cell-based-design-for-higher-resiliency-and-efficiency/

     - AWS Guidance for Cell-Based Architecture on Amazon EKS (Terraform reference, arsa-codes) → https://github.com/arsa-codes/guidance-for-cell-based-architecture-for-amazon-eks

     - New Relic, KubeCon EU 2025, “Resilient Multi-Cloud Strategies” (Cluster API cell program) →

     - Booking.com + Loft Labs, KubeCon India 2024, “Cell-Based Kubernetes - The Secret to Scalable, Repeatable and Resilient Cloud Architecture” →

     - WSO2, KubeCon EU 2026, “Zero Trust for Autonomous Agents: Isolating AI Workloads on Kubernetes” (cell-based architecture applied to agent isolation) →

     - University of Edinburgh + WSO2, KubeCon NA 2025, “People-first Path To Cell-based Architecture” → sched page https://kccncna2025.sched.com/event/27FY1/people-first-path-to-cell-based-architecture-martin-jones-university-of-edinburgh-asanka-abeysinghe-wso2

     - Omnistrate, “Moving to Cell-Based Architecture: Lessons from Neon” → https://blog.omnistrate.com/posts/moving-to-cell-based-architecture-lessons-from-neon

     - AWS Builders’ Library, “Workload isolation using shuffle-sharding” → https://aws.amazon.com/builders-library/workload-isolation-using-shuffle-sharding/

     - Salesforce Hyperforce cellular analysis (Mayank Raj) → https://github.com/rajmayank/mayankraj.com/blob/HEAD/content/blog/cell-based-architecture-blast-radius-containment.md

     - developers.dev, “The Architect’s Playbook for Cell-Based Architecture” → https://www.developers.dev/tech-talk/the-architect-s-playbook-for-cell-based-architecture-from-principles-to-production.html

     - vCluster KubeCon India 2024 recap (vCluster cell implementation) → https://www.vcluster.com/blog/kubecon-india-2024-recap

     The shape keeps getting rediscovered: full-stack isolation, a thin router, waves everywhere. The teams that get it right treat the drain button as the product, not the cell. If you can remove a third of your fleet from traffic in five minutes with zero user-visible errors, the rest of the architecture is details. That is the test I would run first.

News

Cilium 1.12 GA: Cilium Service Mesh and other major new features for enterprise Kubernetes — www.cncf.io

The Cilium Project is excited to announce the general availability of Cilium 1.12.

Exploring Cilium Layer 7 Capabilities Compared to Istio — www.solo.io

Learn about the differences between Layer 7 security in Cilium vs. Layer 7 security in Istio

How to apply GitOps to everything with Crossplane and Flux — www.cncf.io

Diagram as Code — blog.bytebytego.com 6 different ways to turn code into beautiful architecture diagrams

Amazon Prime Day 2022 — aws.amazon.com

SQS 70.5 million messages per second

Kernel Pwning with eBPF: a Love Story We cover the basics of eBPF and the verifier component, which is supposed to make sure the code is safe to run.

Assets

GitHub - awslabs/git-secrets — github.com

Prevents you from committing secrets

GitHub - trufflesecurity/trufflehog — github.com

Find credentials all over the place.

Know. Before it matters — canarytokens.org

Canarytokens is a free tool that helps you discover you’ve been breached by having attackers announce themselves.

AWS Console open source: React components for Cloudscape Design System — github.com

React components for Cloudscape Design System.

Skills

How to design better APIs — r.bluethl.net 15 language-agnostic, actionable tips on REST API design

An Overview of Distributed Caching — learncsdesign.medium.com

CPUs that run your applications have fast, multilevel hardware caches to reduce main memory access times. S

Don't forget to join me every Friday to discuss a Kubernetes book in our BookClub, this week we are discussing Chapter 8 "Policy" from the Hacking Kubernetes book.

Hope you're not melting with this hot summer, stay hydrated.

News

Demystifying the Kubernetes Iceberg: Part 8 | Anton Sankov's Blog — asankov.dev Kubernetes is like an iceberg. You learn the basics, only to see there is a lot more to learn. The more you learn, the more you see there is to know. This series of articles explains all the concepts listed in the "Kubernetes Iceberg" diagram by Flant.

Kubernetes Podcast from Google: Episode 185 - Writing, Learning and Tech, with Ian Miell — kubernetespodcast.com Ian Miell is a partner at consultancy Container Solutions, and an author of books on Bash, Git, Terraform and Docker. He explains to Craig how writing - whether runbooks, blog posts, training courses, or "real" books, can help you learn and make your team more effective.

Operating efficiently at scale. By Brian Armstrong, CEO and Co-founder | by Coinbase | Jul, 2022 | The Coinbase Blog — blog.coinbase.com As companies scale, they usually slow down and become less efficient. It takes more dollars, more people and more time to get anything done. Coordination headwinds increase, vetocracies emerge, risk…

SLSA • General Availability of SLSA 3 Go native builder for GitHub Actions — slsa.dev A couple of months ago, Google and GitHub demonstrated how to generate non-forgeable SLSA 3 provenance for packages/binaries created via GitHub Actions (1, 2). Since then, we’ve been working hard to turn the reference example into a production-ready system for everyone to use. Today, we’re announcing the v1 release of the trusted builders that can be used in GitHub Actions and verification tools.

Optimizing CI/CD Credential Hygiene - A Comparison of CI/CD Solutions - Cider Security Site — www.cidersecurity.io Attackers are always on the lookout to gain access to credentials, which are a critical asset to protect and are widespread throughout the organization.

Use Cases and Tips for Using the BusyBox Docker Official Image - Docker — www.docker.com The BusyBox Docker Official Image can help jumpstart your next Linux development project. Learn about use cases, best practices, and setup, here.

Minimal Container Images: Towards a More Secure Future — blog.chainguard.dev This post walks through the typical approaches in this space — minimal distributions, scratch and “distroless” — finishing with a look at Chainguard’s new, improved version of distroless.

Why Mercedes-Benz runs on 900 Kubernetes clusters | InfoWorld — www.infoworld.com The German automaker runs a massive fleet of Kubernetes clusters to support a wide range of project teams around the world. ‘For us, managing Kubernetes is not that hard.’

Assets

GitHub - infracost/infracost: Cloud cost estimates for Terraform in pull requests💰📉 Love your cloud bill! — github.com Cloud cost estimates for Terraform in pull requests💰📉 Love your cloud bill! - GitHub - infracost/infracost: Cloud cost estimates for Terraform in pull requests💰📉 Love your cloud bill!

Showing how to go from source code to container image using melange+apko — github.com

Demo app duplicated in 5 languages (Go/JavaScript/Python/Ruby/Rust) showing how to go from source code to container image using melange+apko

GitHub - fonoster/fonoster: 🚀 The open-source alternative to Twilio — github.com 🚀 The open-source alternative to Twilio. Contribute to fonoster/fonoster development by creating an account on GitHub.

GitHub - mingrammer/diagrams: Diagram as Code for prototyping cloud system architectures — github.com :art: Diagram as Code for prototyping cloud system architectures - GitHub - mingrammer/diagrams: Diagram as Code for prototyping cloud system architectures

Skills

Living with Kubernetes: 12 Commands to Debug Your Workloads – The New Stack — thenewstack.io Kubernetes can’t fix broken code. But if your container won’t start or the application gets intermittent errors, here’s where you can start.

Fixing the Developer Experience of Kubernetes Port Forwarding – Inlets – The Cloud Native Tunnel — inlets.dev Alex shows you some of the frustrations of using kubectl for port-forwarding and how to fix the developer experience.

How to Deploy Java Microservices on Amazon EKS Using Terraform and Kubernetes | Okta Developer — developer.okta.com Deploy a cloud-native Java microservice stack on Amazon EKS using Terraform and Kubernetes.

News

Scaling Container Technologies at Coinbase with Kubernetes — blog.coinbase.com Tl;dr: Our recent evaluation of Kubernetes underscored its suitability for scaling Coinbase into the future. In the past, a migration to Kubernetes raised concerns due to the operational burden of…

Chainguard Secure Software Supply Chain Images Arrive — thenewstack.io

Chainguard Images, are container base images designed for a secure software supply chain.

How to manage Kubernetes secrets with GitOps? | Akuity — akuity.io How to manage Kubernetes secrets with GitOps? Your guide on selecting a proper method.

Breaking Changes in Argo CD 2.4. — blog.argoproj.io

Argo CD 2.4 includes some awesome improvements and also gave the Argo CD team an opportunity to clean up some tech debt.

PyPI package 'keep' mistakenly included a password stealer — www.bleepingcomputer.com PyPI packages 'keep,' 'pyanxdns,' 'api-res-py' were found to contain a password-stealer and a backdoor due to the presence of malicious 'request' dependency within some versions.

Introducing Envoy Gateway. Today we are thrilled to announce Envoy — blog.envoyproxy.io Today we are thrilled to announce Envoy Gateway, a new member of the Envoy Proxy family aimed at significantly decreasing the barrier to entry when using Envoy for API Gateway (sometimes known as…

Oops, That Almost Happened - Jeli — www.jeli.io

At this point you’ve seen all the reasons why learning from incidents is good for you and your org.

GitHub brings supply chain security features to the Rust community | The GitHub Blog — github.blog The Rust community can now discover, report, and prevent security vulnerabilities.

Introducing Gitsign. Keyless Git commit signing — blog.sigstore.dev

With Gitsign, we aim to bring the best of Sigstore to Git with “keyless” signing and transparency log support 

The Surreal Case of a C.I.A. Hacker’s Revenge | The New Yorker — www.newyorker.com A hot-headed coder is accused of exposing the agency’s hacking arsenal. Did he betray his country because he was pissed off at his colleagues?

Scalable self-hosted runner system for GitHub actions — hectormrejia.medium.com

Hello everyone! This article is intended for organizations that develop on private repositories and the minutes available from GitHub are not enough for their CI/CD needs.

Assets

GitHub - iovisor/bcc: — github.com

BCC - Tools for BPF-based Linux IO analysis, networking, monitoring, and more -

GitHub - kubeshop/testkube: ☸️ — github.com ☸️ Kubernetes-native framework for test definition and execution - GitHub - kubeshop/testkube: ☸️ Kubernetes-native framework for test definition and execution

GitHub - redhat-developer/vscode-didact — github.com

Framework and tools for providing interactive tutorials with active links that call VS Code commandson markdown

WireGuard Transparent Encryption — Cilium 1.11.5 documentation This guide explains how to configure Cilium with transparent encryption of traffic between Cilium-managed endpoints using WireGuard®.

Reproducible Builds — reproducible-builds.org Reproducible builds are a set of software development practices that create an independently-verifiable path from source to binary code.

reprotest · PyPI — pypi.org Build packages and check them for reproducibility.

Skills

How NAT traversal works · Tailscale — tailscale.com In this post, we’ll talk about how to establish a peer-to-peer connection between two machines, in spite of all the obstacles in the way.

How to Troubleshoot Applications on Kubernetes — blog.alexellis.io Learn how to troubleshoot applications on Kubernetes. Because if it's not working, wouldn't it be great if you could find out why and fix it yourself?

How Go Mitigates Supply Chain Attacks - The Go Programming Language — go.dev Go tooling and design help mitigate supply chain attacks at various stages.

Kubernetes Workload Identity with AWS SDK for Go v2 | by Jimmy Ray | Jun, 2022 | Medium — blog.jimmyray.io In the context of Cloud Service Providers (CSP), a Kubernetes workload identity is the concept of pods assuming authenticated principals, to perform operations using CSP services. When using Amazon…

Escaping the Nested Doll with Tailscale — raesene.github.io

I came across a scenario recently (for a workshop in Kubecon) where I needed to access a GUI application deployed in a KinD cluster running in an EC2 instance on AWS, from my laptop.

We resume the Kubernetes BookClub this week, we are reading the Hacking Kubernetes book and will discuss Chapter 3 on June 3rd. If you want to join get an invite here https://www.santana.dev/book-club

News

Letter in Support of Responsible Fintech Policy — concerned.tech Dear Members of Senate Finance Committee...

Chainguard raises $50M Series A for supply chain security – TechCrunch — techcrunch.com Software supply chain startup Chainguard today announced that it has raised a $50 million Series A led by Sequoia.

Announcing the Refreshed Cloud Native Security Whitepaper | Cloud Native Computing Foundation — www.cncf.io The CNCF Security Technical Advisory Group (TAG) has just released a refreshed Cloud Native Security Whitepaper v2 to help educate the community about best…

Graviton 3: First Impressions – Chips and Cheese — chipsandcheese.com

In late May of 2022, AWS released Graviton 3 to the general public. Graviton 3 was the first ARM CPU to introduce the SVE instruction set to a widely accessible server CPU.

KubeCon EU 2022 Summary: Cloud Novices, Golden Paths, and Software Supply Chains | by Daniel Bryant | May, 2022 | Ambassador Labs — blog.getambassador.io Summary of KubeCon EU 2022 in Valencia, with a focus on cloud education, golden paths and platform engineering, and security and software supply chains

Breaking Into Cloud Security - Nick Jones

Cloud security is an area of the industry with some of the biggest skill shortages.

What Made GoLang So Popular? The Language’s Creators Look Back – The New Stack — thenewstack.io

Since the day it was open sourced in 2009, the Go programming language has consistently grown in popularity.

How To Start Programming In Go: Advice For Fellow DevOps Engineers — iximiuz.com "Starting programming", "Starting programming in Go", and "Starting programming Kubernetes controllers in Go" are there different challenges with the exponentially increasing level of complexity.

Introducing DigitalOcean Functions: A powerful serverless computing solution — www.digitalocean.com DigitalOcean is committed to providing products that serve developers throughout their journey, and access to serverless computing has been one of the most popular requests from DigitalOcean users ...

The Open Future : Spotify Engineering — engineering.atspotify.com Spotify’s official technology blog

Kubernetes Annual Report 2021 | Cloud Native Computing Foundation — www.cncf.io This is a summary of the Kubernetes project’s contributor community and activities. This report documents both quantitative measures of community health…

Announcing the First Images Designed for a Secure Software Supply Chain — blog.chainguard.dev We’re building a suite of products with the goal of simplifying security for all developers.

npm security update: Attack campaign using stolen OAuth tokens | The GitHub Blog — github.blog npm's impact analysis of the attack campaign using stolen OAuth tokens and additional findings.

Red Hat Releases Open Source StackRox to the Community — cloud.redhat.com

Today, Red Hat is excited to announce that Red Hat Advanced Cluster Security for Kubernetes (RHACS) is now open sourced as StackRox.

Five Things to Prepare for Cgroup v2 with Kubernetes - Kintone Engineering Blog — blog.kintone.io

By Daichi Sakaue (@yokaze) Above all the effort of the community, Kubernetes is now ready to run with cgroup v2.

Jetstack Helps Turn Security Policies into Actions – The New Stack — thenewstack.io Jetstack, a cloud native security company, has released its Jetstack software supply chain toolkit -- a comprehensive, web-based interactive program for securing software supply chains.

Assets

ttl.sh | An anonymous & ephemeral (and free) Docker image registry An anonymous & ephemeral (and free) Docker image registry.

GitHub - chainguard-dev/ssc-reading-list: A reading list for software supply-chain security. — github.com A reading list for software supply-chain security. - GitHub - chainguard-dev/ssc-reading-list: A reading list for software supply-chain security.

Creates PolicyReports based on the different Trivy Operator CRDs like VulnerabilityReports — github.com Creates PolicyReports based on the different Trivy Operator CRDs like VulnerabilityReports - GitHub - fjogeleit/trivy-operator-polr-adapter: Creates PolicyReports based on the different Trivy Operator CRDs like VulnerabilityReports

GitHub - ContainerSolutions/delayed-jobs-operator — github.com Contribute to ContainerSolutions/delayed-jobs-operator development by creating an account on GitHub.

GitHub - iovisor/bcc: BCC - Tools for BPF-based Linux IO analysis, networking, monitoring, and more — github.com BCC - Tools for BPF-based Linux IO analysis, networking, monitoring, and more - GitHub - iovisor/bcc: BCC - Tools for BPF-based Linux IO analysis, networking, monitoring, and more

Skills

Getting GitOps: A practical platform with OpenShift, Argo CD, and Tekton | Red Hat Developer — developers.redhat.com A practical guide through the jungle of modern development with Kubernetes, with a focus on application distribution via continuous integration/continuous delivery (CI/CD) and GitOps on Red Hat OpenShift.

Introducing native support for OpenTelemetry in Jaeger | by Yuri Shkuro | JaegerTracing | May, 2022 | Medium — medium.com The latest Jaeger v1.35 release introduced the ability to receive OpenTelemetry trace data via the OpenTelemetry Protocol (OTLP), which all OpenTelemetry SDKs are required to support. This is a…

Migrations Done Well: Typical Migration Approaches - The Pragmatic Engineer — blog.pragmaticengineer.com A guide for executing migrations well, at both small and large scales.

Control Group APIs and Delegation Intended audience: hackers working on userspace subsystems that require direct cgroup access, such as container managers and similar.

If you plan to be at KubeConEU at Valencia and see me, don't be a stranger and come say hello and let's take a selfie together. I missed selfies at conferences 😭

News

Kubernetes 1.24: Stargazer | Kubernetes — kubernetes.io

Authors: Kubernetes 1.24 Release Team We are excited to announce the release of Kubernetes 1.24, the first release of 2022! This release consists of 46 enhancements:

A Community Group for Web-interoperable JavaScript runtimes — blog.cloudflare.com Cloudflare is excited to be a part of the launch of the Web-interoperable Runtimes Community Group, a new effort that brings contributors from Cloudflare Workers, Deno, and Node.js together to collaborate on common Web platform API standards.

Argo CD v2.4 release candidate — blog.argoproj.io It has been three months since the v2.3 release. A perfect time for a new release candidate that brings a set of fantastic Argo CD improvements! More than 80 contributors worked hard on building new…

Next-Generation Mutual Authentication with Cilium Service Mesh — isovalent.com Introduction to Mutual Authentication with Cilium & Cilium Service Mesh

The secret gems behind building container images, Enter: BuildKit & Docker Buildx — kubesimplify.com In this post, we discussed various things about Buildkit, its internals, how to interact with BuildKit and its benefits in container image building. Feel fr

Apple, Google and Microsoft Commit to Expanded Support for FIDO Standard to Accelerate Availability of Passwordless Sign-Ins - FIDO Alliance — fidoalliance.org Faster, easier and more secure sign-ins will be available to consumers across leading devices and platforms  Mountain View, California, MAY 5, 2022  – In a joint effort to make the web […]

Kubernetes Gateway API — A successor to existing Kubernetes Ingress! — sanjimoh.medium.com The Ingress resource created a diverse ecosystem of Ingress controllers which were used across hundreds of thousands of clusters in a standardised & consistent way that helped users to adopt…

Logbook - 2022-05-05 · Fly — fly.io What's new at Fly,io

Assets

GitHub - stern/stern: ⎈ Multi pod and container log tailing for Kubernetes — github.com

⎈ Multi pod and container log tailing for Kubernetes

GitHub - Shopify/kubeaudit: kubeaudit helps you audit your Kubernetes clusters against common security controls — github.com kubeaudit helps you audit your Kubernetes clusters against common security controls - GitHub - Shopify/kubeaudit: kubeaudit helps you audit your Kubernetes clusters against common security controls

GitHub - go-gitea/gitea: Git with a cup of tea, painless self-hosted git service — github.com Git with a cup of tea, painless self-hosted git service - GitHub - go-gitea/gitea: Git with a cup of tea, painless self-hosted git service

GitHub - controlplaneio/kubesec: Security risk analysis for Kubernetes resources — github.com Security risk analysis for Kubernetes resources. Contribute to controlplaneio/kubesec development by creating an account on GitHub.

Skills

sigstore, the local way — blog.chainguard.dev

If you've been following the Chainguard blog, you might ask yourself: how do I run the open-source sigstore stack on my machine?

Automatic SBOMs with ko — blog.chainguard.dev

For those unfamiliar with ko, it “is a simple, fast container image builder for Go applications;” its objective is to enable developers to stop worrying about containers and focus on their application. 

I will be leading up Release Notes v1.25 and we are still accepting shadow applications until May 6th.

This newsletter edition is heavier on assets than news since I suspect a lot of projects and companies are holding their announcements for KubeConEU the week of May 16th.

If you are using Knative in your company I'm conducting user interviews for the User Experience Working Group, please reach out by volunteering your time for a short and simple interview.

News

Chainguard Enforce: Software Supply Chain Security for K8s – The New Stack — thenewstack.io

Zero-trust security company Chainguard has shipped the beta release of Chainguard Enforce, its first product

Kubernetes Release Shadow Program Twitter Space — twitter.com

Listen to the recording of the Twitter Space with members of the Kubernetes Release Team v1.25 https://twitter.com/i/spaces/1dRKZleNdzVJB

New GraalVM 22.1: Developer experience improvements, Apple Silicon builds, and more — medium.com

Today we’re releasing GraalVM 22.1! This release brings new features and lots of improvements —

Addressing latency and data transfer costs on EKS using Istio — aws.amazon.com

Data transfer charges are often overlooked when operating Amazon Elastic Kubernetes Service (Amazon EKS) clusters; understanding these charges would help reduce cost

Installing an Apache Kafka cluster on Kubernetes using Strimzi and GitOps – Civo.com — www.civo.com Strimzi is a Kubernetes operator which acts as a dedicated SRE for running Apache Kafka on Kubernetes

servicemesh.es | Service Mesh Comparison — servicemesh.es Service Mesh Feature Comparison — including Istio, Linkerd 2, AWS App Mesh, Consul, Maesh, Kuma, Open Service Mesh (OSM)

Exploring container security: Vulnerability management in open-source Kubernetes — cloud.google.com The Kubernetes Privacy Security Committee follows these steps when a vulnerability is reported.

Prevent Kubernetes misconfigurations during development with this open source tool — opensource.com Explore how the principles behind open source--collaboration, transparency, and rapid prototyping--are proven catalysts for innovation.

Assets

GitHub - The Kubernetes Security Profiles Operator — github.com The Kubernetes Security Profiles Operator. Contribute to kubernetes-sigs/security-profiles-operator development by creating an account on GitHub.

GitHub - SocketCAN Kubernetes device plugin — github.com SocketCAN Kubernetes device plugin. Contribute to collabora/k8s-socketcan development by creating an account on GitHub.

GitHub - Collection of gadgets for debugging and introspecting Kubernetes applications using BPF — github.com Collection of gadgets for debugging and introspecting Kubernetes applications using BPF - GitHub - kinvolk/inspektor-gadget: Collection of gadgets for debugging and introspecting Kubernetes applications using BPF

GitHub - OCI hook to trace syscalls and generate a seccomp profile — github.com OCI hook to trace syscalls and generate a seccomp profile - GitHub - containers/oci-seccomp-bpf-hook: OCI hook to trace syscalls and generate a seccomp profile

GitHub - Kernels for testing ebpf — github.com Kernels for testing tracee CO-RE feature. Contribute to aquasecurity/tracee-test-kernels development by creating an account on GitHub.

Skills

Self-Care is Not the Solution for Burnout — The Beautiful Truth — thebeautifultruth.org Psychologist Justin D. Henderson makes the case that we need to address the systemic and cultural dimensions of burnout.

TAG Observability Whitepaper — github.com

This paper aims to get you quickly started with different kinds of observability you might need to work within the cloud-native world.

CKAD Scenarios Kubectl-Contexts | Pod-Resources | ConfigMap Access — wuestkamp.medium.com In the CKAD exam you need to breath kubectl. Kubectl is a client for the Kubernetes Apiserver and allows you to perform all kinds of operations. A kubectl context contains connection information to a…

You Don't Need an Image To Run a Container — iximiuz.com How to run container without an image? Why do you need container images? What problems container images solve?

It is only Monday, and there is so much going on already.

News

Don’t Panic: A Playbook for Handling Account Compromise with Sigstore — blog.sigstore.dev

Despite your best efforts, you may no longer trust artifacts, keys, or identities when signing software.

OSS Capital Announcement: $200M For An Open Future - COSS Community — www.coss.community Today, OSS Capital is thrilled to publicly announce our first and second funds with $200M dedicated... Tagged with coss, funding, vc, opencore.

Istio has applied to become a CNCF project

The Istio project is pleased to announce its intention to join the Cloud Native Computing Foundation (CNCF). 

Welcome to IstioCon 2022! — events.istio.io

IstioCon is the community conference for the industry’s most popular service mesh.

How to Model Your Gitops Environments and Promote Releases between Them — codefresh.io Learn how to model your GitOps environments using different folders on the same Git branch, and how to handle environment promotion.

Time to patch nginx-ingress controllers to fix 2 recent critical CVEs, CVE-2021-25745 and CVE-2021-2576 they allow any user with ingress permissions to access the service account secret token of the main shared controller.

Chainguard Whitepaper All About That Bade Image

Resources to build Kubernetes Operators Resources to build Kubernetes Operators

'Restricting cluster-admin Permissions' by Marcus Noble — marcusnoble.co.uk

Generally, and by default, operators of the cluster are assigned to the cluster-admin ClusterRole.

eBPF for Service Mesh? Yes, but Envoy Proxy is here to stay - Solo — www.solo.io Our goal here at Solo.io is to bring valuable solutions to our customers around application networking and service connectivity. Back in October, we announced our plans to enhance our enterprise […]

Webamp · Winamp 2 in your browser — webamp.org Winamp 2.9 reimplemented in HTML5 and JavaScript

American Phone-Tracking Firm Demo’d Surveillance Powers by Spying on CIA and NSA — theintercept.com Anomaly Six, a secretive government contractor, claims to monitor the movements of billions of phones around the world and unmask spies with the press of a button.

Removing the stigma of a CVE | The GitHub Blog — github.blog Do you worry that a CVE will hurt the reputation of your project? In reality, CVEs are a tracking number, and nothing more. Here's how we think of them at GitHub.

Assets

GitHub - kubernetes-sigs/scheduler-plugins: Repository for out-of-tree scheduler plugins based on scheduler framework. — github.com Repository for out-of-tree scheduler plugins based on scheduler framework. - GitHub - kubernetes-sigs/scheduler-plugins: Repository for out-of-tree scheduler plugins based on scheduler framework.

GitHub - backube/volsync: Asynchronous data replication for Kubernetes volumes — github.com Asynchronous data replication for Kubernetes volumes - GitHub - backube/volsync: Asynchronous data replication for Kubernetes volumes

twitter/the-algorithm · GitHub — github.com

Future home of twitter algorithm

Skills

Building functions with Knative and Tekton - DEV Community Knative was recently accepted as a CNCF incubation project and there are so many exciting things... Tagged with knative, functions, tekton, faas.

How to Bring your own Scheduler into OpenShift with the Secondary Scheduler Operator — cloud.redhat.com The Kubernetes scheduler is an enterprise grade stable component in Kubernetes that decides where to place the incoming pods by a two step operation of filtering and scoring.

Best Practices for Multi-tenancy in Argo CD | by Dan Garfield | Argo Project — blog.argoproj.io This blogpost is co-authored by Dan Garfield and Jesse Suen. Special thanks to Alexander Matyushentsev, Jann Fischer, Henrik Blixt, and the amazing community for all their hard work in making Argo CD…

Some news around Kubernetes, The Release team 1.24 is working very hard to get a quality build out the door, but due to a bug in golang the final 1.24 release date was moved to May 3rd ⏲

I'm the new release notes lead for 1.25 and the shadow application is open for people to apply. 🚀

News

The Principle of Ephemerality — blog.chainguard.dev TL;DR: Everything that can be ephemeral, should be ephemeral.

What's New in Talos 1.0 | Talos Linux List of new and shiny features in Talos Linux.

3 CloudOps Companies That Want You To Destroy Kubernetes in Prod | by Molly Sheets | Apr, 2022 | Medium — medium.com In the last month, I investigated the portfolios of newer companies in devops and liveops because I had a hunch something interesting was happening in the world of reliability — is chaos engineering…

Kubernetes Removals and Deprecations In 1.24 | Kubernetes — kubernetes.io

Cloud Native Is The New Architecture Mantra For Core Banking Solutions — vedcraft.com Cloud Native technologies are in mainstream adoption and Cloud native is the new architecture mantra for core banking solutions. Read more.

Achieving SLSA 3 Compliance with GitHub Actions and Sigstore for Go modules | The GitHub Blog — github.blog Learn how to build packages with SLSA 3 provenance using GitHub Actions.

Measuring Argo Workflow Costs with Kubecost - Learn how you can use Argo and Kubecost together to optimize your Kubernetes workflows and gain insights and visibility into your cloud costs.

Security alert: Attack campaign involving stolen OAuth user tokens issued to two third-party integrators — github.blog

On April 12, GitHub Security began an investigation that uncovered evidence that an attacker abused stolen OAuth user tokens issued to two third-party OAuth integrators, Heroku and Travis-CI

Scaling containers on AWS in 2022 :: Vlad Ionescu — www.vladionescu.me Comparing how fast containers scale up in 2022 using different orchestrators on AWS

My adventure with Helm as GitOps in a distributed architecture | by Axel Gendillard | Feb, 2022 | Medium — medium.com The “DevOps” community has brought me useful knowledge since I started my career. Now it’s my turn to give back to the community. I would like to share some of my experience about Helm configuration…

An update to Raspberry Pi OS Bullseye - Raspberry Pi — www.raspberrypi.com Over the years, we have gradually ramped up the security of Raspberry Pi OS. Here's Simon Long to tell you what has changed.

Announcing Docker SBOM: A step towards more visibility into Docker images - Docker Learn from Docker experts to simplify and advance your app development and management with Docker. Stay up to date on Docker events and new version announcements!

Argo CD Best Practices | Container Hub — medium.com Discover key best practices for Argo CD that allow you to leverage GitOps easily within your deployment workflow.

The differences between Docker, containerd, CRI-O and runc - Tutorial Works — www.tutorialworks.com Let’s answer the question of Docker vs CRI-O, and other common questions about different container runtimes.

9 reasons you have technical debt and how to reduce it | The Enterprisers Project — enterprisersproject.com Don’t let technical debt hinder your organization’s digital transformation. Here are nine leading causes and a four-step strategy to overcome technical debt

Google Online Security Blog: Improving software supply chain security with tamper-proof builds — security.googleblog.com Posted by Asra Ali and Laurent Simon, Google Open Source Security Team (GOSST) Many of the recent high-profile software attacks that have al...

Announcing AWS Lambda Function URLs: Built-in HTTPS Endpoints for Single-Function Microservices — aws.amazon.com

Assets

Using Fio to Tell Whether Your Storage is Fast Enough for Etcd | IBM — www.ibm.com The short story: fio and etcd

GitHub - kris-nova/kaar — github.com Kubernetes Application Archive. Contribute to kris-nova/kaar development by creating an account on GitHub.

Build smaller, faster, and more secure desktop applications with a web frontend | Tauri Studio — tauri.studio Tauri is a framework for building tiny, blazing fast binaries for all major desktop platforms. Developers can integrate any front-end framework that compiles to HTML, JS and CSS for building their user interface.

GitHub - disneystreaming/ssm-helpers — github.com Help manage AWS systems manager with helpers. Contribute to disneystreaming/ssm-helpers development by creating an account on GitHub.

GitHub - patrickdappollonio/tabloid — github.com tabloid is a simple command line tool to parse and filter column-based CLI outputs from commands like kubectl or docker - GitHub - patrickdappollonio/tabloid: tabloid is a simple command line tool to parse and filter column-based CLI outputs from commands like kubectl or docker

Functional Web App (FWA) The Functional Web App (FWA) is an architectural pattern for building dynamic web applications and APIs.

GitHub - CaravanaCloud/task-tree — github.com Automating maintenance and troubleshooting tasks for Cloud Computing - GitHub - CaravanaCloud/task-tree: Automating maintenance and troubleshooting tasks for Cloud Computing

Skills

Kubernetes events | Kube Events — kube.events Curated meetups, conferences, training and webinars on Kubernetes

Automate CI/CD on pull requests with Argo CD ApplicationSets | Red Hat Developer — developers.redhat.com Use Argo CD's ApplicationSets and pull request generator with Tekton and Red Hat OpenShift tools to bring GitOps workflows into your CI/CD processes.

New Kube blog site — kubesimplify.com On a mission to teach cloud native to everyone.

Securing Grafana with Keycloak SSO — medium.com In this story i will show how to deploy and configure Keycloak in a local Kubernetes cluster, then deploy Grafana and use the Keycloak instance for authentication and authorization. I already wrote…

Load balancing and scaling long-lived connections in Kubernetes — learnk8s.io Kubernetes doesn't load balance long-lived connections and some Pods might receive more requests than others. Learn how to fix that.

Deploy a coloring page generator in minutes with Cloud Run In this post, you'll see how to create an image processing service and make it available online using minimal resources.

HowTo: Make a Reviewing Guide | CNCF Contributors

Modeling & Analyzing Lambda vs. Fargate Breakeven — Nuvalence — nuvalence.io

Hardening Kubernetes Multi-Cluster Environments - Container Journal — containerjournal.com Increased visibility into all Kubernetes platforms and tighter RBAC is necessary to keep cloud-native architecture safe and secure.

If you are a new person to open source and want to participate in Google Summer of Code (GSOC) this year with one of the CNCF projects, including Kubernetes, Knative, and many others, I hosted a Twitter Space you can listen to the recording.

PS: If you plan to attend KubeCon and KnativeCon, I'm giving two talks. Please don't be shy, say hi, and take a selfie with me 🤗

News

Virtual Kubernetes clusters: A new model for multitenancy | Opensource.com — opensource.com Try vcluster, an open source implementation that tackles certain aspects of typical namespace- and cluster-based isolation models.

Amazon EKS now supports Kubernetes 1.22 | Amazon Web Services — aws.amazon.com

Amazon EKS, Amazon EKS Distro, and Amazon EKS Anywhere can now run Kubernetes version 1.22.

Spring4Shell: The zero-day RCE in the Spring Framework explained | Snyk — snyk.io Security resources like Lunasec, Rapid7 and Praetorian confirmed that the vulnerability is real, and in the meantime Spring has already released a new version

Announcing Grafana Mimir, the most scalable open source TSDB in the world | Grafana Labs — grafana.com Our new open source project allows you to scale to 1 billion metrics and beyond.

How Go Mitigates Supply Chain Attacks - The Go Programming Language Go is an open source programming language that makes it easy to build simple, reliable, and efficient software.

Is Platform Engineering the New DevOps or SRE? | by Daniel Bryant | Mar, 2022 | Ambassador Labs — blog.getambassador.io Almost every day we hear about another organization building an internal developer platform or developer control plane. We’re not alone in observing this trend in platform engineering; when Humanitec…

Migrate from PodSecurityPolicy to PodSecurity Admission Controller (Updated) — kubernetes.io

This page describes the process of migrating from PodSecurityPolicies to the built-in PodSecurity admission controller.

Trivy new SBOM subcommand

Comprehensive Vulnerability Scanner Trivy currently supports SBOM formats.

Kubernetes-in-Kubernetes and the WEDOS PXE bootable server farm | Kubernetes — kubernetes.io

Author: Andrei Kvapil (WEDOS) When you own two data centers, thousands of physical servers, virtual machines and hosting for hundreds of thousands sites, Kubernetes can actually simplify the management of all these things.

Generics can make your Go code slower — planetscale.com Go 1.18 is here, and with it, the first release of the long-awaited implementation of Generics is finally ready for production usage. Generics are a frequently requested feature that has been highly contentious throughout the Go community.

Is Your Cluster Ready for v1.24? | Kubernetes — kubernetes.io

Author: Kat Cosgrove Way back in December of 2020, Kubernetes announced the deprecation of Dockershim.

Announcing Postgres Container Apps: Easy Deploy Postgres Apps With Postgres Container Apps you can, from directly inside Postgres with a simple function call, spin up a container that is running right alongside your Postgres database!

Assets

Console Do Not Track (DNT)

This is a proposal for a single, standard environment variable that plainly and unambiguously expresses LACK OF CONSENT by a user of that software to any of the following:

Kubernetes scheduler written in less than 100 lines of bash — github.com Kubernetes scheduler written in less than 100 lines of bash :grimacing: :laughing: - GitHub - rothgar/bashScheduler: Kubernetes scheduler written in less than 100 lines of bash

A Kubectl plugin that can detect if any of your workloads or manifest files are mounting the docker.sock volume — github.com

A Kubectl plugin that can detect if any of your workloads or manifest files are mounting the docker.sock

Validate your Kubernetes configuration files, supports multiple Kubernetes versions — github.com Validate your Kubernetes configuration files, supports multiple Kubernetes versions - GitHub - instrumenta/kubeval: Validate your Kubernetes configuration files, supports multiple Kubernetes versions

A FAST Kubernetes manifests validator, with support for Custom Resources! — github.com A FAST Kubernetes manifests validator, with support for Custom Resources! - GitHub - yannh/kubeconform: A FAST Kubernetes manifests validator, with support for Custom Resources!

Skills

Technical FAQ on the Digital Markets Act | Matrix.org — matrix.org We've been flooded with questions about the DMA since it was announced last week, and have spotted some of the gatekeepers jumping to the wrong conclusions about what it might entail. Just in case you don't want to wade through yesterday's sprawling blog post, we've put together a quick FAQ to cover the most important points based on our understanding.

Parca from Binary | Parca

Parca is a continuous profiling project for applications and infrastructure. It helps you save money, improve performance and understand incidents better.

Finding an intro to maths for cryptography | by Liz Rice | Medium — medium.com If you’re looking for an introduction to the mathematics that make cryptography work, perhaps this list might help. I’m currently writing a book about Container Security for O’Reilly Media, and one…

I hope the war ends soon; writing this phrase is surreal.

Talking about surreal, this is how actors felt at the Oscars this Sunday.

News

GoReleaser And Software Supply Chain Security | by developer-guy | Mar, 2022 | GoReleaser — blog.goreleaser.com Before talking about the security of the software supply chains, we should mention what should come to our minds first when we are talking about software supply chains. In most basic terms, you can…

Introducing Caddy-SSH

Pure-Go, general-purpose SSH server

Favoring Podman over Docker Desktop | by Peter Butkovic | Mar, 2022 | Medium — medium.com Since the announcement, that docker desktop won’t be available for free for the bigger organizations, I’ve been looking for the open source alternative with smooth migration option. Podman did a…

Get the Best of Both Worlds With the KKP 2.19 CNI Strategy — www.kubermatic.com Find out how you can expect greater control and flexibility by selecting a CNI plugin with KKP 2.19.

The shortcomings of rootless containers | Opensource.com — opensource.com Explore how the principles behind open source--collaboration, transparency, and rapid prototyping--are proven catalysts for innovation.

Understanding root inside and outside a container — www.redhat.com Do you run your containers as root, or as a regular user? It’s such a deceptively simple question. You might be tempted to answer too quickly. Is the threat model really crystal clear in your mind? I have a suspicion that it might not be.

Privilege Escalation in gVisor, Google's Container Sandbox tl;dr gVisor is Google’s sandboxing technology for containers running less-than-fully-trusted code. It’s a Golang reimplementation of the Linux kernel that r...

containerd CRI plugin: Insecure handling of image volumes · Advisory · containerd/containerd · GitHub — github.com GitHub is where people build software. More than 73 million people use GitHub to discover, fork, and contribute to over 200 million projects.

Assets

GitHub - box/kube-exec-controller: — github.com

An admission controller service and kubectl plugin to handle container drift in K8s clusters -

GitHub - genuinetools/bane: Custom & better AppArmor profile generator for Docker containers. — github.com Custom & better AppArmor profile generator for Docker containers. - GitHub - genuinetools/bane: Custom & better AppArmor profile generator for Docker containers.

GitHub - lizrice/running-with-scissors: Resources from my KubeCon + CloudNativeCon keynote — github.com Resources from my KubeCon + CloudNativeCon keynote - GitHub - lizrice/running-with-scissors: Resources from my KubeCon + CloudNativeCon keynote

Rootless Containers | Rootless Containers Rootless Containers

Running Kubernetes Node Components as a Non-root User | Kubernetes — kubernetes.io

FEATURE STATE: Kubernetes v1.22 [alpha] This document describes how to run Kubernetes Node components such as kubelet, CRI, OCI, and CNI without root privileges, by using a user namespace.

Deprecated API Migration Guide | Kubernetes — kubernetes.io

As the Kubernetes API evolves, APIs are periodically reorganized or upgraded. in v1.

Introduction - EKS Best Practices Guides

Welcome to the EKS Best Practices Guides.

Skills

Hacking Your Product Leader Career | by Gibson Biddle | Medium — gibsonbiddle.medium.com A few years ago, I watched an Olympic gymnast deliver a speech, “How to Score a Perfect Ten.” He gave his talk while doing his pommel horse routine! He vaulted onto the horse, did a series of moves…

gVisor Performance Guide

gVisor is designed to provide a secure, virtualized environment while preserving key benefits of containerization, such as small fixed overheads and a dynamic resource footprint.

Your visual how-to guide for SELinux policy enforcement | Opensource.com — opensource.com Explore how the principles behind open source--collaboration, transparency, and rapid prototyping--are proven catalysts for innovation.

GitHub - genuinetools/contained.af — github.com A stupid game for learning about containers, capabilities, and syscalls. - GitHub - genuinetools/contained.af: A stupid game for learning about containers, capabilities, and syscalls.

I'm helping plan KnativeCon and the Kubernetes Contributor Summit for KubeCon EU, I hope to be in Spain during May to finally meet some of my Cloud Native peeps in person.

News

Kubernetes container runtime CRI-O has make-me-root flaw • The Register — www.theregister.com Cr8escape priv-escalation bug opens the door to cluster takeovers

sigstore, the local way — blog.chainguard.dev If you've been following the Chainguard blog, you might ask yourself: how do I run the open-source sigstore stack on my machine? While sigstore is often deployed using Kubernetes, it is flexible enough to run nearly anywhere: from a Raspberry Pi to an IBM mainframe. This article will demonstrate how

Senate votes to make daylight saving time permanent — news.yahoo.com The Senate approved legislation Tuesday that would make daylight saving time permanent in the U.S. starting next year.

Guillaume's Security Notebook In this article, we will explore and test Defender for Containers against a vulnerable environment and see what it can detects or prevent and how we can leverage it to make our Kubernetes workloads safer.

Explore client-go Informer Patterns | by Stefanie Lai | CodeX | Feb, 2022 | Medium — medium.com In platform development, our cluster runs operators involving multiple teams and various GCP resources, for querying which we often need to write various code including but not limited to bash…

Open sourcing the Kubernetes security audit | Cloud Native Computing Foundation — www.cncf.io Last year, the Cloud Native Computing Foundation (CNCF) began the process of performing and open sourcing third-party security audits for its projects in order…

Want a better DevOps career? Learn the business | GitLab — about.gitlab.com A better DevOps career starts with a thorough understanding of business. Here's how to get started.

Go 1.18 Release Notes - The Go Programming Language Go is an open source programming language that makes it easy to build simple, reliable, and efficient software.

SLSA vs. Software Supply Chain Attacks — blog.chainguard.dev Past Attacks and How SLSA Helps

The future of Kubernetes – and why developers should look beyond Kubernetes in 2022 Kubernetes is ubiquitous in container orchestration, and its popularity has yet to weaken. This does, however, not mean that evolution in the container orchestration space is at a stand-still.

Backstage project joins the CNCF Incubator | Cloud Native Computing Foundation — www.cncf.io The CNCF Technical Oversight Committee (TOC) has voted to accept Backstage as a CNCF incubating project. Backstage is an open platform for building developer…

Introduction to Taskfile: a Makefile alternative - DEV Community — dev.to Easier and simpler than Makefile. Tagged with automation, make, productivity.

Google Docs update lets you draft emails and send them to Gmail with a click - The Verge — www.theverge.com Google is rolling out a new feature in its Docs that’s designed to make it easier to draft emails. It’s accessible via the @ menu in Google Docs.

The biggest data breach fines, penalties, and settlements so far | CSO Online — www.csoonline.com Hacks and data thefts, enabled by weak security, cover-ups or avoidable mistakes have cost these companies a total of nearly $1.3 billion and counting.

LINUF FOUNDATION

STATEMENT AGAINST TEXAS DISCRIMINATION

Secure your software supply chain using Sigstore and GitHub actions - Marco Franssen

With the rise of software supply chain attacks it becomes more important to secure our software supply chains.

Tim Seagren on LinkedIn: #sops #git #sigstore | 11 comments — www.linkedin.com In the past 48 hours, the DoD Platform One Ironbank Pipelines and Operations (POPs) team has made two huge strides forward in the areas of day-to-day operations... 11 comments on LinkedIn

OpenSSL Security Advisory [15 March 2022]

Infinite loop in BN_mod_sqrt() reachable when parsing certificates (CVE-2022-0778)

CDK Day 2022: Call for Speakers/Papers @ Sessionize.com — sessionize.com A Cloud Development Kit (CDK) is a developer tool built on the open source Constructs model. We now have multiple CDKs in AWS CDK, CDK for Terraform, ...

Assets

GitHub - madhuakula/kubernetes-goat: Kubernetes Goat 🐐 is a "Vulnerable by Design" — github.com

Kubernetes Goat 🐐 is a "Vulnerable by Design" Kubernetes Cluster. Designed to be an intentionally vulnerable cluster environment to learn and practice Kubernetes security 🔐security 🔐

GitHub - kubearmor/KubeArmor: Cloud-native Runtime Security Enforcement System — github.com Cloud-native Runtime Security Enforcement System. Contribute to kubearmor/KubeArmor development by creating an account on GitHub.

GitHub - magnologan/cncf-security-audits: List of all previous CNCF Project's Security Audit Reports — github.com List of all previous CNCF Project's Security Audit Reports - GitHub - magnologan/cncf-security-audits: List of all previous CNCF Project's Security Audit Reports

Releases · go-task/task · GitHub — github.com A task runner / simpler Make alternative written in Go - Releases · go-task/task

Skills

Introducing apko & melange

Research - Linux Foundation — www.linuxfoundation.org Expert guidance to manage open technology projects and put you on the path to success

Stripe: Equity for employees — stripe.com Understand the mechanics, decisions, and trade-offs related to issuing equity to employees

Success Story: Cloud Engineer Bootcamp Enables a Music Teacher to Become a DevOps Engineer - Linux Foundation - Training — training.linuxfoundation.org Michael Rossiter was a long time Linux enthusiast working as a music teacher in the north of England. He had dreamed of a role working in IT, but wasn’t sure...

Learning Go by examples: part 2 - Create an HTTP REST API Server in Go - DEV Community — dev.to Serie of article in order to learn Golang language by concrete applications as example. Tagged with go, beginners, api, tutorial.

This week I will be hosting the Kubernetes Office Hours again, this time will be learning about SIG-Docs

News

Cloud Native Computing Foundation Unveils Schedule for KubeCon + CloudNativeCon Europe 2022 | Cloud Native Computing Foundation — www.cncf.io Back in-person in Valencia, Spain in May, technology enthusiasts will meet to share and educate around cloud native innovation SAN FRANCISCO, Calif. – March 9…

Red Hat co-founded project Knative accepted as CNCF incubating project — www.redhat.com

This begins a new chapter in the evolution of a leading containerized serverless platform.

Release v0.12.0 · kubernetes-sigs/kind — github.com Kubernetes IN Docker - local clusters for testing Kubernetes - Release v0.12.0 · kubernetes-sigs/kind

Google to Acquire Mandiant | Mandiant — www.mandiant.com Your description for this link...

Software Supply Chain Security: Tearing Down the Silos – The New Stack — thenewstack.io Both application and infrastructure security are required to keep a cloud native system safe. A single solution can integrate both to foil hackers.

Visualising the Cost of Kubernetes | by Mitchell Rowling | Streamotion Tech Blog | Mar, 2022 | Medium — medium.com Containerisation is still an emerging technology in many organisations across the world and Here at Streamotion, the adoption of containers has promoted rapid acceleration of our journey of Kayo…

The future of Kubernetes – and why developers should look beyond Kubernetes in 2022 Kubernetes is ubiquitous in container orchestration, and its popularity has yet to weaken. This does, however, not mean that evolution in the container orchestration space is at a stand-still.

Dirty Pipe Linux Vulnerability: Overwriting Files in Container Images CVE-2022-0847 Dirty Pipe in the Linux kernel allows users on Linux hosts running containerized applications to modify files in container images on the host

Assets

GitHub - cert-manager/istio-csr: istio-csr is an agent that allows for Istio workload and control plane components to be secured using cert-manager. — github.com istio-csr is an agent that allows for Istio workload and control plane components to be secured using cert-manager. - GitHub - cert-manager/istio-csr: istio-csr is an agent that allows for Istio workload and control plane components to be secured using cert-manager.

Cloud Managed Redpanda | A Kafka alternative — redpanda.com Choose a fully managed solution or bring your own cloud. Pay only for what you use. Infinite data retention. Global read replicas.

tmate • Instant terminal sharing Your description for this link...

Kubernetes Workload Identity with AKS – baeke.info — blog.baeke.info When you run a workload, no matter how simple or complex, you often need to access protected resources in both a secure and manageable way. Often, a resource's security is integrated with an identity store. Azure resources, for instance, can be secured with roles assigned to Azure Active Directory (AAD) users, groups, or service principals.…

Skills

Join the Monthly Kubernetes Office Hours this Wednesday, March 16th, with hosts @csantanapr and @rawkode

This month is SIG-Docs edition with guest @Divya_Mohan02

See Cloud Native Live: Optimizing Istio with eBPF at CNCF CNCF Online Programs — community.cncf.io CNCF CNCF Online Programs presents Cloud Native Live: Optimizing Istio with eBPF | Mar 16, 2022. Find event and ticket information.

Principles & Best practices of REST API Design | by Love Sharma | Dev Genius — blog.devgenius.io This best-practices article intends for developers interested in creating RESTful Web services that provide high reliability and consistency across multiple service suites; following these…

If you wonder how can you help with the conflict in Ukraine there are many organizations you can donate to, and also encourage your employer to donate to help the large number of refugees.

News

Knative accepted as a CNCF incubating project | Cloud Native Computing Foundation — www.cncf.io The CNCF Technical Oversight Committee (TOC) has voted to accept Knative as a CNCF incubating project. Knative is an open source, Kubernetes-based platform for…

Liz Rice on Programming the Linux Kernel with eBPF, Cilium and Service Meshes — www.infoq.com Charles Humble discusses eBPF, a way of making the Linux kernel programmable, with Liz Rice.

Using Machine Learning to Actively Secure Cloud Native Apps – The New Stack — thenewstack.io It's not enough to simply ward off threats. Tigera's Calico Cloud now uses machine learning to actively find and mitigate vulnerabilities.

Introducing apko: bringing distroless nirvana to Alpine Linux — blog.chainguard.dev

Earlier today, Chainguard released version 0.1 of our apko tool. This tool allows for the composition of so-called “distroless” images from APK-based software distributions, such as Alpine Linux, using a declarative configuration. 

Acquisitions Are Good for the Developer Ecosystem – The New Stack — thenewstack.io A look at Mirantis' acquisition of Docker Enterprise and Lens, and the benefits to the developer and Kubernetes ecosystem that it's created in the past two years.

buildkit-machine: A brand new project to enable building/pushing container images without requiring a Docker Daemon based on BuildKit | by developer-guy | Mar, 2022 | Medium — batuhan-apaydin-11378.medium.com In the previous blog post, we talked about a brand new toolkit (lima + nerdctl + rancher-desktop) that we can use to work with container images, and in that blog post, we mentioned the…

Podman v4.0.0 Released

Podman v4.0.0, a brand-new major release, is now available. Podman 4.0 is one of our most significant releases ever, featuring over 60 new features.

ArgoCD v2.3.0 Released — github.com Declarative continuous deployment for Kubernetes. Contribute to argoproj/argo-cd development by creating an account on GitHub.

Exploring eBPF – Part 3: Getting Started with Hubble — nicovibert.com Welcome to the third post in my eBPF series: in my first post, I introduced eBPF and walked through how to use a sample code, in the second post, I talked about Cilium, an eBPF-based networking plugin for Kubernetes. In this third post, we're going to jump straight from the previous post and leverage Cilium's…

Suborbital Launching Sat Beta-1: Still tiny, still mighty — blog.suborbital.dev Today we're happy to announce that our open source WebAssembly edge compute server Sat is now in beta! We've spent the past few months testing, refining, and simplifying it to enable some essential cloud computing use-cases. Best of all, the original...

Build your perfect Google Cloud infrastructure using Terraform and the gcloud CLI — cloud.google.com Learn more about how declarative export allows you to export the current state of your infrastructure into a descriptive file compatible with Terraform.

Year of the Tiger: $110 million to build the future of data for developers worldwide — www.timescale.com Timescale just raised $110 million in our Series C, led by Tiger Global alongside all existing investors: Benchmark, New Enterprise Associates, Redpoint Ventures, Icon Ventures, and Two Sigma Ventures.

Assets

Debuggging with tmate · Actions · GitHub Marketplace · GitHub — github.com Debug your GitHub Actions Environment

Killercoda Interactive Environments — killercoda.com Interactive E-learning CKS Kubernetes Security

GitHub - aquasecurity/tfsec: Security scanner for your Terraform code — github.com Security scanner for your Terraform code. Contribute to aquasecurity/tfsec development by creating an account on GitHub.

GitHub - Seagate/cortx: CORTX Community Object Storage is 100% open source object storage uniquely optimized for mass capacity storage devices. — github.com CORTX Community Object Storage is 100% open source object storage uniquely optimized for mass capacity storage devices. - GitHub - Seagate/cortx: CORTX Community Object Storage is 100% open source object storage uniquely optimized for mass capacity storage devices.

GitHub - lightrun-platform/koolkits: 🧰 Opinionated, language-specific, batteries-included debug container images for Kubernetes. — github.com 🧰 Opinionated, language-specific, batteries-included debug container images for Kubernetes. - GitHub - lightrun-platform/koolkits: 🧰 Opinionated, language-specific, batteries-included debug container images for Kubernetes.

DNS for Families with Cloudflare 1.1.1.1

Use 1.1.1.2 Use the following DNS resolvers to block malicious content. And 1.1.1.3 to block malware and adult content

GitHub - lowlighter/metrics: 📊 An infographics generator with 30+ plugins and 200+ options to display stats about your GitHub account and render them as SVG, Markdown, PDF or JSON! — github.com 📊 An infographics generator with 30+ plugins and 200+ options to display stats about your GitHub account and render them as SVG, Markdown, PDF or JSON! - GitHub - lowlighter/metrics: 📊 An infographics generator with 30+ plugins and 200+ options to display stats about your GitHub account and render them as SVG, Markdown, PDF or JSON!

GitHub - hashicorp/terraform-cdk: Define infrastructure resources using programming constructs and provision them using HashiCorp Terraform — github.com Define infrastructure resources using programming constructs and provision them using HashiCorp Terraform - GitHub - hashicorp/terraform-cdk: Define infrastructure resources using programming constructs and provision them using HashiCorp Terraform

GitHub - tsenart/vegeta: HTTP load testing tool and library. It's over 9000! — github.com HTTP load testing tool and library. It's over 9000! - GitHub - tsenart/vegeta: HTTP load testing tool and library. It's over 9000!

Skills

What is a Kubernetes Ephemeral Container? | DevOps Learners — devopslearners.com An ephemeral container is a concept of adding a container in an exiting pod for debugging purposes. You can also debug a pod in CrashLoopBackOff state.

Carvel kbld With Helm Post Render - Live and let Learn — liveandletlearn.net

For the past couple of years I’ve been working on the Kubeapps project, which until recently has been a UI dashboard for the Helm project - providing a simple, web-based UI to deploy applications on Kubernetes.

Display Linux Distribution Logo in ASCII Art in Terminal - It's FOSS — itsfoss.com Wondering how they display Linux logo in terminal? With these tools, you can display logo of your Linux distribution in ASCII art in the Linux terminal.

Saving on Amazon CloudWatch Logs costs - DEV Community — dev.to Amazon CloudWatch Logs costs can get out of hand quickly. Here is the remedy. Tagged with aws, serverless, typescript, observability.

6 steps for migrating a PostgreSQL database between containers | Enable Sysadmin — www.redhat.com Upgrading your container-based database? Keep the process straightforward using these steps.

Linux commands I use as a Cloud and DevOps Engineer — blog.rishabkumar.com Top 7 Linux commands I use as a Cloud and DevOps Engineer

How to route UDP traffic into Kubernetes | Amazon Web Services — aws.amazon.com Since its release, Amazon Elastic Kubernetes Service (Amazon EKS) has been helping customers to run their applications reliably and at scale. UDP, or User Datagram Protocol, is a low-latency protocol that is ideal for workloads such as real-time streaming, online gaming, and IoT. The Network Load Balancer (NLB) is designed to handle tens of millions […]

This weekend there was a debate when I went downstairs to the Kitchen, which was choosing which cheese is better Spanish Goat Cheese or Spanish Manchego Cheese, so I did what any nerd would do and created a Twitter Poll.

There was a good conversation on why Kubernetes doesn't have more batteries included like using digest for images, and an interesting one since Knative does this by default.

News

Best Practices for Multi-tenancy in Argo CD | by Dan Garfield | Feb, 2022 | Argo Project — blog.argoproj.io This blogpost is co-authored by Dan Garfield and Jesse Suen. Special thanks to Alexander Matyushentsev, Jann Fischer, Henrik Blixt, and the amazing community for all their hard work in making Argo CD…

[Technical Product Update] What's New: OpenShift 4.10 [Feb-2022] — www.youtube.com Hear directly from Red Hat OpenShift Product Managers on the key updates expected with Red Hat OpenShift 4.10.

Kubernetes Security Best Practices: The Definitive Guide | ARMO — www.armosec.io All you need to know about kubernetes security best practices, from implementing best practices to the importance of kubernetes security and much more

1Password for SSH & Git (Beta) | 1Password Developer Documentation — developer.1password.com Introducing 1Password for SSH & Git (Beta), the single source of truth for all your SSH keys. With 1Password, you can:

Kubernetes Virtual clusters with Loft Labs — www.youtube.com We'll look at benefits and use cases for Kubernetes virtual clusters using Loft.loft.sh

Disclosure: Fixing a critical bug in Optimism’s Geth fork | by Optimism PBC | Feb, 2022 | Medium — optimismpbc.medium.com On February 2nd, the Optimism team was alerted by Jay Freeman (saurik of Cydia and Orchid fame) to the existence of a critical bug in Optimism’s Geth fork. The bug made it possible to create ETH on…

Steal Credentials & Bypass 2FA Using noVNC | mr.d0x Security Research | C:\Users\mr.d0x>

Golang project structuring — Ben Johnson way | by vignesh dharuman | SellerApp | Feb, 2022 | Medium — medium.com Project code organisation is an ever evolving problem. As all wise developers put it, “it always depends on the requirement”. But following a standard structure will help in keeping the code base…

Global Load Balancer Approaches — cloud.redhat.com When working with Kubernetes or OpenShift in a multicluster (possibly hybrid cloud) deployment, one of the considerations that comes up is how to direct traffic to the applications deployed across these clusters. To solve this problem, we need a global load balancer.

Auto Scaling CI Agents At Wix — www.wix.engineering

This article is part II of "6 Challenges We Faced While Building a Super CI Pipeline"

Backup & Restore | Raspberry Pi Kubernetes Cluster — picluster.ricsanfre.com Backup Architecture and Design

GitOps in Kubernetes: How to do it with GitLab CI and Argo CD | by Andrzej Kaczynski | Medium — medium.com The world of Cloud Native in recent days is continuously speaking about GitOps. Indeed this model of Continuous Delivery is a kind of revolution in modern IT world. I’m not going to describe what…

Assets

GitHub - rebuy-de/aws-nuke: Nuke a whole AWS account and delete all its resources. — github.com Nuke a whole AWS account and delete all its resources. - GitHub - rebuy-de/aws-nuke: Nuke a whole AWS account and delete all its resources.

GitHub - developer-guy/rekor-falco: A Falco Plugin for Rekor Transparency Log Server — github.com A Falco Plugin for Rekor Transparency Log Server. Contribute to developer-guy/rekor-falco development by creating an account on GitHub.

GitHub - google/k8s-digester: Add digests to container and init container images in Kubernetes pod and pod template specs. — github.com

Add digests to container and init container images in Kubernetes pod and pod template specs.

Resolve Image to Digest | Kyverno Image tags are mutable and the change of an image can result in the same tag. This policy resolves the image digest of each image in a container and replaces the image with the fully resolved reference which includes the digest rather than tag.

GitHub - estesp/mquery: Multi-platform (manifest list/OCI index) registry image query utility — github.com Multi-platform (manifest list/OCI index) registry image query utility - GitHub - estesp/mquery: Multi-platform (manifest list/OCI index) registry image query utility

GitHub - mylesagray/tanzu-cluster-gitops — github.com Contribute to mylesagray/tanzu-cluster-gitops development by creating an account on GitHub.

Kind, Keycloak — Securing Kubernetes api server with OIDC | by Charles-Edouard Brétéché | Feb, 2022 | Medium — medium.com Securing Kubernetes control plane can be a challenging task, especially when a company grows and more people come and go to work in a shared Kubernetes cluster. One important tool to setup as early…

Skills

Real world Tekton pipeline - Hashnode — hashnode.com Complete guide to getting started with Tekton

Special Rates for Individuals in Economically Developing Countries

Low cost ACM subscription includes OReilly book subscription

Internals of Go's new fuzzing system — jayconrod.com — jayconrod.com Go 1.18 is coming out soon. It's a huge release, but native fuzzing has a special place in my heart. Not much has been written yet on how Go's fuzzing system actually works, so I'll talk a bit about that here.

Azure Study Map — azurecharts.com

Most studied Azure learning subjects by complexity levels and student roles based on aggregated user vote count

Introducing Amazon CloudWatch Container Insights for Amazon EKS Fargate using AWS Distro for OpenTelemetry | Amazon Web Services — aws.amazon.com Your description for this link...

How to Make Package Signing Useful — blog.chainguard.dev The Case for Farm-to-Table Package SigningThe benefits and limitations of signing an open source package–using a private key to create a unique digital signature–are a surprisingly contentious topic. One of the maintainers associated with the Python Package Index maintainer has a cogent blog post called “Why Package Signing

Shades of DevOps - Related Job titles — www.jedi.be A quick overview of the titles/roles use to related to devops related subject matter experts. I will stick with my definition of devops regardless of job title: Dev(sec)Ops: everything you do to overcome the friction created by silos … All the rest is plain engineering

Scaling Kubernetes to Over 4k Nodes and 200k Pods | by Abdul Qadeer | The PayPal Technology Blog | Jan, 2022 | Medium — medium.com At PayPal, we recently started testing the waters with Kubernetes. A majority of our workloads run on Apache Mesos, and as part of this migration, we needed to understand several performance aspects…

Amazon more than doubles max base pay to $350k for corporate and tech workers, citing labor market - GeekWire — www.geekwire.com Amazon will boost its maximum base pay to $350,000 for corporate and tech employees, from $160,000 previously, as part of an overall increase in total…

A modern toolkit to start working with container images on macOS that meets your needs without requiring Docker Desktop — medium.com Most of us stepped into the containerization world with Docker. So, we’ll always be grateful to Docker for that. But, to be honest, even we’re working with Docker, we know that it is not the only…

CNCF Annual Survey 2021 | Cloud Native Computing Foundation — www.cncf.io Featuring production data and insights from Datadog, New Relic, and SlashData download report View the complete raw data on GitHub Are you a CNCF member with in…

A decade of major cache incidents at Twitter

PodSecurityPolicy is dead. Long live...? | Appvia.io — www.appvia.io PodSecurityPolicy is being deprecated. Find out what replaces it and how to migrate with our online free tool

DSHR's Blog: EE380 Talk — blog.dshr.org I was asked at short notice to fill in for a speaker in Stanford's EE380 course who had to cancel. Below the fold is a hastily updated vers...

The Top 7 Open Source Tools for Securing Your Kubernetes Cluster — mattermost.com This article from the Mattermost community explores how to secure production Kubernetes clusters with the help of open source tools.

OCI Artifacts Explained. Are they real? Kind of! | by Dan Lorenc | Medium — dlorenc.medium.com The OCI (Open Containers Initiative) manages a few specifications and projects related to the storage, distribution, and execution of container images. If you’ve ever run a docker container, you’ve…

CNCF Sees Record Kubernetes and Container Adoption in 2021 Cloud Native Survey | Cloud Native Computing Foundation — www.cncf.io Record number of organizations are using or evaluating Kubernetes as the technology goes mainstream and users start to move up the stack SAN FRANCISCO, Calif.

Falco 0.31.0 a.k.a. "the Gyrfalcon" | Falco

Falco 0.31.0 finally ships with the brand new plugin system 🎉

BeyondCorp is dead, long live BeyondCorp No organization has successfully implemented a fully zero trust architecture. Many proponents of zero trust, including the US government, have ignored device...

Connecting Go Profiling With Tracing · Felix Geisendörfer

Profiling Improvements in Go 1.18

SLOConf - Service Level Objective Conference The first Service Level Objective Conference for Site Reliability Engineers

Detecting a Container Escape with Cilium and eBPF — isovalent.com Learn how to use Isovalent Cilium Enterprise observability to detect container escapes

Prodspec and Annealing | USENIX — www.usenix.org

focus on the state you want to reach. Instead of maintaining step-by-step workflows

IPVS-Based In-Cluster Load Balancing Deep Dive | Kubernetes Author: Jun Du(Huawei), Haibin Xie(Huawei), Wei Liang(Huawei) Editor’s note: this post is part of a series of in-depth articles on what’s new in Kubernetes 1.11 Introduction Per the Kubernetes 1.11 release blog post , we announced that IPVS-Based In-Cluster Service Load Balancing graduates to General Availability. In this blog, we will take you through a deep dive of the feature. What Is IPVS? IPVS (IP Virtual Server) is built on top of the Netfilter and implements transport-layer load balancing as part of the Linux kernel.

Zanzibar Implementations Reviewing the current landscape of Zanzibar implementations.

Crypto, NFTs, and sports betting: Money is now a hobby - Vox — www.vox.com Why (mostly) 20- and 30-something dudes made crypto and sports betting their personality.

Assets

GitHub - sbstp/kubie: A more powerful alternative to kubectx and kubens — github.com A more powerful alternative to kubectx and kubens. Contribute to sbstp/kubie development by creating an account on GitHub.

GitHub - apiaryio/curl-trace-parser: Parser for output from Curl --trace option — github.com Parser for output from Curl --trace option. Contribute to apiaryio/curl-trace-parser development by creating an account on GitHub.

GitHub - ruoshan/autoportforward: Bidirectional port-forwarding for docker, podman and kubernetes — github.com Bidirectional port-forwarding for docker, podman and kubernetes - GitHub - ruoshan/autoportforward: Bidirectional port-forwarding for docker, podman and kubernetes

GitHub - kameshsampath/kluster: Tool to run local k3s clusters backed by multipass vms — github.com Tool to run local k3s clusters backed by multipass vms - GitHub - kameshsampath/kluster: Tool to run local k3s clusters backed by multipass vms

GitHub - anchore/grype: A vulnerability scanner for container images and filesystems — github.com A vulnerability scanner for container images and filesystems - GitHub - anchore/grype: A vulnerability scanner for container images and filesystems

Skills

Comparing kube-proxy modes: iptables or IPVS?

Performance Comparison

What is MicroK8s? K3s, Kind, Minikube, VM's with Kubespray... why MicroK8s? What makes it interesting and unique to me? In this video, I'll show off three killer features that...

CORS is not meant to secure an API endpoint A few days ago I came across this article. The author shows how to access a Drupal system in the backend with a Vue.js app. For authentication he uses an API key - and I find that dangerous. Here's why.

HTTP/3: Everything you need to know about the next-generation web protocol | The Daily Swig — portswigger.net QUIC march

Kubernetes and Checkpoint Restore - Adrian Reber, Red Hat — www.youtube.com https://youtu.be/0RUDoTi-Lw4

From AWS Lambda & API Gateway To Knative & Kong API Gateway | Blog — www.pmbanugo.me How to build a serverless function API using Knative, Kong, and kazi

Introducing the ApplicationSet Controller for Argo CD | by Jonathan West | Argo Project — blog.argoproj.io I am excited to announce the first release of the Argo CD ApplicationSet controller, v0.1.0, releasing now alongside Argo CD v2.0! Unlike with an Argo CD Application resource, which deploys resources…

Kernel Community | Kernel — kernel.community A peer-to-peer, lifelong learning community of the most talented individuals in web3

The Work of Edward Tufte and Graphics Press — www.edwardtufte.com Edward Tufte home page for books, posters, sculpture, fine art and one-day course: Presenting Data and Information

This week I started streaming videos on TwitchTV, YouTube, and Twitter about Kubernetes and Knative. The goal is to help others learn about Cloud Native and Open Source. Please let me know if you like the videos.

News

Argo CD v2.3 release candidate. The next Argo CD release is around the… | by Alexander Matyushentsev | Feb, 2022 | Argo Project — blog.argoproj.io The next Argo CD release is around the corner. During the last three months, Argo CD got 200+ commits from the 71 contributors. We worked hard to improve the usability of core Argo CD features…

Safeguard your containers with new container signing capability in GitHub Actions | The GitHub Blog — github.blog GitHub has partnered with the OpenSSF and Project Sigstore to add container image signing to our default “Publish Docker Container” workflow, giving your users confidence that the container images they got from their container registry was the trusted code that you built and published.

Malicious Kubernetes Helm Charts can be used to steal sensitive information from Argo CD deployments — apiiro.com Apiiro's Security Research team has discovered a major vulnerability in Argo CD platform (CVE-2022-24348).

More ways to keep your pull request branch up-to-date | GitHub Changelog — github.blog More ways to keep your pull request branch up-to-date

Quirrel is acquired! And I am joining Netlify - DEV Community — dev.to I am very happy to announce that Quirrel was acquired by Netlify, and I am joining as a software... Tagged with quirrel, netlify, jamstack.

Google and Microsoft back the Alpha-Omega Project to bolster software supply chain | VentureBeat — venturebeat.com The Open Source Security Foundation has launched the Alpha-Omega Project to help secure the software supply chain.

Principles for Designing and Deploying Scalable Applications on Kubernetes — elastisys.com 15 principles for how to design and deploy cloud native applications on Kubernetes - for scalability, observability, automation & security.

Google Cloud launches dedicated Digital Asset Team | Google Cloud Blog Google Cloud launches a new, dedicated Digital Assets Team to help underpin the blockchain ecosystems of the future. Whether you're implementing blockchain strategies or blockchain-native, you can rely on Google Cloud’s scalable, secure, and sustainable infrastructure.

The State of the Octoverse | The State of the Octoverse explores a year of change with new deep dives into writing code faster, creating documentation and how we build sustainable communities on GitHub. — octoverse.github.com Octoverse Report

How Citi is building the secure software factory with Sigstore and Tekton — blog.chainguard.dev

Securing the software supply chain is of paramount importance to the tech industry today.

Supply Chain Security Is Not a Problem…It’s a Predicament | Threatpost — threatpost.com Despite what security vendors might say, there is no way to comprehensively solve our supply-chain security challenges, posits JupiterOne CISO Sounil Yu. We can only manage them.

CNCF Archives the OpenTracing Project | Cloud Native Computing Foundation — www.cncf.io CNCF announced today that the Technical Oversight Committee (TOC) has approved the archiving of the OpenTracing project. Archived projects are fairly rare but a…

Major vulnerability found in open source dev tool for Kubernetes | VentureBeat — venturebeat.com A zero day vulnerability with a "high" severity rating affects Argo CD, an open source developer tool for Kubernetes, Apiiro researchers said.

January 2022 Update | Flux New Flux and Flagger releases bring more security, terraform-controller team wants feedback, Flux articles and docs, upcoming Flux events helping you get started and more.

New Open-Source Multi-Cloud Asset to build SaaS - DEV Community Development and automated deployment of SaaS for multiple tenants, using Red Hat OpenShift/Kubernetes and DevSecOps. Tagged with saas, development, devops, cloudnative.

Mark Chmarny | Twitter follower status monitoring made easy using TweeThingz few longer thoughts,
because every once in a while
140 characters is just not enough

Assets

GitHub - AdminTurnedDevOps/Terraform-The-Hard-Way — github.com

The most efficient way to learn Terraform for beginners and intermediate practitioners

GitHub - firecracker-microvm/firecracker: Secure and fast microVMs for serverless computing. — github.com Secure and fast microVMs for serverless computing. - GitHub - firecracker-microvm/firecracker: Secure and fast microVMs for serverless computing.

GitHub - kotalco/kotal: Kubernetes Blockchain Operator — github.com Kubernetes Blockchain Operator. Contribute to kotalco/kotal development by creating an account on GitHub.

HOUDINI: Hundreds of Offensive and Useful Docker Images for Network Intrusion HOUDINI (Hundreds of Offensive and Useful Docker Images for Network Intrusion) is a curated list of Network Security related Docker Images for Network Intrusion purposes.

GitHub - kubeshop/monokle: 🧐 Monokle is your K8s best friend for creating, validating, debugging and managing manifests! 🚀 — github.com

🧐 Monokle is your K8s best friend for creating, validating, debugging and managing manifests! 🚀 -

GitHub - direktiv/vorteil: turn your applications and containers into micro virtual machines — github.com turn your applications and containers into micro virtual machines - GitHub - direktiv/vorteil: turn your applications and containers into micro virtual machines

Create fast, easy, and repeatable containers with Podman and shell scripts | Enable Sysadmin — www.redhat.com Get started with containers in a fast, repeatable way through the familiar shell scripting interface.

GitHub - weaveworks/flintlock: Lock, Stock, and Two Smoking MicroVMs. Create and manage the lifecycle of MicroVMs backed by containerd. — github.com

Lock, Stock, and Two Smoking MicroVMs. Create and manage the lifecycle of MicroVMs backed by containerd.

GitHub - hamidgholami/k8s-lab: Kubernetes Labratory — github.com Kubernetes Labratory. Contribute to hamidgholami/k8s-lab development by creating an account on GitHub.

Skills

Performance Reviews for Software Developers – How I Do Them In a (Hopefully) Fair Way - The Pragmatic Engineer — blog.pragmaticengineer.com Note: if you're just looking for performance review templates and examples, head to the templates page to download them. I've had about a dozen performance reviews during my decade-long software engineering career. Some of them were unmemorable, some okay, but a good chunk of them were just... plain bad. Often,

OpenShift Commons Gathering on GitOps - Feb 09 | Hopin Get tickets to OpenShift Commons Gathering on GitOps, taking place 02/09/2022. Hopin is your source for engaging events and experiences.

Level up your Go Presentations. What is present? Present is used to… | by Drashti Ved | Medium — medium.com A mini guide to use Present tools for your next Golang presentation

FOSDEM 2022: Golang JSON Serialization - The Fine Print — github.com

Executing Remote Commands with Pulumi | Pulumi Blog — www.pulumi.com In this article, we deploy k3s and use the Command package to retrieve our kubeconfig from the virtual-machine and create a Kubernetes provider

Ep. #110 Supply Chain Security | DevSecCon Supply chain security is a multifaceted, complex, and currently unsolved problem, and Jonathan Meadows is determined to change that!

What is OpenShift CPU throttling? Turbonomic to the Rescue! — openshifttipsandtricks.blogspot.com Your description for this link...

Rakesh Jain on Twitter: "Linux Diagnostics and Troubleshooting Series - Managing Kernel Modules! " — twitter.com Your description for this link...

Setting up an raspberrypi4 k3s-cluster with nfs persistent-storage | by Michael Tissen | Medium — michael-tissen.medium.com There are not many options to add persistent-storage to a k3s raspberry cluster. I will present you a relative simple and powerfull method with the nfs-client-provisioner. I’ve created a folder named…

Kubernetes kOps: Step-By-Step Example & Alternatives - Kubecost Blog Learn the features and functionality of Kubernetes kOps, explore its alternatives, and follow step-by-step instructions to implement it.

Everything Public Key Infrastructure (PKI) - The Missing Manual | Smallstep Blog — smallstep.com Everything you should know about certificates and public key infrastructure (PKI) but are too afraid to ask.

Kubernetes cluster security assessment with kube-bench and kube-hunter – Flant blog — blog.flant.com Your description for this link...

This weekend I finally ran some ethernet cable to by new office upstairs to get a 10x internet performance boost. My wife said if I go up and down the stairs to get snacks I have a better chance to lose some belly fat :-)

This weekend I saw the terrible news that a person admired by the developer community was in a terrible car accident. Kent C. Dodds is alive to tell us what happened. Hug your loved ones.

PS: Follow me on Twitter 🙏

News

OpenShift on Raspberry Pi 4? – Open Sourcerers — www.opensourcerers.org

Almost! We run MicroShift on a Raspberry Pi4. MicroShift is an experimental flavour of OpenShift/Kubernetes optimized for the device edge.

v1.2 release - Knative — knative.dev Knative v1.2 release announcement

CVE-2022-0185 in Linux Kernel Can Allow Container Escape in Kubernetes A high-severity CVE was released that affects the Linux kernel, allowing unprivileged users to escalate those rights to root and escape from the container

Announcing 100% Cloud Service Coverage for Crossplane Crossplane now has 100% coverage for major cloud services with the new providers: provider-jet-aws, provider-jet-azure, and provider-jet-gcp. To create new providers like these, we are introducing Terrajet, a code generation pipeline for creating Crossplane providers.

Linux system service bug gives root on all major distros, exploit released — www.bleepingcomputer.com A vulnerability in Polkit's pkexec component identified as CVE-2021-4034 (PwnKit) is present in the default configuration of all major Linux distributions and can be exploited to gain full root privileges on the system, researchers warn today.

How eBPF will solve Service Mesh - Goodbye Sidecars — isovalent.com eBPF Service Mesh - How we can build an eBPF-based service mesh in the kernel to replace the complex sidecar model

Stop using static cloud credentials in GitHub Actions | lbr. Engineering, DevOps & Cloud Computing

Event-Driven applications with CloudEvents on Kubernetes – Salaboy (Open Source Knowledge) — salaboy.com

This week I've spent time writing this tutorial and examples that contain the building blocks that I will use to build a larger example.

New sync and diff strategies in ArgoCD | by Leonardo Luz | Jan, 2022 | Argo Project — blog.argoproj.io ArgoCD 2.3 will be shipping with a new experimental sync option that will verify diffing customizations while preparing the patch to be applied in the cluster. It also includes a new diff strategy…

GitHub - devtron-labs/devtron: Web based CI/CD Platform for Kubernetes — github.com Web based CI/CD Platform for Kubernetes. Contribute to devtron-labs/devtron development by creating an account on GitHub.

FOSDEM 2022 - Schedule — fosdem.org Every year, FOSDEM hosts a wide variety of activities. This page gives an overview with links to further information about scheduled events. All times CET (UTC+1).

Rancher Desktop 1.0.0 Has Arrived | SUSE Communities — www.suse.com

We are happy to announce the 1.0.0 release of Rancher Desktop. This release has been months in the making since development on Rancher Desktop began.

Kubernetes architecture: How to use hierarchical namespaces for multiple tenants | Enable Architect — www.redhat.com Hierarchical namespaces make it easier to manage individual tenants' permissions and capabilities in a multi-tenant Kuberentes architecture.

Parca - Open Source infrastructure-wide continuous profiling | Parca Open Source infrastructure-wide continuous profiling

WTF is Chainguard ? Chainguard is a 3-month start up in the software supply chain security industry. The mission of Chainguard is to make the software lifecycle secure by default. Sounds kinda vague. Do you have a product?No. Not yet. We have some exciting ideas though, and are working on them right now!

Researchers use GPU fingerprinting to track users online — www.bleepingcomputer.com A team of researchers from French, Israeli, and Australian universities has explored the possibility of using people's GPUs to create unique fingerprints and use them for persistent web tracking.

Reasons for servers to support IPv6 Reasons for servers to support IPv6

The ROAD to SRE. There are many ways to introduce Site… | by Bruce Dominguez | Dec, 2021 | Medium — medium.com There are many ways to introduce Site Reliability Engineering practices to your organisation, but it can be confusing where you should start. Do you start with introducing Service Level Objectives…

Two reasons Kubernetes is so complex • Buttondown — buttondown.email Preface Hello friends! It’s been a while. I’ve been finding it very hard to write while holding up a full-time job, and I’ve also been dealing with some very...

Tracing the path of network traffic in Kubernetes — learnk8s.io Learn how packets flow inside and outside a Kubernetes cluster. Starting from the initial web request and down to the container hosting the application

Kubernetes Scaling, Capacity and Resource Planning in Complex Clusters | by Nick Gibbon | Pareture | Medium — medium.com An intermediate take on Kubernetes various elements of scaling, capacity and resource planning after some pain and confusion over a few years. My experience is that of a Kubernetes Cluster and…

Kickstarting AI for Code: Introducing IBM’s Project CodeNet | IBM Research Blog — research.ibm.com Project CodeNet is a large dataset aimed at teaching AI to code.

Everything about super tokens - an open source alternative to Auth0, Firebase Auth, and AWS Cognito. - Ankur Tyagi — theankurtyagi.com Super Tokens An Open Source User Auth Quick to implement and easy to customize

Sigstore ❤ Ruby! - sigstore — blog.sigstore.dev We started the Sigstore project with a goal of making key management, certificates, and digital signatures accessible and easy to use for…

Engineering | GitLab — about.gitlab.com

GitLab is an open-source company that everything is public. Here is their engineering handbook

Making the case for Kubernetes operators — practicalkubernetes.blogspot.com Your description for this link...

Open Source Kubernetes Virtual Cluster Project vcluster Now Runs on k0s | Business Wire — www.businesswire.com vcluster is now available to spin up virtual clusters with k0s.

How can you tell if the company you’re interviewing with is rotten on the inside? – charity.wtf — charity.wtf

How can you tell the companies who are earnestly trying to improve apart from the ones who sound all polished and healthy from the outside, whilst rotting on the inside?

December Tailscale newsletter · Tailscale — tailscale.com December brought fascinating community contributions, including How To Get Tailscale Working With a Fire TV Stick and how to use Tailscale for SSH access to ‘LAN’ locked machines.

AWS open source news and updates, #97 - DEV Community Jan 22nd, 2022 - Instalment #97 Newsletter #97. Welcome to another edition of the AWS... Tagged with opensource, aws.

Understanding DisplayLink, multiple displays, and M1 Macs – Daniel Compton

Geek out about connecting Monitors to your new Mac

An alternative Docker installation with Multipass on macOS without using Docker for Mac | Niklas Metje Last week I received an email from the Docker Team which said that Docker for Mac (the software which also comes with a GUI) will be forbidden for commercial…

A guide to Web3 for Web2 frontend devs — Dhaiwat Pandya — mirror.xyz With all the hype around, web3 can be overwhelming if you’re looking to get started. Luckily if you are a frontend dev coming from web2, you already have most of the skills you need to get started in web3. I can say this because I come from a web2 frontend background myself and I made the move to web3 last year. I now work full-time in web3.

Assets

GitHub - lukehinds/sigstore-the-hard-way: sigstore the hard way! — github.com sigstore the hard way! Contribute to lukehinds/sigstore-the-hard-way development by creating an account on GitHub.

Hurricane Electric Free IPv6 Tunnel Broker

Get a free tunnel to your internal IPv6 addresses

GitHub - amplication/amplication: — github.com

Amplication is an open‑source development tool. It helps you develop quality Node.js applications without spending time on repetitive coding tasks. - GitHub -

GitHub - fleetbase/storefront-app: — github.com

Storefront by Fleetbase is an open source hyperlocal shopping or services app. Enables users to quickly launch their own shop or service booking app or setup a multi-vendor marketplace. -

GitHub - opencontainers/artwork: OCI artwork and logos — github.com OCI artwork and logos. Contribute to opencontainers/artwork development by creating an account on GitHub.

Everything you need to know about monorepos, and the tools to build them. — monorepo.tools Everything you need to know about monorepos, and the tools to build them.

Collection: Pixel Art Tools · GitHub — github.com GitHub is where people build software. More than 73 million people use GitHub to discover, fork, and contribute to over 200 million projects.

weekly.tf | Revue — weekly.tf weekly.tf - Terraform Weekly...

How To Build Docker Image In Kubernetes Pod Using Kaniko — devopscube.com This beginner's guide focuses on step by step process of setting up Docker image build in Kubernetes pod using Kaniko image builder.

Release v0.13.0 · marcosnils/bin · GitHub — github.com Effortless binary manager. Contribute to marcosnils/bin development by creating an account on GitHub.

Lit Simple. Fast. Web Components.

Skills

How Docker Desktop Networking Works Under the Hood - Docker Blog — www.docker.com Learn from Docker experts to simplify and advance your app development and management with Docker. Stay up to date on Docker events and new version announcements!

Solo Events and Webinars — www.solo.io

[PUBLIC] The Art of SLOs – Participant Handbook - Google Docs — docs.google.com

Practical Guide to calculate SLOs

#437: A Day in the Life of an SA - AWS Podcast | Podcast on Spotify — open.spotify.com

Listen to this episode from AWS Podcast on Spotify. What does a day in the life of a Solution Architect look like at AWS? Simon speaks with four SA’s from around the globe to discuss

Junior Developers by The Alan Barr Show

"The average tenure of software engineers in small companies is only 1.5 years, where it’s 2.3 years for large companies." - Why Programmers Shouldn't Stay in One Company for a long time.

Kubernetes 1.23 - What's new? - New features and deprecations — sysdig.com Kubernetes 1.23 brings 50 enhancement, including improved support for OpenAPI v3, a new kubectl events command. Discover more!

I did minor updates to my site; I added a page for all my Cloud Native learning resources https://www.santana.dev/learn.

I also updated the Kubernetes Book Club roadmap https://www.santana.dev/book-club.

My two highlights are the Kubernetes Documentary on youtube and microshift from Red Hat to get openshift running on Raspberry Pi.

News

Introducing MicroShift - Red Hat Emerging Technologies — next.redhat.com MicroShift has been specifically designed for edge computing use cases, with a goal of fitting in the limited storage capacity of field-deployed devices that can be embedded into a variety of appliances such as cars, factory lines, airplanes or even satellites.

Over 90 WordPress themes, plugins backdoored in supply chain attack — www.bleepingcomputer.com A massive supply chain attack compromised 93 WordPress themes and plugins to contain a backdoor, giving threat-actors full access to websites.

Kubernetes Home Lab Home lab using Intel NUC and Raspberry Pi running Kubernetes, K3S, Knative

Scaling Kubernetes to Over 4k Nodes and 200k Pods | by Abdul Qadeer | The PayPal Technology Blog | Jan, 2022 | Medium — medium.com At PayPal, we recently started testing the waters with Kubernetes. A majority of our workloads run on Apache Mesos, and as part of this migration, we needed to understand several performance aspects…

Inside Amazon’s Graviton3 Arm Server Processor — www.nextplatform.com The Graviton family of Arm server chips designed by the Annapurna Labs division of Amazon Web Services is arguably the highest volume Arm server chips the

SUSE releases NeuVector, the industry’s first open source container security platform | SUSE Communities — www.suse.com Today, we are pleased to announce that the NeuVector codebase is now available to the open source community on GitHub. The work to fully open source a formerly proprietary technology is a testament to SUSE’s open-source culture and our commitment to deliver open, interoperable and innovative solutions to our partners and customers. With this release, …

Third-Party Software for Teslas Can Be Hacked, German Teen Says - Bloomberg — www.bloomberg.com A 19-year-old said he’s found flaws in a piece of third-party software that appears to be used by a relatively small number of owners of Tesla Inc. cars that could allow hackers to remotely control some of the vehicles’ functions.

Our Cloud Native Journey to Red Hat OpenShift Using Quarkus — medium.com Once you have a hypothesis and some spare time, what do you do? You perform an experiment! That is exactly what our Go To Markets — Assets and Architecture team did. Throughout this blog series…

Spin up a Ubuntu VM using Pulumi and libvirt | Dustin Specker — dustinspecker.com Pulumi is an Infrastructure as Code (IaC) tool that supports using Go, .Net, Python, and TypeScript/JavaScript. Libvirt is a tool for managing virtual machines (VM). Typically, teams use Pulumi with different cloud providers, but we can leverage libvirt to manage virtual machines on bare-metal servers, perfect for a homelab.

Kubernetes Nodes - The Complete Guide | Komodor — komodor.com Learn about Kubernetes node components, status, best practices for running nodes in a cluster, and common errors.

Kubernetes API Basics - Resources, Kinds, and Objects — iximiuz.com The article explains the most fundamental concepts of the Kubernetes API - Resources, API Groups, Kinds, and Objects - preparing the reader to the first access of the API from code.

Securing Admission Controllers | Kubernetes — kubernetes.io

Author: Rory McCune (Aqua Security) Admission control is a key part of Kubernetes security, alongside authentication and authorization. Webhook admission controllers

Orca Security Discovers AWS Glue Vulnerability - Orca Security — orca.security Orca's Research Team discovered a critical vulnerability that could allow an actor to create resources and access data of AWS Glue customers.

Goodbye Dockerfiles: Build Secure & Optimised Node.js Container Images with Cloud Native Buildpacks | Blog — www.pmbanugo.me Learn how to secure container images using Cloud Native Buildpacks

Monitoring new syscalls with Falco | Falco Falco is currently the de facto standard for runtime threat detection in Kubernetes environments. The project is growing at a very fast pace, and so is its open source community. The role of Falco is to collect all the system events of a cluster and send some kind of alert whenever suspicious behavior is detected. Among the other data sources supported, system calls are the core kind of events monitored by Falco.

Remix vs Next.js | Remix — remix.run An objective comparison between Remix and Next.js

Assets

GitHub - up9inc/mizu: API traffic viewer for Kubernetes enabling you to view all API communication between microservices. — github.com API traffic viewer for Kubernetes enabling you to view all API communication between microservices. Think TCPDump and Wireshark re-invented for Kubernetes - GitHub - up9inc/mizu: API traffic viewer for Kubernetes enabling you to view all API communication between microservices. Think TCPDump and Wireshark re-invented for Kubernetes

GitHub - tohjustin/kube-lineage: A CLI tool to display all dependencies or dependents of an object in a Kubernetes cluster. — github.com A CLI tool to display all dependencies or dependents of an object in a Kubernetes cluster. - GitHub - tohjustin/kube-lineage: A CLI tool to display all dependencies or dependents of an object in a Kubernetes cluster.

CodeZero - Visual Studio Marketplace — marketplace.visualstudio.com

Extension for Visual Studio Code - CodeZero extension for VS Code

CodeZero is a modern development platform for Kubernetes

GitHub - asobti/kube-monkey: An implementation of Netflix's Chaos Monkey for Kubernetes clusters — github.com An implementation of Netflix's Chaos Monkey for Kubernetes clusters - GitHub - asobti/kube-monkey: An implementation of Netflix's Chaos Monkey for Kubernetes clusters

GitHub - sagittaros/terraform-k3s-private-cloud: Private cluster with k3s. Why have 1 huge complicated cluster (pet) when you can have many simple, cheap clusters (cattle)? — github.com Private cluster with k3s. Why have 1 huge complicated cluster (pet) when you can have many simple, cheap clusters (cattle)? - GitHub - sagittaros/terraform-k3s-private-cloud: Private cluster with k3s. Why have 1 huge complicated cluster (pet) when you can have many simple, cheap clusters (cattle)?

GitHub - vercel/micro: Asynchronous HTTP microservices — github.com Asynchronous HTTP microservices. Contribute to vercel/micro development by creating an account on GitHub.

GitHub - jedi4ever/bashpack: turns nodejs projects into a single executable bash file — github.com turns nodejs projects into a single executable bash file - GitHub - jedi4ever/bashpack: turns nodejs projects into a single executable bash file

Create powerful apps and websites, without code. — www.glideapps.com Turn spreadsheets into powerful apps & websites, without writing any code. Pick a spreadsheet or start with a template, customize your app, then share it instantly with anyone. Start today for free!

Terraform Pull Request Automation | Atlantis Atlantis: Terraform Pull Request Automation

Home | asdf Manage multiple runtime versions with a single CLI tool

Skills

A Deep Dive into Kubernetes External Traffic Policies — Andrew Sy Kim — www.asykim.com Based on recent discussions, I’ve noticed some confusion around external traffic policies for Kubernetes Services. This is not surprising given there’s a lot of context around this feature that can only be found by digging through many Github issues and pull requests. In this post I'll try to do a deep dive into this feature to clarify some of the important assumptions that may not be clear in the API or the documentation.

Episode 17 w/ Brian LeRoux: The Case for a Local Dev Experience in Serverless, Architect and Begin.com, and Making Sense of the Web Today – AWS FM — aws.fm Brian joins Adam to discuss his belief that we shouldn't forego a local dev experience when building cloud-native apps, his experiences building frameworks and products like arc.codes and Begin.com, and an honest evaluation of where we're at with the web in 2021.

DevOps Roadmap: Learn to become a DevOps Engineer or SRE — roadmap.sh Community driven, articles, resources, guides, interview questions, quizzes for DevOps. Learn to become a modern DevOps engineer by following the steps, skills, resources and guides listed in this roadmap.

Follow me on Twitter https://twitter.com/csantanapr

I restarted the Kubernetes Book Club for 2022

"We may have all come on different ships, but we're in the same boat now."

A quote from Dr. Martin Luther King Jr.

News

Readout of White House Meeting on Software Security | The White House — www.whitehouse.gov Today, the White House convened government and private sector stakeholders to discuss initiatives to improve the security of open source software and ways

55 of Dr. Martin Luther King Jr.'s Most Inspiring Motivational Quotes  — parade.com Be inspired by 55 of Martin Luther King Jr.'s quotes, ranging from his famous MLK sayings about equality, faith and love, to MLK quotes about peaceful protests.

What an SBOM Can Do for You — blog.chainguard.dev By now, it is common knowledge that a Software Bill of Materials is becoming an increasingly expected requirement from software releases, yet here still seems that some confusion persists about what an SBOM can/could do for your project.

How to learn PromQL with Prometheus Playground — iximiuz.com How to setup Prometheus playground. How to learn PromQL running example queries? How to prefill Prometheus with metric data?

Top 10 Linux security tutorials for sysadmins from 2021 | Enable Sysadmin — www.redhat.com Even as the world changes around us, the importance of IT security is one of the things that stands firm.

10 real-world stories of how we’ve compromised CI/CD pipelines – NCC Group Research — research.nccgroup.com Mainstream appreciation for cyberattacks targeting continuous integration and continuous delivery/continuous deployment (CI/CD) pipelines has been gaining momentum. Attackers and defenders increasingly understand that build pipelines are highly-privileged targets with a substantial attack surface. But what are the potential weak points in a CI/CD pipeline? What does this type of attack look like in practice? NCC…

Google Online Security Blog: Introducing SLSA, an End-to-End Framework for Supply Chain Integrity — security.googleblog.com Posted Kim Lewandowski, Google Open Source Security Team & Mark Lodato, Binary Authorization for Borg Team  Supply chain integrity attacks—u...

Running MongoDB in Kubernetes: An overview of existing solutions – Flant blog — blog.flant.com Here are the challenges of using MongoDB in Kubernetes and the options we have to overcome them including ready-to-use Helm charts and Kubernetes operators.

Give me /events, not webhooks - Sequin Webhooks come with some challenges. We prefer polling an /events endpoint instead when possible.

What I'd like to see in Go 2.0 | Seth Vargo — www.sethvargo.com Audit logs are very useful for retroactive analysis following a security incident, but what if they could also be used to proactively alert before a security incident occurs?

How To Call Kubernetes API using Simple HTTP Client — iximiuz.com There are plenty of reasons to call the Kubernetes API using a CLI or GUI HTTP client. This article will show you how to get the API server address, authenticate requests using certificates and Service Account tokens, and call the API using kubectl in the raw mode.

Using Event-Driven Architecture With Microservices - DevOps.com — devops.com To optimize business applications, DevOps teams must understand the full potential of microservices and event-driven architecture.

Unveil the Secret Ingredients of Continuous Delivery at Enterprise Scale with Argo CD - Yuan's Blog This is a recap from our KubeCon China 2021 talk. If you are interested in learning more about Argo or Akuity’s products and services, you can find all our past and upcoming conference talks on our website.

Tracing the path of network traffic in Kubernetes — learnk8s.io Learn how packets flow inside and outside a Kubernetes cluster. Starting from the initial web request and down to the container hosting the application

CoSign with Kubernetes: Ensure integrity of images before deployment — blog.rewanthtammana.com Notary vs CoSign? Is CoSign a good alternative? Can we automate keys & signature rotation?

Looking Ahead to Kubernetes 1.24 | Jetstack Blog — www.jetstack.io Kubernetes 1.24 is scheduled for release on Tuesday 19th April 2022, but some of us are already deep in the planning and work for it.

How to Pass your KCNA Exam. The CNCF has just launched the new… | by Brad McCoy | Nov, 2021 | Medium — blog.bradmccoy.io The CNCF has just launched the new Kubernetes and Cloud Native Associate Exam also known as the KCNA. I was one of the first 400 people to go through the Beta exam which contained the full suite of…

AWS open source news and updates, #95 - DEV Community Jan 10th, 2022 - Instalment #95 Newsletter #95. Feliz Ano and a very happy new year to... Tagged with opensource, aws.

Run a Google Kubernetes Engine Cluster for Under $25/Month – The New Stack — thenewstack.io This article will demonstrate a solution (available on GitHub) for running a full-blown GKE cluster on Google Cloud with a goal to keep the costs under $1 per day.

Making Open Source software safer and more secure — blog.google We welcomed the opportunity to participate in the White House Open Source Software Security Summit today.

Kubernetes Threat Modeling. Every security team has to deal with… | by Rahul Jadhav | Medium — medium.com Answering this is non-trivial, and involves understanding the threat vectors faced by the services. To understand threat vectors one needs an understanding of how the services works, what…

Open Startup | cal.com — cal.com The term "Open Startup" is not new, but still fairly niche. There are Open Startups with millions in revenue, yet only a tiny percentage of Startups today fall into the category.

Assets

kube-rs · GitHub — github.com rust kubernetes client and controller runtime. kube-rs has 6 repositories available. Follow their code on GitHub.

Distrobox | Use any linux distribution inside your terminal Use any linux distribution inside your terminal

GitHub - developer-guy/buildkit-machine: A proof-of-concept project that makes accessible buildkitd daemon from macOS — github.com A proof-of-concept project that makes accessible buildkitd daemon from macOS - GitHub - developer-guy/buildkit-machine: A proof-of-concept project that makes accessible buildkitd daemon from macOS

Coder · GitHub — github.com Developer workspaces on your infrastructure. Coder has 51 repositories available. Follow their code on GitHub.

Taking the bite out of x509 certificates with the step CLI Parsing, generating and troubleshooting certificates is critical skill in developing web services. Certificates establish trust on the web (e.g that indeed the company Google is serving you content when you go to www.google.com) and to encrypt traffic once trust is established using TLS.

GitHub - ory/hydra: OpenID Certified™ OpenID Connect and OAuth Provider written in Go — github.com OpenID Certified™ OpenID Connect and OAuth Provider written in Go - cloud native, security-first, open source API security for your infrastructure. SDKs for any language. Works with Hardware Security Modules. Compatible with MITREid. - GitHub - ory/hydra: OpenID Certified™ OpenID Connect and OAuth Provider written in Go - cloud native, security-first, open source API security for your infrastructure. SDKs for any language. Works with Hardware Security Modules. Compatible with MITREid.

GitHub - vladimirvivien/ktop: A top-like tool for your Kubernetes clusters — github.com A top-like tool for your Kubernetes clusters. Contribute to vladimirvivien/ktop development by creating an account on GitHub.

Kubernetes instance calculator — learnk8s.io Explore the best instance types for your Kubernetes cluster interactively.

3 Musketeers — 3musketeers.io Test, build, and deploy your apps from anywhere, the same way!

GitHub - nsmith5/rekor-sidekick: 🔍 Rekor transparency log monitoring and alerting — github.com 🔍 Rekor transparency log monitoring and alerting. Contribute to nsmith5/rekor-sidekick development by creating an account on GitHub.

GitHub - kubeshop/kusk: Kusk makes your OpenAPI definition the source of truth for API resources in your cluster — github.com Kusk makes your OpenAPI definition the source of truth for API resources in your cluster - GitHub - kubeshop/kusk: Kusk makes your OpenAPI definition the source of truth for API resources in your cluster

GitHub - jucardi/go-streams: Stream Collections for Go. Inspired in Java 8 Streams and .NET Linq — github.com Stream Collections for Go. Inspired in Java 8 Streams and .NET Linq - GitHub - jucardi/go-streams: Stream Collections for Go. Inspired in Java 8 Streams and .NET Linq

snappify — snappify.io Snappify helps you to create beautiful code snippets with ease.

GitHub - developer-guy/setup-krew: 📦🚀 A GitHub Action to install 👇 https://github.com/kubernetes-sigs/krew — github.com 📦🚀 A GitHub Action to install 👇 https://github.com/kubernetes-sigs/krew - GitHub - developer-guy/setup-krew: 📦🚀 A GitHub Action to install 👇 https://github.com/kubernetes-sigs/krew

Skills

Cosign Image Signing In AWS CodePipeline In this post we are going to show you how to integrate sigstore’s Cosign with AWS CodePipeline.

AWS SSM: Do you really need SSH? How to connect to EC2 using Session Manager — graystum.com Do you really need SSH? Maybe not!

GitHub - ossu/computer-science: Path to a free self-taught education in Computer Science! — github.com :mortar_board: Path to a free self-taught education in Computer Science! - GitHub - ossu/computer-science: Path to a free self-taught education in Computer Science!

Everything Useful I Know About kubectl

I am a blogv

I Took 20 LinkedIn Skill Assessments So You Don't Have To — www.linkedin.com I was updating my LinkedIn profile and saw a notification to take a skills assessment for Python. Sure, I know python, or so I thought.

API Tokens: A Tedious Survey · Fly — fly.io News, tips, and tricks from the team at Fly

Configure Liveness, Readiness and Startup Probes | Kubernetes — kubernetes.io This page shows how to configure liveness, readiness and startup probes for containers. The kubelet uses liveness probes to know when to restart a container. For example, liveness probes could catch a deadlock, where an application is running, but unable to make progress. Restarting a container in such a state can help to make the application more available despite bugs. The kubelet uses readiness probes to know when a container is ready to start accepting traffic.