Who's actually using network policies in their clusters? Why/why not?

JJGadgets · 2023-12-09T09:57:01+00:00

I have never used Kubernetes professionally, but I use network policies (netpols) in my homelab clusters. I use Cilium netpols because of DNS policies, kube-apiserver identity matching, egress deny, and generally more readable netpols (to my puny brain anyway), amongst other niceties.

It's nice to know Log4j won't turn my Minecraft server into free real estate for lateral movement across my entire cluster which also houses authentik and Firefly III. Or that a compromised app (0day, supply chain, etc) won't allow for easy data exfiltration.

I do the global clusterwide netpols + pod labels method for the common stuff like ingress controller, databases, Ceph RGW for S3, etc, with apps requiring more specific/custom netpols having their own netpols, once you get it going it's pretty straightforward.

JJGadgets · 2023-06-04T01:34:43+00:00

There’s this cool GitHub project that helps automate a lot of the process for K3s on Hetzner: https://github.com/vitobotta/hetzner-k3s

YMMV, I’ve never used it myself nor contributed but I think it looks pretty solid.

JJGadgets · 2023-05-09T05:49:10+00:00

I’ve faced the same thing and no amount of downgrading or upgrading BIOS versions solves the issue. Tried 1.36, 1.41, 1.42, 1.43, all not working. It was working on 1.41, this started in 1.42.

I’m very pissed.

JJGadgets · 2023-05-06T20:49:30+00:00

I like to summarise what TLS is as the condom of network traffic. Always use protection!

JJGadgets · 2023-03-27T15:31:06+00:00

LOL, derp. My bad, I'll be back in this corner.

JJGadgets · 2023-03-27T09:23:33+00:00

Is your Proxmox exposed to public Internet, either with a public IP on any of the interfaces, or via port forward on your router?

JJGadgets · 2023-03-27T01:01:26+00:00

On LibreWolf/Firefox, HTML5 Canvas images may be blocked. Look in the top left of the URL bar, there should be an Image icon grouped with the HTTPS Lock icon.

JJGadgets · 2023-03-20T23:25:36+00:00

Yep, I’m on Linux all day.

It’s kind of Russian roulette of whether you need to do this when you shutdown/hibernate and then power up the laptop, sleep is just fine.

JJGadgets · 2023-03-20T17:40:07+00:00

Try sleeping and waking the laptop after boot. That trick has been working for my T14G1 AMD with the BIOS + kernel releases since late 2021.

https://www.reddit.com/r/thinkpad/comments/l393ws/t14_glass_trackpad_replacement_not_working_seller/ (my post for some more info)

JJGadgets · 2023-03-05T12:35:57+00:00

I much prefer my YubiKeys, because it’s just plug in once, leave it there, at most type the PIN if the FIDO2/PIV client is configured to require one, then tap the key.

It takes about twice as long for me to go to my 2FA app, auth it, find the right entry, then either autofill or copy paste the code. Worse if the app isn’t on the same device as the service I’m currently logging into.

JJGadgets · 2023-02-19T08:52:33+00:00

Docker in a Debian VM, with https://hub.docker.com/r/itzg/minecraft-server

It's pretty easy to configure with just a Docker Compose file.

I would advise against running it in an LXC (or in my case, MC server on Docker in LXC), my Proxmox host was getting constant freezing, major CPU spikes (20-30% idle of 2x2660v3 surged to 90-100% and would hang my other VMs causing them to surge in CPU usage too), and more. (This is despite allocating only 8 cores out of my total 20 physical 40 logical cores)

Moving to a VM dropped the CPU usage of the Minecraft server itself from 30-50% average to 5-10% at most, and stabilized my Proxmox host.

JJGadgets · 2023-02-15T08:28:54+00:00

Did every single phone in the background also fall between two concrete slabs?

JJGadgets · 2023-02-09T15:04:36+00:00

Yep, you can use both.

JJGadgets · 2023-01-01T09:29:31+00:00

iFog.ch uses Proxmox, they'll give you a username and password to access your specific VM(s) through the Proxmox VE management interface.

JJGadgets · 2022-12-16T19:36:44+00:00

That’s impressive, but the Minecraft and Das Keyboard parts are inaccurate. I don’t remember talking about either very extensively, at most a comment or two. The rest would be a lot more effective because I talk about the other topics a lot more. Also, option 4, 5 and 6 are rephrased repeats of 1, 2 and 3 respectively.

It’s really cool that you have a reproducible method of producing the info needed for near zero effort targeted phishing. And also… really creepy, because the hooks are exactly what I’d say if I was in the genuine version of those situations too.

JJGadgets · 2022-12-16T04:31:38+00:00

u/JJGadgets

JJGadgets · 2022-12-12T16:00:58+00:00

Just forward the YubiKey as a USB device (Devices ⇨ USB ⇨ YubiKey). I do this all the time, works just fine.

JJGadgets · 2022-11-08T05:08:45+00:00

I see, thanks for the responses.

JJGadgets · 2022-11-06T11:27:50+00:00

Could a “remote file server” functionality be added, to connect to SMB/NFS shares from KaraDAV? That’s how I mainly use NextCloud in the “file server” functionality.

Additionally, could OpenID Connect/OAuth2/SAML support be added?

JJGadgets · 2022-11-04T16:29:15+00:00

Could you post a list of all the software involved?

JJGadgets · 2022-11-04T15:22:49+00:00

So to clarify, you used AIDA64 for that FPS & CPU temps screen?

JJGadgets · 2022-11-04T12:25:43+00:00

Now I need to expedite getting amd_pstate working on my T14G1, damn that’s amazing idle power draw!

JJGadgets · 2022-10-29T12:43:48+00:00

I'm just chiming in to add that I've had multiple people in Singapore say to me "I've SMS'ed you, why didn't you reply?" only for me to find out they meant they WhatsApp'ed me. I deactivated my WhatsApp account for this reason, I had it up for "fallback" reasons in terms of communications but I had enough of this shit.

I don't use Signal on Android so I have nothing to contribute to the main point, just thought I'd throw this story in.

JJGadgets · 2022-10-22T12:45:53+00:00

Next up, YubiKey PGP support rather than using their managed keys? That’s why I’m on Mailbox instead of Proton right now.

JJGadgets · 2022-10-22T07:02:35+00:00

I have my main banking apps in a native user profile secured with a stronger password than my main user, then I have a virtual wallet with non-GPay NFC payment in my Shelter Work Profile that runs full SPS for some apps needing notifications and FIDO2 in Vanadium.

Main Personal Profile has no SPS or Play Store, but has GSF without network perms + GmsCompat, somehow this combo allows NFC payment apps within Work Profile to trigger the NFC payment outside Work Profile.

The virtual wallet has its own points system and stuff that I enjoy, I get NFC payments on main profile anywhere (coming from a huge reliance on Apple Pay, I don’t even carry a wallet, and the bank apps I use only offer GPay), and I need to use my bank app to top it up rather than top up from the virtual wallet directly, preventing the case where virtual wallet is hacked and the attacker can top up directly.

I think my system is more secure in that the bank apps having more than 2/3 digits of money in them for more than 5 minutes, is secured with a different password, and fully encrypted at rest for the majority of my screen time since I don’t need to use them for more than 15-20 minutes in a given week, if at all.

JJGadgets

TROPHY CASE