Software Engineering, Security, and Cloud Native Technologies
CoreDNS is the DNS server that powers most (all?) Kubernetes distributions, ever since it was made the default in v1.13 in December 2018. Chances are, you’ve never heard of or used its predecessor: kube-dns . Lucky for us, CoreDNS still has a config option to remind us. pods insecure is the default configuration option for most (again - all?) Kubernetes distributions, and was introduced as…
GitHub Actions are a powerful way to automate your software development workflows, and manage them right in your repository. Even though they are becoming ever more popular, there is little movement to invest in tooling to make them more secure… at least until recently. In the last few weeks I have seen posts about zizmor and poutine . After a bit of digging I was also able to find octoscan…
Cloudflare has recently open-sourced the OPKSSH (OpenPubkey SSH) implementation , which they got as part of their acquisition of BastionZero last year. Since I am big fan of Sigstore , and this is very much in the vein of it, I wanted to take it for a spin! What is OPKSSH? OpenPubkey SSH (OPKSSH) removes one more instance where we have to do manual key management: SSH keys . It uses single sign-on…
A good Identity and Access Management (IAM) system is often overlooked in smaller environments and homelabs. Why is that? We know that most enterprise use them, and for good reasons! They provide a central user directory to efficiently handle on-/offboarding for both human and technical users, make logging in to services easy, and granting permissions painless. Yeah right… let me know if…
Up until this point, we have only persisted data in K8s’ etcd database. Stateless workloads are nice, but at some point we want some of our data to survive a pod restart. In this part we will setup a basic NFS server to provide persistent storage and then make it available to our workloads using the NFS Subdirectory External Provisioner . We could have used Longhorn , OpenEBS , or Rook for…
Last time , we added ingress-nginx to our cluster so that external traffic can hit our services. In this post, we will secure that traffic using TLS. Since I am using a *.dev domain, it comes with the blessing (or curse?) of having HSTS preloaded in most modern browsers , but even without that enforcement we want to protect all traffic using TLS. In 2025, there’s no reason not to use TLS:…
Last time , we added automated dependency updates to our cluster. In this post, we will get traffic into our cluster, by setting up an Ingress controller and a load balancer. Networking Options To get traffic into our cluster, we can pick from a few options: Node Ports are built into K8s, but annoying for end-users as they run on high port numbers Ingress enables us to route HTTP traffic based on…
Last time , we set up Cilium and Flux to enable networking and GitOps for our Kubernetes cluster. In this post, we will add automated dependency updates to it. Dependency Management Notice, in our Cilium configuration, we referenced the desired version of the Cilium Helm chart using a specific tag. sourceRef : kind : HelmRepository name : cilium version : 1.16.5 Many ecosystems allow you to…
Last time , we left our Cluster in a semi-happy state: The nodes were up, the control plane was available, but we had no cluster network. Today, we will fix that, and a bit more. Local Access First, let’s make sure we can access the cluster from our local machine. I like to keep my SSH configs modular. So we create a new file: Host control-plane-01 HostName 192.168.1.16 User ubuntu Host…
First things first, we need some nodes that make up our cluster. I will be using libvirt to manage my VMs, as I wanted an excuse to try out the dmacvicar/libvirt Terraform provider. I’m excited to see how this rather bare-bones approach will compare to using solutions like unRAID , Proxmox or Vagrant . Still, this chapter is rather self-contained, so if you decide to go with any other…
The year was 2024, Cyber Monday was rolling by and my manager pointed out that I still had a budget available for training and certifications. One purchase of a Kubestronaut Certification Bundle and a few weeks later, I kinda have to face it: I need a new home lab. Motivation So why a home lab exactly? Well, I have a few reasons: It’s fun. Haven’t we all have a pile of hardware lying…
Lots of people ask for advice on how to get started in open source. What works for me is to - instead of jumping straight into the code - become a user first! The chances are high that you either: Run into a problem: A great opportunity to start a conversation on how to improve documentation, update build requirements for your platform or fix broken scripts. or discover a missing feature for your…
Popularized by Google [1] [2] , Haunted Graveyards are pieces of code that, while providing a business value, are so ancient, obtuse, or complex that no one dares enter them. Every organization has them: From one-off integration software for that one customer with deep enough pockets, to code that was hammered out too quickly to make the KPIs happy. The reasons for their existence are manifold,…
Everything started with a simple question: “Why does my laptop get hot watching YouTube?”, and led to a rabbit hole of hardware acceleration, Chrome flags, and Intel iGPU monitors. Alright 44°C isn’t that hot, but it’s the principle of the thing! What is Hardware Acceleration? Even though (Intel) CPUs are general purpose processors, they include specialized hardware and…
After attending SigstoreCon, I got inspired by Priya Wadhwa’s Keynote: Signing Git Commits with Gitsign , to finally set up gitsign for my dev environment. It seemed straightforward enough, right? Following the instructions I am mostly working with VSCode using their amazing SSH remote extension . After following Priya’s configuration example, the browser opened on my local machine,…
In a previous post , we explored how to generate a Software Bill of Materials (SBOM) and subsequently scan them for vulnerabilities . In this post, we show you how SBOMs can be signed and then stored in the same container registry as the scanned image. This improves security & discoverability! Why should I sign my SBOM? Up until now, our generated SBOM is a plain JSON file with some metadata and a…
In our last post , we explored how Software Bill of Materials (SBOMs) provide us with a transparent view of all dependencies in Constellation. In this post, we explore how we can use this information to continuously monitor vulnerabilities and upgrade to patched versions as soon as they are available. Grype Grype is a vulnerability scanner for container images and filesystems. It supports reading…
Constellation is an infrastructure product and includes several different components: A command-line interface (CLI) manages the life-cycle of the Confidential Kubernetes cluster In-cluster services provide features such as key management and secure node administration A node operator handles upgrades of cluster nodes All of these components could include a dependency with known vulnerabilities!…
After integrating cosign into the release process of Constellation ’s CLI, I also wanted to improve the supply chain security of our metadata that are used for attestation. Using cosign CLI for signing and verifying blobs or container images is a well documented process. The sigstore/sigstore project is the common go library for all sigstore services and clients and has documented public…
This is a summary of the talk I gave at the Kubernetes Community Days (KCD) Berlin 2022. Both, the slides and a recording are available. After working 5 years with cloud native technologies to enable key & certificate management in automotive enterprise security, I was amazed to discover how many Confidential Computing (CC) use cases are possible today. When joining Edgeless Systems, I learned…
Status: Complete, action items in progress. Summary: unRAID’s OS Flash Device failed undetected for 14 days, preventing server to successfully reboot, taking all internal services down, including pfSense VM which prevented home network from accessing internet. Impact: 2 hours of limited internet access (mobile data plan). Internal services still offline, due to broken configuration. Root…
Since DNS:NET provides support only for a limited number of supported routers, and pfSense is not on that list, I will share my configuration here. This guide is aimed at pfSense Community Edition Version 2.5.x . In the following configurations, parameters that are omitted should be left empty or with their default value. This configuration assumes that the WAN port is called em0 . You can check…
VirtualBox GUI is slow for repetitive tasks such as starting & stopping virtual machines. In addition, some tasks such as starting VMs headless is not possible at all. On the other hand, VBoxManage.exe with its 842 lines of unsorted help output is unwieldy for everyday use. To get around both limitation I like to keep a few batch files on my desktop for recurring tasks. Start One script for each…
Hosting multiple containers on unRAID, and keeping track of their port mappings can become quite annoying. Using a reverse proxy as a single point of entry will allow us to hide this from the user, and use easy to remember DNS records instead. In this example we will use Traefik 2.x as a reverse proxy on an unRAID 6.8.x machine, and configure easy access to the unRAID webUI, Traefik dashboard, as…