LWN: Comments on "New projects from day two of CoreOS Fest"

New projects from day two of CoreOS Fest

philipsbd — Wed, 03 Jun 2015 18:10:32 +0000

I don't follow your concern; storing users/roles in etcd keys makes it very similar to how SQL databases work. The keys that hold the users/roles aren't exposed via the normal keys API if that is your concern?

New projects from day two of CoreOS Fest

jberkus — Tue, 02 Jun 2015 23:35:26 +0000

Am I reading this correctly that users and roles are stored in etcd itself? There's a bit of a security catch-22 with that; how does etcd prevent attackers from exploiting the authentication method?

New projects from day two of CoreOS Fest

kleptog — Tue, 02 Jun 2015 20:11:51 +0000

> And in the upcoming version of etcd you can pair transport security with authz using users and roles.

Now that is excellent news, thanks for pointing it out. That definitely puts etcd back in the running for me (not that there were many competitors...). The API described in that page looks easily sufficient for the most important requirements, namely making configuration read-only for most users and preventing key enumeration.

New projects from day two of CoreOS Fest

philipsbd — Tue, 02 Jun 2015 19:36:37 +0000

etcd supports TLS client certificates for authentication to the service and has supported this from very early on in the project. And in the upcoming version of etcd you can pair transport security with authz using users and roles.

New projects from day two of CoreOS Fest

kleptog — Sun, 31 May 2015 12:51:58 +0000

Project Calico looks interesting, but it says it uses etcd and last time I checked they have no kind of security against a rogue agent. So an attacker in a container would just need to fiddle the settings in etcd and then wait for the firewall to open up.

Seems a strange thing to overlook, but the whole containerisation craze recently has shown little interest in security.

Go as a faster Python

sjj — Fri, 22 May 2015 20:55:24 +0000

As someone more on the Ops side, static binaries FTW! Not having to worry about different versions of interpreters and supporting libraries on different machines is a bigger reason for me to really learn Go. Plus simple cross-compilation.

New projects from day two of CoreOS Fest

sciurus — Fri, 22 May 2015 17:59:25 +0000

Sysdig gives you insight into more system activity than just network traffic; see http://www.sysdig.org/wiki/sysdig-examples/ for examples.

Go as a faster Python

jberkus — Fri, 22 May 2015 17:07:03 +0000

Yes, I think that's the case a lot of places. At least, I know of more than a few Python/Go shops, although I know about even more Ruby/Go shops, for which the same argument would hold.

Go as a faster Python

ncm — Fri, 22 May 2015 16:36:32 +0000

I guess we should see this use of Go as an example of its displacing Python in places where performance sort of matters.