IT Ghost

IT Ghost

Sign in Subscribe

Why Aether's shared filesystem commits writes faster than its block storage

Why Aether's shared filesystem commits writes faster than its block storage

I ran the first storage benchmark on Aether expecting block to win everywhere. It didn't, and the reason says something about how everyone benchmarks cloud storage.

What I hardened before Aether's first release

What I hardened before Aether's first release

Aether is close to its first release. Here are the three decisions behind it: immutable Talos Linux nodes, Harbor proxy caching so image pulls survive registry outages, and CAPI autoscaling that takes a Pending pod to a Ready node in ~80 seconds.

Why Aether dropped Kamaji and vcluster for custom controllers

I replaced Kamaji's tenant control plane and shelved vcluster in favour of two custom controllers — aether-operator and aether-controllers — with cert-manager driving the entire PKI. Here is why.

Why Aether runs seven isolation layers for every tenant cluster

Multi-tenant Kubernetes isolation is the hardest unsolved problem in the ecosystem. Here is why I don't trust any single layer to solve it, and what seven layers working together actually looks like.

17 things that broke getting the first tenant cluster running on Aether

I am building a managed Kubernetes platform from scratch on Proxmox with Kamaji, Talos and Cilium. Getting the first tenant worker to join took two days and 17 things broke along the way. Here is what went wrong and how I fixed it.

Running Kubernetes control planes as pods with Kamaji

I am building a managed Kubernetes platform and needed a control plane that is architecturally unreachable — not just firewalled. Here is how Kamaji runs customer API servers as pods inside a management cluster, and how Envoy routes traffic to them without ever terminating TLS.

Setting up TLS for Kubernetes Gateway API with Cilium and Cert-Manager

Setting up TLS for Kubernetes Gateway API with Cilium and Cert-Manager

Easily secure your Kubernetes apps with TLS using this step-by-step guide. Configure the Gateway API, Cilium, and Cert-Manager for HTTPS access. Simple instructions and code examples make setup a breeze.

Expose your kubernetes sevices using gateway-api with envoy-gateway.

Expose your kubernetes sevices using gateway-api with envoy-gateway.

I wanted to see what benefits the gateway-api has in comparison with other service types on kubernetes that each has their own use case with their pros and cons. After I have research different providers I decided to use envoy-gateway as it was the most stable and complete

Self hosted kubernetes loadbalancing with cilium

Self hosted kubernetes loadbalancing with cilium

I have switched from calico CNI to cilium mostly because cilium comes with an ability to create a loadBalancer type of service without installing any third party application that is not possible using calico. With calico I was using metallb to have the ability to create loadbalancer. In order to

Create kubernetes loadbalancer on self hosted cluster using metallb

Create kubernetes loadbalancer on self hosted cluster using metallb

If you use a self hosted environment and you want to use an ingress controller or a gateway api you will have to have the ability to create a loadbalancing type of service. As the loadbalancing services are tied to a hosted service environment you don't have much

Run a multiarch build using podman

When we want to create an image that can be deployed on multiple architectures we need to create an image with multi architecture support. For this project this time will use podman. In case you are using podman in a emulated environment like macosx for example where the podman machine

Create an easy kubernetes cluster using kind and docker on your workstation

Assuming that you want to have a quick way to spawn up a kubernetes cluster for some development work all you need to do is to have docker desktop installed and install kind app on your computer. I will not go through the installation process as it is very well

Kubernetes generate certificate using certmanager with dns authenticator using cloudflare

Now that I have installed a haproxy ingress controller it is time to add ssl to our website. For this I will be using an ssl certificate generated on cloudflare by certmanager. Since I am hosting the DNS on cloudflare and mostly using wildcard certificates I am kind of forced

Install and configure Haproxy ingress controller on kubernetes

kubernetes Featured

Install and configure Haproxy ingress controller on kubernetes

In this post I will explain how to install and configure the haproxy ingress In order to have this work you need a fully installed kubernetes cluster a workstation with Helm 3.6 preferably 3.7 installed. We need to install the haproxy repository to the helm chart. #helm repo

Building a kubernetes cluster on raspberry pi using k3s

Building a kubernetes cluster on raspberry pi using k3s

On a smaller raspberry pi where you don't have that much resources (usually 1-2 gb of ram) you don't have the resources to run a full fledged kubernetes cluster. There is a project for providing fully working lightweight kubernetes cluster using rancher's k3s.

How to create multiarch docker images.

How to create multiarch docker images.

If you are like me and you need to create some kubernetes integration I prefer to have it done locally without too much fuss and for that I am mostly using raspberry pi's to create either standalone docker server or create a kubernetes cluster and have it running

How to run JupyterHub in docker swarm environment using swarmSpawner.

How to run JupyterHub in docker swarm environment using swarmSpawner.

I had a request in these days where I was asked to run JupyterHub in a docker environment. To be able to provide horizontal scaling to the platform taking in count that for each customer will start a new container and each container will use resources. Jupyterhub is a great

Setup docker swarm cluster

Setting up a swarm cluster is really easy. All you need is a minimum of two nodes with OS of your choosing and having docker-ce installed on them both. Since I am mostly using debian I will be following the steps for installing docker-ce for ubuntu/debian since

Managing your elasticsearch indices with curator

If you are monitoring your environment using beats the default action is to rotate the indices every day and create new indices at midnight. After some time your disk will start filling up and it is very hard to see what you want to delete or keep and what you

Creating swap file on your filesystem

Some times you just need more memory in your system that you physically have. You don't know what to do but you cannot add more memory for various reasons. Filesystem is always there is it has more space than you could need in memory so why not use

Create an ipsec VPN tunnel between GCE network and AWS network

Recently I got a task to link the AWS network with the GCE network so that the traffic between the two networks would be going via an encrypted and secured tunnel without accessing the public network. For this you will need a GCE account. If you don't have

How to create your own in house elasticsearch alerts.

Since I am using elasticsearch for getting server side healthchecks, statistics and check on services which are important for the blog to function, I was wondering if I can use elasticsearch to write my own alerts in case something goes down. Therefore I have installed heartbeat on the elasticsearch server

Putting Kibana behind haproxy as /kibana and enable simple http authentication.

In this post we will talk about why and how to put kibana behind haproxy. First thing I am thinking is to be able to have multiple kibana setups and either do loadbalancing between them or use them as active - backup setup. This is how I will be using in