[{"content":"","date":null,"permalink":"https://dminca.github.io/","section":"Daniel-Andrei Minca","summary":"","title":"Daniel-Andrei Minca"},{"content":"","date":null,"permalink":"https://dminca.github.io/tags/kubernetes/","section":"Tags","summary":"","title":"Kubernetes"},{"content":"","date":null,"permalink":"https://dminca.github.io/tags/monitoring/","section":"Tags","summary":"","title":"Monitoring"},{"content":"This guide has multiple parts, youre reading now Part 1. Had to do this to prevent the blog post from getting way too huge to manage and also not to tire the poor reader. The rest of the parts will be added below as they come\nIt all started with the \u0026ldquo;what if\u0026rsquo;s\u0026rdquo;\nwhat if I don\u0026rsquo;t need Helm to generate a shit ton of manifests and pick my brain on understanding whatever the fuck the author of the Chart wanted to say on this _helpers.tpl what if Kustomize is simply not enough for keeping my code DRY because I have to apply too much brain gymnastics to format my code according to Kustomize\u0026rsquo;s requirements what if THERE\u0026rsquo;S MORE THAN THAT? Well, there was actually more: jsonnet\nIf you check your basic tutorial on YouTube or any blog post on the net, nearly everyone keeps saying YAML is the language of data, well this is what\u0026rsquo;s built upon. Generating data, be it YAML or JSON.\nToolchain #Like all carpenters out there, you\u0026rsquo;re gonna need some basic tooling to get this story working\nThanos kluctl jsonnet-language-server jsonnet-bundler kube-thanos | jsonnet kube-prometheus | jsonnet Setting up your IDE (NeoVIM) #DISCLAIMER(!) althought jsonnet language support is obnoxiously crap at the current point in time, you\u0026rsquo;re not going to get 100% flexibility in other IDEs except NeoVIM. Just wanted to put this out there so that we smash all dreams from the beginning and be real.\ninstall jsonnet CLI install jsonnet-bundler install jsonnet-language-server configure it in your NeoVIM CoC, you can see my Nix Flake for reference Generating the YAML manifests #By default, jsonnet -J vendor -m manifests example.jsonnet command will dump JSON files in the ./manifests dir.\nThe -J vendor flag we\u0026rsquo;re passing instructs jsonnet where to find the dependencies we\u0026rsquo;ve pulled from the net.\nTherefore, we\u0026rsquo;re going to need gotojsonyaml to convert the JSON files to Kubernetes YAML manifests, as seen in this build.sh script that everyone shoves up our throats as the default way to go.\nBash scripts #Personally, I despise using Bash scripts simply for this operation of converting JSON to YAML because the above mentioned shell script is fairly limited. Sure, one can argue it\u0026rsquo;s just a starting point or example to get started BUT you\u0026rsquo;ll notice the script craps-out midway while rendering through kube-prometheus jsonnet files \u0026hellip;\nThat\u0026rsquo;s why I\u0026rsquo;ve written a small Go program helper to tackle this operation in a much safer and faster way see codeberg.org/dminca/tiny-programs/jsonnet-convert\nShell scripts have been for a long time considered the glue code of architecture but what this glue code will never contain is UNIT TESTS. Let\u0026rsquo;s admit it, no one in their lives that\u0026rsquo;ve written shell scripts, have written a single unit test for them because the only supported way (which came fairly late) was bats and it\u0026rsquo;s horrendous.\nProgramming this in Go has many advantages\neverything is contained in that package unit tests sit close to the main code dependencies are tracked dependencies are cryptographically checksumed so ++Security Can shell scripts do that? NOPE.\nProject structure #Since we mentioned we\u0026rsquo;re going to use kluctl to tackle the deployment of all generated manifests, we need to structure it in a way that\u0026rsquo;s not getting too messy to get out of control, here\u0026rsquo;s what I propose\n . ├──  kube-thanos-jsonnet │ ├──  manifests │ ├──  vendor │ ├──  first-tenant-example.jsonnet │ ├──  jsonnetfile.json │ ├──  jsonnetfile.lock.json │ ├──  kube-prometheus-example.jsonnet │ └──  thanos-example.jsonnet ├──  vars │ ├──  common.yml │ └──  prd.yml ├── 󰊢 .gitignore ├──  .kluctl.yml ├──  deployment.yml └── 󰂺 README.md This is the most basic kluctl project structure that you could come up with\n# .kluctl.yml discriminator: \u0026#34;app.kubernetes.io/instance={{ target.name }}\u0026#34; targets: - name: prd context: production-kubernetes-cluster-fqdn args: {} - name: stg context: staging-kubernetes-cluster-fqdn args: {} # deployment.yml vars: - file: ./vars/common.yml - file: ./vars/{{ target.name }}.yml deployments: - path: kube-thanos-base git: url: https://github.com/thanos-io/kube-thanos ref: 6fedb045db2aeb0a4a880f77bfdfb5d4580f51f9 path: jsonnet Use vars/common.yml and vars/prd.yml to define environment specific variables for Kluctl to use.\nWrap-up #What did we achieve in the first part\nwe\u0026rsquo;ve set-up our development environment to make it easier to develop in Jsonnet we\u0026rsquo;ve setup a basic directory structure for working with kluctl in the next parts Stay tuned, in the next part we\u0026rsquo;re going to adjust the project structure and make room for our tenants or even plan the whole tenant setup together. Think about questions like\nhow many teams are there? do SREs need acccess to ALL the metrics? and many others ","date":"29 August 2025","permalink":"https://dminca.github.io/posts/p1-multi-tenant-thanos-with-jsonnet/","section":"Posts","summary":"","title":"Part 1: Multi-tenant Thanos with Jsonnet"},{"content":"","date":null,"permalink":"https://dminca.github.io/posts/","section":"Posts","summary":"","title":"Posts"},{"content":"","date":null,"permalink":"https://dminca.github.io/tags/","section":"Tags","summary":"","title":"Tags"},{"content":"","date":null,"permalink":"https://dminca.github.io/tags/tutorial/","section":"Tags","summary":"","title":"Tutorial"},{"content":" pepr.dev Mutate: Dynamically modify incoming resource configurations to adhere to system security policy Validate: Enforce strict validation rules, preventing the deployment of resources that don\u0026rsquo;t meet defined criteria Watch: Enable rapid responses to updates and help maintain desired cluster states Flux Multitenant Policies how to use the Kubernetes built-in validating admission engine to enforce policies on multi-tenant clusters managed by Flux Startx LimitRange (sxlimits) Simplifying Kubernetes Limits Range with sxlimits | Medium The sxlimits command line can interact with a kubernetes cluster and allow operations on the LimitRanges resources like resize or adjust to update the spec.hard values kubectl plugin to print Kubernetes resource conditions kubectl plugin to print Kubernetes object resource conditions in a more human-readable format open-source JSON Editor JSON Crack is a tool for visualizing JSON data in a structured, interactive graphs, making it easier to explore, format, and validate JSON. It offers features like converting JSON to other formats (CSV, YAML), generating JSON Schema, executing queries, and exporting visualizations as images. Designed for both readability and usability ","date":"15 August 2025","permalink":"https://dminca.github.io/posts/things-to-try/","section":"Posts","summary":"Collection of awesome tooling awesome to try out","title":"Things to Try"},{"content":"","date":null,"permalink":"https://dminca.github.io/tags/tryout/","section":"Tags","summary":"","title":"Tryout"},{"content":"","date":"22 March 2025","permalink":"","section":"Posts","summary":"Privacy Guides is a not-for-profit, volunteer-run project that hosts online\ncommunities and publishes news and recommendations surrounding privacy and\nsecurity tools, services, and knowledge","title":"Privacy Guides — privacy advocacy community"},{"content":"Just wiped my RaspberryPi 3b+ and figured I forgot to back-up some PiHole settings 🤦‍♂️ (go figure). This is my attempt at keeping a tab there and preventing this from happening again.\nAdLists # https://big.oisd.nl https://perflyst.github.io/PiHoleBlocklist/SmartTV.txt PiHole settings #DNS #Providers # NextDNS1 DNS0.eu2 Mullvad DNS3 Setup # AuthN to nextdns.io1 copy IPv4 \u0026amp; IPv6 of NextDNS come back to PiHole Settings → DNS → Custom DNS servers paste them in this box Save\u0026amp;Apply DHCP # Settings → DHCP → DHCP Settings toggle DHCP server enabled input a range, eg. x.x.x.100 - 200 toggle Enable additional IPv6 support (SLAAC + RA) Advanced DHCP Settings DHCP lease time: 1d check Advertise DNS server multiple times Advertise DNS server multiple times is needed here otherwise during DSL outages you\u0026rsquo;ll suffer DNS issues, meaning if you try pinging the PiHole station you\u0026rsquo;ll get\nRequest timeout for icmp_seq 0 ping: sendto: No route to host There\u0026rsquo;s no point to discuss what\u0026rsquo;ll nc -zv x.x.x.x 22 return.\nModem (router) settings #DNSv4/v6 setup # Internet → Zugangsdaten → DNS Server DNSv4-Server Andere DNSv4-Server verwenden add IPv4 of RaspberryPi DNSv6-Server Andere DNSv6-Server verwenden add IPv6 of RaspberryPi DHCPv4 setup # Heimnetz → Netzwerkeinstellungen IP-Adressen → IPv4-Einstellungen uncheck DHCP-Server aktivieren DHCP-Server aktivieren needs to be disabled because PiHole acts as DHCPv4 server. This is needed in order to have client hostnames shown in PiHole dashboard. F.A.Q. #PiHole lacks an IPv4 address #Even though you\u0026rsquo;ve pinned it on the modem somehow PiHole flushed it. This is how you can pin it.\nSince you\u0026rsquo;re using Raspberry Pi OS Lite and don\u0026rsquo;t have the dhcpcd service, you can set a static IP address using the Network Manager tool. Here\u0026rsquo;s how to do it:\nUsing nmtui # Open the Network Manager text user interface by running: sudo nmtui Select \u0026ldquo;Edit a connection\u0026rdquo; and choose your network interface (either eth0 for Ethernet or wlan0 for Wi-Fi).\nNavigate to \u0026ldquo;IPv4 CONFIGURATION\u0026rdquo; and change it from \u0026ldquo;Automatic\u0026rdquo; to \u0026ldquo;Manual\u0026rdquo;.\nAdd your desired static IP address, along with the subnet mask (usually /24), gateway, and DNS servers.\nSave the configuration and exit nmtui.\nReboot your Raspberry Pi to apply the changes:\nsudo reboot Alternative Method: Editing Configuration Files #If you prefer editing configuration files directly, you can modify the NetworkManager connection file:\nFind your connection file in /etc/NetworkManager/system-connections/.\nEdit the file using sudo:\nsudo nano /etc/NetworkManager/system-connections/your_connection_file In the [ipv4] section, add or modify these lines: [ipv4] method=manual address1=192.168.1.X/24,192.168.1.1 dns=192.168.1.1;8.8.8.8; Replace \u0026ldquo;192.168.1.X\u0026rdquo; with your desired static IP, and adjust the gateway and DNS servers as needed.\nSave the file and restart the NetworkManager service: sudo systemctl restart NetworkManager These methods should allow you to set a static IP address on your Raspberry Pi OS Lite system without relying on the dhcpcd service456.\nCannot SSH into my PiHole because there\u0026rsquo;s no IPv4 attached to it! #If there\u0026rsquo;s no IPv4, there\u0026rsquo;s an IPv6 for sure, try using that instead\nssh pi@2001:db8:0:2234:5678:9abc:def0:1234 Rebooted my PiHole and I don\u0026rsquo;t know if it came up #Ping either IPv4 or IPv6; whichever\u0026rsquo;s attached.\n# traditional ping IPv4 ping pi.hole ping 192.0.2.42 # ping IPv6 ping6 2001:db8:0:2234:5678:9abc:def0:1234 Cannot SSH onto my PiHole because of SSH strictHostKeyChecking # remove the host from ~/.ssh/known_hosts ssh-keygen -R example.com retry SSH-ing again unbound settings #Minimal configuration #For a minimal configuration to kick things off\nserver: verbosity: 0 interface: 127.0.0.1 port: 5335 do-ip4: yes do-udp: yes do-tcp: yes do-ip6: yes root-hints: \u0026#34;/var/lib/unbound/root.hints\u0026#34; harden-glue: yes harden-dnssec-stripped: yes hide-identity: yes hide-version: yes use-caps-for-id: yes prefetch: yes prefetch-key: yes qname-minimisation: yes rrset-roundrobin: yes cache-min-ttl: 3600 cache-max-ttl: 86400 unwanted-reply-threshold: 10000 edns-buffer-size: 1232 msg-cache-size: 50m rrset-cache-size: 100m private-address: 192.168.0.0/16 private-address: 10.0.0.0/8 private-address: 172.16.0.0/12 private-address: 127.0.0.0/8 private-address: ::1 private-address: fc00::/7 private-address: fe80::/10 Advanced configuration #For a more advanced and hardnened configuration\nserver: # Logging verbosity: 0 # Interfaces interface: 127.0.0.1 interface: ::1 # add if Pi-hole uses IPv6 locally port: 5335 # Protocols do-ip4: yes do-udp: yes do-tcp: yes do-ip6: yes # Root hints (optional: remove to use built-ins) root-hints: \u0026#34;/var/lib/unbound/root.hints\u0026#34; # Security \u0026amp; DNSSEC harden-glue: yes harden-dnssec-stripped: yes harden-referral-path: yes aggressive-nsec: yes val-clean-additional: yes # Privacy hide-identity: yes hide-version: yes use-caps-for-id: yes qname-minimisation: yes qname-minimisation-strict: yes # Cache \u0026amp; performance prefetch: yes prefetch-key: yes rrset-roundrobin: yes msg-cache-size: 50m rrset-cache-size: 100m cache-min-ttl: 300 cache-max-ttl: 86400 cache-max-negative-ttl: 3600 serve-expired: yes serve-expired-ttl: 86400 serve-expired-reply-ttl: 30 edns-buffer-size: 1232 num-threads: 2 so-rcvbuf: 4m so-sndbuf: 4m # RRL (optional if strictly loopback) ratelimit: 1000 # Private ranges (to avoid ECS/leakage) private-address: 192.168.0.0/16 private-address: 10.0.0.0/8 private-address: 172.16.0.0/12 private-address: 127.0.0.0/8 private-address: ::1 private-address: fc00::/7 private-address: fe80::/10 # If you ever listen beyond loopback: access-control: 127.0.0.0/8 allow access-control: ::1 allow Validate configuration and restart #sudo unbound-checkconf sudo systemctl start unbound https://nextdns.io\u0026#160;\u0026#x21a9;\u0026#xfe0e;\u0026#160;\u0026#x21a9;\u0026#xfe0e;\nhttps://www.dns0.eu\u0026#160;\u0026#x21a9;\u0026#xfe0e;\nhttps://mullvad.net/en/help/dns-over-https-and-dns-over-tls\u0026#160;\u0026#x21a9;\u0026#xfe0e;\nHow to Set Up a Raspberry Pi Static IP Address - Pi My Life Up https://pimylifeup.com/raspberry-pi-static-ip-address/\u0026#160;\u0026#x21a9;\u0026#xfe0e;\nSet a static IP address with nmtui on Raspberry Pi OS 12 \u0026lsquo;Bookworm\u0026rsquo; https://www.jeffgeerling.com/blog/2024/set-static-ip-address-nmtui-on-raspberry-pi-os-12-bookworm\u0026#160;\u0026#x21a9;\u0026#xfe0e;\nHow to set a static IP address in PiOS? - Raspberry Pi Forums https://forums.raspberrypi.com/viewtopic.php?t=362637\u0026#160;\u0026#x21a9;\u0026#xfe0e;\n","date":"16 March 2025","permalink":"https://dminca.github.io/posts/pi-hole-settings/","section":"Posts","summary":"","title":"Pi-Hole Settings"},{"content":"","date":null,"permalink":"https://dminca.github.io/tags/privacy/","section":"Tags","summary":"","title":"Privacy"},{"content":"","date":null,"permalink":"https://dminca.github.io/tags/article/","section":"Tags","summary":"","title":"Article"},{"content":"","date":null,"permalink":"https://dminca.github.io/tags/tools/","section":"Tags","summary":"","title":"Tools"},{"content":"","date":null,"permalink":"https://dminca.github.io/tags/til/","section":"Tags","summary":"","title":"Til"},{"content":"","date":null,"permalink":"https://dminca.github.io/tags/tips/","section":"Tags","summary":"","title":"Tips"},{"content":" vim is a double edged sword. Use it properly and you\u0026rsquo;ll see the benefits, don\u0026rsquo;t use it properly and it\u0026rsquo;s just going to cause more pain and sorrow. Handy vim cheatsheet: https://vim.rtorr.com\nHow to add text at the end of each line #Use-case: assume you just copied a whole column of text and just want to append a comma at the end\n:%s/$/,/ :\u0026#39;\u0026lt;,\u0026#39;\u0026gt;s/$/,/ '\u0026lt;,'\u0026gt; assumes you selected text aka visual select :\u0026#39;\u0026lt;,\u0026#39;\u0026gt;norm A, Remove lines that (do not) contain a specific word #Use-case: you created a Kubernetes Secret via kubectl create secret and want to remove all lines containing creationTimestamp: null\n:g /word/d The reverse of this (meaning, remove lines that don\u0026rsquo;t contain specific word) would look like this\n:g!/word/d delete all blank lines #:g/^$/d copy file contents to clipboard #:%w !pbcopy replace text matching X with Y #with confirmation\n:%s/replacethis/withthis/gc without confirmation\n:%s/replacethis/withthis/g move existing window to existing tab #As a window is just a viewport into a loaded buffer, you have to:\nNote the buffer number displayed in the current window. :close! the window. Switch to the existing target tab page. :sbuffer the buffer number to re-open it. save and restore multiple different sessions #Use-case: assume you just upgraded vim or Terminal app and just want to restart them\n:mksession ~/mysession.vim source session to restore everything back\n:source ~/mysession.vim open vim with the session\n$ vim -S ~/mysession.vim open filename under cursor like gf, but in a new tab # gf - Edit existing file under cursor in same window C-W f - Edit existing file under cursor in split window C-W C-F - Edit existing file under cursor in split window C-W gf - Edit existing file under cursor in new tabpage make a new directory or file in netrw, vim\u0026rsquo;s file explorer #If you are in the file explorer mode, you can use:\nd for creating a directory % for creating a new file You can get into the explorer mode with issuing a command :Sexplore or :Vexplore\nThere is no need to call external commands with !\nfind and replace all instances of specific string in multiple files in vim #The general workflow is:\nSearch for your pattern across the project. Operate on each match (safer, slower) or on each file with matches (riskier, faster). Write your changes. The first step can be done with any command that populates the quickfix list: :help :vimgrep, :help :grep, something from a third-party plugin, etc.\nTaking :grep as an example:\n:grep foo **/*.js will populate the quickfix list with an entry for every foo found in *.js files in the current directory and subcategories. You can see the list with :cwindow.\nThe second step involves :help :cdo or :help :cfdo:\n:cdo s/foo/bar/gc which will substitute every foo with bar on each line in the quickfix list and ask for confirmation. With :cfdo it would look like that:\n:cfdo %s/foo/bar/gc If you are super confident, you can drop the c at the end. See :help :s_flags.\nThe third step involves :help :update:\n:cfdo update which will write every file in the quickfix list to disk if they have been changed.\nIn short:\n:gr foo **/*.js :cdo s/foo/bar/gc :cfdo up Remove all unwanted whitespaces #Ever had those pesky trailing whitespaces? How about those on a newline? Well, this trick should do it\n:%s/\\s\\+$//e In a search,\\s finds whitespace (a space or a tab), and \\+ finds one or more occurrences. The following command deletes any trailing whitespace at the end of each line. If no trailing whitespace is found no change occurs, and the e flag means no error is displayed ","date":"1 May 2024","permalink":"https://dminca.github.io/posts/vim-for-hackers/","section":"Posts","summary":"","title":"Vim for Hackers"},{"content":"","date":null,"permalink":"https://dminca.github.io/tags/howto/","section":"Tags","summary":"","title":"Howto"},{"content":"","date":null,"permalink":"https://dminca.github.io/tags/best-practices/","section":"Tags","summary":"","title":"Best-Practices"},{"content":"","date":null,"permalink":"https://dminca.github.io/tags/documentation/","section":"Tags","summary":"","title":"Documentation"},{"content":"What is good documentation, how does it look like and where can I find it? There\u0026rsquo;s always that moment in the life of an engineer when you sit in front of your laptop with your warm cup of coffee/tea and a blank page opened, trying to come up with a beginning of that documentation page for your team.\nBeginnings are always harsh, unfortunately you can only overcome them by just writing something, even a bare brain-dump. Keep in mind, when you start writing a docu, the initial version is always a Draft.\nWe\u0026rsquo;ve all skimmed through RFCs and have noticed some of them are in Status: Draft; why, because they have to be peer-reviewed. You\u0026rsquo;ve marked a document Standard when everyone reviewed and proofed it of grammar and typos.\nHere are some good examples of actionable documentation.\nDiscord releases #Version releases are also documentation. Discord writes them in a fun way, so imho I call this fun documentation.\nDiscord app release notes; love the \u0026lsquo;I gotchu\u0026rsquo; link If you click on the I gotchu link, you\u0026rsquo;ll end up on another fun docu page with pictures and explanations of what\u0026rsquo;s new! Now this is the kind of page that never tires a reader. Sure, an image is a thousand words, but there are also gifs with interactive actions being explained, take a look\nBullet points with instructions, clear info bubble and a picture to explain features clearly to the User source You can clearly distinguish from this picture a simple guideline with bullet point steps with detailed actions required from the User. Not only that, an information bubble (green background) emphasizes key elements to the reader, something like FYI.\nEven the smallest details like the notification bubble is explained by Discord team; now that\u0026rsquo;s attention to detail Memgraph documentation # Driver connection links can be interracted even from small touch devices source Memgraph have done a good job here laying down the driver connectivity via the aforementioned programming languages, all clearly distinguished in their own boxes.\nClosing notes #What\u0026rsquo;s common on both documentation pages (Memgraph and Discord) is at the footer they have a way of collecting user feedback. It\u0026rsquo;s a simple question that doesn\u0026rsquo;t require any account, just a humble yes or no. You can also see how many people found it useful.\n","date":"27 August 2022","permalink":"https://dminca.github.io/posts/what-is-good-documentation/","section":"Posts","summary":"","title":"What is good documentation?"},{"content":"","date":null,"permalink":"https://dminca.github.io/tags/authn/","section":"Tags","summary":"","title":"Authn"},{"content":"","date":null,"permalink":"https://dminca.github.io/tags/macos/","section":"Tags","summary":"","title":"Macos"},{"content":"The file we have to edit is /etc/pam.d/sudo.\nWe have to add\nauth sufficient pam_tid.so below the pam_smartcard.so line\nauth sufficient pam_smartcard.so auth sufficient pam_tid.so auth required pam_opendirectory.so account required pam_permit.so password required pam_deny.so session required pam_permit.so Credits to digitaino\n","date":"26 August 2022","permalink":"https://dminca.github.io/posts/touchid-authn-sudo-macos/","section":"Posts","summary":"","title":"TouchID for sudo AuthN on MacOS"},{"content":"","date":null,"permalink":"https://dminca.github.io/tags/git/","section":"Tags","summary":"","title":"Git"},{"content":"The fact that Web surfing has deteriorated lately is no news at all. We can thank the BigCorps for that because they\u0026rsquo;ve managed to gain so much control of that and that\u0026rsquo;s not all, they\u0026rsquo;ve f#cked up the way marketing is done as well.\nHow many times have you tried to peacefully read an article on an online newspaper without being disturbed by those pesky pop-ups to Sign-up to Newsletters or get a free ebook on non-sense? Well, this is breaking usability in many ways.\nThat\u0026rsquo;s not even the tip of the iceberg, if we go deeper, we see they\u0026rsquo;re tracking all our movement on the WWW (spelled dub-dub-dub) for marketing purposes but also selling that information to 3rd parties without even telling you what\u0026rsquo;s going to happend with your data.\nWhy Privacy matters? #That\u0026rsquo;s a question with many edges. I think the real questions should be:\nWould you give your home keys to a total stranger? give your banking credentials to a stranger? share all your medical/financial information publicly? If the answer to the above questions is No then you know what privacy is about by this point.\nImproving your Web surfing experience #The simplest way we can improve our UX, and currently the only way we have full control, is to block ads, pop-ups and tracking.\nPrivacy redirect (browser extension) # Source Supported by uBlock Origin (browser extension) # Source Supported by Privacy Redirect for Safari (€ 1.99 browser extension) # Source Supported by Newpipe (Android app) # Source Supported by Freetube (Desktop app) # Source Supported by Detox your home WiFi LAN #Get yourself a Raspberry Pi 3. Why 3 and not 4? Because 4 requires a cooler and some also install a heatsink. There are many opinions on heatsink\u0026rsquo;s efficiency. To keep things simple, just get a RPI3 kit, it contains everything you need to boot your OS.\nFlash raspbian on the MicroSD card and continue to install and setup PiHole.\nHere are a few useful AdLists:\nhttps://oisd.nl https://github.com/Perflyst/PiHoleBlocklist Not possible to block YouTube ads. Unfortunately they use a shitty strategy with a ton of domains and subdomains which is impossible to come up with a capture-all pattern. But the above browser extensions help you circumvent that \u0026ndash; it\u0026rsquo;s currently the only solution. Thus you\u0026rsquo;ll have no more ads on your whole WiFi LAN so you can peacefully read those news articles without any pesky attention grabbers.\n","date":"14 August 2022","permalink":"https://dminca.github.io/posts/improving-your-web-experience/","section":"Posts","summary":"","title":"Improving your Web UX | Ads \u0026 Tracking free"},{"content":"","date":null,"permalink":"https://dminca.github.io/tags/rant/","section":"Tags","summary":"","title":"Rant"},{"content":"","date":null,"permalink":"https://dminca.github.io/tags/hugo/","section":"Tags","summary":"","title":"Hugo"},{"content":"Disable GitHub Pages #Add deprecation notice # Let your audience know where you moved Commit and push it to your repo\nArchive repo # It may be possible that before archiving you\u0026rsquo;d have to toggle Pages off. Unfortunately I can\u0026rsquo;t see that option anymore since I\u0026rsquo;ve disabled it already. If that\u0026rsquo;s the case and you find the option in repo Settings be sure to do that prior to archiving it. Archive your repo to disable Pages Create Codeberg repo #Head over to codeberg.org and create an empty repo called pages, you can follow the instructions from https://codeberg.page\nRemember that your main/master branch is where you\u0026rsquo;ll store the generated website only. No markdown, no hugo files nothing. Only the result of site build. Keep the repository empty for now, we\u0026rsquo;ll come back to it later.\nMove your content #In your old repo where used to be GitHub Pages set a new git remote\ngit remote set-url origin https://codeberg.org/\u0026lt;user\u0026gt;/pages.git # rename main/master branch git branch -m hugo # copy compiled website up a dir cp -vr public ../ # move to your main/master Codeberg branch git checkout -b main # bring the compiled website on this branch cp -vr ../public/** . # commit and push git add . ; git commit -m \u0026#39;initial commit\u0026#39;; git push -u origin main Replace \u0026lt;user\u0026gt; with your codeberg username. Just set the Codeberg repo as the main remote. The public/ dir is where your website is dumped after hugo build, depending on your installation some may have it in docs/ dir. Adjust this accordingly.\nWhen you create a new Codeberg repo it defaults to main branch. The name has no importance as long as the repo settings point to it then your website will work perfectly fine.\nAutomate building your site #Let\u0026rsquo;s automate the above steps because repetitive tasks are not worth to be done by humans but rather by 🤖\nRequest Woodpecker CI access #Head over to codeberg-ci/request-access and request Woodpecker CI access.\nYou could also donate to Codeberg to support them paying for the infra.\nConfigure pipeline # You should have received your CI access to proceed with these steps. We basically have to replicate the above steps in your CI and we do that by creating a file at repository root level .woodpecker.yml\nYou can check out mine as an example .woodpecker.yml\nMine is configured with master (lines 18,20,26) as the main branch. Adjust this accordingly. 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 pipeline: build: image: klakegg/hugo:0.101.0-ext-alpine-onbuild commands: - hugo mod get -u - hugo --gc --buildDrafts --minify when: event: [pull_request, push] publish: image: bitnami/git:2 secrets: [ cbtoken ] commands: - apt-get update; apt-get install git-lfs --no-install-recommends -y - git config --global --add safe.directory $CI_WORKSPACE/public - git config --global user.email \u0026#34;woodpecker-bot@no-reply.eu\u0026#34; - git config --global user.name \u0026#34;woodpecker-bot\u0026#34; - git config --global init.defaultBranch master - git config --global lfs.contenttype 0 - git clone -b master https://codeberg.org/dminca/pages.git - cp -a public/* pages/ - cd pages/ - git remote set-url origin https://$CBTOKEN@codeberg.org/dminca/pages.git - git add --all - git commit -m \u0026#34;deploy $CI_COMMIT_SHA\u0026#34; - git push -u origin master when: event: push branch: hugo This pipeline was inspired from codeberg.org/Codeberg-CI/examples.\nFor the CI runner to have push access to the repo\ncreate a token in your Codeberg profile settings head over to https://ci.codeberg.org/repos and locate your repo in repo settings create a Secret CBTOKEN and paste the created token (we\u0026rsquo;re refering to it on line 12 in .woodpecker.yml) And that\u0026rsquo;s all! Congratulations, you\u0026rsquo;ve successfully migrated from GH Pages to Codeberg Pages.\nYou can brag on their matrix channel #codeberg.org:matrix.org that you\u0026rsquo;re all set-up.\nBonus tips # Store your assets (ie. pictures, pdfs) with git-lfs so that your repo doesn\u0026rsquo;t become more sluggish. I\u0026rsquo;ve configured mine for pictures .gitattributes, also you can check the README.md for git lfs initial instructions ignore build directory on your hugo branch, for example Ignoring the build dir in your hugo branch will help keeping your commit history sane and in the event of introducing new content you won\u0026rsquo;t have to commit a whole chunk of HTML, CSS and all other unrelated stuff, just your markdown file containing your blog post. ","date":"13 August 2022","permalink":"https://dminca.github.io/posts/moved-to-codeberg-pages/","section":"Posts","summary":"","title":"Moving Hugo from GitHub Pages to Codeberg Pages"},{"content":" Further tips will follow! Fetch revisions for a StatefulSet #Revisions for StatefulSet \u0026amp; DaemonSet are stored in ControllerRevision objects.\nkubectl get controllerrevisions --all-namespaces These revisions allow rolling back StatefulSet by running\nkubectl rollout undo Different from Deployment which capture the state in ReplicaSet\nkudos Sheogorath\nGet events for a certain Pod #kubectl get events --field-selector involvedObject.name=\u0026lt;pod-name\u0026gt; Get events for other objects #kubectl get events --field-selector involvedObject.kind=\u0026lt;resource-name\u0026gt;,involvedObject.name=\u0026lt;object-name\u0026gt; resource-name could be Pod, Job, CronJob etc. object-name the name of resource Delete a PVC stuck in \u0026ldquo;Terminating\u0026rdquo; state #You\u0026rsquo;ve probably already tried to forcefully delete the PVC\nkubectl delete pvc \u0026lt;pvc-name\u0026gt; --force --grace-period=0 PVC needs to be unmounted from the node in order to finalize deletion and we do that by annotating the object with the removal of finalizer field.\nkubectl patch pvc \u0026lt;pvc-name\u0026gt; -p \u0026#39;{\u0026#34;metadata\u0026#34;:{\u0026#34;finalizers\u0026#34;:null}}\u0026#39; Source Also kudos Dean Lewis\nDelete a Pod stuck in \u0026ldquo;Terminating\u0026rdquo; state # This is a dangerous operation. Be prepared in case you might corrupt the ETCD database and have a backup. These resources might be in handy:\nhttps://kubernetes.io/docs/tasks/administer-cluster/configure-upgrade-etcd/#replacing-a-failed-etcd-member https://kubernetes.io/docs/tasks/administer-cluster/configure-upgrade-etcd/#securing-communication If you did everything in order to delete a Pod, meaning delete its dependencies and it\u0026rsquo;s still not terminating, last resort is to attempt a removal from ETCD\nIdentify the IPs of your ETCD replicas #Let\u0026rsquo;s assume we have these IPs\n10.11.68.181 10.11.68.226 10.11.68.164 and we want to terminate the Pod oops-im-stuck-1234\nSantity check: list the Pod #ETCDCTL_API=3 etcdctl --endpoints=https://10.11.68.181:2379,https://10.11.68.226:2379,https://10.11.68.164:2379 \\ --cert=/etc/kubernetes/pki/etcd/server.crt \\ --key=/etc/kubernetes/pki/etcd/server.key \\ --cacert=/etc/kubernetes/pki/etcd/ca.crt \\ get --prefix \u0026#34;/registry/pods/default/oops-im-stuck-1234\u0026#34; Delete the Pod from ETCD #ETCDCTL_API=3 etcdctl --endpoints=https://10.11.68.181:2379,https://10.11.68.226:2379,https://10.11.68.164:2379 \\ --cert=/etc/kubernetes/pki/etcd/server.crt \\ --key=/etc/kubernetes/pki/etcd/server.key \\ --cacert=/etc/kubernetes/pki/etcd/ca.crt \\ del \u0026#34;/registry/pods/default/oops-im-stuck-1234\u0026#34; ","date":"12 August 2022","permalink":"https://dminca.github.io/posts/kubernetes-tips/","section":"Posts","summary":"","title":"Kubernetes poweruser tips"},{"content":"","date":null,"permalink":"https://dminca.github.io/tags/devsecops/","section":"Tags","summary":"","title":"Devsecops"},{"content":"","date":null,"permalink":"https://dminca.github.io/tags/infosec/","section":"Tags","summary":"","title":"Infosec"},{"content":"","date":null,"permalink":"https://dminca.github.io/tags/itsec/","section":"Tags","summary":"","title":"Itsec"},{"content":"","date":null,"permalink":"https://dminca.github.io/tags/security/","section":"Tags","summary":"","title":"Security"},{"content":"","date":null,"permalink":"https://dminca.github.io/tags/ads-free/","section":"Tags","summary":"","title":"Ads-Free"},{"content":"If you\u0026rsquo;re tired of being tracked on the Internet, or you just simply don\u0026rsquo;t want to see any more shitty ads in any platform, even YT, here\u0026rsquo;s a compilation of some awesome FOSS tooling.\nInvidious (YouTube alternative) # Official logo of Invidious\nSource Invidious is an open source alternative front-end to YouTube.\nBasically, like a proxy to youtube with the tracking \u0026amp; ads stripped, you can check the available instances https://docs.invidious.io/instances/\nNitter (Twitter alternative) # Official logo of Nitter\nSource Alternative Twitter front-end.\nIf you\u0026rsquo;ve been in that moment where your friends share Twitter links but you don\u0026rsquo;t have an account and fucks sake don\u0026rsquo;t even want to make one, then this will proxy for you. No login screen, no JavaScript, no Ads/Tracking.\nNow when you get that twitter link, just replace twitter.com with the name of an instance from this list https://github.com/xnaas/nitter-instances\nPeerTube (YouTube alternative) # Official logo of PeerTube\nSource free and decentralized alternative to video platforms\nMastodon (Twitter alternative) # Official logo of Mastodon\nSource Mastodon isn’t a single website like Twitter or Facebook, it\u0026rsquo;s a network of thousands of servers operated by different organizations and individuals that provide a seamless social media experience.\nThere are lots of instances https://joinmastodon.org/communities\nPixelfed (Instagram alternative) # Official logo of Pixelfed\nSource A federated free and ethical photo sharing platform.\nInstances: https://fedidb.org/software/pixelfed\nCodeberg (GitHub alternative) # Official logo of Codeberg\nSource Free git hosting platform with no tracking. They use Woodpecker CI for CI/CD pipelines. They\u0026rsquo;re built on top of gitea which in v1.17.0 have layed the foundation for federation, which means it will allow instances to communicate with each other in the future.\nCodeberg pages (GitHub Pages alternative) # Source Here\u0026rsquo;s my blog configuration to get you started https://codeberg.org/dminca/pages\nBibliogram (Instagram alternative) # Source Bibliogram is an alternative front-end for Instagram. Bibliogram works without browser JavaScript, has no ads or tracking, and doesn\u0026rsquo;t urge you to sign up.\nLists of instances:\nhttps://git.sr.ht/~cadence/bibliogram-docs/tree/master/docs/Instances.md https://xnaas.github.io/bibliogram-instances/ Proxitok (TikTok alternative) # Source Instances:\nhttps://github.com/pablouser1/ProxiTok/wiki/Public-instances Teddit (Reddit alternative) # Source Instances:\nhttps://codeberg.org/teddit/teddit#instances Rimgo (Imgur alternative) # Source Instances:\nhttps://codeberg.org/video-prize-ranch/rimgo#instances ","date":"2 August 2022","permalink":"https://dminca.github.io/posts/awesome-foss-tooling/","section":"Posts","summary":"","title":"Awesome FOSS Tooling in 2022 • Tracking-free and Ads-free"},{"content":"","date":null,"permalink":"https://dminca.github.io/tags/foss/","section":"Tags","summary":"","title":"Foss"},{"content":"","date":null,"permalink":"https://dminca.github.io/tags/tracking-free/","section":"Tags","summary":"","title":"Tracking-Free"},{"content":"","date":null,"permalink":"https://dminca.github.io/tags/fish/","section":"Tags","summary":"","title":"Fish"},{"content":"I\u0026rsquo;ll update this page with anything new 🆕 I find about fish-shell 🐟\nAutosuggestions #Bumped into this one here\nApparently, after you enable some new completions you can run fish_update_completions and fish parses man pages for possible commands and switches.\nSetting an alias \u0026rsquo;the right way\u0026rsquo; without slowing down your shell # Source Aliases created with alias will not be available in new shell sessions. If you want them to persist, use\nalias -s ... which will save it to ~/.config/fish/functions/[alias-name].fish\nUsing alias inside ~/.config/fish/config.fish will slow down your shell start as each alias/function will be eagerly loaded.\nTo persist aliases across shell sessions, use alias -s, which will create a function and save it to ~/.config/fish/functions. This takes advantage of fish function lazy-loading / autoloading mechanism.\nFish shell cheatsheet #https://devhints.io/fish-shell\nFish shell scripting manual #https://developerlife.com/2021/01/19/fish-scripting-manual/\nRunning in \u0026lsquo;incognito\u0026rsquo; mode (Private mode) #fish calls it Private mode, it sorta works like an incognito/private browser tab by dropping all history. Some contexts when you could use this is decoding base64 Kubernetes secrets in the terminal or logging in while passing some credentials\u0026hellip;\n⋊\u0026gt; ~ fish --private Welcome to fish, the friendly interactive shell Type help for instructions on how to use fish fish is running in private mode, history will not be persisted. ⋊\u0026gt; ~ You can find out more on the official docu\nInspect and or hack functions #funced\nfunced fish_greeting # opens function in $EDITOR # hack, hack, hack and done; now you wanna save funcsave fish_greeting Manipulate history #history - show and manipulate command history\nLet\u0026rsquo;s say you fired a command that didn\u0026rsquo;t work out well and don\u0026rsquo;t even want to persist it in your history\n# look for it history search --contains \u0026#34;foo\u0026#34; # delete it history delete --prefix \u0026#34;foo\u0026#34; # you can even be more precise if you know what you have to delete history delete --case-sensitive --exact \u0026#39;foo\u0026#39; Check if variable is set # Source Test if an environment variable or a local variable from the script was set\nif set -q FOOBAR echo its set else echo its not set end Check if file exists # Source if test -e /bin/test echo its there else echo its not there end ","date":"2 August 2022","permalink":"https://dminca.github.io/posts/fish-shell-tips-and-tricks/","section":"Posts","summary":"","title":"fish-shell: Tips and Tricks"},{"content":"","date":null,"permalink":"https://dminca.github.io/tags/linux/","section":"Tags","summary":"","title":"Linux"},{"content":"","date":null,"permalink":"https://dminca.github.io/tags/shell/","section":"Tags","summary":"","title":"Shell"},{"content":"","date":null,"permalink":"https://dminca.github.io/categories/","section":"Categories","summary":"","title":"Categories"},{"content":"C/C++/C# has a way to compile their source code with the help of Makefiles, but how about Go? Sure, it\u0026rsquo;s minimalistic, you can just do go build and you\u0026rsquo;re done, but if you want to fine-tune something that one-liner turns into a Bratwurst 🌭\nI\u0026rsquo;ve asked around on the #go-lang:matrix.org room which alternatives exist and got 2 tools so far.\nTask # Official logo of Taskfile\nTask is a task runner / build tool that aims to be simpler and easier to use than, for example, GNU Make.\nSource Mage # Official logo of Mage\nMage is a make/rake-like build tool using Go. You write plain-old go functions, and Mage automatically uses them as Makefile-like runnable targets.\nSource ","date":"1 August 2022","permalink":"https://dminca.github.io/posts/make-alternatives-for-go/","section":"Posts","summary":"","title":"GNU-Make Alternatives for Go"},{"content":"","date":null,"permalink":"https://dminca.github.io/tags/go/","section":"Tags","summary":"","title":"Go"},{"content":"","date":null,"permalink":"https://dminca.github.io/tags/golang/","section":"Tags","summary":"","title":"Golang"},{"content":"","date":null,"permalink":"https://dminca.github.io/tags/make/","section":"Tags","summary":"","title":"Make"},{"content":"","date":null,"permalink":"https://dminca.github.io/categories/tooling/","section":"Categories","summary":"","title":"Tooling"},{"content":"I\u0026rsquo;ve just moved from zsh to fish today and guess what, there were some bumps on the road.\nFirst of all, I\u0026rsquo;ve been reading some blog posts before migrating which were all rainbows and unicorns on the idea that fish installs quite smooth and without any issues whatsoever, but those were written 6mo. or even +1 years ago and as you already know, a lot can change in the Tech/IT/Software domain in that amount of time and when it does it breaks some shits.\nThis is only valid for Apple Silicon Macs, the Intel-based Macs will just install the package in its ordinary place ( /usr/local/bin/fish ). The installation was ran on M1 Mac with MacOS Monterey 12.5. Initial install #chsh: /etc/shells: non-standard shell #Like ordinary people, I started with\nbrew install fish echo \u0026#34;/usr/local/bin/fish\u0026#34; | sudo tee -a /etc/shells chsh -s /usr/local/bin/fish But guess what, you get\nchsh: /etc/shells: non-standard shell Wanna know why?\nBecause homebrew doesn\u0026rsquo;t install the binary at /usr/local/bin/fish but rather /opt/homebrew/bin/fish, if you run this again the right way, it\u0026rsquo;ll work.\nbrew install fish echo \u0026#34;/opt/homebrew/bin/fish\u0026#34; | sudo tee -a /etc/shells chsh -s /opt/homebrew/bin/fish One problem solved. Now restart terminal and let\u0026rsquo;s move to the next one.\nfish: Unknown command: fish #Since it was installed via homebrew, those binaries are on a different path therefore we need to append it to the ${PATH}.\n# ~/.config/fish/config.fish if status is-interactive # Commands to run in interactive sessions can go here export PATH=\u0026#34;$PATH:/opt/homebrew/bin:/opt/homebrew/opt/openjdk/bin\u0026#34; end Plug-in managers #Now we are able to continue installing omf, thanks Travis for your blog post.\ncurl -L https://get.oh-my.fish | fish Additionally, there\u0026rsquo;s fisher which I\u0026rsquo;m not installing it because I don\u0026rsquo;t want to bloat my fish 😆\ncurl -sL https://git.io/fisher | source \u0026amp;\u0026amp; fisher install jorgebucaran/fisher Fine-tuning #After finishing with the initial installation, I need some basic tooling like fzf. Guess what, the initial fzf is not going to do, therefore we need the fzf.fish from https://github.com/PatrickF1/fzf.fish\nI\u0026rsquo;ve followed Travis\u0026rsquo;s suggestions to pull it through fisher, but Patrick (the maintainer of fzf.fish) said you don\u0026rsquo;t need fisher for that, but I\u0026rsquo;m lazy meh 🤫\n⋊\u0026gt; ~/Projects fisher install PatrickF1/fzf.fish fisher install version 4.4.2 Fetching https://api.github.com/repos/patrickf1/fzf.fish/tarball/HEAD Installing patrickf1/fzf.fish /Users/cyb0rg/.config/fish/functions/_fzf_configure_bindings_help.fish /Users/cyb0rg/.config/fish/functions/_fzf_extract_var_info.fish /Users/cyb0rg/.config/fish/functions/_fzf_preview_changed_file.fish /Users/cyb0rg/.config/fish/functions/_fzf_preview_file.fish /Users/cyb0rg/.config/fish/functions/_fzf_report_diff_type.fish /Users/cyb0rg/.config/fish/functions/_fzf_report_file_type.fish /Users/cyb0rg/.config/fish/functions/_fzf_search_directory.fish /Users/cyb0rg/.config/fish/functions/_fzf_search_git_log.fish /Users/cyb0rg/.config/fish/functions/_fzf_search_git_status.fish /Users/cyb0rg/.config/fish/functions/_fzf_search_history.fish /Users/cyb0rg/.config/fish/functions/_fzf_search_processes.fish /Users/cyb0rg/.config/fish/functions/_fzf_search_variables.fish /Users/cyb0rg/.config/fish/functions/_fzf_wrapper.fish /Users/cyb0rg/.config/fish/functions/fzf_configure_bindings.fish /Users/cyb0rg/.config/fish/conf.d/fzf.fish /Users/cyb0rg/.config/fish/completions/fzf_configure_bindings.fish Installed 1 plugin/s But when you ⌘+R it just farts\n⋊\u0026gt; ~/Projects fish: Unknown command: fzf ~/.config/fish/functions/_fzf_wrapper.fish (line 19): fzf $argv ^ in function \u0026#39;_fzf_wrapper\u0026#39; with arguments \u0026#39;--read0 --tiebreak=index --query= --preview=echo\\ --\\ \\{4..\\}\\ \\|\\ fish_indent\\ --ansi --preview-window=bottom:3:wrap\u0026#39; called on line 3 of file ~/.config/fish/functions/_fzf_search_history.fish in command substitution called on line 8 of file ~/.config/fish/functions/_fzf_search_history.fish in function \u0026#39;_fzf_search_history\u0026#39; Therefore, time for more 🪓\nThen we notice in the readme of fzf.fish Off we go to do the prereqs\nbrew install fd fzf bat ... 5h later **spongebob theme** ... ==\u0026gt; fd fish completions have been installed to: /opt/homebrew/share/fish/vendor_completions.d ==\u0026gt; fzf To install useful keybindings and fuzzy completion: /opt/homebrew/opt/fzf/install To use fzf in Vim, add the following line to your .vimrc: set rtp+=/opt/homebrew/opt/fzf ==\u0026gt; bat fish completions have been installed to: /opt/homebrew/share/fish/vendor_completions.d NOW finally we\u0026rsquo;re ready to go: ⌘+R and evrika! Fonts and shit #Fuck\u0026rsquo;em. I don\u0026rsquo;t need that crap, defaults are just fine. As long as I can clearly read whatever\u0026rsquo;s in my term I don\u0026rsquo;t need no bells and whistles.\nBonus tip: bang bang !! and bang dollar !$ tokens #Drop these functions in your ~/.config/fish/config.fish or anywhere fish 🐟 could pick them up.\nfunction bind_bang switch (commandline -t)[-1] case \u0026#34;!\u0026#34; commandline -t $history[1]; commandline -f repaint case \u0026#34;*\u0026#34; commandline -i ! end end function bind_dollar switch (commandline -t)[-1] case \u0026#34;!\u0026#34; commandline -t \u0026#34;\u0026#34; commandline -f history-token-search-backward case \u0026#34;*\u0026#34; commandline -i \u0026#39;$\u0026#39; end end function fish_user_key_bindings bind ! bind_bang bind \u0026#39;$\u0026#39; bind_dollar end And then you can sudo !! or whatever.\nKudos:\nhttps://github.com/fish-shell/fish-shell/wiki/Bash-Style-Command-Substitution-and-Chaining-(!!-!$) https://superuser.com/a/944589 Moving zsh history to fish #I\u0026rsquo;ve done some ddg.co searches but last that I found were some dodgy python scripts which I currently don\u0026rsquo;t have the time and patience to go through and understand before actually running random shit from the internet. Never. Do. That. Ever.\nIf it was a Rust or Go binary then I\u0026rsquo;d trust it 😺\nWhat did I gain from this? # I\u0026rsquo;m a prowd vscodium user and I have to say with fish I finally got rid of that shitty pop-up error each time I was closing the shell via ⌃+D. This was fucking anoying because when I was to git commit something, write the message and exit via :x from vim, you\u0026rsquo;d normally have to ESC to drop to Normal mode in order to go into command mode.\nIt\u0026rsquo;s fuckin\u0026rsquo; fast mate!\nTyping suggestions - well thank you! It has really good support for these, not only that but it\u0026rsquo;s also showing typing errors in red\n","date":"31 July 2022","permalink":"https://dminca.github.io/posts/moved-from-zsh-to-fish/","section":"Posts","summary":"","title":"Moved from zsh to fish"},{"content":"","date":null,"permalink":"https://dminca.github.io/tags/zsh/","section":"Tags","summary":"","title":"Zsh"},{"content":"","date":null,"permalink":"https://dminca.github.io/tags/information/","section":"Tags","summary":"","title":"Information"},{"content":"","date":null,"permalink":"https://dminca.github.io/tags/newsletters/","section":"Tags","summary":"","title":"Newsletters"},{"content":"","date":null,"permalink":"https://dminca.github.io/tags/podcast/","section":"Tags","summary":"","title":"Podcast"},{"content":"As you may already know, keeping up with the news in the IT sector is necessary not only to further develop/extend your skillset but also it\u0026rsquo;s interesting to see how others tackle some issues as there are multiple schools of thought.\nThis domain is to me the most fascinating because no matter how many certifications or diplomas you have at hand and no matter how much you know, you need to be a good team player.\nAge does not matter in this domain, but knowledge and humbleness. If you have more knowledge on some ramifications (ie. Networking) and you can explain it really good to your fellow colleagues then you are best fit for this role. In the end we\u0026rsquo;re all in here to learn from each other and to help each other because we all started from scratch.\nNewsletters #My no. 1 place to check the pulse are newsletters. Newsletters, although they are a waterfall of information, they\u0026rsquo;re a gold mine, and kudos to the people that are curating \u0026amp; maintaining them! Out of all the newsletters, I\u0026rsquo;m interested mostly in Site Reliability Engineering (SRE) topics because these cover a broader view (logging, monitoring, CI/CD et. al.); I\u0026rsquo;m subscribed to these newsletters:\nDevOps Weekly1 \u0026ndash; you can check the topics in their archive KubeWeekly2 \u0026ndash; although it\u0026rsquo;s focused on Kubernetes, you can find SRE topics as well Golang Weekly3 \u0026ndash; not only Go, they often show some helpful K8s tooling, that\u0026rsquo;s where I found out about k9s4 I\u0026rsquo;m only subscribed to these 2 as it\u0026rsquo;s humanly impossible to keep up with the amount of information, just trying to avoid 32783 unread emails in my inbox.\nTo make it simpler, I made a rule in GMail and tagging the newsletters so that I\u0026rsquo;m able to find them faster; could possibly be a candidate for automating this via a Telegram chat bot. You may find me post some interesting links in my Telegram channel @DevOps1012.\nReddit subs #2nd place to check is Reddit. Here I just skim through some subs and share the link in my Telegram channel to read it later on. By having these articles on the channel I\u0026rsquo;m able to search when I need them the most.\nI\u0026rsquo;ve joined these subs:\nr/devops5 r/kubernetes6 Podcasts #Before going to bed or early in the morning you can just play a podcast and listen to what\u0026rsquo;s going on in the ecosystem. I like the podcasts because it makes you inherit the terminology and how to pronounce some stuff (ie. kubectl \u0026ndash; long discussion). The terminology is key as this unlocks some super powers like knowing what to google in the event you hit some bumps along the way; but also are helpful in presentations and simplifies explaining stuff.\nRecommend these podcasts:\nKubernetes Podcast7 The New Stack Makers8 Software Engineering Radio (SE-Radio)9 \u0026ndash; this one\u0026rsquo;s cool because you can imrpove your skill to identify and resolve issues in Development; they also cover some Software Architecture that\u0026rsquo;s really interesting, and of course, the terminology that you learn is definitely a plus Twitter #I subscribed to few key people here and I just check them from time to time, I\u0026rsquo;ve dropped everything in my Cloud Technology list\nColleagues from your field #Last but not least and most importantly, information that your colleagues or fellows share with you. This one\u0026rsquo;s cool because you can exchange some feedback with them, find out some opinions.\nWrapping up #Although there are many channels to feed from it\u0026rsquo;s important to filter out the hype/noise and actually read them whenever you have some spare minutes. I usually go through some of them in the morning with a cup of coffee.\nReading them is not enough, you have to tell the story to your colleagues in order for it to be imprinted in memory. Let me know what other sources did you find interesting, I\u0026rsquo;ll gladly update this post with your recommendations, or your can also open a PR 😄\nhttps://devopsweeklyarchive.com\u0026#160;\u0026#x21a9;\u0026#xfe0e;\nhttps://t.me/s/DevOps101\u0026#160;\u0026#x21a9;\u0026#xfe0e;\u0026#160;\u0026#x21a9;\u0026#xfe0e;\nhttps://golangweekly.com\u0026#160;\u0026#x21a9;\u0026#xfe0e;\nhttps://github.com/derailed/k9s\u0026#160;\u0026#x21a9;\u0026#xfe0e;\nhttps://www.reddit.com/r/devops/\u0026#160;\u0026#x21a9;\u0026#xfe0e;\nhttps://www.reddit.com/r/kubernetes/\u0026#160;\u0026#x21a9;\u0026#xfe0e;\nhttps://kubernetespodcast.com\u0026#160;\u0026#x21a9;\u0026#xfe0e;\nhttps://thenewstack.io/podcasts/makers\u0026#160;\u0026#x21a9;\u0026#xfe0e;\nhttps://www.se-radio.net\u0026#160;\u0026#x21a9;\u0026#xfe0e;\n","date":"26 March 2021","permalink":"https://dminca.github.io/posts/pulse-checking-it/","section":"Posts","summary":"","title":"Sources I use for keeping up with IT news"},{"content":"","date":null,"permalink":"https://dminca.github.io/tags/tricks/","section":"Tags","summary":"","title":"Tricks"},{"content":"","date":null,"permalink":"https://dminca.github.io/tags/cncf/","section":"Tags","summary":"","title":"Cncf"},{"content":"","date":null,"permalink":"https://dminca.github.io/tags/devops/","section":"Tags","summary":"","title":"Devops"},{"content":"This is the 2nd year conferences are being virtual and we can only benefit from this. Some of time are free whilst some, more popular, require a small fee.\nThe topics these conferences cover mostly relate to the SRE (Site Reliability Engineer) role and they cover topics like:\nSecurity \u0026amp; DevSecOps Observability Multicloud Enterprise IT Infrastructure Kubernetes GitOps CI/CD (Continous Integration/Continous Deployment/Delivery) Incomming this year #PromCon Online \u0026lsquo;21 1 #📅 Date: May 3\n💰 Registration cost: colocated with KubeCon\n#KubeCon + #CloudNativeCon 🇪🇺 2 #📅 Date: May 4 - 7\n💰 Registration cost: $10 (early bird) / $75 (standard)\nIf you registered here you can join other conferences hosted by the CNCF, such as:\nCloud Native Security Day Europe3 Fluentcon4 ServiceMeshCon5 PromCon Online1 #WTFisSRE 6 #📅 Date: May 20\n💰 Registration cost: free 🍺\nCovers topics like Security \u0026amp; DevSecOps, Observability and Multicloud.\nGrafanaCONline 2021 7 #📅 Date: May 20\n💰 Registration cost: free 🍺\nGitOps days 8 #📅 Date: June 9-10\n💰 Registration cost: free 🍺\nCDcon 9 #📅 Date: June 23-24\n💰 Registration cost: free 🍺\nThe schedule hasn\u0026rsquo;t been posted yet, but expect CI/CD (Continous Integration/ Continous Delivery/Deployment) related topics.\nWrapping up #Basically, if you get an entrance to the KubeCon this year, that\u0026rsquo;ll unlock you a lot of possibilities.\nhttps://promcon.io/2021-online/\u0026#160;\u0026#x21a9;\u0026#xfe0e;\u0026#160;\u0026#x21a9;\u0026#xfe0e;\nhttps://events.linuxfoundation.org/kubecon-cloudnativecon-europe/\u0026#160;\u0026#x21a9;\u0026#xfe0e;\nhttps://events.linuxfoundation.org/cloud-native-security-day-europe/\u0026#160;\u0026#x21a9;\u0026#xfe0e;\nhttps://events.linuxfoundation.org/fluentcon/\u0026#160;\u0026#x21a9;\u0026#xfe0e;\nhttps://events.linuxfoundation.org/servicemeshcon-europe/\u0026#160;\u0026#x21a9;\u0026#xfe0e;\nhttps://www.cloud-native-sre.wtf\u0026#160;\u0026#x21a9;\u0026#xfe0e;\nhttps://grafana.com/about/events/grafanacon/2021/\u0026#160;\u0026#x21a9;\u0026#xfe0e;\nhttps://www.gitopsdays.com\u0026#160;\u0026#x21a9;\u0026#xfe0e;\nhttps://events.linuxfoundation.org/cdcon/\u0026#160;\u0026#x21a9;\u0026#xfe0e;\n","date":"25 March 2021","permalink":"https://dminca.github.io/posts/interesting-conferences-21/","section":"Posts","summary":"","title":"Interesting Tech Conferences '21"},{"content":"","date":null,"permalink":"https://dminca.github.io/tags/sre/","section":"Tags","summary":"","title":"Sre"},{"content":"","date":null,"permalink":"https://dminca.github.io/categories/conferences/","section":"Categories","summary":"","title":"Conferences"},{"content":"ZapCon \u0026lsquo;21 was scheduled on 9th March 2021\nWhat was interesting #Robot Framework #Democratizing ZAP with test automation and DSLs by Abhay Bhargav\nBDD (Behaviour Driven Development) in IT-Security apparently, there\u0026rsquo;s this robotframework which makes writing test cases in quite a simple way, and you can run pentests on your UI application Why using a DAST scanner? #DAST (Dynamic Application Security Testing) keeps app secure:\ntest your running app find bugs before they are deployed to prod mimick how attackers view your system test how the whole system works not just components give you low signal to noise ratio reveal real risks not just theoretical ones ZAP automation framework #by Simon Bennetts \u0026ndash; ZAP Project Lead\nDEMO available it will support core features like: passive scanning configuration waiting to complete traditional spider active scanner additional addons supported Mobile app security with OWASP ZAP #by Ankush Mohanty \u0026amp; Milan Sen\nDEMO available in mobile AppSec, Traffic Analysis has major role in finding various server side vulns some common vulns uncovered by Traffic Analysis include (but not limited to) secure communication validation (SSL/TLS or HTTP) server side open ports PII data or Server information leak Server side Brute force/lock out validation validation of resource utilization vulnerability Server side authorization vulns Enhance ZAP with feedback-based fuzzing #by Khaled Yakdan\nCoverage-guided, in-process fuzzing for the JVM -\u0026gt; github.com/CodeIntelligenceTesting/jazzer DEMO CVE-2021-23899 feedback-based fuzzing is great for finding bugs that cannot be unvealed during blackbox testing Wrap up #Overall, the conference was pretty cool and much knowledge was gained, most interesting part for me was the BDD with the Robot Framework, that\u0026rsquo;s actually something interesting to implement in your Sec pipelines and you can actually run it in headless mode (no UI, no browser required).\n","date":"25 February 2021","permalink":"https://dminca.github.io/posts/zapcon-21/","section":"Posts","summary":"","title":"ZapCon 21"},{"content":"I never had the chance to compact a list of available Security tools in Q1 2021, here it goes. If something\u0026rsquo;s missing from this list, anyone can freely open a PR and I\u0026rsquo;ll gladly update the list.\nSecurity tooling available #By attending the ZapCon \u0026lsquo;21, I\u0026rsquo;ve received a feedback request email from them where I should list security tools I\u0026rsquo;ve used in the past.\nName Pricing model checkmarx.com Premium synopsys.com Premium portswigger.net/burp Premium/Community Edition detectify.com Premium acunetix.com Premium veracode.com Premium dependabot.com Open-Source synk.io Free/Standard/Pro/Enterprise stackhawk.com Free/Pro/Enterprise hcltechsw.com/wps/portal/products/appscan Premium dependencytrack.org Open-Source Opinions #Of all these tools I\u0026rsquo;ve heard good remarks on dependabot mainly because it\u0026rsquo;s Open-Source since GitHub acquired it, plus it\u0026rsquo;s fairly simple to integrate it into your CI/CD pipelines.\ndependencytrack I saw it demoed in a real use-case scenario and what can you do with this tool is absolutely amazing, you can configure the server to push dependency deprecations in your PRs (Pull Requests), you have a pretty neat unified dashboard with any security vulns for your apps, definintely recommend it; plus, it\u0026rsquo;s easy to set-up as they offer a Docker image and it\u0026rsquo;s licensed under Apache 2.0.\nveracode is amazing for scanning your OnPrem and this is just one use-case, there are plenty more out there, main point is that you should know how/what to configure properly so that you get a good experience from it (like all tools nonetheless)\nWhat you get #Depending on your needs, don\u0026rsquo;t go for something Premium just because you\u0026rsquo;re buying the support, trust me, that in 2021 is so overrated and Support is not how it used to be before, now when you open a ticket, if you\u0026rsquo;re lucky ☝️, you get someone experienced handling your case, otherwise you\u0026rsquo;ll get someone who constantly asks you for logs et. al. and then just keeps escalating your issue to heavenly gates and you lose time \u0026amp; neurons\u0026hellip;\nChoosing something that\u0026rsquo;s Open-Source has way more benefits because for most of the issues you could find a GitHub issue raised by someone else, or find something on StackOverflow, ddg.co or whatnot\u0026hellip; it\u0026rsquo;s also good to share your experiences to the community 😉\n","date":"25 February 2021","permalink":"https://dminca.github.io/posts/security-tools/","section":"Posts","summary":"","title":"Security Tools"},{"content":"","date":null,"permalink":"https://dminca.github.io/tags/cloudnative/","section":"Tags","summary":"","title":"Cloudnative"},{"content":"ICYMI, IstioCon \u0026lsquo;21 was happening previous week 22-26 Feb 2021. Luckily the videos are still there, so if you want to check what\u0026rsquo;s been discussed you can still do it, it\u0026rsquo;s nice that you can login with  Apple ID also 😉\nTalks I found interesting #I want to sketch a mesh for you - by Christian Posta # ✨ installing the Istio control plane with the revision flag istioctl install ... --revision 1-0-3 version istio control planes \u0026amp; components to separate them from each other, as an operator of a system, the service mesh is a critical component of that system canary upgrades through both Control Planes where workloads are managed by each of them was doing the istio-workshop using HashiCorp Vault as your CA cool  AirPods Max, really good sound quality 👍 Improving Security with Istio # Alex Soto was screaming a lot, was funny Taming Istio configuration with Helm # Ryan Michela showed off here other sides of Helm: sometimes you find broken or incomplete charts CRDs problem is not solved on both Helm or Kubernetes sides and sometimes results in intermitent installation failures caused by race conditions in K8s writing charts is tedious You don\u0026rsquo;t need most of Helm to get the most from Helm ✨ Helm Starters \u0026ndash; ok, this is something that I just found out 🤔 it\u0026rsquo;s a Helm chart that makes helm charts 😮 helm create my-service --starter some/thing used bookinfo in the demos Deep dive into Istio Auth Policies # ✨ Lawrence Gadban just showed me that Istio has OPA (Open Policy Agent) built-in; not the real OPA, but it mimics that functionality with the Auth Policies Istio mTLS == Envoy at its core SPIFFE \u0026ndash; doesn\u0026rsquo;t matter what the accronyms mean, keep in mind that it\u0026rsquo;s there to remove the need for app-level authentication \u0026amp; complex network level ACL config Istio Debugging: Finding and fixing issues in a multi-cluster service graph # Eitan \u0026amp; Scott emphasized the fact that Service Mesh provides telemetry data OOTB your Single Pane of Glass (SPOG) collects telemetry data accross multiple envs what caught my eye was their (solo.io) definition for Single Pane of Glass: a layer which aggregates all of your telemetry data in a single place adds context for cross-cluster and hybrid-env data creates actionable, useful metrics to help prevent and or solve outages show that SPOG \u0026amp; manually inject faults helps understand \u0026amp; grok what\u0026rsquo;s going on in the system Debugging Istio within the Department of Defense # Nick Nellis \u0026amp; Adam Toy gave this presentation, most interesting part was Adam\u0026rsquo;s, here\u0026rsquo;s why DevSecOps managed services, team name\u0026rsquo;s Platform One plain and simple application flow diagram (top to bottom) did a clear demo showing off how he introduced faults really valuable that often he showed on the slides where we\u0026rsquo;re at in the whole app flow check the Response Headers of the 404 request in the WebInspector browser ✨ covers 90% of the issues troubleshooting Istio -\u0026gt; istioctl analyze Wrap up #Most interesting talk for me was Adam Toy\u0026rsquo;s as I can clearly see that he repeated it multiple times, so he was sure of all the steps he was following there.\nI could only follow 2 days in a row with the live sessions, then I lost interest as I couldn\u0026rsquo;t follow some presentations (they were really bad prepared), so I decided to just watch the recordings.\nOverall, this IstioCon \u0026lsquo;21 was a win, as I managed to learn quite some new stuff about Istio overall, well, tbh, most important part for me was the troubleshooting and solving real life problems.\nPS: everything marked with ✨ are stuff that I won after this Con, thanks guys for the great conference!\n","date":"25 February 2021","permalink":"https://dminca.github.io/posts/istio-con-21/","section":"Posts","summary":"","title":"IstioCon 21"},{"content":"Oha! I\u0026rsquo;m a teapot\nIt\u0026rsquo;s very interesting sometimes to test Golang blogging platforms\nThis is a sample YAML manifest 😄 🆒 😎\n{{- if (and (ne (.Values.ui.ingress.enabled | toString ) \u0026#34;-\u0026#34;) .Values.ui.ingress.enabled) }} {{- $serviceName := printf \u0026#34;%s-%s\u0026#34; (include \u0026#34;vault.fullname\u0026#34; .) \u0026#34;ui\u0026#34; -}} apiVersion: extensions/v1beta1 kind: Ingress metadata: name: {{ template \u0026#34;vault.fullname\u0026#34; . }}-ingress namespace: {{ .Release.Namespace }} labels: app: {{ template \u0026#34;vault.name\u0026#34; . }} chart: {{ template \u0026#34;vault.chart\u0026#34; . }} heritage: {{ .Release.Service }} release: {{ .Release.Name }} {{- if .Values.ui.ingress.annotations }} annotations: {{ toYaml .Values.ui.ingress.annotations | indent 4 }} {{- end }} spec: rules: {{- range .Values.ui.ingress.hosts }} - host: {{ . }} http: paths: - backend: serviceName: {{ $serviceName }} servicePort: http {{- end -}} {{- if .Values.ui.ingress.tls }} tls: {{- range $value := .Values.ui.ingress.tls }} - hosts: {{- range $value.hosts }} - {{ . }} {{- end }} secretName: {{ $value.secretName }} {{- end }} {{- end }} {{- end }} Some python sample code ##!/usr/bin/python3 from engine import RunForrestRun \u0026#34;\u0026#34;\u0026#34;Test code for syntax highlighting!\u0026#34;\u0026#34;\u0026#34; class Foo: def __init__(self, var): self.var = var self.run() def run(self): RunForrestRun() # run along! 1 2 3 4 5 6 7 8 9 10 11 12 13 #!/usr/bin/python3 from engine import RunForrestRun \u0026#34;\u0026#34;\u0026#34;Test code for syntax highlighting!\u0026#34;\u0026#34;\u0026#34; class Foo: def __init__(self, var): self.var = var self.run() def run(self): RunForrestRun() # run along! test1234\n","date":"24 February 2021","permalink":"https://dminca.github.io/posts/hello-world/","section":"Posts","summary":"","title":"Hello World"},{"content":"","date":null,"permalink":"https://dminca.github.io/tags/untagged/","section":"Tags","summary":"","title":"Untagged"}]