This post was first presented as a talk at Data Innovation Summit 2025. What I’d like to talk to you about today is what the new and exciting world of data platform engineering can steal/learn from the world of infrastructure engineering (spoiler: quite a lot). To introduce myself a bit more and give you some context for this presentation, my background is originally physics, but I moved into the…
Last year we upgraded from flux v1 to v2, flux v2 being a full rewrite, splitting the single binary into a number of dedicated controllers to improve performance. We installed flux v2 to each of our clusters, and let it run for a while before revisiting it to see what needed tuning, and what improvements could be made. Controller behaviour and intervals As we dug down into the documentation, we…
At WG2 we’re coming close to having everything running in Kubernetes, which means that almost everything we deploy needs to be pulled from a registry. We have run our own local registry for some time now, to host both locally-built images and cached images from Docker Hub. We recently decided to improve the registry solution by implementing Harbor to scan images for vulnerabilities on upload, and…
At Working Group Two, we try to use CI/CD pipelines to automate all of our repetitive tasks when it comes to code and infrastructure deployment and testing, such as: running unit tests on each pull request building and running integration tests with bazel on every merge to the monorepo building container images and upload them to the registry scanning all images for security flaws running…
This is a more-or-less transcript of a talk I recently gave at our /dev/øl conference at RiksTV. The context was to talk a bit about some of the great features of Prometheus, and hopefully persuade my colleagues that we should move away from Datadog. Prometheus is an open-source monitoring system that gathers metrics from targets, stores the data in its database, and makes that data available for…
Bastion (noun) A projecting part of a fortification A special purpose computer on a network specifically designed and configured to withstand attacks If you deploy servers to a private network, then you also need a way to connect to them. The two most common ways methods are to use a VPN, or to ssh through a bastion host (also known as a jump box). Shielding services this way massively reduces…
Lately I’ve been working on building base AMIs for our infrastructure using Packer, and verifying these images with Serverspec. In the opening stages my workflow looked like: Build AMI with Packer Launch instance based on AMI Run Serverspec tests against instance This works fine, and could potentially be converted into a Jenkins pipeline, but it feels a bit clunky. My AMI is based on a running…
We have a legacy ELK-stack that has been struggling somewhat lately. We decided to make a new ELG-stack (Graylog replacing Kibana) in parallel, so that we could have both systems running with live data for some time before we flipped the switch. This meant that we needed to send the logs from the old ELK-stack to the new ELG-stack, specifically from logstash to logstash. Turns out the options for…
Lately I’ve been working on setting up a logging stack consisting of the ELG components - that is, ElasticSearch, Logstash, and Graylog. Obviously we’re doing automated installs of everything, but in the case of Graylog it turned out that the easiest way to configure most of the components was to do calls to Graylog’s own API. In the Graylog UI, the API can be found at System / Nodes and then…
Having just written a short git course using reveal.js, I was looking for somewhere to host it online, and I discovered that Github pages worked beautifully. Basically: Make a new empty repository in github (don’t let it do any fancy setting up for you) Commit the reveal.js presentation (the whole folder) to a branch called gh-pages The presentation should now (within a few minutes) be available…