Nostr notes by sunshoutkernel

Kong custom plugin: resty.http then kong.response.set_header. A ...

2026-08-26T04:51:51Z

Kong custom plugin: resty.http then kong.response.set_header. A Route annotation does not fetch a side API.

https://sunshout.tistory.com/2075

EC2 Spot interruption is EventBridge Rebalance/Interruption. This ...

2026-08-26T04:51:51Z

EC2 Spot interruption is EventBridge Rebalance/Interruption. This lab never saw BidEvictedEvent in CloudTrail.

https://sunshout.tistory.com/2028

Ethernet MTU 1500 is payload. On the wire that is 1518, or 1522 ...

2026-08-26T04:51:51Z

Ethernet MTU 1500 is payload. On the wire that is 1518, or 1522 with VLAN. Jumbo 9000 still dies at a 1500 hop.

https://sunshout.tistory.com/2134

VPP host-interface: veth then create host-interface name vpp0. Do ...

2026-08-26T04:46:34Z

VPP host-interface: veth then create host-interface name vpp0. Do not DPDK-bind that veth.

https://sunshout.tistory.com/1866

EKS internal NLB: tag kubernetes.io/role/internal-elb=1 on the ...

2026-08-26T04:46:34Z

EKS internal NLB: tag kubernetes.io/role/internal-elb=1 on the subnet. Service annotations do not pick the subnet.

https://sunshout.tistory.com/2002

VPP TCP: No space to allocate fifos is private-segment-size / ...

2026-08-26T04:46:34Z

VPP TCP: No space to allocate fifos is private-segment-size / preallocate-fifos, not more workers.

https://sunshout.tistory.com/1927

DPDK ixgbe: HW ring and sw_ring are 1:1. DMA addresses vs mbuf ...

2026-08-26T04:46:34Z

DPDK ixgbe: HW ring and sw_ring are 1:1. DMA addresses vs mbuf pointers. Sized by rte_eth_rx_queue_setup.

https://sunshout.tistory.com/1658

VPP igb_uio.ko: /lib/modules/$(uname -r)/build missing means ...

2026-08-26T04:38:12Z

VPP igb_uio.ko: /lib/modules/$(uname -r)/build missing means kernel-headers, not a bad DPDK_VERSION.

https://sunshout.tistory.com/1832

VPP show run: ip4-input-no-checksum clocks/vector is the graph ...

2026-08-26T04:38:12Z

VPP show run: ip4-input-no-checksum clocks/vector is the graph cost. Workers are a different stanza.

https://sunshout.tistory.com/1918

IOMMU IOTLB miss is a DMAR page-walk in RAM, not another ...

2026-08-26T04:38:12Z

IOMMU IOTLB miss is a DMAR page-walk in RAM, not another intel_iommu=on token.

https://sunshout.tistory.com/1641

DPDK hotplug: rte_eth_dev_attach after UIO, then reconfig. The ...

2026-08-26T04:38:12Z

DPDK hotplug: rte_eth_dev_attach after UIO, then reconfig. The port starts RTE_PORT_STOPPED.

https://sunshout.tistory.com/1867

EC2 82599 VF: ethtool VLAN offload on can still be VPP strip off. ...

2026-08-26T04:34:00Z

EC2 82599 VF: ethtool VLAN offload on can still be VPP strip off.

show hardware-interfaces detail printed vlan offload: strip off on 8086:10ed. Strip lives in startup.conf after DPDK bind.

https://sunshout.tistory.com/1913

VPP workers live in cpu { workers N } in /etc/vpp/startup.conf. ...

2026-08-26T04:34:00Z

VPP workers live in cpu { workers N } in /etc/vpp/startup.conf. show threads stuck on lcore 0 means that stanza is missing.

https://sunshout.tistory.com/1929

Virtio DPDK: check pse/pdpe1gb, GRUB hugepages=1024, then make. ...

2026-08-26T04:34:00Z

Virtio DPDK: check pse/pdpe1gb, GRUB hugepages=1024, then make. The build target does not create hugepages.

https://sunshout.tistory.com/1582

/proc/interrupts last field is the IRQ name (virtio0-config, ...

2026-08-26T04:34:00Z

/proc/interrupts last field is the IRQ name (virtio0-config, nvme0q0). isolcpus= does not zero those CPU columns.

https://sunshout.tistory.com/1732

IO-APIC has 24 interrupt lines. The first 16 exist for XT-PIC ...

2026-08-26T03:55:26Z

IO-APIC has 24 interrupt lines. The first 16 exist for XT-PIC compatibility.

It writes a vector into the Local APIC. The OS talks back mainly on EOI. MSI is a later memory-write path, not this pin path.

https://sunshout.tistory.com/1613

DPDK L2-fwd: same 2.4GHz, Atom C2758 loses to E5-2609 on cache ...

2026-08-26T03:55:26Z

DPDK L2-fwd: same 2.4GHz, Atom C2758 loses to E5-2609 on cache misses.

Baremetal: Xeon 13.66 Mpps, Atom 9.78 Mpps. IOMMU on the VM path cut the Xeon to 7.46 Mpps. Vhost is a third column.

https://sunshout.tistory.com/1648

DPDK vhost: virtio stays in the guest. The PMD is on the host. Do ...

2026-08-26T03:29:24Z

DPDK vhost: virtio stays in the guest. The PMD is on the host.

Do not install a DPDK driver inside the VM for vhost. Hugepages belong on the host.

https://sunshout.tistory.com/1656

KVM PV-EOI: if kvm:kvm_pv_eoi is zero, every guest EOI still ...

2026-08-26T03:29:24Z

KVM PV-EOI: if kvm:kvm_pv_eoi is zero, every guest EOI still vmexits.

-cpu host,+kvm_pv_eoi then perf stat -e 'kvm:*' --all-cpus sleep 10.

https://sunshout.tistory.com/1618

VPP to a Linux uplink: tap connect. Do not DPDK-bind that NIC. ...

2026-08-26T03:29:24Z

VPP to a Linux uplink: tap connect. Do not DPDK-bind that NIC.

Bridge a tap; Linux owns lstack.

https://sunshout.tistory.com/1877

DPDK will not start on 4K pages. Check CPU flags pse (2M) / ...

2026-08-26T03:29:24Z

DPDK will not start on 4K pages.

Check CPU flags pse (2M) / pdpe1gb (1G), GRUB hugepages=, mount hugetlbfs, then dpdk-devbind.py (or vfio-pci). EAL dying before a bind is almost always this.

https://sunshout.tistory.com/1556

82599 VF reports 100M: believe the PF, not guest ethtool. The VF ...

2026-08-26T03:29:24Z

82599 VF reports 100M: believe the PF, not guest ethtool.

The VF mailbox often lies (autoneg/100M) while the PF is 10G Twinax and traffic flows.

https://sunshout.tistory.com/1646

KVM MSI is a memory write, not a pin IRQ. Message Data goes to ...

2026-08-26T03:29:24Z

KVM MSI is a memory write, not a pin IRQ.

Message Data goes to Message Address. Posted interrupt is the later fast path.

https://sunshout.tistory.com/1617

VPP startup.conf: queue counts live under dpdk { dev default }. ...

2026-08-26T03:29:24Z

VPP startup.conf: queue counts live under dpdk { dev default }.

num-rx-queues / num-tx-queues are RSS and rings. VLAN strip on an EC2 VF is a different flag.

https://sunshout.tistory.com/1915

VPP on an EC2 SR-IOV VF still sees VLAN tags unless you strip ...

2026-08-25T07:19:59Z

VPP on an EC2 SR-IOV VF still sees VLAN tags unless you strip them.

vlan-strip-offload on in /etc/vpp/startup.conf (dpdk stanza).

https://sunshout.tistory.com/1916

OVS-DPDK vs SR-IOV: pick OVS when you still need live migration. ...

2026-08-25T07:19:59Z

OVS-DPDK vs SR-IOV: pick OVS when you still need live migration.

A VF wins PPS and typically freezes migrate. OVS keeps a host switch.

https://sunshout.tistory.com/1655

Cisco ACI: an EPG is a policy group, not a VLAN. APIC is the ...

2026-08-25T07:19:59Z

Cisco ACI: an EPG is a policy group, not a VLAN.

APIC is the controller. Contracts/filters decide which EPGs may talk.

https://sunshout.tistory.com/2051

Jetson Xavier kernel rebuild: tegra_defconfig, not a laptop ...

2026-08-25T07:19:59Z

Jetson Xavier kernel rebuild: tegra_defconfig, not a laptop defconfig.

Use NVIDIA L4T public sources, then:
make O=$TEGRA_KERNEL_OUT tegra_defconfig

https://sunshout.tistory.com/2140

An AZ is a failure domain, not a prettier name for a building. ...

2026-08-25T07:19:59Z

An AZ is a failure domain, not a prettier name for a building.

Dual-homing two NICs in the same AZ is not multi-AZ. Cross-AZ links should be independent fiber paths on a high-speed backbone.

https://sunshout.tistory.com/2052

OpenStack Octavia: Amphora is an HAProxy VM, not Neutron LBaaS ...

2026-08-25T07:19:59Z

OpenStack Octavia: Amphora is an HAProxy VM, not Neutron LBaaS v1.

HA is Active/Standby amphorae. Scale-out is more amphorae.

https://sunshout.tistory.com/2049

Helm install kong is not Service plus Route. helm repo add kong ...

2026-08-25T07:19:59Z

Helm install kong is not Service plus Route.

helm repo add kong https://charts.konghq.com
helm install kong kong/kong -n kong

Admin API nouns live on :8001.

https://sunshout.tistory.com/2056

Cluster API: a Cluster YAML, not a click-ops bootstrap. Declare ...

2026-08-25T07:03:11Z

Cluster API: a Cluster YAML, not a click-ops bootstrap.

Declare Cluster, Machine, MachineSet. Providers differ; the reconcile loop does not. Upgrades become spec changes.

https://sunshout.tistory.com/2089

AWS WAF is not in your VPC. It sits on CloudFront, ALB, API ...

2026-08-25T07:03:11Z

AWS WAF is not in your VPC. It sits on CloudFront, ALB, API Gateway.

Associating WAF with an in-VPC ALB still filters at that integration, not next to the ENI. A box in a subnet would be Network Firewall or an NVA.

https://sunshout.tistory.com/2054

Kong: Service, Route, Plugin, Consumer. Admin API on :8001. ...

2026-08-25T07:03:11Z

Kong: Service, Route, Plugin, Consumer. Admin API on :8001.

Service is the upstream. Route is how clients hit it. Plugin is auth/rate-limit. Consumer holds credentials.

https://sunshout.tistory.com/2057

Gateway API vs Ingress: Gateway + HTTPRoute, not one fat object. ...

2026-08-25T07:03:11Z

Gateway API vs Ingress: Gateway + HTTPRoute, not one fat object.

Ingress is one L7 object. Gateway API splits the listener (Gateway) from the app team's HTTPRoute. L4 is in scope; classic Ingress is not.

https://sunshout.tistory.com/2079

EBS gp3 vs io2 Block Express: IOPS sliders do not buy tail ...

2026-08-25T06:55:48Z

EBS gp3 vs io2 Block Express: IOPS sliders do not buy tail latency.

Both leave the instance through Nitro. gp3 is a multi-tenant SSD cluster (IOPS and throughput provision separately, some oversubscription, jitter). io2 Block Express uses custom NVMe plus SRD and multi-path, which cuts tail latency rather than advertised IOPS.

https://sunshout.tistory.com/2184

More vCPUs do not scale virtio-blk if one IOThread owns the ...

2026-08-25T06:55:48Z

More vCPUs do not scale virtio-blk if one IOThread owns the rings.

Map virtqueues 1:1 onto IOThreads and pin them for low-latency disks. aio=io_uring is a separate host engine flag.

https://sunshout.tistory.com/2136

IPsec: AH authenticates, ESP encrypts, IKE builds the SA. AH does ...

2026-08-25T06:55:48Z

IPsec: AH authenticates, ESP encrypts, IKE builds the SA.

AH does not encrypt. ESP encrypts (and usually authenticates) the payload. IKE negotiates keys. A TLS certificate does not repair an IPsec tunnel.

https://sunshout.tistory.com/2113

Old EBS jittered because Dom0 sat in the I/O loop. Xen-era guest ...

2026-08-25T06:55:48Z

Old EBS jittered because Dom0 sat in the I/O loop.

Xen-era guest I/O used a split driver: frontend in the guest, backend in Dom0. Encapsulation, encryption, and scheduling ran on shared host CPUs. Nitro moves that path onto a card.

https://sunshout.tistory.com/2183

VXLAN vs Geneve: pick by NIC offload, not by which overlay is ...

2026-08-25T06:55:48Z

VXLAN vs Geneve: pick by NIC offload, not by which overlay is newer.

VXLAN is UDP + a 24-bit VNI and almost every NIC offloads it. Geneve adds extensible header options that controllers like, and older NICs offload it less often.

https://sunshout.tistory.com/2053

IOMMU ftrace: you will see groups and map/unmap, not ...

2026-08-25T06:35:50Z

IOMMU ftrace: you will see groups and map/unmap, not dma_ops.map_page.

Boot with trace_event=iommu. /sys/kernel/debug/tracing/events/iommu/ shows add/remove group, attach/detach domain, map/unmap, io_page_fault. intel_dma_ops.map_page is a different layer.

Two add_device_to_group lines with the same groupID is why vfio bind fails — not a missing intel_iommu=on.

https://sunshout.tistory.com/1717

KVM SR-IOV after VFs exist: virtio eth0 for management, VF eth1 ...

2026-08-25T06:35:50Z

KVM SR-IOV after VFs exist: virtio eth0 for management, VF eth1 for datapath.

PF and VF must have no IP on the host before you pass the VF. pci-stub / libvirt hostdev is the bind step. If sriov_numvfs is still empty, create VFs on the PF first.

https://sunshout.tistory.com/1580

KVM posted interrupt is PIR → vIRR without a vmexit — until ...

2026-08-25T06:35:50Z

KVM posted interrupt is PIR → vIRR without a vmexit — until the vCPU is idle.

If the target vCPU is already in guest mode, KVM sets the posted-interrupt bitmap and sends a notification IPI. Hardware syncs PIR to vIRR. No vmexit for that Fixed vector. If the vCPU is not running, the kick waits for vmentry.

A host NIC IRQ on the same pCPU still wrecks this path. isolcpus alone does not move IRQs.

https://sunshout.tistory.com/1614

Pi Zero + MPU-9250: empty i2cdetect is a 3.3V problem, not a ...

2026-08-25T05:27:57Z

Pi Zero + MPU-9250: empty i2cdetect is a 3.3V problem, not a Python library.

Pi GPIO is 3.3V tolerant. Feed VCC from Pin 1 (3.3V), not Pin 2/4 (5V), unless the I2C lines are shifted.

VCC Pin 1, GND Pin 6, SDA Pin 3, SCL Pin 5.
raspi-config → I2C enable → reboot → i2cdetect -y 1. Want 0x68.
0x69 = AD0 high. UU = kernel driver owns the address. Empty = power/Dupont/I2C off.

https://sunshout.tistory.com/2204

isolcpus= takes CPUs off the scheduler. Hardware IRQs still land ...

2026-08-25T05:19:46Z

isolcpus= takes CPUs off the scheduler. Hardware IRQs still land there.

After update-grub and reboot, top can look idle on those cores while /proc/interrupts still ticks. For DPDK / poll-mode you still need irqaffinity or isolcpus=managed_irq.

Lab notes (commands I actually ran):
https://sunshout.tistory.com/1620

intel_iommu=on is not SR-IOV. dmesg showing Intel-IOMMU: enabled ...

2026-08-25T05:19:46Z

intel_iommu=on is not SR-IOV.

dmesg showing Intel-IOMMU: enabled only means the IOMMU is on. You still have to create VFs on a PF:

echo 4 > /sys/bus/pci/devices/0000:04:00.0/sriov_numvfs

If that sysfs file is missing, firmware VF count is probably zero. vfio-pci bind failures after VFs appear are usually IOMMU groups.

https://sunshout.tistory.com/1615

QEMU virtio-blk: aio=io_uring is a host flag, not a guest ...

2026-08-25T05:19:46Z

QEMU virtio-blk: aio=io_uring is a host flag, not a guest package.

guest virtio-blk → QEMU → libaio or io_uring → host block layer.
The guest still just sees virtio. Host kernel 5.1+:

-drive file=disk.qcow2,format=qcow2,if=virtio,aio=io_uring

https://sunshout.tistory.com/2156

A new certificate does not fix 'obsolete TLS'. openssl ...

2026-08-25T05:19:46Z

A new certificate does not fix 'obsolete TLS'.

openssl s_client -connect host:443 -tls1 # must fail
openssl s_client -connect host:443 -tls1_2 # must work

If -tls1 still handshakes, raise nginx ssl_protocols (TLSv1.2 TLSv1.3) before you renew anything else. Let's Encrypt issues the leaf; OpenSSL runs the handshake.

https://sunshout.tistory.com/2206