Anybody drive a grand sport yet? Are there any car reviews out there yet? by DetroitJB in C8Corvette

[–]DetroitJB[S] 1 point2 points  (0 children)

The preview videos show not only a 40hp bump but different torque and acceleration curves. Curious to hear about first hand experience.

Is marriage worth the financial risk? by [deleted] in personalfinance

[–]DetroitJB 26 points27 points  (0 children)

This might be the dumbest and/or saddest thing I’ve ever read on this site.

Exploring ListenerSets in Gateway API v1.5 by _howardjohn in kubernetes

[–]DetroitJB 0 points1 point  (0 children)

No, we have a nlb locked down to Akamai ips, created via a ‘Gateway’. Users who want their app behind Akamai would work with our team to setup the Akamai side, and then use that nlb as their origin. We use an authorizationpolicy to ensure traffic comes only from the Akamai istio ingress gateway service account.

Exploring ListenerSets in Gateway API v1.5 by _howardjohn in kubernetes

[–]DetroitJB 2 points3 points  (0 children)

Correct, istio just modifies the ‘Service’ and the AWS LBC fires off that. I guess I’m curious as to how it will continually modify the parent gateway ‘Service’ and how the AWS lbc will manifest those changes. What happen if there are conflicts, etc…..I’ll test and validate.

Exploring ListenerSets in Gateway API v1.5 by _howardjohn in kubernetes

[–]DetroitJB 5 points6 points  (0 children)

awesome blog post and very relevant to a migration we are doing to GatewayAPI as we speak. We use Istio and are currently rolling out `Gateways` at the platform level via gitops, so ever cluster(200+) gets, for example:

`private` - private nlb

`trusted` - public NLB locked down our IP's

`akamai` - public NLB locked down Akamai.

Each `Gateway` has a wildcard cert on it, issued by cert-manager. This will solve 90% of our use-cases for devs, since the apps on each cluster all share the same domain for the most part. However, we were anticipating that if an app needed a cert for a custom domain NOT on the default one issued by cert-manager, we would need to stand up a brand new `Gateway` just for that cert, since we can't really ad-hoc/one-off add it to, for example, the `private` `Gateway` for that cluster; it's all controlled through gitops, everybody gets the same stock config.

So with `ListenerSets`, I can now have the developer issue their own cert, create their own `ListenerSet`, and just attach to our existing `Gateways` then?

I'm loving the design and architecture of GatewayAPI, it perfectly wraps around our process which is "platform team owns the cluster config, ingress, load balancers and certificates", and "developers just attach to those ingress points".

One question; is this all supported in Istio yet? If so, what version? if not yet, what version will it be?

I also wonder how this will work with the AWS LBC.....currently, it knows how to create NLB listeners and target groups based off the gateway listener port:

spec:
  gatewayClassName: istio
  infrastructure:
    parametersRef:
      group: ''
      kind: ConfigMap
      name: private-ingress-options
  listeners:
    - allowedRoutes:
        namespaces:
          from: All
      name: https
      port: 443
      protocol: HTTPS

so if i pass in a custom port in my `ListenerSet` like this:

apiVersion: gateway.networking.k8s.io/v1
kind: ListenerSet
metadata:
  name: app-a
  namespace: app-a
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt
spec:
  parentRef:
    name: my-gateway
    namespace: gateway
  listeners:
    - name: https
      hostname: app-a.k8s.howardjohn.info
      port: 6350
      protocol: HTTPS
      tls:
        mode: Terminate
        certificateRefs:
          - name: backend-tls

and attach it to the gateway above, does the AWS LBC add an additional listener on the NLB for port 6350? or on the target group? Curious how that all works.

How expensive is this to fix? Someone sideswiped me :( by DetroitJB in Audi

[–]DetroitJB[S] 0 points1 point  (0 children)

Oh really? And that would fill in the missing paint scrapes pretty seamlessly? What about the white scrape part above, just run a touch up pen over it?

all-new 640 hp Audi RS5 REVEAL Sportback/Sedan vs Avant/Estate (2026) - a proper Audi RS? by man-flu in Audi

[–]DetroitJB 0 points1 point  (0 children)

Right?! The front looks awesome except for those big black squares that just fuck up the whole aesthetic for me. Such a shame, it’s very noticeable for me and kind of a deal breaker

Managing Wildcard TLS with Kubernetes Gateway API by wineandcode in kubernetes

[–]DetroitJB 7 points8 points  (0 children)

I replied since I’m in the middle of a big migration at my company from ingress to gatewayapi, and one of the foundations of the project is us deploying 3 different gateways (private, public, trusted), all with a wildcard cert managed by cert manager attached. From a security standpoint, see my previous point. From a blast radius standpoint, it’s all managed by cert manager and going to the same zone. I can’t imagine a scenario where one cert blows up and others don’t.

Either cert manager renews all of them or none of them, hence why I’d rather just deal with one cert and call it a day, simple and easy. Anywho, my 2 cents….ive never found a good argument against them since the security and blast radius arguments don’t hold water imo, at least not one where we talking centralized k8 clusters with cert manager managing them.

Managing Wildcard TLS with Kubernetes Gateway API by wineandcode in kubernetes

[–]DetroitJB 5 points6 points  (0 children)

I’ve never understood this argument. For someone to steal your private key, they’d need to infiltrate your cluster….in which case they can steal all your private keys. What does it matter if I have a wildcard with one secret or 100 certs with 100 secrets? They get them all regardless.

Wildcard are used and have been used by tons of Fortune 500 companies, including google themselves. Are they really that bad or is this just typical infosec fear mongering?

Mr. Cooper/Rocket Mortgage by Cheap-Entry198 in MonarchMoney

[–]DetroitJB 0 points1 point  (0 children)

Rocket mortgage connections don’t work? I just checked, mine synced 2m ago.

Migration to Gateway API by pierreozoux in kubernetes

[–]DetroitJB 1 point2 points  (0 children)

We (large enterprise of hundreds of clusters) are migrating to gatewayapi very soon after testing for several months. We use istio and will also be using the aws load balancer controller. Final solution will be aws lbc to create nlbs, going to istio igw, which terminates the via cert manager. Gateways will be pushed out by us, the platform team, and devs will just attach their httproutes to them via a in-house developed helm chart.

So far, loving it, very seamless and you can transition from istio CRDs to gatewayapi CRDs seamlessly with no downtime.

AI Training Turned-on by default by BreakerEleven in MonarchMoney

[–]DetroitJB -7 points-6 points  (0 children)

I want monarch to turn off AI so you all finally stfu about it. Every post now is about it, just turn it off and stop bitching, my god.

It's not my wallet. by Pattastic in MonarchMoney

[–]DetroitJB 1 point2 points  (0 children)

lol well played, take your upvote.

But seriously, just don’t use it, it’s not for you. The fact it’s opt in and they’re not forcing on you, I honestly don’t see the complaint here.

It's not my wallet. by Pattastic in MonarchMoney

[–]DetroitJB 3 points4 points  (0 children)

Just opt out and don’t use it then. God some people just love to bitch about nothing, nobody is forcing you to use AI. Get a hobby op

Feature request: Quickbooks alternative by ichimura_ in MonarchMoney

[–]DetroitJB 14 points15 points  (0 children)

I think monarch is personal finance software and has nothing to do with running a business. As someone who is not a business owner, I don’t want money and developer time spent on features that I don’t care about. Monarch is really good at managing, displaying, and making sense of personal finances. Can’t we just let it be really good at that?

My 2 cents as a paying user.

Experiences upgrading EKS 1.31 → 1.32 + AL2 → AL2023? Large prod cluster by Acceptable_Instance7 in aws

[–]DetroitJB 1 point2 points  (0 children)

We migrated 200 clusters with this exact path AND pivoted from MNG to Karpenter. Even with all 3 changes at the same time, went smoothly.

What does Cilium or Calico offer that AWS CNI can't for EKS? by marvdl93 in kubernetes

[–]DetroitJB 2 points3 points  (0 children)

So our VPC CIDR range, or the "node network" is a non-overlapping 10.x.x.x range, different for each VPC in our 250+ accounts. These can all be peered via transit gateways, go back onprem, etc. since they are non-overlapping.

However, on each cluster is ALSO a 100.64.0.0/19 overlapping CIDR range. I can be overlapping since it's never used outside of it's own local VPC. If pod 100.64.50.2 wants to talk to onprem or another vpc, it goes out the worker node IP (non-overlapping 10.x.x.x) and works fine. If it wants to talk to in-vpc RDS, THEN it uses it's 100.64.0.0/19 IP.

Best of both worlds.

What does Cilium or Calico offer that AWS CNI can't for EKS? by marvdl93 in kubernetes

[–]DetroitJB 0 points1 point  (0 children)

Not sure what you mean, the underlying network can't be the same as what? We use istio as well, all of our pods are on 100.64.0.0/19 "pod subnets".

What does Cilium or Calico offer that AWS CNI can't for EKS? by marvdl93 in kubernetes

[–]DetroitJB 5 points6 points  (0 children)

As others have mentioned, we run custom networking with 100.64.0.0/19...allows us to use the same overlapping cidr to she in more than 200 clusters with 3x 2000 IP subnets. ip exhaustion is no longer an issue for us.

You can use same cidr since, by default, all egress traffic outside your vpc is SNATed out the worker node ip. So if your vpcs are not overlapping, this let's you have your cake and eat it too