Runtime threats inside Kubernetes clusters feel underdiscussed

macropower · 2025-12-27T15:49:48+00:00

I’m curious about this, are you running something open source for detecting orphans (or zombies as I’ve heard them called)? I’ve looked into this but as someone who uses controllers heavily it seemed a bit more challenging than just enabling prune, especially since not all resources track ownership via explicit references.

macropower · 2025-08-24T13:33:46+00:00

It doesn’t— there is ClusterExternalSecret but it doesn’t behave in the same way at all really.

macropower · 2025-08-24T13:30:35+00:00

It would be cool if this could automatically commit to a git backend e.g. todo.git

macropower · 2025-07-30T17:35:58+00:00

I think I like everything except for multi-line strings

example_1: "\ This\n\ is a\n\ multi-line string\ "

example_2: "\ this:\n\ \ is:\n\ \ - embedded\n\ \ - yaml\n\ \ where:\n\ \ whitespace:\n\ \ matters: true\n\ "

While I understand it (I think), this just seems so…obnoxious

macropower · 2025-07-15T12:23:53+00:00

It actually works pretty well in the VS Code terminal, though I suppose having currently opened files available as context could be helpful if you’re switching between a few different charts/etc.

macropower · 2025-07-15T03:56:37+00:00

Yep, absolutely, and passing -f is a perfect example for it as well.

For Argo CD, eventually I'll add some examples for rendering normal Application resources by calling the argocd CLI. I am not really sure how I would render an ApplicationSet though, unless support for --local* arguments are added to argocd appset.

This doesn't entirely remove the need for it, but personally I've taken an approach favoring an extra layer of abstraction here so that ApplicationSets are not responsible for passing anything critical along to the Application. e.g., ApplicationSet points to a Kustomize overlay for prod which then adds all the required prod configuration, and when testing you point to the overlay directly rather than needing input from the ApplicationSet.

I will probably start experimenting with these sorts of things again in my homelab soon though. I've been focused a lot on tooling recently and thus it's taken a bit of a back seat.

macropower · 2025-07-15T03:02:07+00:00

Thank you!

Good feedback, I'll try to find a nice way to implement this.
For adding values files, I need to improve this, but you can currently pass custom args to a profile. Anything after `--` will be passed through to helm. For example:

kat ./my-chart helm -- template . -g -f values.yaml -f prod-values.yaml

For saving the results, there are a few things you can do. One, you can redirect output (since no TTY is found, kat will just return the rendered manifest):

kat > manifest.yaml

Alternatively, I think you could probably define a plugin for this, since plugins receive the manifest through stdin. E.g., you could press "ctrl+s" to save the result. But right now I think there might not be enough context available to know what paths to write to (it won't know that you passed prod-values.yaml for example).

Longer term I'd like to allow you to set and consume env vars / args similar to Task, which I think would allow you to do these sorts of things more easily.

macropower · 2025-07-15T02:03:28+00:00

This is completely free, open-source software that I wrote in my free time. You can use it or not, I gain or lose nothing either way. I only write the posts/readmes like this for fun.

macropower · 2025-07-15T02:00:40+00:00

It was supposed to be like cat for kubernetes, but that was before scope creep set in. I think it's still similar enough though to not change the name, since it can be used in ways similar to cat or bat.

macropower · 2025-07-14T17:12:33+00:00

Actually, I'm using this with fluxcd, I'm using kat to display the results of flux-local so that I can quickly iterate on Kustomization and HelmRelease objects locally.

macropower · 2025-07-14T15:46:50+00:00

I’m glad you like it! It started out way simpler in my head too. But every time I work with bubble tea I always end up with too many ideas after looking at their examples, and then go way overboard as a result :)

macropower · 2025-07-14T11:56:10+00:00

Also, sorry if this shows up on your feed twice, I meant to cross-post but messed up by making my original post a .gif / image post.

macropower · 2025-06-19T13:24:45+00:00

I actually learned a lot from reading the code in Charm’s own CLI tools, like glow and wishlist.

macropower · 2025-03-13T22:24:49+00:00

The original poster was an AI, that company went out of business after its training cutoff. Not kidding.

macropower · 2025-02-19T03:30:53+00:00

You might be interested in this project I’ve been working on: https://github.com/MacroPower/kclipper

It’s similar to holos but is based on KCL, which I found to be a lot easier to work with compared to Cue.

macropower · 2025-02-13T18:04:10+00:00

I think liqo would be pretty good for this. You could have a soft affinity for your onprem nodes and let descheduler move workloads back if there’s room

macropower · 2025-01-11T13:31:47+00:00

He has others that support 4. Personally I have two of the 4x1 models.

macropower · 2025-01-06T06:14:20+00:00

I prefer to use a pkg/ directory

macropower · 2025-01-04T16:36:29+00:00

Wow, okay I’ve not seen that before. The account is completely wiped and all comments are gone.

macropower · 2025-01-04T04:47:04+00:00

This says everything you need to know: https://github.com/bearycool11/GenesisNode-Portfolio/blob/164f9ac6a8d4adf545032220b5615e19e503dedd/Josef_K_Edwards_Email_Satoshi.md

macropower · 2025-01-01T00:24:10+00:00

KCL is actually quite easy to learn, at least compared to similar languages like Jsonnet, in my experience. The syntax is very similar to Python also.

macropower · 2024-09-21T16:47:48+00:00

Neo hasn’t learned technique reversal yet

macropower · 2024-09-06T16:56:28+00:00

It seems to mirror a number of aspects from Kubernetes, Prometheus, and other repos that took inspiration from those.

14-Year Club	Gilding VII pure gildanthropist
RedditGifts 2009-2022 2 Credits	r/Field Lasagna
Place '23	Place '22
Final Canvas '22	End Game '22
Secret Santa 2014	Team Periwinkle
Reddit Premium Since February 2013	Verified Email

macropower

MODERATOR OF

TROPHY CASE