krullie

How does it compare to Hydra/Dex? What I'm missing is a page that tells me where it sits in the ecosystem. A versus page if you will.

It's been crashing for me since the switch to wayland as a default. I don't mind really, this stuff needs to get adopted. I tend to use my keyboard way more than my tablet these days.

I've taken a real liking to Fedora. It actually made me switch from my custom Arch linux with i3 to almost default setup Fedora with Gnome. Worked flawlessly on my old Dell XPS 13 developers edition and my new one.

Sadly after the switch to Wayland my pen tablet doesn't get picked up by most applications I use daily including Chrome, Firefox, VSCode, Kritta, Blender, etc. It's a real shame as Gnome/Wayland handles switching the tablet between monitors and multimonitor setups really well! Running Gnome on Xorg also isn't an option, it tends to crash a lot now...

I do get 2 cursors though which is interesting.

I'm using it like that as well, It's a really nice experience once you convince all the applications using ssh to use the gpg-agent's socket.

Have you enabled any other yubikey features while having all you gpg + ssh keys on it? Like for using U2F? I'm a bit scared I'll wipe my key ('-_-).

I'd like to have these systems as decoupled as possible or at least have some meaningful information without a dependency on an external datastore. This might be just me being paranoid and overthinking it but after having to deal with a nasty monolith of an application for the last couple of years and finally convincing the rest that we need to change if we want to be able to expand I want to do it right.

The problem with that is that the originally uploaded filename is lost. At least without storing it in a separate database.

I could shorten the key by moving the sha512sum from the url to a CHECKSUM file.

org/file_uuid/original/original_filename.png CHECKSUM org/file_uuid/thumb/160x90.png 48x48.png org/file_uuid/poster/1k.png 2k.png org/file_uuid/other/

I don't have any other real use case for bucket per org other than easy bucket mirroring, backup and maybe migration from shared hosting to on premises.

I didn't think of using different prefixes for different media usages. We for example would then use thumbnail/originating_file_uuid.png and poster/originating_file_uuid.png.

How would you handle uploaded media then?

I've never really been able to figure out what a good strategy is for object storage organization. Do you create a bucket per application instance? user? organization?

Right now I'm playing with a new service and came up with this which is probably over engineerd:

Here is an actual object key including the bucket: 7dcdb229600e4467a2714866e0d406f6/85/26c/c0271374067b5db832adb7909a7/bbda55db15266f7ce2284d8f5f66fc85e495e2b12265ef87537237ad5e2658b24c081970332417f60e5fc352ae9b8c1031398c02ecde03eb29af2d3c8eda8a4b/y18.gif

Given the file's uuid is aabbbcccccccccccccccccccccccccccccc

for original images: {{organizations_uuid as bucket}}/aa/bbb/cccccccccccccccccccccccccccccc/{{sha512sum}}/{{originalfilename}}

And for all derivatives of it: {{organizations_uuid as bucket}}/aa/bbb/cccccccccccccccccccccccccccccc/derived/{{this files uuid}}_{{filename}}

My thinking was that:

- using the organizations' uuid (which can have multiple users) as a bucket makes backing up per organization and having on prem deployments easier.

- Encoding the file's uuid in the object name can identify it easily and by splitting that uuid up in 2/3/rest would help with spreading of objects.

- Encoding the file's sha512sum in the key name would enable checking that file's integrity even without a database.

- putting all derived files under derived but with the original file's uuid prefix makes the link between them clear.

I know this will result in long object names as shown above in the actual example but it does include quite some information. What parts of this is considered bad practice? Do you have any real world examples for other strategies? They seem hard to come by.

Thank you, I was wondering about the reason Istio was created. It also sheds some light as to why the CNCF brought on both Istio and Envoy. Still wondering why both Envoy and Linkerd are on their page as service mesh and not just one. They have one project for every other category.

Same here. I was sceptical about code generation and the whole protobuf as a base thing but i'm really liking it. Especially when you throw opentracing in the mix.

Yes definitely. Although you could build a new image based off of the original one, add a bash script that sets it all up for you and overwrite the entrypoint i never like that sollution. It should be something that the software supports out of the box as it plays into one of the strengths of docker, easily spinning up and taking down instances.

I've been jumping between hydra and dex for the last couple of weeks. On the one hand I like the tight focus hydra has, with the exception of the warden api. On the other hand it is really involved to simply setup a working environment that includes hydra ready to go. It would be nice to do all the token, client and policy setup using a simple docker-compose up.

Dex for example has a dev mode doing that for you. The downside of Dex is you cannot use your own backend without forking the project, writing your own login page and creating a custom connector for your existing login system.

I've deployed almost exactly this on a new kubernetes cluster running coreos exclusively with 4 nodes, 3 masters and 3 etcd instances divided over 4 physical machines.

Things I haven't implemented yet is deploying the node-exporters via DaemonSets and the Prometheus config through a ConfigMap. Those are right now done through a cloud-config systemd override and a gluster mount.

Couple of things I ran into. The kubelet's running the kubernetes master components need access to the ssl certificates of the apiserver, otherwise they cannot be scraped by prometheus over https when they communicate with the apiserver over https. And I'm still very confused about a seemingly simple thing of getting a per request response time query. This is what I'm using now:

`irate(request_processing_seconds_sum{app="myapp", method=~"$method"}[5m]) / irate(request_processing_seconds_count{app="myapp", method=~"$method"}[5m])`

Two things: I'm confused by what I should set the vector time to `[5m]`. And how I can get the response time of an individual request. We've had a request take 30 seconds but that spike only showed up when viewing the graph over a 3 hour time period. When viewing it over 6 hours or 1 hour it simply will not show up even though it happend in the last hour.

Things I do really love is the ability of configuring services to be scraped by setting annotations to it. Works great when slowly transitioning your services to prometheus style metrics!

If any body has some pointers about querying and visualizing using grafana and prometheus that would be great!

Thanks theoh. Dutchie here. Always nice to learn something new about a foreign language.