Recent content on A cup of coffee
One of Kubernetes’ great strengths is being able to manage our resources elastically. If a stateless pod consumes too much, we can add replicas; if it has irregular consumption, we slap an HPA (Horizontal Pod Autoscaler) on it and it adapts to the load. Our cluster is full? We can add nodes to it. But while autoscaling replicas is automatic, doing the same for nodes isn’t necessarily…
When an application gets breached, the first thing an attacker will do is exfiltrate whatever data they can reach. From customer data to authentication tokens, secrets are target number one (goodbye to your GitHub PATs, your Slack bots in #general channels, your Mailchimp tokens, OpenAI keys, and so on). You’ll have to revoke everything, assuming the attacker already had access. When…
If you follow my blog regularly, you know I have a genuine fondness for Talos Linux. It’s the OS I recommend without hesitation for running Kubernetes: immutable, minimalist, SSH-free, with a gRPC API for all administration. In short, it’s what a cloud-native OS should be. But there’s one thing that has always bothered me a little: authentication. Talos uses mTLS (mutual TLS) to…
Regular readers of this blog know my deep attachment to Talos. I’m lucky enough to be on the team managing Talos machines at Lucca, I’ve also presented it as part of my VAE, and I even had the chance to be a Sidero ambassador. If you haven’t discovered this incredible solution yet, I can only encourage you to visit their website, read my previous articles, watch recordings of my…
Introduction# For several years, I’ve been looking to manage my system configuration “As-code” to ensure reproducibility and consistency across my environments. The primary goal was to install my work laptop, but I also need to install Linux servers (without Kubernetes, so Talos isn’t an option). Initially, I used Packer to generate a virtual machine image, which I would…
In my article on Authentik, I mentioned the possibility of having SSO on the Kubernetes API-Server. As a reminder, to enable OIDC authentication when using kubectl, you first need to configure the Kubernetes API so it can accept JWT tokens issued by a compatible OIDC identity provider (IdP). This is done by adding parameters to the Kubernetes API server command line: cluster: apiServer: extraArgs:…
In 2024, I wrote an article about Istio, a service mesh that manages communication between microservices. In that article, we explored a bit how mTLS works with sidecars (link to the chapter). It was a practical article, but we didn’t go very deep into the details. Today, we will dive deeper into this topic by exploring SPIFFE, which is the reference framework for workload identity…
When I present Talos, I often start by showcasing the speed of cluster deployment, the lightweight OS, the security, the simplicity of deployment, and I conclude by emphasizing that despite being minimalist, it is still extensible. To recap, Talos is an OS dedicated to deploying Kubernetes nodes. It is immutable and minimalist, with the unique characteristic that it is not managed like a…
At first, I didn’t really want to write an article about Omni. I thought I wouldn’t have much to say about it and that “it just works”… I didn’t expect to fall so much in love with this solution. First, let’s recap my context: I host a twitch live show every Monday evening (9 PM) on Twitch (sorry english-speaking friends, it’s in French). During…
If you are a regular reader of this blog, you already know that I am a huge fan of Talos, a minimalist and secure distribution designed solely to run Kubernetes components. According to the publication date of my article on this topic, it’s been almost a year that I’ve been using it daily (although in reality, I started much earlier). I still love this project and remain convinced of…
I have been using Github as an OAuth2 support for authenticating myself on applications for a while now. However, I have always been content with just following documentation without really trying to understand what was happening each time I wanted to authenticate. As a result, I have been motivated to write this article about SSO. The goal is to discover the mechanisms available to manage a large…
When you start working with Kubernetes, you quickly realize that managing communications between services is not so simple. As soon as traffic passes through an ingress, the only thing you can do to observe what is happening is to check the pod logs, which is neither practical nor efficient. This is why service meshes were created. They allow you to manage communications between services, secure…
I think many of us have our own collection of smart gadgets at home, connected to platforms like Jeedom, Home Assistant, or others. Personally, I have about ten sensors that allow me to monitor temperature, air quality, electricity consumption, and a few actuators to control lights and smart plugs. Most of my gadgets work with WiFi or ZigBee (a protocol used by Xiaomi, Philips Hue, Ikea, etc.). So…
Falco from A to Y# When managing a server fleet, it is often challenging to have visibility into what is happening on the servers. We can never truly know when a user is attempting to bypass our system’s security. Logs (if they exist) are usually buried in the noise, making it difficult to detect abnormal behaviors that could be a sign of an intrusion. Using a log aggregator like Loki or…
Introduction# The Web of Trust (WoT) is a concept used in the field of computer security and cryptography. It is a decentralized trust model that allows for the verification of digital identities and ensures the integrity of communications. In the context of public key cryptography, the Web of Trust is used to validate users’ public keys. Each user can generate a key pair, consisting of a…
GitOps# What is GitOps?# GitOps is a methodology where Git is at the center of delivery automation processes. It serves as the “source of truth” and is coupled with programs to continuously compare the current infrastructure with that described in the Git repository. It should not be confused with CI/CD, which involves testing the application code and delivering it. Indeed, GitOps…
Introduction# For some time now, I have been interested in Talos, an operating system for Kubernetes. I installed my first Talos cluster in November 2023, and my “production” (composed of 3 Raspberry Pi) is now running on this OS. It’s a solution that has seduced me with its simplicity, security, and ease of administration. Today, I finally decide to write this page to introduce…
Loki is an open-source log management system designed by Grafana Labs. It is known for being user-friendly and highly performant. Loki is designed to be used with Grafana using an equivalent to LogQL, a query language similar to Prometheus’s (to learn more about Prometheus, click here). In this article, we will see how to install all the necessary components to use Loki and Promtail. We will…
Introduction# Vault is a secret management tool developed by Hashicorp. It allows for secure storage and management of secrets. In this article, we will see how to use Vault to manage your application’s secrets. Vault was released in 2015 and has become an essential tool for secret management. It is used by many companies for its flexibility and security. Its scope is wide, it can be used to…
Creating your own cloud at home?# I constantly use virtual machines to test scripts, host services, perform deployment tests, etc. I usually use Proxmox in my lab, and Libvirt at work. Recently, I have been deepening my knowledge of public clouds like AWS, GCP, Azure, etc. And if there is one thing that fascinates me, it’s how quickly you can create a virtual machine. I sometimes use…
Introduction# When you deploy an application on Kubernetes, it may need secrets to function. These secrets can be passwords, SSH keys, tokens, etc. But how do you manage these secrets? How do you store them? How do you share them with developers or allow developers to create them? For example, you want to define a secret corresponding to an API token. And in a GitOps approach, you store your…
What is Prometheus?# Prometheus is a monitoring solution created by SoundCloud in 2012 and open-sourced in 2015. In 2016, Prometheus became the second project to join the Cloud Native Computing Foundation (the first being Kubernetes). Prometheus is designed to monitor metrics from applications or servers. It consists of 3 parts: The query engine to retrieve metrics from exporters; The Time Series…
Tmux is a terminal multiplexer that allows you to create and control sessions. It is often used to run a command in the background and be able to close the terminal without stopping the process. When you start Tmux, it initiates a session stored (by default) in your /tmp directory. By closing the window, reopening a terminal, and running tmux attach, you can retrieve your processes. It is also…
IPFS (InterPlanetary File System) is a P2P (Peer to Peer) protocol that allows for the decentralized distribution of files. The term “InterPlanetary” highlights the primary goal of IPFS: to overcome the technical difficulties and constraints of communication between planets.
Dagger.io is a project that was announced some time ago by Solomon Hykes, and its philosophy caught my attention. It is a CI/CD service that allows running jobs in Docker containers. The added value of Dagger is that it is not limited to Yaml (like Gitlab-CI, Github Action, Drone.io) or a custom DSL (like Jenkins). It allows running jobs using Python, Go, Java, TypeScript, or even GraphQL code. It…
Introduction# Usually, when I start writing documentation, I always begin with a definition (often sourced from Wikipedia). Since the Wikipedia page for cert-manager is not very comprehensive (and also to be trendy and mention it at least once), I will ask ChatGPT to write this definition for me. Cert-manager is a certificate management tool for Kubernetes. It automates the generation, renewal,…
2026 - 5# Date Title Description 12/07/2026 Karpenter + Cluster API “My journey to autoscale an OVH cluster deployed via the Cluster API, using Karpenter and its cluster-api provider, with MKS as the management cluster.” 02/05/2026 Kloak: kernel-space secret injection via eBPF on Kubernetes “How Kloak intercepts TLS traffic from your pods at the kernel level with eBPF uprobes to…
Linkedin Administrateur système passionné par l’univers du libre et de l’open-source, je suis toujours à la recherche de défis et de nouvelles technologies à découvrir dans la gestion d’infrastructure et d’automatisation de tâches. J’apprécie d’ailleurs mettre à profit ma double compétence dans le domaine de l’administration système et du développement…
Administration d’Infrastructure Boot PXE avec NetBoot Introduction à DNSMasq
CI/CD# Dagger.io, a Universal CI DevOps# Cert-Manager Dagger.io, a Universal CI Creating your MicroVM cloud at home? Vault from A to Z Domotique# Awtrix Ulanzi + Domotic = ❤️ Infrastructure# Bootc and OSTree: Modernizing Linux System Deployment Cert-Manager Creating your MicroVM cloud at home? GoAuthentik from A to Y Karpenter + Cluster API Kloak: kernel-space secret injection via eBPF on…