Distroless images are all the rage in the container space these days due to the reduced attack surface. This is great and also results in much thinner images. But, when an image isn't behaving it can cause some additional trouble as you try to figure out what may be missing …

When using dynamic database credentials with Flask, we need to make sure that the flask instance picks up the right credentials, renews them when necessary, and uses the right roles. My flask code is pretty embedded with the database changes here, so pardon the dust, but I think it's relatively …

When I was confirming the configurations for my vault management of database credentials, I used a local postgresql and vault server. This may also be useful for development (especially testing code that may exercise the vault and database interactions). This can make it relatively easy to watch all of the …

This is part of a multi-part series on using postgres databases, vault, and a variety of other tools to effect short-lived database credentials for real use. As postgres uses user and role interchangably, so will I, although I'll generally try to use user to refer to a role with login …

When using dynamic database credentials with Django, we need to make sure that the django instance picks up the right credentials, renews them when necessary, and uses the right roles. This post includes the background and the necessary code. Migration and creation Migration and creation provide special problems because of …

This morning I had the need to change the IP address configuration for the load balancer in our k8s cluster. The basics of changing the main pool in metallb were straightforward enough, but when I applied my changes, I didn't get what I needed. So, what happened? Originally, I wasn't …

Another chapter in my learning kubernetes the hard way, this time Longhorn. Probably ill-advisedly, I'm using ephemeral volumes for my storage volumes in Longhorn and have a habit of leaving the nodes in the cluster as they're being rebuilt. Generally, this isn't a problem. This weekend, I was a bit …

Over the past year, I've been experimenting with Hashicorp Vault, using the open-source/community version for some internal experiments, including some with high availability. In a separate article, I'll go over a test configuration of Vault, but all of the notes here are agnostic to the use of HCP (Hashicorp's …

This post is mostly a warning to me for the future, but hopefully it'll prevent somebody else from going through the same problem. I've been running a small Kubernetes cluster for a couple of years now, mostly as an experiment and to keep my skills tuned for new tooling. Part …

Recently, I noticed a problem with my Index Lifecycle Management (ILM) not appropriately rotating indexes. The error was not super clear, but I did notice that the existing index had just reached 90 days without closing and that was the first move in the ILM. It was clear that the …

This weekend, I had occasion to build a new python-based utility and leaned in to my existing poetry tooling in order to do so. While starting the new project, I wanted to take advantage of some gitlab automation I'd previously used on other projects, so I figured I'd document it …

Background Generally speaking, I refresh most of my systems pretty regularly, spurred on by security concerns, general hygiene, a desire to make sure the automation doesn't age out, and certificate expiration. Although I don't need to refresh systems due to certificate expiration, it has historically been the easiest indicator of …

Background As part of an ongoing effort to keep Cartographica up to date with recent changes in libraries that we compile from source, notably GDAL and Proj, I'm in the midst of a refresh of those subtrees in the frameworks that I build from them. Over the past few years …

My previous post about proj floating point investigation discussed an issue that I'd tracked down to the OS level. However, it's clear that this relates to an underlying change to code compiled by Xcode (and/or the LLVM toolchain that it is built upon). Based on a post about Xcode …

As part of digging through my various problems with Xcode 14.3 (Feedback FB12154691, FB12154887, and some test case issues involving floating point math), I needed to install Xcode 14.2 to move my buildfarm backwards. Although this didn't entirely fix the problem, it was an essential element of the …

TL;DR MacOS 13.3 or 13.3.1 incorporated a change that is affecting calculations in proj for applications running on those versions of the OS. The change appears to be relatively subtle, only affecting a single test in a single projection and only on x86_64, not arm, but …

I've already written a bit about using renovate to keep dependencies current using Renovate On Prem in Renovating GitLab Repos. This has been working well. However, there are a couple of twists that I figured I'd document in the event that people run into them. For single-repositories with public dependencies …

Most of the system administration work that I do has been automated using Ansible, as I've mentioned in posts here, including Deploying with GitLab. Now that I've got Renovate in place (Renovating GitLab Repos), I am starting to look at how to expand beyond my existing automations in order to …

Seemingly appropriate for the week after Easter, I've gone through some old draft posts and decided to publish them. A couple that were mostly ready and I decided to push out: Slathering Xcode Variants Test without building and SPM And one that I did a bunch of additional work and …

Ed. Note: I started this article nearly a year ago, but got stuck on the Kubernetes piece. Now that I've resolved that, I'm publishing it. I've been a very happy user of SauceLabs for testing for many years. However, I don't make a lot of use of it, and recently …