Rules provide system-level instructions to Agent . — Cursor docs, “Rules” I keep getting stuck on that sentence. Not because of the missing article (though, yes , to “the” Agent is what English wants here), but because of what the missing article tells us about the prose underneath: The whole document reads like a config schema that someone half-translated into English and then shipped. Cursor is…
Occasionally, you stumble into a conversation that feels… off. Not obviously broken. Not obviously malicious. Just slightly too smooth , slightly too generic, slightly too… optimized . This is the story of one such encounter. And how it completely collapsed under minimal pressure. The Setup An account (let’s call her F. L. ) reached out with this: Hello, Volkan I'm curious Can I ask you a…
A Question I Keep Getting I receive some version of this message a few times a month: “Given where technology/AI is today, what does a Junior Software Engineer actually need to bring to the table to be worth having on your team?” I appreciate when the question is honest about what it’s really asking. Sometimes it is. And sometimes, there’s a hook in the water . Either way, the question deserves a…
Recently, my Mac Studio started acting weirdly, so I decided to wipe the hard drive clean and reinstall my system. This post details the tools and applications I installed to this new system. My goal for this new system is to keep it lean and minimal, so that it starts up quickly, remains stable, and remains easy-to-maintain. With that in mind, let’s start with the foundation of any good setup:…
This is a short case study with iperf , Windows, macOS, and WSL . The Curious Case Recently, I was testing my downstream network performance on my Windows and Mac machines, both of them connected to the same router. The problem was: I was getting ~700Mbps downlink on Windows, while MacOS saturated at >1Gbps. “If I’m only getting ~700 Mbps, my Ethernet cable must be bad, no?” My first guess was…
Roadmap This article covers: Why I upgraded my audio interface and what I set out to achieve The hardware signal chain ( including mic, Cloudlifter, and Babyface Pro FS ) How software routing ( Audio Hijack, OBS, Wirecast, TotalMix FX ) ties it all together Managing streaming complexities—background music, copyright, and multi-output scenarios Dynamic control during streams and automation with…
Here are some bookmarks that I visit frequently when deploying a new system, or setting up a new development environment, or just trying to look something up, along with some snippets that I use frequently. Build Essentials sudo apt update sudo apt upgrade sudo apt install build-essential ~/.zshrc export ZSH = " $HOME /.oh-my-zsh " ZSH_THEME = " powerlevel10k/powerlevel10k " source $ZSH…
Here is the prompt that I used to verify that the code and documentation of SPIKE and SPIKE Go SDK is aligned. Later down the line, I am planning to streamline this process even further. But I still think, you need a human in the loop, as some of the documentation may turn out to be misplaced or inaccurate. I need a comprehensive audit of Go documentation vs implementation across the codebase.…
Less Friction. More productivity Introduction If you’re running a static blog with Zola , you know the drill: create a markdown file, add the frontmatter, remember the correct TOML format, generate a slug from the title, put it in the proper directory, commit, build, and push. It’s not complicated, but it’s friction . And the last thing I need nowadays is friction: I have a lot of high-priority,…
When working with Git, you might frequently encounter the command git push origin main . But what do origin and main actually mean? Let’s break it down. What is git push origin main ? The command git push origin main pushes changes from your local repository to a remote repository. It consists of three main parts: git push : The Git command that initiates the process of sending your commits to a…
Quick fix: Disable the service (if you don’t need to wait for network at boot): sudo systemctl disable systemd-networkd-wait-online.service Better fixes: Configure it to wait only for specific interfaces: Edit the service: sudo systemctl edit systemd-networkd-wait-online.service Add: ini[Service] ExecStart= ExecStart=/lib/systemd/systemd-networkd-wait-online --interface=eth0 Reduce the timeout: […
Encrypting and Decrypting with AES CBC package main import ( " crypto/aes " " crypto/cipher " " crypto/rand " " encoding/base64 " " fmt " " io " ) func main () { plaintext := [] byte (" Hello, Go encryption! ") key := [] byte (" 32-byte-key-for-AES-256-!!!!!!!! ") // 32 bytes for AES-256 // Encrypt ciphertext , err := encryptAES ( plaintext , key ) if err != nil { fmt . Println (" Encryption…
If you’re like me and have accumulated hundreds of bookmarks across various services, migrating them to a self-hosted solution like Shiori can feel daunting. While Shiori ’s simplicity is one of its strengths, importing bookmarks one by one through the web UI or CLI can be time-consuming. In this post, I’ll share a bash script that automates the bulk import process, making it easy to migrate your…
Introduction Secure secrets management is a critical aspect of any modern distributed system’s infrastructure. SPIKE ( Secure Production Identity for Key Encryption ) is a system that achieves secure secrets management through a distributed , zero-trust architecture. To learn more about SPIKE , you can visit SPIKE ’s website or check out SPIKE ’s GitHub repository . A Video is a Worth a Million…
Modern data encryption strategies often employ a two-layer model of key management to balance strong security with operational flexibility. Two commonly used concepts in this model are the Data Encryption Key (DEK) and the Key Encryption Key (KEK). In this post, we’ll unpack how these two keys work together, and how you might store and retrieve them effectively. What Are DEK and KEK? Data…
When working with Kubernetes, securely managing secrets is a crucial part of your infrastructure. Traditional approaches—like directly embedding secrets in manifests or manually managing Secret objects—can become cumbersome and less secure over time. Enter the External Secrets Operator (ESO) , a powerful way to integrate external secret stores with Kubernetes. One such secret store is HashiCorp…
When working with secure systems, a common scenario involves Server A obtaining a certificate signed by Server B (acting as a Certificate Authority, or CA). But if the ultimate goal is to exchange public keys so that JWTs (JSON Web Tokens) signed by Server A can be verified by Server B, you might wonder: Do I really need to use a CSR (Certificate Signing Request)? Can’t I just send my public key…
SPIFFE (Secure Production Identity Framework For Everyone) provides a robust framework for service identity across distributed systems. When using SPIFFE with SPIRE (SPIFFE Runtime Environment) in Kubernetes clusters, it’s common to have multiple trust domains. To enable secure communication between these domains, you need to establish SPIFFE federation by exchanging and trusting each other’s…
In this tutorial, we’ll walk through creating a custom webhook provider for External Secrets Operator (ESO) from scratch. We’ll build a simple Go server that serves as a webhook, deploy it to Kubernetes, and configure ESO to use it for secret management. Understanding the Architecture The External Secrets Operator (ESO) can fetch secrets from various providers, including custom webhooks. In this…
VMware Cloud Foundation (VCF) provides two methods for adding capacity to deployed workload domains: Adding hosts to existing clusters Adding new clusters to existing workload domains This guide focuses on the process of adding a new cluster to an existing workload domain. Process Overview Initial Navigation Access SDDC Manager dashboard Navigate to Workload Domains Select target domain Click…
After successfully deploying the vCSA virtual machine in Stage 1, Stage 2 handles the critical initial configuration of your vCenter Server. This guide walks through the complete configuration process to get your vCenter Server up and running. Stage 2 Configuration Steps 1. Time Synchronization Setup Enable NTP synchronization Configure NTP server: 192.168.1.100 Important : Accurate time…
As organizations scale their Kubernetes infrastructure, managing SSL certificates becomes increasingly complex. Let’s dive into some common misconceptions and explore how certificate management really works, especially when dealing with custom Certificate Authorities (CAs). The Common Misconception Many developers initially believe that having an SSL certificate for a domain (let’s say…
Application Virtual Networks (AVNs) are software-defined networking constructs built on overlay-backed virtual networks within NSX. When deploying the VMware Aria suite in Cloud Foundation, understanding AVN configuration is crucial for proper implementation. Understanding AVN Types When deploying AVNs for the Aria suite, two distinct network segments are created: 1. Region Segment (Local Virtual…
When deploying vCenter Server Appliance, proper planning is crucial. Just like a carpenter who measures twice and cuts once, taking time to plan your vCSA deployment can save hours of troubleshooting later. This guide provides a detailed deployment plan for setting up vCSA in a lab environment. Environment Prerequisites Management Computer Requirements Windows Server with: Mounted vCSA ISO image…
Have you ever encountered this puzzling error message while working with Docker containers? Warning Failed 89s (x12 over 3m44s) kubelet Error: Error response from daemon: Minimum memory limit allowed is 6MB If you’re like many developers, your first instinct might be to check Kubernetes’ LimitRange resources: $ kubectl get limitrange -A No resources found But wait - if there are no LimitRange…
When working with Kubernetes External Secrets Operator (ESO) and its webhook provider, you might encounter some interesting URL encoding challenges. In this post, I’ll walk through a specific issue we encountered and how we solved it, which might help others facing similar problems. The Setup We started with a basic ClusterSecretStore configuration using ESO’s webhook provider: apiVersion :…
External Secrets Operator (ESO) is a powerful Kubernetes operator that helps manage secrets from external sources. While it’s commonly used with cloud provider secret managers like AWS Secrets Manager or HashiCorp Vault, ESO also supports fetching secrets from HTTP endpoints. In this guide, we’ll explore how to configure ESO to poll an HTTP endpoint and automatically create Kubernetes secrets from…
While VMware Cloud Foundation (VCF) offers multiple ways to increase capacity, adding hosts to an existing cluster is one of the most straightforward methods. This guide walks through the process of expanding a vSphere cluster by adding new hosts. Process Overview Current State Assessment Before adding hosts: Check current cluster composition in vSphere client Review existing configuration in SDDC…
This guide walks through the first stage of deploying vCenter Server Appliance (vCSA) on an ESXi host. Like any critical infrastructure deployment, proper preparation and verification at each step is essential for success. Prerequisites Verification Before beginning the installation: Verify DNS resolution for target ESXi host: nslookup esxi-4.zerotohero.dev # Should resolve to 192.168.1.104 Verify…
Managing secrets in a Kubernetes environment can be challenging, especially when dealing with multiple tenants, clusters, and different types of secrets. In this post, we’ll explore how to design a flexible and secure secret store that can handle various secret types while integrating with existing tools like External Secrets Operator (ESO). The Challenge When building a secret management system,…
Every day, millions of people access resources on the public internet without giving it a second thought. But have you ever wondered what actually happens when you type a website address into your browser? Behind that simple action lies a complex series of processes that make network communication possible. Let’s break it down using one of the most fundamental frameworks in networking: the OSI…
The Software-Defined Data Center (SDDC) Manager is the central management component of VMware Cloud Foundation (VCF). This guide explores its capabilities, deployment, and essential configuration steps. What is SDDC Manager? SDDC Manager is deployed as a virtual appliance that runs in the management domain with: 4 CPUs 16GB of memory High availability through vSphere HA File-based backup…
When working with Kubernetes secrets, you may need to export them in a format that can be version controlled or transferred between clusters. This guide will show you how to export Kubernetes secrets as JSON while preserving important metadata like labels and annotations. The Basic Approach The fundamental command to export a secret in JSON format is straightforward: kubectl get secret <…
Managing multiple ESXi hosts individually can quickly become overwhelming as your infrastructure grows. This is where VMware’s vCenter Server Appliance (vCSA) comes into play, offering a centralized management solution that streamlines your virtual infrastructure operations. What is vCenter Server Appliance? vCSA serves as a central management platform for your ESXi hosts. Instead of managing each…
This guide covers two essential administrative tasks for vCenter Server: configuring backups and managing licenses. Proper backup configuration ensures business continuity, while correct license management keeps your environment compliant. Backup Configuration Using VAMI Accessing VAMI URL: https://vcsa.zerotohero.dev:5480 Login credentials: Username: root Password: (vCSA root password) Backup…
After deploying vCenter Server Appliance (vCSA), you have two primary graphical interfaces for management. This guide walks through both interfaces and the initial environment setup process. Understanding vCenter’s Management Interfaces 1. vSphere Client Access URL : https://vcsa.zerotohero.dev/ui Primary Purpose : Managing virtual infrastructure Main Functions : Creating and managing datacenters…
For VMware Cloud Foundation (VCF) administrators, understanding software bundle management is crucial for maintaining a healthy infrastructure. This guide explores the essentials of managing software bundles in VCF environments. Understanding Software Bundles Software bundles are the foundation of VCF lifecycle management, coming in two primary types: Patch/Upgrade Bundles Used for existing…
When deploying VMware Cloud Foundation (VCF), proper setup of DNS and NTP services is crucial for success. These fundamental infrastructure components often seem simple, but they’re frequently the source of deployment issues and troubleshooting headaches. Here’s what you need to know before starting your VCF deployment. The Deployment Parameters Workbook VCF provides a Deployment Parameters…
As organizations continue to modernize their infrastructure, vSphere administrators are increasingly looking for ways to streamline operations and reduce maintenance overhead. VMware Cloud Foundation (VCF) offers a compelling solution by providing a modern, agile, and highly efficient cloud operating model that brings the convenience of public cloud operations to your on-premises datacenter. What…
In VMware Cloud Foundation (VCF), adding cloud capacity is accomplished through a process called host commissioning, where physical servers are added to the SDDC Manager inventory. This guide walks through the process and key considerations. Understanding Host Commissioning Host commissioning creates a “free pool” of available capacity from added servers. This pool serves as the foundation for:…
VMware Cloud Foundation (VCF) transforms traditional virtualization into a complete private cloud experience. Let’s break down how it all works together. Core Components The Foundation: vSphere Combines vCenter and ESXi Handles day-to-day VM operations Remains familiar to existing administrators Serves as the compute foundation Software-Defined Infrastructure Storage (vSAN) Hyper-converged storage…
For organizations running VMware Cloud Foundation (VCF), one of the most powerful features is the centralized lifecycle management (LCM) through SDDC Manager. This capability transforms what was once a complex, manual process into an automated, orchestrated workflow. Let’s explore how it works and why it matters. Understanding the Bill of Materials (BOM) Each VCF release comes with a specific Bill…
Workload domains in VMware Cloud Foundation (VCF) are the primary method of allocating cloud capacity for hosting workloads. This guide walks through the process of creating and configuring workload domains. Understanding Workload Domains Two primary types exist: Management Domain (created automatically during bringup) VI (Virtual Infrastructure) Workload Domain (for business workloads) Creation…
For vSphere administrators looking to build a more flexible and automated private cloud infrastructure, understanding VMware Cloud Foundation (VCF) Workload Domains is essential. Let’s dive into what they are and how they can transform your datacenter operations. What is a Workload Domain? At its core, a Workload Domain is a vCenter instance with an ESXi compute cluster, but with an important…
Managing secrets in Kubernetes can be challenging, especially when integrating with external secret management systems. In this post, we’ll explore how to build a Kubernetes Operator that integrates with VMware Secrets Manager (VSecM) to automatically sync and manage secrets in your cluster. What We’re Building Our operator will watch for custom VSecMSecret resources that define how secrets should…
Many organizations are looking to transform their traditional vSphere environments into a full private cloud experience with VMware Cloud Foundation (VCF). This guide explores the migration process and key benefits. Why Move to Cloud Foundation? SDDC Manager Benefits Built-in automation and architecture Consistent infrastructure deployment Public cloud-like experience on-premises Centralized…
VMware has announced significant updates to vSphere 8 with Update 2, along with new cloud services for vSphere Plus customers. These updates focus on three key areas: administrative efficiency, performance improvements, and developer enablement. Enhanced IT Admin Efficiency New Lifecycle Management Service ESXi-Linux lifecycle management service for vSphere Plus customers Cloud console management…
In this tutorial, we’ll walk through the process of building and containerizing a secure webhook server using Go. We’ll cover everything from setting up the project structure to creating a production-ready Docker container. Project Overview Our webhook server is designed to handle secure GET requests with query parameters, process JSON data, and implement basic authentication. The server listens…
In modern cloud-native applications, authentication requirements can vary significantly across different environments and use cases. In this post, I’ll share how we implemented a flexible authentication system for a webhook server that integrates with Kubernetes External Secrets Operator (ESO). The Challenge Our webhook server needed to support different authentication methods depending on the…
When working with JWTs in Go, you’ll often need to extract and validate claims from the payload section. Let’s walk through how to do this effectively using the popular github.com/golang-jwt/jwt package. Basic JWT Structure First, let’s understand what we’re parsing. A JWT consists of three parts: Header (algorithm and token type) Payload (claims) Signature Setting Up Your Project Start by…