dropbear VS flux2

Dropbear server v2020.81 https://matt.ucc.asn.au/dropbear/dropbear.html

# docker run -it --rm debian:latest # then run the following commands apt-get update apt-get install -y git wget build-essential zlib1g-dev git clone https://github.com/mkj/dropbear cd dropbear # here we disable ChaCha20Poly1305 and enable GCM instead # CBC is disabled by default env CFLAGS='-DDROPBEAR_CHACHA20POLY1305=0 -DDROPBEAR_ENABLE_GCM_MODE=1' ./configure make make install # check if dropbear is vulnerable dropbear -R wget https://github.com/RUB-NDS/Terrapin-Scanner/releases/download/v1.1.0/Terrapin_Scanner_Linux_amd64 chmod +x Terrapin_Scanner_Linux_amd64 ./Terrapin_Scanner_Linux_amd64 -connect 127.0.0.1:22 pkill dropbear

I would follow the suggestions in https://github.com/mkj/dropbear/blob/master/DEVELOPING.md for Deubg Printing, as this seems difficult to solve within information from dropbear.

Heads is good reference for what could be done at BIOS level. It can connect via ethernet but only because the firmware is built in (The GBE section in IFD stands for Gigabit Ethernet). If you want an SSH server, this needs to be built separately because Dropbear is too big to include by default. Due to the size of firmware and range of different wifi cards that could be installed plus the software to connect, wifi is not possible in Heads. Similarly with Bluetooth. For cellar, the firmware, software and configuration would be needed to BIOS. There is also how no service/roaming would be indicated without any physical meter like LEDs (Ethernet has LEDs to show connection). It would also take time during the boot cycle to connect to a cellular service and would block booting the OS. That said, you could add a service at boot of your OS to do this and connect to something like a NextCloud Phone Tracker to do this.

While it is good to have another alternative, I think Dropbear SSH[1] is also being used very widely.

[1] https://matt.ucc.asn.au/dropbear/dropbear.html

I need an SSH server. I try OpenSSH, but run into an issue when I attempt to log in. OpenSSH servers use privilege separation as a security measure. The OpenSSH subprocess that handles authentication runs as an unprivileged user with its root directory set to some safe location. The CAP_SYS_CHROOT capability is required to change the root directory for a process, but Render services run in unprivileged containers without this capability. I discover that there are other SSH servers, like dropbear, that don't do privilege separation. This is great because it's not necessary for my use case anyway. My SSH server will run as a non-root user and will only be available within the VPN.

That's what Dropbear is supposed to do, it can be included in the initramfs of a server: https://matt.ucc.asn.au/dropbear/dropbear.html

Disclaimer: I still didn't try it myself yet, but it's on my (too long) list of things to do.

KOM operates within kubernetes environments where Flux or ArgoCD is installed.

Given the team had already adopted GitOps and were familiar with deployments powered by Helm Releases and Flux, we wanted to move the provisioning of the infrastructure to be part of the same process of creating the service and its continuous deployment.

Your GitHub action can trigger a helm chart, or series thereof, or other infra tools. Declarative specifications, triggered procedurally with the context of the branch’s latest build. We use this pattern quite extensively for preview app workflows.

As of a year ago this is possible in a fully declarative way with Flux 2, but there’s a lot more moving parts and security footguns - and the idea that the maintenance of this project has lost one of its primary sponsors is worrying at best.

https://github.com/fluxcd/flux2/discussions/831

https://blog.kluctl.io/introducing-the-template-controller-a...

FluxCD - FluxCD is another popular GitOps tool that allows developers to use a Git repository as the sole source of configuration. Flux automatically ensures that the state of the Kubernetes cluster is synchronized with the configuration in the Git repository. It supports automatic updates, meaning Flux can monitor Docker image repositories for new images and push updates to the cluster.

#!/bin/bash aws eks update-kubeconfig --name $CLUSTER_NAME --region $AWS_REGION flux_installed=$(kubectl api-resources | grep flux) if [ -z "$flux_installed" ]; then echo "flux is not installed" curl -s https://fluxcd.io/install.sh | sudo bash flux bootstrap github \ --owner=$GH_USER_NAME \ --repository=$FLUX_REPO_NAME \ --path="clusters/$ENVIRONMENT/$CLUSTER_NAME/bootstrap" \ --branch=main \ --personal else echo "flux is installed" fi

Flux CD enables continuous deployment to Kubernetes through GitOps by syncing Git repositories with Kubernetes clusters. Flux CD enables GitOps for Kubernetes through source control integration. It manages Kubernetes manifests as code and syncs git repo changes to clusters. Flux automates checks, deployments, and updates within clusters.

FluxCD is a GitOps tool developed by Weaveworks that allows you to implement continuous and progressive delivery of your applications on Kubernetes. It is a CNCF graduated project that offers a set of controllers to monitor Git repositories and reconciles the cluster's actual state with the desired state defined by manifests committed in the repo.

From here, we can explore other developments and tutorials on Kubernetes, such as o11y or observability (PLG, ELK, ELF, TICK, Jaeger, Pyroscope), service mesh (Linkerd, Istio, NSM, Consul Connect, Cillium), and progressive delivery (ArgoCD, FluxCD, Spinnaker).

Instead, we will create a single long-lived cluster, and deploy our application in different namespaces. There are a bunch of ways to do that - see ArgoCD, Flux, custom internal tooling, or other solutions (we use our own product). That way, we: