xpepermint's questions

Etcd has a concept of Atomic Compare-and-Update by comparing the key's value before executing an update. I'd like to use this feature for updating a ConfigMap in my Kubernetes cluster. I'd like to update the config map only if the existing config map data or a specific data key matches a certain value.

Example ConfigMap:

curl -X POST -H 'Content-Type: application/json' \
    -d '{"apiVersion": "v1", "kind": "ConfigMap", "metadata": {"name": "test"}, "data": {"foo": "1"}}' \
    http://localhost:8001/api/v1/namespaces/default/configmaps

I need to interact with K8S API or directly with K8S's etcd directly if possible (is it?), and I don't want to rely on resourceVersion. I'd like to depend on my own version which is actually the config map's data key. How can I achieve such an atomic UPDATE (or DELETE) operation?

I wonder how Kubernetes executes updates. Let's say that two entities perform an update at the same time. How will the configuration be applied? Is applying/deleting configuration and in general performing mutations over K8S API an atomic operation? Is it possible to perform a mutation based on a condition?

Let's take this simple ConfigMap for an example:

apiVersion: v1
kind: ConfigMap
metadata:
  name: testmap
data:
  foo: "1"

I'd like to update this configuration by setting foo: "2" but only if the foo: "1" exists in the ConfigMap. Such atomic features can be found in databases like MongoDB (e.g. findAndModify), Redis, etc. How can I achieve atomicity in K8S?

I wonder how security experts think about making container traffic secure. Let's take a simple K8S cluster as an example.

I guess we all agree that running HTTPS instead of HTTP within each container is more secure. I would normally configure a TLS on Ingress and then route to an internal container will TLS configured as well.

Modern mashing solutions usually install proxy sidecar - let's take Linkerd2 for a concrete example. Ingress will upgrade all incoming traffic to TLS, it will then use Linkerd's TLS to forward traffic to the sidecar proxy. Everything transmitted until here is TLS and secured. I wonder, now that a secured traffic "already reached" the pod, should a container use TLS as well, or is it safe enough to communicate with the sidecar without TLS? I'd like to hear the security aspect between the container and its sidecar. Should a sidecar be treated as a stand-alone container and thus the communication with a container should also be TLS secured?

I have a working Envoy proxy configuration that matches two routes /name/foo/bar?mode=receive-data and /name/receive-data. The Envoy configuration file looks something like this:

static_resources:
  ...
    filter_chains:
    - filters:
      - name: envoy.http_connection_manager
        typed_config:
          ...
          route_config:
            virtual_hosts:
            - ...
              routes:
              - match:
                  prefix: "/name/foo/bar?mode=receive-data"
                ...
              - match:
                  prefix: "/name/receive-data"
                ...

I need to update the configuration from using route prefix matching to regex match as explained in the route.RouteMatch documentation. These two route deinitions must be converted to /:name/foo/bar?mode=receive-data and /:name/receive-data somehow, where :name can be [a-z0-9]. I've tried to write my own regex: for this, but with no success, so I'd appreciate some help here.

I have a postfix mail server with a working opendkim and SPF setup. Everything works when I use only 1 IP/MX/hostname (e.g. mail.example.com). I try to enable another IP so the postfix could balance traffic when sending bulk emails (e.g. mail2.example.com).

At first I planed to use iptables for rotating IPs but I noticed that my emails will probably be soon marked as spam because the received email does not always have the IP and the hostname properly set. The next solution was multi-instances but I noticed that this will only separate mail features not actually make duplicated instances. So I decided to manage the logic my self and just use multiple hostnames/IPs on the mail server side.

The problem that I'm facing is that postfix always sends an email using the primary IP address. How can I configure the postfix to send email over the same IP address that the message is received? So e.g. if I telnet mail.example.com 25 and send an email, the email is sent using the mail.example.com hostname & IP and if I telnet mail2.example.com 25 and send an email, the email is sent using the mail2.example.com hostname & IP.

I've search the web but I can't find the right answer. How people usually solve this? Thx!

Is it possible to connect to EC2 instance directly? This is possible on Rackspace using a java servlet inside your browser where you get a "remote monitor window" (not SSH but a local login screen). I ask this because being able to connect only over SSH can be dangerous. It can happen that something goes wrong with your SSH and you can loose your server for ever. I'm surprised that I don't see this option in my account. What is the right way?

I would like to protect my nginx+pessenger+rails3 HTTP server from hammering/scraping. If you try to scrape the Google it shows you a captcha in case you make too many requests from the same IP. What module should I use?

Thanks.

I have a static index.html with css and images. I uploaded a fresh index.html with fixes but the content was not showing - the page/changes were not visible/refreshed. If I look into the source I can see that image paths has been changed into strange long "cache-like" paths.

E.g. from

<link rel="stylesheet" type="text/css" media="all" href="http://mydomain.com/stylesheets/screen.css">

to

<link rel="stylesheet" type="text/css" media="all" href="http://mydomain.com/stylesheets/cc.2c251d9cae64435f25c60ee79fc472a4.screen,s+jquery,oprettyPhoto,s?123.css">

It is not browser's issue because the response in the console is the same.

How can I fix that?

UPDATE: I use mod_expires and mod_pagespeed.