Jim Angel jimangel

Home Assistant with ecowitt: HTTP to HTTPS nginx reverse proxy secure DIY solution

Shoutout @del13r for posting a great tutorial on the community forum and indepth feedback on GitHub issues.

Problem

Ecowitt can only send stats to HTTP API endpoints and we want to keep our Home Assistant secure via HTTP/s access only.

Resolution

Upload staging images to Google Artifact Registry

This is specifically for testing unreleased k8s components. Most of this is from https://cloud.google.com/artifact-registry/docs/docker/quickstart

Pre Reqs

https://cloud.google.com/sdk/docs/install

Setup

Fixes errors in Kubernetes v1.22+:

kubelet cgroup driver: \"cgroupfs\" is different from docker cgroup driver: \"systemd\""
kubelet cgroup driver: \"systemd\" is different from docker cgroup driver: \"cgroupfs\""

By setting both to use systemd as preferred by kubeadm.

Kubeadm: remove the automatic detection and matching of cgroup drivers for Docker. For new clusters if you have not configured the cgroup driver explicitly you might get a failure in the kubelet on driver mismatch (kubeadm clusters should be using the systemd driver). Also remove the IsDockerSystemdCheck preflight check (warning) that checks if the Docker cgroup driver is set to systemd. Ideally such detection / coordination should be on the side of CRI implementers and the kubelet. Please see the page on [how to configure cgroup drivers](https://kubernetes.io/docs/tasks/administer-cluster/kubeadm/

Enable auditing on KinD

TODO

Use a webhook vs. file backend (maybe cloudrun?)
This might only be possible if Docker is running as root - need to test

Config

Make a temporary directory to host files to be mounted in KinD.

https://kb.vmware.com/s/article/79832 has a pretty useless resolution...

Symptoms

VMs that have side channel mitigations enabled while running on Fusion on Mac OS 11.0 or later or on Workstation on Windows hosts with virtualization based security enabled may run slowly.

Cause

The root cause of the performance degradation is most likely due to mitigations for side channel attacks such as Spectre and Meltdown. Side channel attacks allow unauthorized read access by malicious processes or virtual machines to the contents of protected kernel or host memory. CPU vendors have introduced a number of features to protect data against this class of attacks such as indirect branch prediction barriers, single thread indirect branch predictor mode, indirect branch restricted speculation mode and L1 data cache flushing. While these features are effective at preventing side channel attacks they can cause noticeable performance degradation in some cases.

Resolution

Right click the VM > Settings... > Options [tab

Kubernetes v1.16 API deprecation testing

Examples of how to test the impact of the v1.16 API deprecations and ways to debug early!

If this is the first time you're hearing of these deprecations STOP and read this blog post (thanks @vllry!).

Common misunderstandings

The exact apiVersion: value that I use in my manifest is stored on disk (etcd).

Here is the process to merge master into dev-1.15. Please read the entire document before starting any work.

Start with a fresh slate

$ git clone https://github.com/jimangel/website.git website-docs
$ cd website-docs
$ git remote add upstream https://github.com/kubernetes/website.git
$ # validate
$ git remote -v
$ git fetch upstream

	#cloud-config
	autoinstall:
	version: 1

	ssh:
	install-server: true
	# option "allow-pw" defaults to `true` if authorized_keys is empty, `false` otherwise.
	allow-pw: false

	# "[late-commands] are run in the installer environment with the installed system mounted at /target."