Has anyone actually *done* Kubernetes ABAC based on matching resource and principal actor labels?
Search just yields slop or toy projects, and the official docs don't indicate *how* you can access the attributes of the principal or resource in the policy.
Malarkey clause: if you haven't done it yourself or the article isn't complete and thorough, don't bother. LLM responses banished to the sun at rocket speed.
#K8s #Kubernetes #KubernetesDev #DevOps #PlatformEngineering
Kubernetes-native etcd secrets encryption using TPM/HSM
They...they implemented my side project...sobbing rn
Cluster Bare Autoscaler is a tool that automatically adjusts the size of the bare-metal Kubernetes cluster. - docent-net/cluster-bare-autoscaler
@seanhood there's a few key changes in my design
1. A full, functional programming language for inflating configuration into manifest files. We publish a versioned library of this as an OCI artifact, and any resources or changes the library doesn't support yet can be done by passing a closure/function to an escape hatch.
2. Kubernetes is THE control plane. Anything that would have been terraform is now Crossplane or ACK or whatever operator. No living in two worlds or picking the best-of-the-worst couplings between TF and K8s
3. The control plane desired stare should include any cross-resource dependencies. It's still GitOps but there should be no need for any write back or chore commits. This is where the custom operator comes in, though potentially Kro could work.
After a couple hours of very less-coding and more-pacing-and-thinking I've wrangled the blockers and have started on actual implementation of the cluster autoscaler.
I can see a couple spots that are going to get much more complex - caching informers, backoffs, tracking desired state, and background reconciliation loops.
Exciting at least! Working for hours to change a handful of lines is ....rewarding but also uncomfortable.
Interesting but what-you'd-expect container caching enhancement to Kubernetes architecture.
Does make me wonder if you could do the caching at the content-addressed-storage layer with distributed s3 and data locality via redirects and maybe presigned URLs...
Great post on authoring Kubernetes controllers with examples and lots of onward reading
Any company using Kubernetes eventually starts looking into developing their custom controllers. After all, what’s not to like about being able to provision resources with declarative configuration: Control loops are fun, and Kubebuilder makes...
Operator works fine against a cluster, testing framework fails.
Tracked it down and the test call to create my Custom Resource wipes the TypeMeta off it. But...why?
Started wrangling this test framework and the moment I got past just getting it working it revealed a bug to me.
Now that's instant gratification.
"Musty Bits" McGee