Applying the principle of least privileges when developing Operators — Applying the principle of least privileges when developing Operators Let me start by asking you a few questions. Are you developing Operators for Kubernetes? Are you the kind of person who yearns for a safe environment to run everything as a privileged user (‘root’) during development? Is bypassing security checks…

If you are responsible for managing Red Hat OpenShift clusters, then there is a nifty opensource project (aptly named openshift-checks)… — If you are responsible for managing Red Hat OpenShift clusters, then there is a nifty opensource project (aptly named openshift-checks) that could be a good addition to your toolkit. The openshift-checks project is a collection of health-check scripts for an OpenShift cluster.

When transitioning workloads to Kubernetes, some of the following questions often cross our minds: — When transitioning workloads to Kubernetes, some of the following questions often cross our minds: How to satisfy conflicting workload requirements on the same Kubernetes cluster? Is it possible to lift and shift a few existing workloads to run on Kubernetes with phase-wise modernization? What kind of flexibility can be provided…

A Kubernetes emptyDir volume is a directory that exists on the local node’s filesystem with no contents. These volumes are stored either on… — A Kubernetes emptyDir volume is a directory that exists on the local node’s filesystem with no contents. These volumes are stored either on the node’s backing disk storage or memory. …

A low-risk approach for Developers and Administrators — Linux provides the sysctl mechanism to modify the kernel behavior at runtime. There are many situations where this is desired. For example, tuning the kernel to run high-performance computing apps, configuring the application core dump settings, modifying network settings, experiments, etc. Sysctl settings can be grouped into two categories Namespaced…

More flexibility, Improved Isolation, and handling of Noisy Neighbour — A commonly used approach to build container images as part of the DevOps pipeline is to use a builder image running in a Kubernetes cluster. The builder image leverages either docker or kaniko or buildah. The docker-based builder image is commonly referred to as docker-in-docker (DinD). There are different variations…

Current state and challenges — There are many use cases that necessitate the need for encrypted container images when working with confidential containers. This article summarizes what we are doing under the Confidential-Containers (CoCo) project to provide this functionality and current challenges. Before we dive into the details, let’s spend some time understanding the encryption/decryption…

Building block for confidential containers with Kata — Building block for confidential containers with Kata The latest release ( 2.3.0) of Kata containers runtime added support to dynamically configure the kata-agent behaviour using a configuration file. …

An often-asked question that I get during discussions with team members and mentees is, what it takes to progress to the next level in… — An often-asked question that I get during discussions with team members and mentees is, what does it take to progress to the next level in their career? While this question is simple on the face, there is no prescriptive answer to it. …