DevOps & SRE notes

The article delves into the intricacies of Kubernetes resource management, specifically focusing on requests and limits. It explains how these settings impact pod scheduling, resource allocation, and performance, highlighting the importance of correctly configuring them to ensure efficient use of cluster resources and prevent overcommitting or underutilization. Understanding these concepts is crucial for optimizing application performance and reliability in Kubernetes environments.

https://thenewstack.io/how-kubernetes-requests-and-limits-really-work/

The author discusses strategies for significantly reducing the startup time of AWS EKS Windows nodes. The author achieved this by using Karpenter for dynamic node provisioning, optimizing PowerShell scripts, and pre-caching images with AWS Image Builder. Key optimizations included uninstalling unnecessary PowerShell modules and rewriting the bootstrap script in C# for better performance, resulting in startup times under 90 seconds



https://hackernoon.com/how-i-reduced-eks-windows-node-start-time-from-5-min-to-90s

🔥 Critical vulnarabliiity in ingress-nginx controlller

9.8/10 🔥 https://github.com/advisories/GHSA-mgvx-rpfc-9mpv

If you're running Kubernetes with the ingress-nginx controller and are affected by the vulnerability described in GHSA-mgvx-rpfc-9mpv (CVE-2025-1974), you face several serious security risks:

Critical Security Risks

This vulnerability, published on March 25, 2025, is part of a set of critical flaws collectively named "IngressNightmare" with a CVSS score of 9.8[6]. The specific issues include:

- Unauthenticated Remote Code Execution (RCE): An attacker with access to the pod network can execute arbitrary code in the context of the ingress-nginx controller without authentication[1][2].

- Cluster-wide Secret Exposure: The vulnerability allows attackers to access and steal all secrets accessible to the controller. In default installations, the controller can access all secrets across all namespaces in the cluster[1][3].

- Complete Cluster Takeover: Due to the elevated privileges of the admission controller, successful exploitation could lead to full compromise of your Kubernetes environment[3][6].

- Public Exposure Risk: Over 6,500 clusters with publicly accessible admission controllers are at immediate risk, including those operated by Fortune 500 companies[8].

How the Vulnerability Works

The attack targets the admission controller component of the ingress-nginx controller:

1. The vulnerability allows attackers to inject arbitrary NGINX configuration remotely by sending a malicious ingress object directly to the admission controller[3].

2. When the controller processes this malicious object during validation, it causes the NGINX validator to execute malicious code[6][8].

3. The admission controller's elevated privileges and network accessibility create a critical escalation path, allowing an attacker to access sensitive resources across the entire cluster[3].

Required Action

To mitigate this issue, you should:

- Update immediately to one of the patched versions: 1.12.1, 1.11.5, or 1.10.7[6].

- Ensure your admission webhook endpoint is not exposed externally[6].

- Limit access to the admission controller to only the Kubernetes API Server[6].

- Temporarily disable the admission controller component if it's not needed[6].

This vulnerability affects approximately 43% of cloud environments, making it a widespread and serious threat to Kubernetes deployments[6].

A PostgreSQL database explorer TUI (Terminal User Interface) application written in Go.

https://github.com/ddoemonn/go-dot-dot

The incredible HULL - Helm Uniform Layer Library - is a Helm library chart to improve Helm chart based workflows

https://github.com/vidispine/hull

The article focuses on the importance of handling termination signals gracefully in applications deployed in orchestrated environments like Kubernetes. Graceful shutdowns are crucial to prevent data loss and system instability that can occur with abrupt terminations, ensuring that applications can exit cleanly and maintain consistency even when they are stopped or scaled down.

https://packagemain.tech/p/graceful-shutdowns-k8s-go

The recursive internet scanner for hackers. 🧡

https://github.com/blacklanternsecurity/bbot

Git branches made easy

https://github.com/git-town/git-town

A Declarative Dependency Management tool

https://github.com/updatecli/updatecli

This article provides a comprehensive guide on setting up a WireGuard VPN server on AWS using Terraform. It likely covers the step-by-step process of deploying a secure and scalable VPN solution, leveraging AWS infrastructure and Terraform's infrastructure-as-code capabilities.


https://vladkens.cc/aws-wireguard-vpn-terraform/

This article explores Docker Multi-Stage Builds as a powerful technique for creating smaller and more secure container images.

https://labs.iximiuz.com/tutorials/docker-multi-stage-builds

csi storage for container orchestration systems

https://github.com/democratic-csi/democratic-csi

grep for words with similar meaning to the query

https://github.com/arunsupe/semantic-grep

This article explores how observability, particularly tracing, serves as a powerful tool for debugging and optimizing software systems at incident.io. It delves into the concept of traces and spans, explaining how they provide detailed insights into application performance and behavior, enabling developers to quickly identify and resolve issues

https://incident.io/blog/observability-as-a-superpower

This blogpost presents a comprehensive benchmark of Kubernetes Container Network Interfaces (CNIs) over a 40Gbit/s network, conducted in early 2024. The study evaluates seven CNIs with 21 different configurations, focusing on performance, efficiency, and resource consumption.

https://itnext.io/benchmark-results-of-kubernetes-network-plugins-cni-over-40gbit-s-network-2024-156f085a5e4e

Quickly query the AWS IP Ranges

https://github.com/cmlccie/awsipranges

A browser & editor for network configuration files.

https://github.com/blademd/thymus

This article explores the key areas of responsibility for engineering managers, providing insights into their multifaceted role within an organization. It likely delves into topics such as team leadership, project management, technical guidance, and strategic planning, offering valuable perspectives for both aspiring and current engineering managers.

https://levelup.gitconnected.com/the-engineering-managers-areas-of-responsibility-e25fe6c6fbb7

This author explores how Otterize simplifies workload IAM integration in Kubernetes on Azure. It demonstrates how developers can manage IAM changes directly from within the cluster, using Otterize's open-source solution to automate managed identity and policy creation

https://itnext.io/kubernetes-automate-workload-iam-on-azure-with-otterize-860faa221eac

Transparent proxy server that works as a poor man's VPN. Forwards over ssh. Doesn't require admin. Works with Linux and MacOS. Supports DNS tunneling.

https://github.com/sshuttle/sshuttle