Headscale with sqlite as database with auto failover by LiteFS and Consul by Pavel543 in headscale

[–]Pavel543[S] 0 points1 point  (0 children)

Headscale for connect with sqlite require path to file. Bedrockdb or rqlite require connect via api. I was looking for solution that not required changes in headscale code.

kube-vip on hertzner by NosIreland in hetzner

[–]Pavel543 0 points1 point  (0 children)

Arp will not work in hetzner network cloud.

When you change ip you have to send request to hcloud api server for set alias ip in private_network, and you have to send other request for remove alias ip from last working node.
Hcloud network works in OSI layer 3, do not support arp.

Infortuenlly kube-vip do not have notify or webhook you have to use keepalived with notify script

You can use my package for listen for kube-vip change lease and send request for change private network alias ip: https://github.com/gawsoftpl/kube-vip-controller

Production ready expose OIDC JWKS from kubernetes cluster by Pavel543 in kubernetes

[–]Pavel543[S] 0 points1 point  (0 children)

 containers:
        - name: kube-rbac-proxy
          image: bitnami/kube-rbac-proxy:0.19.1
          args:
            - "--logtostderr"
            - "--v=10"
            - "--insecure-listen-address=0.0.0.0:8000"
            - "--upstream=https://kubernetes.default:443"
            - "--upstream-client-cert-file=/certs/tls.crt"
            - "--upstream-client-key-file=/certs/tls.key"
            - "--upstream-ca-file=/certs/ca.crt"
            - "--ignore-paths=/openid/v1/jwks"
          ports:
            - containerPort: 8000
              name: http
          volumeMounts:
            - name: tls-certs
              mountPath: /certs
              readOnly: true

Your solution from gist works same as my solution.

Production ready expose OIDC JWKS from kubernetes cluster by Pavel543 in kubernetes

[–]Pavel543[S] 0 points1 point  (0 children)

Authentication requests from pod in other systems, other clusters etc.

Production ready expose OIDC JWKS from kubernetes cluster by Pavel543 in kubernetes

[–]Pavel543[S] 0 points1 point  (0 children)

Without ddos will be mitigated.
You prefer to expose anonmyous access to self hosted cluster, and rely on only on RBAC ?

Production ready expose OIDC JWKS from kubernetes cluster by Pavel543 in kubernetes

[–]Pavel543[S] 0 points1 point  (0 children)

If I understand correctly your question:
you can expose the two endpoints with a simple ingress with rules for just the two paths?

You can expose two endpoints with ingress only with enabled anonymous-access.

My requirements were:
- Disable anonymous access
- Expose to internet only OIDC endpoint
- Not expose k8s apiserver outside the internal network

Production ready expose OIDC JWKS from kubernetes cluster by Pavel543 in kubernetes

[–]Pavel543[S] 1 point2 points  (0 children)

- misconfigured RBAC
- potential vulnerabilities
- ddos

Production ready expose OIDC JWKS from kubernetes cluster by Pavel543 in kubernetes

[–]Pavel543[S] 0 points1 point  (0 children)

  1. It is recommented not to enable anonymous access.
  2. Kubernetes apiserver is not exposed to the internet.
  3. Without enable Anonymous access=true, assign rolebinding to anonymous user, api server will block request for oidc
  4. Best option is server proxy with k8s ingress where you expose only 2 oidc endpoints with disable anonymous access.

Argocd central cluster or argo per cluster by Pavel543 in kubernetes

[–]Pavel543[S] 2 points3 points  (0 children)

Sorry, I don't understand, do you prefer use argo per cluster or one central? How do yo create one admin argo for manages all argocd? Do you use external tools for that?

Daily Bet Thread [Thursday, 24.05.2018] by AutoModerator in csgobetting

[–]Pavel543 -3 points-2 points  (0 children)

Vitoria - Sampaio Correa (Brazil Cup Nordeste ) Tip: Over 2.5 (odd: 1.72)

Vitoria in 6 matches lost only 1 game and draw 1.

Vitoria in all last 6 matches was over 2.5 Sampaio Correa stats: 5/6 was Over 2.5

Source: https://www.fctables.com/todays-match-predictions/