MastodonTech.de

ReynardSecA grumpy ItSec guy walks through the office #2devops0: dude, we've got so many roles in this cluster my terminal buffer runs out when I try to list them all. devops1: bro, if it works, don't touch. devops0: sure, but neither I nor anyone else on the project knows who can access what...ItSec (walking by): just use rbac-tool and review this... devops1: r... rba... what? devops0: rbac-tool probably or smth--It's always a good moment to verify who can do what in your Kubernetes cluster.For basic checks, use native kubectl:1) Can "I" read secrets?kubectl auth can-i get secrets2) To check another identity's permissions (e.g., a ServiceAccount) run:kubectl auth can-i get secrets --as=system:serviceaccount:somenamespace:someserviceaccountHowever, this approach will not work for complex environments. There's a more effective way to do this with rbac-tool [2]. It gives you cluster-wide visibility with simple commands. Check this:1) Who can do a specific thing? For example: who in the entire cluster can read Secrets?rbac-tool who-can get secrets2) Run an RBAC health check - global analysis with risk hints (wildcards in RBAC, overly broad permissions, cross-namespace binds, etc)rbac-tool analysis3) Visualize the mess - produce an interactive map of roles, bindings, etc:rbac-tool visualizeThis command writes a report to rbac.html in the current directory.Alternatives to rbac-tool like rakkess [3] can offer similar "who can" insights, though it may not be actively maintained.Stay (more) safe![1] <a href="https://kubernetes.io/docs/reference/kubectl/generated/kubectl_auth/kubectl_auth_can-i/" rel="nofollow noopener" translate="no" target="_blank">https://kubernetes.io/docs/reference/kubectl/generated/kubectl_auth/kubectl_auth_can-i/</a> [2] <a href="https://github.com/alcideio/rbac-tool" rel="nofollow noopener" translate="no" target="_blank">https://github.com/alcideio/rbac-tool</a> [3] <a href="https://github.com/corneliusweig/rakkess" rel="nofollow noopener" translate="no" target="_blank">https://github.com/corneliusweig/rakkess</a><a href="https://infosec.exchange/tags/devops" class="mention hashtag" rel="nofollow noopener" target="_blank">#devops</a> <a href="https://infosec.exchange/tags/programming" class="mention hashtag" rel="nofollow noopener" target="_blank">#programming</a> <a href="https://infosec.exchange/tags/webdev" class="mention hashtag" rel="nofollow noopener" target="_blank">#webdev</a> <a href="https://infosec.exchange/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#cybersecurity</a> <a href="https://infosec.exchange/tags/infosec" class="mention hashtag" rel="nofollow noopener" target="_blank">#infosec</a> <a href="https://infosec.exchange/tags/sysadmin" class="mention hashtag" rel="nofollow noopener" target="_blank">#sysadmin</a> <a href="https://infosec.exchange/tags/kubernetes" class="mention hashtag" rel="nofollow noopener" target="_blank">#kubernetes</a> <a href="https://infosec.exchange/tags/containers" class="mention hashtag" rel="nofollow noopener" target="_blank">#containers</a>

Yuan Tang :redhat:Big thanks to everyone contributing code, reviews, and ideas — this integration is shaping up to be a game-changer for 𝗞𝘂𝗯𝗲𝗿𝗻𝗲𝘁𝗲𝘀-𝗻𝗮𝘁𝗶𝘃𝗲 𝗟𝗟𝗠 𝘀𝗲𝗿𝘃𝗶𝗻𝗴. Stay tuned for next release!<a href="https://fosstodon.org/tags/KServe" class="mention hashtag" rel="nofollow noopener" target="_blank">#KServe</a> <a href="https://fosstodon.org/tags/llmd" class="mention hashtag" rel="nofollow noopener" target="_blank">#llmd</a> <a href="https://fosstodon.org/tags/GenerativeAI" class="mention hashtag" rel="nofollow noopener" target="_blank">#GenerativeAI</a> <a href="https://fosstodon.org/tags/MLOps" class="mention hashtag" rel="nofollow noopener" target="_blank">#MLOps</a> <a href="https://fosstodon.org/tags/Kubernetes" class="mention hashtag" rel="nofollow noopener" target="_blank">#Kubernetes</a> <a href="https://fosstodon.org/tags/ModelServing" class="mention hashtag" rel="nofollow noopener" target="_blank">#ModelServing</a> <a href="https://fosstodon.org/tags/AIInfrastructure" class="mention hashtag" rel="nofollow noopener" target="_blank">#AIInfrastructure</a>

Watchful CitizenSo happy about getting <a href="https://goingdark.social/tags/mastodon" class="mention hashtag" rel="nofollow noopener" target="_blank">#mastodon</a> up and working in my <a href="https://goingdark.social/tags/kubernetes" class="mention hashtag" rel="nofollow noopener" target="_blank">#kubernetes</a> <a href="https://goingdark.social/tags/homelab" class="mention hashtag" rel="nofollow noopener" target="_blank">#homelab</a>. I can really recommend. <a href="https://goingdark.social/tags/Cloudflare" class="mention hashtag" rel="nofollow noopener" target="_blank">#Cloudflare</a> R2 is pretty solid too. What's your latest accomplishment in <a href="https://goingdark.social/tags/foss" class="mention hashtag" rel="nofollow noopener" target="_blank">#foss</a> in your homelab?

heise online EnglishKubernetes: Web UI Headlamp gets an AI assistantThe Kubernetes web UI Headlamp comes with the new AI Assistant as a plug-in. It improves interaction with Kubernetes clusters.<a href="https://www.heise.de/en/news/Kubernetes-Web-UI-Headlamp-gets-an-AI-assistant-10517020.html?wt_mc=sm.red.ho.mastodon.mastodon.md_beitraege.md_beitraege&utm_source=mastodon" rel="nofollow noopener" translate="no" target="_blank">https://www.heise.de/en/news/Kubernetes-Web-UI-Headlamp-gets-an-AI-assistant-10517020.html?wt_mc=sm.red.ho.mastodon.mastodon.md_beitraege.md_beitraege&utm_source=mastodon</a><a href="https://social.heise.de/tags/Containerisierung" class="mention hashtag" rel="nofollow noopener" target="_blank">#Containerisierung</a> <a href="https://social.heise.de/tags/IT" class="mention hashtag" rel="nofollow noopener" target="_blank">#IT</a> <a href="https://social.heise.de/tags/Kubernetes" class="mention hashtag" rel="nofollow noopener" target="_blank">#Kubernetes</a> <a href="https://social.heise.de/tags/K%C3%BCnstlicheIntelligenz" class="mention hashtag" rel="nofollow noopener" target="_blank">#KünstlicheIntelligenz</a> <a href="https://social.heise.de/tags/news" class="mention hashtag" rel="nofollow noopener" target="_blank">#news</a>

heise DeveloperKubernetes: Web-UI Headlamp erhält einen KI-AssistentenDas Kubernetes-Web-UI Headlamp bringt den neuen AI Assistant als Plug-in mit. Er verbessert die Interaktion mit Kubernetes-Clustern.<a href="https://www.heise.de/news/Kubernetes-Web-UI-Headlamp-erhaelt-einen-KI-Assistenten-10516260.html?wt_mc=sm.red.ho.mastodon.mastodon.md_beitraege.md_beitraege&utm_source=mastodon" rel="nofollow noopener" translate="no" target="_blank">https://www.heise.de/news/Kubernetes-Web-UI-Headlamp-erhaelt-einen-KI-Assistenten-10516260.html?wt_mc=sm.red.ho.mastodon.mastodon.md_beitraege.md_beitraege&utm_source=mastodon</a><a href="https://social.heise.de/tags/Containerisierung" class="mention hashtag" rel="nofollow noopener" target="_blank">#Containerisierung</a> <a href="https://social.heise.de/tags/IT" class="mention hashtag" rel="nofollow noopener" target="_blank">#IT</a> <a href="https://social.heise.de/tags/Kubernetes" class="mention hashtag" rel="nofollow noopener" target="_blank">#Kubernetes</a> <a href="https://social.heise.de/tags/K%C3%BCnstlicheIntelligenz" class="mention hashtag" rel="nofollow noopener" target="_blank">#KünstlicheIntelligenz</a> <a href="https://social.heise.de/tags/news" class="mention hashtag" rel="nofollow noopener" target="_blank">#news</a>

Vlad<a href="https://3v-host.com/blog/how-to-build-a-kubernetes-cluster-from-three-vps-servers/" rel="nofollow noopener" translate="no" target="_blank">https://3v-host.com/blog/how-to-build-a-kubernetes-cluster-from-three-vps-servers/</a> Learn how to build a Kubernetes cluster using three VPS servers! This step-by-step guide covers everything from server preparation to deploying your first application. Perfect for beginners looking to dive into container orchestration. 🚀 <a href="https://mstdn.business/tags/Kubernetes" class="mention hashtag" rel="nofollow noopener" target="_blank">#Kubernetes</a> <a href="https://mstdn.business/tags/VPS" class="mention hashtag" rel="nofollow noopener" target="_blank">#VPS</a> <a href="https://mstdn.business/tags/DevOps" class="mention hashtag" rel="nofollow noopener" target="_blank">#DevOps</a>

K8sContributorsIntroducing Headlamp AI Assistant - <a href="https://kubernetes.io/blog/2025/08/07/introducing-headlamp-ai-assistant/" rel="nofollow noopener" translate="no" target="_blank">https://kubernetes.io/blog/2025/08/07/introducing-headlamp-ai-assistant/</a> <a href="https://hachyderm.io/tags/Kubernetes" class="mention hashtag" rel="nofollow noopener" target="_blank">#Kubernetes</a>

teqqyUnd zu guter letzte noch den <a href="https://gts.teqqy.social/tags/kubernetes" class="mention hashtag" rel="nofollow noopener" target="_blank">#Kubernetes</a> Cluster mal auf Version 1.33.3 hoch gezogen. Das habe ich auch schon lange vor mir her geschoben. <a href="https://gts.teqqy.social/tags/homelab" class="mention hashtag" rel="nofollow noopener" target="_blank">#homelab</a>

Watchful Citizen<a href="https://aseachange.com/@elena" class="u-url mention" rel="nofollow noopener" target="_blank">@elena</a> welcome to hell, you will never leave. Wait until you learn about <a href="https://goingdark.social/tags/kubernetes" class="mention hashtag" rel="nofollow noopener" target="_blank">#kubernetes</a> <a href="https://goingdark.social/tags/docker" class="mention hashtag" rel="nofollow noopener" target="_blank">#docker</a> will feel like a toddler after that

Watchful Citizen<a href="https://gts.sadauskas.id.au/@aj" class="u-url mention" rel="nofollow noopener" target="_blank">@aj</a> congrats! Recently did the same nice myself. Self hosted on <a href="https://goingdark.social/tags/kubernetes" class="mention hashtag" rel="nofollow noopener" target="_blank">#kubernetes</a> . It was a bit challenging ironing some issues. It feels great being in control by yourself right?

robrichI'm on my way to <a href="https://hachyderm.io/tags/KCDC" class="mention hashtag" rel="nofollow noopener" target="_blank">#KCDC</a>. <a href="https://www.kcdc.info/" rel="nofollow noopener" translate="no" target="_blank">https://www.kcdc.info/</a> Join us <a href="https://hachyderm.io/tags/InPerson" class="mention hashtag" rel="nofollow noopener" target="_blank">#InPerson</a> in <a href="https://hachyderm.io/tags/KansasCity" class="mention hashtag" rel="nofollow noopener" target="_blank">#KansasCity</a>! I'll be teaching a <a href="https://hachyderm.io/tags/Kubernetes" class="mention hashtag" rel="nofollow noopener" target="_blank">#Kubernetes</a> workshop and a <a href="https://hachyderm.io/tags/TypeScript" class="mention hashtag" rel="nofollow noopener" target="_blank">#TypeScript</a> <a href="https://hachyderm.io/tags/Testing" class="mention hashtag" rel="nofollow noopener" target="_blank">#Testing</a> talk, and I'm excited to learn together.

Ben HardillUsing the instructions here:<a href="https://jonathangazeley.com/2025/02/11/intel-gpu-acceleration-on-kubernetes/" rel="nofollow noopener" translate="no" target="_blank">https://jonathangazeley.com/2025/02/11/intel-gpu-acceleration-on-kubernetes/</a>to label my cluster nodes and enable Intel GPU discovery and reporting so I can target pods to the right nodes.<a href="https://bluetoot.hardill.me.uk/tags/k8s" class="mention hashtag" rel="nofollow noopener" target="_blank">#k8s</a> <a href="https://bluetoot.hardill.me.uk/tags/kubernetes" class="mention hashtag" rel="nofollow noopener" target="_blank">#kubernetes</a>

heise DeveloperCLC-Konferenz 2025: Keynote zu Souveränität und digitaler ResilienzDie CLC 2025 bringt IT-Profis zusammen – zu den wichtigsten Trends von Platform Engineering, DevOps und KI bis zu digitaler Souveränität.<a href="https://www.heise.de/news/CLC-Konferenz-2025-Keynote-zu-Souveraenitaet-und-digitaler-Resilienz-10513458.html?wt_mc=sm.red.ho.mastodon.mastodon.md_beitraege.md_beitraege&utm_source=mastodon" rel="nofollow noopener" translate="no" target="_blank">https://www.heise.de/news/CLC-Konferenz-2025-Keynote-zu-Souveraenitaet-und-digitaler-Resilienz-10513458.html?wt_mc=sm.red.ho.mastodon.mastodon.md_beitraege.md_beitraege&utm_source=mastodon</a><a href="https://social.heise.de/tags/Containerisierung" class="mention hashtag" rel="nofollow noopener" target="_blank">#Containerisierung</a> <a href="https://social.heise.de/tags/Developer" class="mention hashtag" rel="nofollow noopener" target="_blank">#Developer</a> <a href="https://social.heise.de/tags/IT" class="mention hashtag" rel="nofollow noopener" target="_blank">#IT</a> <a href="https://social.heise.de/tags/Kubernetes" class="mention hashtag" rel="nofollow noopener" target="_blank">#Kubernetes</a> <a href="https://social.heise.de/tags/Softwareentwicklung" class="mention hashtag" rel="nofollow noopener" target="_blank">#Softwareentwicklung</a> <a href="https://social.heise.de/tags/news" class="mention hashtag" rel="nofollow noopener" target="_blank">#news</a>

Kubernetes ReleasesNew Kubernetes Release Candidate Release:kubernetes: Kubernetes v1.34.0-rc.1 :kubernetes:<a href="https://github.com/kubernetes/kubernetes/releases/tag/v1.34.0-rc.1" rel="nofollow noopener" translate="no" target="_blank">https://github.com/kubernetes/kubernetes/releases/tag/v1.34.0-rc.1</a><a href="https://k8s.social/tags/Kubernetes" class="mention hashtag" rel="nofollow noopener" target="_blank">#Kubernetes</a> <a href="https://k8s.social/tags/k8s" class="mention hashtag" rel="nofollow noopener" target="_blank">#k8s</a> <a href="https://k8s.social/tags/kube" class="mention hashtag" rel="nofollow noopener" target="_blank">#kube</a>

Solinvictus :mastodon:Running a standalone <a href="https://mastodon.social/@CloudNativePG" class="u-url mention" rel="nofollow noopener" target="_blank">@CloudNativePG</a> PostgreSQL instance in production for 17d already, no issues reported 🫡This thing is robust af! 770 TPS (Transactions Per Second). Reminder for everyone to set “wal_*” settings in your postgresql.conf to prevent filling up your disk with ONLY wal files 😉<a href="https://mastodon.social/tags/postgresql" class="mention hashtag" rel="nofollow noopener" target="_blank">#postgresql</a> <a href="https://mastodon.social/tags/kubernetes" class="mention hashtag" rel="nofollow noopener" target="_blank">#kubernetes</a> <a href="https://mastodon.social/tags/k8s" class="mention hashtag" rel="nofollow noopener" target="_blank">#k8s</a> <a href="https://mastodon.social/tags/db" class="mention hashtag" rel="nofollow noopener" target="_blank">#db</a> <a href="https://mastodon.social/tags/dba" class="mention hashtag" rel="nofollow noopener" target="_blank">#dba</a>

drmorrUnlike most folks, I actually don't hate yaml, even though it's fun to dunk on. But I think it's approximately "fine" as a configuration language for computers to consume; yaml isn't the problem, and kyaml isn't fixing it.The problem is that we need a way to _generate_ yaml programmatically, and helm is a templating language trying to be a programming language.Just. Just stop. Use a real programming language to generate your configs.<a href="https://hachyderm.io/tags/kubernetes" class="mention hashtag" rel="nofollow noopener" target="_blank">#kubernetes</a> <a href="https://hachyderm.io/tags/helm" class="mention hashtag" rel="nofollow noopener" target="_blank">#helm</a> <a href="https://hachyderm.io/tags/yaml" class="mention hashtag" rel="nofollow noopener" target="_blank">#yaml</a>

drmorrCatching up on my blogroll: two different posts slamming Helm show up.Helm Charts are Cloud Native Fast Food -- "Only 13,880 lines of yaml: If those were calories, it would be about 24 Big Macs."<a href="https://kyle.cascade.family/posts/helm-charts-are-cloud-native-fast-food/" rel="nofollow noopener" translate="no" target="_blank">https://kyle.cascade.family/posts/helm-charts-are-cloud-native-fast-food/</a>I Shouldn't Have to Read Installer Code Every Day -- "Many helm charts for off-the-shelf applications have hundreds of parameters. They are pushed in the direction of extreme flexibility by requests from their many users — the more users and use cases, the more parameters."<a href="https://itnext.io/i-shouldnt-have-to-read-installer-code-every-day-4dc1e5f9ee1a" rel="nofollow noopener" translate="no" target="_blank">https://itnext.io/i-shouldnt-have-to-read-installer-code-every-day-4dc1e5f9ee1a</a><a href="https://hachyderm.io/tags/kubernetes" class="mention hashtag" rel="nofollow noopener" target="_blank">#kubernetes</a> <a href="https://hachyderm.io/tags/helm" class="mention hashtag" rel="nofollow noopener" target="_blank">#helm</a> <a href="https://hachyderm.io/tags/yaml" class="mention hashtag" rel="nofollow noopener" target="_blank">#yaml</a>

drmorrThe graphs at the end remind me a lot of the SimKube work I did last year, only at a much larger scale. I wonder if they'd be willing to release a trace of their work? I'd go bananas with SimKube on that.<a href="https://blog.appliedcomputing.io/p/using-simkube-10-comparing-kubernetes" rel="nofollow noopener" translate="no" target="_blank">https://blog.appliedcomputing.io/p/using-simkube-10-comparing-kubernetes</a><a href="https://hachyderm.io/tags/kubernetes" class="mention hashtag" rel="nofollow noopener" target="_blank">#kubernetes</a> <a href="https://hachyderm.io/tags/aws" class="mention hashtag" rel="nofollow noopener" target="_blank">#aws</a> <a href="https://hachyderm.io/tags/simkube" class="mention hashtag" rel="nofollow noopener" target="_blank">#simkube</a> <a href="https://hachyderm.io/tags/simulation" class="mention hashtag" rel="nofollow noopener" target="_blank">#simulation</a>

drmorrI'm also interested in what they did to kube-scheduler. They say that the scheduler is a big source of latency because of its "one-pod-at-a-time" behaviour, and that this doesn't work for "ultra-scale" or big ML workloads. But then they say, "However, we achieved consistently a high throughput of 500 pods/second even at the 100K node scale by carefully tailoring scheduler plugins based on the workload and optimizing node filtering/scoring parameters."How does this work??? What did they do??? Again, frustratingly light on details.<a href="https://hachyderm.io/tags/kubernetes" class="mention hashtag" rel="nofollow noopener" target="_blank">#kubernetes</a> <a href="https://hachyderm.io/tags/aws" class="mention hashtag" rel="nofollow noopener" target="_blank">#aws</a> <a href="https://hachyderm.io/tags/eks" class="mention hashtag" rel="nofollow noopener" target="_blank">#eks</a> <a href="https://hachyderm.io/tags/scheduling" class="mention hashtag" rel="nofollow noopener" target="_blank">#scheduling</a>

drmorrFinally finished reading the AWS post from a few weeks ago about their "ultra-scale" EKS perf improvements! There's some cool stuff in there, and lots of pretty graphs.Aside from a bunch of "targeted" improvements, it seems like the biggest change is to move away from raft into some internal thing called "journal" in etcd. This seems cool, I guess, but also kinda like magic unicorn sauce?"Offloading consensus to journal enabled us to freely scale etcd replicas without being bound by a quorum requirement and eliminated the need for peer-to-peer communication."How on earth does that work? Would love to have more details here.<a href="https://aws.amazon.com/blogs/containers/under-the-hood-amazon-eks-ultra-scale-clusters/?ref=cloudnative.now" rel="nofollow noopener" translate="no" target="_blank">https://aws.amazon.com/blogs/containers/under-the-hood-amazon-eks-ultra-scale-clusters/?ref=cloudnative.now</a><a href="https://hachyderm.io/tags/kubernetes" class="mention hashtag" rel="nofollow noopener" target="_blank">#kubernetes</a> <a href="https://hachyderm.io/tags/aws" class="mention hashtag" rel="nofollow noopener" target="_blank">#aws</a> <a href="https://hachyderm.io/tags/eks" class="mention hashtag" rel="nofollow noopener" target="_blank">#eks</a> <a href="https://hachyderm.io/tags/etcd" class="mention hashtag" rel="nofollow noopener" target="_blank">#etcd</a>

Frühere Suchanfragen

Suchoptionen

Verwaltet von:

Serverstatistik:

#kubernetes