tinyvmm Migrating Forward Migrations are tricky business. If you think of the Kubernetes model, the client API supports versioned objects. You can e.g. store an ExternalSecret version v1beta1 and then read it as an ExternalSecret v1alpha1. Kubernetes APIs do that by allowing upgrading and downgrading the resource versions. Why is it practically
tinyvmm The woes of networkd When I based the initial implementation of tinyvmm’s networking on networkd I thought it was a genuinely good idea. Networkd knows how to manage networks and it’s much easier to talk INI files than kernel syscalls. It also had a neat DBUS API, meaning I could control it
bazel Featured From Create-React-App to Bazel: how to build things This story describes my experience of moving a create-react-app based app to bazel and the reasons for the move.
metanotes Featured My Journey into self-sustainable note-taking I have vast collections of notes I amassed over the years, spanning from text files in SVN, webpage snips in Evernote, semi-structured notes in Bear, and, lately, TiddlyWiki.
envoy Jwks remote fetch is failed Isn’t it nice when you wake up and your auth is broken, despite you not changing anything? Isn’t it fun to debug a third-party integration? Anyways, I stumbled on an annoying gRPC error: Given the backend didn’t log the request, I blamed the middle man, aka envoy.
ssh Featured SSH Auth with Yubikeys SSH supports FIDO2/U2F since 8.2, so you can generate a FIDO2 key with a trivial ssh-keygen -t ecdsa-sk. However, neither the default SSH in Windows 10 nor macOS is new enough, so I’ll guide you through the smartcard way (aka gpg ssh).
security Featured K3S & NetworkPolicy: a short story of pain A short story of tracing a broken curl to an inconspicuously slow NetworkPolicy
envoy Simple JWT Authentication with Envoy and Auth0 JSON Web Tokens is a popular web standard for representing claims securely between two parties. In a nutshell, a JSON Web Token is several chunks of Base64-encoded JSON concatenated together, specifying who issued it and for whom, what’s the audience of the token, for how long it’s valid,
envoy How to configure HTTPS backends in envoy Envoy is an extremely flexible reverse proxy, most known by its use in istio [https://istio.io/] where it functions as an envelope in every job, routing the traffic and managing authorization. That said, it’s totally fine to use envoy on its own; one case for such would be
