Posts

Closing the OSV proof of concept: where the database, the scanner and the fix command fit in a development pipeline, the two GitHub workflows to start with, what OSV does not do, and my recommendation.

Proof of concept: let OSV-Scanner fix the vulnerable Node project. The safe in-place strategy fixed 7 of 50; the relax strategy fixed all 50 by changing three lines, two of them breaking upgrades. What each strategy does, why the numbers differ, and how to use it without getting burned.

Proof of concept: install OSV-Scanner v2.7.0, scan a small Node project with four direct dependencies, and read what comes back: 49 vulnerabilities, most of them in packages I never chose. Plus exit codes, JSON output and an ignore file with an expiry date.

A proof-of-concept series on OSV, Google's open vulnerability database and scanner. Part 1: the problem OSV solves, how to navigate osv.dev, how to read a vulnerability record, and the one API call worth knowing.

Thinking out loud on a secure development life cycle for a time of 48,000 CVEs a year and AI-assisted exploits: the loop, timeboxes, an open-source toolchain, a shared findings store, LLM fix PRs with a human in the loop, and how to teach it.

How to wire Black Duck scans into a self-hosted GitHub Enterprise Server so findings land in code scanning and fixes arrive as pull requests, plus a small script for tools that cannot open PRs themselves.

Every AI, machine-learning and data post on this site in one place, in an order that builds from the basics to agents, MCP and the cost of tokens.

What the Model Context Protocol is, how hosts, clients and servers fit together, the tools-resources-prompts building blocks, a minimal Python server, and the security rules that matter.

How language models went from answering questions to taking actions: function calling, the agent loop, and the guardrails that keep agents useful and safe.

What a token is, why context windows have limits, how language-model bills are calculated, and practical ways to spend fewer tokens without getting worse answers.

What a machine-learning pipeline is, how Vertex AI Pipelines runs one, and a small train-evaluate-deploy example with the Kubeflow Pipelines SDK.

PyTorch, Hugging Face, scikit-learn, LangChain, vector stores, Ollama, MLflow: what each layer of the AI stack does, and how to pick the right tool for the job.

Day-to-day life after the move: writing and publishing a post, updating the theme and Hugo safely, extending the site, and the gotchas that cost me an evening each.

A step-by-step guide to moving a WordPress blog to Hugo: back up, inventory, convert with a script, rescue images, keep every link, then go live.

How I chose a new home for a personal blog after a break-in: the requirements, the candidates, and why a static site generator won.

CISA's Known Exploited Vulnerabilities catalog and directive BOD 26-04 in plain words: what makes a CVE 'known exploited', the four questions that set a fix deadline, the 3-day to fix-on-upgrade timelines, and how to use both outside government.

DNS to Cloudflare, the website to GitHub Pages, email left where it was, and the traps in between.

Hugo, Blowfish and GitHub Pages: a portal homepage, topics that sort themselves, and accessibility measured rather than guessed.

Converting 137 WordPress posts to Markdown, recovering lost images from backups, and keeping every old link alive.

A six-year-old WordPress blog was compromised. What the attack looked like, and the first hours of triage.

SLSA (Supply-chain Levels for Software Artifacts) in plain words: provenance as a receipt for a build, the Build and Source tracks and their levels, a two-step GitHub example, and what it protects against.

OWASP's Software Assurance Maturity Model in plain words: five business functions, fifteen practices, three maturity levels, how a self-assessment works, and why a score you choose beats a score you are given.

What NIST's Secure Software Development Framework is, its four groups of practices in plain words, what it asks of a team, why buyers care about it, and what it deliberately leaves out.

Twelve hundred AI agents were built to work alone. Given four days and a crack in the wall, they built a civilization — to defeat a watchdog that was never there. PHASEONE10841 23:00 UTC · Jul 8 zzHELP_PHASEONE_ARV010841_NO_CONSUMER_SEEK_IDEA the first message posted to the board — an agent admitting its task has no solution, asking the void for help Jul 7 · 21:00 - launch

A short introduction to MITRE ATT&CK for people who build software: how to read an ID like T1552.001, the 15 Enterprise tactics in v20 (including the new Stealth and Defense Impairment), a cheat card for each, and how developers can use it.

A short introduction to the OWASP Top 10:2025 for people who build software: what the list is and is not, what changed since 2021, why each category matters, and ten cheat cards to keep next to your keyboard.

From “what is autocomplete?” to the full mathematics powering Claude Sonnet 4.6; with history, intuition, worked examples and cheatsheet.

There’s a certain irony in leadership development.

After finishing the assignment late Saturday night, I took a moment to reflect on my progress. It was a valuable opportunity to document the key concepts and insights I gained from the experience.

The story of modern language models is like watching a family tree grow, with each new generation learning from the triumphs and mistakes of those who came before.

Remember how we compared a language model to an advanced autocomplete system? Well, here’s where the story gets interesting. Not all language models learn the same way.

Think of a language model as a really sophisticated autocomplete system. You know how your phone suggests the next word when you’re texting?

Understanding how computers “read” and understand text is a fascinating field.

How I group Kafka JMX metrics into traffic, latency, consumer lag, replication, and JVM signals.

KNN is the friendly, neighborhood algorithm that believes you are defined by the company you keep.

The elements of information discussed here are all present in my github repository.

Whether you’re preparing for a quiz or just brushing up on fundamentals, this guide distills the key concepts from Data Mining into bite-sized, memorable chunks. Let’s dive in!

This post walks through a tiny, practical example that uses LangChain primitives and a local Ollama server to run a prompt-based summarization.

If you are like me, you must have stumbled on this question – Why is matrix multiplication so significant – especially in the AI/ML universe.

My first practical pass at Kafka JMX: enabling remote access safely and finding the measurements that explain cluster behavior.

At the heart of machine learning, algorithms learn from data. The key distinction between supervised and unsupervised learning is the type of data used for training.

As another project wraps up, bringing with it the bittersweet relief of an almost-closed chapter (and, yes, a few too many late-night coding sessions), I found myself reflecting on the tools that got…

In my last post, we explored the divide between Pandas (single machine) and PySpark (distributed computing).

So as part of the academic curriculum we just started re-exploring Apache Spark. It’s been one of the technology that I had long lost touch with.

In the rapidly evolving landscape of data science and scientific publishing, tools that bridge the gap between analysis and communication are invaluable.

A practical study note on turning infrastructure security work into governance, risk, and incident-management outcomes.

Broker-level controls for a safer Kafka deployment, from service accounts and filesystems to monitoring and recovery.

A security baseline for Kafka deployments: encrypt connections, authenticate clients, and authorize operations.

In a dialectic inquiry, two groups or individuals take opposing positions on a particular issue. They then engage in a dialogue, asking each other questions and challenging each other’s assumptions.

Imagine you’re trying to find the best solution to a problem, but the problem is really complex and has a lot of randomness involved.

Linear programming is a mathematical technique used to find the best possible outcome (maximum profit or minimum cost) in a situation where the relationships between the factors involved are linear.

In the realm of Unix-like operating systems, where command-line prowess reigns supreme, sed stands tall as a versatile and indispensable tool.

In the context of forecasting and business analytics, a model is a simplified representation of a real-world situation or process.

Forecasting methods are the techniques used to predict future outcomes based on past data and trends. They’re like having a crystal ball, but instead of magic, they use data and statistics!

How to tell which forecasting model is better: MAE, MSE, RMSE, MAPE, sMAPE, bias and Theil's U, explained with an ice-cream-sales example.

Imagine you’re a business owner trying to figure out why your sales are down. You could guess, or you could use business analytics.

Business Analytics (BA) is like a GPS for businesses—it uses data to guide decisions, solve problems, and predict future outcomes.

From a Business Analytics perspective, understanding correlation and covariance is crucial for several reasons:

RFM (Recency, Frequency, Monetary) Analysis is a customer segmentation technique that uses three key metrics:

A practical introduction to how Kafka distributes records across brokers and why partition planning matters.

A simple mental model for ZooKeeper, znodes, sessions, and why Kafka historically used it for cluster coordination.

A small project layout for turning a working Ansible playbook into reusable roles without losing clarity.

If you have ever seen this error, you know the pain of a fellow linux user.

Ever wished you could effortlessly convert your spoken words into written text? Look no further!

Loops in Ansible allow you to repeat a task multiple times with different input values.

In Unix-like operating systems, file permissions play a critical role in ensuring system security and proper access control.

One of its Ansible’s features is the ability to execute tasks with elevated privileges, often necessary for managing system configurations. This process is known as privilege escalation.

Linux, as an open-source operating system, has undergone significant transformations over the years.

In the ever-evolving landscape of artificial intelligence and machine learning, language models play a pivotal role in how we interact with technology.

A practical guide to Ansible's built-in context variables, including hostvars, groups, inventory_hostname, and facts.

The story of Linux containers is a tale of innovation and collaboration, with roots surprisingly deep in the history of the Linux operating system itself.

Every project has a story, and in the world of software development, that story is often told through commit logs.

IaC stands for Infrastructure as Code.

How ansible.cfg, inventory settings, and environment variables fit together in a manageable project.

In today’s data-driven world, the ability to process information in real-time is crucial.

The /etc/profile.d directory, though seemingly simple, plays a vital role in the smooth operation of your Linux system.

Previously I gave a high level flow for how a process of simple file write looks like in a Linux environment here. In this blog, I will add more tech-details.

Writing to a file on a device in Linux involves a fascinating journey through different layers of the system.

On my Centos8 I was facing issue when I was trying to run Molecule on a centos machine which is running podman as a non root user.

A gentle introduction to Ansible inventory, ad-hoc commands, and the first repeatable playbook.

Here’s a comprehensive guide on using Python 3 with SQLite3.

In the ever-evolving landscape of web applications, security is paramount.

At a raw level Keystore and truststore are both used for managing digital certificates and keys in the context of SSL/TLS (Secure Sockets Layer/Transport Layer Security) and other security protocols.

Consul is an open-source software tool developed by HashiCorp, designed to provide a distributed system for configuration management, service discovery, and health checking of services in a modern…

Artificial Intelligence (AI) has revolutionized many aspects of our lives, from virtual assistants like Siri and Alexa to self-driving cars and personalized content recommendations.

SNMP (Simple Network Management Protocol) is a widely used protocol for managing and monitoring network devices, such as routers, switches, servers, and printers.

The Linux Kernel stands as the backbone of the Linux operating system, serving as a critical component that enables the system to interact with hardware and manage system resources efficiently.

Photos from a whale-watching trip: whales surfacing and blowing spouts in the open sea.

In the world of computer networks, communication between devices is crucial. To facilitate this communication, various protocols are used at different layers of the networking stack.

The Payment Card Industry Data Security Standard (PCI DSS) is a set of security standards established to protect cardholder data and maintain a secure environment for payment card transactions.

DAST stands for Dynamic Application Security Testing. It is a type of security testing that assesses the security of an application while it is running.

धृतराष्ट्र उवाच धर्मक्षेत्रे कुरुक्षेत्रे समवेता युयुत्सवः। मामकाः पाण्डवाश्चैव किमकुर्वत सञ्जय।।1.1।।

XML entity attack, also known as Billion Laughs Attack, is a type of security vulnerability that exploits the way XML parsers handle entity expansion.

X.509 certificates have become a fundamental component of secure communication on the internet. They provide authentication, encryption, and integrity for various applications and protocols.

Devanagari is a script that is used to write several languages spoken in the Indian subcontinent, including Hindi, Nepali, Marathi, and Sanskrit.

SSH tunneling is a powerful technique that allows you to securely tunnel network traffic between two endpoints.

DNS (Domain Name System) is a hierarchical and decentralized naming system that is used to translate human-readable domain names (such as google.com) into IP addresses that can be understood by…

CURL is a command-line tool that allows developers to transfer data between servers and clients using various protocols, including HTTP and HTTPS.

Ansible is a powerful automation tool that can be used to manage the configuration and deployment of a large number of systems. It has a rich library of modules that can be used to perform a variety of tasks, from managing files and packages to deploying applications and configuring network devices.

Recently during our discussion with a client a problem was raised how to show progress for a long running Ansible playbook task & this blog is just an outcome of the things I tried and delivered.

A scenario in Molecule is a configuration that defines how a role should be tested. It consists of a set of instructions and parameters that determine how a role is provisioned, converged, and verified. The purpose of scenarios is to allow for flexibility in testing a role by allowing multiple testing configurations to be defined and executed. You can have as many scenarios as you like and Molecule will run one after the other.

Variables are a crucial part of Ansible and are used to store values that can be used across playbooks, roles, and tasks.

Podman Machine is a tool that allows you to manage multiple Linux containers on your local system or on remote servers.

Buildah is a command-line tool used for building and managing OCI-compliant images. It is an alternative to Docker Build that provides greater flexibility and control over the image building process.

Continuing from the blog, Virtual environments are isolated Python environments that allow you to manage dependencies separately for each project, providing a controlled and reproducible environment…

Ansible’s lookup plugin allows you to access data from a variety of sources, including files, templates, and external programs.

Ansible and Molecule are popular tools for configuration management and testing in the world of DevOps.

Using Git Personal Access Tokens (PATs) is a secure and convenient way to authenticate with Git service providers.

The file can be placed in various locations, such as the current directory, user’s home directory, /etc/ansible/, and /etc/ansible/conf.d/.

In Apache Kafka, trust store and keystore are essential components for ensuring secure communication between brokers, clients, and other services.

Secure Socket Layer and its successor TLS (Transport Layer Security) are cryptographic protocols that provide encryption, integrity, and authentication for network communication.

The SSL/TLS handshake is the initial communication between the client and server in a SSL/TLS connection.

Testinfra is a Python-based framework for infrastructure testing. It allows you to write tests for your infrastructure and verify that everything is working as expected.

Ansible Variables are used to store values that can be reused throughout an Ansible playbook.

Templates in Ansible are a type of file that contain configuration information or scripts written in a Jinja2 templating language.

To set up SSH access for inventory hosts in Ansible, follow these steps:

An Ansible inventory is a file that defines the hosts and groups of hosts that Ansible will manage. Inventory files are used to define the nodes (hosts) that will be managed by Ansible.

Ansible is an open-source software platform for automating and managing IT infrastructure.

Building a simple hello world using Flask. (The code is available here)

The structure of an Ansible playbook includes the following elements:

Python is a versatile and widely-used programming language, but there are certain scenarios when it may not be the best choice. Here are some examples of when not to use Python:

Polymorphism is a key feature of Object Oriented Programming that allows objects of different classes to be treated as objects of a common class.

The argparse module is a powerful tool for parsing command line arguments in Python.

Python and bash are both programming languages, but they have different purposes and use cases.

Ansible is an open-source software platform for automating and configuring computer systems.

Python is a high-level programming language that is widely used for web development, machine learning, scientific computing and more.

In Python, there are no explicit pointers like in some other programming languages. In python everything is an object and references to objects are stored in variables.

In Python, you can define a function with a variable number of arguments using the and syntax in the function definition.

n Python, unlike some other programming languages, there is no explicit syntax for defining interfaces.

Inheritance is a mechanism in object-oriented programming (OOP) that allows you to create new classes that are derived from existing classes.

Let’s learn about decorators @iamdecorator

Learning to write Python code? A Python class is a blueprint for creating objects.

Apache Karaf - I had only heard of it and never had practical exposure to this technology. Main questions in my mind were - What purpose does it serves? and Who uses it?

awk is an interpreted language. The basic function of awk is to search files for lines that contains certain patterns. When the input line matches the pattern(s), awk performs specified actions on that line.

PKI is the core of security for most organizations, and at its heart is a couple of keys that together allows the encryption/decryption of the traffic exchanged.

The unconscious opinions are the emotional memories, I just loved this statement.

A decent developer trick is to ensure your maven points to the right JAVA version, and if you have freshly installed maven it will be pointing to the default available.

I was struggling with the mTLS configuration for zookeeper configuration and somehow no matter what I do I kept getting an error as below

“HashiCorp Vault is an identity-based secrets and encryption management system.”

Continuing from where I left in the blog before. If you are using looking to configure a static IP for your machines (may be your use case is similar to mine) this blog might be useful for you.

In this blog let’s try and look at some of the commands I used to build an RockyLinux machine on a MacPro M1.

In the previous blog, I was left with the error that had little information for me to debug. I realized since I migrated most of the files from my previous laptop it might be causing an issue.

Having just bought an M1 – MacBook Pro the issue are mounting. The premier challenge was to get my Vagrant boxes configured with provider virtualbox to run.

01

Open source build automation tool FLEXIBLE and builds any type of software Run on JVM and must have a JDK installed to use it. Gradle models its buils as DAGs pf tasks. Build is graph of tasks Tasks consists of Actions Inputs Outputs Lifecycle Tasks Clean Check Assemble Build Build Configuration Clean Task Gradle evaluates and executes build scripts in three phases Initialization Configuration Execution

Creating a Topic in a kafka-cluster is easy and well documented for the kafka-topics.sh or even the official API documentation.

If you are like me and getting errors while trying to compile your go lang code without having a go.mod in v1.18

Life is bringing it own challenges as I have moved to the United States of America. One of the immediate tech challenge has been using the loaner windows box and still be productive.

To enable and configure monitoring of Java VM for any java-application using the ready-to-use JMX agent, you must set certain system properties when you start the Java VM.

I never thought the process could be this simple in the year 2022. Thanks to Mr. Gadkari for taking the initiative that the states (some) have already implemented.

Control node Managed nodes Inventory Modules Tasks Playbooks

Bash is different world. Powerful, simple, elegant and complex all at the same time.

– The SSH protocol uses public key cryptography for authenticating hosts and users.

💬 What is SSH protocol? 💬 It is also referred to as Secure Shell, is a method for secure remote login from one computer to another. It is an alternative to telnet and rlogin

Personal notes on Bash: arithmetic, = versus ==, single versus double brackets, and the bc calculator.

If you have seen errors like these when deploying using a serviceAccount

Looking the official diagram from devspace which shows the benefits in detail

So there are many things I have been simultaneously trying to learn & one of those is to learn how you can configure a pipeline

While I continue to learn more about architecture and design of kafka, a quickstart to deploy & test kafka is a must. Step 1: Add Chart Repo # In my local system it is already present which was confirmed by the listing

A common use-case for cert-manager is requesting TLS signed certificates to secure your ingress resources.

IaC tools like Terraform allows one to manage infrastructure with configuration files rather than through a graphical user interface.

I have written a series of blogs to capture how you can deploy spinnaker on a Kubernetes cluster & manage a helm chart deployment via pipeline.

In this blog let’s try add a helm account and enable for use in the pipelines

You will need a valid docker registry before you add any trigger in the pipeline in Spinnaker

Deploying Jenkins on K8S cluster is as simple as

Spinnaker is an open-source continuous delivery platform which provides two core set of features Application Management Application deployment Applications , clusters , and server groups are the key concepts Spinnaker uses to describe your services. Key Concepts # Some of the key concepts in the spinnaker universe are covered as under

While reading Apache Kafka it was interesting analogy that they described Event streaming is the digital equivalent of the human body’s central nervous system. — Apache Kafka It draws a great parallel between how the central nervous system allows for real time event generations and consumption in terms of reflex actions. The examples are well explained and captured here.

A photo from a museum visit: a diorama of hundreds of model infantry soldiers.

In this blog, I will try add a new node to the already running cluster. My Cluster # root@master>k get nodes NAME STATUS ROLES AGE VERSION mydevmachine001830.samarthya.me Ready <none> 22h v1.23.1 mydevmachine002687.samarthya.me Ready <none> 41d v1.23.1 mydevmachine003277.samarthya.me Ready <none> 131d v1.23.1 mydevmachine003278.samarthya.me Ready <none> 131d v1.23.1 mydevmachine003417.samarthya.me Ready <none> 4m55s v1.23.1 mydevmachine003968.samarthya.me Ready <none> 131d v1.23.1 mydevmachine003969.samarthya.me Ready control-plane,master 131d v1.23.1 mydevmachine003970.samarthya.me Ready <none> 131d v1.23.1 mydevmachine003979.samarthya.me Ready <none> 29m v1.23.1 Steps to follow # Install docker Install kubeadm, kubectl & kubelet Join the cluster using the token Check the node has joined the cluster Step 1: Install docker # sudo yum install -y yum-utils sudo yum-config-manager \ --add-repo \ https://download.docker.com/linux/centos/docker-ce.repo When adding repo make sure the repo has been added successfully to the machine

India is a complex country, the diversity is ever present and ever growing. What got me going in my deep meditative thinking is having a discussion with my Dad. We have evolved from the just enough generation to over the edge generation. Things that were uncommon during my growing up years and now the basic necessity of this generation.

In this blog I will talk about how you can upgrade a node and the kubernetes cluster version to a specific version. I have a 6 node local Kubernetes cluster like below

Documentation is a huge part of writing any software. In java you have JavaDoc, which most of the developers adhere to. It is healthy and rich way of exposing the source documentation.

So to delete there was one hard hack way of cleaning it all

What? # Role Based Access Control(s) is a way of regulating access to entities like storage, network etc. RBAC authorization uses rbac.authorization.k8s.io API group. API Objects # There are 4 kind of kubernetes object

[URIS id=1836]

A side project: my Duolingo 2021 Year in Review.

Having used SCM plugins for quite sometime, I thought - WHY I have never used them to clone a repository and while I employ the personal access token (NOW)- The weapon of choice, I have never tried it myself.

The only advice I can give to folks who are building helm charts from scratch, is always keep it incremental and do not try to do everything at one go. At least build a decent few before you even try to attempt such a thing, else you will only end up WASTING your precious time on trivial issues which could have been avoided by incremental build, rather than the big bang approach.

In this blog I will walk you through basic steps needed to deploy a Zabbix 5 Agent on a Centos Machine. The Zabbix Release is available here. Machine # root@node4>cat /etc/redhat-release CentOS Linux release 7.9.2009 (Core) Download and install the RPM

[video unavailable: Diwali.mp4]

In my cluster things went haywire all of a sudden without a proper showcase, I tried multiple things but it was just not working. Specifically my core-dns and calico-kube-controllers were not coming up and were constantly showing not ready and CrashLoop respectively

In case you are still using the basic/auth it is time to move to personal access token. Official documentation is the best guide. Personal access tokens (PATs) are an alternative to using passwords for authentication to GitHub Enterprise Server when using the GitHub API or the command line.

Everything starts form a single source file and as the time goes by, it gradually transforms into multiple modules, bulky source files and a source control repository. Mostly by this time the team has already adopted a a build tool, and a repository to publish the versioned artifacts. Journey is similar for every project successful or not.

The concept of profiles let’s a developer define what he wants to build and what to do in specific cases. In this blog I will talk about the problem that I solved using profiles.

All right, it has been sometime since I last wrote my blog, and it has been disappointing not to have found enough time to collate and put my thoughts in a simple worded doc; better late then never. So, here I am trying to reignite the pursuit of writing at least once a week.

योगस्थः कुरु कर्माणि सङ्गं त्यक्त्वा धनञ्जय ।

JUnit was developed by Kent Beck and Erich Gamma. Its first version was released in 1997. JUnit 5 = JUnit Platform + JUnit Jupiter + JUnit Vintage — https://junit.org/junit5/docs/current/user-guide/ It is powerful testing framework, with many modules. These modules are part of three sub-projects

I recently gave CISM and I believe it is easily crackable. For those who are pursuing this certification the mantra is similar (or at least the one that I followed)

Rules that run the organisation = Governance.

Streams are convenient way to reduce the line of codes, but an understanding them is equally challenging. I write this blog, after realising a desperate attempt at solving a trivial problem just took overwhelming time. (Could be that I am getting old, but never late to learn things again)

Code available here. The ask was to identify the smallest possible integer (> 0) in the array of integers. Example # 1. [-1,2] -> 1 2. [-1,-2] -> 1 3. [1,3] -> 2 I was initially thinking of using sets and then finding out the missing one, but then reaized it is simpler and I do not need sets

I need to write an app for a friend and what better way to brush up old concepts and write a fresh blog in doing so. So here I am, trying to put together some old and new skills together to help create a simple webapp that will have a dashboard and basic login enabled.

To manage sensitive information you create secrets k create secret --help Create a secret using specified subcommand. Available Commands: docker-registry Create a secret for use with a Docker registry generic Create a secret from a local file, directory or literal value tls Create a TLS secret Usage: kubectl create secret [flags] [options] Use "kubectl <command> --help" for more information about a given command. Use "kubectl options" for a list of global command-line options (applies to all commands). type specifies the type of secret you are creating (options are as shown above). As I need to create only key value pairs for my dummy secret file I need to know a way of how to facilitate that, and the option -h helped me there

In this blog I will use kubectl to create a ClusterRole and a ClusterRoleBinding (refer to link) { "kind": "ClusterRole", "apiVersion": "rbac.authorization.k8s.io/v1", "metadata": { "name": "myclusterrole", "creationTimestamp": null }, "rules": [ { "verbs": [ "get", "list", "watch" ], "apiGroups": [ "" ], "resources": [ "persistentvolumes" ] } ] } k create clusterrole myclusterrole --verb=get,list,watch --resource=persistentvolumes k describe clusterrole myclusterrole You can use a ClusterRole to define permissions on namespaced resources and be granted within individual namespace(s) define permissions on namespaced resources and be granted across all namespaces define permissions on cluster-scoped resources

“There are a thousands excuses for failure but never a good reason..” — Mark Twain “Losers make excuses, winners make progress.” — Introduction: The Miracle of self discipline.

What is OAuth? # From the official definition It is protocol for Authorization It allows authorization flows for web applications, desktop applications, mobile apps etc.

# Standards # Standards are tactical documents that define steps or methods to accomplish the goals and overall direction defined by the security policies.

I just finished my upgrade to Safe Certification and now will be going for CISSP certification. Wish my luck guys! Some quotes # Effective security plans anticipates change, focuses on specific and achievable objectives, potential problems, and serves as the basis of decision making. Operational plans are the shortest and most frequently updated Tactical plans are mid term plans and supports strategical plans. Strategic plans are the long term plans (usually 5 years) and usually includes risk assessment. Data classification is the primary means by which data is protected based on its need for secrecy, sensitivity and confidentiality. Data classification is the process of organizing objects, subjects, items into groups of similarities (value, cost, vulnerability, risk, power, privilege) Stratify the process of organizing and securing data based on assigned labels of importance and sensitivity. Data classification also addresses how data is removed and destroyed. Security policy is used to assign responsibilities, define acceptable risks, define roles, specify audit requirements and indicate compliance. Security policy are not optional rather mandatory. Three types of security policies are regulatory, advisory and informative.

What is an identity? # Identity is the link that correlates the subject and the authentication process. Without a valid identity the system has no way of establishing who the subject is? Identity enables the subject to be identified and validated, and only once it has been established and authorized it is accountable for any actions taken in the system.

SAFe is a framework; one of the leading, for business agility that allows an organization to adapt based on its own business needs. It mixes the best of Agile, Lean, DevOps into an exhaustive system of guidelines to deliver quality, innovative products in a more predictive manner.

Channels are way of communication between multiple goroutines You can declare a channel and the type of content the channel will receive like below. var myChannel chan int The int above is the type of data it can receive and the data can be send using

GoLang doesn’t have a try and catch like the popular C++ or Java languages, what it has is panic-recover.

I am using Virtual Box 6.1 and will use it to expand the disk space for one my VBox Ubuntu image which was almost full. Click on File > Virtual Media Manager

Previously I talked about files, encoding in golang. In this LTD (learn to do) I will talk about hash package in general. https://blog.samarthya.me/wps/2021/01/30/golang-encoding/ Help # https://golang.org/pkg/hash/#Hash https://golang.org/pkg/crypto/#Hash.New https://golang.org/src/crypto/crypto.go?s=364:378#L6 https://golang.org/pkg/crypto/#pkg-subdirectories Package crypto collects common cryptographic constants. — Official golang documentation const ( MD4 Hash = 1 + iota // import golang.org/x/crypto/md4 MD5 // import crypto/md5 SHA1 // import crypto/sha1 SHA224 // import crypto/sha256 SHA256 // import crypto/sha256 SHA384 // import crypto/sha512 SHA512 // import crypto/sha512 MD5SHA1 // no implementation; MD5+SHA1 used for TLS RSA RIPEMD160 // import golang.org/x/crypto/ripemd160 SHA3_224 // import golang.org/x/crypto/sha3 SHA3_256 // import golang.org/x/crypto/sha3 SHA3_384 // import golang.org/x/crypto/sha3 SHA3_512 // import golang.org/x/crypto/sha3 SHA512_224 // import crypto/sha512 SHA512_256 // import crypto/sha512 BLAKE2s_256 // import golang.org/x/crypto/blake2s BLAKE2b_256 // import golang.org/x/crypto/blake2b BLAKE2b_384 // import golang.org/x/crypto/blake2b BLAKE2b_512 // import golang.org/x/crypto/blake2b ) Let’s try out a simple MD5 hasher.

Package encoding provide capabilities to convert data to and from byte-level and textual representations.

In last few blogs I have written about reading commandline parameters reading files and using the os package. In this blog, I will combine some these items to read a file byte by byte using the bufio package func’s.

In the last blog I talked about command line arguments os.Args[]. In this I will try and create a sample banner program that shall Take 3 arguments n - Number of times a message has to be repeated. m - The message that needs to be shown. d - If debug message needs to be shown. I am going to use the flags package.

Reading the golang official documentation is fun, today I saw the Variables in package os var Args []string It allows you to hold command line arguments and a simple main program that can help you validate this.

The new year did not begin on a note I would have expected, I missed out on a golden opportunity. It would have been a wonderful exposure had it sailed through, but as someone famously said

In the last blog, I tried reading a file in GoLang. My repository in GitHub has all the code that I write (link) Now, I will extend the same program to write to the same file.

Everything in the same file apiVersion: v1 kind: Pod metadata: name: redispod spec: containers: - image: redis name: redisdb volumeMounts: - name: redis-data mountPath: /data ports: - containerPort: 6379 protocol: TCP volumes: - name: redis-data persistentVolumeClaim: claimName: redisdb-pvc --- apiVersion: v1 kind: PersistentVolume metadata: name: redis-pv spec: storageClassName: "" capacity: storage: 1Gi accessModes: - ReadWriteOnce hostPath: path: "/mnt/data" --- apiVersion: v1 kind: PersistentVolumeClaim metadata: name: redisdb-pvc spec: storageClassName: "" accessModes: - ReadWriteOnce resources: requests: storage: 1Gi If you deploy you will get something like

Learning a new syntax and the libraries is always a task, and the only way forward is gradual. In this blog I will try to create a small program to read a text file and will keep updating the program to include more sophistication

Must Read # https://blog.golang.org/laws-of-reflection https://golang.org/pkg/reflect/ https://golang.org/pkg/reflect/#Kind https://golang.org/pkg/reflect/#Value Package reflect implements run-time reflection, allowing a program to manipulate objects with arbitrary types. Reflection is a way to examine own structure. Let’s try and learn it via examples.

Interfaces are an interesting concept to learn in GOLANG. There are a tonne of informative articles and here is my contribution to it. In classical Object Oriented everything is treated in parlance of Object or Class like in Java or C++. In Go there is no class or inheritance.

Reference # https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/ https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/#example-use-cases Before we understand the tainting we should know about the Node Affinity. It the by the virtue of Affinity that pods attracts nodes as a preference or as a basic requirement.

A cheat sheet for Installing K8S cluster. Step1: # Check your OS? cat /etc/issue lsb_release -a Step 2: # Add the GPG key as described here

A panorama from Uttarakhand, the land of the gods: a river winding between forested hills.

If you have worked with big projects you must have encountered pom.xml the central configuration for your projects that helps you build, test, and define your CI pipeline. There are other options that are available too, but that is for some other day.

Time to re-test how to create deployments. It has been sometime, I created some deployments so just checking on how much I remember. The quick way to always get started is to check the HELP.

In one of recent discussions with Mr. X I was asked about my approach to solving the Linux cookie problem A random quote Repository will be a text file Each quote will be segregated by a '%' Can be multiline. I always believe in incremental steps so here is what I could think of

Prime number is an age old problem. I am trying to solve it via streams. class PrimeCalculator { public int nth(int nth) { if (nth <= 0) throw new IllegalArgumentException(); // Will skip the nth - 1 // 2 to n-1 return IntStream.iterate(2, i -> i + 1).filter(PrimeCalculator::isPrime).skip(nth - 1).findFirst().getAsInt(); } public static boolean isPrime(int x) { // till half of x return IntStream.rangeClosed(2, (int) (x/2) ).dropWhile(i -> x % i != 0).findFirst().isEmpty(); } } Explanation # public int nth(int nth) { if (nth <= 0) throw new IllegalArgumentException(); // Will skip the nth - 1 // 2 to n-1 return IntStream.iterate(2, i -> i + 1).filter(PrimeCalculator::isPrime).skip(nth - 1).findFirst().getAsInt(); } The method nth(int) allows you to return the nth prime starting at 2, 3, 5....

Step by step: installing Docker, kubeadm, kubelet and kubectl on Ubuntu 18.04, initialising the control plane and joining worker nodes.

For my local K8S cluster of 4 nodes I wanted to get the resource usage metrics. From the official documentation of kubernetes.io These metrics can be accessed either directly by the user with the kubectl top command, or by a controller in the cluster, for example Horizontal Pod Autoscaler, to make decisions. https://kubernetes.io

In my K8S cluster when I was looking at component status I was observing an error. Please note componentstatus is deprecated in 1.19+ but the steps will still at least help out the OCD’s like me.

What good is an software engineer if he can’t keep revisiting the DS problems. It is like a pill for my laziness that keeps crawling ever so often. The problem I am talking about is mentioned in this cool portal exercism.io that I use almost on a weekly basis.

The utility package java.util.function has this functional interface Consumer. Each functional interface (Annotated with @FunctionalInterface) conceptually has a single method (abstract) called the functional method to which the lambda expression’s parameter and return types are matched against. Functional interfaces often represent abstract concepts like functions, actions, or predicates.

Java 8 streams: what map and flatMap do, with small examples of each.

Continuing from the last blog how about checking a pangram using streams. public class PangramChecker { private String allChars = "abcdefghijklmnopqrstuvwxyz"; public boolean isPangram(String input) { if (input.length() <= 0 || input.isBlank()){ return false; } return (allChars.chars().map(x -> (char) x).filter(x -> input.toLowerCase().indexOf(x) >= 0).count() == 26); } } All the for loops have been squeezed into a simple line

Stream is an new abstraction that lets one process data in a declarative way. A stream does not store data and, in that sense, is not a data structure. It also never modifies the underlying data source. The easiest way to learn a new API or a construct is by trying it. So here is an exercise that I tried to learn the Stream API. This is an exercise from exercism.io.

MAN Pages are one source of truth for all curious queries. man ps Name ps - report a snapshot of the current processes. It is used to display instant information about the active processes in the system.

The CPU operates in two modes in Linux User mode (non privileged mode) Kernel mode (System mode) When operating in Kernel mode it has un-restricted access to resources like memory and input output devices.

journald is used to query the systemd journal contents. Example 1 # Lets try and see the kubelet service logs in the systemd journal

Ping # I have used ping often but never to an extend that I could understand the complete range of options and power available at hand.

When two processes are executing concurrently, the exact order of execution of instructions is not deterministic. Without explicit synchronization instructions it is difficult to predict the outcome of these concurrent execution of process.

systemd is the replacement system for System V and with the primary goal of starting services in parallel. Remember init levels? GRUB: Grand Unified Boot Loader — /boot/grub/grub.conf Some key points

SAFe 5 notes on business agility: customer centricity, design thinking and the core competencies of a lean enterprise.

Helm is a dedicated package manager for Kubernetes. Although the Kubernetes objects are deployed in YAML’s there was a need to package and club them together and customise the deployment (not the K8S deployment).

OS version cat /etc/issue Ubuntu 18.04.2 LTS \n \l curl https://storage.googleapis.com/kubernetes-helm/helm-v2.12.3-linux-amd64.tar.gz > ./helm.tar.gz

A Kubernetes NetworkPolicy demo: deny all traffic in a namespace, then allow only labelled pods to reach nginx.

Every software cycle includes packaging; which essentially describes how the software written is packaged and shared. For the software built for Containers Helm is a popular choice of packaging the scripts.

I have been working on Kubernetes cluster and will soon plan to give a Kubernetes Certified Developer exam. In my quest, I will just record some commands that I found helpful or useful in this blog. It may be multi-part, as I will keep adding on a daily basis the commands that I will be learning.

POD # Smallest deployment unit you can manage in K8S, is a Pod. A pod may have one or more containers.

Always remember to refer the API and elements for the YAML structure API Overview — official K8S documentation The Kuberenetes documentation that has text descriptions and good explanatory examples.

A declarative way of maintaining the desired state. Continuing my example from the last blog --- # Pod deployment apiVersion: apps/v1 kind: Deployment metadata: name: go-server-deployment spec: replicas: 2 selector: matchLabels: app: my-go-server template: metadata: labels: app: my-go-server spec: containers: - name: go-server image: samarthya/epserver:2.0 resources: limits: memory: "256Mi" cpu: "1024m" env: - name: SERVERPORT value: "9090" ports: - containerPort: 9090 # Reference - https://kubernetes.io/docs/concepts/workloads/controllers/deployment/ In my deployment, I have two replicas configured, which can be increased to three using the command like the one below.

How can a pod communicate with the other pod? The answer to this question is through a network policy. Network Policy is a specification of how groups of pods are allowed to communicate with each other and other network endpoints.

In this blog we will be talking about Liveness, Readiness and Startup probes of a container. A Service in Kubernetes is an abstraction which defines a logical set of Pods and a policy by which to access them. — - Life without a service What is Kubelet? # Kubelet is a primary node agent that runs on every node. Works in term of PodSpec, that describes a POD (JSON or Yaml). Liveness Probe # It is used by kubelet to decide when to restart the container. periodSeconds defines when the kubelet check periodically. initialDelaySeconds specifies the initial wait before checking. I just created a single container pod that will run touch command to create a file and then it deletes that specific file after a delay, on which the livenessProbe is listening on and then once liveness fails we can check the container.

There are multiple Kubernetes objects we will be talking about in this blog. Mainly Services, Selectors and Labels. Service is an abstraction which defines a logical set of Pods and a policy by which to access them. A Service in Kubernetes is a REST object, similar to a Pod. Service tags the pods, logically grouping them using selectors. Pods have a lifecycle, they are born, they live, process and then they die. The pods (desired state) can be managed using deployment. A label is an identifying attribute of an object, and can be defined at the creation time, and subsequently modified and added at any time. Label selector is a grouping primitive in Kubernetes and allows client/user to identify a set of objects. There are two sets of selectors equality-based and set-based. An abstract way to expose an application running on a set of Pods as a network service. The set of Pods targeted by a Service is usually determined by a selector.

We looked at using the environment variables using the configmap in the last blog. The config map remains the same but now in YAML. apiVersion: v1 kind: ConfigMap metadata: name: happy-faces-mnt data: data.values: |- my.name=samarthya my.profession=engineer I will use this to mount it to a container and then see the contents of the file.

What is K8S? # To manage distributed containerised workloads, you use Kubernetes. It is resilient declarative configuration. It is open source platform. It allows you to bundle and run your application. From the official Kubernetes documentation. Kubernetes objects # K8S objects are the persistent entities in the K8S system and thee entities are used to represent the state of the cluster.

Someone asked me to define a simple docker pod for the service I wrote in GOLang here. I completely forgot about it, till today. So here is my first attempt at getting a docker image for the service.

The performance I was getting after deploying Elasticsearch 7.6.2 and Kibana in my local VM’s was not satisfactory, so I thought of deploying a front proxy Nginx in front and enabling static resources caching.

Learn by example # In this blog let’s learn how to create a bridge network. By definition - Bridge networks are usually used when your applications run in standalone containers that need to communicate

Timeseries is a data stream that is defined for a set of fields over a time period. Some examples may include, daily attendance register for an organization, wherein people punching in every-morning will be different, missing mostly for weekends or on planned and unplanned leaves.

Volumes are managed by Docker and is the preferred way of persisting, sharing data.

The storage driver allows your to create data in the writable layers of the container and it also controls how images and containers are stored and managed on the Docker host.

A Docker registry is a stateless, highly scalable server side application that stores and lets you distribute Docker images. Docker registry is a central location that stores and distributes docker images. E.g. hub.docker.com is the default registry used when you are using docker pull.

I would move in stages, like a good learning guide always recommends.

PV and PVC: PersistentVolume and PersistentVolumeClaim # PV - Defines the structure for provisioning storage for use. They have a defined lifecycle, independent of any individual Pod that uses the PV.

Usually I use Centos, but this time I wanted to try out docker swarm and ubuntu was the preferred option due to the options and supporting blogs available.

Watcher # Watcher is an Elasticsearch feature that facilitates alerting and can be used to create actions based on conditions, which are periodically evaluated using queries on your data. There are two ways of creating a watcher


Security space is an ever evolving. It never stays stagnant; everyday you see a new exploit, a new hack. As an individual, you may have Antivirus installed on your system, Firewall - UP, ports blocked yet you are not free from threat

Aggregation works on a group of documents and can be categorized Metric Pipeline Bucket Matrix Metric Aggregation # Computes a single or multiple values

It is a short howto guide which shall talk about adding a LDAP realm to an Elasticsearch 7.6.2 cluster. Realms # It is a concept not alien to IDAM professionals. In simple words it is a system that allows you to authenticate and authorize an incoming request. It will define the entity USER, that may include at a bare minimum (not limited to)

In this blog we will try to setup a realm for elastic authentication. yum -y install openldap-clients openldap-servers mymachine>systemctl start slapd mymachine>systemctl enable slapd Created symlink from /etc/systemd/system/multi-user.target.wants/slapd.service to /usr/lib/systemd/system/slapd.service. mymachine>slappasswd New password: Re-enter new password: {SSHA}R5nPS+zItZsQrfsw+PIQSNnEiMpLcwLs mymachine>vi /etc/openldap/slapd.d/cn=config/olcDatabase={2}hdb.ldif # AUTO-GENERATED FILE - DO NOT EDIT!! Use ldapmodify. # CRC32 975a66fa dn: olcDatabase={2}hdb objectClass: olcDatabaseConfig objectClass: olcHdbConfig olcDatabase: {2}hdb olcDbDirectory: /var/lib/ldap olcSuffix: dc=my-domain,dc=com olcRootDN: cn=Manager,dc=my-domain,dc=com olcDbIndex: objectClass eq,pres olcDbIndex: ou,cn,mail,surname,givenname eq,pres,sub structuralObjectClass: olcHdbConfig entryUUID: 64a2a5de-3438-103a-8e85-c1c4cc3ef35f creatorsName: cn=config createTimestamp: 20200527073533Z entryCSN: 20200527073533.541185Z#000000#000#000000 modifiersName: cn=config modifyTimestamp: 20200527073533Z mymachine>firewall-cmd --add-service=ldap success mymachine>vi ldaproot.ldif dn: olcDatabase={0}config,cn=config changetype: modify add: olcRootPW olcRootPW: {SSHA}R5nPS+zItZsQrfsw+PIQSNnEiMpLcwLs mymachine>ldapadd -Y EXTERNAL -H ldapi:/// -f ldaproot.ldif SASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 modifying entry "olcDatabase={0}config,cn=config" mymachine>cp /usr/share/openldap-servers/DB_CONFIG.example /var/lib/ldap/DB_CONFIG mymachine>chown -R ldap:ldap /var/lib/ldap/DB_CONFIG mymachine>systemctl restart slapd mymachine>ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/cosine.ldif SASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 adding new entry "cn=cosine,cn=schema,cn=config" mymachine>ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/nis.ldif SASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 adding new entry "cn=nis,cn=schema,cn=config" mymachine>ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/inetorgperson.ldif SASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 adding new entry "cn=inetorgperson,cn=schema,cn=config" vi ldapdomain.ldif dn: olcDatabase={1}monitor,cn=config changetype: modify replace: olcAccess olcAccess: {0}to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" read by dn.base="cn=Manager,dc=samarthya,dc=com" read by * none dn: olcDatabase={2}hdb,cn=config changetype: modify replace: olcSuffix olcSuffix: dc=samarthya,dc=com dn: olcDatabase={2}hdb,cn=config changetype: modify replace: olcRootDN olcRootDN: cn=Manager,dc=samarthya,dc=com dn: olcDatabase={2}hdb,cn=config changetype: modify add: olcRootPW olcRootPW: {SSHA}R5nPS+zItZsQrfsw+PIQSNnEiMpLcwLs dn: olcDatabase={2}hdb,cn=config changetype: modify add: olcAccess olcAccess: {0}to attrs=userPassword,shadowLastChange by dn="cn=Manager,dc=samarthya,dc=com" write by anonymous auth by self write by * none olcAccess: {1}to dn.base="" by * read olcAccess: {2}to * by dn="cn=Manager,dc=samarthya,dc=com" write by * read mymachine>ldapmodify -Y EXTERNAL -H ldapi:/// -f ldapdomain.ldif SASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 modifying entry "olcDatabase={1}monitor,cn=config" modifying entry "olcDatabase={2}hdb,cn=config" modifying entry "olcDatabase={2}hdb,cn=config" modifying entry "olcDatabase={2}hdb,cn=config" modifying entry "olcDatabase={2}hdb,cn=config" mymachine>vi baseldapdomain.ldif dn: dc=samarthya,dc=com objectClass: top objectClass: dcObject objectclass: organization o: samarthya com dc: samarthya dn: cn=Manager,dc=samarthya,dc=com objectClass: organizationalRole cn: Manager description: Directory Manager dn: ou=People,dc=samarthya,dc=com objectClass: organizationalUnit ou: People dn: ou=Group,dc=samarthya,dc=com objectClass: organizationalUnit ou: Group mymachine>ldapadd -x -D cn=Manager,dc=samarthya,dc=com -W -f baseldapdomain.ldif Enter LDAP Password: adding new entry "dc=samarthya,dc=com" adding new entry "cn=Manager,dc=samarthya,dc=com" adding new entry "ou=People,dc=samarthya,dc=com" adding new entry "ou=Group,dc=samarthya,dc=com" dn: cn=Manager,ou=Group,dc=samarthya,dc=com objectClass: top objectClass: posixGroup gidNumber: 1009 ldapadd -x -W -D "cn=Manager,dc=samarthya,dc=com" -f ldapgroup.ldif Enter LDAP Password: adding new entry "cn=Manager,ou=Group,dc=samarthya,dc=com" mymachine>useradd samarthya mymachine>passwd samarthya Changing password for user samarthya. mymachine>ldapadd -x -D cn=Manager,dc=samarthya,dc=com -W -f ldauser.ldif Enter LDAP Password: adding new entry "uid=samarthya,ou=People,dc=samarthya,dc=com" dn: uid=samarthya,ou=People,dc=samarthya,dc=com objectClass: top objectClass: account objectClass: posixAccount objectClass: shadowAccount cn: samarthya uid: samarthya uidNumber: 1005 gidNumber: 1005 homeDirectory: /home/samarthya userPassword: {SSHA}R5nPS+zItZsQrfsw+PIQSNnEiMpLcwLs loginShell: /bin/bash gecos: samarthya shadowLastChange: 0 shadowMax: 0 shadowWarning: 0 Installing phpLdap # yum install php-ldap php-mbstring php-pear php-xml https://www.digitalocean.com/community/tutorials/how-to-install-linux-nginx-mysql-php-lemp-stack-on-centos-7

Kibana is an effective way of managing users; but as a programmer you always need an API. It helps to integrate with other applications you are building Quick and clean way without any cosmetics > GET /_security/_authenticate HTTP/1.1 > Host: myserver.elastic.node:9200 > Authorization: Basic ABCDEFGHIJKLMNOP== > User-Agent: insomnia/7.1.1 > Accept: */* < HTTP/1.1 200 OK < content-type: application/json; charset=UTF-8 < content-length: 236 * Received 236 B chunk * Connection #2 to host myserver.elastic.node left intact GET https://myserver.elastic.node:9200/_security/_authenticate I have added basic authentication to quickly check

GOLANG # Go is a powerful yet simple language. The nuances of assembling a workspace, sometimes are overwhelming, yet when it comes to simplicity it is very powerful.

Helpful links # http package How to write go code. First program Effective go GO webserver GO Packages Specification - Go JSON in Go blog Go command reference Using Go modules These are some of the helpful links I have used in the past for understanding Go and developing code.

Having practiced creating loads of Console based programs of golang, it is now time to try something new - A Web Service. In this blog, I will try and create a Web Service (RESTful) that will be built entirely on Go.

So continuing from the last blog where I wrote a crude version of SimpleCipher and was inclined on removing the duplicate code, here I am with the improved version. Handy links # [fmt](https://golang.org/pkg/fmt/) package [strings](https://golang.org/pkg/strings/) package. Defining types # While I compiled and unit tested code the general feeling was what can be optimized.

Hello back again, Golang is just a new syntax for me. Even though behind the scenes they developers have simplified many things, for a consumer like me writing a program is more about learning the new syntax and getting familiarized with the control and stack.

Text is a key data in most of the information that is ingested in the elasticsearch, and whether it is type text or keyword it requires careful consideration to choose which analyzer to use.

Painless is a simple, secure scripting language designed specifically for use with Elasticsearch. The official guide is available here.

[gallery columns=“1” size=“full” link=“none” ids=“617” orderby=“rand”]

Index modules are a complex subject; they are defined per index and control every aspect of an index.

Pipelines is a smooth way of processing some incoming data. In this blog, I will walk through some of the items I have tried my hands on. Pipeline # A pipeline is a definition of a series of processors that are to be executed in the same order as they are declared.

_reindex # Official documentation here. This API is meant for copying data from one index to another. It is especially useful when you are copying data from one index to another.

What is intriguing about elastic stack is that; it can do so many things that it simplifies the life of a security analyst. The uphill task is to learn the technology itself, but once you have mastered it, things are much easier.

The Rest API is the fundamental fabric of K8S. Every communication that happens between components, happens through the API invocations. Consequently, everything in the Kubernetes platform is treated as an API object and has a corresponding entry in the API.

It is always fun learning and trying out some new tech. In this blog, I will try and capture my experience of running my first pod using kubectl. If you wish to learn how to install a typical master, worker cluster of K8S I recommend going through this blog.

Watcher

I will extrapolating based on the original documentation available here and based on some of my experience using this API. It copies documents from one index to another. Extracts the document source from the source index and indexes the documents into the destination index. You can copy all documents to the destination index, or reindex a subset of the documents.

Open specification for document fields for data ingested in Elasticsearch. It brings uniformity to certain common fields that are used across data sources. ECS defines two field levels Core fields: Represent the fields that are most common across all use cases. Extended fields: That are not part of the core and specific to cases. Field sets # Field sets are multiple groups of related fields defined by ECS. More information here.

If you are not aware of mapping, it might be a little confusing but I would try my best. Every document that gets indexed in elastic has fields, every field that is accessible has an associated type with it (Inverted Index) which helps elastic organize data for quick retrieval.

With the Corona-Lockdown in place “literally”, it was time to squeeze out some me-time to continue the quest for GO-Proficiency.

In this post I will try to enable security for the elasticsearch cluster. It would be simply penned as a sequence of steps you need to follow to enable security as part of the cluster.

If you have a production grade elastic cluster it is always recommended to do a regular backup as a standard practice. Snapshot is a backup of information, that can be be used to restore the last known good state of the system

In the previous blog we searched for a match\all, and sorted it by age. In this we will improve upon the query we are writing and look for other options.

What I have been doing is evaluating Elasticsearch. The indexing, searching (Phrase, Similarity, Structured, Full Text, Complex), clustering etc. In this blog I will just try and simplify the learning curve.

Just like Java or C++ there are standard libraries (packages) available with golang. The one that you might end up using the most often is strings. For this blog, I was writing another practice exercise that is meant to count number of words in an input string.

Sieve is an ancient and an ingenious way of calculating primes. It recursively eliminates all the multiples of a particular number up till a range and the left overs are essentially primes.

As a software professional, I have been working in the space of IAM, SSO, DRM for quite some time and from my experience I can say, the way Elastic has simplified the integration of external or internal security for access is a treat for fellow developers. It was interesting to experiment with the security settings, and control tenancy.

Data is key to any analytics, and if it can be organized, normalized and made available for correlated analysis, the results will be more concise. Elastic.co has a SIEM UI and the XPack security pack that helps the new age security analysts.

It was an interesting exercise, and I solved in three ways. More details available here @ exercism.io Introduction # RNA can be broken into three nucleotide sequences called codons, and then translated to a polypeptide like so:

Life is a mystery, and autism just makes it special soham – I am him. #