Nahidul Kibria

How To Build A Platform Engineering Environment On Kubernetes 👇 ✅ Part 1: https://buff.ly/3u58qhA Part one dives into building the cluster, automating the workflows, and securing the environment. ✅ Part 2: https://buff.ly/47NDG2k Part two dives into platform capabilities like monitoring, observability, and overall cluster management. ✅ Part 3: https://buff.ly/4939GRg Part three dives into various tools and platforms you can use to make platform engineering easier on Kubernetes. #kubernetes #devops #platformengineering

118

1 Kommentar

📥 Import existing console-created resources into your #Terraform / #OpenTofu code. Read this post to learn how to manage existing cloud resources without recreating them using the 'import' command👇

4

mapkubeapis is a Helm v3 plugin which updates in-place Helm release metadata that contains deprecated or removed Kubernetes APIs to a new instance with supported Kubernetes APIs. More: https://lnkd.in/dgJp9C5G

12

✴ Ever Wondered How Terminated Pods Are Cleaned Up in Kubernetes? Kubernetes has a built-in Pod GC (Garbage Collection) Controller that is responsible for cleaning up terminated pods. This controller initiates gc cycle every 20 seconds, scans for all terminated and orphaned pods and deletes them. ✴ What Are Terminated Pods? Terminated pods are those that have either: 👉 Successfully completed their tasks (status: Succeeded) 👉 Failed during execution (status: Failed) 👉 Been manually deleted by a user To be precise, any pod with a status phase that is not "Pending", "Running", or "Unknown" is considered terminated. ✴ What Are Orphaned Pods? Orphaned pods are those scheduled to nodes that are no longer accessible. This typically happens when nodes are deleted or become unreachable. 🍀 Configurable GC Behavior The behavior of the Pod GC Controller is adjustable. One key parameter is the "terminated-pod-gc-threshold", which defines the maximum number of terminated pods that can exist before the controller begins deleting them. For example: --terminated-pod-gc-threshold=1000 This means the controller starts deleting terminated pods when the count exceeds 1000. In Google Kubernetes Engine (GKE), this threshold is set to 12,500. However, if your cluster experiences many terminated pods in a short time, it may be wise to decrease this threshold to improve efficiency and resource management. [The following code snippet is from the official Kubernetes repo -https://lnkd.in/gyJZgjXw]

61

🔭 OpenTelemetry Collector: The Architecture Review I have just published the second article in my OpenTelemetry series about design, architecture and interesting implementation spots in the OTel Collector including: - 🔗 The Signal Processing Pipeline Architecture -📡 OTel Receivers. Prometheus-style Scrapers - ⚙️ OTel Processors. The Memory Limiter & Batch Processor. Multi-tenant Signal Processing - 🚚 OTel Exporters. The Exporting Pipeline & Queues. The implementation of persistent queues - 🔭 How observability is done in the OTel Collector itself. Logging, metrics, and traces - 🔌 OTel Extensions Design. Authentication & ZPages -👷Custom Collectors & OTel Collector Builder - 🚧 Feature Gates Design & The Feature Release & Deprecation Process Enjoy the article & let me know how do you like it 🙌 #observability #opentelemetry #golang #distributedsystems

17

3 Kommentare

Is Load Delay making your Largest Contentful Paint Score worse? Load Delay happens when the browser can't recognize the LCP image immediately after loading the HTML code. Our new article looks at 4 examples of load delay and how to fix it.

5

The CSI driver EKS plugin doesn't use the cluster's IAM role. Here is why: EKS has a default storage class (gp2) which is part of the in-tree storage plugin. It uses the cluster's IAM role to manage EBS volumes. So you don't need to add any extra IAM role to manage volumes using gp2. However, the EBS CSI Driver requires its own separate IAM permissions to interact with AWS services. This is because it runs as a separate service inside the cluster. To provide the necessary IAM access to the CSI Controller, you can use the Pod Identity Webhook Plugin. This allows you to assign temporary IAM credentials directly to the CSI Controller using a Kubernetes service account. This way, the EBS CSI Controller can securely authenticate with AWS and perform operations like provisioning, attaching, and managing EBS volumes. If you are using eksctl to manage clusters, You can associate IAM permission with the simple 𝗮𝘂𝘁𝗼𝗔𝗽𝗽𝗹𝘆𝗣𝗼𝗱𝗜𝗱𝗲𝗻𝘁𝗶𝘁𝘆𝗔𝘀𝘀𝗼𝗰𝗶𝗮𝘁𝗶𝗼𝗻𝘀 flag as shown in the image. With this option, eksctl automatically resolves and applies the recommended IAM roles and pod identity associations for the add-ons (e.g., EBS CSI Driver). You can refer to my detailed eksctl guide to get hands-on with this feature. 𝗲𝗸𝗰𝘁𝗹 𝗯𝗹𝗼𝗴: https://lnkd.in/gwKtZX38 If you want to understand more about EKS EBS CSI Driver Workflow, you refer to the following blog. 𝗖𝗦𝗜 𝗗𝗿𝗶𝘃𝗲𝗿 𝗪𝗼𝗿𝗸𝗳𝗹𝗼𝘄: https://lnkd.in/gpGTR3Zw PS: ♻️ Repost if you find this useful. It helps the DevOps community 🙂 Have anything to add? Comment below. #devops #aws #kubernetes

142

2 Kommentare

A severe SQL injection vulnerability has been discovered in Grafana, a popular open-source platform extensively used for monitoring and observability. This flaw enables attackers with valid user credentials to execute arbitrary SQL commands, posing risks such as data leakage and security breaches. Grafana Tool Vulnerability The vulnerability is located within the Grafana SQL package, specifically in the SqlDatasource.ts file, where SQL queries are managed and executed. This can be exploited by attackers who send a malicious POST request to the /api/ds/query endpoint, utilizing a carefully constructed raw SQL parameter. ~First Hackers News To Continue reading this article, click on this link >>> https://lnkd.in/g47ctywr #sql #vulnerability #grafana #monitoring #attackers #breach #malicious #endpoint #cyberattack #cyberdefence #cybersecurity #fhn #firsthackersnews #informationsecurity #latestupdates

1

In this practical guide, you'll cover the fundamental aspects of the Kubernetes API to help you navigate it confidently. More: https://lnkd.in/gqpJaivH

142

2 Kommentare

If you got Cilium, then you definitely gotta have Gateway API as well. I mean, why not, right? It makes total sense cause it's more flexible than Ingress and has more capabilities than its cousin. Anyway, I'm not here to convince you which to pick (psst... pick Gateway API)... I'm here to announce the new article I published just today for installing cert-manager and fetching TLS certificates by integrating your preferred cloud provider. It goes from the installation of the operator in the Kubernetes cluster, creating the issuer, fetching a TLS certificate, and what's good without a concrete example if there wasn't an HTTPS application exposed at the end (spoiler alert, there is an example). Enjoy reading, and if you like the content, share it with your network. #kubernetes #cilium

13

Checkout the Provisioners in Terraform. In this video Sagar Maurya talks about: - What are Provisioner in Terraform? - Local-exec Provisioner - Destroy-Time Provisioners - Should we use it? https://lnkd.in/dvR8SFWv Stay tuned for more advanced stuff! Register for daily live interactive classes here: https://lnkd.in/dayhDZXt -Team Dhaansu DevOps #DevOps #DevSecOps #SRE #CloudComputing #CICD #Deployment #CuttingEdge #Terraform #EC2 #Provisioners #AWS #Git #VersionControl  #DhaansuDevOps #Systumm #Faad #Denge #Upskill 

5

Dear software developers, Small recap about #ELF (it has nothing to do with german national soccer team) ELF as unix-like system specific executable contains additional, metadata information that can be used to inspect the by the compiler generated file. These information are stored into different kind of sections: - Header: describes the executable in terms of the type of the executable, architecture, and other attributes - Program headers: these describe the runtime properties of each segment, like code, data, stack, etc. - Section headers: these describe each section within the binary, like symbol tables, string tables, and similar - Symbol tables: unless the binary is stripped (‚strip <executable>‘) - as usually is for building the release binary, the ELF contains symbol tables and therefore information that can be used for core dump analysis (f.e. with gdb), about the function and variables, their names and addresses, everything that is required to retrieve some meaningful backtraces - Dynamic link information: about the external - shared library dependencies This way you can use a different kind of tools, like objdump (,objdump -x <executbale>‘) to inspect the binary on all these metadata information, or even disassemble machine code to human-readable assemble code (,objdump -d <executable>’). Another useful tool that can leverage on these descriptive information included in ELF is ldd - to inspect the dynamic link information: (,ldd <executable>’). This could be useful to resolve the issue when some shared libraries are missing on the target - are not deployed, which prevent executable to run, especially if this binary is not originally part of the image (f.e. if you want to use tcpmdump diagnostic tool that is not by default delivered with the image). # For more content, please visit my blog https://lnkd.in/dMPi7cvg Feedback as usual more than welcome. #unix #embedded #cplusplus #programming

18

4 Kommentare

🚀Run Your Own Kubernetes Clusters on Hetzner! 🚀 Our new tutorial is here to guide you! 🔎What You’ll Learn: ▶ How to use Cluster API with Hetzner Cloud GmbH ▶ Step-by-step instructions to get you started quickly 💡Why You Need This: Managing #Kubernetes clusters can be complex and time-consuming. With our Cluster API Provider Hetzner, you'll simplify the process and gain more control. However, running a full-fledged Kubernetes platform takes a lot of effort - even with Cluster API. That's why we addressed these pain points of DIY Kubernetes, among others: ▶ Security concerns: We follow all security best practices and test every version for CVEs ▶ Software compatibility issues: We ensure compatibility of all relevant components of the Kubernetes clusters ▶ Operating system and network configuration: We handle all configurations to meet compliance standards ▶ Tedious updates: Enjoy zero downtime updates, so your clusters are always up-to-date without interruption ▶ Comprehensive testing: We rigorously test every upgrade to ensure reliability and performance Ready to transform your Kubernetes management? Drop us a message and let's get started! 🥳 Read the tutorial now: ▶ English Version: https://lnkd.in/eFczJYK8 ▶ German Version: https://lnkd.in/ernhEUbS Cluster API Provider Hetzner: ▶ GitHub: https://lnkd.in/eRm5V_fT ▶ CAPH Docs: https://lnkd.in/erqF2P_X #syself #clusterapi #devops #opensource

18

3 Kommentare

About our Terraform Google Provider. If you missed the following information, here's a little catch-up. - Opt-out default label “goog-terraform-provisioned” - Deletion protection fields added to multiple resources - Allowed reducing the suffix length in “name_prefix” for multiple resources Awesome! https://lnkd.in/dEGyD8b2

29

1 Kommentar

Mastering Terraform Workflows: apply-before-merge vs apply-after-merge When managing cloud infrastructure with Terraform, one common question arises: Should we run terraform apply before or after merging a pull request back to the main branch? This article explores both workflows, highlighting why apply-after-merge is often the better choice. https://lnkd.in/eU2N5h9K

15

1 Kommentar

Kubernetes has driven cloud spending up for 49% of respondents. The main reasons for this overspending include: 🔷 Overprovisioning (70%): Excess resources are allocated, leading to unnecessary costs 🔷 Resource Sprawl (43%): Resources are not deactivated after use, contributing to waste. Additionally, challenges related to visibility and responsibility are significant: 🔷 Lack of Visibility and Insight (40%): Teams struggle to track and manage consumption and spending effectively. 🔷 Lack of Awareness and Responsibility (45%): At both individual and team levels, there is a gap in understanding and managing resource usage. Onepane can help you tackle these issues by providing clear visualizations that help teams quickly identify and fix problems. Our shared interface enhances collaboration, making it easy for team members to collaborate and share insights to improve efficiency, as faster root cause analysis reduces downtime and boosts system reliability. Image Source: Cloud Native Computing Foundation (CNCF) #k8s #AWS #Azure #GCP

14

1 Kommentar