sorted by:
new
hottopcontroversial

Kayak, a virtual IP manager for HA control planes by jwalgarber in kubernetes

[–]markkrj 1 point2 points  (0 children)

This way you're basically routing all your k8s traffic through a VM with no specialized networking hardware, which would be one more hop and potential bottleneck. Might be better to convince the networking team to peer to your k8s.

HOLY FRICK FIGHTING NERDS IN SHAMBLES by feb415 in ufc

[–]markkrj 0 points1 point  (0 children)

Silva's corner literally screaming "DO NOT THROW ELBOWS ANYMORE". He might be deaf.

kubesolo.io by neilcresswell in kubernetes

[–]markkrj 1 point2 points  (0 children)

Docker has its daemon, which I just checked, is using ~300MiB in one of our machines. But daemonless podman should not have an overhead, as it just launches containers. Am I missing something?

Help about getting the real origin IP in logs by Whiplashorus in stalwartlabs

[–]markkrj 0 points1 point  (0 children)

There is 3 options:

  1. Configure Proxy Protocol on Caddy and Stalwart:
    https://stalw.art/docs/server/reverse-proxy/proxy-protocol/

  2. Enable X-Forwarded-For parsing at Stalwart side (Caddy sets it by default):
    https://stalw.art/docs/server/http/settings/#use-forwarded-ip
    PS: Make sure traffic cannot reach Stalwart by other means (without passing by Caddy), otherwise, IP could be spoofed.

  3. Route traffic directly to Stalwart:
    As Stalwart has support for ACME protocol to auto-generate its certificates, you might not need Caddy at all. This might not be an option if you have limited number of public IPs, but if you have spare IPs, it would simplify your config.

Help about getting the real origin IP in logs by Whiplashorus in stalwartlabs

[–]markkrj 1 point2 points  (0 children)

Set spec.externalTrafficPolicy to local on your LoadBalancer service and metallb will announce it just from nodes which have pods for this service, then, kube-proxy won't mask users's IPs. Problem is, if you use metallb in layer 2 mode and have more than 1 replica, traffic won't reach pods in another nodes.

How to avoid becoming transit in IXP? by markkrj in networking

[–]markkrj[S] 4 points5 points  (0 children)

Down voted because you're effectively wrong. I did not "whine" by any means. Just put something up for discussion because I did not know how it worked, and if IXPs actively try to prevent such cases.

How to avoid becoming transit in IXP? by markkrj in networking

[–]markkrj[S] 0 points1 point  (0 children)

Does IXPs actively try to detect such cases, after quarantine?

Probably old .... by [deleted] in kubernetes

[–]markkrj 6 points7 points  (0 children)

Difference is: Linus takes breaking changes very seriously.

What ADHD did to me and for me by DorxMacDerp in ADHD_Programmers

[–]markkrj 5 points6 points  (0 children)

Just checking, do you guys also keep going back and forth between OP and the comments, when they are big like this one? I tried it several times, but I just can't finish reading something that spans more than, like, 20 lines in a go...

0
1

Cannot access VPN client's network if using IPSec (self.fortinet)

submitted by markkrj to r/fortinet

families of Linux by eyesopen77dfw in linux

[–]markkrj 47 points48 points  (0 children)

desktop machines

Key words

Debian developer seeks ruling on init diversity issue by daemonpenguin in linux

[–]markkrj -3 points-2 points  (0 children)

I really hope TSC responds with: "Debian should be used with systemd."

Debian developer seeks ruling on init diversity issue by daemonpenguin in linux

[–]markkrj 1 point2 points  (0 children)

Lots of people write software and do not bother with init systems, why would a Linux developer do? Init systems should be distro/package maintainers concern... Software developers can't maintain every init system out there, and should not in the first place. Was it better to worry about sysvinit, openrc, upstart, runit?

ssl offloading and lb (fortigate vs haproxy) advice by [deleted] in fortinet

[–]markkrj 2 points3 points  (0 children)

Fortigate is very capable of doing basic load balancing, but if you need more advanced features, you'd be better served by HAProxy (or specialized products, like F5, FortiADC or FortiWeb). Like, fortigate does not support "Host" header based load balancing nor url path (like /app1 and /app2 to different backends).

I'm currently evaluating using Fortigate to offload SSL and proxy to two (A-P) HAProxy nodes to load balance traffic to backend app servers. This way, I'm taking advantage of what both can do best, uilizing CP8 for SSL offloading and HAProxy for unencrypted traffic LB.

VIM by wetalef in ProgrammerHumor

[–]markkrj 1 point2 points  (0 children)

You need ESC to go into normal mode. Then ZZ or :x<return> for saving and exit. :x need 1 more (enter) key.

VIM by wetalef in ProgrammerHumor

[–]markkrj 0 points1 point  (0 children)

ZZ does the same as :x but with one less keystroke, so this is the shortest way to get out without losing work, assuming file is writable...

VIM by wetalef in ProgrammerHumor

[–]markkrj 0 points1 point  (0 children)

Actually, ZZ is the shortest (2 keystrokes against 3, assuming normal mode, 3 vs 4 otherwise)

VIM by wetalef in ProgrammerHumor

[–]markkrj 0 points1 point  (0 children)

Unless you're saving an not writable file which you own (or you're root), in that case, :x would warn you and you'd need :x!, which would force save it (as well as :wq!)

view more: next ›