https://blog.peterlee.app/Recent content on Peter Lee - BlogHugoenpeterlee0127@gmail.com (peterlee)peterlee0127@gmail.com (peterlee)Sat, 22 Aug 2026 00:00:00 +0800https://blog.peterlee.app/cloud/cloudflare-tunnel-kubernetes-without-open-ports/Sat, 22 Aug 2026 00:00:00 +0800peterlee0127@gmail.com (peterlee)https://blog.peterlee.app/cloud/cloudflare-tunnel-kubernetes-without-open-ports/<p>My <code>k8s_infra</code> setup originally used Caddy as a local web reverse proxy. External requests reached Cloudflare first, entered my home network through forwarded HTTP or HTTPS ports, arrived at Caddy, and were finally sent to Kubernetes.</p>https://blog.peterlee.app/cloud/remove-committed-secret-from-git-history/Thu, 30 Jul 2026 00:00:00 +0800peterlee0127@gmail.com (peterlee)https://blog.peterlee.app/cloud/remove-committed-secret-from-git-history/<p>This incident started with an ordinary side-project task. The project consumed several CSV files from external sources, and some of those files contained confidential data that should never have been versioned. While preparing the data for the project, I accidentally added one of the sensitive CSV files to the Git repository without noticing.</p>https://blog.peterlee.app/ios/dns-security-pro-native-macos-ai-coding/Sat, 18 Jul 2026 00:00:00 +0800peterlee0127@gmail.com (peterlee)https://blog.peterlee.app/ios/dns-security-pro-native-macos-ai-coding/<p>I recently used AI-assisted coding to complete a new open-source project: <a href="https://github.com/peterlee0127/DNS-Security-Pro-macOS">DNS Security Pro for macOS</a>.</p> <p>It is an independent, native macOS app built with SwiftUI, the AppKit lifecycle, and Apple&rsquo;s NetworkExtension APIs. It lets users switch between DNS over HTTPS (DoH) and DNS over TLS (DoT) on their Mac. This is neither a direct port of the iOS interface nor a Mac Catalyst app. It was redesigned around the way people use macOS.</p>https://blog.peterlee.app/cloud/gitops-sops-encrypted-secrets/Tue, 09 Jun 2026 00:00:00 +0800peterlee0127@gmail.com (peterlee)https://blog.peterlee.app/cloud/gitops-sops-encrypted-secrets/<p>This post records another way to manage Kubernetes Secrets in a GitOps repo: encrypt the secret files before committing them.</p> <p>In the Vault and External Secrets post, my rule was:</p>https://blog.peterlee.app/cloud/airflow-on-kubernetes-with-gitops-values/Wed, 03 Jun 2026 00:00:00 +0800peterlee0127@gmail.com (peterlee)https://blog.peterlee.app/cloud/airflow-on-kubernetes-with-gitops-values/<p>This post records how I run <code>Apache Airflow</code> on Kubernetes with Argo CD.</p> <p>Airflow is a good test for a GitOps cluster because it has both normal Helm values and a lot of sensitive runtime values: fernet key, webserver secret key, metadata database connection, broker URL, Redis password, the default admin user, and sometimes a private DAG repository SSH key.</p>https://blog.peterlee.app/cloud/istio-ambient-waypoint-proxies/Wed, 03 Jun 2026 00:00:00 +0800peterlee0127@gmail.com (peterlee)https://blog.peterlee.app/cloud/istio-ambient-waypoint-proxies/<p>This post records how I use <code>Istio ambient mode</code> in the same GitOps-managed Kubernetes cluster from the previous posts.</p> <p>Sidecars are powerful, but for a home cluster I like ambient mode because the first step is much smaller: enroll a namespace, let ztunnel handle secure L4 traffic, then add a waypoint only where I actually need L7 behavior.</p>https://blog.peterlee.app/cloud/bootstrap-rke-cluster-for-gitops/Tue, 02 Jun 2026 00:00:00 +0800peterlee0127@gmail.com (peterlee)https://blog.peterlee.app/cloud/bootstrap-rke-cluster-for-gitops/<p>This post records how I prepare a new <code>RKE</code> Kubernetes cluster before letting Argo CD reconcile the applications.</p> <p>In my setup, Argo CD can manage most of the cluster after the root Application is applied. But a new cluster still needs a few manual pieces first. If those pieces are missing, the first sync looks noisy: CRDs are missing, ExternalSecrets cannot read Vault, workloads start before their Secrets exist, or PVC users fail because storage is not ready.</p>https://blog.peterlee.app/cloud/opentelemetry-stack-for-kubernetes-apps/Tue, 02 Jun 2026 00:00:00 +0800peterlee0127@gmail.com (peterlee)https://blog.peterlee.app/cloud/opentelemetry-stack-for-kubernetes-apps/<p>This post records how I built an <code>OpenTelemetry</code> stack for Kubernetes apps.</p> <p>I started with Docker Compose instead of moving the whole observability backend into Kubernetes immediately. That gave me a smaller blast radius: application pods can export OTLP data to one host, while Prometheus, Loki, Tempo, and Grafana run as a separate backend.</p>https://blog.peterlee.app/cloud/istio-gateway-api-ingress/Tue, 02 Jun 2026 00:00:00 +0800peterlee0127@gmail.com (peterlee)https://blog.peterlee.app/cloud/istio-gateway-api-ingress/<p>This post records how I expose services from my Kubernetes cluster with <code>Istio</code> and <code>Gateway API</code>.</p> <p>The goal is not to make Istio terminate public TLS directly. In my home setup, the outside edge can still be handled by a reverse proxy. The Kubernetes side only needs a predictable Gateway entry point and clean routes to Services.</p>https://blog.peterlee.app/cloud/argocd-gitops-for-home-kubernetes/Tue, 02 Jun 2026 00:00:00 +0800peterlee0127@gmail.com (peterlee)https://blog.peterlee.app/cloud/argocd-gitops-for-home-kubernetes/<p>This post records how I use <code>Argo CD</code> to manage my home Kubernetes cluster.</p> <p>Before this setup, most Kubernetes resources were applied manually. That is fine when the cluster is small, but after adding application workloads, Redis, Longhorn, Istio, monitoring, and ingress resources, I wanted the cluster to be rebuilt from Git as much as possible.</p>https://blog.peterlee.app/cloud/vault-kubernetes-external-secrets/Tue, 02 Jun 2026 00:00:00 +0800peterlee0127@gmail.com (peterlee)https://blog.peterlee.app/cloud/vault-kubernetes-external-secrets/<p>This post records how I use <code>Vault</code> and <code>External Secrets Operator</code> in my home Kubernetes cluster.</p> <p>The main idea is:</p> <p><code>Vault KV v2 -&gt; ClusterSecretStore -&gt; ExternalSecret -&gt; Kubernetes Secret -&gt; Pod</code></p>https://blog.peterlee.app/cloud/kubernetes-airflow/Mon, 11 Oct 2021 00:00:00 +0800peterlee0127@gmail.com (peterlee)https://blog.peterlee.app/cloud/kubernetes-airflow/<p>Apache Airflow is useful when you need to orchestrate scheduled data pipelines, operational tasks, or repeatable workflows. Running it on Kubernetes keeps the scheduler, webserver, workers, and supporting services easier to scale and isolate.</p>https://blog.peterlee.app/cloud/deploy-rancher-kubernetes/Sun, 10 Oct 2021 00:00:00 +0800peterlee0127@gmail.com (peterlee)https://blog.peterlee.app/cloud/deploy-rancher-kubernetes/<h3 id="why-use-rancher-to-deploy-a-kubernetes-cluster">Why use Rancher to deploy a Kubernetes cluster?</h3> <p>RKE is more configurable than kubeadm for my environment because several components, such as kube-dns, CoreDNS, Flannel, and StorageClass behavior, can be managed from a single cluster configuration. Upgrades can also be challenging in mixed-OS environments like mine, which includes Ubuntu 20.04.3 LTS and CentOS 7 servers. Rancher makes these differences easier to manage because the Kubernetes services run in Docker.</p>https://blog.peterlee.app/ios/dns_security_ios/Fri, 20 Nov 2020 00:00:00 +0800peterlee0127@gmail.com (peterlee)https://blog.peterlee.app/ios/dns_security_ios/<h1 id="dns-security">DNS Security</h1> <div style="text-align:center"><a href='https://apps.apple.com/us/app/id1533938029'><img src="https://raw.githubusercontent.com/peterlee0127/DNS-Security-iOS/main/mac_logo.png" width='200px' style='alignment:center'></a></div> <h4 id="one-of-the-first-apps-to-use-ios-14-encrypted-dns-profiles-without-requiring-a-vpn-configuration">One of the first apps to use iOS 14 encrypted DNS profiles without requiring a VPN configuration.</h4> <p>Secure your DNS queries without routing all network traffic through a VPN.</p>https://blog.peterlee.app/web/host-your-website-on-github-pages/Thu, 24 Oct 2019 00:00:00 +0800peterlee0127@gmail.com (peterlee)https://blog.peterlee.app/web/host-your-website-on-github-pages/<p>Host your website on GitHub Pages.</p> <h3 id="requirements">Requirements</h3> <ol> <li>A domain name from a registrar such as Namecheap or GoDaddy.</li> <li>A GitHub account.</li> <li>Cloudflare for DNS management.</li> </ol> <h2 id="steps">Steps</h2> <p>Create a <code>CNAME</code> file in your Git project:</p>https://blog.peterlee.app/cloud/deploy-storage-class-for-kubernetes/Tue, 27 Aug 2019 00:00:00 +0800peterlee0127@gmail.com (peterlee)https://blog.peterlee.app/cloud/deploy-storage-class-for-kubernetes/<p>This post shows how to deploy an NFS-backed <code>StorageClass</code> for Kubernetes.</p> <h4 id="related-post-start-a-kubernetes-cluster-with-kubeadm">Related post: <a href="https://blog.peterlee.app/cloud/start_a_kubernetes_with_kubeadm/"><code>Start a Kubernetes cluster with kubeadm</code></a></h4> <p>With the private Kubernetes cluster from the previous post, pods can be recreated on different nodes, so application data needs persistent storage. I chose NFS as a simple storage option for this lab environment. First, I set up an NFS server.</p>https://blog.peterlee.app/cloud/start_a_kubernetes_with_kubeadm/Sun, 25 Aug 2019 00:00:00 +0800peterlee0127@gmail.com (peterlee)https://blog.peterlee.app/cloud/start_a_kubernetes_with_kubeadm/<p>In this post, I share how I built a private Kubernetes cluster on my own servers.</p> <p><img src="https://blog.peterlee.app/assets/images/posts/2019-08-25-start-a-kubernetes-cluster-with-kubeadm/kube-dashboard.jpg" alt="Kubernetes dashboard"></p> <p>For this tutorial, I will create a <code>private Kubernetes cluster</code>. You can use multiple computers, or a powerful single machine that can run several virtual nodes.</p>