and how to solve them with ssh-agent GitHub Action? You can utilize Repository Deploy Keys to access your private or internal repositories on GitHub from the workflow instances of another repository. This is useful if you are using Git submodules or private Golang modules in your projects. The procedure is…

In your GitHub Pipelines Image Signing: Why? Supply Chain Attacks have been plaguing the modern software development ecosystem. The build and deployment pipelines are not airtight, leading to points that can be exploited by malicious actors to inject code or artifacts to you production cluster to extract data or move laterally within it…

Problem Description Setup In one of the recent services we have developed in my day job, we had a constraint that a device should not have duplicate active entries of the same configuration key in the database. This was initially achieved by a UNIQUE INDEX: CREATE UNIQUE INDEX ON device (id, key) WHERE…

Health checking gRPC servers on Kubernetes Author: Ahmet Alp Balkan (Google) Update (December 2021): Kubernetes now has built-in gRPC health probes starting in…kubernetes.io In earlier Kubernetes versions, we used the handy grpc-health-probe project developed primarily by Ahmet Balkan in order to perform liveness and readiness checks for our gRPC based services. This naturally means that your images should have this binary so that Kubernetes exec probes can actually execute it.

Seccomp is a sandboxing mechanism built-in Linux kernel to allow defining rulesets to govern the syscalls being made by a program. Seccomp has two modes. Mode 1 is primitive, strict and only allows a fixed list of syscalls to be called, whereas Mode 2 allows a user defined filtering/action mechanism…

If you are an expat working in Germany, you have the following options for your savings: A savings account in the form of Tagesgeld or Festgeld/Sparbrief. A broker account for stock and ETF trading. The first kind of account will have an associated interest rate. The second one may offer…

Suboptimal struct alignment can lead to waste of memory in your Go program. Luckily, there are several tools that do address this issue by trying to optimize the struct layout by reordering the fields to create a better “packed” struct. Querying the Size of a Go Struct At runtime use…

Pod and Container Security Contexts Your deployments in Kubernetes have several knobs that allow you to make them more secure overall. These knobs are gathered under the securityContext objects, which are present under pod.spec.securityContext and pod.spec.containers.securityContext as PodSecurityContext and ContainerSecurityContext objects respectively. Use > kubectl explain pod.spec.securityContext > kubectl explain pod.spec.containers.securityContext…

We have a bunch of old Java projects that directly depend on SLF4J and Log4J2. Log4J2 was kept up-to-date for obvious reasons but SLF4J itself did not get much maintenance love lately, as it did not have as it did not have a glaring security issue. We have prioritized performing…