To know what is going on in your container network and to control the flow of traffic we need tools that are well integrated into the stack. Cilium and hubble are tools that provide many options to control flows and to observe what is happening.

What is cilium?

Cilium is a container network interface plugin to provide eBPF-based networking, observability and security. I will not go through eBPF and what it is in detail. For more information the ebpf.io website is an excellent source of information.

What is hubble?

Hubble allows us to monitor the network behavior of cilium managed Kubernetes pods. It will allow us to troubleshoot network connectivity issues when we are trying to lock down containers as much as possible.

In this post I will go through

• locking down a container and
• debugging connection issues.

Target (simplified) architecture

eBPF-based Networking, Observability and Security

In advanced Kubernetes setups requirements for the networking stack become more advanced. There is an increased need for observability and security. Container runtimes use container network interface (CNI) plugins to create network interfaces for the containers.

There are multiple CNI plugins like

• kubenet
• Azure CNI
• Cilium
• and many more

Some of the customers I work with use Cilium. To get a better understanding it helps myself to take this plugin for a test drive.

Setting up Cilium and Hubble on AKS

The Cilium documentation has instructions on how to setup it up. The steps I took are as follows:

• Bring your own CNI plugin with Azure Kubernetes Service (AKS)
• Install Cilium with Helm, select AKS (BYOCNI)
• Setup hubble

When I first got started I had no clue what happened under the hood or how to know if everything is setup correctly. To make sure everything is working the documentation includes validate steps. Make sure to run through those sections.

A container for some experiments

For the first steps we just need a container with a small footprint. I like to use an alpine image for this purpose. From here on I am assuming that you have configured kubectl to work with your cluster. I am running everything in the default namespace.

# run on local machine
# This will run a pod and allocate a tty to play around

# Note: The label "app" is important we will be using that
# later to target this pod
kubectl run -it alpine --image=alpine --labels="app=alpine"

You are now attached to the pod and can run any command available. Let's run a first simple test to check if our DNS is working. If you get disconnected from your pod you can use kubectl attach to reattach to the pod.

# Reattach to the container
kubectl attach alpine -c alpine -i -t

Nice! Getting a response and the name could be resolved. Now we make sure that we can do a HTTP GET request and get a response with status code 200. This status code will indicate a successful HTTP request to the server. To execute the request we need a command to do this. I usually use cURL for that. To install run the following command in the container.

# run in pod
apk add curl

Now we can use cURL. I am only interested in the status code. With the -I option we will only see the headers, that is enough.

Again, this is looking good. Our pod can communicate to the outside world of our cluster. It can actually connect to anywhere in the world.

The container keeps running even when we exit the tty. To reattach to that container we can use

Locking down the container

Locking down the container can be achieved with a cilium network policy. To get started we apply the following basic policy. It only has a name locking-down-alpine and the name of the pod we want to target. By default if no rules are applied, everything is allowed.

apiVersion: "cilium.io/v2"
kind: CiliumNetworkPolicy
metadata:
  name: "locking-down-alpine"
spec:
  endpointSelector:
    matchLabels:
      app: alpine

# run on local machine
# applying the policy
kubectl apply -f ./locking-down-alpine.yml

Deny everything

By defining empty ingress and egress definitions we deny all traffic to and from the pod.

apiVersion: "cilium.io/v2"
kind: CiliumNetworkPolicy
metadata:
  name: "locking-down-alpine"
spec:
  endpointSelector:
    matchLabels:
      app: alpine
  egress:
    - {}
  ingress:
    - {}

If you try to run nslookup, apk add or curl -I you will get timeouts or similar error messages

Allow DNS

So first, let's check how to find out to which service the pod wants to talk to. To use hubble to observe traffic
we forward hubble's port to our machine. Run the following command on your local machine

# Run on local machine
# I like to run the port-forward as a process in the background, hence the & at the end
cilium hubble port-forward &

Now, in the container we try another nslookup www.microsoft.com. And now we observe what happened using hubble.

hubble observe --pod alpine

And depending on your configuration the visualization might differ. This is telling us that our alpine pod in the default namespace is trying to talk to the coredns service in the kube-system namespace. The port we want to talk to with coredns is 53 (the port for DNS) and the protocol used is UDP. It might not look like much but when you are investigating connection issues this is a lot of information that we are getting here.

Let's adjust the egress rule for our pod.

apiVersion: "cilium.io/v2"
kind: CiliumNetworkPolicy
metadata:
  name: "locking-down-alpine"
spec:
  endpointSelector:
    matchLabels:
      app: alpine
  egress:
  # Allow traffic from our endpoint alpine to the endpoints
  - toEndpoints:
    # that match the following criteria
    - matchLabels:
        # have a label 'k8s:io.kubernetes.pod.namespace' with value 'kube-system'
        "k8s:io.kubernetes.pod.namespace": kube-system
        # and a label 'k8s:k8s-app' with value 'kube-dns'
        "k8s:k8s-app": kube-dns
    # and uses the following ports
    toPorts:
      - ports:
        # port 53 and protocol UDP
        - port: "53"
          protocol: UDP
  # Do not allow any traffic from the outside in
  ingress:
  - {}

Using hubble observe we should now see that traffic is allowed and requests are forwarded.

Allow HTTP traffic to a specific domain

Running curl -I www.microsoft.com will still timeout. Using hubble observe we can investigate who is trying to talk to whom.

To make allow and deny rules easier to understand I prefer to use fully qualified domain names (FQDNs). For the next person to understand what is going on it is easier to understand that a rule allows traffic to www.microsoft.com rather than 80.67.94.7.

apiVersion: "cilium.io/v2"
kind: CiliumNetworkPolicy
metadata:
  name: "locking-down-alpine"
spec:
  endpointSelector:
    matchLabels:
      app: alpine
  egress:
  - toEndpoints:
    - matchLabels:
        "k8s:io.kubernetes.pod.namespace": kube-system
        "k8s:k8s-app": kube-dns
    toPorts:
      - ports:
        - port: "53"
          protocol: UDP
        # There is a challenge with alpine/musl and how a dns refused response is treated. This is
        # a not so elegant work around. As DNS is not simple I avoided going for a better solution for
        # now.
        # https://docs.cilium.io/en/stable/policy/language/#alpine-musl-deployments-and-dns-refused
        rules:
          dns:
            - matchPattern: "*"
  # allow traffic to a FQDN that
  - toFQDNs:
    # matches the pattern "*.microsoft.com"
    - matchPattern: "*.microsoft.com"
  ingress:
  - {}

Applying the rule kubectl apply -f ./locking-down-alpine.yml, running curl -I www.microsoft.com in the container again and using hubble observe to check if everything is working as expected.

In case you are wondering why there are so many requests going back and forth between our pod and the target website, you can actually see the steps involved in a TLS handshake.

Thanks for making it this far

If you have any questions or suggestions, either contact me on twitter @devndive.

A new position at Microsoft is enough action for the first half of the year, right? When my brother and one of my sisters signed up for the PSD Triathlon in Düsseldorf I did not want to task load myself with another challenge. A bit later my second sister signed up and I was the only one left not participating. With 3 siblings excited for the event I wanted to at least get fitter. I started looking for a personal trainer. The way I am, offers have to be compared and evaluated. That involves tabs.

I decided to contact someone from the first 3 tabs. Prepared a short text describing what I want to do. Basically from couch potato to healthier lifestyle. The next morning an email arrived from Stefan Helwig. I was 100% sure I did not contact this person but hey - let's see how this works. Fast email response time and an offer to have a quick getting to know call a few days later. During the call we talked about goals and I mentioned the triathlon. We agreed that this is a good and achievable goal.

The first trainings

Totally motivated I showed up for the first training. A little bit of warming and then start running. I was pretty out of shape and jogging for more than 600m - no chance. Having at least one too many layers of cloths it got pretty warm. The first training was about

• how to warm up
• key parts of running technique
• and getting started

The beginning was tough. Heart rate was high, speed was low. Small steps. During this time we also started the swim training. I did a lot of swimming during my childhood / teenage years. Working on my technique was rewarding. I started seeing improvements in my everyday life, less sweating and less effort needed for other sports and activities.

Before the event

The weeks before the event I started to compare running and biking activities from the start to where I was then. Tracking my training made this pretty easy.

Basically I got faster and my body was able to perform at a lower heart rate. Seeing this impressed me a lot. Already pretty hyped about the actual event this gave me another boost of confidence that I will for sure finish the triathlon standing. During my training we focused on running and swimming. I used my bike more but never trained for the distance. I did two tours with a friend. The first one ground and scared me a bit. It was super hard for me. The second one was another confirmation that the training is going in exactly the right direction

Everything prepared - the day may come.

The event

I arrived in Düsseldorf on Friday already. A light job in the afternoon. Saturday we spend at an outdoor swimming pool; it was just too hot for anything else. We participated in a "Pasta Party" the night before. Went to bed early.

Sunday morning breakfast at my brothers home at 7 o'clock. My siblings arrived and we left for the starting location at 7.45. Everyone ready and focused.

During the setup of our changing area first swimmers from the olympic distance returned to switch to cycling. The atmosphere was overwhelming. With everything setup we were ready to proceed to the water starting area. From a short briefing to a water start. I was so excited that I did not even hear the starting sound clearly - started swimming when everyone else did.

Swimming in open water is a whole other discipline than in a pool. Luckily I was well prepared. Getting to the first buoy felt like it took forever. Recalling my training to just swim like it feels good - long strokes, gliding and regular breathing helped. After the first turn it was more like, got that done check, next one till I left the water.

Switching from swimming to running to my bike was tougher than expected. Switched to shoes, quick big sip of water, take the bike and off I went. The cycling started with a head wind. The motivation for having rear wind on the way back kept me going. After about a total time of 60minutes I returned to the changing area.

Finding my spot, storing the bike, another quick sip of water and start running. Well, had to return after a few steps to leave the helmet at the bike Oo. The running distance was pretty smooth. Took a drink at the water station, tried to drink, almost puked. Guess my body was not ready to really process something. The second round it was easier to drink another sip.

During the second round the excitement already kicked in that I am on the final lap. Getting closer to the finish line and finally getting through. Done. My siblings already waited for me. Due to my delayed sign up I was in a different starting group than them.

We all reached the finish line safe and sound. An amazing day!

Thank you

A big thank you goes out to all the supporters, family and friends that helped with everything from lending me a bike, to making sure I have time for training, to cheering and keeping my head focused on finishing and not being to competitive.

After the event is before the event - next sprint distance is planned for the 18th of September - olympic distance 2023! To be continued ...

Introduction

On March 16th 2020 our office officially closed. Everyone had to work from home. Since then I have been working from home, round about 100 days.

This is a little recap on what worked well and what did not.

Context

I live in Berlin and we are very fortunate to have a small garden and balcony. In my free time I like playing online games. My setup at home was pretty decent already, a good chair, a very good screen (4k, 60Hz), a small office, no kids.

Sorting things out

The first days and weeks where mostly about figuring things out. How to separate work and life, how to live healthy, how to distribute information and how to stay connected to friends and family.

Work life balance

In uncertain times strict schedules help me a lot. This was task one. Start working at 9.00, lunch from 12.00 to 13.00 o'clock, end of day at 17.00. To end the day I did some sports (running or yoga).

The strict schedule frees up my mind and I can focus on other tasks. A clear start and end helps to get into work mode and out of work mode.

With the regained time of not having to commute (about 1 hour a day) we started cooking more and decided to go with HelloFresh.

Work and distributing information

The actual work and processes we have in our team did not really change. We extended our standup by 20 minutes to compensate for the morning coffee we used to have. Our virtual coffee break is for all topics, off topic, private chat, work stuff anything that is on our minds.

Our nice scrum board at the office got retired and the work is organized with JIRA. We have a lot more comments now on our tickets. This ensures information does not get lost or stays between two people.

Living healthy

• Tracking calories
• Breakfast, Lunch, Dinner
• Enough and good rest
• A bit of sport

That's about all I did.

Keeping in touch with family and friends

My family does not live in Berlin. So it involves travelling which we did not do. Over the time parts of the family came to visit us in Berlin. A vacation where we will see my brother is already planned and booked.

We spend one week of vacation visiting some friends not too far away. This was time very well spent.

Till now, this area of life we did not figure quite out yet. Things are calming down and we will see how to improve here. Of course you can always have a call, but still, kids grow up fast and it is always nice to meet and have some time together.

What did not work so well

Overall things worked out okay. The main parts I will change in the near future are

Private life

To end every work day with some sport is really nice. But we did not manage to keep up with it. Once you start slacking it is really hard to get back into it. The plan now is to not be too ambitious and start with 2 days of sports every week.

At work

Staying in contact with people from other teams is not easy. If you have dependencies on each other it is easier. If not, you have to call them and just chat. This part I have been missing out on and will get to more often.

Things I can recommend

A few things that I really like in my home office setup. For the sound and video you can check a blog post from Scott Hanselman. It is a very good starting point.

Height adjustable desk

This is the one item that really changed working from home for me. In the morning I enjoy my coffee, prepare the day while sitting. In the afternoon I work standing up. Keeps your mind fresh and helps with your posture.

A decent webcam

When you do a lot of calls, a decent camera gives people looking at you a more face to face feeling. With the build in notebook cameras it is easy to be looking down on people.

Microphone / Sound

Make sure your sound setup is good. Meetings with bad sound quality are very hard to follow. Test how your voice sounds to others. MS Teams and Skype have a recording function to test what you sound like to others. Make sure you do not annoy people with our sounds for incoming mails or other notifications.

Thanks for making it this far

There are still a lot of things to improve. Overall I am happy and will ensure that future work is possible to do from home.

Feel free to reach out if you have questions or feedback.

A frequent question I get "How do software engineering and diving go together?".
The explanation starts with learning, going to improving your skills, caring
about the environment over to mentoring people to improve their skills.

Learning

In this section I will explain how we (@PADI) let people learn to dive and how
I let people learn to code.

Diving

Learning to dive is a live changing experience. The 70% ^[1] of our earth
covered by water become a place you can start to discover and explore. You will
be able to see turtles, alligators, dolphins, sharks and all kinds of other
magnificent creatures in their natural habitat. Teaching someone to dive is
more about mentoring them to learn diving by themselves. Training every skill in
a safe environment, a swimming pool or a place with pool like conditions, is the
key. This allows the student to tryout new skills and practice them until
mastering them.

How do you you introduce new skills? You demonstrate them with emphasis on the
key features of the skill ^[2]. After the demonstration the student can then
repeat the skill. Once they have mastered the skill they will perform the skill
by themselves in open water (the ocean, a lake, or such) without prior
demonstration. This ensures that they memorized that skill with the key
features.

Software engineering

When you start software development it opens completely new areas for your
professional career or a new hobby for your time off. It can start letting you
automate your home or find a new job. When new software engineers start in my
team I make sure that they learn to code or improve their skills by themselves.
New skills will be introduced in a safe environment, version control and our dev
stages. This helps the new person to adjust to our processes, naming
conventions, code styles, etc.

How do you introduce new skills? Depending on the current skillset I let the new
person start with a tutorial and then jump into fixing simple bugs. The tutorial
part can be skipped if skills for the current project are sufficient. Code
reviews and pairing sessions ensure that developers can learn, practice, make
mistakes and get the appropriate feedback to improve further. As they progress
they will implement complete new features and participate more in architecture
discussions.

Improving skills

Once you have mastered a base set of skills you want to explore new things.

Diving

Once you have mastered the basics, it is time to advance to new depths, explore
wrecks or dive in cold waters. For these special conditions some more skills are
needed. By now you usually have some idea of what interests you most or which
areas of the world you want to explore. Again you will be looking for a mentor
that can foster safe learning to let you learn and practice the skills so you
can rely on them when needed.

Software engineering

After you have gotten a good taste for the project/programming
language/framework it is time to go deeper, explore basic concepts of
libraries/languages/frameworks used. At this point developers start noticing
areas they are really interested in and you can guide them to explore those
areas more. This helps a lot in T-shaping your team.

The environment

Caring about the environment is very important if you look at things like the
climate change. In the IT world you need to care about the environment by using
resources efficiently and by taking care of the communities you rely on
(stackoverflow, opensource, etc).

Diving

In diving we can and need to take care of the underwater world. We can do so by
documenting the amount of garbage found ^[3] and cleaning it up. But there are
also things you can do without touching anything, be aware of your fins, avoid
garbage if possible and recycle what ever is possible.

Software engineering

Looking at the amount of computers running now a days, it is always a good idea
to make sure you use those resources properly. You can shutdown unneeded servers
in dev and test stages during nights and weekends or you can try to avoid
servers at all (go serverless ^[4]).

The other environments that need to be taken care of are the communities that you
rely on. If you are using stackoverflow upvote answers that really helped you.
Of course it is also possible to raise questions and post answers.

When working with git for sometime you might encounter some challenges. From making mistakes to growing needs for strategies of branching and merging to monitor the history of accidental committing of secrets.

Learning

There are some resource to learn git - here is a guide you can use to teach someone a bit more about git

• How to teach Git
• Mastering Git by thoughtbot
• Git command explorer

Making mistakes

Be careful what you are doing because you are altering the past, it can have unforeseen consequences for the present and future!

• Oh shit, git!
• On undoing, fixing, or removing commits in git
• Changing author info

Branching and merging

The obvious one is git-flow. Personally I have not used it in any team so far because the "overhead" was just not worth investing time in. The branching model that worked for me best so far:

Having

• master branch -> CI/CD -> to production / pre production
• develop branch -> CI/CD -> to dev stage
• feature branches -> CI/CD -> to verify dependencies are up-to-date, linting, unit|e2e tests are passing

Merging is always done from feature to develop to master branch. You can gather multiple features in develop and at the end of the sprint / development period merge to master.

This allows you to do hot fixes in production at anytime. Later you can than decide if you merge / cherrypick the hotfix to develop or anything else that works for you.

Monitoring your history

There have been some reports of people pushing private keys to public repositories. To check your repositories history for common security relevant filenames and extensions the UK Home Office has published a repo-security-scanner than can be configured to look for certain things in the history.

Be aware that this is only a post commit measurement, so stuff has already been committed and maybe pushed.

Git in detail - write your own git client

• Write your own git client

Nowadays, it has become quite easy to build nice looking websites without investing time into your styling.

Here are some libraries to try

Currently using in my project learning vuejs

• getuikit

Used in my project to explore current version of angular

• papercss

Non bootstrap based

• Element
• Bluma
• Milligram

Some themes for bootstrap

• Bootstrap 4 Themes
• Sign app - Admin template
• PatternFly

Iconsets

• vivid.js
• octicons

Vector graphics

• Illustration Gallery by manypixels

Bremen, 30.08.2016: Endlich geht auch für mich die Reise los. Gestartet wird am Bremer Hauptbahnhof und auf gehts in Richtung Frankfurt. Eine Nacht verbringe ich in einem Hotel am Flughafen. Nach einem gemütlichen Frühstück geht es langsam auf zum Terminal.
Zum Glück macht der Check-In Schalter schon etwas früher auf, so dass die Wartezeit nicht allzu lang ist.

Mein Flug soll eigentlich um 15:15 starten... Wäre nicht genau an dem Tag irgend so ein Depp der Meinung gewesen es ist eine super Idee sich in den abgesperreten Bereich eines Flughafens zu begeben, ohne sich vorher odnungsgemäß vom Flughafenpersonal checken zu lassen... Von dem ganzen Evakuierungsprozedere bekomme ich zum Glück nichts mit. Nur die Auswirkungen bekomme ich zu spüren. Statt 15:15 steht plötzlich 17:15 an meinem Abfluggate. Nach ca. einer Stunde warten ohne irgendwelche Infos gibt es dann eine Durchsage, dass der Flieger nach München umgeleitet wurde und jetzt auf dem Weg nach Frankfurt sei. Naja mal abwarten, der Puffer in Dubai zum Umsteigen sollte auf jeden Fall locker reichen.

Um ca. 17:30 geht dann auch endlich das Boarding los und kurz danach ist der Flieger in der Luft.
In Dubai habe ich dann statt der eigentlichen 4 Stunden nur noch ca. 1 1/2 Stunden zum Umsteigen, was aber auch noch ohne Stress reicht. Der Flug nach Manila kann dann wegen technischer Probleme am Flughafen erst etwa eine halbe Stunde später als geplant starten.

Nach einem wieder sehr ruhigen Flug lande ich dann endlich um ca. 17 Uhr Ortzeit am 01.09 in Manila. Dort werde ich von Yann in Empfang genommen.

Da es schon zu spät ist um noch mit der schnellen Bootsverbindung nach Sabang Beach zu kommen und Yann noch eine Besorgung für das Hotel machen muss bleiben wir für eine Nacht in Manila. Die Besitzer des Hotels haben dort ein kleines Appartment, welches sie bei Bedarf ihren Gästen zur Verfügung stellen. Leider müssen wir am nächsten Morgen schon um 6:30 wieder los (irgendwas mit bestimmte Autos dürfen ab einer bestimmten Uhrzeit nicht mehr in der Stadt fahren). Also holt uns unser Fahrer ab und bringt uns außerhalb zu einem Einkaufszentrum (Yann muss ja noch was besorgen). Die Shops dort machen um 10:00 Uhr auf, wir sind um 7:00 Uhr dort. Zum Glück ist schon ein Cafe geöffnet. Also irgendwie 3 Stunden mit Kaffee und Frühstück rumbekommen, dann kurz 5 Minuten die Besorgung erledigen und weiter gehts in Richtung Hotel.

Da Sabang Beach auf einer anderen Insel liegt als Manila, muss man wohl oder übel mit dem Boot fahren. Die heißen hier traditionell Bankas und sind etwas abenteuerlich. Zum Glück spielt das Wetter mit und es ist nicht allzu wellig.

Nach ca. 1 1/2 Stunden Boot fahren (inkl. einer Delfin Sichtung) bin ich endlich in Sabang Beach und dem Garden of Eden angekommen.

Ich bin hier. Es geht los. Naja, noch nicht so wirklich. Mehr als ein kaputtes Netzteil auswechseln und eine Software für einen Tidencalendar installieren ist noch nicht zu tun.

So kann man erstmal in Ruhe ankommen. Tauchequipment ist jetzt auch vorbereitet. Der erste Tauchgang muss aber noch ein wenig warten da gerade eine Gruppe aus Wien hier ist.

Der Bungalow

Der Bungalow liegt auf einer Anhöhe.

Es sind schon einige Treppen die man erklimmen muss, dafür hat man einen schönen Ausblick.

Essen

Frühstück!

Ausblick beim Abendessen - läuft.

Es geht los

Freitag, 12.08.2016
Online Checkin

Samstag, 13.08.2016:
12.03 CET - 12.55 CET Uhr - U-Bahn zum Flughafen
15.15 CET - 23.35 GST Uhr - Flug von FRA nach DXB

Sonntag, 14.08.2016:
Boarding für den Flug nach Manila beginnt laut Boardingpass und Anzeige um 2.45 Uhr morgens. Für Notfälle den Wecker gestellt auf 2.30 Uhr. Der Wecker klingelt pünktlich, Rucksack auf, ab zu den Toilette - Zähneputzen. Auf dem Weg dorthin, ca. 2.35 Uhr eine Durchsage - EK332 (mein Flug) Final Call! Erster Gedanke - FUCK - ab zum Gate! Am Gate angekommen stellt sich zum Glück heraus, dass das eine falsche Ansage war und das Boarding noch nicht begonnen hat. Ich bin wieder hellwach. Boarding beginnt regulär um 2.45 Uhr. Es geht weiter.

03.30 GST - 16.15 PHT Uhr - Flug von DXB nach MNL

Warten auf eine Gruppe die um 21.40 Uhr landen soll. Leider hat der Flug Verspätung - Landezeit 22.10 Uhr. Zeit bei Starbucks überbrückt, zum Glück gibt es kostenloses WLAN, Pokéstops, Lockmodule, Kaffee, Kekse, alles was man zum leben braucht.

Nachdem die Gruppe ihr Gepäck eingesammelt hat (ca. 22.40 Uhr) fährt leider kein Boot mehr zur Insel Mindoro. Erst wieder ab ca. 5.00 Uhr...

Montag, 15.08.2016:
Ankunft an einer großen Raststätte mit einigen Kaffees um ca. 0.00 Uhr. Von hier aus brauchen wir zum Hafen ca. 1,5 Stunden. Also Zeit bis 2.30 Uhr erschlagen. Besser hier als am Hafen, am Hafen gibt es nichts.

Abfahrt 2.30 Uhr. Am ersten Hafen sind die Wellen leider zu groß. Ab zum nächsten. Ankunft 4.45 Uhr. Boote noch nicht da. 5.30 Uhr, die Boote treffen ein. Gepäck wird verladen, alle 23 Personen steigen ein ... Abfahrt 6.30 Uhr.

1,5 Stunden später, klitschnass und ein paar Wellen später endlich Ankunft auf Mindoro im Garden of Eden.

Zum Frühstück erstmal Strammer Max und einen Kaffee. Um 10.00 Uhr bin ich erstmal auf dem Zimmer und komme zu Schlaf in einem richtigen Bett! Nach 38 Stunden Anreise, mehr als nötig!