uav's questions

How to run docker scan --login with corporate proxy? Do I really have to install Snyk with npm?

What have I tried?

1. Register and login with Google account on https://app.snyk.io/login?cta=sign-up&loc=nav&page=homepage.
2. Exec docker scan --login (optional with --token <TOKEN>) on Ubuntu 20.04.
3. Open link shown in terminal.
4. Go back to terminal and see error (probably timeout).

I have proxy definitions in /etc/systemd/system/docker.service.d/http-proxy.conf, ~/.docker/config.json and ~/.docker/scan/config.json without any luck.

What does Amazon AWS EC2 DDOS protection shield throw when activated? HTTP(S) 503?

At which amount can this happen? 5000 - 10000 requests at "the same time"?

Is this public info and available somewhere?

How to activate/renew Ubuntu Advantage/ESM on Ubuntu 14.04 if you have HTTP connect proxy like Squid - so you get security updates again? With the older tool I get errors and/or timeouts with sudo apt update && sudo apt dist-upgrade.

Does someone have a list of all Permissions-Policy header keys and values?

What I have:

more_set_headers "Permissions-Policy: camera=(self), fullscreen=(*), geolocation=(self), payment=()";

It was somehow (old - don't use it):

more_set_headers "Feature-Policy: camera 'self'; fullscreen *; geolocation 'self'; payment 'none'";

Note that the old syntax is with semicolons and the new syntax requires commas.

Does http.nonProxyHosts support the subnet/CIDR IP syntax 172.16.0.0/12 (private IP addresses)? The alternative would be quite complicated:

172.16.*\|172.17.*\|172.18.*\|172.19.*\|172.20.*\|172.21.*\|172.22.*\|172.23.*

...and so on, to not match 172.0.* to 172.15.* (with 172.*) (or are these not important public IP addresses)?!

Actually I don't ask so specifically, but more generally. Because once you have understood the subnet/CIDR notation, you will want to use it!

I know there are Nginx phases. Why does the following snippet deliver the "200 Host: example.com" instead of forwarding to Google? What would be a generally valid workaround to evaluate Lua higher or before?

server
{
    listen 80;
    server_name example.com;

    location /
    {
        rewrite_by_lua_block
        {
            return ngx.redirect('https://www.google.com/', 303)
        }

        default_type text/plain;
        return 200 "Host: $host";
    }
}

Maybe this doesn't make sense at first sight, but I have an intelligent way to block/redirect certain calls in the Lua block (or in a Lua file included at this point). This module should work in general. With proxy_pass, alias etc. it works fine. Only with return 200 it does not work. Does anyone have an idea?

Preliminary remark: The word replica means repetition or copy for me, but:

When someone speaks of "one replica", does that mean one instance or two instances in total? Interestingly, I have come across the use of the former case and this makes me a little insecure. Based on the second case, would one speak of "zero replicas" if there is only one app or instance in total?

Sorry if that question seems a bit vague. Example time. My app or instance has 8 different containers in 8 different pods.

+------------+--------------+--------------+
| #container |    case 1    |    case 2    |
+------------+--------------+--------------+
| 8 x 1      | "1 replica"  | "0 replicas" |
| 8 x 2      | "2 replicas" | "1 replica"  |
| 8 x 3      | "3 replicas" | "2 replicas" |
| ...        | ...          | ...          |
+------------+--------------+--------------+

The question whether the word replica refers to a single container/pod or to the whole app is not important here (it is equivalent), because I will replicate each different container/pod of the 8 containers/pods with the same number. I would like to know if you would rather use case 1 or case 2 (in discussions among colleagues), or if the numbering is one-based or zero-based. Please mark the question as opinion-based, if necessary.

I have a running etcd cluster with five members (Own etcd cluster for Kubernetes). How can I include this in the kubeadm init command? My idea is that I generate the configuration, edit it manually and then run it. In theory, these are two commands, but I don't know exactly what they are.

Since I don't have direct access to the storage, but want to run Kubernetes in my own environment: Which software (on a VM) do I use to provide PV/PVC via the file system? I have heard about Ceph. What do I have to consider? Are there alternatives?

If this is too general: Can I get around Ceph (not that I wanted to) when I can only use the file system in a VM (yes/no)?

I want to build my own Kubernetes cluster across two locations (300 km distance) and integrate it into GitLab.

Let me list my ideas. My question is if I have a mistake in my thinking somewhere and ask to solve it.

1. Since I can only set up VMs and have no rights directly on the hosts, I want to install an etcd-cluster on 5 VMs (3+2). I would install etcd with apt on Ubuntu 18.04. For this I don't need Kubernetes at first.

2. An odd number of instances only applies to etcd and not to control planes?

3. Does it make any sense to set up separate VMs for the control planes or can I reuse the 3+2 VMs of the etcd cluster? Otherwise I would already have 10 VMs.

CAA probably makes sure that issued certificates come from my CA and not from another one.

Given in the DNS:

example.com. 300 IN CAA 0 issue "ca.example.com"
example.com. 300 IN CAA 0 issuewild "ca.example.com"

Question 1: Can my CA use it to issue the following sub-subdomains?

a.b.c.example.com
d.e.f.example.com

Question 2: If this is not possible, what is the easiest way to do this in DNS? We have many sub-subdomains.

How can I set up global environment variables in GitLab that are not project-specific, but apply to all projects? Classic use cases are deployment keys, docker registry credentials and connect proxy information.

People have been asking about it for three years, as you can see in the following link. Unfortunately the issue has been closed.

https://gitlab.com/gitlab-org/gitlab-foss/issues/3897