karmarepellent

7 ms·

1.
by karmarepellent 1y ago
This is why I've become a fan of StrictYAML [0]. Of course it is not supported by many projects, but at least you are given the option to dispense with all the unnecessary features and their associated pitfalls in the context of your o
2.
by karmarepellent 1y ago
The sarcasm is duly noted. But I simply answered the question. I don't have any strong opinion regarding passkeys.
3.
by karmarepellent 1y ago
A service that lets you sign up by uploading a SSH public key could just as well let you upload multiple public keys in your profile to be able to connect from other devices.
4.
by karmarepellent 1y ago
This is incorrect. SSH certificates work just like x509 certificates in that regard. Also, with PubkeyAuthentication, there exist all kinds of ways to collect host keys before connecting to them for the first time and thus avoiding the trus
5.
by karmarepellent 1y ago
> Signing in is cryptographically signing a commitment to the current ephemeral tunnel. I can see how SSH could be used for authentication on the web. And I have no doubt that it would be sound out-of-the-box. But I am not sure what you
6.
Fai.me – build your own custom ISO(fai-project.org)
2 points by karmarepellent 1y ago|0 comments
7.
by karmarepellent 1y ago
I'm curious to know if people see this as a viable alternative to a PXE installation, especially when it comes to the deployment of large-ish (possibly air-gapped) clusters.
8.
Automated Installation of Proxmox VE(pve.proxmox.com)
2 points by karmarepellent 1y ago|2 comments
9.
by karmarepellent 2y ago
Actually I think the trick is to change ones own perspective on these things. Regardless of how many redundancies and how many 9's of availability your system theoretically achieves, there is always stuff that can go wrong for a variet
10.
by karmarepellent 2y ago
Its a matter of evaluating what kind of infrastructure your application needs to run on. There are certainly mission critical systems where even a sliver of downtime causes real damage, like lost revenue. If you come to the conclusion that
11.
by karmarepellent 2y ago
I think it depends on the definition of "bricking the cluster". When you start to upgrade your control plane, your control plane pods restart one after one, and not only those on the specific control plane node. So at this point y
12.
by karmarepellent 2y ago
Do you mind sharing what these operations were? I can think of a few things that may very well brick your control plane. But at the very least existing workloads continue to function in this case as far as I know. Same with e.g. misconfigur
13.
by karmarepellent 2y ago
In theory: absolutely. This is just anecdata and you are welcome to challenge me on it, but I have never had a problem upgrading Kubernetes itself. As long as you trail one version behind the latest to ensure critical bugs are fixed before
14.
by karmarepellent 2y ago
Agreed. The best thing we did back when we ran k8s clusters, was moving a few stateful services to dedicated VMs and keep the clusters for stateless services (the bulk) only. Running k8s for stateless services was an absolute bliss. At that
15.
by karmarepellent 2y ago
I think the value proposition holds when you are just getting started with your company and you happen to employ people that know their way around the hyperscaler cloud ecosystems. But I agree that moving your own infra or outsourcing opera
16.
by karmarepellent 2y ago
We ran only two (very small) clusters for some time in the past and even then it introduced some unnecessary overhead on the ops side and some headaches on the dev side. Maybe they were just growing pains, but if I have to run Kubernetes ag
17.
by karmarepellent 2y ago
I have use cases for both approaches (letting a reverse proxy handle TLS, letting the application listen on an external socket and handling TLS in the application). I find is is easier to configure an application with a reverse proxy in fro
18.
by karmarepellent 2y ago
Makes me wonder what part of the pattern you think is "too clever"? I think it is fairly easy to reason about when the lock is restricted to the encompassing block and automatically dropped when you leave the block.
19.
by karmarepellent 2y ago
I agree. Sometimes the best you can do to cope with the sprawling ecosystems around programming languages and having to deal with convoluted codebases and inefficient programs, is sit down at home and building something simple (if you can s
20.
by karmarepellent 2y ago
I can confirm that upkeep of Gitlab is rather easy and does not take much time. Just the occasional update every few weeks. For its size it is also quite robust and the integrations it offers work well. The only thing I can really complain
21.
by karmarepellent 2y ago
Not sure why JS is the problem though. You can use JS in small doses to drastically improve the user experience on websites. The fact that heavy frameworks are sometimes used in contexts where they are overkill is not strictly JS' faul
22.
by karmarepellent 2y ago
I have no data to back it up, but this is why a lot of people living in the Alps supposedly still drive cars with a manual gearbox, although generally sales of new, automatic cars are now ahead of manual ones, even in Germany.
23.
by karmarepellent 2y ago
It makes me question what we are doing too. I'm using HTMX extensively at work, but I never use it to only update local state. A few lines of Javscript on the client will do that. However I think it's a powerful solution to updati
24.
by karmarepellent 2y ago
I have never seen a Debian system break due to auto-updates when they only subscribe to the common main, contrib and even non-free Debian repositories. They are incredibly stable and robust. However one might want to use apt preferences&#x2
25.
by karmarepellent 2y ago
Unfortunately in air-gapped systems you cannot simply pay pennies for a managed k8s platform. In these cases you have to bootstrap and manage k8s on your own in your data centers. While I do not think bootstrapping and managing a cluster is
26.
by karmarepellent 2y ago
To be fair in other comments OP made an effort not to get involved into those endless Kubernetes vs VM discussions. However either side eventually posts a snarky comment and there goes. I think everyone just has to acknowledge that there ar
27.
by karmarepellent 2y ago
Thank you for your thorough explanation. Interesting to see that you basically use your monitoring system as a scheduler to run Puppet and it sounds beneficial to closely integrate it with your monitoring to have it all in one place. At my
28.
by karmarepellent 2y ago
Now I am curious: how do you detect despair regarding cloud tech in job descriptions?
29.
by karmarepellent 2y ago
> while monitoring configuration compliance with a custom Naemon plugin. While I absolutely agree with you and your approach, would you mind elaborating what kind of configuration compliance you are referring to in this statement? I supp
30.
by karmarepellent 2y ago
Thorough auditing can still happen on the target host. If every single one of your hosts is properly configured to produce audit logs, maybe you can get away without auditing or even session recording on the SSH bastion host.

More ›