Update (27. July 2021): I added argumentation why SAML2.0 vs OIDC. I also updated the software in the GitHub repository, so made some corrections here in the text also. Kubernetes is a great system. It allows very powerful and sophisticated container orchestration. By default the entities, which can perform actions…

After I published the first post about my PoC, I decided to continue refining the idea and to create a running, secured Kubernetes cluster out of it. Here are the next challenges I tackled and the final solutions. …

TL;DR: if you’re here only for the solution, skip to chapter “What is SMACK?” Prologue In the last couple of years, I spent a lot of my time managing on-premise cloud infrastructure. The advantage of on-prem is that infrastructure managers have full control of the stack — from the location, through…

I spent the last couple of days learning about AppArmor. The time spent is definitely not sufficient, but I want to share some thoughts about SELinux. The reason for this is, because while researching AppArmor, one inevitably comes to comparisons between SELinux and AppArmor. And if I have to summarize…

When I build clusters I have one goal — make it secure. And I usually prefer to get something ready before I build it completely on my own. The reasoning for the latter is simple — behind ready products is always the community. And I am for sure not as…

Today I struggled some time with actually a very simple problem in Ansible. At the end I found a solution to it, so I wanted to write some words about it — for my feature self and for other people, who’ve stumbled upon this problem. The problem itself can be…

I am writing this blog post, because I quite often hear from friends and colleagues two things: - I’ve disabled SELinux - I don’t know what I need SELinux on my desktop for And since usually my follow-up questions end in lengthy and probably annoying for my friends discussions, I…