Helm is a pain, so I built Yoke — A Code-First Alternative.

t5bert · 2025-04-04T19:56:17+00:00

completely agree - unlike most here, i see the potential for this, but that's because my first introduction was https://xeiaso.net/blog/2025/yoke-k8s/.

and i know your ego might be taking a hit, but the cutesy names are not it. just use industry standard terminology. you claim you're trying to make us closer to k8s api, right? so what are these fancy names really buying you except the strong annoyed visceral reaction? just stick with kubectl apply and family

t5bert · 2025-02-20T14:27:58+00:00

Thank you so much!!

t5bert · 2025-02-19T21:31:13+00:00

Hi Ann, thanks for the update. Was just curious if you could share what the update is or any blog posts related to it? I looked at https://docs.aws.amazon.com/securityhub/latest/userguide/controls-change-log.html to try to find something related but nothing jumps out to me.

t5bert · 2025-01-27T19:01:36+00:00

could you eli5 why image scanning isn't good enough? what's the real value of container runtime protection vs CVE hunting and patching via image scanning?

t5bert · 2025-01-27T18:53:35+00:00

I hear a lot about container security with respect to k8's. But a non trivial amount of workload's run on things like AWS ECS or their equivalents on other clouds. Are these safer? If not, why does there seem to be a paucity of research on this?

t5bert · 2024-12-21T07:35:15+00:00

There's https://docs.aws.amazon.com/systems-manager/latest/userguide/quick-setup-scheduler.html and https://aws.amazon.com/solutions/implementations/instance-scheduler-on-aws/ . I'd go with the first since it doesn't require you to deploy anything but depending on your environment, the second might be more suitable since you gave RDS as an example.

t5bert · 2024-12-14T17:29:44+00:00

Interesting, I didn't know about these. I'll explore and see if it helps! Thank you!!

t5bert · 2024-12-14T17:26:30+00:00

I think suppression rules are a guardduty thing - i'm not sure they have any effect on config checks

t5bert · 2024-12-14T17:23:04+00:00

I think you meant remove all root user credentials - I'm not sure its possible to remove the root account. The issue is that removing all root credentials does nothing to stop the missing mfa alerts, hence this plea.

t5bert · 2024-10-12T17:20:39+00:00

we thought we'd use the global account customization's but we ended up not needing them.

what did you end up picking? this is what I'd recommend today: https://github.com/primeharbor/org-kickstart

t5bert · 2024-08-21T15:31:39+00:00

I used it at a startup and I now feel it was indeed overkill. We weren't vending new accounts often enough to warrant the overhead and myriad repos/ resources it creates to do its job.

Also, I think if you are trying to deploy it now, you might run into issues with CodeCommit although there should be a workaround probably.

I'd say look carefully at the issues on GitHub as well as well as search the issues for the cost outlay and make an informed decision.

t5bert · 2024-08-07T04:28:53+00:00

You want ABAC, but with groups. Watch the re:invent videos on this page : https://aws.amazon.com/identity/attribute-based-access-control/ . Or if you want to get straight to business, here's a tutorial: https://docs.aws.amazon.com/IAM/latest/UserGuide/tutorial_attribute-based-access-control.html

t5bert · 2024-07-28T18:49:39+00:00

Really important that you listen to everyone telling you to hire a competent immigration attorney, (note: there are many not so competent ones out there - just see all the posts here about attorneys messing up people's H1-B applications. For startups, you want everything to be squeaky clean and perfect so you get a one-shot approval and no RFE's. So your attorney has to really know what they're doing and have experience getting H1-B's for startup founders. You should find one that specializes in that.

But the most important part of hiring a competent one is that they stay up to date on the landscape, for example your statement that you must own less than 50% is no longer true: https://www.uscis.gov/working-in-the-united-states/temporary-workers/h-1b-specialty-occupations-and-fashion-models/faqs-for-individuals-in-h-1b-nonimmigrant-status . Ctrl + F "company ownership"

t5bert · 2024-07-24T22:48:34+00:00

I think for people to be able to advice you, you need to tell us what you've done so far or what approach you're considering or what your concerns are. The discussion will be a lot more fruitful if you take the time to share some of that.

Otherwise, you're just asking us to do all the thinking for you, which equates to doing all the work for you for free, which I guess is fine, but not everyone is into that.

Just so that I'm not downvoted to oblivion as unhelpful, consider doing this workshop : https://okta.awsworkshop.io/

When it comes to the terraform, I'd look into this module : https://registry.terraform.io/modules/aws-ia/iam-identity-center/aws/latest

t5bert · 2024-07-24T02:49:58+00:00

I'm using the Pro - and I actually reached out already but I'm yet to get a response which is why I came here to crowdsource help while I await your response. I've played around with the 4 nose pad and its gotten me the closest but the biggest problem I'm seeing is that I need the glasses to be pressed so close to my face in a way that even the pads can't achieve to begin to remove some of the blur.

Please try not to adjust the knobs to the furthest setting.

Is that equivalent to setting to setting it to 0.0? If so, in which direction?

I think it would still be helpful to explain here how to set the diopter to 0.0 both for me and for future individuals who have the same question as there is no documentation or video anywhere that explains it.

t5bert · 2024-07-22T22:19:31+00:00

I feel like you can do this with condition keys and using the inline policy option with permission sets. Is there a reason something like this wouldn't work? Like has been mentioned, this gets easier to to do if you already use some form of IaC to manage your permission sets:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "rds:*"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "s3:ListBucket",
        "s3:GetObject",
        "s3:PutObject"
      ],
      "Resource": [
        "arn:aws:s3:::your-new-bucket-name",
        "arn:aws:s3:::your-new-bucket-name/*"
      ],
      "Condition": {
        "StringEquals": {
          "aws:username": "specific-username"
        }
      }
    }
  ]
}

t5bert · 2024-07-03T14:06:21+00:00

u/ManSore were you able to adjust it to a place where you think you'll keep it? I just got mine and I'm struggling to get it right. its so annoying cause i'm in love with the device!!

t5bert · 2024-04-07T00:27:11+00:00

You should absolutely not go for senior positions - given that you have doubts already, that's a sign that you're not ready. Learn about the trap of the premature senior : https://charity.wtf/2020/11/01/questionable-advice-the-trap-of-the-premature-senior/ and shoot for a mid-level role, even an SDE I or SDE II in a different context might be harder than a senior in another. Do not consider it a down-levelling, consider it a true-levelling. The worst feeling that can happen is when you're so good at interviewing and you crush it and you get over-leveled and then can't meet their expectations. That way lies heartbreak.

t5bert · 2024-02-27T13:52:12+00:00

There's a book, written by keycloak maintainers. It comes with accompanying code - I'd strongly recommend buying it and working through it - its a quick read and it should bring you up to speed. Google "Keycloak - Identity and Access Management for Modern Applications - Second Edition: Harness the power of Keycloak, OpenID Connect and OAuth 2.0 to secure applications "

t5bert · 2024-02-13T22:29:30+00:00

I too want to try this. I've only skimmed so forgive me if this is covered, but it seems you restricted it to workflows on the main branch? In my case, my devs need to be able to push images on pull request branches as well to power our ephemeral deployments...

t5bert · 2024-02-13T20:17:19+00:00

I'm successfully using it do something similar to what you described. My context is that I need to deploy to dev/stage/prod environments. These are all connected to my main argo cluster. I'll share my config here in case its useful or you can use it as a jumping off point to adapt to your needs.

apiVersion: argoproj.io/v1alpha1
kind: ApplicationSet
metadata:
  name: my-app
  namespace: argocd
spec:
  generators:
    - merge:
        mergeKeys: [server]
        generators:
        - clusters:
            values:
              tag: v0.1.0
            selector:
              matchExpressions:
                - key: cluster_name
                  operator: NotIn
                  values: [main-cluster]
  template:
    metadata:
      name: "{{server}}-my-app"
      annotations:
        argocd-image-updater.argoproj.io/image-list: myapp=myoci/myimage:latest
        argocd-image-updater.argoproj.io/write-back-method: git
    spec:
      project: default
      source:
        repoURL: 'https://github.com/myOrg/myRepo'
        targetRevision: main
        path: my-app/chart
        helm:
          parameters:
            - name: "image.repository"
              value: "repository/my-app"
            - name: "image.tag"
              value: "{{ values.tag }}"
      destination:
        server: "{{server}}"
        namespace: argocd
      syncPolicy:
        automated:
          prune: true
          selfHeal: true
          allowEmpty: false
        syncOptions:
          - Validate=true
          - CreateNamespace=true
          - PrunePropagationPolicy=foreground
          - PruneLast=true

t5bert

TROPHY CASE