protosam

In my storage quests, I finally decided I want to lazily use S3 for ReadWriteMany and to do do some experiments with.

There are a few options, but to save you some time if you just want what I landed on, I like csi-s3.

S3FS Mounted in Pod Containers

Well... this works great! The only problem was that it needed security privileges for mounting. That would be terrible if a container with this power got compromised, so I immediately moved on to getting this a layer away from being managed in-pod.

NFS Provisioner with Mounted S3

My initial plan was to just use the nfs-subdir-external-provisioner on top of a multi-replica S3 backed deployment of NFS Ganesha.

protosam

// A small SSH daemon providing bash sessions
//
// Server:
// cd my/new/dir/
// #generate server keypair
// ssh-keygen -t rsa
// go get -v .
// go run sshd.go
//
// Client:

protosam

FROM ubuntu:18.04



# Install SDK deps
RUN apt-get update
RUN DEBIAN_FRONTEND=noninteractive apt-get install -y \
    libgconf-2-4 \
    libcanberra-gtk-module \
    locales \

protosam

$ curl -o ~/.shrc https://gist.githubusercontent.com/protosam/74ac72cbbf27c51296a87aa55acab71d/raw/.shrc.sh
$ ln -s ~/.shrc ~/.bashrc
$ ln -s ~/.shrc ~/.zshrc

$ curl -o ~/.profiles.d/kubernetes https://gist.githubusercontent.com/protosam/74ac72cbbf27c51296a87aa55acab71d/raw/profiles.d.kubernetes.sh

protosam

Bash can connect to stuff without the need for curl or nc.

exec 3<> /dev/tcp/google.com/80
echo -e 'GET / HTTP/1.1\r\nhost: www.google.com\r\nConnection: close\r\n\r\n' >&3
cat <&3

# result: 
# HTTP/1.1 200 OK
# Expires: -1

protosam

#!/bin/bash

# detect mac os
if ! uname | grep -i -q darwin; then
  echo "ERROR: Only Mac OS is supported."
  exit 1
fi

# kill docker desktop
DOCKER_DESKTOP_PID=$(ps aux | grep '/Applications/Docker\.app/Contents/MacOS/Docker$' | awk '{print $2}')

protosam

BASH Scripting Tricks

protosam

Overview

This example shows how to generate something like a random password and keeping it consistent during upgrades.

Note About Better Security

IF YOU CAN, you should let helm generate a random secret during every upgrade and update the app to rotate the password from old one to new one. There are many options available by means of jobs and hooks to figure this out.

Walkthrough

Create a new helm chart with with no templates.

% helm create chart-name

protosam

Mac OS uses LibreSSL. Getting OpenSSL can be done with brew:

brew install openssl

After which, an alias can be used for openssl commands:

ls -lah $(echo /opt/homebrew/Cellar/openssl@*/*/bin/openssl)
alias openssl=/opt/homebrew/Cellar/openssl@1.1/1.1.1s/bin/openssl

protosam

Simple makefile to simplify building and installing this vscode extension locally: github.com/tintinweb/vscode-interactive-graphviz

Build from specific branch:

CHECKOUT=110-formatter-deletes-comments-and-all-whitespace-on-save make build

Install the vsix that was packaged:

make install