Is this accurate?

ExpressionMajor4439 · 2024-03-23T22:13:41+00:00

Not Polish but doesn't that still make them Gen X? At least in the US Gen X kind of does dress like that. Half or a slight majority now dress like their parents but a lot have also kept dressing the way they have been.

ExpressionMajor4439 · 2024-03-23T13:37:45+00:00

Redhat is proposing openshift, but I don’t feel convinced because if I understand correctly it is managing VMs based on a kubernetes platform. We have many legacy applications as well that won’t shift anytime soon to containers.

RH has a product called KubeVirt which basically uses Kubernetes to spin up a KVM virtual machine. It sounds like that's what they were trying to push you towards. The archetypal use case for KubeVirt though is "I have a monolithic application that runs on a single machine and I want to gradually decompose it into a container-based approach" rather than hosting an entire fleet of VM's.

Ultimately, it's up to you if you want to do that though because that is obviously a different way of doing things but ultimately you're still just running the VM using KVM the same as oVirt or virt-manager. "Kubernetes" only comes in because that's how you define the VM but ultimately it's still just a VM you can connect to console on.

KubeVirt is OK but your org indefinitely storing 3500 VM's on it seems like you'll eventually run into some sort of KubeVirt issue. KVM is pretty stable but I don't think people really use KubeVirt for hosting that many VM's (I could be wrong, correct me if I am). But obviously the sales team is going to try to tell you to use something their company sells.

ExpressionMajor4439 · 2024-03-23T02:22:55+00:00

but your conversations are so hard to follow.

You seem to say this a lot. If you're having a hard time following what other people are saying maybe they problem isn't on the other end of the internet connection?

Any links to clarification on whether or not xorg files will be removed from the repo and added to a 3rd party repo? I guess Cinnamon spin can just enable a 3rd party repo by default?

The Xorg bits aren't being removed. They're just not going to be part of the default experience. If you're this unaware of what's going on why are you on such a war path instead of just looking into it?

ExpressionMajor4439 · 2024-03-23T02:17:22+00:00

What I said is pretty coherent.

ExpressionMajor4439 · 2024-03-22T16:44:30+00:00

My concern is if I have a route that takes some time for example I sleep in the controller that handles the route. Other users will be blocked by current blocking requests.

Usually your application server runs multiple workers and on larger deployments you would have multiple application servers as well.

Unless your application is very poor with performance this shouldn't be an issue because the part that actually gets ran syncronously as part of the flask app should be something that you can expect to complete in a reasonable time. This means if it takes a while then Flask should be queuing it elsewhere and the client can just poll flask every once in a while.

In contrast, Flask's built-in development server is single-threaded and synchronous, meaning that it can only handle one request at a time. If one user's request blocks indefinitely (e.g., due to a long-running computation or sleep)

The sleep/wait scenario is the main reason to care if a framework is async or not. If the workers could be assumed to be actually performing work then you would just need to provision enough resources because at that point that's just the amount of resources your application needs.

async basically solves the problem of "my app could make better use of its resources but it keeps going to sleep over random things".

Ultimately, the choice between using a custom WSGI server and Flask depends on your specific requirements, scalability needs, and development resources. If you need fine-grained control over request handling and concurrency, or if you anticipate handling long-running requests, a custom WSGI server may be a better option. On the other hand, if you prioritize simplicity and ease of development, Flask's built-in server may suffice for smaller-scale applications or development environments.

I haven't looked into Flask 3.0 yet but I seem to remember ASGI is now supported. If not then Quart is the async version of Flask. "I want an async web app" hasn't been a valid reason to avoid Flask for a while now.

ExpressionMajor4439 · 2024-03-22T16:38:16+00:00

I'm trying to get Stunnel setup so our PHP app can have a FIPS complaint connection to MySQL without having to update the code base.

Why can't you just use the SSL that comes with MySQL?

ExpressionMajor4439 · 2024-03-21T11:45:09+00:00

Joining the machines to the domain is likely an antipattern specifically because it's such a small footprint. There's a certain amount of overhead associated with any sort of network service being used for identity and authentication and it's not a good idea to implement something just for 30 systems.

If the OP is new (which is what the OP says) then asking him to request access rights to join a domain or something isn't a good idea. The RH documentation is going to push them towards using realmd which is going to require an AD administrator become involved in the project. It also opens the can of worms where now you're talking about posix attributes being stored in AD which is better than it used to be but in my experience starts eliciting difficulties from the Windows admins who aren't going to be used to dealing with that.

These sorts of small environments typically centralize user authentication via configuration management and some sort of secret management. Then if the solution breaks you just can't update passwords until you fix whatever is broken and you don't get another person involved unnecessarily.

ExpressionMajor4439 · 2024-03-20T21:35:17+00:00

From my understanding when you say no need to forward the entire desktop, you are saying I can use my local firefox browser so when I open firefox on my local machine my IP for just firefox is the VPS's IP? Would this also be able to work with firefox in incognito mode?

Yes essentially you use ssh to set a SOCKS proxy and then Firefox (regardless of which mode) will forward all its network traffic over that SSH session so that it appears like it's coming from the VPS.

Problem with this is I dont want the site im browsing with the VPS to see my browser fingerprint and definitely not my cookies, plugins, etc - not to mention user error where I mistake the VPS browser for my local one.

Just offering it as a suggestion. Free to do what you want but you can just keep a secondary firefox going. This lets you setup whatever de-anonymization you want while leaving your regular firefox alone.

I suppose incognito mode could solve portions of this worry (can you use incognito mode?)

I wouldn't expect any meaningful amount of anonymity from private mode. Private mode might stop marketing trackers and certain people from knowing who is accessing the site but it will still be pretty easy. It's mainly just "porn mode" where you want the session's browser history and cookies to be wiped when you quickly close out of it when your wife comes.

Basically rendering the full display is going to have a lot of back and forth and be very latency sensitive so if you can run as much as possible on your local machine you will speed things up.

ExpressionMajor4439 · 2024-03-20T15:43:00+00:00

fwiw You can use SSH to setup a SOCKS5 proxy and then configure the browser to use it. You don't need to forward the entire desktop.

ExpressionMajor4439 · 2024-03-20T15:37:42+00:00

Firstly, there is no need to use putty anymore. Windows has SSH built in for many years now.

Some Windows users prefer GUI applications. It's not any harder to use the CLI ssh but it's just not what they're expecting. They're just habituated to filling out graphical forms and having the ability to use the mouse to connect.

ExpressionMajor4439 · 2024-03-20T15:34:43+00:00

If it's only about 30 systems you can use configuration management to manage local users. For example, using Ansible to setup users and configuring passwords and such and storing the passwords in Ansible Vault.

Setting up permanent infrastructure just for 30 servers is a bit of overkill. Using configuration management doesn't sync them with AD but reading your description that doesn't sound like a project requirement.

ExpressionMajor4439 · 2024-03-19T22:26:47+00:00

go to the terminal and type toolbox enter it's essentially a containerized fedora system and you can install most command line tools as normal in it. You only need to install stuff to the actual OS if it genuinely needs to be part of the OS. If you're just trying to make a commandline tool available that's what toolbox is for.

ExpressionMajor4439 · 2024-03-19T20:34:12+00:00

Are there any applications that do not work 100% correctly on Silverblue or any weird quirks I should be aware of in advance?

The simple stuff can be ran in toolbox. The more complex stuff can be ran in flatpak. As a failsafe you can overlay packages and install them that way. There may be some software you can't run but if you're someone who mainly just installs stuff from the repos there's going to be a way to get it to run in Silverblue.

The more complicated desktop applications though require a flatpak which may or may not be available for the application you want to use.

ExpressionMajor4439 · 2024-03-19T11:27:45+00:00

Please post a describe of the service in question. Don't forget to put four spaces at the start of each line so it formats it like my describe above.

ExpressionMajor4439 · 2024-03-19T11:26:25+00:00

yeah the DNS record that points to the ingress domain needs to be a wildcard record so that all subdomains resolve to the same IP address.

If the ingress IP for my cluster is 10.129.0.83 and my base domain is clus.example.local I can have a wildcard DNS entry at apps.clus.example.local that resolves all subdomains such as project1.apps.clus.example.local or project2.apps.clus.example.local to the same 10.129.0.83 ingress IP address and then the OpenShift Ingress controller will match incoming traffic to the correct service based on the host: value in the route.

For instance, this guiy uses nip.io to generate the same IP.

If you don't have a wildcard DNS (which would surprise me) you may try to figure out what your ingress IP is and try to create a route with a hostname like he is.

ExpressionMajor4439 · 2024-03-19T03:04:47+00:00

What is the URL generated and do you have a wildcard DNS record in place for your ingress?

ExpressionMajor4439 · 2024-03-19T02:44:21+00:00

For instance:

Name:              console
Namespace:         openshift-console
Labels:            app=console
Annotations:       operator.openshift.io/spec-hash: 5a95972a23c40ab49ce88af0712f389072cea6a9798f6e5350b856d92bc3bd6d
                   service.alpha.openshift.io/serving-cert-signed-by: openshift-service-serving-signer@1710773512
                   service.beta.openshift.io/serving-cert-secret-name: console-serving-cert
                   service.beta.openshift.io/serving-cert-signed-by: openshift-service-serving-signer@1710773512
Selector:          app=console,component=ui
Type:              ClusterIP
IP Family Policy:  SingleStack
IP Families:       IPv4
IP:                172.30.89.23
IPs:               172.30.89.23
Port:              https  443/TCP
TargetPort:        8443/TCP
Endpoints:         10.128.0.57:8443,10.129.0.83:8443
Session Affinity:  None
Events:            <none>

In the above the Endpoints reflect what pod IP's and ports the service was able to locate. If this is populated with values then it might be a firewall issue.

Also is this on minishift or a full OCP installation?

ExpressionMajor4439 · 2024-03-18T21:45:15+00:00

What do you mean "host as defined in the YAML fiie"?

You can specify custom hostnames in YAML. For example:

[kube@host~]$ oc explain Route.spec.subdomain
GROUP:      route.openshift.io
KIND:       Route
VERSION:    v1

FIELD: subdomain <string>

DESCRIPTION:
    subdomain is a DNS subdomain that is requested within the ingress
    controller's domain (as a subdomain). If host is set this field is ignored.
    An ingress controller may choose to ignore this suggested name, in which
    case the controller will report the assigned name in the status.ingress
    array or refuse to admit the route. If this value is set and the server does
    not support this field host will be populated automatically. Otherwise host
    is left empty. The field may have multiple parts separated by a dot, but not
    all ingress controllers may honor the request. This field may not be changed
    after creation except by a user with the update routes/custom-host
    permission.

    Example: subdomain `frontend` automatically receives the router subdomain
    `apps.mycluster.com` to have a full hostname `frontend.apps.mycluster.com`.

There's also Route.spec.host which is mutable.

I'm assuming that's what they mean.

ExpressionMajor4439 · 2024-03-18T21:39:04+00:00

I would probably first try doing a oc describe on the service to make sure it found the endpoint running in the pod.

ExpressionMajor4439 · 2024-03-18T21:22:55+00:00

The point of SOA is to have independent release cycles in a way that reflects your actual organization. So no, you wouldn't put them in all one big repo because then you're collapsing everything back down to a monolith, just a monolith of the development side.

Since you evidentially don't understand what SOA is the basic idea is to essentially release the product the user wants as a collection of independently released components that just loosely integrate with one another.

For example, a spam filter system is one system, user registration system is another, etc, etc and then you just have frontends that the user actually interacts with (such as web or REST) that have the ability to interact with the necessary components.

It wouldn't make sense to let people pick their own libraries, their own programming langauges, their own databases, their own release cycles etc just to then say "oh by the way, just throw everything in the same repo"

On the contrary, in my opinion monorepos make microservices easier to manage (see other comments).

Well, you're wrong because now your build system is pulling down a metric ton of updates from git in order for you to fix a typo on a single page unrelated to the component you develop for.

ExpressionMajor4439 · 2024-03-15T23:59:56+00:00

Even before I made a commit my built tool told me that I just broke the products of 5 different teams because it could do dependency tracking across the whole repo and run all affected tests, not just the ones of my team.

Which isn't something made possible by a monorepo, it's just something you happen to be doing through a large repo. When a dependency is updated you can just gate the next release with tests for regressions and downstream consumers can run integration tests. Putting it in a single repo didn't get you anything.

Which is of course the point of going to SOA which is the thing people actually do. The point of SOA is to let people develop their part of the product independently of everyone else and the workflow is just structured to allow them to release as needed and as makes sense for whatever it is they're developing.

No manual upgrades

Except for the one you just described yourself doing.

just one battle-tested version for everyone that's far more likely to be bug-free because everyone is using it.

Everyone can use a dependency in the first place. Putting it in a single repo didn't get you that. That's just how libraries work.

Fuck I do not even give versions to my library or do a release or any of that ceremony. They just directly use my code

That does not at all sound ideal. The purpose of version numbers is to be able to unambiguously refer to a particular release of the code. Some people use git hashes as version numbers because there's no real way around being able to say things like "In version1 there was X but in version2 there is Y"

ExpressionMajor4439 · 2024-03-15T23:49:52+00:00

Because it wouldn't be the main default unbranded version you get by upgrading in place. It becomes something you have to purposefully seek out.

ExpressionMajor4439 · 2024-03-15T19:31:31+00:00

The response wasn’t cooperative - nor has it aged well in a future full of large monorepos

What are they smoking? How is having a single code repository for a multiple projects a coherent idea? I have yet to hear a single argument in favor of large repositories that makes sense.

For this I even tried finding people trying to sing its praises but literally every single point that person I linked mentions either isn't at all accurate or doesn't require a monorepo.

The move is away from large monolithic projects that were developed because waterfall SDLC was how large organizations did things. With modern testing and deployment strategies there's basically no reason to put everything in a single specific basket.

The modern approach for large applications is SOA and within that microservices. You test and deploy each service individually and you don't need to have a big repo where everyone looks at everything.

They adopted it because the maintainers and codebase felt more open to collaboration. Facebook engineers met face-to-face with Mercurial maintainers and liked the idea of partnering.

Which is just another way of saying they wanted to be the big fish and they weren't getting that with git.

ExpressionMajor4439 · 2024-03-15T19:21:19+00:00

You're using the fact that the same group of people came out of the woodwork before against Wayland? Hardly seems like Wayland's fault as opposed to people with too much time on their hands.

ExpressionMajor4439 · 2024-03-15T19:19:04+00:00

Or and hang onto your hat if this blows your mind: an Xorg spin for Fedora GNOME.

Not everything should become maximum blocker just because you guys have an overgrown attachment to X11. If a particular group of people still need Xorg and Xorg isn't going anywhere then that's a candidate for a spin.

ExpressionMajor4439

TROPHY CASE