An Alternate Approach to etcd Certificate Generation with Kubeadm

I’ve written a fair amount about kubeadm, which was my preferred way of bootstrapping Kubernetes clusters until Cluster API arrived. Along the way, I’ve also discussed using kubeadm to assist with setting up etcd, the distributed key-value store leveraged by the Kubernetes control plane (see here, here, and here). In this post, I’d like to revisit the topic of using kubeadm to set up an etcd cluster once again, this time taking a look at an alternate approach to generating the necessary TLS certificates than what the official documentation describes.

There is absolutely nothing wrong with the process the official documentation describes (I’m referring to this page, by the way); this process just creates slightly “cleaner” certificates. What do I mean by “cleaner” certificates? The official documentation uses a series of kubeadm configuration files, one for each etcd cluster member, to control how the utility creates the necessary certificates and configuration files. The user is instructed to use these configuration files on a single system to generate the certificates for all the cluster members. This works fine, with one caveat: each of the certificates will have an extra hostname—the hostname of the system being used Continue reading

Juniper software triggers network response to threats

Juniper Networks continues to grow its enterprise cloud-security family with a new product that promises to protect application workloads in any cloud or on-premises environment.The company rolled out Juniper Cloud Workload Protection package--a  lightweight software agent that the company says controls application execution and monitors application behavior to help businesses spot and fix anomalies.Backup lessons from a cloud-storage disaster The idea is to provide protection from attackers looking to exploit application vulnerabilities, said Kate Adam, senior director of security product marketing for Juniper Networks. To read this article in full, please click here

Juniper software triggers network response to threats

Juniper Networks continues to grow its enterprise cloud-security family with a new product that promises to protect application workloads in any cloud or on-premises environment.The company rolled out Juniper Cloud Workload Protection package--a  lightweight software agent that the company says controls application execution and monitors application behavior to help businesses spot and fix anomalies.Backup lessons from a cloud-storage disaster The idea is to provide protection from attackers looking to exploit application vulnerabilities, said Kate Adam, senior director of security product marketing for Juniper Networks. To read this article in full, please click here

Ampere Computing Buys An AI Inference Performance Leap

Machine learning inference models have been running on X86 server processors from the very beginning of the latest – and by far the most successful – AI revolution, and the techies that know both hardware and software down to the minutest detail at the hyperscalers, cloud builders, and semiconductor manufacturers have been able to tune the software, jack the hardware, and retune for more than a decade. …

Ampere Computing Buys An AI Inference Performance Leap was written by Timothy Prickett Morgan at The Next Platform.

Audit your VMware vCenter Server using Ansible

vCenter has a graphical user interface if you want to interact with it, but what if you manage multiple vCenter servers and want to automate audits or the maintenance of those servers? In this blog, we will see how we can retrieve details about the VMware vCenter Server directly using Ansible. The practices laid out in the blog will help system administrators responsible for managing multiple vCenter servers. In addition, Ansible automation becomes imperative in development environments for testing against multiple instances in your CI/CD pipeline. 

The new vmware.vmware_rest Collection has recently been released and published, and it comes with a new set of modules dedicated to vCenter Server (VCSA) management.

VMware vSphere (Product bundle that includes vCenter Server and other features) 7.0.2 (a.k.a 7.0U2) comes with some new REST end-points. This REST API does not cover all the features exposed over the SOAP interface. Modules in the vmware.vmware_rest Collection are built on top of this API and face the same limitations.

The vmware.vmware_rest Collection contains these modules, which is supported by Red Hat and available on Ansible automation hub.

 

Validate the state of a vCenter Server instance from Ansible

Continue reading

Durable Objects: Easy, Fast, Correct — Choose three

Durable Objects: Easy, Fast, Correct — Choose three
Durable Objects: Easy, Fast, Correct — Choose three

Storage in distributed systems is surprisingly hard to get right. Distributed databases and consensus are well-known to be extremely hard to build. But, application code isn't necessarily easy either. There are many ways in which apps that use databases can have subtle timing bugs that could result in inconsistent results, or even data loss. Worse, these problems can be very hard to test for, as they'll often manifest only under heavy load, or only after a sudden machine failure.

Up until recently, Durable Objects were no exception. A Durable Object is a special kind of Cloudflare Worker that has access to persistent storage and processes requests in one of Cloudflare’s points of presence. Each Object has its own private storage, accessible through a classical key/value storage API. Like any classical database API, this storage API had to be used carefully to avoid possible race conditions and data loss, especially when performance mattered. And like any classical database API, many apps got it wrong.

However, rather than fix the apps, we decided to fix the model. Last month, we rolled out deep changes to the Durable Objects runtime such that many applications which previously contained subtle race conditions are now correct Continue reading

Computational storage startup Pliops launches flagship product

A startup called Pliops has emerged from stealth mode with a new way to do data processing. Rather than load data into main memory as is traditionally done, the Pliops technology offloads data and the application to a PCI Express card, and data is processed where it is stored, thus freeing up the CPU for other tasks.It's called computational storage. The concept has been around for a while, but like so many technological ideas, it was ahead of its time. The technology needed to catch up to the concept. It could never be done with mechanical hard drives, and SSDs, too, needed to make gains. Recently, Samsung and Xilinx partnered to deliver a compute-on-storage SSD device that uses a Xilinx FPGA to offload the processing work.To read this article in full, please click here

Computational storage startup Pliops launches flagship product

A startup called Pliops has emerged from stealth mode with a new way to do data processing. Rather than load data into main memory as is traditionally done, the Pliops technology offloads data and the application to a PCI Express card, and data is processed where it is stored, thus freeing up the CPU for other tasks.It's called computational storage. The concept has been around for a while, but like so many technological ideas, it was ahead of its time. The technology needed to catch up to the concept. It could never be done with mechanical hard drives, and SSDs, too, needed to make gains. Recently, Samsung and Xilinx partnered to deliver a compute-on-storage SSD device that uses a Xilinx FPGA to offload the processing work.To read this article in full, please click here

Segment Routing | Control and Data plane review

Hi all!

Today I’m going to talk about Segment Routing, especially SR-MPLS. Exactly the best source of theoretical information is RFC. But Segment Routing is a huge topic and it's difficult to sort things out. I will provide basic concepts of SR-MPLS and we will go through basic control plane and data plane tasks of SR.

A good network engineer always tries to optimize network, operation tools and workflow. And I’m sure, engineers who develop Segment Routing concepts follow the same idea.


Why do I think so? Look SR-MPLS short facts:

  1. SR is an alternative of main label distribution protocols - LDP and RSVP.

  2. SR decreases control plane entities because it’s a part of IGP protocols (IS-IS or OSPF)

  3. SR uses stateless paradigm unlike RSVP (It helps to reduce CPU consumption)


Let’s investigate basic SR concepts.

Segment and routing. Take the first definition. What is a "segment"? What types of segments do we have? 


Segments are instructions. Head-end encodes these instructions into MPLS headers. It's an interesting concept. We can steer traffic flow by data plane units that contain a stack of MPLS labels - stack of instructions. It helps to eliminate states for every MPLS LSP on Continue reading

Network Break 344: Zoom Expands Into Contact Center Biz; Will Devs Choose Cloudflare’s Green Compute?

Zoom buys its way into the contact center biz with the $14.7 billion purchase of Five9, Extreme announces Wi-Fi 6E APs, Cloudflare debuts Green Compute for scheduled workloads, and IT vendors report strong quarterly financial results. We analyze these stories and more IT news on today's Network Break podcast.

The post Network Break 344: Zoom Expands Into Contact Center Biz; Will Devs Choose Cloudflare’s Green Compute? appeared first on Packet Pushers.

The many faces of awk

If you only use awk when you need to select specific fields from lines of text, you might be missing out on a lot of other services that the command can provide. In this post, we'll look at this simple use along with many other things that awk can do for you with enough examples to show you that the command is a lot more flexible than you might have imagined.Plucking out columns of data The easiest and most commonly used service that awk provides is selecting specific fields from files or from data that is piped to it. With the default of using white space as a field separator, this is very simple:To read this article in full, please click here

Linkerd Graduates CNCF with Focus on Simplicity

The number of requirements around stability, adoption, maturity, and governance, and joins more than a dozen other graduated projects, such as Helm, Prometheus, Envoy, and Kubernetes. In a press release regarding Linkerd’s graduation, H-E-B is quoted as saying that they didn’t “choose a service mesh based on hype,” and that they “weren’t worried about which mesh had the most marketing behind it.” The service mesh being alluded to here is Istio, which, in the most recent William Morgan. “And the fact that it has attained graduation, that it has this community of enthusiastic and committed adopters, I think it’s pretty remarkable given that context. It’s hard not to talk about Linkerd without also talking about Istio, although I think the reality is, there’s some pretty fundamental philosophical differences between those projects.” Linkerd was created by Buoyant in 2016, and Morgan said its first iterations were rather complex before the project found its focus on simplicity. This simplicity, which starts with Linkerd using Envoy, is a key differentiator for the service mesh, and one of the fundamental philosophical differences Morgan speaks of. “Naturally, as engineers, what you want to do when you’re building infrastructure is, you want to solve every possible problem with this beautiful platform that can do all things for all people,” Morgan said. “I think when you go down that path, which feels very natural to an engineer, you end up with something that is really unwieldy, and that’s complex, and that is fundamentally unsatisfying. It sounds great, but it’s so hard to operate that you never accomplish your goals.” Part of the balancing act, said Morgan, is to deliver all the features of the service mesh around reliability, security, and observability, “without getting mired in all the complexity, without having to hire a team of developers or a team of engineers, service mesh experts, just to run your service mesh.” In the past year, Linkerd has seen a 300% increase in downloads, and part of that acceleration may be attributed to a migration away from Istio due to its complexity. Rather than focusing on moving away from Istio, which he says some users may end up using simply because they see it first, Morgan again focuses on Linkerd’s simplicity as the reason behind its increased adoption. “In the absence of having these marketing bullhorns, these huge marketing budgets, the way that Linkerd has grown has been by word of mouth,” said Morgan. “It’s been like the way that open source projects used to grow. The way that we’ve been able to accomplish that is by having a really clear vision and a really clear message around simplicity.” Another key architectural decision made around simplicity was that Linkerd was made to focus on Kubernetes. An earlier version, said Morgan, was made to work with Mesos, Zookeeper, Kubernetes and others, and they instead decided that they had to go with the “lowest common denominator,” which was Kubernetes. Linkerd’s decision to go with the Rust programming language, rather than Go, C, or C++, was another distinction for the service mesh in its evolution, and one Morgan stands behind. “It was a scary choice, but we did that because we felt that the future of the service mesh, and in fact the future of all cloud native technology, really has to be built in Rust,” he said. “There’s no reason for us, in 2021, to ever write code in C++ or in C anymore. That was a pretty scary, risky, controversial decision at the time, but it’s paid off because now we have the adoption to kind of show it off.” While Morgan calls the project’s CNCF graduation “a nice moment for us to reflect and to be grateful for all the people around the world who worked so hard to get Linkerd to this point,” he says that there is a long roadmap ahead, which includes things like server and client-side policies, and “mesh expansion” to allow the Linkerd data plane to operate outside of Kubernetes. But when your focus is on simplicity, where do you draw the line on additional features? Morgan said that, as a project designer, you have to ask yourself some questions. “What is the maximum number of those problems that I can solve, and then the rest, we’re just not going to solve? Like, that’s the stopping point,” said Morgan. “There are going to be use cases that Linkerd is just not going to solve, and that’s okay. For those folks, I do actually sometimes tell people to use Istio. There’s a set of things that Istio can do, super complicated situations, where I just don’t want Linkerd to be able to solve that because it would be too complicated.” The post Linkerd Graduates CNCF with Focus on Simplicity appeared first on The New Stack.

It Always Takes Too Long

It always takes longer to find a problem than it should. Moving through the troubleshooting process often feels like swimming in molasses—it’s never fast enough or far enough to get the application back up and running before that crucial deadline. The “swimming in molasses effect” doesn’t end when the problem is found out, either—repairing the problem requires juggling a thousand variables, most of which are unknown, combined with the wit and sagacity of a soothsayer to work with vendors, code releases, and unintended consequences.

It’s enough to make a network engineer want to find a mountain top and assume an all-knowing pose—even if they don’t know anything at all.
The problem of taking longer, though, applies in every area of computer networking. It takes too long for the packet to get there, it takes to long for the routing protocol to converge, it takes too long to support a new application or server. It takes so long to create and validate a network design change that the hardware, software and processes created are obsolete before they are used.

Why does it always take too long? A short story often told to me by my Grandfather—a farmer—might help.

One morning a Continue reading

Evolution of search engines architecture – Algolia New Search Architecture Part 1

 

What would a totally new search engine architecture look like? Who better than Julien Lemoine, Co-founder & CTO of Algolia, to describe what the future of search will look like. This is the first article in a series.


Search engines, and more generally, information retrieval systems, play a central role in almost all of today’s technical stacks. Information retrieval started in the beginning of computer science. Research accelerated in the early 90s with the introduction of the Text REtrieval Conference (TREC). After more than 30 years of evolution since TREC, search engines continue to grow and evolve, leading to new challenges.

In this article, we look at some key milestones in the evolution of search engine architecture. We also describe the challenges those architectures face today. As you’ll see, we grouped the engines into four architecture categories. This is a simplification, as there are in reality a lot of different engines with various mix of architectures. We did this to focus our attention on the most important characteristics of those architectures.

1. The Inverted Index —  the early days of search

1 … 633 634 635 636 637 … 3,787