Building Your First Certified Kubernetes Cluster On-Premises, Part 1

This is the first in a series of guest blog posts by Docker Captain Ajeet Raina diving in to how to run Kubernetes on Docker Enterprise. You can follow Ajeet on Twitter @ajeetsraina and read his blog at http://www.collabnix.com. 

There are now a number of options for running certified Kubernetes in the cloud. But let’s say you’re looking to adopt and operationalize Kubernetes for production workloads on-premises. What then? For an on-premises certified Kubernetes distribution, you need an enterprise container platform that allows you to leverage your existing team and processes. 

Enter Docker Kubernetes Service

At DockerCon 2019, Docker announced the Docker Kubernetes Service (DKS). It is a certified Kubernetes distribution that is included with Docker Enterprise 3.0 and is designed to solve this fundamental challenge.

In this blog series, I’ll explain Kubernetes support and capabilities under Docker Enterprise 3.0, covering these topics:

1. Deploying certified Kubernetes Cluster using Docker Enterprise 3.0 running on a Bare Metal System
2. Support of Kubernetes on Windows Server 2019 with Docker Enterprise 3.0
3. Implementing Persistent storage for Kubernetes workload using iSCSI
4. Implementing Cluster Ingress for Kubernetes
5. Deploying Istio Service Mesh under Docker Enterprise 3.0

So About Continue reading

¡Bienvenidos a Latinflare!

Our Story

When I first began interviewing with Cloudflare in the Spring of 2019, I came across a Cloudflare blog post announcing Proudflare, the company’s LGBTQIA+ Employee Resource Group (ERG). The post gave me a clear sense of the company’s commitment to diversity and inclusion. I could tell this was a place that values and celebrates diversity, which really appealed to me as I progressed through the interview process with Cloudflare, and ultimately accepted the role.

Fast forward to my Cloudflare new hire orientation, two weeks of training and introductions at our San Francisco HQ. We learned about the various ERGs at Cloudflare including one for Latinx employees. While I had a strong desire to be part of a Latinx ERG, it was clear that the group was actually in need of someone to lead the effort and rally the troops. At Cloudflare, we have offices across the country and around the world. I wasn’t really sure how to launch an ERG that would be global in scope. After meeting with leads from other Cloudflare ERGs, understanding the landscape, and attending an external workshop, everything started to come together.

In early August, we officially gave ourselves Continue reading

How the Linux screen tool can save your tasks – and your sanity – if SSH is interrupted

If you’ve ever had to restart a time-consuming process because your SSH session was disconnected, you might be very happy to learn about an interesting tool that you can use to avoid this problem – the screen tool.Screen, which is a terminal multiplexor, allows you to run many terminal sessions within a single ssh session, detaching from them and reattaching them as needed. The process for doing this is surprising simple and involves only a handful of commands. [ Two-Minute Linux Tips: Learn how to master a host of Linux commands in these 2-minute video tutorials ] To start a screen session, you simply type screen within your ssh session. You then start your long-running process, type Ctrl+A Ctrl+D to detach from the session and screen -r to reattach when the time is right.To read this article in full, please click here

How the Linux screen tool can save your tasks — and your sanity — if SSH is interrupted

If you’ve ever had to restart a time-consuming process because your SSH session was disconnected, you might be very happy to learn about an interesting tool that you can use to avoid this problem — the screen tool.Screen, which is a terminal multiplexor, allows you to run many terminal sessions within a single ssh session, detaching from them and reattaching them as needed. The process for doing this is surprising simple and involves only a handful of commands. [ Two-Minute Linux Tips: Learn how to master a host of Linux commands in these 2-minute video tutorials ] To start a screen session, you simply type screen within your ssh session. You then start your long-running process, type Ctrl+A Ctrl+D to detach from the session and screen -r to reattach when the time is right.To read this article in full, please click here

The Week in Internet News: The New Internet Space Race

Broadband in space: The Associated Press, via the New York Post, has a story on the new space race involving Amazon, SpaceX, and other companies. The competition is to be first to deploy new satellite networks to provide broadband service to all corners of the Earth. Still, there are some questions about these low-Earth orbit satellites, with the multi-billion-dollar cost of deployment being the biggest concern.

Secure by algorithm: Researchers at Princeton University have developed algorithms that they say can prevent hacker attacks on power grids, DownToEarth reports. The new algorithms target power spikes that could be driven by IoT-based attacks. One algorithm would prevent connections overloading by balancing power, and the other would help grids restore their functionality after an attack.

Please help: A column at ZDNet asks network operators to using existing tools to fix security problems with the Border Gateway Protocol, which routers use to tell each other the best way to route traffic. The BGP standard includes Route Origin Authorizations (ROAs) to confirm the accuracy of routing messages, but those tools aren’t as widely deployed as they could be, the column suggests.

Lost jobs: A nearly two-month Internet shutdown in the India-controlled Kashmir region Continue reading

Junos Primary and Preferred Interface Commands

This blog post was spurred on by a recent real-world experience where I had to configure a primary IP address …

Continue reading →

The post Junos Primary and Preferred Interface Commands appeared first on Fryguy's Blog.

Recommended Networking Resources for September 2019 Third Week

There are so many good resources for Network Engineers out there. I started to share the ones I liked on beginning of this month. Click here to see previous Networking Recommended Resources. As you know, I share 5 resource every week. There are so many in my list already, I can’t wait for the next …

Continue reading "Recommended Networking Resources for September 2019 Third Week"

The post Recommended Networking Resources for September 2019 Third Week appeared first on Cisco Network Design and Architecture | CCDE Bootcamp | orhanergun.net.

Networking in Public Clouds – New ipSpace.net Online Course

I have exciting news I’d love to share with you: we’re launching a new online course focused on networking in public clouds starting in February 2020 (I’ve been mulling over this idea and polishing the concept for almost 18 months, and finally it all came together ;)

With Go To The Cloud becoming the answer to all questions (regardless of what the question is), you can find tons of materials describing various aspects of public clouds, so you might wonder why I decided to enter the fray. The answer is simple: with everyone being focused on developers, there’s not much that an infrastructure engineer could use to help him survive when the developers move on and he’s left to manage whatever they put in place.

Small world with high risks: a study of security threats in the npm ecosystem

Small world with high risks: a study of security threats in the npm ecosystem Zimmermann et al., USENIX Security Symposium 2019

This is a fascinating study of the npm ecosystem, looking at the graph of maintainers and packages and its evolution over time. It’s packed with some great data, and also helps us quantify something we’ve probably all had an intuition for— the high risks involved in depending on a open and fast-moving ecosystem. One the key takeaways for me is the concentration of reach in a comparatively small number of packages and maintainers, making these both very high value targets (event-stream, it turns out, wouldn’t even have made the top-1000 in a list of ranked targets!), but also high leverage points for defence. We have to couple this of course with an exceedingly long tail.

The npm ecosystem

As the primary source of third-party JavaScript packages for the client-side, server-side, and other platforms, npm is the centrerpiece of a large and important software ecosystem.

Npm is an open ecosystem hosting a collection of over 800,000 packages as of February 2019, and it continues to grow rapidly.

To share a package on npm, a maintainer creates Continue reading

Serverless Security Threats Loom as Enterprises Go Cloud Native

Worth Reading: Koding Academies

Every few weeks I stumble upon an article (or twitter storm) in which someone claims you don’t need formal education to get started as a Software Engineer (or whatever else) - all you need is a coding academy/bootcamp and you're all set.

George V. Neville-Neil wrote a hilarious rebuttal of this idea followed by some pretty good advice. Hope you’ll enjoy it as much as I did ;)

Run a script on virtual machines when the host is shut down

I want to show you how to configure a host server so, when it is shut down, it executes a script that runs commands on any running virtual machines before the host tries to stop them. I will configure the host server to wait until the script completes configuring the virtual machines before continuing with the shutdown process, shutting down the virtual machines, and eventually powering off.

I had to learn how Systemd service unit configuration files work and some more details about how Libvirt is configured in different Linux distributions. Read on to see the solution, plus some details about how to test the solution in Ubuntu and CentOS.

Solution Summary

Create a new Systemd service named graceful-shutdown that runs a script when the host system shuts down, but before Libvirt shuts down any virtual machines. Ensure that the libvirt-guests service is already started and enabled, and is configured appropriately.

The graceful-shutdown.service unit configuration file

Create a new Systemd unit configuration file named graceful-shutdown.service and save it in the directory, /etc/systemd/system, where it is advised you put custom configuration files.

For example:

# vi /etc/systemd/system/graceful-shutdown.service

Enter the following text into the file, then save it:

 Continue reading

Cloudflare’s protection against a new Remote Code Execution vulnerability (CVE-2019-16759) in vBulletin

Cloudflare has released a new rule as part of its Cloudflare Specials Rulesets, to protect our customers against a high-severity vulnerability in vBulletin.  

A new zero-day vulnerability was discovered for vBulletin, a proprietary Internet forum software. By exploiting this vulnerability, bad actors could potentially gain privileged access and control to the host servers on which this software runs, through Remote Code Execution (RCE).

Implications of this vulnerability

At Cloudflare, we use three key indicators to understand the severity of a vulnerability 1) how many customers on Cloudflare are running the affected software 2) the Common Vulnerability Scoring System (CVSS) score, and 3) the OWASP Top 10, an open-source security framework.

We assess this vulnerability to be very significant as it has a CVSS score of 9.8/10 and affects 7 out of the 10 key risk areas of the OWASP 2017 Top 10.

Remote Code Execution is considered a type of injection, which provides the capability to potentially launch a catastrophic attack. Through RCE an attacker can gain privileged access to the host server that might be running the unpatched and vulnerable version of this software. With elevated privileges the attacker could perform malicious activities including discovery of additional Continue reading

Qualcomm Paints Strategic Contrasts in Cloud, AI, Edge

Worth Reading: SDN Ate My Hamster

A long while ago Daniel Dib wrote a nice blog post on “SDN will make the networking engineers obsolete” theme. While it sounds like beating a dead horse, the SDN craze isn’t subsiding, so another healthy dose of common sense might come handy.

Hint: if you’re not following Daniel’s blog, you should… even though he decided to make old farts’ life harder by publishing on LinkedIn.

Heavy Networking 474: Find Breaches With Continuous Monitoring From Open Systems (Sponsored)

On today's Heavy Networking, sponsor Open Systems joins us to talk about its continuous security monitoring capabilities that help customers find breaches quickly. Our guest is Dave Martin, Senior Director for Product Management of Threat Response at Open Systems.

The post Heavy Networking 474: Find Breaches With Continuous Monitoring From Open Systems (Sponsored) appeared first on Packet Pushers.

Cumulus Co-Founder JR Rivers Joins Amazon

Birthday Week 2019 Wrap-up

This week we celebrated Cloudflare’s 9th birthday by launching a variety of new offerings that support our mission: to help build a better Internet.  Below is a summary recap of how we celebrated Birthday Week 2019.

Cleaning up bad bots

Every day Cloudflare protects over 20 million Internet properties from malicious bots, and this week you were invited to join in the fight!  Now you can enable “bot fight mode” in the Firewall settings of the Cloudflare Dashboard and we’ll start deploying CPU intensive code to traffic originating from malicious bots.  This wastes the bots’ CPU resources and makes it more difficult and costly for perpetrators to deploy malicious bots at scale. We’ll also share the IP addresses of malicious bot traffic with our Bandwidth Alliance partners, who can help kick malicious bots offline. Join us in the battle against bad bots – and, as you can read here – you can help the climate too!

Browser Insights

Speed matters, and if you manage a website or app, you want to make sure that you’re delivering a high performing website to all of your global end users. Now you can enable Browser Insights in the Speed section of the Continue reading

Tutorial: Explore Project Calico Network Policies with Google Kubernetes Engine

Virtual networking softwareKubernetes open source container orchestration software. While Kubernetes has extensive support for Role-Based Access Control (RBAC), the default networking stack based on Google Kubernetes Engine (GKE). Unlike other managed Kubernetes services, GKE comes with an integrated Calico stack that can be enabled during the cluster creation. It is also possible to configure Calico on an existing, running GKE cluster. Start by launching a standard GKE cluster with network policies enabled. This can be done by clicking the Enable network policy checkbox available under Availability, networking, security, and additional features section. After the cluster is up and running, we can check for Calico Pods deployed as a part of Daemonset in the kube-system namespace. Let’s download the calicoctl, Calico’s CLI to explore the environment further. We need to point calicoctl to etcd endpoints of GKE cluster. This can be done with the below settings: Now, let’s go ahead and deploy one of the samples provided by Project Calico. Run the below commands to deploy the application. You can download the YAML files from Project Calico’s http://mi2.live. The post Tutorial: Explore Project Calico Network Policies with Google Kubernetes Engine appeared first on The New Stack.

AT&T Lobs White Box Router Design at OCP