HNHacker News
TopNewBestAskShowJobs

micah_chatt

539 karma · joined September 17, 2013

Principal Engineer at AWS working on EKS

Github/twitter: @micahhausler

[ my public key: https://keybase.io/micahhausler; my proof: https://keybase.io/micahhausler/sigs/rg60fRi4UGRr1oFpkl2hOHdQFc4-uUekdcDHbhayDm8 ]

submissionscomments
micah_chatt··on Creepy Crawlies
If you do the math (also a common system design interview question for an AI lab), its actually only ~3PB (compress to 1PB, ~$22,000/mo in S3) and a few thousand/mo in compute over less than 4 months to index the entire internet for pretraining purposes. At that price point, its actually very affordable to many thousands of organizations to get their own copy. I would expect the major labs to special case kernel.org similarly to other sites like Wikipedia, but not the majority of scrapers
micah_chatt··on Airport Simulator
Super fun game! Minor modifications that would be fun: * As you draw a path, at the same rate gradually bold/pulse all other planes' existing drawn paths from their current location forward so I can visually see if two future lines will not just overlap, but overlap at the same time * A slider to control game speed * A clearer arrow over the landing zone. It took me quite a while to realize how to land a plane * A timer over each runway to next takeoff
micah_chatt··on U.S. Senators Vote to Ban Themselves from Trading on Prediction Markets
What about Senate staff?
micah_chatt··on Daylight Computer – New 60fps e-paper tablet
First, this looks amazing, congrats! The primary reason I've held off on buying an eink tablet (remarkable/kindle scribe) is because much of the non-leisure reading I do for work requires enterprise-friendly features like MDM and encryption, and even with that plugging into a laptop to sync every document is a major UX hurdle.

Are you thinking about this primarily as a consumer device with, or do you want to go after those business applications sooner than later?

Disclosure: I work at AWS, own a Kindle Oasis, but have nothing to do with Kindle or devices.

micah_chatt··on AWS federation comes to GitHub Actions
I just mean that it was a coincidence that I asked GitHub for the feature and they were already working on it
micah_chatt··on AWS federation comes to GitHub Actions
Nice write up! By pure coincidence I asked GitHub for this feature 2 weeks ago [1] and they confirmed it was in the works.

[1]. https://twitter.com/micahhausler/status/1431350884810821637

micah_chatt··on Amazon EKS Anywhere
EKS Engineer here. This is something we have lots of thoughts about and want to make better in EKS on AWS.

For EKS Anywhere, you can configure your cluster with OIDC auth today, and IAM auth is coming very soon. https://github.com/aws/eks-anywhere/issues/90

micah_chatt··on Ask HN: Who is hiring? (September 2020)
Amazon EKS | Sr Software Engineer | Remote (US/Canada) | Full Time

As a Senior Software Engineer in the Elastic Kubernetes Service (EKS) team you will help us deliver the mission of making AWS the best place to run containers. You will be part of an exceptional team that is moving the needle towards making containers as the next generation compute platform. This is an opportunity to engineer systems on a massive scale, and to gain top-notch experience in distributed systems and cloud computing.

https://www.amazon.jobs/en/jobs/1231608/senior-software-deve...

Also hiring:

* Senior Software Manager https://www.amazon.jobs/en/jobs/1202522/software-development...

* Software Engineer https://www.amazon.jobs/en/jobs/1253531/software-development...

micah_chatt··on Monzo: How our security team handle secrets
That would by my error, its actually `BoundServiceAccountTokenVolume` and `TokenRequestProjection`
micah_chatt··on Monzo: How our security team handle secrets
(Disclosure: I work on Kubernetes/EKS Security at AWS)

I'm curious why they didn't look into using Kubernetes ProjectedVolumeTokens for authenticating to Vault? The tokens Kubernetes issues are not stored in etcd, and they contain pod-specific metadata so they are invalidated as soon as the pod dies (when using TokenReview). Alternatively, they can be used to directly authenticate with Vault since they're OIDC-valid tokens [1].

The semantics around secrets in Kubernetes aren't nearly as robust as Vault, so I was surprised to not see this more clearly called out (ex: list secrets == get all keys and values). Even if you use KMS/AES encryption (which they reference) that doesn't help with access control.

[1] https://www.vaultproject.io/docs/auth/jwt.html

micah_chatt··on Be wary of functions which take several parameters of the same type
This. It extends to command line tools too. I can _never_ remember what the order is for `ln -s`.
micah_chatt··on How Far Out Is AWS Fargate?
You are correct that the API server is only aware of the VPC network, and not any overlays. One solution to the metrics-server or other webhooks is to use host-networking mode so the API server can have connectivity.
micah_chatt··on How Far Out Is AWS Fargate?
EKS Engineer here.

Calico policy can be used with the AWS VPC CNI, but you can remove the default CNI and install Calico or any other CNI plugin you’d like.

micah_chatt··on How Far Out Is AWS Fargate?
EKS Engineer here, thanks for the feedback.

Service IP configurability is a very common ask, and as you’ve linked, is on our roadmap along with a slew of other control plane configuration options.

You can delete the AWS VPC CNI DaemonSet and install any CNI plugin you’d like.

EKS regularly backs up etcd and has automatic restore in the case of a failure. Manually restoring to an old snapshot would be quite disruptive. What is your use case, and what would be the interface you’d like to see?

micah_chatt··on Blender 2.80
One of the things about blender that was frustrating for me when I last tried it ~3 years ago was the inability to use a different python REPL (ex: iPython) or easily import the blender python libraries in a non-blender python process. Can anyone say if this has gotten better?
micah_chatt··on 26 States Now Ban or Restrict Community Broadband
A year ago I moved from Chattanooga, TN (mentioned in the article) to Bellevue, Wa to work in “Cloud City” Seattle to take a job at AWS. It used to cost me a total $59/mo for 100MB fiber up and down, no contract, with _amazing_ customer service (I seriously have stories to tell about how great EPB is).

My only real option at my new residence is Comcast at $79/mo which went up to $94/mo after 1 year for a hypothetical 100down/5up, with frequent network drops.

It was quite disappointing to find zero options for fiber, and this convinces me that this kind of corruption by ISPs and legislators needs to be severely curbed.

micah_chatt··on Ask HN: Who is hiring? (April 2019)
Amazon Web Services (AWS) EKS | Frontend & Software Development Engineer | ONSITE (US relocation) | Seattle, WA | Full Time

Amazon Web Services is looking for Systems Development Engineers (SysDE) and Software Development Engineers (SDE) to join our growing Amazon Elastic Container Services for Kubernetes (EKS) team. Amazon EKS is our managed Kubernetes service that makes it easy for customers to use Kubernetes without needing to become experts in provisioning and operating Kubernetes. EKS manages time-consuming administrative tasks like setting up, operating, scaling and updating Kubernetes freeing customers up to focus on their applications.

Please note that these are not entry level positions. Kubernetes and/or AWS experience preferred.

Please feel free to reach out to the hiring manager for this position with any questions, beswar@amazon.com

- https://www.amazon.jobs/en/jobs/814274/software-development-...

- https://www.amazon.jobs/en/jobs/756191/front-end-engineer-ek...

micah_chatt··on Amazon uses dummy parcels to catch thieves
I know a family friend who works in internal investigations at $PACKAGE_DELIVERY_CORP, and this kind of sting is nothing new. You just don’t hear about it.

Disclosure: I work at AWS but know nothing about Amazon delivery

micah_chatt··on AWS Service Operator for Kubernetes Now Available
This is something we’ve heard a lot and are working together with the Kubernetes community on. We’ll have more to announce on this one soon

Full disclosure: I work on EKS at AWS

micah_chatt··on Ask HN: Who is hiring? (June 2018)
Amazon Web Services (AWS) EKS | Systems Development Engineer | ONSITE (US relocation) | Seattle, WA | Full Time Amazon Web Services is looking for Systems Development Engineers (SysDE) and Software Development Engineers (SDE) to join our growing Amazon Elastic Container Services for Kubernetes (EKS) team. Amazon EKS is our managed Kubernetes service that makes it easy for customers to use Kubernetes without needing to become experts in provisioning and operating Kubernetes. EKS manages time-consuming administrative tasks like setting up, operating, scaling and updating Kubernetes freeing customers up to focus on their applications.

Please note that these are not entry level positions. Kubernetes and/or AWS experience preferred.

Please feel free to reach out to the hiring manager for this position with any questions, beswar@amazon.com

https://www.amazon.jobs/en/jobs/632063/systems-development-e...

micah_chatt··on Ask HN: Who is hiring? (May 2018)
Amazon Web Services (AWS) EKS | Systems Development Engineer | ONSITE (US relocation) | Seattle, WA | Full Time

Amazon Web Services is looking for Systems Development Engineers (SysDE) and Software Development Engineers (SDE) to join our growing Amazon Elastic Container Services for Kubernetes (EKS) team. Amazon EKS is our managed Kubernetes service that makes it easy for customers to use Kubernetes without needing to become experts in provisioning and operating Kubernetes. EKS manages time-consuming administrative tasks like setting up, operating, scaling and updating Kubernetes freeing customers up to focus on their applications.

Please note that these are not entry level positions. Kubernetes and/or AWS experience preferred.

Please feel free to reach out to the hiring manager for this position with any questions, beswar@amazon.com

https://www.amazon.jobs/en/jobs/632063/systems-development-e...

micah_chatt··on Red Hat to Acquire CoreOS
What is the source? I didn't see that in the linked article.
micah_chatt··on Ask HN: What to do as a back-end dev and with many app ideas but can't do UX?
Also: You can (for free) remove the 30day trial restriction as a developer: https://www.skuid.com/developer-trial/
micah_chatt··on Ask HN: What to do as a back-end dev and with many app ideas but can't do UX?
F500 is where the money is at, so that is where the marketing is at (currently). Also, selling (no-code) development software to F500 business units requires explanation, which is a hard problem.
micah_chatt··on Ask HN: What to do as a back-end dev and with many app ideas but can't do UX?
I literally have experienced this same issue, and was lucky enough to work for a company where building UI/UX around APIs _is_ the product. We're a no-code (but code-extensible) UI platform.

https://www.skuid.com/

This isn't meant to be a marketing message, I really actually build UI's around internal API's I write all the time. It is honestly great for side projects and we have multiple F500 organizations that use it at scale as well.

micah_chatt··on Bitumen balls could be a pipeline-free way to transport Alberta oil
This is funny reversal in history: Rockefeller first built pipelines to cut out the rail industry from distribution.
micah_chatt··on Show HN: Version Control for Microsoft Word
This is actually a great idea, but not a new one. See this TED talk from 2012 [1]. I hope this kind of thing is integrated into more products and services

[1] https://www.ted.com/talks/clay_shirky_how_the_internet_will_...

micah_chatt··on Streamlining Kubernetes development with Draft
This looks really cool! Hopefully it scratches the same itch docker-compose did a long time ago, but for those running Kubernetes.

I was just talking to a coworker this morning about how Helm is great, but its very analogous to debs or rpms: You would use it all day to install core-libraries (or services for k8s) on your system (or cluster), but probably not your first choice for shipping your business application.

I know, with Helm you can update a value for an image of a "release" (Helm term for an installed chart): but you hand off the upgrade of the application to the Tiller server to manage. If anything in your deployment goes south, Kubernetes will just keep trying to push it out until it works or is manually rolled back. Until Kubernetes gets automated rollbacks (https://github.com/kubernetes/kubernetes/issues/23211), this can be less than ideal.

Going with the rpm/deb analogy, I prefer to use something that would take the place of Puppet/Ansible (like Spinnaker) for _my_ applications I release, and still use Helm for the cluster level services like monitoring, logging, etc.

micah_chatt··on Oracle buys Wercker
Is this an attempt by Oracle to really get into the Kubernetes space, or just a right-priced acquisition in the broader cloud space?
micah_chatt··on Intel Pulls Out of OpenStack Effort It Founded with Rackspace
Is there any chance that vendors (like Intel) will care less about the API for accessing their products, as there seems to be more consolidation around API's for running applications like Kubernetes. Intel is a member of the CNCF [1] and seems to be putting money behind it. Am I reading too much into that and is Intel just a big company that puts money in lots of places?

[1]: https://www.cncf.io/about/members/

Page 1 of 3Next →