Don't have a Pixel phone? There are still a collection of security fixes that should be headed your way soon courtesy of your favorite device manufacturer:
https://source.android.com/docs/security/bulletin/2022-12-01
It's the first Monday of a new month, and you know what that means: new Android update!
The December 2022 OTA brings a bunch of fixes:
https://support.google.com/pixelphone/thread/191508547/google-pixel-update-december-2022
And a host of cool new features, too:
https://support.google.com/pixelphone/thread/191508448/new-software-features-have-arrived-to-the-pixel-family
#CoSoTech
Victory!
I've been tinkering the past week or so with using Packer, Terraform, and kubeadm to deploy a highly-available vanilla #Kubernetes cluster onto my #VMware #vSphere infrastructure, complete with all the fancy networking and storage integrations.
And it works! It deployed and configured the full cluster in just under 8 minutes.
Woohoo!
I've still got some additional tweaking to do (like enabling LDAPS authentication) but I'm really happy with this progress.
This one goes out to everyone frustrated by the superprevalence of side-fumbling in their legacy encabulation solutions. Only the SANS ICS HyperEncabulator can make futuristic zero-trust encabulation a reality, today.
#CoSoTech
Periodic reminder that https://www.shellcheck.net/ is a thing. It makes it so easy to validate (and optimize!) Linux shell scripts, and just saved me a ton of troubleshooting with a script I've been working on lately.
You've used Tailscale tunnels to establish secure connections between your devices.
Now get ready for Tailscale Funnels!
Funnels use Tailscale *magic* to make services on Tailscale nodes available outside of your tailnet (that is, accessible to the Internet) in a secure and controlled way. Kind of like if you stuck your own reverse proxy in front of it, but without having to manage another Linux instance.
I think I'm going to have fun with this!
I ran into a weird issue today with two hypervisors at a remote site that kept dropping offline, but their VMs remained reachable. I eventually found that as long as I pinged another (unresponsive) address on that subnet, both hosts would respond to pings (and other requests) for ~5 minutes before dropping again.
We went back and forth with the network team and the local IT at the site trying to figure out what was going on, but we weren't really able to make much headway.
👇
It's that time again - time to update the VMware ARM Edition running on my Quartz64 to this week's 1.11 release.
Changelog:
https://flings.vmware.com/esxi-arm-edition#changelog
My update notes from last time:
http://vpota.to/esxi-arm-on-quartz64/
Tailscale blows me away again. This is seriously cool stuff, and I love the details they share about how they built it.
Ooh, Tailscale + NextDNS is a brilliant pairing. I've been running this setup (though in a not-officially-supported configuration) for a few months already and it's been great.
Now to do it in a much more polished fashion!
Great news for people who like a bit of Linux in their Windows!
#CoSoTech
https://devblogs.microsoft.com/commandline/systemd-support-is-now-available-in-wsl/
I took some notes so that maybe I'll remember how useful the vSphere Diagnostic Tool is next time:
I was skimming through the ticket queue and saw one titled "Teapot Error". I opened it to see what was up and IT'S AN HONEST-TO-GOODNESS HTTP418! In the wild!
I think I can retire from tech now.
https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/418
Friendly reminder that the vSphere Diagnostic Tool is a(n incredible) thing, and it takes a lot of the legwork out of investigating weirdness in your vSphere environment.
Heck, it's also great as a preventative health check!
#vExpert #VMware #CoSoTech
https://flings.vmware.com/vsphere-diagnostic-tool
I just switched https://virtuallypotato.com from data-hungry Google Analytics to privacy-first Cabin Analytics, and it took me maybe three minutes to do. I'm impressed so far!
This should help me keep an eye on how various posts do without being creepy.
Check it out:
https://withcabin.com/
Any #kubernetes gurus around?
I'm working in an environment with an internal self-issued CA (actually a root and two subordinate CAs), and trying to figure out the best (or least-bad) way to make those CAs available to pods running in various namespaces.
I eventually figured to use a DaemonSet to load the certs into /etc/ssl/certs/ on each node so that K8s will trust a private registry with a cert issued by the CAs.
But what about the other workload pods?
True story. Tailscale feels too easy to be true - but it is!
If you aren't yet using Tailscale (https://tailscale.com/) for securely (and easily!) accessing remote devices and networks, you absolutely should. This is probably my favorite tech discovery of the past year, and I wrote some notes on it at https://www.virtuallypotato.com/secure-networking-made-simple-with-tailscale/.
(Tweet: https://twitter.com/simon_frankau/status/1552207554931003393)
Wrangler of imaginary computers. Dodger of orange cones. Anarchist of sandwiches. Antecedent of he/him.