Hacker News Reader

crbon KeePassXC 2.2.0 released with YubiKey and TOTP support

Docs are.. sparse. The website says go to the GitHub wiki, and that only really talks about how to build and develop the app, not how to use it.

Can anyone tell me how to enable Yubikey?

crbon All AMD ThreadRipper CPU's will have 64 PCIe Lanes

Any word from AMD on support for Thunderbolt 3, now Intel are making it available royalty-free?

https://newsroom.intel.com/editorials/envision-world-thunder...

crbon New Surface Pro

They'll "give" you a USB-C dongle.

https://www.theverge.com/2017/5/23/15674254/microsoft-surfac...

> Microsoft is planning to release a dongle that will plug into the new Surface Pro and Surface Laptop devices and provide USB-C support. It’s like any dongle you’d expect, and it simply slots into the Surface connector port on the device. “If you want to charge a device with a Type-C charger, you can. If you want to put data back and forth with a Type-C peripheral, you can,” says Panay.

crbon Microsoft: You need to fix your Skype and Microsoft account issues, this is insane

Yes, they can; you register a Gmail account as crb@example.org, proving you control that e-mail address.

Then, an admin who proves they control the entire example.org domain registers it for G Suite, and creates a 'crb' user.

You now have a conflict account situation: https://support.google.com/a/answer/7062710?hl=en

crbon A new upstream project to break up Docker into independent components

Hey Solomon, here are some 'starters for 10':

- Who will be able to use the Docker trademark? If someone built a fork of Docker CE from Moby, can they still call it Docker? What about distribution packagers?

- Right now a single binary ('docker') is used to build images and runs clusters (among other things). As the monolith is broken down, will the new binaries still be named/branded 'docker'? Will there be rules about packaging only some of them? Will Docker CE/EE still have a single binary for all purposes?

crbon A new upstream project to break up Docker into independent components

Oracle?

https://blog.docker.com/2017/04/oracle-database-dev-tools-in...

(The other posted list talking about Microsoft is from 2016)

crbon Moby: An open-source project to advance containerization

Will I eventually be able to 'moby build' a directory with an 'OCIfile'?

crbon They Used To Last 50 Years

I'm a New Zealander who has owned Fisher and Paykel appliances, and was interested to see if they were still independent, as they weren't mentioned in this article.

Since 2012, they've been 90% owned by Haier, one of the "big four" he lists.

crbon CoreOS's rkt and Docker's containerd jointly donated to CNCF

There absolutely is a legal transfer. the donation assigns copyright, and normally includes the intellectual property rights of the trademark and logo.

In theory, the recipient could choose to relicense.

crbon Docker to Donate Containerd to the Cloud Native Computing Foundation

Their proposal to the TOC: https://docs.google.com/presentation/d/1ZazSXwYWp_DVNjOArbvt...

Interestingly, a few slides later, rkt is proposed also. There's a slide as to "why both": "Standards are most effective when there are multiple, independent implementations with different architectures"

crbon Show HN: Go from Docker-Compose to Kubernetes with a simple tool

I work on a team who wants to help make this easier. What are the concepts that you think are the most complex?

crbon Docker Enterprise Edition

http://kompose.io/ is part of the Kubernetes project (in incubation) — https://github.com/kubernetes-incubator/kompose

crbon Deploying PostgreSQL Clusters Using StatefulSets

If all the OS does is provide a minimal surface for running containers, I'd focus on whatever gives me the best security, manageability and updates.

The Container Optimised OS is what GKE uses on Google Cloud Platform https://cloud.google.com/container-optimized-os/docs/

It's conceptually very similar to CoreOS' Container Linux, so I might try that if I were looking at Kubernetes elsewhere and wanted a container-only OS.

If I am running an environment with multiple purposes - some container hosts, some regular machines - I'd err on the side of "who is my current vendor/what does my ops team support and know best".

crbon Deploying PostgreSQL Clusters Using StatefulSets

Think of Helm like a Linux package manager. You tell it you want etcd, and it makes it happen for you.

The way it makes it happen might be by using an operator, a Deployment/ReplicaSet, or a StatefulSet.

Think of operators as a "replica set that is aware of what it is replicating", and can do work to get things in the correct state.

crbon Deploying PostgreSQL Clusters Using StatefulSets

You can reimplement that logic in Python. There's nothing magic about it: you can see in https://github.com/kubernetes/kubernetes/blob/master/pkg/cli... that it just uses a Kubernetes annotation.

There's some more information (and a sidecar pod prebaked) at http://blog.kubernetes.io/2016/01/simple-leader-election-wit...

crbon Deploying PostgreSQL Clusters Using StatefulSets

https://twitter.com/chanezon/status/834847669042311168

"containerd is all we wanted from @docker in @kubernetesio and none of what we didn't need: kudos to the team!"

crbon Deploying PostgreSQL Clusters Using StatefulSets

Not at all - it's just a language for which there is a Kubernetes client. The API is 100% REST. We have a Python library underway also: https://github.com/kubernetes-incubator/client-python

crbon Deploying PostgreSQL Clusters Using StatefulSets

You sound like you might be first in line to use a rkt-powered GKE :)

crbon Deploying PostgreSQL Clusters Using StatefulSets

I think I saw you on this thread, but I'd defer to Clayton Coleman of Red Hat/OpenShift in this post: https://news.ycombinator.com/item?id=13680244

tl;dr: do you want to be a DBA? do you want to be a cluster admin? If you want to be both you can run databases on Kubernetes. If you don't want to be a DBA, use a managed service.

crbon Deploying PostgreSQL Clusters Using StatefulSets

> Why doesn't Kubernetes destroy these nodes when they've been out of commission for 3-4 hours?

Kubernetes isn't responsible for the lifecycle of its nodes. It can run in a DC where "destroying a node" might mean paging a tech to turn off a server. Something external - in your case, kops & your ASG - is responsible for the nodes that Kubernetes runs on. That's a deliberate design choice.

It should make a correct decision not to schedule work there, which it sounds like it did.

Given that, your other questions are hard to answer. kubelet is a process that runs on the nodes. So is docker. If you can't get into the machine to diagnose the fault, I'd encourage you to set up some monitoring/log shipping off the node so you can see what the state was when it failed.

There's nothing inherently "Kubernetes" about this diagnosis - it's more EC2, node/kernel/OS and Docker troubleshooting, in that order.

crbon Deploying PostgreSQL Clusters Using StatefulSets

If your pattern requires you to connect to etcd, then you're not taking the best advantage of Kubernetes.

Yes, you can connect to an etcd instance outside of Kubernetes, or deploy etcd on Kubernetes. CoreOS developed the etcd operator for the purposes of self-hosting the system KV store, but you can of course run a "user" etcd.

A better pattern is relying on the objects provided by Kubernetes, which are themselves backed by a lock service (which happens to be etcd, but that's an implementation detail you shouldn't worry about.)

You could, for example, use an Annotation on an object to do leader election. Look at how HA masters are implemented on Kubernetes, for example:

https://github.com/kubernetes/kubernetes/blob/master/pkg/cli...

crbon Deploying PostgreSQL Clusters Using StatefulSets

Generally you would get a network attached block storage disk (Google Cloud Persistent Disk, EBS volume, etc).

The blog writes from the perspective of an on-prem deployment and suggests you could use NFS to provide a PersistentVolume to Kubernetes. While this is possible, it's probably not best practice, especially if a failure in your NFS will render all your nodes offline at once.

crbon Docker in Production: An Update

Chromium OS is open source: https://www.chromium.org/chromium-os. OverlayFS is in the upstream Linux kernel.

CoreOS is a very similar idea, and given that, we don't make builds of the container images available outside GCE.

Customers who need specifics of the OS (that they can't find them by just looking at the kernel config on the node) are welcome to ping us a support ticket.

crbon Docker in Production: An Update

You can't ssh to the master with GKE, but you can check the nodes (as mentioned at https://news.ycombinator.com/item?id=13715358.)

crbon Docker in Production: An Update

If you're a customer and you're interested in either of the first two, please ping me an e-mail.

GitHub's lmctfy README states "We are not actively developing lmctfy further and have moved our efforts to libcontainer."

crbon Docker in Production: An Update

The default distro is Container Optimised OS: https://cloud.google.com/container-optimized-os/docs/. It's derived from Chromium OS, which means we can take advantage of the team who build images for the many devices which use it, and the security response infrastructure around it.

With 'docker info' on a node you can see we use OverlayFS, which seems a popular choice in the community also: http://burkelibbey.s3.amazonaws.com/dockercon-fs.pdf

crbon Docker in Production: An Update

It's great that hftguy thinks Google Container Engine is stable (I work on it) but I'm sorry to say it's very easy to prove that is, in fact, running Docker on the nodes.

You can just SSH into one and see for yourself.

Kubernetes was built from the ground up to orchestrate Docker. CoreOS did a lot of work to make it possible to trade rkt in for Docker's engine, and the cri (Container Runtime Interface) is now generalising that so that there is a clear abstraction between the kubelet and the engines it orchestrates. Read about it here: http://blog.kubernetes.io/2016/12/container-runtime-interfac...

If you want to do things that are different to what we provide support for on GKE as a Managed Service (tm), you're able to run your own Kubernetes clusters on GCE. (We do let you run a Kubernetes alpha version, but only on non-supported clusters that self-destruct after 30 days.

crbon Teaching Kubernetes

Or just put --- between various stanzas in one file: https://kubernetes.io/docs/user-guide/managing-deployments/#...

(Google now has a L3 internal load balancer, but not a L7 LB. It's fair to say that this will be made much easier this year.)