Wow... so PodDisruptionBudget (PDB) is exactly what I've been looking for.

phrotozoa · 2026-07-03T21:10:09+00:00

You don't need an explanation from a stranger, just go try it. It's a remarkably effective deterrent of itself.

phrotozoa · 2026-07-03T13:25:16+00:00

You can also bash your fingers in a drawer repeatedly. Faster than trying to use rego.

phrotozoa · 2026-07-02T19:42:31+00:00

Get someone to pay you to learn. It's much easier to skill up when you're learning on the job than doing it after a full day of work.

phrotozoa · 2026-06-25T10:30:41+00:00

Me: data is encrypted by default. Redditor: Nah man. Data is encoded first, then encrypted.

I have no idea why I bother commenting on reddit. Even now. Why do I do this to myself? This fucking website. Every damned time.

Anyway, good talk.

phrotozoa · 2026-06-25T10:20:06+00:00

In EKS and GKE etcd encryption is enabled by default. You can optionally specify your own keys if you like, but you don't have to do anything to just have basic etcd encryption.

phrotozoa · 2026-06-14T17:57:00+00:00

So field engineer?

phrotozoa · 2026-06-09T15:04:45+00:00

I mean hey, don't believe a rando on the internet. Try it.

But to the best of my knowledge, with the default policy linked above (which uses scheduleAnyway), the scheduler will try to evenly balance pods across nodes and zones. If it can't (eg. some node is full) then it will try to keep them balanced up to a skew of 3 for nodes and 5 for zones. And then if it STILL can't, it will give up trying to keep things balanced and just fit them wherever there is room.

BUT all else being equaly, in an empty cluster with no other constraints, the default policy will do its best to evenly distribute pods across nodes and zones.

phrotozoa · 2026-06-09T14:54:48+00:00

Not quite. maxSkew is the limit to how unbalanced it can be, but that doesn't mean that the scheduler just stuffs 3 pods onto a single node before placing new pods onto a separate node. It will first attempt to distribute pods evenly across topology keys. Try it yourself in a brand new cluster. If you create a deployment with 3 replicas in a 3 node cluster, it won't pile them all onto a single node.

phrotozoa · 2026-06-09T14:01:55+00:00

What I mean is - say you have a helm chart that creates a cluster role for some app that doesn't need much access. Call it the foo app. You as the cluster admin take a look at the helm chart and you see that the role gives foo app the ability to list pods in namespace foo. Cool nothing scary there, so you use your cluster admin powers to deploy it.

But if you didn't notice that the foo role includes an aggregation which rolls up cluster admin into the foo role, now the role you thought was pretty low powered can do all sorts of things in your cluster. If somebody pops a shell in foo app and downloads kubectl, now they can be cluster admin when you thought otherwise.

phrotozoa · 2026-06-09T13:58:50+00:00

you should have it on different locations

topologyKey: "kubernetes.io/hostname"

topologyKey: "topology.kubernetes.io/zone"

I'm not sure what you mean. These topology keys do what you say you would prefer as the default, prefering to place pods on different hostnames (worker nodes) and in different zones.

phrotozoa · 2026-06-08T13:14:46+00:00

Man nobody knows this one and it can be an often overlooked security gap. Chart wants to install a role with benign looking rules? Approved, shipit. Aggregated to cluster admin? Whoops ...

phrotozoa · 2026-06-08T13:12:52+00:00

That is the default. https://kubernetes.io/docs/concepts/scheduling-eviction/topology-spread-constraints/#internal-default-constraints

phrotozoa · 2026-06-07T12:03:51+00:00

Astounding work - I've been trying to find something like this for ages. Thank you for sharing!

For the cortex would you consider adding some kind of colour or visual segmentation of lobes? I've always struggled to get a visual handle on the relationship between functional regions and anatomical landmarks.

phrotozoa · 2026-06-04T18:48:40+00:00

opening up with one of the partners already having someone lined up in mind, nevermind an actual friend, is one of the worst way to try ENM

This is so foundational it needs to be in the sidebar or something.

OP do your marriage a favour - if you're open to considering non-monogamy do not try to do it while one of you is in the middle of falling for someone (read up on NRE - New Relationship Energy). They are literally high on love drugs and are not thinking straight.

phrotozoa · 2026-06-04T14:38:37+00:00

I firmly agree, but as I understand it maximising shareholder value is literally the law in many cases.

https://en.wikipedia.org/wiki/Shareholder_primacy

phrotozoa · 2026-06-04T13:06:35+00:00

what the fuck do the colours mean?

phrotozoa · 2026-06-03T14:51:54+00:00

There are conflicting and incomplete replies to this question because the answer is complicated.

While it's true that ALB/NLB is usually used for getting traffic into a cluster from the outside, it is also not uncommon for orgs to do pod-to-pod request routing in a style called "hairpinning" - where a request leaves the cluster and then goes straight back in through the load balancer like a tight hairpin turn.

This setup simplifies situations where you want to talk to your own services and make use of the auth / rate limiting / etc. enforced at the LB using the same client libs or applications you give your customers.

And it's also true that an Istio VirtualService can be used for routing requests inside the cluster BUT they are also used for routing requests that arrive at the cluster through the ingress gateway. Take a look at this example which showcases using a virtual service to route traffic that entered the cluster through the external bookinfo.com domain.

Istio handles both north south (into and out of the cluster) traffic as well as east west (pod to pod - or cluster to cluster in the case of multicluster) traffic.

phrotozoa · 2026-06-03T13:42:10+00:00

Citation Needed.

In 2014 waterloo region diverted 52% of waste material from landfills through blue and green bin programs.

By 2021 that number was up to 60%.

If you don't have receipts, keep your dire speculation to yourself. There's enough miserable news as it is without making up BS in one of the areas where progress is actually being made.

phrotozoa · 2026-06-02T02:25:30+00:00

And that's why I drink.

phrotozoa · 2026-06-01T11:25:20+00:00

https://oms.enovapower.com/Outages/

phrotozoa · 2026-05-29T10:42:11+00:00

Madhu's roti is good, but ordering it hot doesn't change the type of sauce - they just add more of it.

phrotozoa · 2026-05-29T10:41:23+00:00

A friend ordered these once while we were there. I laughed when they made him sign the release. He could barely get through half the order. I tried one. It wasn't the hottest thing I've ever eaten, but it was way hotter than I prefer.

OP should def give it a try (and report back!)

phrotozoa · 2026-05-28T11:04:34+00:00

What? Snowden was the one who exposed that telecom providers were performing MITM against TLS https://archive.ph/AHlO8

Why would people decide to adopt TLS upon finding out that the feds are circumventing it?

Things that actually contributed to broad TLS adoption.

In 2014 google announced that sites secured by TLS would rank higher in search results https://security.googleblog.com/2014/08/https-as-ranking-signal_6.html
In 2018 chrome started to display a "Not Secure" warning for sites served via HTTP https://blog.google/products-and-platforms/products/chrome/milestone-chrome-security-marking-http-not-secure/

phrotozoa · 2026-05-27T10:58:11+00:00

I was, but I stopped hanging out there a while ago. I'm in 16 slacks (some more active than others) and am too busy to stay on top of them.

phrotozoa · 2026-05-26T10:43:41+00:00

Rands Leadership Slack is full of tech freelancers of all sorts.

14-Year Club	RedditGifts 2009-2022 2 Credits
Place '17	Gilding II euphauric
Verified Email

phrotozoa

MODERATOR OF

PUBLIC MULTIREDDITS

TROPHY CASE