tsaarni

Envoy RING_HASH + EDS: 503 on late endpoint arrival

This file contains example repro script output for issue envoyproxy/envoy#45344

Scenario 1

envoy.reloadable_features.coalesce_lb_rebuilds_on_batch_update: true

$ ./repro-envoy-ring-hash-503.sh coalesce-enabled

tsaarni

How to connect to Azure AKS Kubernetes worker node by SSH

Nodes are not assigned public IP. If you have accessible VM in the same VNET as worker nodes, then you can use that VM as jump host and connect the worker via private IP.

Alternatively public IP can be assigned to a worker node. This readme shows how to do that.

Steps how to attach public IP to a worker node

find out the resource group that AKS created for the node VMs

tsaarni

This document contains manual test steps for PR openbao#2863.

All required files are attached in this gist.

1. Create test certificates.

cat <<EOF >certs.yaml
subject: cn=server-ca

tsaarni

Reproduction steps for https://github.com/orgs/openbao/discussions/2721

Overview

The Puppet server CA fails to preserve the encoding of the CA certificate subject name when issuing new certificates. The issuer field in issued certificates is always re-encoded as a UTF8String.

When Go crypto builds a chain to a trust anchor, it compares the raw bytes of a certificate's issuer to the subject of its issuing certificate. Because the CA re-encodes this field, validation fails due to mismatching DNs.

tsaarni

Using ELK stack for offline SSHD log analysis

To start Elasticsearch + Logstash + Kibana execute:

docker-compose up

The container images will be downloaded from docker hub at first run.

Next, import the log file data to logstash

tsaarni

*** RSA

# Generate self-signed certificate with RSA 4096 key-pair
openssl req -x509 -nodes -days 3650 -newkey rsa:4096 -keyout rsakey.pem -out rsacert.pem

# print private and public key
openssl rsa -in rsakey.pem -text -noout

# print certificate
openssl x509 -in rsacert.pem -text -noout

tsaarni

EDS Cache Tests

This document contains manually executed test scenarios related to PR projectcontour/contour#6906

Analyzing xDS gRPC messages

To collect gRPC debugs, you can use https://github.com/tsaarni/grpc-json-sniffer.

1. Apply the patch included in this gist patch -p1 < grpc-sniffer.patch.

tsaarni

Fetching OIDC discovery endpoint from https://kubernetes.default.svc/.well-known/openid-configuration...
Fetching public keys from https://172.20.0.3:6443/openid/v1/jwks...
Validating the default service account token in the pod...
Token is valid!
Claims: {
    "aud": [
        "https://kubernetes.default.svc.cluster.local"
    ],
    "exp": 1749207355,
    "iat": 1717671355,

tsaarni

apiVersion: apps/v1
kind: Deployment
metadata:
  name: echoserver
spec:
  selector:
    matchLabels:
      app: echoserver
  template:
    metadata:

tsaarni

Running Kind cluster

Preconditions

Install docker using install instructions at https://docs.docker.com/engine/install/ubuntu/:

$ sudo apt-get install -y \
    ca-certificates \
    curl \