For a long time, Sealed Secrets was our go-to solution for managing confidential data like database credentials, tokens and private keys within Kubernetes. However, as our operations grew, the operational overhead of this approach led us to migrate to External Secrets. This transition has significantly streamlined our workflow, enhanced our security posture during credential rotations,…
Read MoreRecently we had to monitor an EKS cluster and several other resources using NetEye. AWS already provides solid dashboards out of the box, but log analysis isn’t as flexible as in Elasticsearch, and costs can easily grow out of control. Our goals were to: AWS CloudWatch is a monitoring and observability service that collects logs,…
Read MoreRecently, we needed to upload build artifacts to allow developers to visualize Playwright test recordings. Initially, we used a simple PVC and an NGINX server with basic authentication, but this approach has a major drawback: it doesn’t allow uploads from different namespaces. As a result, we had to choose whether to deploy this service and…
Read MoreOur old ISO used the first drive (sda) as the only option when installing the system. Sometimes we were asked to install NetEye on a different drive, so as a workaround we suggested properly sorting RAID arrays in the controller, in order to put the installation drive first on the list. Even if suboptimal, this…
Read MoreUse Case During NetEye Cloud updates we typically have to handle 25+ nodes, updating both OS and Firmware and subsequently rebooting all servers, all without causing downtime. We can of course reboot one node a time, but this would be really time-consuming. The main constraints on reboot are PCS nodes and Elastic layers. In particular…
Read MoreWhen approaching a GitOps workflow you’ll soon have to choose between push- and pull-based approaches. In this blog post I’ll explain the high-level differences of each approach with pros and cons. What is GitOps? GitOps stands for Git Operation: in this workflow all the infrastructure configurations are stored in a Git repository, which represents the…
Read MoreRecently we had to provision a couple of NetEye machines on Azure for production purposes. Our procedure essentially creates a RedHat 8.10 VM starting with an official RedHat image, and adds the NetEye repositories to install the required software. This procedure is what we usually follow to create training environments, but these machines are usually…
Read MoreWhen you prepare a machine for production, you usually want to use a redundant network interface in order to be resilient to possible network outages. When we created our OpenShift cluster this wasn’t possible during the installation procedure, at least not using the UPI procedure. We recently added a new node and discovered this new…
Read MoreOne of the first issues we added more than 2 years ago to our DevOps backlog was automating the infrastructure preparation and release of NetEye, but we postponed it for a long time because it was too big to do. A bit of background Every 2 months we release a new NetEye version: this basically…
Read MoreEvery so often it may happen (in particular after a cluster update or hardware issues) that you see your storage in a warning state on OpenShift. The first thing to do is to check what’s wrong with your cluster: sometimes you may have a real issue, in other cases it may just be a temporary…
Read MoreRecently we felt the need to collect anonymous metrics about how our users are visiting our websites. After some investigation, the development team proposed using Matomo: a free and open source software project which collects usage metrics while guaranteeing 100% privacy alongside the chance to be self-hosted. We decided to install it on OpenShift, since…
Read MoreSome days after installing an OpenShift cluster you may notice a warning related to insights: the system is complaining because metrics are not stored in a persistent way and a restart of the container may cause the loss of metrics. In OpenShift it is possible to configure several custom metrics. In this post I will…
Read MoreWe fixed a bug in NetEye Userguide clarifying the procedure to setup custom certificate on a NetEye Mirror in Change NGINX Certificates section both in NetEye 4.30 and 4.31.
Read MoreIn my previous blog-post I wrote an introduction to pipelining in OpenShift. This blog post is a follow-up to explain how to trigger a pipeline automatically. Tekton triggers are quite complex and need some explanation in order to be understood. To trigger a pipeline you need several components. In the graph below you can see…
Read MoreIt’s been a while since my last blog post about our OpenShift journey since as a devops team, we’ve been focusing on other activities for a while. Today I’d like to talk a bit about how to use OpenShift for CI purposes. As described in our productive use case, we implemented several pipelines to build…
Read More