1_DevOps'ish

Mitiga Researchers found a new post-exploitation attack method, a novel way in AWS that may enable adversaries to hijack static public IP addresses for malicious purposes.

Using IP blocks to make domains unreachable is a far-reaching method that has undesirable side effects because there is no one-on-one relationship.

A new wave of chat bots like ChatGPT use artificial intelligence that could reinvent or even replace the traditional internet search engine.

A friendly reminder to set-up Google alerts for yourself, your family, your business, your trademarks, so that in case of a data breach, harassment, stalking, NCP, or even rumors/crisis, you get notification & can handle accordingly. #googlealerts #google #reminder #MorningMeditation #infosec #techie #safety #InformationSecurity #privacy #business #coffee

Authors: Andrew Sy Kim (Google), Dixita Narang (Google) Kubernetes v1.26 introduced generally available (GA) support for kubelet credential provider plugins , offering an extensible plugin framework to dynamically fetch credentials for any container image registry. Background Kubernetes supports the ability to dynamically fetch credentials for a container registry service. Prior to Kubernetes v1.20, this capability was compiled into the kubelet and only available for Amazon Elastic Container Registry, Azure Container Registry, and Google Cloud Container Registry. Figure 1: Kubelet built-in credential provider support for Amazon Elastic Container Registry, Azure Container Registry, and Google Cloud Container Registry. Kubernetes v1.20 introduced alpha support for kubelet credential providers plugins, which provides a mechanism for the kubelet to dynamically authenticate and pull images for arbitrary container registries - whether these are public registries, managed services, or even a self-hosted registry. In Kubernetes v1.26, this feature is now GA Figure 2: Kubelet credential provider overview Why is it important? Prior to Kubernetes v1.20, if you wanted to dynamically fetch credentials for image registries other than ACR (Azure Container Registry), ECR (Elastic Container Registry), or GCR (Google Container Registry), you needed to modify the kubelet code. The new plugin mechanism can be used in any cluster, and lets you authenticate to new registries without any changes to Kubernetes itself. Any cloud provider or vendor can publish a plugin that lets you authenticate with their image registry. How it works The kubelet and the exec plugin binary communicate through stdio (stdin, stdout, and stderr) by sending and receiving json-serialized api-versioned types. If the exec plugin is enabled and the kubelet requires authentication information for an image that matches against a plugin, the kubelet will execute the plugin binary, passing the CredentialProviderRequest API via stdin. Then the exec plugin communicates with the container registry to dynamically fetch the credentials and returns the credentials in an encoded response of the CredentialProviderResponse API to the kubelet via stdout. Figure 3: Kubelet credential provider plugin flow On receiving credentials from the kubelet, the plugin can also indicate how long credentials can be cached for, to prevent unnecessary execution of the plugin by the kubelet for subsequent image pull requests to the same registry. In cases where the cache duration is not specified by the plugin, a default cache duration can be specified by the kubelet (more details below). { "apiVersion" : "kubelet.k8s.io/v1" , "kind" : "CredentialProviderResponse" , "auth" : { "cacheDuration" : "6h" , "private-registry.io/my-app" : { "username" : "exampleuser" , "password" : "token12345" } } } In addition, the plugin can specify the scope in which cached credentials are valid for. This is specified through the cacheKeyType field in CredentialProviderResponse . When the value is Image , the kubelet will only use cached credentials for future image pulls that exactly match the image of the first request. When the value is Registry , the kubelet will use cached credentials for any subsequent image pulls destined for the same registry host but using different paths (for example, gcr.io/foo/bar and gcr.io/bar/foo refer to different images from the same registry). Lastly, when the value is Global , the kubelet will use returned credentials for all images that match against the plugin, including images that can map to different registry hosts (for example, gcr.io vs k8s.gcr.io). The cacheKeyType field is required by plugin implementations. { "apiVersion" : "kubelet.k8s.io/v1" , "kind" : "CredentialProviderResponse" , "auth" : { "cacheKeyType" : "Registry" , "private-registry.io/my-app" : { "username" : "exampleuser" , "password" : "token12345" } } } Using kubelet credential providers You can configure credential providers by installing the exec plugin(s) into a local directory accessible by the kubelet on every node. Then you set two command line arguments for the kubelet: --image-credential-provider-config : the path to the credential provider plugin config file. --image-credential-provider-bin-dir : the path to the directory where credential provider plugin binaries are located. The configuration file passed into --image-credential-provider-config is read by the kubelet to determine which exec plugins should be invoked for a container image used by a Pod. Note that the name of each provider must match the name of the binary located in the local directory specified in --image-credential-provider-bin-dir , otherwise the kubelet cannot locate the path of the plugin to invoke. kind : CredentialProviderConfig apiVersion : kubelet.config.k8s.io/v1 providers : - name : auth-provider-gcp apiVersion : credentialprovider.kubelet.k8s.io/v1 matchImages : - "container.cloud.google.com" - "gcr.io" - "*.gcr.io" - "*.pkg.dev" args : - get-credentials - --v=3 defaultCacheDuration : 1m Below is an overview of how the Kubernetes project is using kubelet credential providers for end-to-end testing. Figure 4: Kubelet credential provider configuration used for Kubernetes e2e testing For more configuration details, see Kubelet Credential Providers . Getting Involved Come join SIG Node if you want to report bugs or have feature requests for the Kubelet Credential Provider. You can reach us through the following ways: Slack: #sig-node Mailing list Open Community Issues/PRs Biweekly meetings

I'm staying safe with the Emergency app, why don't you too?

Staff at The Guardian newspaper have been told not to come into the office and to work from home for the rest of the week due to a suspected ransomware attack which struck late on Tuesday.

PostgreSQL database locks usually work seamlessly until they don't. Before your Rails app dataset and traffic reach a certain scale, you're unlikely to face any locks-related issues. But if your app suddenly slows down to a crawl, deadlocks likely are to blame. In this blog post, I'll describe how to monitor database locks and propose best practices to prevent them from causing issues.

CNBC's Michael Wayland recently tested "hands-free" systems from Tesla, GM and Ford. Theirs are among the most readily available and dynamic on the market.

Satya Nadella keeps thinking bigger. Microsoft’s chief executive has been buying new businesses at an impressive clip. Look for him to add Netflix to the list in 2023.

A new set of patches posted for the Plan 9 (9p) resource sharing protocol code inside the Linux kernel can deliver roughly 10x better performance for file transfers.

Internal documents show Twitter whitelisted CENTCOM accounts that were then used to run its online influence campaign abroad.

The review requirement reflects Beijing’s efforts to tighten cross-border data flows and safeguard what it considers as sensitive information.

In a 'confidential' email notification sent by Okta and seen by BleepingComputer, the company states that attackers gained access to its GitHub repositories this month and stole the company's source code.

I was curious about how Mastodon is actually implemented. A high-level overview: * Web app is written in Ruby on Rails * Persistence layer is PostgreSQL * File storage/mailer is S3/SMTP agnostic * Redis for precomputed social feed cache and worker queue * Sidekiq for background processing * A node handler for streaming (notifications, new posts, etc.) Looking at the code, it's definitely an interesting look into the early 2010s style of development. There's nothing wrong with it, and in

AWS now runs online services for the Ukrainian government.

The Gorilla Web Toolkit, a popular, open source Go toolkit for web-based applications, is being archived at the end of this year.

Virtual Event - Join our charity event to support the people of Ukraine on the 16th of March 2023. This half-day, virtual event will be full of national and international talks.

Hachyderm has experienced a minor unplanned degradation in our service. Here is the postmortem, analysis, and writeup on the incident.

Welcome to the v1.6.14 release of containerd! The fourteenth patch release for containerd 1.6 fixes a regression in the CRI plugin related to swap Notable Updates Fix memory.memsw.limit_in_bytes: ...