Transcendence - 1

---------------------------------------------------------------------------------------Let me share some pearls of wisdom from a book. 
My Spiritual Experiences with Pramukh Swamiji
by A.P.J. Abdul Kalam
with Arun Tiwari. 

This is not a book review.
This article is just like
'key take away points' for me. 

The book is divided in 4 parts. This article covers 1st part of the book. 


Part 1 Experiencing the presence 

Tolerance of others' view and opinions is essential in building teams and accomplishing tasks that are beyond the individuals' capacities. 
- Dr. Brahma Prakash


Srimad Bhagavad Gita defines renunciation in a unique way: "One must renounce not the performance of deeds, but renounce the desire for the fruits of those actions." 
- Pramukh Swamiji


When things go smoothly and fall into place, you have most likely made the right choices so that the right event could come into your life. When your decisions of efforts encounter resistance or roadblocks, seriously re-examine the choices you have made. 

"Who I really am".... can only be revealed when the mind is quiet and no longer telling me who I am. When all the preconceptions about myself are stilled, what remains is who I really am: consciousness, awareness, stillness, presence, peace, love, and the Divine. You are that which is nameless and yet has been given a thousand names.


Harmony makes small things grow, lack of it makes great things decay. 
- Sallust
1st century BC Roman senator

When you go to a place of worships, you pray for peace and prosperity, not only for yourself but also for everyone around you. 

Sulah meaning peace and peacemaking in Arabic. 
Sulah is also the root of the word Islah denoting development and improvement. 


It is easier to build strong children than to repair broken men
- Frederick Douglass
19th Centaury African-American social reformer

The empires of the future are the empires of the mind. Dream, dream, dream. Dreaming leads to thoughts. Thoughts lead to action. 

"How can you mix spirituality and social service?"
Pramukh Swamiji asks, "How can you separate the two?"


Success can only come to you by courageous devotion to the task in front of you... You will be remembered for creating the one page in the history of the nation - whether it is the page of invention, innovation, discovery or fighting injustice. 
A.P.J. Abdul Kalam (in book 'Indomitable Spirit') 


The wise discipline themselves, the unwise discipline others
- Pramukh Swamiji

As long as there is the pull of gravity whatever you throw up is always going to come down. But once a rocket is out of the attraction of the Earth's gravity, it will not fall back and will escape into space. Likewise, as long as we are attracted and attached to 
- the comforts of this body
- desires of the mind and
- the material world,
we are consigned to the cycle of births and deaths. There will be no escape. But as your wordly desires decreases, you transcend the pull of the world and eventually you connect to God. 
- Pramukh Swamiji

Transcendence - 2

---------------------------------------------------------------------------------------Let me share some pearls of wisdom from a book. 
My Spiritual Experiences with Pramukh Swamiji
by A.P.J. Abdul Kalam
with Arun Tiwari. 

This is not a book review.
This article is just like
'key take away points' for me. 

The book is divided in 4 parts. This article covers 2nd part of the book. 


Part 2 Spirituality in Action


Appearance is a glimpse of the unseen
- Anaxagora
Pre-Socratic Greek Philosopher

A temple is the physical  manifestation of the unseen
- Pramukh Swami Maharaj

Do not confuse excellence with perfection. Excellence man can reach, but perfection is God's work. 
- Pramukh Swami Maharaj


Courage is not absence of fear, but the triumph over it. The brave man is not be who does not feel afraid, but he who conquers the fear. 
-Nelson Mandela

To overcome fear by forgiving through faith. 
- Pramukh Swami Maharaj


If you surround yourself with good and righteous, they can only raise you up. 
If you surround yourself with ordinary, they will drag you down into the pessimism of mediocrity, and they will keep you there, but only as long as you permit it. 
- father of A.P.J. Abdul Kalam

Youth needs a wisdom. 
Youth needs a vision.
Youth needs credible guidance
and above youth needs an example. 
Great minds give all three. 

The vision of a prosperous and peaceful humanity. 
guidance through the idea of great institutions like BAPS
and the example of impeccable service 
are beacons of that guide souls from drifting and foundering 
however deep and dark the turbulent sea. 

Where there is faith, there is love
Where there is love, there is peace
Where there is peace, there is God
And where there is God, there is no need. 
- Leo Tolstoy 
in book "The Kingdom of God Is Within You"


If you are irritated by every run, how will your mirror be polished? 
- Rumi
13th Century Persian poet

Where there is righteousness in the heart, 
There is beauty in the character. 
When there is beauty in the character, 
There is harmony in the home.
When there is harmony in the home, 
There is order in the nation.
When there is order in the nation, 
There is peace in the world. 


We cannot teach people anything; we can only help them discover it within themselves. 
-Galileo Galilei
16th century Italian philosopher. 

Human brain
* 2% of body weight
* receives 15% of cardiac power
* 20 % of total body consumption
* 25 % of total body glucose utilization

I recommend, all people - with scientific temperament - must read chapter 14. 


If you talk to a man in a language he has learned in school, it goes to his head. If you talk to him in a lanugage he has heard from his mother, it goes to his heart
-Nelson Mandela

If I have a beautiful mind, I will have beautiful thoughts
If I have a beautiful thoughts, I will have beautiful life
If I have a beautiful life, I will become a great soul like Pramukh Swamiji

Confidence leads to creativity
Creativity leads to knowledge
Knowledge leads to thinking
Thinking makes on great. 

Every time we smile angel wins and every time we sulk Satan wins

Jaeger + Elastic Search: Handson


docker run --rm -it --name=elasticsearch -e "ES_JAVA_OPTS=-Xms2g -Xmx2g" -p 9200:9200 -p 9300:9300 -e "discovery.type=single-node" -e ""

docker run --rm -it --link=elasticsearch --name=kibana -p 5601:5601

docker run --rm -it --link=elasticsearch --name=jaeger -e SPAN_STORAGE_TYPE=elasticsearch -e ES_SERVER_URLS=http://elasticsearch:9200 -e ES_TAGS_AS_FIELDS_ALL=true -p 16686:16686 jaegertracing/all-in-one:1.12

docker run --rm --link jaeger --env JAEGER_AGENT_HOST=jaeger --env JAEGER_AGENT_PORT=6831 -p8080-8083:8080-8083 jaegertracing/example-hotrod:latest all 

Create a file JSON.txt with below conntent

    "query" : {
        "match_all" : {}


curl -XGET "localhost:9200/jaeger-span-YYYY-MM-DD/_search" -H "Content-Type: application/json" -d @json.txt

curl -XGET "localhost:9200/jaeger-span-YYYY-MM-DD/_search?size=10000" -H "Content-Type: application/json" -d @json.txt


JSON Output: 

  "took": 0,
  "timed_out": false,
  "_shards": {
    "total": 5,
    "successful": 5,
    "skipped": 0,
    "failed": 0
  "hits": {
    "total": 441,
    "max_score": 1,
    "hits": [
        "_index": "jaeger-span-2019-11-12",
        "_type": "span",
        "_id": "mQ2cXm4BVYoOLxBFNHpP",
        "_score": 1,
        "_source": {
          "traceID": "553c8316169ab970",
          "spanID": "2cd1c33438cb79f5",
          "flags": 1,
          "operationName": "HTTP GET /route",
          "references": [
              "refType": "CHILD_OF",
              "traceID": "553c8316169ab970",
              "spanID": "44fa89467cc873aa"
          "startTime": 1573545324720315,
          "startTimeMillis": 1573545324720,
          "duration": 53302,
          "tags": [],
          "tag": {
            "component": "net/http",
            "http@method": "GET",
            "http@status_code": 200,
            "http@url": "/route?dropoff=728%2C326&pickup=106%2C311",
            "internal@span@format": "proto",
            "span@kind": "server"
          "logs": [
              "timestamp": 1573545324720369,
              "fields": [
                  "key": "event",
                  "type": "string",
                  "value": "HTTP request received"
                  "key": "level",
                  "type": "string",
                  "value": "info"
                  "key": "method",
                  "type": "string",
                  "value": "GET"
                  "key": "url",
                  "type": "string",
                  "value": "/route?dropoff=728%2C326&pickup=106%2C311"
          "process": {
            "serviceName": "route",
            "tags": [],
            "tag": {
              "client-uuid": "761a24cbd892ada8",
              "hostname": "367b2536b5f9",
              "ip": "",
              "jaeger@version": "Go-2.20.0"

Trace JSON at Kibana APM

    "events": [
            "@timestamp": "2018-07-30T18:53:42.281Z",
            "agent": {
                "name": "elastic-node",
                "version": "3.14.0"
            "parent": {
                "id": "abcdef0123456789"
            "processor": {
                "event": "span",
                "name": "transaction"
            "service": {
                "environment": "staging",
                "name": "backendspans"
            "span": {
                "action": "query.custom",
                "duration": {
                    "us": 141581
                "id": "abcdef01234567",
                "name": "GET /api/types",
                "subtype": "postgresql",
                "type": "db"
            "timestamp": {
                "us": 1532976822281000
            "trace": {
                "id": "fdedef0123456789abcdef9876543210"
            "transaction": {
                "id": "01af25874dec69dd"




Distributed Tracing FAQ

** Is tracing only for request-response pair? How tracing happens for indication where response is not expected.

This is: One-way RPC Tracing. One-way is the same as normal RPC tracing, except there is no response anticipated.
In normal RPC tracing 4 annotations are used: “cs” “sr” (request) then “ss” “cr” (response). In one-way tracing, the first two are used “cs” “sr” as there is no response returned to the caller.
So, the client adds “cs” to a span and reports it to zipkin. Then, the server adds “sr” to the same span and reports it. Neither side add Span.timestamp or duration because neither side know both when the span started and finished.
CS = Client Send
SR = Server Receive
SS = Server Sent
CR = Client Receive
They are annotations for spans in Zipkin format


For asynchronous messaging communications: “span.kind” tag values are: Producer and Consumer
For synchronous RPC communications: “span.kind” tag values are: Client and Server
The span.kind=server tag denotes an entry span, e.g. a span created in the local code in response to an external request. Likewise, span.kind=client denotes an exit span, e.g. a call made from the local code to another server.

** At ‘Istio service mesh’, does ‘Envoy sidecar proxy’ add ‘B3 headers’ for incoming message or outgoing message,
For incoming message.

** What if some of the microservices use Zipkin format and new microservices use Jaeger format at K8s cluster?
Jaeger provides backward compatibility. So, just need to route ‘Zipkin format data’ from ‘legacy services’ to ‘Jaeger backend’ using ‘zipkin collector’

Backwards compatibility with Zipkin
Although we recommend instrumenting applications with OpenTracing API and binding to Jaeger client libraries to benefit from advanced features not available elsewhere, if your organization has already invested in the instrumentation using Zipkin libraries, you do not have to rewrite all that code. Jaeger provides backwards compatibility with Zipkin by accepting spans in Zipkin formats (Thrift or JSON v1/v2) over HTTP. Switching from Zipkin backend is just a matter of routing the traffic from Zipkin libraries to the Jaeger backend.

** The ‘Envoy sidecar proxy’ at ‘Istio Service Mesh’ sends collected span data (JSON format) to Jaeger Collector. It it for incoming message or outgoing message?
The ‘Envoy sidecar proxy’ sends a single span (JSON format), asynchronously, anytime, after receiving response for the request which was originated by application.

** Can we bypass Jaeger Agent?
Yes for C++ Jaeger ClientLib.

** Can Jaeger Collector work on UDP?

** How to use Baggage in Jaeger headers?
Key: uberctx-{baggage-key}
Value: url-encoded string

** How to use Baggage in Zipkin B3 header?
The support is only for Java and Go languages

** What is thrift It is for RPC with format like: JSON, Binary etc.

** what is TChannel?
It is a protocol over TCP for RPC

** Does Zipkin supports binary/compress format?
Zipkin can work on TChannel. It also supports compact Thrift format. However, Jaeger is better as being CNCF project.

** TChannel, Thrift, or its combination, which one is better?
Now, Jaeger collector supports gRPC as well. gRPC can be even better choice.

** Wild card query is supported at Jaeger UI?
No, due to limitations of other storage implementations. However, one can use Kibana + Elastic Search for the same.

Programming Kubernetes - I

Meetup Event :

on 24th August 2019

* Only API server interact with etcd

* Extend K8s

1. Extend life cycle of API server by adding new controller
2. add more APIs : by adding new API resource types and by adding CRDs
3. cluster daemons for automation. E.g. collecting metrics
4. cluster assist to extend functionality. E.g. SSL certificate manager. 

* Action or commands on K8s resources

1 create
2 read
- get
- list
- watch
3 update
- patch
- replace
4 delete

Here are all such actions/command on Deployment resource



Short form : GVR = group, version, resource 

Possible versions: 
Alpha (v1alpha1)
Beta (v1beata1)
Stable (v1)

* Few useful commands

kubectl api version
kubectl api-resource

we can get short names
kubectl get --raw 

* KIND used at YAML file is corrosponding to golang type. For any built-in K8s object:
1. has multiple struct in Go langugae corrpospond to each K8s object at YAML file.
2. folder has multiple files. Each file is corrsoponding to one K8s object. 
* K8s support for client library implemented in many languages: 
Official support for : Go, Python, Java, DotNet, JavaScript, Haskell
Many more language supported by community implementaiton
Please refer: The source code is available at
Out of all of them: client-go has cache and many more features. Kubectl and prometheus-operator also internally use client-go library. Important packages / utilities of client-go library are described at blog E.g. Kubernetes, Discovery, Dynamic, Transport, Plugin, Scale, Util, tool/cache etc. tools/clientcmd package is useful to setup client from kubeconfig file. 

* Flatcar Linux: 

- an immutable Linux distribution for containers. 
- a friendly fork of CoreOS’s Container Linux and as such, compatible with it. 
- a self-updating operating system 
- It is designed for containers, making it ideal for running Kubernetes and other container platforms. 
- It aims to be an independently built, distributed, and supported Linux distribution designed for container workloads.
Reference :

* apimachienry
- Scheme, typing, encoding, decoding, and conversion packages for Kubernetes and Kubernetes-like API objects.
- This library is a shared dependency for servers and clients to work with Kubernetes API infrastructure without direct type dependencies. 
- Its first consumers are,, and

* "~/.kube/config" path has all the security related file to interface with K8s master node (or minikybe) kubeconfig has context

* controller uses service account. secreat is mounted inside pod

* jq is a lightweight and flexible command-line JSON processor. It is like sed for JSON. Reference :

* YAML file consists 

1. api version
2. kind
3. matadata
4. spec
5. status
everything under metadata is in type of go language

Read Annotations

Unit testing of controller with fake client

* Join K8s slack channel "k8sBLR"


Go Client to communicate with K8s cluster:

Schema of the external API types that are served by the Kubernetes API server: 

All relevant blogs: 

PPT slide deck:

Github accounts
Relevant blogs


Alternatives of tcpdump

There are many tools similar to tcpdump, as per

Here, I choose only Free and Open Source tools, whose docker image is available and tool is lightweight.

  1. Ngrep is best, for capture only those packets, whose payload has certain pattern.

  1. Packetbeat is lightweight open source packet analyzer. It sends data to Elastic Search OR Logstash. It is not inline to datapath. So no impact on latency. It consumes high CPU. Packetbeat can run as sidecar Docker container:
It can capture all HTTP headers from request and response

  1. Tranalyzer is Lightweight open-source flow generator and packet analyzer for practitioners and researchers

  1. Justniffer is like tcpdump. Tcpdump is for TCP, while Justniffer for HTTP. Useful to debug webserver.

Digital Certificate and SSL

1. cryptographic algorithms, 
1.1 Conventional cryptography (symmetric key)
1.2 Public Key cryptography 
2. message digest functions, = one-way hash
3. digital signatures
Encrypt 1. digest 2. seq number 3. etc. using private key

DER is based on BER. Digital certificate is converted to binary format using DER. Then Base64 convert + add prefix BEGIN + add suffix END = PEM format.

Cipher suite
1. Key Exchange Method : RSA, DH. with / without signature
2. Cipher for data transfer
2.1 No encryption
2.2 Steam cipher
2.3 Block cipher
3. Message Digest for creating MAC.
3.1 no digest
3.2 MD5
3.3 SHA

SSL Record Protocol between TCP and HTTP layers
1. Input from HTTP goes to RPU (Record Protocol Unit)
2. Compress input
3. add MAC
4. encrypt
5. output as TCP payload

TCPdump inside docker

For TCPDump 1

k get pod productpage-v1-8554d58bff-rz25r -o json | grep containerID

docker exec ff8e6d1a169bc225ad1e357b54445e9055423189b900176bcc6cdd393f9cd83d /bin/bash -c 'cat /sys/class/net/eth0/iflink'

ip link | grep ^47

tcpdump -i

For TCPDump 2


- name: tcpdump
   image: corfr/tcpdump
     - /bin/sleep
     - infinity
k get pod productpage-v1-8554d58bff-rz25r -o json | grep containerID

docker exec 867662a10a0324059b71d3be9765069b900eca4f2f5f29fdb2e7b7792fcfc726 tcpdump -s 0 -n -w /tmp/container.pcap

docker cp 867662a10a0324059b71d3be9765069b900eca4f2f5f29fdb2e7b7792fcfc726:/tmp/container.pcap .

Istio Practical - 1


Istio version istio-1.3.0-rc.1 at path Downloads/istio-1.3.0-rc.1
Helm version helm-v2.14.3

sudo apt-get install socat

kubectl create serviceaccount tiller --namespace kube-system

kubectl create clusterrolebinding tiller-cluster-rule --clusterrole=cluster-admin --serviceaccount=kube-system:tiller

helm init --wait --service-account tiller

kubectl create namespace istio-system

helm repo add

helm repo update

helm template Downloads/istio-1.3.0-rc.1/install/kubernetes/helm/istio-init --name istio-init --namespace istio-system | kubectl apply -f -

helm install --wait --name istio --namespace istio-system Downloads/istio-1.3.0-rc.1/install/kubernetes/helm/istio \
  --set gateways.istio-ingressgateway.type=NodePort \
  --set gateways.istio-egressgateway.type=NodePort \
  --set grafana.enabled=true \
  --set kiali.enabled=true \
  --set kiali.dashboard.grafanaURL=http://localhost:3000 \
  --set kiali.dashboard.jaegerURL=http://localhost:16686 \
  --set servicegraph.enabled=true \
  --set telemetry-gateway.grafanaEnabled=true \
  --set telemetry-gateway.prometheusEnabled=true \
  --set tracing.enabled=true \
  --set sidecarInjectorWebhook.enabled=true \
  --set global.mtls.enabled=false

K8s Interfaces

Istio HandsOn

Istio 101

Istio 101 
Meetup event by
Kubernetes & Openshift India Community


Challenge with microservice

- Service Discovery
- Load Balancing 
- Monitoring and Observability
- Network resiliency
- Latency
- Security

Istio : Connect, Manage, Secure microservices. 
Istio has rich policy driven ops IFTTT

Istio has evolved. 
When people realized the challenges with micro services, Netflix OSS has developed following tools

Hystrix: Circuit Breaking
Zuul: Edge Router
Ribbon: Service Discovery, LB
Eureka: Service Registry
Brave / Zipkin: Tracing

Spectator / Atlas : Metrics

However they are specific to Java. Addition code was added existing Java application code. 

In case of Istio, side car proxy container is added to each pod. The existing application code is not modified. Istio can be used for application developed in any language and polyglot applications. 

Early version of Istio was not optimized. Industry was skeptical and reluctant to adopt Istio. For each request, Envoy Sidecar proxy contacts Mixer module for policy check. After the request is processed, it updates the metrics to Mixer. Later on Caching was added. The early adopters of Istio, themselves contribute back to Istio. Lately many many performance optimization happened in Istio. Now more and more micro service based applications are using Istio. 

Istio : Production deployment

Success : eBay, IBM
Failure : BigBasket

Few analogy between Open Shift and Kubernetes. 
* project = namespace
* oc = kubectl
* oc expose service = ingress in k8s
Side Car proxy can be injected by two ways
1. mannual injection with istioctl command
2. automatic injection: by annotation for mutation webhook
istioctl modules talks with istio's control plane component by name Pilot
IstioAuth module is not Citadel
================= We had interesting question about Mirroing / Shadowing the incoming request. How even a new TCP session will be created? 

- name: tcpdump
   image: corfr/tcpdump
     - /bin/sleep
     - infinity
at Deployment.yaml
under spec: containers:
Cross cluster federation is also present at Istio, in case if the application is deployed on two different clusters hosted by two different cloud service provider. 
There are set of istio-ctl commands for debugging the application deployment. I found this URL :
Envoy proxy is light weight, efficient and very powerful. It has lots of configuration options. One should avoid play around with them, at beginner stage. 
Istio can be installed using Helm chart. Another option is to use Maistra Istio-operator. It is wrapper around Helm chart. 
Redhat offers Istio as "OpenShift Service Mesh"

For cartoons :


Slide Deck :

Disclaimer : This blog is just my note from an event, that I attended. It is not verbatim of any speech. This blog may not indicate the exact expression/opinion of speakers of the event, due to my possible mistake in taking note. Any corrections/suggestions are welcome.