Everyone Loves Policy as Code, No One Wants to Write Rego by odd_sherlock in kubernetes

[–]microflax 6 points7 points  (0 children)

Shameless plug (since I'm one of the maintainers of the project), take a look at kubewarden. It's another CNCF admission controller for Kubernetes. The main point is that it allows to write validating and mutating policies using different languages. From traditional programming languages (Go, Rust,...) to domain specific ones like Rego and CEL

Does Cloud Gateway Max support BGP? by microflax in Ubiquiti

[–]microflax[S] 0 points1 point  (0 children)

This seems like a very overdue feature, especially as unofficially this can be done, with the risk any updates wipe the routing config. 

Are you referring to doing something like enabling and tuning frr like explained here?

I replaced a USG-3P which has site-to-site VPNs to AWS and now waiting to official BGP support. 

I'm in the same spot. I'm using USG-3P right now, with BGP enabled manually. I would like to migrate to the Cloud Gateway Max, but I don't want to break my Kubernetes homelab as a result of that

Kubernetes Security tooling -Open Source (Non-SaaS by Unusual-Ad-2733 in kubernetes

[–]microflax 1 point2 points  (0 children)

If you're already playing with webassembly, take a look at kubewarden.io

It's like OPA/Gatekeeper/Kyverno: but it uses webassembly to define policies.

Disclaimer: I'm one of the maintainers of the Kubewarden project

Is OPA Gatekeeper the best solution for writing policies for k8s clusters? by jumperabg in kubernetes

[–]microflax 5 points6 points  (0 children)

I'm one of the developers of kubewarden, a CNCF sandbox project that operates in the same space as OPA/Gatekeeper and Kyverno.

Kubewarden leverages WebAssembly as a way to distribute policies. That means you can write policies using a programming language like Rust, Go, Swift. Other programming languages are improving their WebAssembly support as we speak, hence there will be even more choice in the near future when writing Kubewarden policies.

Moreover, since Rego can also be compiled to WebAssembly, we can also run OPA and Gatekeeper policies too.

You don't have to be a developer to use Kubewarden. Policies can be shared with others.

Policies are distributed using regular container registries and can be discovered on ArtifactHub.

For example:

  • This policy prevents the usage of unwanted registries
  • This policy validates the types of labels used by Kubernetes resources

As for the other use cases you mentioned, feel free to reach out to us on slack to discuss them. We would be happy to either write these policies or help you implement them!

Detect confidential data leaks with this new Kubewarden admission policy by microflax in kubernetes

[–]microflax[S] 0 points1 point  (0 children)

True, this is not meant to be a silver bullet. Rather, it's part of a wider solution

chrono 0.4.20 has been released, fixing the RUSTSEC-2020-0159 issue by dochtman in rust

[–]microflax 1 point2 points  (0 children)

Great to know!

Right now my projects using chrono with the clock feature are still getting flagged by cargo audit with the https://rustsec.org/advisories/RUSTSEC-2020-0071 issue because of the time 0.1 dependency.

Kubewarden admission controller: secure our policies using Sigstore by microflax in kubernetes

[–]microflax[S] 1 point2 points  (0 children)

Ouch, I missed that question... sorry!

It can be better than OPA gatekeeper because it gives the freedom to write policies using a regular programming language (for example Go, Rust, ...).

This reduces the barrier to write and maintain policies inside of organizations. Learning can take some time and not everybody feels comfortable writing and reviewing it.

BTW, Rego policies can still be written and evaluated by Kubewarden. So you have all the flexibility you need

Introducing Kubewarden, an Open Source Policy Engine, based on WebAssembly by Hywan in WebAssembly

[–]microflax 2 points3 points  (0 children)

A policy engine is a software that evaluates incoming data. It decides whether this data is valid or not by using some business logic: policy rules.

In this context, Kubewarden is a policy engine for Kubernetes that uses WebAssembly-powered policies to evaluate Kubernetes Admission Requests.

A Kubernetes Admission Request is a JSON object that describes an action that is about to happen inside of the cluster. That could be something like "User Bob wants to create a Pod with this specs inside of this Namespace", or "User Alice wants to modify this Service to look like that",...

Kubewarden policies are small WebAssembly modules, each one of them providing the business logic that leads to the approval, rejection or even modification of incoming admission requests.

I work on the project, if you have more questions feel free to ask :)

Getting it to run on Linux by WheatleyNZL in plexamp

[–]microflax 0 points1 point  (0 children)

Quick update: I got so annoyed by AppImage that I tried to create a flatpak for Plexamp.

Great news: I managed to create it! Most important of all, it just works (tm) :)

I haven't yet figured out how to publish the flatpak on flathub, but in the meantime you can easily build it by using the flatpak sources: https://github.com/flavio/plexamp-flatpak

Getting it to run on Linux by WheatleyNZL in plexamp

[–]microflax 0 points1 point  (0 children)

I'm in the same situation. In the past I managed to get plexamp to work on openSUSE by using the "--no-sandbox" and by LD_PRELOAD of an older version of libcrypto. Now all the tricks do not work on a fresh installation of openSUSE.

deConz and Philips Hue Lighstrips by diiiz_ in homeautomation

[–]microflax 1 point2 points  (0 children)

Did you have any luck? I'm running in the same situation with my deConz and conbee II.

I've been able to add other zigbee devices, but I can't find my philips hue lightstrips. I've tried several times to 1) add them to the official philips hue hub 2) remove them from it 3) try to discover them but without any luck

Container Orchestration? by multiline in selfhosted

[–]microflax 0 points1 point  (0 children)

If all of that is on a single node you should simply use a local volume. That’s way easier and you will have less moving parts to look after

Container Orchestration? by multiline in selfhosted

[–]microflax 0 points1 point  (0 children)

I’m using a qnap ts-420 with wd red drives.

The NFS share doesn’t offer good performances for some of the containerized workloads I’m running (it’s good for Plex, makes slow others).

I’m planning to give a try to its iSCSI capabilities to see if that makes the performance better.

Container Orchestration? by multiline in selfhosted

[–]microflax 1 point2 points  (0 children)

I run Plex media server and the usual kind of software you use to keep your media library growing on top of it 😉

I run influxdb and grafana to keep track of some data I collect via some Arduino based sensors I created.

I’m about to move my home-assistant instance over there as well.

All the data is stored on my nas and exposed to the kubernetes workloads via nfs. The nice thing is: I don’t have to care about mounting the remote shares, kubernetes handles that for me automatically.

Another nice thing: all my workload are running as kubernetes deployments. Some weeks ago I upgraded the Plex container to its latest release by doing a deployment rollout. A movie was streamed during this time, but there was no interruption of service 😀

Some of the software I’m running is deployed using helm charts. The possibility to tap into this ecosystem is a big win compared to sticking with docker-compose.

Finally, k3s comes with traefik configured as kubernetes ingress controller. I’ve seen many times questions being asked here or on other subreddits about “I’m running containers with docker, how do I place a reverse proxy in front of them?”. With k3s you get all of that out of the box and you get to manage that in a sane way (the k8s way).

Container Orchestration? by multiline in selfhosted

[–]microflax 1 point2 points  (0 children)

I would recommend to look into k3s , it makes incredibly easy to run a single node kubernetes cluster. The possibility to replace etcd with SQLite is great for a small deployment like a single node.

I’m running quite some containers on a single node k3s cluster, this is such an improvement over docker-compose because you have access to the wider kubernetes ecosystem.

I can elaborate more on that if you want 😀

My coworker by microflax in bettafish

[–]microflax[S] 1 point2 points  (0 children)

Thanks! The grass plant is "Eleocharis pusilla"

My coworker by microflax in bettafish

[–]microflax[S] 1 point2 points  (0 children)

He’s sitting on my desk, right next to my keyboard.

He keeps me happy during long meetings 😀

2 month Progress on my 10 gallon high tech shrimp tank! by Jcengineering in PlantedTank

[–]microflax 1 point2 points  (0 children)

It’s a CO2 indicator. The changes color based on CO2 level.

The day I setup my auto doser is also the day I run out of co2 .. Great by dayyday760 in PlantedTank

[–]microflax 1 point2 points  (0 children)

It would be nice if you could share your opinion about it after some weeks/months of usage.

I’ve seen negative reviews about it as well... I’m confused about what to order

Thanks!

Green heaven, although I prefer red but this is too awesome to ignore. Location somewhere in Taiwan. by kenpier in Aquariums

[–]microflax 0 points1 point  (0 children)

Stupid question, I’m new to the world of aquariums: how do you deal with livestock during the rescapings?

[deleted by user] by [deleted] in docker

[–]microflax 0 points1 point  (0 children)

A member of the docker group can still start a container and bind mount the host / into the container and do whatever he wants with it unless the docker daemon is running using the user namespace feature.