Notes on Linux, Kubernetes, and cloud-native infrastructure https://www.caizhe.org/ 2026-09-18T00:00:00Z caizhe https://www.caizhe.org/ecr-image-pull-secret/ 2026-09-18T00:00:00Z

An ECR login token is valid for 12 hours. That is the entire lifespan of the credential you get from aws ecr get-login-password, and it is the thing that…

https://www.caizhe.org/rke2-ha-install/ 2026-09-18T00:00:00Z

This is the deployment manual for a three-node RKE2 control plane. It has three deliberate design choices worth stating up front, because they drive…

https://www.caizhe.org/vault-dynamic-db-creds/ 2026-09-18T00:00:00Z

The usual pattern for application database access is a long-lived account with a password stored somewhere — a ConfigMap, a Secret, a config file, or…

https://www.caizhe.org/docker-openldap/ 2023-07-24T00:00:00Z

Or run it inside the container: Before adding users in LDAP you need a group. You can pick any organizational unit here — you will change it later anyway…

https://www.caizhe.org/docker-elasticsearch/ 2023-06-14T00:00:00Z

Since 8.0, Elasticsearch requires HTTPS for inter-node cluster communication, so an SSL certificate has to be generated first. You can start a single-node…

https://www.caizhe.org/docker-redis-cluster/ 2023-06-14T00:00:00Z

Create a dedicated network (optional): Create the conf and data directories: Enter any one of the containers…

https://www.caizhe.org/kubernetes-api-calls/ 2023-06-13T00:00:00Z

Three ways to call the Kubernetes API — the official SDK, the in-cluster service account token, and port 6443 with client certs.

https://www.caizhe.org/docker-keepalived/ 2023-03-13T00:00:00Z

Running Keepalived under Docker for a floating VIP: the master and backup node configs, health checks, and how the failover behaves.

https://www.caizhe.org/kubernetes-1-22-ha-install/ 2023-03-13T00:00:00Z

A high-availability Kubernetes 1.22 cluster from bare Ubuntu: kernel prerequisites, containerd, kubeadm, the Aliyun mirror, and ingress.

https://www.caizhe.org/containerd-commands/ 2023-03-02T00:00:00Z

A practical ctr cheat sheet — pull, list, tag, remove, mount, export, and import images, plus the content digest not found error.

https://www.caizhe.org/containerd-install/ 2023-03-01T00:00:00Z

The default config file is /etc/containerd/config.toml, generated with the command below.

https://www.caizhe.org/gitlab-purge-large-files/ 2023-03-01T00:00:00Z

Everyone else can then re-clone the project. Reference: https://www.msnao.com/2021/06/15/5031.html

https://www.caizhe.org/glusterfs-distributed-storage/ 2019-09-13T00:00:00Z

GlusterFS distributed versus replicated volumes, how brick hashing places files, and the trade-offs between the two volume types.

https://www.caizhe.org/nginx-trailing-slash/ 2019-03-02T00:00:00Z

Why a trailing slash changes Nginx behaviour — the difference between location and proxy_pass rules, with test URLs and both cases.

https://www.caizhe.org/bind-dlz/ 2018-08-02T00:00:00Z

Building BIND with DLZ and a MySQL backend: dependencies, the schema, named.conf, and removing the anonymous users that break the build.

https://www.caizhe.org/clamav/ 2018-03-13T00:00:00Z

I have been looking into security lately and noticed there are not many antivirus options on Linux. Today I want to introduce ClamAV, an open-source…

https://www.caizhe.org/lvs-keepalived/ 2017-09-13T00:00:00Z

I had some spare time recently and went back over high-availability Keepalived and LVS reverse proxying. It is a classic setup, so I put together a…

https://www.caizhe.org/letsencrypt-acme-sh/ 2017-06-13T00:00:00Z

With HTTPS becoming the norm, Let’s Encrypt has been a huge part of that. There are plenty of guides online and the process itself is simple — far more…

https://www.caizhe.org/redis-tuning/ 2017-03-02T00:00:00Z

Redis offers several levels of persistence: Redis can use both AOF and RDB persistence at the same time. In that case, when Redis restarts it prefers the…

https://www.caizhe.org/301-vs-302-redirect/ 2016-12-11T00:00:00Z

Both the 301 and 302 status codes mean “redirect”. That is, after the browser receives this status code from the server, it automatically jumps to a new…

https://www.caizhe.org/kvm-virtual-machines/ 2016-05-02T00:00:00Z

Recently I had some spare time and compared Docker with KVM. Docker is impressive and has a lot of room to grow, but it still falls short in a few areas —…

https://www.caizhe.org/linux-system-tuning/ 2016-03-02T00:00:00Z

Production Linux tuning: trimming startup services, hardening SSH, and the kernel parameters for ports, TIME_WAIT, and connection tracking.

https://www.caizhe.org/nginx-tuning/ 2016-03-02T00:00:00Z

Nginx tuning splits into two directions: performance optimization and security hardening. Configure multiple worker processes: Tune the max connections…