Readit News logoReadit News
jonenst commented on What would a Kubernetes 2.0 look like   matduggan.com/what-would-... · Posted by u/Bogdanp
jakewins · 2 months ago
After you’ve run kubectl run, and it’s created the pod resource for you, what are you imagining will happen without the reconciliation system?

You can invent a new resource type that spawns raw processes if you like, and then use k8s without pods or nodes, but if you take away the reconciliation system then k8s is just an idle etcd instance

jonenst · 2 months ago
Since they had the reconciliation system because they decided the main use case was declarative, it makes sense that they used it to implement kubectl run. But they could have done it differently.

Imagine if pods couldn't reach other and you had to specify all networks and networking rules.

Or imagine that once you created a container you had to manually schedule it on a node. And when the node or pod crashes you have to manually schedule it somewhere else.

jonenst commented on What would a Kubernetes 2.0 look like   matduggan.com/what-would-... · Posted by u/Bogdanp
jakewins · 2 months ago
The core idea isn’t pods. The core idea is reconciliation loops: you have some desired state - a picture of how you’d like a resource to look or be - and little controller loops that indefinitely compare that to the world, and update the world.

Much of the complexity then comes from the enormous amount of resource types - including all the custom ones. But the basic idea is really pretty small.

I find terraform much more confusing - there’s a spec, and the real world.. and then an opaque blob of something I don’t understand that terraform sticks in S3 or your file system and then.. presumably something similar to a one-shot reconciler that wires that all together each time you plan and apply?

jonenst · 2 months ago
To me the core of k8s is pod scheduling on nodes, networking ingress (e.g. nodeport service), networking between pods (everything addressable directly), and colocated containers inside pods.

Declarative reconciliation is (very) nice but not irreplaceable (and actually not mandatory, e.g. kubectl run xyz)

jonenst commented on What would a Kubernetes 2.0 look like   matduggan.com/what-would-... · Posted by u/Bogdanp
jonenst · 2 months ago
What about kustomize and kpt ? I'm using them (instead of helm) but but:

* kpt is still not 1.0

* both kustomize and kpt require complex setups to programatically generate configs (even for simple things like replicas = replicasx2)

jonenst commented on The Pain That Is GitHub Actions   feldera.com/blog/the-pain... · Posted by u/qianli_cs
jonenst · 5 months ago
I'm surprised the author doesn't mention environment secrets, which I think currently are the only way to avoid that anyone with push access to any repo also gets full access to all secrets (by pushing a new workflow file and triggering it). This makes org and repo secrets practically useless for any team where only admins or maintainers should have access to secrets.
jonenst commented on Tj-actions/changed-files GitHub Action Compromised – used by over 23K repos   stepsecurity.io/blog/hard... · Posted by u/varunsharma07
diggan · 5 months ago
> 6. Some people had automerging of such updates enabled, but this is not Renovate's default behavior. Even without automerging, an action like this might be able to achieve its aim only with a PR, if it's run as part of PR builds

I'm not sure how this could exploited by just making a PR, unless you for some reason have secrets enabled for builds by unknown contributors, which obviously would be a mistake. Usually, only builds using secrets only run on certain branches which has a known contributor approving the code before it gets there.

> people mistakenly assume that git tags are immutable

If you're distributing a library on GitHub used by many other people/projects, then you really need to setup `protected branches` and `protected tags`, where you can prevent changes somewhat.

jonenst · 5 months ago
Neither Branch Protection nor the newer Rulesets allow to protect secrets from someone with push acces to the repo. From what I understand, only environment secrets provide this feature (and have the drawback that you can't share them among multiple repos in the same org without copying them everywhere, although you can script the copying with the github api)
jonenst commented on Factorio: Space Age Is Out   factorio.com/buy-space-ag... · Posted by u/Lwrless
jonenst · 10 months ago
The factory must grow, to infinity and beyond !
jonenst commented on We lost 54k GitHub stars   httpie.io/blog/stardust... · Posted by u/todsacerdoti
jonenst · 3 years ago
I would have had more sympathy for the author if they explained why they care so much about github stars. It's just internet points after all. At the very end, they say "What started as a side project has recently become a company" so if it's all about business, maybe they could have made that more prominent. EDIT: sorry, not meant to be harsh. Hopefully you get what you want and thank you for writing open source software
jonenst commented on Solar Power/Batteries are 60% of planned new U.S. electric generation capacity   eia.gov/todayinenergy/det... · Posted by u/belter
jonenst · 3 years ago
Where are all these batteries and solar panels made ? How much GHG was emitted to build them, and how much GHG is expected to be saved by choosing this kind of electrical grid instead of alternatives ?
jonenst commented on Map of Surnames in Europe   surnamemap.eu/... · Posted by u/Nitrolo
jonenst · 3 years ago
This website is overloaded with adds. It almost feels like a scam. Based on the fact that almost all other comments are not talking about it, I guess at least one of the following hypotheses is true (if not all of them): - most people here use an efficient addblocker - The website changed since its first appearance on the first page (maximize revenue?) - some comments are sponsored - on mobile it feels overwhelming but on desktops it's more bearable

u/jonenst

KarmaCake day78July 6, 2012
About
[ my public key: https://keybase.io/jonenst; my proof: https://keybase.io/jonenst/sigs/2dOVlbcPWi0HNvYTX_sxKrmFDW5KC8Io95poar3CKrc ]
View Original