Webpage of Henrik Gerdes
Native Keyless Authentication from AWS to Azure with Web-Identity TLDR: AWS STS Web-Identity-Token function allows secure, low maintenance authentication via OIDC for all none AWS Services at no additional cost. Perfect for Azure, OnPrem system or CI. Late 2025, I wrote about Reduce your Token-Usage for all non AWS-Apps which looked at the new AWS capability to authenticate from AWS to OnPrem…
Kubernetes & IPv6 Let’s bring some technologies with very different adoption metrics closer together: Kubernetes is just over 11 years old, as of writing. IPv6 is from 1998, that’s more than twice the age of k8s with 27 years. Some early deployments are even older. While Kubernetes is nothing but a success story, IPv6 has a complicated history. Based on Google data , IPv6 just hit 50% of traffic -…
Gateway API doesn’t solve real problems - yet 🧾📖 PDF version Disclaimer: This tells my personal experiences with the Kubernetes Gateway-API and shows the value Ingress-Nginx provided. My takeaway : Gateway API makes hard things possible - but easy things hard. Why the Change? The Kubernetes steering committee shocked a lot of people when they announced the retirement of the…
Reduce your Token-Usage for all non AWS-Apps with AWS Web-Identity-Token TLDR: AWS new STS Web-Identity-Token function allows secure, low maintenance authentication via OIDC for all none AWS Services at no additional cost. Perfect for OnPrem system or CI. AWS enabled a new functionality within their secret-token-service (STS) which basically is a free and managed OpenID Connect (OIDC)…
I can’t recommend Grafana anymore Disclaimer: This tells my personal experiences with Grafana products. It also includes some facts but your experience may vary, and I would love to hear your take. I started my work life at a small software company near my university. They develop, run websites and operate web services for multiple clients. Everyone had multiple responsibilities, and they heavily…
Rootless GitLab Runners TL;DR: Rootless Docker has become easy! You can also easily run the GitLab Runner binary with rootless Docker without impacting workloads with rootless-kit. Even run buildkit, dind and docker build! See the HOW-TO! GitLab CI is the biggest CI/CD system after GitHub Actions and is the preferred solution for self-hosted and enterprise SCM-Systems. While GitHub gives you…
Follow Up: Let’s talk about anonymous access to Kubernetes TL;DR: Kubernetes default anonymous-auth allows unended information exposure, but disabling it was hard. Now you can limit anonymous-auth to specific paths only. In 2023 Rory McCune (raesene) wrote a nice blog post about Kubernetes anonymous-auth flag, which is enabled by default. While security mechanism like RBAC are still applied,…
Level up your Ansible Code - Creating Golden Images TL;DR: The combination of Ansible and Packer can be a terrific solution to improve provisioning time, increase reliability and reduce stress on other infrastructure. Run Packer once with your existing Ansible-Config and reuse the resulting image a 1000 times. So the story usually looks like this: You became tired of doing the same web-server base…
Understanding modern day Authentication with OAuth2 and OIDC ℹ️ This post was written in the context of my employment at ARES. While it does not promote any software or solutions from which ARES or I will benefit off, it is written in a more cooperate tone. The german version can be found at my company’s website. Authentication is hard. Especially when the traditional concept of a trusted network…
What is new in containerd 2.0? Containerd recently released its first major update since its 1.0 release form over 7 years ago. It provides some exciting new features, improves compatibility, gets rid of some deprecated functions and may even improve performance. This post aims to give a high level overview of the changes made in containerd and takes a closer look into the user-namespaces…
Improving OnPrem Kubernetes & making it feel like managed k8s Managed Kubernetes services like AKS, EKS or GKE are awesome. The hyperscaler’s take away so many annoying and difficult tasks. When you use a managed Kubernetes offering, you don’t have to deal with the controlplane, no etcd backups and provisioning of new nodes is fast and painless. A very nice feature of these managed Kubernetes…
New Website - Abandoning JavaScript frameworks This is the third generation of my website. I went from raw handwritten HTML to falling into the JavaScript frontend framework pit, back to raw HTML with a little templating. Let me tell you about this journey and my thoughts. Be aware that I’m not a web-developer and I will never be one! My First website - Getting things out there I was still in…
The Engines that run our Kubernetes Workloads 🧾📖 PDF version Target audience: This article is a deep dive for people living the Kubernetes lifestyle, for people who know or want to know how the low level stuff works and performs. I do not explain every container or Kubernetes component as it is expected to be known. Kubernetes has become THE standard for container orchestration. It is not just a…
Using GitLab to manage Kubernetes access Recently I have been tasked to share access to a Kubernetes test cluster with other teams. Easy: Add them to a group in your OIDC provider and set appropriate RBAC rules. Task done - no need to write this. BUT: Unfortunately I can’t have an OIDC provider for non-production clusters… because. Sighs… TL;DR Use Kubernetes built-in OIDC authentication; if this…
The recurring problem of the Metrics Server and Insecure Kubelet certificate What is this about: Currently the kubelet, the client agent coordinating container lifecycle on each node, also runs a server, using a self signed certificate by default. Therefore any client connecting the the kubelet server, most prominent the metrics server, will not be able to verify the servers identity. Current…
Using AWS from GitHub without Credentials AWS allows external services to authenticate without any secrets, which increases security and also reduces management overhead. There is no need to create, distribute, or rotate any secrets. This short guide shows how to set up and use this federated identity concept. Pre-Requirements To follow this guide, you need: A GitHub repo with read/write…
Comparing GitHub Actions with GitLab CI/CD Introduction GitLab just announced the availability of their GitLab CI/CD Catalog (2023/12), which states a perfect opportunity to compare the current state of the two CI/CD systems of everyone’s favourite version control providers: GitLab CI & GitHub Actions. Disclaimer: While there are a lot of other CI/CD systems like Circle…
Building preconfigured OS images with Packer Introduction Hetzner Cloud provides a number of different operating system images to select from when creating a new virtual machine. These images provide the basic ground to get started with your service, but they are rarely configured according to your specific needs. Maybe you want to install a database or a web server, add a maintenance user, or…
Building and Cracking the Enigma - Part I As more and more parts of our lives are shifted to the internet, the subject of security is becoming increasingly relevant. Large language models (LLMs) and chat controls claim more and more personal data. A significant part of security on the internet is achieved through encryption. During the last few weeks, I have been increasingly engaged with…
Sending metrics to Azure - with Prometheus With this post, I want to provide a quick demonstration on how to send Prometheus metrics to Azure managed Prometheus. Let’s get stared. What is Prometheus Prometheus is an open-source monitoring system that scrapes (pulls) system and application metrics from supported targets. It is an graduated project of the Cloud Native Computing Foundation (CNCF) and…
Joplin: The notebook for Devs How do you keep your digital life organized? How do you store and structure your knowledge in the era of information (overload)? I struggled for sooo long to find a good solution for these problems, but all the systems I tried, every app I used, felt off . They didn’t let me do the things I wanted to, were slow to operate or were just too costly. I almost gave up and…
Broken NodeJS Apps due to security dot-release On July 7th the vulnerabilities CVE-2022-32213 , CVE-2022-32214 and CVE-2022-32215 where publicly disclosed. They affected all current NodeJS versions (v14.x, v16.x, v18.x)! The same day fixes for the vulnerabilities where released. My colleagues and I assumed a quick and easy deployment to spit these fixes onto our client’s production systems. A…
Productive Working - Be lazy & get things done - Part II My math teacher always told me that mathematicians are lazy and so should we. Only do the minimal number of steps to reach your desired destination. Whether or not these steps are simple in themselves is another matter. But somehow this phrase stuck with me. So here are my favorite shortcuts, scripts and tricks to get things done: Personal…
Productive Working - Be lazy & get things done - Part I My math teacher always told me that mathematicians are lazy and so should we. Only do the minimal number of steps to reach your desired destination. Whether or not these steps are simple in themselves is another matter. But somehow this phrase stuck with me. As I grow older I measured more value to my time. Doing my obligatory tasks…
Getting started with LaTex as a Dev About LaTeX LaTeX is a typesetting system that allows the user to write plain text, while the formatting is provided via markup tags, similar to HTML . It differs from WYSIWYG ( What You See Is What You Get ) applications like Word in that the final document must first be generated by a compiler. While the output of a LaTeX document is reproducible, minimal and…
One Day Build: WebApp to download Videos from Reddit It has become kind of annoying to download a simple video from Reddit. My sister wanted to save a video but couldn’t do it. So, I did what all programmers do - I wrote a small app. You can try it out here or use it via your terminal like described below . Some Background The URLs of videos on Reddit are not directly visible. You have dig through…
Install & Configure Promtail for Grafana Loki This post will demonstrate a reliable and easy way to install Promtail to your server in order to collect all system logs in a central place for proper monitoring. NOTE: This post will only cover the install and setup for Linux based systems About Promtail Promtail is part of the Grafana platform. The Grafana platform is increasing in popularity due to…
How to build a Docker image for a TypeScript based NodeJS project You just finished your TypeScript project and now you want to release it to the internet by using ECS, GKE, Azure or any other cloud service? Or maybe you just want to share it with your co-workers without having them to install and configure additional software. Docker is a great use case for this! This post shows demonstrates how…
More is comming soon Lorem ipsum dolor sit amet, consectetur adipiscing elit. Quisque consequat pretium mauris ac scelerisque. Sed semper egestas nisl. Integer tempus turpis mauris, eu dictum mauris porta id. Quisque nec ultricies erat. Mauris accumsan nisl velit, nec semper velit vehicula ornare. Pellentesque eu tortor ac ante finibus tincidunt. Phasellus tortor arcu, mattis id mauris a,…