In this post, I’ll build a Talos Linux Kubernetes cluster on Proxmox with Cilium as the CNI, and use BGP to announce LoadBalancer Services to a MikroTik router. The router learns a route to every Service IP through each of the workers, and spreads the traffic across them with ECMP. On top of that, the Cilium Gateway routes host names to applications behind a single IP.
In this post, I’ll take the Talos cluster from the previous post and move its Kubernetes API endpoint from the IP of the control plane node to a virtual IP, using the built-in Layer 2 VIP in Talos. The cluster keeps running during the change.
In this post, I’ll walk through creating a small Talos Linux Kubernetes cluster on Proxmox VE, with one control plane and two workers. No Cilium, no Cluster API, just three VMs, talosctl and the defaults Talos ships with.
In this post, I’ll walk through configuring Network UPS Tools on a Proxmox host, from getting the UPS recognized over USB to triggering a clean shutdown after a set amount of time on battery, instead of waiting until the battery is nearly empty.
A quick tutorial on how to remove the "No valid subscription" nag message from the Proxmox web UI, and make it stick across updates.
In this post, I’ll demonstrate how to configure an Azure App Registration with federated credentials and configure OAuth2 Proxy to use Kubernetes-issued workload identity tokens to authenticate itself during an OpenID Connect login flow.
Workload Identity Federation is rapidly becoming the modern standard for authenticating workloads. In this post, I will configure the Crossplane AzureAD provider to use a Kubernetes-issued service account token to authenticate to Azure, eliminating the need for long-lived secrets.
In this blog post, I’ll walk you through an example of creating an Azure App Registration with a Federated Credential that trusts tokens issued by my Kubernetes cluster. I’ll then exchange that token for an Azure token and use it to make an API call to retrieve information about my own user.
In a previous post, I showed how to set up a simple HTTP file server using Caddy with Basic Authentication. In this post, I replace Basic Auth with GoGatekeeper as an authentication proxy and demonstrate how to implement path-based authorization using Keycloak roles assigned via group membership.
In this blog post, I’ll show how to set up Workload Identity Federation between a non-GKE Kubernetes cluster and Google Cloud Platform. This setup allows an application running in Kubernetes to use its Kubernetes service account to impersonate a Google service account and access cloud resources.