Recent content on Chmouel's blog
Note: This article was partly generated with AI while I was learning Kotlin. It started as personal notes but turned into something readable enough to share. Also, Hugo renders it better than my text editor. You’ve seen Kotlin mentioned in passing. “Modern Java,” they said. “Null-safe,” they promised. “Works on the JVM, Android, browser, fridge, whatever,” they muttered. Here’s the deal: we’ll…
GitHub’s pull_request_target event presents a significant security challenge due to its access to the pull request within the target repository’s context. This can expose sensitive secrets to untrusted users submitting pull requests. For projects like Pipelines-as-Code (PAC), where interaction with multiple upstream providers (Bitbucket, GitLab, GitHub) is essential, this risk is…
I haven’t fully jumped on the AI hype train, but I’ve kept an eye on the evolving technologies of the past two decades. It used to be that Cloud was the buzzword, then Containers, and maybe blockchain (never got into this one), and now AI. At first, AI felt like a nice gimmick—discussing things with a chatbot felt a bit like doing a Google search but with a conversational twist. The problem with…
Introduction It has been a long time since I have blogged about Emacs. I still enjoy using it as when I started from day one (around 1998). I did made some changes I have now moved out of the Emacs keybindings toward using the evil keybinding and have become proficient using Neovim (for terminal editing) or Vscode (for the debugger) but Emacs is where my “home” is. Today I’d like…
I have a very complicated development environment, which spins up a local Kubernetes cluster on Kind and then deploys a bunch of services to it. Some of the services gets accessed by the browser and until late I was deploying everything on localhost which so far did not cause any issues, since the browser are good at trusting localhost. But since my laptop was getting slower and slower and I had a…
I use “Webhook” every day; it’s a simple mechanism used by most web applications to send payloads on events. It’s great and all, but since it needs to send you data, it has to be exposed to the internet. And that’s where it gets tricky. If you are in development mode and want to test the webhook, you can’t just expose your local machine to the internet; you need…
GitHub workflow is great but can be a bit of a black box when things go wrong. When the YAML cannot be validated, GitHub offers a handy feature to debug the workflow with additional logging . But sometimes your deployment or tests, or whatever you are doing in your workflow, fail when running on CI but not locally, and you are bound to end up in the git push/commit Outer-Loop hell: 📝 vi…
I enjoy the space cadet feature of QMK : https://docs.qmk.fm/#/feature_space_cadet The feature is simple but yet powerful, when you hit one press you send a parenthese open or close form the other side and if you hold it you have shift. I am not sure what happened to my config, but I could not get it to work with the default macros offered SC_LSPO and SC_RSPO . I dug into the process_record_user()…
Sometime the tiniest optimization makes a huge difference. When I am not using Emacs and dired I usually just use the shell with zsh to do all my file management. This is fine and great but sometime when I need to select multiple files with different names, I would have to do a lot of tabs and selection or copy and paste to select properly the list of files I want to do operations on.
Every time I press the [TAB] key in my shell, it bothers me that nothing happens. I’m not very smart, so I often press the [TAB] key multiple times, hoping that maybe the seventh time will magically produce the completion that I expect. However, magic is not a computer function, and if a user or command line interface (CLI) author has not provided a completion function, nothing will ever…
I have been meaning to write an article about tools that I have developed lately to make it easier for my day to day life work. Being a so called “Kubernetes cloud native developer” (don’t laugh at the title because I do) I have to watch a log of controller logs. Most controller logs output in JSON format which is a nice tool for computers but not straightforward to parse to the…
I was talking with a colleague about Rust and we were wondering (since we are both learning the language) how error handling compares to Go. Chaining error in Go Go’s best practice when you want to chain multiple errors is to “wrap” them. For example let’s say you have this function returning an error: func do_something () err { value := 'value' if value != 'expected' {…
On Pipelines as Code we started to get a nice documentation website on : https://pipelinesascode.com The website is statically generated with Hugo and hosted on CloudFares Pages using the markdown files from the repository. So far that’s a pretty standard stack, but what we wanted is to be able to get preview URLS like on Netlify or other CI s There is a nice check box, that says…
There is a lot of zsh plugin manager around : https://github.com/unixorn/awesome-zsh-plugins#frameworks They all allow you to add cool new features to your shell easily and for authors to easily share their plugin with users and frameworks. While a lot of people are probably using frameworks like oh-my-zsh which does everything for them with minimal setup. But since I have been using zsh since…
With the TektonCD CLI we have a system of “plugins”, it’s the same very simple CLI plugin system you have with git or kubectl, if you do a : kubectl blah foo --bar since kubectl knows it doesn’t have the blah command will try to go over the filesystem paths in your $PATH environment and sees if there is a binary called kubectl-blah and if it finds it will pass the arguments…
Expanding on my previous blog post on getting buildah to run with user namespaces or as rootless. There is another important security topic to talk about is how to run everything on OpenShift Pipeline as non root and not just the buildah task. On OpenShift Pipelines we made the conscious decision to run all the TaskRuns and Pipelinerun by default under a custom ServiceAccount called pipelines .…
In 2022 one of the hottest topic around CI is how to secure it every steps along the way. The so-called supply chain attacks have been more and more an attack vector for bad actor whereas providers need to make sure every piece of the Integration is secure. One area that was identified as something we can improve with Openshift and containers in general is when running as root on the container may…
Feels weird or great or stupid or pretty smart or whatever to be wrong. Just when I wrote that previous blog post : https://blog.chmouel.com/2021/11/14/for-the-love-of-centered-windows/ that I realize that shell script doesn’t work great on wayland. I didn’t really understood how Wayland works and just assumed that my tiny scripts just works. But experiencing not working on a native…
Sometime over a 2020 confinement my work decided to give us some money to buy some work from home office items. I didn’t need much at that time since I was already settled with everything I needed in a work from home office but decided to go for a fancy new screen since well why not and the other one (a standard 24" display) could find some good use for my teenage gamer son.
One of the early goals of Pipelines as Code on Tekton was to ensure the project’s CI could run using itself. The common use case of validating pull requests was quickly implemented, and you can find more information about it in this walkthrough video: For slightly more advanced use cases, here is how we created a release pipeline for the project.