Commandes en Vrac

Managing kubeconfig files + download from Rancher

2026-04-17T14:39:00.002-04:00

Managing kubeconfig files across multiple Rancher clusters

When you manage several Kubernetes clusters through Rancher, you quickly end up with a pile of kubeconfig files. Downloading them by hand from the Rancher UI is tedious, keeping track of which ones are loaded is error-prone, and testing connectivity after a VPN change or token rotation is a chore.

Here is the setup I landed on: a download script, a directory convention, auto-discovery in the shell, and a parallel connectivity tester.

Directory layout
Downloading kubeconfigs from Rancher
Auto-discovery in .bashrc
Testing connectivity
Putting it all together

Directory layout

~/.kube/
  config                        # default kubectl config (GKE, kind, etc.)
  clusters/
    rancher_kubeconfig_dl.sh    # download script
    test-kubeconfigs.sh         # connectivity tester
    local.yaml                  # kubeconfig files live here
    cluster-us-east-1.yaml
    cluster-us-west-2.yaml
    cluster-eu-west-1.yaml
    cluster-ap-south-1.yaml

The scripts and kubeconfig files all live in ~/.kube/clusters/. The test script filters by kind: Config so it ignores non-kubeconfig files like itself.

Downloading kubeconfigs from Rancher

Rancher exposes a generateKubeconfig action on its v3 API. The following script lists all clusters your token has access to and downloads each kubeconfig into a directory.

First, create an API key in Rancher: top-right avatar, Account & API Keys, Create API Key. You get a token like token-xxxxx:yyyyyyy.

#!/usr/bin/env bash
# rancher_kubeconfig_dl.sh
# Downloads all kubeconfig YAML files from a Rancher instance.
#
# Usage:
#   RANCHER_TOKEN=token-xxxxx:yyyyyyy ./rancher_kubeconfig_dl.sh
#
# To get a token manually:
#   Rancher UI -> top-right avatar -> Account & API Keys -> Create API Key

set -euo pipefail

RANCHER_URL="${RANCHER_URL:-https://rancher.example.com}"
RANCHER_TOKEN="${RANCHER_TOKEN:-}"
OUTPUT_DIR="${OUTPUT_DIR:-.}"

# -- Auth --
if [[ -z "$RANCHER_TOKEN" ]]; then
  echo "ERROR: Set RANCHER_TOKEN (e.g. token-xxxxx:yyyyyyy)"
  echo "       Rancher UI -> Avatar -> Account & API Keys -> Create API Key"
  exit 1
fi

CURL_OPTS=(-sSf -H "Authorization: Bearer ${RANCHER_TOKEN}")

# -- Fetch cluster list --
echo "-> Fetching cluster list from ${RANCHER_URL} ..."
clusters_json=$(curl "${CURL_OPTS[@]}" "${RANCHER_URL}/v3/clusters")

tmp=$(mktemp)
trap 'rm -f "$tmp"' EXIT
echo "$clusters_json" | jq -r '.data[] | .id + "\t" + .name' > "$tmp"

count=$(wc -l < "$tmp" | tr -d ' ')
[[ "$count" -eq 0 ]] && { echo "No clusters found (check your token permissions)."; exit 1; }
echo "-> Found ${count} cluster(s)"
mkdir -p "$OUTPUT_DIR"

# -- Download kubeconfig per cluster --
while IFS=$(printf '\t') read -r id name; do
  safe=$(echo "$name" | tr -cs '[:alnum:]-_.' '-' | sed 's/-$//')
  out="${OUTPUT_DIR}/${safe}.yaml"
  echo "  ${name} (${id}) -> ${out}"
  curl "${CURL_OPTS[@]}" \
    -X POST \
    "${RANCHER_URL}/v3/clusters/${id}?action=generateKubeconfig" \
    | jq -r '.config' \
    > "$out"
done < "$tmp"

echo ""
echo "Done. Kubeconfigs saved to: ${OUTPUT_DIR}/"
ls -lh "$OUTPUT_DIR"

Run it once, or whenever you add a new cluster to Rancher:

RANCHER_TOKEN=token-xxxxx:yyyyyyy ./rancher_kubeconfig_dl.sh

Each cluster gets its own file, named after the cluster. No manual copy-pasting from the Rancher UI.

Auto-discovery in .bashrc

kubectl merges all files listed in the KUBECONFIG environment variable (colon-separated). Instead of maintaining a hardcoded list that goes stale every time you add or remove a cluster, use find to discover them at shell startup:

# In ~/.bashrc or ~/.zshrc
export KUBECONFIG=~/.kube/config:$(find ~/.kube/clusters -name '*.yaml' 2>/dev/null | tr '\n' ':' | sed 's/:$//')

This starts with the default ~/.kube/config (for GKE, kind, minikube, or anything else) and appends every YAML file found in the clusters directory. find, tr, and sed are all POSIX — this works on macOS, Linux, and BSDs. Avoid find -printf which is a GNU extension and won't work on macOS.

Drop a new file in, open a new terminal, and kubectx sees it immediately. Remove a file and it disappears. No editing required.

Testing connectivity

After a VPN reconnect, a token rotation, or just to check that everything is reachable, run the test script. It finds all kubeconfig files in a directory, extracts every context from each file, and tests them all in parallel:

#!/usr/bin/env bash
# test-kubeconfigs.sh
# Test connectivity for all kubeconfig YAML files in a directory.
# Usage: ./test-kubeconfigs.sh [directory]
#   directory: path containing kubeconfig YAML files (default: script directory)

set -euo pipefail
shopt -s nullglob

dir="${1:-$(dirname "$0")}"

if [[ ! -d "$dir" ]]; then
  echo "Error: '$dir' is not a directory" >&2
  exit 1
fi

test_context() {
  local f="$1" ctx="$2" name
  name="$(basename "$f")"
  if kubectl --kubeconfig="$f" --context="$ctx" cluster-info --request-timeout=5s &>/dev/null; then
    echo "OK    $name  context=$ctx"
  else
    echo "FAIL  $name  context=$ctx"
  fi
}

pids=()
found=0

for f in "$dir"/*.yaml "$dir"/*.yml; do
  [[ -f "$f" ]] || continue
  grep -q 'kind: Config' "$f" 2>/dev/null || continue
  found=$((found + 1))

  contexts=$(kubectl --kubeconfig="$f" config get-contexts -o name 2>/dev/null)
  if [[ -z "$contexts" ]]; then
    echo "SKIP  $(basename "$f")  (no contexts found)" &
    pids+=($!)
    continue
  fi

  for ctx in $contexts; do
    test_context "$f" "$ctx" &
    pids+=($!)
  done
done

if [[ $found -eq 0 ]]; then
  echo "No kubeconfig files (kind: Config) found in $dir"
  exit 1
fi

fail=0
for pid in "${pids[@]}"; do
  wait "$pid" || fail=$((fail + 1))
done

pass=$(( ${#pids[@]} - fail ))
echo ""
echo "Results: $pass ok, $fail failed (from $found files)"
[[ $fail -eq 0 ]]

Each test runs as a background job, so checking six clusters takes as long as the slowest one (typically the 5-second timeout for an unreachable cluster), not six times that.

$ ./test-kubeconfigs.sh
OK    cluster-us-east-1.yaml   context=cluster-us-east-1
OK    cluster-us-west-2.yaml   context=cluster-us-west-2
OK    cluster-eu-west-1.yaml   context=cluster-eu-west-1
FAIL  cluster-ap-south-1.yaml  context=cluster-ap-south-1
OK    local.yaml               context=local

Results: 4 ok, 1 failed (from 5 files)

Putting it all together

The workflow is:

Run rancher_kubeconfig_dl.sh once (or after adding clusters in Rancher) to download all kubeconfigs into ~/.kube/clusters/.
Open a new terminal. The find-based KUBECONFIG export picks up all files automatically. kubectx lists every context.
Run test-kubeconfigs.sh to verify connectivity to all clusters in parallel.

No manual list to maintain, no UI clicking, and a quick way to verify everything is reachable.

Reverse-engineering Ropvacnic S1 vacuum for homeassistant integration

2026-04-01T19:13:00.000-04:00

Integrating the Ropvacnic S1 into Home Assistant via LocalTuya

The Ropvacnic S1 is a Tuya-based robot vacuum. Getting it to work locally in Home Assistant requires some digging — the DP numbers aren't documented anywhere, and LocalTuya has a bug in its locate function. This guide documents everything I found.

Why local control? Faster response, no cloud dependency, works if Tuya servers go down. The device still sends data to Tuya's cloud, but Home Assistant commands go directly over your LAN.

Setup: Home Assistant OS 2026.3.4 · LocalTuya 5.2.3 · Protocol 3.4 · Region: Western America

Step 1 — Tuya IoT Platform Setup

Create an account at iot.tuya.com (not tuya.com — click "Developer Platform" at the bottom). Create a Cloud Project with these settings:

Industry: Smart Home
Development Method: Smart Home
Data Center: Western America (for Canada/USA accounts)

Important: The Data Center must match your Tuya Smart app region. A mismatch causes a "Data center inconsistency" error when scanning the QR code.

Under Devices → Link Tuya App Account, scan the QR code with your Tuya Smart app. Then note:

Access ID — from the Overview tab
Access Secret — from the Overview tab
UID — from the linked account (starts with az...)

Step 2 — Discover DPs with tinytuya

A DP (Data Point) is a numbered channel that controls one specific function of the device. Install tinytuya on your computer to identify them all:

pip3 install tinytuya
python3 -m tinytuya wizard
# Enter your Access ID, Secret, UID and region (us)
 
python3 -m tinytuya snapshot
# Poll: Y → shows all live DP values

Complete DP Map — Ropvacnic S1

DP	Code	Type	Values
1	switch	Boolean	true / false
2	switch_go	Boolean	true / false
3	mode	Enum	standby, random, wall_follow, spiral, chargego
4	direction_control	Enum	forward, backward, turn_left, turn_right, stop
5	status	Enum	standby, smart_clean, goto_charge, charging, charge_done, paused
6	residual_electricity	Integer	0–100 (%)
7	clean_time	Integer	minutes
9	clean_area	Integer	m²
13	seek (locate)	Boolean	true / false
14	suction	Enum	gentle, normal, strong
17	edge_brush	Integer	0–100 (%)
18	filter	Integer	0–100 (%)
20	water_control	Enum	closed, low, middle, high

Note: DP 13 (seek/locate) is not visible in the standard tinytuya output. It was found by brute-force testing DPs 10–16 using d.set_value(dp, True) and listening for the vacuum's beep.

Step 3 — LocalTuya Entity Configuration

Install LocalTuya via HACS, restart HA, then go to Settings → Devices & Services → Add Integration → LocalTuya.

Set Manual DPS to: 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25

Configure the entity with these values:

Field	Value
ID (status DP)	5
Power DP (powergo_dp)	1
Mode DP	3
Battery DP	6
Fan Speed DP	14
Clean Time DP	7
Clean Area DP	9
Locate DP	13
Fault DP	(leave empty)
Idle Status	standby,sleep
Docked Status	charging,chargecompleted,charge_done
Returning Status	goto_charge
Modes list	standby,random,wall_follow,spiral,chargego
Return home mode	chargego
Fan speeds list	gentle,normal,strong
Pause state	paused
Stop status	standby

Step 4 — Fix vacuum.py (LocalTuya bug)

LocalTuya 5.2.3 has a bug in async_locate — it sends an empty string "" instead of True, so the locate button does nothing. Fix it via the Terminal add-on:

sed -i 's/set_dp("", self._config\[CONF_LOCATE_DP\])/set_dp(True, self._config[CONF_LOCATE_DP])/g' \
  /config/custom_components/localtuya/vacuum.py
 
# Verify
grep -A3 "async_locate" /config/custom_components/localtuya/vacuum.py

Step 5 — Fix config via Terminal (if GUI doesn't save)

The LocalTuya GUI sometimes doesn't persist certain changes (notably mode_dp and id). Edit the config file directly:

# Backup first!
cp /config/.storage/core.config_entries \
   /config/.storage/core.config_entries.backup
 
# Status DP = 5 (reads DP 5 for state)
sed -i 's/"id":1,"idle_status_value":"standby,sleep"/"id":5,"idle_status_value":"standby,sleep"/g' \
  /config/.storage/core.config_entries
 
# powergo_dp must be 1 (start/pause)
sed -i 's/"powergo_dp":5/"powergo_dp":1/g' \
  /config/.storage/core.config_entries
 
# mode_dp = 3 (stop + return to base)
sed -i 's/"mode_dp":0/"mode_dp":3/g' \
  /config/.storage/core.config_entries
 
# locate_dp = 13
sed -i 's/"locate_dp":0/"locate_dp":13/g' \
  /config/.storage/core.config_entries
 
# Remove fault_dp entirely (causes false errors)
sed -i 's/,"fault_dp":[0-9]*//g' \
  /config/.storage/core.config_entries

After edits, reload LocalTuya: Settings → Devices & Services → LocalTuya → 3 dots → Reload — no full restart needed.

Final Result

After completing all steps, the Ropvacnic S1 is fully controllable from Home Assistant with local-only communication:

State correctly shows Docked, Cleaning, Returning, and Paused
Start, Pause, Stop, and Return to Base all work
Locate (beep) works after the vacuum.py fix
Battery percentage displayed in real time
Fan speed (gentle / normal / strong) selectable from HA
Clean time and area tracked per session

UN / unodc elearning

2025-11-21T16:05:00.002-05:00

https://elearningunodc.org/local/pages/?id=3

[ref] Chainguard 101

2025-09-30T16:53:00.002-04:00

Links from Adrian Mouat https://www.linkedin.com/in/adrianmouat/ (Chainguard)

Chainguard slack :

https://communityinviter.com/apps/chainguardcommunity/invite

Image magick, reduce size of jpg files by 50%

2025-09-11T14:39:00.003-04:00

for file in *.jpg; do magick "$file" -resize 50% "resized/$file"; done

Ansible : GCP Google Cloud (Compute) ansible dynamic inventory with cache

2025-09-08T15:24:00.006-04:00

Inventory definition GCP compute

---
plugin: google.cloud.gcp_compute
# https://docs.ansible.com/ansible/latest/collections/google/cloud/gcp_compute_inventory.html
# https://gitlab.com/gitlab-org/gitlab-environment-toolkit/-/blob/main/docs/environment_configure.md#google-cloud-platform-gcp

projects:
 - project_id

auth_kind: serviceaccount
# must match `ansible_user` below, cf. other article on how to set this up
service_account_file: ./gcp-sa.json

filters:
 # only return running instances, we won't be able to connect to sopped instances
 - status = RUNNING
 # for example, only return compute instances with label foo = foobar
 - labels.foo = foobar

keyed_groups:
  - key: labels
    prefix: label

hostnames:
  - name
  - public_ip
  - private_ip

compose:
 #<ansible variable to be set>  <data from gcp discovery>
 # Set an inventory parameter to use the Public IP address to connect to the host
 #ansible_host: public_ip
 ansible_host:           networkInterfaces[0].accessConfigs[0].natIP
 ansible_user:           "'sa_115528571027174573787'"

 # GCP compute label "activate_this" value => ansible variable "run_this" value
 run_this:    labels['activate_this']

Systemd healtcheck with side service and monotonic timer, auto-healing

2025-08-28T15:41:00.001-04:00

What : bypass the lack of healthcheck of systemd

systemd service "what-service.service"
systemd timer "what-service-healthcheck.timer"

triggers a systemd service "what-service-healthcheck.service"
which lanches a script "service_health_check.sh"
script that :

curl's heal-tcheck URL "HEALTH_CHECK_URL"
if KO, restart the targetted service

what-service-healthcheck.timer

[Unit]

Description=Run health check every 15 seconds

[Timer]

# Wait 1 minute after boot before the first check

OnBootSec=1min

# Run the check 15 seconds after the last time it finished

OnUnitActiveSec=15s

[Install]
WantedBy=timers.target

By default the timer service will trigger the unit service with the same name, no need to specify it.

what-service-healthcheck.service.j2

[Unit]

Description=Health Check for {{ what_service }}

Requires={{ what_service }}.service

[Service]

Type=oneshot

ExecStart=/usr/local/bin/service_health_check.sh

Restart=on-failure

OnFailure={{ what_service }}

service_health_check.sh

#!/bin/bash

# The health check endpoint

HEALTH_CHECK_URL="http://localhost:{{ running_port }}/health_check"

# Use curl to check the endpoint.

# --fail: Makes curl exit with a non-zero status code on server errors (4xx or 5xx).

# --silent: Hides the progress meter.

# --output /dev/null: Discards the response body.

if ! curl --silent --fail --max-time 2 --output /dev/null "$HEALTH_CHECK_URL"; then

echo "Health check failed for {{ service_name }}. Restarting..."

# Restart is performed on failure from healthcheck service

exit 1

Adding through ansible (to do : fix indentation, blog isn't great for this)

<role>/tasks/main.yml

---

- name: Generate what-service systemd file

ansible.builtin.template:

src: what-service.service.j2

dest: /etc/systemd/system/what-service.service

mode: "0755"

notify: Restart what-service

- name: Copy the health check script

ansible.builtin.copy:

src: service_health_check.sh

dest: /usr/local/bin/service_health_check.sh

owner: root

group: root

mode: '0755'

vars:

service_name: what-service

- name: Copy the health check systemd service file

ansible.builtin.copy:

src: what-service-healthcheck.service

dest: /etc/systemd/system/what-service-healthcheck.service

owner: root

group: root

mode: '0644'

notify: Reload systemd

- name: Copy the health check systemd timer file

ansible.builtin.copy:

src: what-service-healthcheck.timer

dest: /etc/systemd/system/what-service-healthcheck.timer

owner: root

group: root

mode: '0644'

notify: Reload systemd

- name: Enable and start the health check timer

ansible.builtin.systemd:

state: started

enabled: yes

daemon_reload: yes # Ensures systemd is reloaded before starting

<role>/handlers/main.yml

---

- name: Restart what-service
ansible.builtin.service:

state: restarted

daemon_reload: true

- name: Reload systemd

ansible.builtin.service:

daemon_reload: yes

- name: Restart what-service-healthcheck.timer

ansible.builtin.service:

state: restarted

daemon_reload: true

apt info - ansible tasks + roles to install apt_info.py automatically along node-exporter + Grafana dashboard

2025-07-24T16:44:00.004-04:00

Create a file with openmetrics values, so that it be exporter along node-exporter metrics.

=> script runs every 12h to report the status of apt packages to upgrade writes it in /var/lib/node_exporter/apt_info.prom

which is ingested by prometheus when calling node-exporter.

The metrics are used by a grafana dashboard available here : https://grafana.com/grafana/dashboards/23777-apt-ugrades/

```

---
- name: Monitoring probes - setup exporters running on each server
  hosts: all
  vars:
   become_user: root
   become: true

  tasks:
  # https://github.com/ncabatoff/process-exporter
   - name: Install .deb package of process-exporter
     ansible.builtin.apt:
      deb: https://github.com/ncabatoff/process-exporter/releases/download/v0.8.3/process-exporter_0.8.3_linux_amd64.deb
     become: true

   - name: Download and install apt_info.py
     ansible.builtin.get_url:
      url: https://raw.githubusercontent.com/prometheus-community/node-exporter-textfile-collector-scripts/refs/heads/master/apt_info.py
      dest: /usr/local/bin/apt_info.py
      mode: '0755'
     become: true

   - name: Install apt_info.py dependencies via apt
     ansible.builtin.apt:
      name: "{{ item }}"
      state: present
      update_cache: true
     become: true
     with_items:
      - python3-prometheus-client
      - python3-apt
      - cron

   - name: Add a cron job to run apt_info.py every 12 hours
     ansible.builtin.cron:
      name: "Run apt_info.py every 12 hours"
      minute: "0"
      hour: "*/12"
      job: "/usr/local/bin/apt_info.py > /var/lib/node_exporter/apt_info.prom"
     become: true
     ignore_errors: "{{ ansible_check_mode }}"

   - name: Ensure APT auto update is enabled
     ansible.builtin.copy:
      dest: /etc/apt/apt.conf.d/99_auto_apt_update.conf
      content: 'APT::Periodic::Update-Package-Lists "1";'
      owner: root
      group: root
      mode: '0644'
     become: true

  roles:
   # https://github.com/prometheus-community/ansible/tree/main/roles/node_exporter
   - name: prometheus.prometheus.node_exporter

   #  node_exporter_textfile_dir: "/var/lib/node_exporter" # default
```

SRE & monitoring of distributed systems

2025-05-29T06:19:00.005-04:00

Google SRE book, Chapter 6
https://sre.google/sre-book/monitoring-distributed-systems/

(and more globally, the whole Goolge SRE book explains a full methodology of SRE from monitoring to incident management)

2 different type of recommended monitoring : USE and RED

RED Method explained at GrafanaCon 2018 https://grafana.com/blog/2018/08/02/the-red-method-how-to-instrument-your-services/
USE Deep dive http://brendangregg.com/usemethod.html

Some cryptographic references and blockchain applications

2025-05-28T18:09:00.002-04:00

Boneh–Shoup A Graduate Course in Applied Cryptography

Preface: [...] This book is about exactly that: constructing practical cryptosystems for which we can argue security under plausible assumptions. The book covers many constructions for different tasks in cryptography. For each task we define a precise security goal that we aim to achieve and then present constructions that achieve the required goal. To analyze the constructions, we develop a unified framework for doing cryptographic proofs. A reader who masters this framework will be capable of applying it to new constructions that may not be covered in the book.[...]

Dan Boneh, Manu Drijvers, Gregory Neven Compact Multi-Signatures for Smaller Blockchains

Abstract: We construct new multi-signature schemes that provide new
functionality. Our schemes are designed to reduce the size of the Bitcoin
blockchain, but are useful in many other settings where multi-signatures
are needed. All our constructions support both signature compression
and public-key aggregation. Hence, to verify that a number of parties
signed a common message m, the verifier only needs a short multi-
signature, a short aggregation of their public keys, and the message m.
We give new constructions that are derived from Schnorr signatures and
from BLS signatures. Our constructions are in the plain public key model,
meaning that users do not need to prove knowledge or possession of their
secret key.

Rogue Key Attack in BLS Signature and Harmony Security

Intro: Consensus algorithm is one of the most important components in blockchain. Harmony Blockchain achieves consensus through the Fast Byzantine Fault Tolerance (FBFT) algorithm. In FBFT, instead of asking all validators to broadcast their votes, the leader runs a multi-signature signing process to collect the validators’ votes in a O(1)-sized multi-signature and then broadcast it to all validators. Consensus is reached when all the validators validate the aggregated signature against the aggregated public keys for this round of consensus.

(vrac / to edit / to format) Prometheus sandbox - demo / prometheus relabeling tool & ref / grafana demo

2025-05-28T18:09:00.001-04:00

* The Art of Metric Relabeling in Prometheus:

https://heiioncall.com/guides/the-art-of-metric-relabeling-in-prometheus

* relabeler online testing tool :
https://relabeler.promlabs.com/

* relabeling cookbook (mostly compatible with prometheus too) https://docs.victoriametrics.com/victoriametrics/relabeling/#how-to-remove-labels-from-targets

* open / demo instance of grafana : https://play.grafana.org/

* Grafana dashboards directory : https://grafana.com/grafana/dashboards/

* Open / demo instance of prometheus :

https://prometheus.demo.prometheus.io/query

https://prometheus.demo.prometheus.io/config

global: scrape_interval: 15s scrape_timeout: 10s scrape_protocols: - OpenMetricsText1.0.0 - OpenMetricsText0.0.1 - PrometheusText1.0.0 - PrometheusText0.0.4 evaluation_interval: 15s external_labels: environment: demo-prometheus-io.c.macro-mile-203600.internal runtime: gogc: 75 alerting: alertmanagers: - follow_redirects: true enable_http2: true scheme: http timeout: 10s api_version: v2 static_configs: - targets: - demo.prometheus.io:9093 rule_files: - /etc/prometheus/rules/*.yml - /etc/prometheus/rules/*.yaml - /etc/prometheus/rules/*.rules scrape_config_files: - /etc/prometheus/scrape_configs/* scrape_configs: - job_name: prometheus honor_timestamps: true track_timestamps_staleness: false scrape_interval: 15s scrape_timeout: 10s scrape_protocols: - OpenMetricsText1.0.0 - OpenMetricsText0.0.1 - PrometheusText1.0.0 - PrometheusText0.0.4 metrics_path: /metrics scheme: http enable_compression: true follow_redirects: true enable_http2: true static_configs: - targets: - demo.prometheus.io:9090 - job_name: random honor_timestamps: true track_timestamps_staleness: false scrape_interval: 15s scrape_timeout: 10s scrape_protocols: - OpenMetricsText1.0.0 - OpenMetricsText0.0.1 - PrometheusText1.0.0 - PrometheusText0.0.4 metrics_path: /metrics scheme: http enable_compression: true follow_redirects: true enable_http2: true file_sd_configs: - files: - /etc/prometheus/file_sd/random.yml refresh_interval: 5m - job_name: caddy honor_timestamps: true track_timestamps_staleness: false scrape_interval: 15s scrape_timeout: 10s scrape_protocols: - OpenMetricsText1.0.0 - OpenMetricsText0.0.1 - PrometheusText1.0.0 - PrometheusText0.0.4 metrics_path: /metrics scheme: http enable_compression: true follow_redirects: true enable_http2: true static_configs: - targets: - localhost:2019 - job_name: grafana honor_timestamps: true track_timestamps_staleness: false scrape_interval: 15s scrape_timeout: 10s scrape_protocols: - OpenMetricsText1.0.0 - OpenMetricsText0.0.1 - PrometheusText1.0.0 - PrometheusText0.0.4 metrics_path: /metrics scheme: http enable_compression: true follow_redirects: true enable_http2: true static_configs: - targets: - demo.prometheus.io:3000 - job_name: node honor_timestamps: true track_timestamps_staleness: false scrape_interval: 15s scrape_timeout: 10s scrape_protocols: - OpenMetricsText1.0.0 - OpenMetricsText0.0.1 - PrometheusText1.0.0 - PrometheusText0.0.4 metrics_path: /metrics scheme: http enable_compression: true follow_redirects: true enable_http2: true file_sd_configs: - files: - /etc/prometheus/file_sd/node.yml refresh_interval: 5m - job_name: alertmanager honor_timestamps: true track_timestamps_staleness: false scrape_interval: 15s scrape_timeout: 10s scrape_protocols: - OpenMetricsText1.0.0 - OpenMetricsText0.0.1 - PrometheusText1.0.0 - PrometheusText0.0.4 metrics_path: /metrics scheme: http enable_compression: true follow_redirects: true enable_http2: true file_sd_configs: - files: - /etc/prometheus/file_sd/alertmanager.yml refresh_interval: 5m - job_name: cadvisor honor_timestamps: true track_timestamps_staleness: true scrape_interval: 15s scrape_timeout: 10s scrape_protocols: - OpenMetricsText1.0.0 - OpenMetricsText0.0.1 - PrometheusText1.0.0 - PrometheusText0.0.4 metrics_path: /metrics scheme: http enable_compression: true follow_redirects: true enable_http2: true file_sd_configs: - files: - /etc/prometheus/file_sd/cadvisor.yml refresh_interval: 5m - job_name: blackbox honor_timestamps: true track_timestamps_staleness: false params: module: - http_2xx scrape_interval: 15s scrape_timeout: 10s scrape_protocols: - OpenMetricsText1.0.0 - OpenMetricsText0.0.1 - PrometheusText1.0.0 - PrometheusText0.0.4 metrics_path: /probe scheme: http enable_compression: true follow_redirects: true enable_http2: true relabel_configs: - source_labels: [__address__] separator: ; target_label: __param_target replacement: $1 action: replace - source_labels: [__param_target] separator: ; target_label: instance replacement: $1 action: replace - separator: ; target_label: __address__ replacement: 127.0.0.1:9115 action: replace static_configs: - targets: - http://localhost:9100

terraform Associate certification notes & links

2025-03-04T14:31:00.003-05:00

Terraform Associate exam is a 60-minute, multiple choice exam for beginner-level learners.

Terraform Authoring and Operations Professional exam is 4 hours long, lab-based with some MCQs, and intended for very experienced Terraform users.

All domains covered in terraform associate certification / more in-depth about what exam covers: https://developer.hashicorp.com/terraform/tutorials/certification-003
Learning path - https://developer.hashicorp.com/terraform/tutorials/certification-003/associate-study-003
Exam objectives https://developer.hashicorp.com/certifications/infrastructure-automation#terraform-associate-(003)-details
Content list - https://developer.hashicorp.com/terraform/tutorials/certification-003/associate-review-003
Sample questions - https://developer.hashicorp.com/terraform/tutorials/certification-003/associate-questions
Chris study notes : https://www.freecodecamp.org/news/terraform-certified-associate-003-study-notes/
Hashicorp discuss forum: https://discuss.hashicorp.com/c/terraform-core/27
official forum for Terraform newbies: HashiCorp Discuss: https://discuss.hashicorp.com/latest

Notice which questions have checkboxes, and for those, make sure you check the right number of boxes. This goes back to reading the whole question.

Some HCP topics covered at a basic level, specifically in objective 9, "Understanding HCP Terraform capabilities". You can learn more about exactly what topics are covered and how to study for them by reviewing our study materials: https://developer.hashicorp.com/terraform/tutorials/certification-003

How-to request extra time if English as a second language: instructions for requesting accommodations: https://hashicorp-certifications.zendesk.com/hc/en-us/articles/360046049832

Are the questions focused on AWS provider? exams are provider-agnostic when possible.

exam would be on which tf version? Product version tested: Terraform 1.0 or higher

operations-professional-details

You will need a GitHub account to register for your exam appointment.

Currently (march 2025) each Associate exam appointment is $70.50 USD. More about the administrative details of our Terraform exams here: https://developer.hashicorp.com/certifications/infrastructure-automation

How to purchase and schedule your appointment here: https://hashicorp-certifications.zendesk.com/hc/en-us/articles/360049215692

How to re-certify on this page: https://hashicorp-certifications.zendesk.com/hc/en-us/articles/9677396620941

If you already hold an unexpired Terraform Associate certification, and then pass Terraform Pro, you’re Associate certification expiration date will be extended.

What is the validity for this certification ? certifications are valid for two years
How many questions are on the 1-hour exam? We don't publish these details about the exam, but for the average test-taker, 60 minutes is enough time to answer every question we present. If you are concerned about time, you can see if you qualify for an accommodation here: https://hashicorp-certifications.zendesk.com/hc/en-us/articles/360046049832

Other certs

Current Terraform Pro certification is for AWS! Check out more here: https://developer.hashicorp.com/certifications/infrastructure-automation#terraform-authoring-and-
Study materials for the Terraform Authoring and Operations Professional exam: https://developer.hashicorp.com/terraform/tutorials/pro-cert

Vault Associate session coming up! https://www.hashicorp.com/en/events/webinars/vault-associate-exam-prep
Study resources for Vault Pro: https://developer.hashicorp.com/vault/tutorials/ops-pro-cert

removing unwanted typo systemd instance'd template units

2024-11-19T18:02:00.005-05:00

Systemd has this great feature :

file: foo@.service

contains the definition, as usual, with "%i"

=> will replace anything in the service file

for example:

systemctl start foo@bar.service

systemctl start foo@resto.service

=> will start service foo@bar and foo@resto

but if resto does not make a valid service, it fails and can't be easily removed from the list of apparently formerly existing services.

(cf. for example https://bbs.archlinux.org/viewtopic.php?id=286912&p=1 )

As you can see with the command :

systemctl list-units --type=service | grep 'foo'

UNIT LOAD ACTIVE SUB DESCRIPTION

foo@alpha.service loaded active running Foo for protocol alpha

● foo@lish.service masked failed failed foo@lish.service

=> Solution (on ubuntu, but no reason it does not work elsewhere)

systemctl mask foo@resto.service #this creates a symlink / replaces the symlink with one pointing to /dev/null, and marks the service as failed => no restart will happen again

systemctl reset-failed # cleans failed services

workshop - Intro to Creative Coding & Generative Art, by Ahmad Moussa (links)

2024-11-15T11:41:00.005-05:00

https://slides.com/ahmadmoussa-3/creative-coding-generative-art

by https://x.com/gorillasu

https://timeline.lerandom.art Generative Art Timeline

https://editor.p5js.org

https://x.com/gorillasu/status/1857444190910664749 example with p5js

https://openprocessing.org/sketch/2320206

example on fxHash https://www.fxhash.xyz/marketplace/generative/15063

colors palette : https://ronikaufman.github.io/color_pals/

colors manipulation js library : https://gka.github.io/chroma.js/

+ https://encycolorpedia.com/2b3c00

https://iquilezles.org/articles/distfunctions/ shapes and math

doc on fxHash : https://docs.fxhash.xyz/

Tricks :

- when playing with RGB, start from the median value 127.5 and move around +/- 127.5

- RGB + 2 chars => 2 chars of transparency

- cos/sin/tan [0..1] with frameCount native variable of p5js : use pi to divide values and have the last frame coincide with the first frame of the loop.

--- first example

let a = 1;

var b;

const windowWidth = 800;

const windowHeitgh = 800;

function setup() {

// attach a canvas element to the dom

createCanvas(windowWidth, windowHeitgh);

}

// runs continously for each frame of the video, unless noLoop() inside

function draw() {

// "#efface"

// "#decede"

background("#decede");

ellipse(100, 150, 100)

fill ("#efface")

rect (300, 200, 200)

noStroke()

stroke("blue")

}

-- animated

let a = 1;

var b;

const windowWidth = 400;

const windowHeitgh = windowWidth;

function setup() {

// attach a canvas element to the dom

createCanvas(windowWidth, windowHeitgh);

}

// runs continously for each frame of the video, unless noLoop() inside

function draw() {

// "#efface"

// "#decede"

background("#decede");

noStroke()

let t = frameCount

// for (let y = 0; y < 400; y=y+1){

// ellipse (200, y, 5)

// }

// console.log(frameCount/50)

for (let y = 0; y < 400; y=y+1){

fill(127.5 + sin (-frameCount/50 + y/20) * 127.5,

127.5 + sin (-frameCount/50 + y/20) * 127.5,

127.5 + sin (-frameCount/50 + y/20) * 127.5)

ellipse (200 + sin (-frameCount/50 + y/20) * 20,

20 + cos (frameCount/30 + y/10) * 10)

}

--- moving, and colors changing (by me, inspired by GorillaSun)

let a = 1;

var b;

const windowWidth = 400;

const windowHeitgh = windowWidth;

let variation = 0

let variation2 = 2

function setup() {

// attach a canvas element to the dom

createCanvas(windowWidth, windowHeitgh);

frameRate(50) // frame / s

randomSeed(0) // so that random always does the same

variation = random(0, 80)

variation2 = random(100, 80)

}

let loopLength = 75

// runs continously for each frame of the video, unless noLoop() inside

function draw() {

// "#efface"

// "#decede"

background("#decede");

// trick to

let t = ( frameCount % loopLength ) / loopLength * 2 * PI;

// console.log(sin(PI))

// noStroke()

// for (let y = 0; y < 400; y=y+1){

// ellipse (200, y, 5)

// }

// console.log(frameCount/50)

for (let y = 0; y < 400; y=y+1){

stroke (127.5 + sin (-t + y/variation) * 127.5,

127.5 + sin (-t + y/20) * 127.5,

127.5 + sin (-t + y/variation2) * 127.5)

// fill(127.5 + sin (-t/50 + y/20) * 127.5,

// 127.5 + sin (-t/50 + y/20),

// 127.5 + sin (-t/50 + y/20) * 127.5)

noFill()

square (200 + sin (-t/50 + y/variation) * 20,

200 + tan (-t/50 + y/variation) * variation*variation/3,

20 + cos (t/30 + y/variation) * variation)

}

function keyPressed(){

console.log(keyCode)

if (keyCode == 56){

saveGif('annimation', 4)

}

--- other links and code from the presentation

json_exporter prometheus debug

2024-10-03T10:11:00.005-04:00

JSON url to convert : http://json_url/foobar.json

json_exporter running locally : localhost:7979 or json_exporter:7979

Status of the json_exporter, does NOT contain the metrics from the targets, only related to the process itself (useful to know if it's up or not for example).

localhost:7979/metrics

Check the result of a JSON URL to be converted / aka. what prometheus should scrape

curl http://json_url/foobar.json => JSON (original)

curl localhost:7979/probe?target=https://json_url/foobar.json => openmetrics converted by json_exporter

Other useful commands :

* edit, restart, wait, check json_exporter output

sudo vi /etc/json_exporter/config.yml && sudo systemctl restart json_exporter && sleep 5 && curl http://localhost:7979/probe?target=http://json_url/foobar.json

* edit, check and restart prometheus :

sudo vi /etc/prometheus/prometheus.yml && sudo promtool check config /etc/prometheus/prometheus.yml && sudo systemctl restart prometheus.service

Google Spreadsheet conditional formatting for week days check (display weekends with a different color)

2024-09-09T12:07:00.006-04:00

Goal:

I have a column of dates that I want to format so that weekends are in a different color.

Solution :

conditional formatting and the formula =OR(WEEKDAY(A1)=7;WEEKDAY(A1)=1)

GCP+ansible+gitlab-ci : OS-login for ansible with dynamic google compute inventory and gitlab-ci

2024-08-19T17:59:00.007-04:00

"How to configure OS Login in GCP for Ansible" + ansible dynamic inventory for GCP compute + update on accepted cryptographic algo for SSH key + gitlab-ci example

Context:

2024 update on https://alex.dzyoba.com/blog/gcp-ansible-service-account/ => thanks ! this still works, but the ssk-keygen by default doesn't provide keys that are accepted by gcp os-login.

+ updated precisions that took me too much time to infer, understood after reading : https://cloud.google.com/compute/docs/connect/create-ssh-keys => the SSH keys need to be in ssh-rsa !

+ ansible dynamic inventory configuration (as of 2024-aug)

+ automation example with gitlab-ci (as of 2024-aug)

Note: For the sake of completeness, ease of reproduction by the reader and leveraging the CC-BY-SA copyright, I include the sections of the great blog post cited as [1] and add my contributions when and where I needed too.

Service account

(cf. [1] - no change so far) OS Login allows SSH access for IAM users - there is no need to provision Linux users on an instance.
So Ansible should have access to the instances via IAM user. This is accomplished via IAM service account.
You can create service account via Console (web UI), via Terraform template or (as in [this] case) via gcloud:
$ gcloud iam service-accounts create ansible-sa \
     --display-name "Service account for Ansible"

(cf. [1,5,6] - no change so far)

Now, the trickiest part – configuring OS Login for service account.

0. Enable OS Login for all VMs in the project

Before you do anything else make sure to enable it for your project:
$ gcloud compute project-info add-metadata \
    --metadata enable-oslogin=TRUE

1. Add roles

Fresh service account don't have any IAM roles, so ansible-sa doesn’t have permission to do anything. To allow OS Login we have to add these 4 roles to the Ansible service account:

Compute Instance Admin (beta)

Compute Instance Admin (v1) => login as root (for "become: true" with ansible)

Compute OS Admin Login => login as a regular user

Service Account User

Here is how to do it via gcloud:
for role in \
    'roles/compute.instanceAdmin' \
    'roles/compute.instanceAdmin.v1' \
    'roles/compute.osAdminLogin' \
    'roles/iam.serviceAccountUser'
do \
    gcloud projects add-iam-policy-binding \
        my-gcp-project-241123 \
        --member='serviceAccount:ansible-sa@my-gcp-project-241123.iam.gserviceaccount.com' \
        --role="${role}"
done

2. Create key for service account and save it

Service account is useless without key, create one with gcloud, and save it, we will use it for the dynamic inventory connection further down the path.
This will create GCP key, not the SSH key.
$ gcloud iam service-accounts keys create \
    .gcp/gcp-key-ansible-sa.json \
    --iam-account=ansible-sa@my-gcp-project.iam.gserviceaccount.com 

3. Create SSH key for service account

(cf. [1] modified ! with command from [2])
This [was supposed] the easiest part. $ ssh-keygen -f ssh-key-ansible-sa

By default ssh-keygen provided an ssh-ed25519 ssh key, leading to a Permission denied (publickey) when trying to connect with Ansible and OS-login (but no issue when connecting directly from the command-line). Specify `-t rsa` when creating your SSH keys.

$ ssh-keygen -t rsa -f ssh-key-ansible-sa -b 2048

4. Add SSH key for OS login to service account

(cf. [1] - no change) Now, to allow service account to access instances via SSH it has to have SSH public key added to it. To do this, first, we have to activate service account in gcloud:
$ gcloud auth activate-service-account \
    --key-file=.gcp/gcp-key-ansible-sa.json
This command uses GCP key we’ve created on step 2.
Now we add SSH key to the service account:
$ gcloud compute os-login ssh-keys add \
    --key-file=ssh-key-ansible-sa.pub

5. Switch back from service account

(cf. [1] - no change)

$ gcloud config set account your@gmail.com

Connecting to the instance with OS login

(cf. [1] - with change to the command to bypass the ssh-agent)

Now, we have everything configured on the GCP side, we can check that it’s working.
Note, that you don’t need to add SSH key to compute metadata, authentication works via OS login. But this means that you need to know a special user name for the service account.
Find out the service account id.

$ gcloud iam service-accounts describe \
    ansible-sa@my-gcp-project.iam.gserviceaccount.com \
    --format='value(uniqueId)'
106627723496398399336

This id is used to form user name in OS login – it’s sa_<unique_id>.

Here is how to use it to check SSH access is working,

Specify the RSA private key, and to bypass the ssh-agent, specify to only test the identity provided in the command (IdentitiesOnly=yes), not all the keys you may have loaded in your running ssh-agent.

$ ssh -o "IdentitiesOnly=yes" -i ssh-key-ansible-sa sa_106627723496398399336@10.0.0.44
...

Configuring Ansible

 Ansible GCP static inventory

(cf. [1] - no change for static inventory, more on dynamic inventory just after)

And for the final part – make Ansible work with it.
There is a special variable ansible_user that sets user name for SSH when Ansible connects to the host.
In my case, I have a group gcp where all GCP instances are added, and so I can set ansible_user in group_vars like this:

# File inventory/dev/group_vars/gcp
ansible_user: sa_106627723496398399336



(thanks a lot to [1]'s author Alex Dzyoba, those previous steps helped me a lot in going this far ! now, let's add dynamic inventory and how I run it from gitlab-ci...) 

Ansible GCP dynamic inventory
The compose section of the dynamic GCP inventory ansible plugin (google.cloud.gcp_compute, cf. [3]) expects a jinga2 template, to pass a variable directly, you need to double escape it:

 ansible_user: "'sa_106627723496398399336'"

#example of inventory.gcp.yml

---
plugin: google.cloud.gcp_compute

projects:
 - your-gcp-project

auth_kind: serviceaccount
# must match `ansible_user` below, json file must be available
service_account_file: ./.gcp/gcp-key-ansible-sa.json

filters:
 - status = RUNNING

keyed_groups:
  - key: labels
    prefix: label
  - key: zone
    prefix: zone
  - key: project
    prefix: project
  - key: labels['compoment']
    prefix: component

compose:
 ansible_host:           networkInterfaces[0].accessConfigs[0].natIP
 ansible_user:           "'sa_106627723496398399336'"

Configuring Ansible (ansible.cfg ssh_args)
Make sure to instruct ansible to use the correct private key when connecting to the servers
ssh_args = -i ssh-key-ansible-sa 

#file ansible.cfg :

[defaults]
;debug = true
roles_path = ./vendor-roles:./roles
collections_path = ./vendor-collections:./collections
stdout_callback = yaml
deprecation_warnings = True
host_key_checking = False
forks = 10
callbacks_enabled = timer, profile_tasks, profile_roles
;remote_user = sa_106627723496398399336

remote_tmp = /tmp

[ssh_connection]
pipelining = True
scp_if_ssh = True
ssh_args = -i ssh-key-ansible-sa

Gitlab-ci example

Identify an image that has ansible installed (and maintained), I used registry.gitlab.com/gitlab-org/gitlab-environment-toolkit:latest but if you find other /lighter one, let me know !

Gitlab-ci secret files [4] doc is set from the gitlab project's configuration, in the CI settings and doc can be found here https://docs.gitlab.com/ee/ci/secure_files/index.html

Using gitlab-ci feature secret files [4], store the ssh RSA secret key (for ssh)
Using gitlab-ci feature secret files [4], store the GCP json file for GCP authentication (for dynamic inventory).
We gather the files in the prepare_ssh_ansible job

If you have multiple jobs using Ansible, factorize (here in the prepare_ssh_ansible job), and extends, here in the ssh-access, ansible-ping, ansible-inventory)

Example playbook, in this case, is located in ~/ansible/playbook/ssh.yml; replace with your own playbook).

# file: .gitlab-ci.yml

variables:
  ANSIBLE_DYN_INVENTORY      : "inventory.gcp.yml"
  ANSIBLE_CHECK              : "--check -vvv"
  SECURE_FILES_DOWNLOAD_PATH: './secured_files/'

prepare_ssh_ansible:
  # image: librespace/ansible:9.6.0
  image: registry.gitlab.com/gitlab-org/gitlab-environment-toolkit:latest
  before_script:
    # install missing packages
    - apt update --allow-releaseinfo-change -y -qq && apt install -y ansible curl bash jq

    # gitlab-ci secured_files (cf [4]) for GCP service account credentials
    - curl --silent "https://gitlab.com/gitlab-org/incubation-engineering/mobile-devops/download-secure-files/-/raw/main/installer" | bash
    - mkdir ./ansible/.gcp/
    - cp ${SECURE_FILES_DOWNLOAD_PATH}/gcp-key-ansible-sa.json ./ansible/.gcp/gcp-key-ansible-sa.json
    - cp ${SECURE_FILES_DOWNLOAD_PATH}/ssh-key-ansible-sa ./ansible/ssh-key-ansible-sa && chmod 400 ./ansible/ssh-key-ansible-sa

    # cf https://docs.ansible.com/ansible/9/scenario_guides/guide_gce.html#providing-credentials-as-environment-variables
    - export GCP_AUTH_KIND="serviceaccount"
    - export GCP_SERVICE_ACCOUNT_FILE="./ansible/.gcp/gcp-key-ansible-sa.json"
    - export GCP_SCOPES="https://www.googleapis.com/auth/compute"

    - export ANSIBLE_HOME=./ansible
    - cd ./ansible/
    - export ANSIBLE_CONFIG=./ansible.cfg
    
    - ansible-galaxy            install -r requirements.yaml --roles-path ./vendor-roles
    - ansible-galaxy collection install -r requirements.yaml -p ./vendor-collections/
    - ansible --version

ansible-inventory:
  extends:
    .prepare_ssh_ansible    
  script:
    - ansible-inventory -i ${ANSIBLE_DYN_INVENTORY}  --graph

ansible-ping:
  extends:
    .prepare_ssh_ansible    
  script:
    - ansible all -i ${ANSIBLE_DYN_INVENTORY} -m ping -vvv

ssh-access:
  extends:
    .prepare_ssh_ansible    
  script:
    - ansible-playbook -i ${ANSIBLE_DYN_INVENTORY} playbooks/ssh.yml

References :

[1] https://alex.dzyoba.com/blog/gcp-ansible-service-account/

[2] https://cloud.google.com/compute/docs/connect/create-ssh-keys

[3] https://docs.ansible.com/ansible/latest/collections/google/cloud/gcp_compute_inventory.html

[4] https://docs.gitlab.com/ee/ci/secure_files/index.html

[5] https://cloud.google.com/compute/docs/oslogin

[6] https://cloud.google.com/compute/docs/oslogin/set-up-oslogin

Emacs packages

2024-07-31T19:47:00.004-04:00

https://melpa.org/

Engineering blogs (2024)

2024-06-04T15:18:00.004-04:00

• Engineering at Microsoft: https://devblogs.microsoft.com/engineering-at-microsoft/

• Github: https://github.blog/category/engineering/

• LinkedIn Engineering: https://www.linkedin.com/blog/engineering

• AWS Architecture: https://aws.amazon.com/blogs/architecture/

• Slack: https://slack.engineering/

• Nextflix Tech: https://netflixtechblog.com/

• Spotify: https://engineering.atspotify.com/

• Meta: https://engineering.fb.com

• Instagram: https://instagram-engineering.com/

• Uber: https://www.uber.com/en-CH/blog/

• Lyft: https://eng.lyft.com/

• Airbnb: https://medium.com/airbnb-engineering

• Yelp: https://engineeringblog.yelp.com/

• Twitter: https://blog.x.com/engineering/en_us

• Pinterest: https://medium.com/pinterest-engineering

• Canva: https://www.canva.dev/blog/engineering/

• Shopify: https://shopify.engineering/

• Reddit: https://www.reddit.com/r/RedditEng/

• Reddit: https://www.reddit.com/r/RedditEng/?rdt=65525

• Stripe: https://stripe.com/blog/engineering

• Discord: https://discord.com/blog

• Databricks: https://www.databricks.com/blog/category/engineering

• Hotstar: https://blog.hotstar.com

• MongoDB: https://www.mongodb.com/blog/channel/engineering-blog

• Dropbox: https://dropbox.tech

list of awesome jq tools

2024-05-22T16:46:00.003-04:00

from https://github.com/fiatjaf/awesome-jq?tab=readme-ov-file#tools

example:

https://github.com/jcsalterego/jqq/ interactive json path explorer `jqq <expr> file>

DNS debugging

2024-05-22T16:06:00.009-04:00

Doing some digging about why a specific DNS wasn't propagating properly everywhere, I found out that it was related to a wrong DNSSEC declaration.

Tool to check if the DNS record is properly propagated https://www.whatsmydns.net
Debug DNS settings & DNSSEC settings

a bit more details about DNSSEC

https://blog.ovhcloud.com/an-introduction-to-dnssec/

DNS DNSKEY and DS records "The DNSKEY and DS records are used by DNSSEC resolvers to verify the authenticity of DNS records."

https://www.cloudflare.com/learning/dns/dns-records/dnskey-ds-records/

some debuging steps

https://serverfault.com/questions/1018543/dns-not-resolving-in-all-locations-after-a-week

RFC 1178. Choosing a Name for Your Computer (c ACM 1989)

2024-04-07T09:32:00.004-04:00

RFC 1178

Informational

Network Working Group D. Libes

Request for Comments: 1178 Integrated Systems Group/NIST

FYI: 5 August 1990

Choosing a Name for Your Computer

Status of this Memo

This FYI RFC is a republication of a Communications of the ACM

article on guidelines on what to do and what not to do when naming

your computer [1]. This memo provides information for the Internet

community. It does not specify any standard.

Distribution of this memo is unlimited.

Abstract

In order to easily distinguish between multiple computers, we give

them names. Experience has taught us that it is as easy to choose

bad names as it is to choose good ones. This essay presents

guidelines for deciding what makes a name good or bad.

Keywords: domain name system, naming conventions, computer

administration, computer network management

Introduction

As soon as you deal with more than one computer, you need to

distinguish between them. For example, to tell your system

administrator that your computer is busted, you might say, "Hey Ken.

Goon is down!"

Computers also have to be able to distinguish between themselves.

Thus, when sending mail to a colleague at another computer, you might

use the command "mail libes@goon".

In both cases, "goon" refers to a particular computer. How the name

is actually dereferenced by a human or computer need not concern us

here. This essay is only concerned with choosing a "good" name. (It

is assumed that the reader has a basic understanding of the domain

name system as described by [2].)

By picking a "good" name for your computer, you can avoid a number of

problems that people stumble over again and again.

Here are some guidelines on what NOT to do.

Libes [Page 1]

RFC 1178 Name Your Computer August 1990

Don't overload other terms already in common use.

Using a word that has strong semantic implications in the

current context will cause confusion. This is especially true

in conversation where punctuation is not obvious and grammar is

often incorrect.

For example, a distributed database had been built on top of

several computers. Each one had a different name. One machine

was named "up", as it was the only one that accepted updates.

Conversations would sound like this: "Is up down?" and "Boot

the machine up." followed by "Which machine?"

While it didn't take long to catch on and get used to this

zaniness, it was annoying when occasionally your mind would

stumble, and you would have to stop and think about each word

in a sentence. It is as if, all of a sudden, English has

become a foreign language.

Don't choose a name after a project unique to that machine.

A manufacturing project had named a machine "shop" since it was

going to be used to control a number of machines on a shop

floor. A while later, a new machine was acquired to help with

some of the processing. Needless to say, it couldn't be called

"shop" as well. Indeed, both machines ended up performing more

specific tasks, allowing more precision in naming. A year

later, five new machines were installed and the original one

was moved to an unrelated project. It is simply impossible to

choose generic names that remain appropriate for very long.

Of course, they could have called the second one "shop2" and so

on. But then one is really only distinguishing machines by

their number. You might as well just call them "1", "2", and

"3". The only time this kind of naming scheme is appropriate

is when you have a lot of machines and there are no reasons for

any human to distinguish between them. For example, a master

computer might be controlling an array of one hundred

computers. In this case, it makes sense to refer to them with

the array indices.

While computers aren't quite analogous to people, their names

are. Nobody expects to learn much about a person by their

name. Just because a person is named "Don" doesn't mean he is

the ruler of the world (despite what the "Choosing a Name for

your Baby" books say). In reality, names are just arbitrary

tags. You cannot tell what a person does for a living, what

their hobbies are, and so on.

Libes [Page 2]

RFC 1178 Name Your Computer August 1990

Don't use your own name.

Even if a computer is sitting on your desktop, it is a mistake

to name it after yourself. This is another case of

overloading, in which statements become ambiguous. Does "give

the disk drive to don" refer to a person or computer?

Even using your initials (or some other moniker) is

unsatisfactory. What happens if I get a different machine

after a year? Someone else gets stuck with "don" and I end up

living with "jim". The machines can be renamed, but that is

excess work and besides, a program that used a special

peripheral or database on "don" would start failing when it

wasn't found on the "new don".

It is especially tempting to name your first computer after

yourself, but think about it. Do you name any of your other

possessions after yourself? No. Your dog has its own name, as

do your children. If you are one of those who feel so inclined

to name your car and other objects, you certainly don't reuse

your own name. Otherwise you would have a great deal of

trouble distinguishing between them in speech.

For the same reason, it follows that naming your computer the

same thing as your car or another possession is a mistake.

Don't use long names.

This is hard to quantify, but experience has shown that names

longer than eight characters simply annoy people.

Most systems will allow prespecified abbreviations, but why not

choose a name that you don't have to abbreviate to begin with?

This removes any chance of confusion.

Avoid alternate spellings.

Once we called a machine "czek". In discussion, people

continually thought we were talking about a machine called

"check". Indeed, "czek" isn't even a word (although "Czech"

is).

Purposely incorrect (but cute) spellings also tend to annoy a

large subset of people. Also, people who have learned English

as a second language often question their own knowledge upon

seeing a word that they know but spelled differently. ("I

guess I've always been spelling "funxion" incorrectly. How

embarrassing!")

Libes [Page 3]

RFC 1178 Name Your Computer August 1990

By now you may be saying to yourself, "This is all very

silly...people who have to know how to spell a name will learn

it and that's that." While it is true that some people will

learn the spelling, it will eventually cause problems

somewhere.

For example, one day a machine named "pythagoris" (sic) went

awry and began sending a tremendous number of messages to the

site administrator's computer. The administrator, who wasn't a

very good speller to begin with, had never seen this machine

before (someone else had set it up and named it), but he had to

deal with it since it was clogging up the network as well as

bogging down his own machine which was logging all the errors.

Needless to say, he had to look it up every time he needed to

spell "pythagoris". (He suspected there was an abbreviation,

but he would have had to log into yet another computer (the

local nameserver) to find out and the network was too jammed to

waste time doing that.)

Avoid domain names.

For technical reasons, domain names should be avoided. In

particular, name resolution of non-absolute hostnames is

problematic. Resolvers will check names against domains before

checking them against hostnames. But we have seen instances of

mailers that refuse to treat single token names as domains.

For example, assume that you mail to "libes@rutgers" from

yale.edu. Depending upon the implementation, the mail may go

to rutgers.edu or rutgers.yale.edu (assuming both exist).

Avoid domain-like names.

Domain names are either organizational (e.g., cia.gov) or

geographical (e.g., dallas.tx.us). Using anything like these

tends to imply some connection. For example, the name "tahiti"

sounds like it means you are located there. This is confusing

if it is really somewhere else (e.g., "tahiti.cia.gov is

located in Langley, Virginia? I thought it was the CIA's

Tahiti office!"). If it really is located there, the name

implies that it is the only computer there. If this isn't

wrong now, it inevitably will be.

There are some organizational and geographical names that work

fine. These are exactly the ones that do not function well as

domain names. For example, amorphous names such as rivers,

mythological places and other impossibilities are very

suitable. ("earth" is not yet a domain name.)

Libes [Page 4]

RFC 1178 Name Your Computer August 1990

Don't use antagonistic or otherwise embarrassing names.

Words like "moron" or "twit" are good names if no one else is

going to see them. But if you ever give someone a demo on your

machine, you may find that they are distracted by seeing a

nasty word on your screen. (Maybe their spouse called them

that this morning.) Why bother taking the chance that they

will be turned off by something completely irrelevant to your

demo.

Don't use digits at the beginning of the name.

Many programs accept a numerical internet address as well as a

name. Unfortunately, some programs do not correctly

distinguish between the two and may be fooled, for example, by

a string beginning with a decimal digit.

Names consisting entirely of hexadecimal digits, such as

"beef", are also problematic, since they can be interpreted

entirely as hexadecimal numbers as well as alphabetic strings.

Don't use non-alphanumeric characters in a name.

Your own computer may handle punctuation or control characters

in a name, but most others do not. If you ever expect to

connect your computer to a heterogeneous network, you can count

on a variety of interpretations of non-alphanumeric characters

in names. Network conventions on this are surprisingly

nonstandard.

Don't expect case to be preserved.

Upper and lowercase characters look the same to a great deal of

internet software, often under the assumption that it is doing

you a favor. It may seem appropriate to capitalize a name the

same way you might do it in English, but convention dictates

that computer names appear all lowercase. (And it saves

holding down the shift key.)

Now that we've heard what not to do, here are some suggestions on

names that work well.

Use words/names that are rarely used.

While a word like "typical" or "up" (see above) isn't computer

jargon, it is just too likely to arise in discussion and throw

off one's concentration while determining the correct referent.

Instead, use words like "lurch" or "squire" which are unlikely

Libes [Page 5]

RFC 1178 Name Your Computer August 1990

to cause any confusion.

You might feel it is safe to use the name "jose" just because

no one is named that in your group, but you will have a problem

if you should happen to hire Jose. A name like "sphinx" will

be less likely to conflict with new hires.

Use theme names.

Naming groups of machines in a common way is very popular, and

enhances communality while displaying depth of knowledge as

well as imagination. A simple example is to use colors, such

as "red" and "blue". Personality can be injected by choices

such as "aqua" and "crimson".

Certain sets are finite, such as the seven dwarfs. When you

order your first seven computers, keep in mind that you will

probably get more next year. Colors will never run out.

Some more suggestions are: mythical places (e.g., Midgard,

Styx, Paradise), mythical people (e.g., Procne, Tereus, Zeus),

killers (e.g., Cain, Burr, Boleyn), babies (e.g., colt, puppy,

tadpole, elver), collectives (e.g., passel, plague, bevy,

covey), elements (e.g., helium, argon, zinc), flowers (e.g.,

tulip, peony, lilac, arbutus). Get the idea?

Use real words.

Random strings are inappropriate for the same reason that they

are so useful for passwords. They are hard to remember. Use

real words.

Don't worry about reusing someone else's hostname.

Extremely well-known hostnames such as "sri-nic" and "uunet"

should be avoided since they are understood in conversation as

absolute addresses even without a domain. In all other cases,

the local domain is assumed to qualify single-part hostnames.

This is similar to the way phone numbers are qualified by an

area code when dialed from another area.

In other words, if you have choosen a reasonable name, you do

not have to worry that it has already been used in another

domain. The number of hosts in a bottom-level domain is small,

so it shouldn't be hard to pick a name unique only to that

domain.

Libes [Page 6]

RFC 1178 Name Your Computer August 1990

There is always room for an exception.

I don't think any explanation is needed here. However, let me

add that if you later decide to change a name (to something

sensible like you should have chosen in the first place), you

are going to be amazed at the amount of pain awaiting you. No

matter how easy the manuals suggest it is to change a name, you

will find that lots of obscure software has rapidly accumulated

which refers to that computer using that now-ugly name. It all

has to be found and changed. People mailing to you from other

sites have to be told. And you will have to remember that

names on old backup media labels correspond to different names.

I could go on but it would be easier just to forget this

guideline exists.

Conclusion

Most people don't have the opportunity to name more than one or two

computers, while site administrators name large numbers of them. By

choosing a name wisely, both user and administrator will have an

easier time of remembering, discussing and typing the names of their

computers.

I have tried to formalize useful guidelines for naming computers,

along with plenty of examples to make my points obvious. Having been

both a user and site administrator, many of these anecdotes come from

real experiences which I have no desire to relive. Hopefully, you

will avoid all of the pitfalls I have discussed by choosing your

computer's name wisely.

Credits

Thanks to the following people for suggesting some of these

guidelines and participating in numerous discussions on computer

naming: Ed Barkmeyer, Peter Brown, Chuck Hedrick, Ken Manheimer, and

Scott Paisley.

This essay first appeared in the Communications of the ACM, November,

1989, along with a Gary Larson cartoon reprinted with permission of

United Press Syndicate. The text is not subject to copyright, since

it is work of the National Institute of Standards and Technology.

However, the author, CACM, and NIST request that this credit appear

with the article whenever it is reprinted.

Libes [Page 7]

RFC 1178 Name Your Computer August 1990

References

[1] Libes, D., "Choosing a Name for Your Computer", Communications

of the ACM, Vol. 32, No. 11, Pg. 1289, November 1989.

[2] Mockapetris, P., "Domain Names - Concepts and Facilities",

RFC 1034, USC/Information Sciences Institute, November 1987.

Security Considerations

Security issues are not discussed in this memo.

Author's Address

Don Libes

Integrated Systems Group

National Institute of Standards and Technology

Gaithersburg, MD 20899

Phone: (301) 975-3535

EMail: libes@cme.nist.gov

Libes [Page 8]

RFC 1178

Informational

Document type

RFC Informational

August 1990

Select version

RFC 1178

Author

Don Libes

RFC stream

Legacy stream

Other formats

terminology: VUCA

2024-03-26T14:32:00.000-04:00

VUCA environments = volatile, uncertain, complex and ambiguous (VUCA)

CI/CD and secure supply chain

2024-03-26T10:52:00.002-04:00

https://www.sigstore.dev/ ( & cosig https://github.com/sigstore/cosign )

https://in-toto.io/

(cf. red hat trusted software supply chain which actually embeds those open source tools)

+ backstage.io for "platform engineering"

git pre-commit hooks library

2024-02-29T09:24:00.003-05:00

cf. https://codimd.nomadic-labs.com/p/YcXmjg1qv#/4

pre-commit is a tool that helps to configure git pre-commit hooks, with an abundance of already configured scripts

pre-commit install and configuration

Install in system

(apt-get / brew ) install pre-commit

install in repo

then in each repo clone (set-up pre-commit for this repo):

pre-commit install

then (configure) edit .pre-commit-config.yaml

.pre-commit-config.yaml example (from https://gitlab.com/tezos/tezos/-/blob/master/.pre-commit-config.yaml?ref_type=heads )

# See https://pre-commit.com for more information
# See https://pre-commit.com/hooks.html for more hooks
repos:
- repo: https://github.com/pre-commit/pre-commit-hooks
rev: v3.2.0
hooks:
- id: trailing-whitespace
- id: end-of-file-fixer
- repo: https://github.com/koalaman/shellcheck-precommit
rev: v0.9.0
hooks:
- id: shellcheck
args: [ "--external-sources" ]
- repo: https://github.com/cisagov/pre-commit-shfmt
rev: v0.0.2
hooks:
- id: shfmt
# These settings must mirror the ones set in `scripts/lint.sh`.
args: [ "-i", "2", "-sr", "-d" ]
- repo: https://github.com/arenadotio/pre-commit-ocamlformat
rev: 0439858
hooks:
- id: ocamlformat
args: [ "-i" ]
- repo: https://github.com/hadolint/hadolint
rev: v2.9.3
hooks:
- id: hadolint-docker
- repo: https://github.com/python-jsonschema/check-jsonschema
rev: 0.28.0
hooks:
- id: check-gitlab-ci
args: ["--verbose"]
files: '(\.gitlab-ci\.yml|\.gitlab/ci/.*\.yml)'

General Notes about pre-commits

runs only against staged files

to run manually :

pre-commit run --all-files

to run 1 check specifically (example : run only 1 plugin (shfmt) )

pre-commit run shfmt

Commandes en Vrac

Managing kubeconfig files + download from Rancher

Managing kubeconfig files across multiple Rancher clusters

Directory layout

Downloading kubeconfigs from Rancher

Auto-discovery in .bashrc

Testing connectivity

Putting it all together

Reverse-engineering Ropvacnic S1 vacuum for homeassistant integration

Integrating the Ropvacnic S1 into Home Assistant via LocalTuya

Step 1 — Tuya IoT Platform Setup

Step 2 — Discover DPs with tinytuya

Complete DP Map — Ropvacnic S1

Step 3 — LocalTuya Entity Configuration

Step 4 — Fix vacuum.py (LocalTuya bug)

Step 5 — Fix config via Terminal (if GUI doesn't save)

Final Result

UN / unodc elearning

[ref] Chainguard 101

Image magick, reduce size of jpg files by 50%

Ansible : GCP Google Cloud (Compute) ansible dynamic inventory with cache

Systemd healtcheck with side service and monotonic timer, auto-healing

apt info - ansible tasks + roles to install apt_info.py automatically along node-exporter + Grafana dashboard

SRE & monitoring of distributed systems

Some cryptographic references and blockchain applications

(vrac / to edit / to format) Prometheus sandbox - demo / prometheus relabeling tool & ref / grafana demo

terraform Associate certification notes & links

removing unwanted *typo* systemd instance'd template units

workshop - Intro to Creative Coding & Generative Art, by Ahmad Moussa (links)

--- other links and code from the presentation

json_exporter prometheus debug

Google Spreadsheet conditional formatting for week days check (display weekends with a different color)

GCP+ansible+gitlab-ci : OS-login for ansible with dynamic google compute inventory and gitlab-ci

Service account

Configure OS Login

0. Enable OS Login for all VMs in the project

1. Add roles

2. Create key for service account and save it

3. Create SSH key for service account

4. Add SSH key for OS login to service account

5. Switch back from service account

Connecting to the instance with OS login

Configuring Ansible

Ansible GCP static inventory

(cf. [1] - no change for static inventory, more on dynamic inventory just after)

(thanks a lot to [1]'s author Alex Dzyoba, those previous steps helped me a lot in going this far ! now, let's add dynamic inventory and how I run it from gitlab-ci...)

Ansible GCP dynamic inventory

Configuring Ansible (ansible.cfg ssh_args)

Gitlab-ci example

References :

Emacs packages

Engineering blogs (2024)

list of awesome jq tools

DNS debugging

RFC 1178. Choosing a Name for Your Computer (c ACM 1989)

terminology: VUCA

CI/CD and secure supply chain

git pre-commit hooks library

pre-commit install and configuration

General Notes about pre-commits

removing unwanted typo systemd instance'd template units