About
Hi! My name is Maël, I am a software engineer based in Toulouse, France. I mostly write Go, Kubernetes controllers and n...
maelvls dev blog
Recent content on maelvls.dev
Latest posts
print-your-cert redirect
Logging into Synology NAS with Personal Google Accounts
Learn how to simplify access to your Synology NAS by enabling single sign-on (SSO) with personal Google accounts.
mitmproxy hangs on TLS renegotiation: a debugging story
I often use mitmproxy in order to see the HTTP calls that programs are making under the hood. vcert, a tool used for operating Venafi TPP and Venafi Cloud, did not seem to be working with mitmproxy. This post presents the steps I took to discover that the issue comes from an unsupported feature of mitmproxy: TLS renegotiation.
Writing useful comments
We often talk about avoiding unnecessary comments that needlessly paraphrase what the code does. In this article, I gathered some thoughts about why writing comments is as important as writing the code itself, and how to spot comments that should be refactored using the 'what' and the 'why'.
It's always the DNS' fault
Terms A domain name (or just “domain”) is a string the form bar.foo.com.. Not all domains refer to physical ...
Understanding the Available condition of a Kubernetes deployment
Although the Kubernetes documentation is excellent, the API reference does not document the conditions that can be found in a deployment's status. The Available condition has always eluded me!
Pull-through Docker registry on Kind clusters
Kind offers an excellent UX to Kubernetes developers but lacks support for caching images; each time you recreate a new cluster, all the previous downloaded images are gone. In this post, I explain why the default Docker network is a trap and how to set up a registry & make sure that it actually works.
Using mitmproxy to understand what kubectl does under the hood
Mitmproxy is an excellent tool that helps us understand what network calls are made by programs. And kubectl is one of these interesting programs, but it uses a mutual TLS authentication which is tricky to get right.
Epic journey with statically and dynamically-linked libraries (.a, .so)
Dynamic libraries and PIC (position-independant code) are great features of modern systems. But trying to get the right library built can become a nightmare as soon as you rely on other libraries that may or may not have these features in the first place... In this post, I detail the hacks I made to the ./configure-based build system of Yices, a C++ library.
Github Actions with a private Terraform module
Terraform makes it easy to manage infrastructure at scale; you might want to share code between modules, and that's where it becomes tricky. In this post, I try to give some clues on how to use terraform across private Github repos.
Learning Kubernetes Controllers
Kubernetes' extensibility is probably its biggest strength. Controllers and CRDs are all over the place. But finding the right information to begin writing a controller isn't easy due to the sheer amount of tribal knowledge scattered everywhere. Here are some links to help you start.
The Client-go Transitive Hell
Client-go is the client library that allows anyone (including Kubernetes itself) to talk to the Kubernetes apiserver. Recently, the Kubernetes team chose to release a breaking version of client-go that adds support for context.Context, without really giving anyone notice. In this post, I detail the workaround and what that happened.
How do packets find their way back?
In one of my previous posts, I studied how traffic flows when using Kubernetes Services. While drawing the last diagram, I did not clearly see how traffic could make its way back to the user. In this post, I focus on how packets find their way back and what makes stateless rewriting interesting.
The evolution of my home office from 2019 to 2022
I present what hardware I have been using and what changed between 2019 and 2022!
Migrating from GKE to Civo's K3s
My free trial on GKE was ending in 2 days and I had to find a way to migrate away. I decided to switch to Civo's managed K3s.
The Packet's-Eye View of a Kubernetes Service
The Service and Ingress respectively brings L4 and L7 traffics to your pods. In this article, I focus on how traffic flows in and what are the interactions between the ingress controller and the service-lb controller (the thing that creates the external load balancer). I also detail how the `hostPort` approach shapes traffic.
Debugging Kubernetes Networking: my kube-dns is not working!
Some pods were unable to connect to the kube-proxy pod on one of my GKE Kubernetes clusters. This post present an in-depth investigation using tcpdump, wireshark and iptables tracing.
Avoid GKE's expensive load balancer by using hostPort
I want to avoid using the expensive Google Network Load Balancer and instead do the load balancing in-cluster using akrobateo, which acts as a LoadBalancer controller.
Nice diagram about TLS, certificates and keys
ROLE OF THE CERTIFICATE AUTHORITY +------------------------------+ +-----------------+ CERTIFICATE AUTHORITY (NOT A CER...
What to do when Go ignores HTTP_PROXY for 127.0.0.1
At some point, the Go team chose to disable the proxy for requests coming from localhost or 127.0.0.1. This is annoying when debugging services locally.
Go Happy Path: the Unindented Line of Sight
Readability is a property we all love about Go. In other languages, it might be fine to have a lot of nested if statements; in Go, it is a good practice to keep away from overly-nested logic.
Why is GO111MODULE everywhere, and everything about Go Modules (updated with Go 1.20)
GO111MODULE is all over the place. It appears in README install instructions, in Dockerfiles, in makefiles. On top of that, the behavior of GO111MODULE has changed from Go 1.11 to 1.12, changed again with Go 1.13 and Go 1.15 and changed a last time in Go 1.16, and is stable since then.
What the heck are Conditions in Kubernetes controllers?
Although progress is being made, Kubernetes controllers and operators still require prior knowledge about Kubernetes internals. Information on how to set the status is scattered across comments, issues, PRs and the Kubernetes code itself. Conditions may be a good solution for your controller, but for what?
Stuff about Wireshark
tcpdump -i eth0 -U -w - 'not port 22' | wireshark -k -i - wireshark -i en9 -k -Y "ip.addr == 35.211.248.124 ...
How client-server SSH authentication works
Difference between CA and cert Ssh authentication themes Case A: unknown host Case B: host already in known_host but ip...
Use the Bootcamp partition under VirtualBox
From: https://apple.stackexchange.com/questions/220670/run-boot-camp-windows10-partition-inside-virtualbox First, find w...
Notes on OAuth
I know two main ways of using OAuth2 password-based client grant (2-leg oauth flow: on the project I worked on, the OAut...
Some kubectl stuff
kubectl run --generator=run-pod/v1 tmp-shell --rm -i --tty --image nicolaka/netshoot -- /bin/bash gcloud ssh ... docker ...
Memo for Tmux
I installed https://gist.github.com/cybic/6375457 in ~/.bash_completion (file) to get the bash completion. General short...
Checking info about CPU and Nvidia GPU on Linux
If there is a Nvidia card: nvidia-smi Otherwise: cat /proc/cpuinfo lscpu
Using dd
sudo dd if=$HOME/Downloads/elementaryos-0.4.1-stable.20170814.iso of=/dev/disk3s1 status=progress df -h diskutil unmount...
Remote Docker using docker-machine
Use docker-machine for remoting docker docker-machine create --driver generic --generic-ip-address=141.115.74.15 --gener...
Run the test suite of the Gitlab projet
From https://docs.gitlab.com/runner/install/linux-manually.html sudo wget -O /usr/local/bin/gitlab-runner https://gitlab...
Using mutt and msmtp with Gmail
On macOS, install msmtp: brew install mutt msmtp I read this thread: https://www.engadget.com/2010/05/04/msmtp-a-free-to...
Everything I know about TCP
How is a TCP connection uniquely identified Kill a process that is using a TCP port you need: lsof -n -i :8001 # copy PI...
git stash vs. git reset --hard
Many times, I used git reset --hard and found out later that all my changes had disappeared. I think this is because I d...
Some stuff about gpg
Sign my message Things on securiry Public-key protocol is slow Errors I got To list the keys I have in my keyring, use ...
Epson scanner, large PDFs and ImageMagick (convert CLI)
The Epson iPrint soft is producing PDFs in 300dpi but the 300 information does not seem to be stored in the PDF metadata...
Avoid typing the SSH passphrase on Ubuntu using ssh-agent
Here: https://unix.stackexchange.com/questions/12195/how-to-avoid-being-asked-passphrase-each-time-i-push-to-bitbucket T...
Managing Basic Texlive instead of Full Texlive/Mactex
tlmgr install texliveonfly texliveonfly main.tex will install automatically all packages called using \usepackage{} To f...
Using Matlab at IRIT
Token server at IRIT: matlab -nodecktop -nodisplay -c 27000@licence.irit.fr or SERVER licence.irit.fr 0050568A1251 27000...
Stuff about managing Ruby & rvm
Warning ‘Ignoring… because its extensions are not built’ The message is: Ignoring atomic-1.1.101 beca...
Get lighter PDFs
convert -resample 72x72 -compress JPEG -quality 20 a.jpg a.pdf convert -resample 72x72 -compress JPEG -quality 20 a.jpg ...
Using Linyxbrew on university servers
On the university server azteca or inca (must use vpn or sassh through-pass) export http_proxy=proxy.univ-tlse3.fr:3128 ...
Interesting macOS-specific commands
open -a MacDown README.md # open README.md in MacDown mdfind # spotlight pbcopy # copy from stdin to pb pbpaste # paste ...
What I know about shells
General information Sed Shell, terminal, console, command line .bash_profile vs .bashrc Tty, pty, interactive vs non-in...