stand-sure

Grafana Datasource with Secrets

1. Create a secret
2. Add the secrets as environment variables to the Grafana section of the Prometheus yaml
3. Use the environment values (secureJsonData)

stand-sure

jaeger-config.yaml

Set values for address, username, and password.

Make the password into a hash for the clickhouse installation.

printf `printf 'my-password' | sha256sum` ; echo

# 6fa2288c361becce3e30ba4c41be7d8ba01e3580566f7acc76a7f99994474c46

stand-sure

Clickhouse & OTel Collector

clickhouse network security

The username/networks/ip under spec.configuration.users was the key to getting things to work.
It seems that "10.0.0.0/16" isn't enough. Allowing all networks solved the problem.

Otel Collector and sensitive data

Secrets can be mounted to environment variables under the extraEnvs key.

stand-sure

{{- if empty .Values.manualSecretName }}
apiVersion: v1
kind: Secret
metadata:
  name: "jwt-secret"
  annotations:
    "helm.sh/resource-policy": "keep"
type: Opaque
data:
  # retrieve the secret data using lookup function and when not exists, return an empty dictionary / map as result

stand-sure

### Keybase proof

I hereby claim:

  * I am stand-sure on github.
  * I am stand_sure (https://keybase.io/stand_sure) on keybase.
  * I have a public key ASCyW_dmVCsEDjWTcomieNrIhS2NJrkfRyww-S2qFc7K2Ao

To claim this, I am signing this object:

stand-sure

#! /usr/bin/env bash

for file in src/**/*.csproj
do 
  cat $file | \
  xq '[(try(.Project.ItemGroup[].PackageReference) // [])] | flatten' | \
  jq '[.[].["@Include"]]' | \
  jq --arg file ${file} '{"file":$file, "refs":.}' | \
  yq eval --prettyPrint '[.]';
done

stand-sure

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>KeepAlive</key>
    <true/>
    <key>Label</key>
    <string>my.gitsign-credential-cache</string>
    <key>ProgramArguments</key>
    <array>

stand-sure

    [Fact]
    public async Task InterceptShouldTrace()
    {
        IList<Activity> exportedActivities = new List<Activity>();
        
        IHostBuilder hostBuilder = Host.CreateDefaultBuilder();

        var source = Guid.NewGuid().ToString("N");
        
        hostBuilder.ConfigureServices((_, serviceCollection) =>

stand-sure

// found at https://www.strathweb.com/2016/09/strongly-typed-configuration-in-asp-net-core-without-ioptionst/

public static class ServiceCollectionExtensions
{
    public static TConfig ConfigurePOCO<TConfig>(this IServiceCollection services, IConfiguration configuration, Func<TConfig> pocoProvider) where TConfig : class
    {
        if (services == null) throw new ArgumentNullException(nameof(services));
        if (configuration == null) throw new ArgumentNullException(nameof(configuration));
        if (pocoProvider == null) throw new ArgumentNullException(nameof(pocoProvider));

stand-sure

#! /usr/bin/env bash
kubectl get secret --output yaml | /usr/local/bin/yq '.items[] | { (.metadata.name): (.data | to_entries) | map_values({ (.key): (.value | @base64d )}) }'
echo