Recent content on Code Engineered
Helm v4 has been released after a year of development . There were a number of people who have contributed to Helm v4 and I want to say a big Thank You to them. A subset has been instrumental is getting Helm v4 to where it is. They have given a lot of their time and I, like many others, appreciate it. That includes (but isn’t limited to): Robert Sirchia - In addition to contributing code, he…
10 year ago I had my first commit against Helm . This is my 10 year anniversary. commit b64d701023830999750c570a9224fa9dd3eb4a22 Author: Matt Farina <matt@xxxxxxxxxx.com> Date: Wed Oct 28 13:52:21 2015 -0400 docs(README): add Go Report Card badge I had been around the Kubernetes space for awhile and I have long known Matt Butcher, who had the first Helm commit. He showed me Helm and I found my…
I’ve had the same terminal setup for years. Every year it gets some minor changes, usually in the form of additions. Over time, the whole setup has slowed down and fell into a state of being a mess rather than optimal or thought out. With the release of Ghostty , it seemed like a good time to rethink my whole setup. Ghostty Ghostty is the creation of the famed Mitchell Hashimoto . He’s…
I get asked a lot of questions that involve Semantic Versioning (a.k.a. SemVer) . I also get told that something some piece of software does around it is wrong. Having spent far too much time dealing versions, this post tries to clear up some of the more common misconceptions. What Is SemVer? Semantic Versioning, often referred to SemVer, is a specific way to deal with computer software versions.…
When I read about the use of Tiller in the article on SAP AI vulnerabilities , I was a bit surprised. The article came out around three and a half years after Helm v2 - which includes Tiller - reached its end of life. It had been even longer since the last Helm v2 release. Looking at the downloads of Tiller, I was surprised to find tens of thousands of downloads each week. The image blew is the…
There are fewer contributors to CNCF projects than there were a few years ago. During that time, there has been an increase in the number of projects in the CNCF. I’ve been wondering what the data can tell us about what’s going on. Here’s what I’ve found from my preliminary review of the data. Note A decrease in contributors is neither a good or bad thing. We would need to dig deeper to understand…
Every month, new projects are submitted to the CNCF Sandbox in hopes of having their project join the CNCF. But, there’s a bunch of things that often escape the attention of companies and project maintainers when they submit their projects. It’s all in the fine print but, how often do we read that and realize what it means. With that in mind, let’s take a look at some things…
I just finished a two year term on the Cloud Native Computing Foundation (CNCF) Technical Oversight Committee (TOC). Being too busy to dedicate the time it deserves, I didn’t run for another term. Before I put the TOC out of my mind, I wanted to take some time and do a retrospective. I’m hopeful this is useful for the future TOC members and the broader cloud native community who…
Over the years, I’ve been asked a lot of questions about why the Cloud Native Computing Foundation (CNCF) has done things the way it has. I’ve also seen people speculate about things that are going on and reasons for it. Quite often, developers are missing some context or understanding about what the CNCF is or how it operates. The CNCF often doesn’t operate the way project…
Kubernetes was birthed from tooling for on-premise data centers. So, it should be no surprise that it’s incredibly useful in on-premise situations like clusters. And, while the collective “we” often looks at the public cloud with Kubernetes, it’s worth looking at clusters in our offices, labs, and colocation data centers . Borg And Google Data Centers Kubernetes was birthed…
Maintaining several open source projects, over the years, I’ve seen a common request. That the project either produce builds or a wider variety of builds. For example, to build for a new architecture or to provide the software as a container or Helm chart. I see a couple common expectations. First, that the open source project is the right place to do the builds. Second, that a project…
Docker has decided to sunset free organizations on Docker Hub . This has created some feelings of unrest in the open source community at large . There is a program for open source projects . This got me wondering, why is Docker Hub the go to location for container images? Why don’t more projects use GitHub Container Registry, Quay, or one of the many other registries? The answer is simple…
While I was looking at where CNCF contributors are in the world I also wondered, how to the Technical Oversight Committee (TOC) members overlap with these locations? To summarize the data, contributors are distributed around the globe (mostly in the northern hemisphere) fairly evenly in North America, Europe, and Asia. The TOC is responsible for defining common practices across projects, approving…
It has long been suggested to me that contributions to the CNCF are mostly United States centered. At times people use that to justify various things from the times meetings are scheduled for to the way certain things are prioritized. I was wondering, how true is this notion? To find out, I decided to see what devstats made available. What I found was enlightening. Ways To Look At The Data There…
I was recently asked about an error someone got with Helm and GKE . The error provides some insight into how semantic versions work and how to work around cases where someone isn’t following them. The specific error was: Error: INSTALLATION FAILED: chart requires kubeVersion: >= 1.19.0 which is incompatible with Kubernetes v1.23.8-gke.1900 This error is specific to the kubeVersion optional…
Several months ago, I moved from working on Rancher Desktop to work on Fleet . At the time, there wasn’t much development of Fleet and there were a lot of questions with it. Some of those were around feature requests, some of those were around bugs, and some of those were around the level of SUSE Rancher investment in Fleet. I think actions speak louder than words. Now that we have two…
Disclaimer: I work for SUSE but I don’t work in the Linux business unit. I’m a consumer of the base container images like anyone else who uses them. If you’re building a containerized applications you have a base container image at the bottom. That base container image can make a difference to your stack. Is it really large which impacts what you pass around on the network and…
SLSA , the supply chain security project, as a model for attesting and verifing software artifacts. The project documentation has a whole section on software attestations . The SUSE SLE Base Container Images (BCI) are attested and you can verify them. Basic Example To follow along with the examples you will need to have cosign installed. This software lets you attest and verify images.…
I’ve been regularly asked about comparisons between Docker Desktop and Rancher Desktop . As I have moved off of Rancher Desktop to work on other things at SUSE, I figure now is a good time to write up some of my thoughts. Note, there is an amazing team working on it now. They are incredibly talented and have made it better than I imagined. First, I need to say what respect I have for the…
Go has a logging mess. If you want to see it in action open up a Go application and look at the number of logging implementations that have been pulled into the application. For example, if you look into the Kubernetes modules you’ll find it’s using zap, logrus, klog, and others. This mess can lead to applications not exposing logs, binary bloat, and more. It also inverts control.…
When I’m doing local development, I sometimes need a domain name that routes back to localhost . I’ve long run into cases where I need subdomains and ended up modifying my local hosts file. I’ve used this for a variety of situations going back for a long time. From Kubernetes ingress work to web development. While I was reviewing the NGINX ingress guide for Rancher Desktop , I…
SUSE has SLE Base Container Images (BCI) that are great to use in workflows and as a based under your applications. One of the big reasons I like these images is that they are constantly updated with fixes for Common Vulnerabilities and Exposures (CVE). SUSE stays on top of this and takes security seriously . For example, prior to writing this post I used Trivy to scan the Go image: ❯ trivy i…
At the end of 2021, a new version of Rancher Desktop came out that provides the Docker CLI and a dockerd socket as an alternative to nerdctl and containerd . In this post I’ll cover some details on why and how we did it. Why Docker/Moby nerdctl has been a great CLI for many things. You can build images and run containers with it. But, you can’t do everything you can with the Docker…
When I recently bought a Framework laptop , one of the tasks I needed to do was to choose a processor. When I bought Mac computers there were few things to think about in terms of processors. A more expensive processor just meant more power. The processors available in Framework laptops don’t quite operate on that model. In some cases, you may get more features and not more power. Are those…
It was time to replace my 7 year old Macbook Pro. Two cores running the latest macOS was not longer capable of easily doing everything I threw at it. Instead of buying another Macbook Pro I went a different route. After close to 20 years of having a personal Mac laptop, I switched to a Framework laptop. This is the reasoning behind the move. Framework Laptop Framework is a new laptop from a new…
Almost everywhere I look, IT is treated as a cost center. Their goal is often to cut costs (expenses) to be as low as possible. But, this isn’t working well for them or the companies that treat things like this. In companies like this you end up with shadow IT, lines of business who are held back (which hurts income), or a little of both. Let’s explore what this means. The Customer of…
The Docker CLI has some competition in the form of podman and nerdctl . Recent changes in the Docker ecosystem have caused some folks to start looking at what the other options are. Since these are two of the most capable Docker CLI alternatives, it’s worth looking at them. Who Owns The Code Since the recent uptake in conversations on this topic are driven by changes to Docker you might be…
I review a lot of pull requests for Helm , the package manager for Kubernetes. While reviewing, I’ve noticed some common pieces of advice or guidance I give along the way. This post documents some of those. Don’t Change APIs In minor and patch releases of Helm we don’t change APIs. Helm follows semantic versioning and we have documented our backwards compatibility . This is both…
Always Be Connecting Dots (ABCD) I think it was Rajeev Pandey who shared this with me. Technology is complicated and getting more so. Take Kubernetes as an example. To understand the environment that created it, it’s useful to know how Google builds their data centers and about the cluster operating system they use ( borg - a predecessor to Kubernetes). It’s also useful to know the…
A Call To Minimize Distraction & Respect Users Attention is a recently hyped presentation that was shown internally at Google years ago and leaked at some point. After looking at the presentation, which I believe is very much worth looking at, I realized there were two concrete reasons to minimize distraction that mattered to me and many people I talk with. Deep Work and Getting Things Done Deep…
The first have of 2021 has been quite a half year at SUSE / Rancher. Numerous new open source projects have been launched covering a wide array of areas. I’m enjoying seeing all the innovation taking place as these new projects try to find their footing. These are in addition to projects like Harvester that started in 2020. Let’s take a look at some of these projects… Rancher…
When we started working on Hypper we knew there would be an SDK and a client in the codebase. From the beginning, we wanted the core business logic to be easily accessible for other applications to use. This meant we needed to have logging that worked for a CLI application and when the SDK was pulled into an app. All of this written in Go due to the need to pull in some outside libraries only…
In November 2016, Operators came on the scene. They have since been embraced by the Kubernetes community for many use cases where there are frameworks and ecosystems surrounding them. In the years after the announcement, CoreOS, the company that started the operator craze, has been bought and that company has been bought. The CoreOS website and docs, where all of this came out, are no longer…
Have you ever wondered how Helm’s source code was organized? Or wanted to know where to start when fixing a bug or creating a new feature for Helm? Trying to learn a new codebase can take some time and feel daunting. To help with that problem I created a short series of short videos that walk through the code organization, life of a command, testing, layout of the package library, and more.…
When you’re writing libraries and applications in Go there is one glaring problem. Logging is all over the place. This is due to there being no standard interface for logging. So, libraries and applications both include logging libraries that are different from each other. This leads to log sprawl. For example, look in the Kubernetes dependencies and you’ll see references to about 10…
Did you know that you can store more than container images in many container registries? Container registries generally follow the OCI Distribution specification . While still unreleased, as of the writing of this, there have been recent changes that make the type thing (a.k.a artifact) stored and distributed through registries more general. This work was started though a project called OCI…
Have you ever found a code snippet on a blog or some other website that helped you out? One you just wanted to copy into a software project you were working on. Unfortunately, quite often the code on that website isn’t licensed for someone to take and use in their own software projects. It may not seem like a big deal to take that code snippets and use them anyway. The problems starts to…
When JFrog announced they were sun setting Bintray and ChartCenter I quickly had a couple of thoughts… I was relieved we didn’t move the Helm stable and incubator archive to ChartCenter (it was an option) I wondered what Homebrew was going to do. Homebrew stores bottles in Bintray and the project has to deal with a new setup and migration When Helm had to move the stable and incubator…
Have you ever wanted to understand package management in Kubernetes? Helm is the package manager for Kubernetes and there is a whole ecosystem of packages you can install or you can create some yourself. If you want to understand it through a book, where can you go? Learning Helm is a book written by Matt Butcher (co-creator of Helm), Josh Dolitsky, and myself. Each of us is a core maintainer of…
I’ve watched software developers argue about the right way to do things for most of my career. Sometimes it’s around the technologies or patterns that are acceptable to use. Sometimes it’s around the right things to have as part of the interview process for candidates. I’ll illustrate this with an example many can relate to. Many companies ask people to do code interviews…
There are now many charts (packages) for Helm , the Kubernetes package manager. These charts are provided by companies, like Bitnami (part of VMware), open source projects, and individuals. These days, the charts are hosted in a distributed manner where these different people and groups can host them on their own. To aide in discovering these distributed charts, there are now multiple services you…
Using kubectl exec to execute commands in a container is a powerful feature for Kubernetes. It’s especially useful for debugging applications. But, it can also be a security risk and some policies require you to disable this feature. So, how can you do it? The Need If we look at similar systems, for example systems that control access to ssh, we will see the need is more than an explicit…
On June 10th 2020, Mike Vizard writing for the Container Journal wrote: As IT organizations look to operationalize what may soon become fleets of Kubernetes clusters, the amount of time required to deploy applications on those clusters will need to be greatly reduced. Helm provides a means of accomplishing that goal using an open source tool that is not going to fade away anytime soon because of a…
Artifact versions regularly change and new releases come out. Cloud native software changes and it can be difficult to stay on top of the changes. Notifications and webhooks when updates come out are rarely available for consumers. The Artifact Hub is different. It now provides notifications and webhooks, that you can use for programming, when new releases of packages come out. Email Notifications…
Helm v3 uses Kubernetes Secrets as the default method to store release information in a cluster. This bucks some newer trends, but if you look at the needs and features it turns out that Secrets are a good fit. In this post you’ll learn why Helm uses Secrets by default and how you can do something similar if Secrets fit well for you. Why Secrets? Custom Resources based on Custom Resource…
Naming things and anti-patterns are two things that have fascinated me. So, when Marc Atwood tweeted with a name for an anti-pattern I’d personally experienced I was excited to have a name to it. Marc tweeted : today I asked a master of naming antipatterns for a name for the practice of naming directories in an evolving project after version numbers, instead of just using the VCS. His…
I have a Linux workstation I regularly use and I need to develop in Go on it. So, I want an easy way to install and upgrade Go. With Go, I need to use the latest version and usually don’t want the version I would get with apt-get or the systems conservative package manager. I’ve become accustomed to using one command to install Go and a similar command to upgrade it. Install Go: $…
One of the really powerful new features in Helm v3 is the use of JSON Schemas . This is great for validation, documentation, and it can be used for automated form generation . We’ll take a quick look at what they are, how you can generate them (i.e. you don’t need to write the whole thing by hand), and how they can be used to generate web forms. JSON Schema The basics… when you…
Graduating a CNCF project is no small feat. As someone who took Helm through the graduation process I thought it would be useful and interesting for people to learn about it. This can illustrate what the CNCF looks for in a mature project and what other projects that look to graduate can look forward to. A Little Background When the CNCF first launched and Kubernetes became the first project, Helm…
Many of the cloud native and CNCF projects are based around artifacts that you can use and share. Helm has charts, which is an obvious case. It doesn’t stop there. Open Policy Agent (OPA) has policies. Falco has configurations. Then there are operators. Operators can be deployed using Helm, KUDO , the Operator Frameworks OLM, and even raw Kubernetes manifests. It turns out there are a lot of…