Writing about code, electronics and other stuff

How to rotate Istio TLS certificates without downtime in ambient mode

Thu, 19 Mar 2026 10:00:00 +0200

This is rather short note on how to do the certification rotation, as official istio documentation is really sparse on details.

This has been tested on Istio 1.28.1, in Kind cluster, running ambient mode with ztunnel and waypoints.

Issue I’ve been facing was that whenever I tried to replace the CA Certificates used by istio, Istio Waypoints were unable to communicate with Istio Ztunnel.

It turns out that istio has two options that has to be enabled to make the transition seamless, and you also need to know how to properly modify the certificate chain that you’re providing.

LLM told me to do so - navigating my career in the age of AI

Thu, 19 Feb 2026 11:00:00 +0200

Something that has been bothering me for a while and I’d really like to put it in writing.

I believe that LLM based AI is going to negatively impact an ability for a person to become an expert at anything. As an effect of that, a negative feedback loop is going to form where AI will become dumber and dumber. You can’t have LLM learn more and yet destroy the whole incentive for learning anything.

Contributing to Openwrt for the first time TP-Link RE650 V2

Sun, 10 Apr 2022 17:58:03 +0200

Buying a new AP to cover more space

So I recently moved to a new flat. This was a significant upgrade for me, since before I was living in almost 40m² and a single AP was enough.

However, once I moved to almost 80m² - it turns out single AP cannot cover 5GHz for the whole flat, so I had to buy another one.

I wanted to buy something cheap & reliable. I came across TP-Link RE650 recommendation somewhere on the internet, it was quite cheap and promised high speed so I said why not.

I Give Up on Traefik Its Too Complicated

Fri, 03 Sep 2021 22:49:50 +0200

Mind you, this is kind of a clickbaitish, but what I mean exactly is that traefik is too complicated for personal k3s setup.

Trying to setup traefik from scratch

I’ve been working on setting up traefik from scratch as an exercise. I got to the point where it’s all nice and running and then there is this.

I’ve created IngressRoute

apiVersion: traefik.containo.us/v1alpha1
kind: IngressRoute
metadata:
  labels:
    app.kubernetes.io/managed-by: pulumi
  name: dashboard
  namespace: traefik-tailscale
spec:
  entryPoints:
  - websecure
  routes:
  - kind: Rule
    match: PathPrefix(`/dashboard`) || PathPrefix(`/api`)
    services:
    - kind: TraefikService
      name: api@internal

Which does what it says - matches /dashboard and directs that to internal api which resolves to showing a dashboard when you access /dashboard/ (mind the slash).

Deploying Tailscale Vpn on K3s Kubernetes

Thu, 02 Sep 2021 22:18:52 +0200

This is gonna be rather short. I wanted to put all the info I gathered in a single place.

Dockerfile

There is no official docker image available yet. There is however official Dockerfile which you can use to base your setup off of.

https://github.com/tailscale/tailscale/blob/v1.14.0/Dockerfile

You need to modify it slightly however

Create file called entrypoint.sh (based on snippet)

if [ ! -d /dev/net ]; then mkdir /dev/net; fi
if [ ! -e /dev/net/tun ]; then  mknod /dev/net/tun c 10 200; fi

# Wait 5s for the daemon to start and then run tailscale up to configure
/bin/sh -c "sleep 5; tailscale up --authkey=${TAILSCALE_AUTH} -advertise-tags=${TAILSCALE_TAGS}" &
exec /usr/local/bin/tailscaled --state=/tailscale/tailscaled.state

And put it into the same dir you have tailscale Dockerfile. You need to add that entrypoint to Dockerfile and use it:

Using Pulumi as Helm Alternative for Templating

Thu, 02 Sep 2021 14:23:03 +0200

I hate Helm

I truly hate helm. It’s not because it’s a bad idea, core idea of Helm does actually solve a problem that you often meet with deploying manifest (customization). It’s not because I don’t know how to use it - I used it to create many deployments and I truly appreciate its existence.

But I hate it to the heart.

Why you might ask?

It’s because most of the time Helm tends to become total customization of the chart. Literally. If you try to use any off the shelf helm charts you will often meet with following dilemma:

Understanding Flannel Networking in K3s

Wed, 01 Sep 2021 17:07:44 +0200

How does it work without Flannel

Assumption: I’m using host networking through these examples. You could utilize docker network for example, but to make it simple I wanted to stick to the fact below

container network = host/node network

If there was no Flannel, connection between containers would need to happen by directly connecting to the specific port that container is binding to

Like so:

#1 Node 10.0.0.10

#1 Server Container binds onto port 5432
#2 Client Container connects to 127.0.0.1:5432 (Orange connection)

#2 Node 10.0.0.11

Flashing Android 7 onto Lenovo A3500-FL (Custom ROM, Recovery)

Thu, 19 Aug 2021 15:17:00 +0200

Long time ago I bought a tablet Lenovo A3500-FL. It’s really old tablet but still works suprisingly well. I thought about maybe having it working as a mobile terminal or Home Assistant Dashboard.

It only has offical upgrade to Android 4.4.2 which is really old and applications might not be targeting it anymore. According to XDA article only 4% of devices are still running Android that old (and 5,9% culminative of previous versions and this one).

K3s for Home Server the Easy Way pt. 1 - SSO, external access, traefik

Sat, 14 Aug 2021 09:30:13 +0200

I’ve always wanted to have my own home server. I’ve even bought Intel NUC for that which I intended to use, but I never got around to configuring it properly so it has gathered dust while not in use.

But in motivation strike, I decided to finally get around to do it, and implement it.

Infra automation not always the best way to move forward

First of all, I don’t want to be it a maintanence burden at all. With that comes also the need to be able to recover from possible hardware failure easily (and by that I mean all the configuration has to be available somewhere without much manual work).

Living in the IDE - or Why I Really Like HCL and Loathe YAML

Thu, 05 Aug 2021 17:07:59 +0200

There are things that I enjoy when working as a professional. One of them is that when the tooling is so good that it just makes want to write the code. Example of state-of-the-art integration of IDE into a language is what Hashicorp has done to the Terraform and its integration with IntelliJ IDEA.

An example of that you can find below

Autocomplete works out of the box, no configuration needed

One might say “yeah, its just a simple gimmick, it will fall apart for more complex things!” like it often can be the case with dynamic languages.

Infra as a Code Is Cloud Lock-In

Wed, 04 Aug 2021 20:23:53 +0200

UPDATE (2021-08-06): In a hindsight I think I choose wrong title to describe the concept. More appropriate would be “Modern infra automation state management is gateway drug for using more cloud provided services” or something along these lines. Initial thought on title came from the fact that I considered terraform/pulumi to be truly “Infra as a code” solution, while Ansible (second tool that I use for automation) being subpar in that experience (and hence more of “commands over SSH” thing than true infra state manager).

No Idea Where to Live

Wed, 04 Aug 2021 13:38:41 +0200

Intro

For unfamiliar with Polish economy

For the context of this post - I currently live by renting a flat in Warsaw, almost by the city border (Far end of Ursynów district). See the attached view for having a context

Here is how it looks like

I’ve pretty close connection to metro line (which to say is impressive here as Warsaw has only two metro lines).

Rent market

! Disclaimer: I’m not an expert in real estate market - these numbers are pulled out of thin air according to my knowledge when I searched for flat recently. Don’t treat it as source of truth

tfui

Wed, 30 Dec 2020 00:00:00 +0200

Interactive terraform console UI for managing state (mainly renaming variables)

Prototyping ESP32 PWM LED Controller for Home Assistant

Sat, 14 Nov 2020 10:00:00 +0200

After spending a couple of days laying in my bed with absolute no motivation at all to do anything I’ve decided to do anything that will bring me from the lair of despair.

COVID situation here in Poland at the moment of writing the post is not really great, there is absolutely nothing to do outside because everything is cancelled.

I can either tinker in my “electronic workshop” or do programming which I couldn’t really keep motivation for.

Gemrabot

Sat, 29 Aug 2020 00:00:00 +0200

Gitlab Merge Request Bot that allows interactive approval using slack (ChatOps)

Threedverse

Fri, 12 Jun 2020 00:00:00 +0200

My attempt to make alternative for hosting 3D printing content (*.stl)

Hash Sum Mismatch – trouble when using WSL2 and VirtualBox

Wed, 20 May 2020 10:00:00 +0200

When I was writing a tutorial regarding usage of VirtualBox to compile Marlin firmware (for 3D Printers) I came across following issue:

E: Failed to fetch store:/var/lib/apt/lists/partial/jp.archive.ubuntu.com_ubuntu_dists_focal_main_binary-amd64_Packages.xz  Hash Sum mismatch
   Hashes of expected file:
    - Filesize:5826751 [weak]
    - SHA256:af226b4496cbb524bd4814d102047ae77769836203274dffc91cb543d5da13cc
    - SHA1:aef5c36ce45bd5c3154a1bb03c62b6cfb33e2bc6 [weak]
    - MD5Sum:7ef83228ec207df10acac48fbdd81112 [weak]
   Hashes of received file:
    - SHA256:e2c7fc5a2d86f75f03612fec614dcf84d3d502976558fbe40928c1dd120bb05e
    - SHA1:aef5c36ce45bd5c3154a1bb03c62b6cfb33e2bc6 [weak]
    - MD5Sum:7ef83228ec207df10acac48fbdd81112 [weak]
    - Filesize:5826751 [weak]
   Last modification reported: Thu, 23 Apr 2020 16:40:26 +0000
   Release file created at: Thu, 23 Apr 2020 17:33:17 +0000

This error was really strange because SHA256 is the only one that differs. (See related post on AskUbuntu)

paperless (fork)

Sat, 15 Feb 2020 10:00:00 +0200

My FORK of paperless which adds Azure OCR service for better OCR

Docker swarm cluster on single laptop home lab running Proxmox VE

Mon, 06 Jan 2020 10:00:00 +0200

This is my first blog post about running anything related to home lab. As I have already done some work before to have Proxmox VE running with connection to the router — I will be explaining that in later posts if I find time or motivation to do so.

Planned:

I want to have 3 nodes of VM, with Ubuntu Server running on them, referring to them as Swarm Nodes.
I will be using Ansible past the point when I have a fresh Ubuntu installed (installation will be manual, as this is really complicated to automate for the beginner)
I will connect swarm nodes with docker swarm

In the future:

Scooter-Board-MCU

Tue, 29 Oct 2019 00:00:00 +0200

My attempt on reverse engineering Xiaomi M365 scooter UART communication

langenv (concept)

Sun, 05 Aug 2018 17:50:17 +0200

Concept of making a universal language management tool

arduino-fft-visualizer

Sat, 09 May 2015 09:40:23 +0200

Ancient project for making LEDs flash according to given frequency played in my speaker using FFT

Trellobot

Fri, 18 Apr 2014 09:23:30 +0200

My oldest public project, a bot which sends notifications about terllo events on slack