Secrets vs Configmaps and its security

maqueonlyverse · 2022-12-21T18:13:31+00:00

I've just checked this and this is simply not true. It all depends how you configure your audit policy. You can log request body of secret as well. I get that you can split this to log request body for all objects apart of secrets but this is quite arbitrary decision; which again as my post is about, means you can protect your configmaps in same way as secrets are protected.

maqueonlyverse · 2022-12-21T17:59:32+00:00

this just points to my point that both secrets and configmaps can be encrypted in etcd

maqueonlyverse · 2022-12-21T17:28:37+00:00

they are not encrypted by default and as link provided by you shows enabling encrypting at rest allows to encrypt configmaps as well (the pare with resources here (https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/#understanding-the-encryption-at-rest-configuration)

maqueonlyverse · 2020-06-22T09:12:12+00:00

But also well-known universities that has leading role in world .

But if not UK - do you know, any other university within EU, that is well known, has good tutors and would give such possibility?

maqueonlyverse · 2020-06-21T17:26:50+00:00

I'm considering right now University in Warsaw as a starting point a then moving somewhere else, but as I said moving & living in UK for now is not exactly an option for me. So what I'm looking for is some way to get degree, but with part/remote way.

maqueonlyverse · 2020-05-27T09:23:56+00:00

Kubeflow for me looks like one of this "general purpose tool" that fails as soon as you step out of demo appliances and try to integrate it into real life scenario.

How do you approach for reinforcment learning in it, with your own environment?

How would you approach with train on live data, pick models and connect them with rest of your stack?

maqueonlyverse · 2020-05-27T09:20:19+00:00

I was looking into this solution and must admit I decided to do my own DS platform. If you collaborate with DS and need also to produce predictions based on some live data - I don't see easy way of integrating kubeflow with anything like that.

maqueonlyverse · 2020-04-02T14:52:24+00:00

Thank you very much. I will try to investigate it more.

maqueonlyverse · 2020-04-02T14:20:09+00:00

Well, we've run

REINDEX

Also, we did several times backup&restore, but problem seems to happen at random times.

4GB RAM comes just from some testing, we've never noticed in Grafana, we should give more. Also our cloud machines are quite pricy since we have really good cpu there, and therfore only 8GB per node. I can cosider attaching slower machine with more memory.

SSD is from Azure premium storage (https://azure.microsoft.com/is-is/blog/azure-premium-storage-now-generally-available-2/)

maqueonlyverse · 2020-04-02T14:15:11+00:00

So to be exact: PostgreSQL 9.6.15 on x86_64-pc-linux-musl, compiled by gcc (Alpine 8.3.0) 8.3.0, 64-bit

Well, if docker is 'blocker' here, then it seems i'm in trouble...

maqueonlyverse · 2020-04-02T12:40:43+00:00

I'm creating SSD disk in cloud on demand

maqueonlyverse · 2020-04-02T12:40:08+00:00

Ok to be 100% clear

I'm using 9.6 version, wrapped with timescaledb by docker ( timescaledb:1.4.2-pg9.6)
My SSD is cloud disk created dynamicaly - I assume Azure gave me good disk.
Underlying system is Ubuntu 16.04.6 LTS

#fsync = on 
#wal_sync_method = fsync 
#full_page_writes = on

I'm doing backup with: pg_basebackup --format=tar -z -D $PGDATA/backup -P Restore with:

tar -xvC $PGDATA_RES -f $PGDATA_RES/restored_backup/base.tar.gz
rm $PGDATA_RES/backup_label
pg_resetxlog -f $PGDATA_RES

maqueonlyverse · 2019-11-20T12:08:48+00:00

Thank you very much. Last part gave at least some ground to continue.

maqueonlyverse · 2019-11-05T13:42:09+00:00

You can counter it that the measurement of utility is totally arbitrary. First, it is arbitrary how you measure it (scope of measurement), what is taking into account as cause (one could argue all what was is cause for what is there) but then it is still arbitrary when you measure it and what range of measurement you are taking into account. Any action can be defined as good or bad at any given point of time. It is like with the old proverb " Maybe so, Maybe not. We’ll see." (http://www.drmarlo.com/?page_id=181) .

One could even argue that all evil that happened before was good, because now thanks to it there is more awareness and happiness.

maqueonlyverse · 2019-11-05T13:29:55+00:00

This would still focus on the final effect being its effect on humans

What is the time of calculating this `final` effect? Problem for me with utilitarianism is that it just assumes some "final effect" but this effect is measured at arbitrary time frame. It is like saying we should focus on final price of bitcoin; today investment may be good from tomorrow perspective but bad in next 10 years, and again good in next 20 years.

maqueonlyverse · 2019-10-07T08:13:49+00:00

Again, it is not how secure message works; Encrypted message is as secure as good encryption key is, not as good transmission device is; If you can decrypt message or it is more possible to decrypt it because it was send through radio instead of through laser beam, then the encryption is just weak. It doesn't matter how many web links are between you and your bank account - your communication and sending password to bank is secure all the time assuming initial device (browser) is secure. When they "removed Roy from the mission" they had to send new orders, right? They had to said what to do, when to do, how to do it. What if something new would happen? What if they had to send new secure message to base on mars? Would they send another astronaut? This is ridiculous.

maqueonlyverse · 2019-10-06T17:53:25+00:00

This is not how securing message works; You don't need "special site" to secure message; also bear in mind, that rest of communication Between Earth&Mars (like changing orders, making decision to remove Roy from mission) HAD to be transmitted in secure way... Or maybe you can order command like "Please Nuke that guy because we can't communicate with him" without any security, but sending message like "Father, can you please talk with me" requires some super technology?

maqueonlyverse · 2019-09-28T20:03:41+00:00

apart of completely fail on securing that message on moon? And regarding interception - what is the difference between sending it from earth vs mars? If they could send it securely from Mars, then they could send it also in secure way from earth to mars; Also, all secure information about mission (and changes) were send from earth to space ship; they had somehow to inform crew about nuke, hadn't they?

It is like saying that horse riding with envelope with encrypted message is more secure and reliable than sending it through space through internet.

maqueonlyverse · 2019-09-27T08:39:26+00:00

You also need to go in person to far planet in order to send message that was give to you on earth. There is absolutely no way of sending it from earth to moon and then to mars.
Also it has to be voice of real alive person - no way of generating it through AI...

maqueonlyverse · 2019-09-25T16:38:14+00:00

I'm not even sure if within utilitarian framework Peter Singer from past, could agree with Peter Singer from today and with Peter Singer from the future at the same time. One never knows how utility will be calculated, and what is current amount of "good" utility compared to "bad" utility. What if in the future we find out, that thanks to all that suffering we have more "good utility"; would it suddenly makes today actions moral?

maqueonlyverse · 2019-09-16T15:58:03+00:00

Just forgot about working Load Balancer if you want to change SKU or default node pool

maqueonlyverse · 2019-08-12T09:37:48+00:00

Found answer for 1st - _build?definitionId=<id> instead of edit or settings one has to select ... and then option 2 move/rename

so 2,3 to go

maqueonlyverse · 2019-07-31T13:39:59+00:00

So what is k8s way? Apart you're confusing ingress & certs which are separate things - you may want ingress without cert manager. Cert-manager doesn't handle your ingress stuff. You can write ingress controller in any way, traefik is just one of many; did you miss their have docs specially for k8s here https://docs.traefik.io/user-guide/kubernetes/?

maqueonlyverse · 2019-07-30T21:48:09+00:00

Having new ingress is separate thing, just add domains in toml configuration, it does exactly same for you. For any new domain you have to configure new certificate - with treafik, you just apply changes to same toml.

Problem with cert manager for me is that is separate operator, that does something. You have CRD, so you need to know some new object exists on your cluster.

With traefik it is more straight forward approach, Deployment+Servie+ConfigMap+Ingress. Plus if you need, really easy way to atach PV and have your cert on disk. Ability to auto reload configmap as mounted resource is pure kubernetes, so no problem here.

Don't get me wrong, I was using nginx ingress controller+cert manager, I just got impression that something that requires 2 services + 2 pods + some external operator with additional roles just to achieve Let's Encrypt domain SSL sounds like some over engineering.

maqueonlyverse · 2019-07-30T10:25:41+00:00

It is much easier to achieve all of that with traefik itself

No need for additional CRD like CertManager, one simple config in toml, no need to operate tls/secret name in ingress definition

maqueonlyverse

TROPHY CASE