Create distinct roles with specific permissions to call untrusted web services.
Client services authenticate as one of these roles when calling an untrusted web service.
When using an externalized (Nginx) forwarder and gatekeeper, a webservice client can send a Conjur access token for its own identity. The client doesn't have to worry about the gatekeeper misusing the access token,
| - !policy | |
| id: myapp | |
| body: | |
| - &variables | |
| - !variable | |
| id: database/username | |
| annotations: | |
| description: Application database username | |
| - !variable | |
| id: database/password |
| - !policy | |
| id: conjur/authn-k8s/minikube/default | |
| owner: !group /k8s_admin | |
| body: | |
| - !webservice | |
| annotations: | |
| kubernetes/namespace: default | |
| - !host client |
| root@3935c7d86a07:/# cat policy-2.yml | |
| - !user alice | |
| - !group developers | |
| - !grant | |
| role: !group developers | |
| member: !user alice | |
hi
<script> alert('hi') </script>
| https://app.land/applications/219?mapset=1970 |
Save rails_gem_paths.rb to your local directory
Run this command to open a VSCode project containing the local directory and all "active*" and "action*" gems. The script also prints out the gem names in appmap.yml form.
code . $(bundle exec ruby rails_gem_paths.rb)
# - gem: actioncable
# - gem: actionmailbox
| name: sample_app_6th_ed | |
| packages: | |
| - path: app/mailers | |
| - path: app/models | |
| - path: app/jobs | |
| - path: app/controllers | |
| - path: app/helpers | |
| - gem: actioncable | |
| - gem: actionmailbox | |
| - gem: actionmailer |
| import sys | |
| import os | |
| import appmap | |
| #start the recorder | |
| r = appmap.Recording() | |
| with r: | |
| #run the SSH demo code | |
| import sshdemo | |
| sshdemo.Demo().runDemo() |
| { | |
| "$schema": "https://aka.ms/codetour-schema", | |
| "title": "Install AppMap for RSpec", | |
| "steps": [ | |
| { | |
| "file": "spec/spec_helper.rb", | |
| "description": "You'll now install the AppMap RSpec helper.\n\n```ruby\nrequire 'appmap/rspec'\n```\n\nThis line should be placed **before** any other `require` statements.\n", | |
| "line": 2, | |
| "contents": "require 'appmap/rspec'" | |
| }, |