Marquesledivan

# Install https://www.vaultproject.io/
brew install vault

# Start dev vault server in a separate terminal
vault server -dev
# ==> Vault server configuration:
# ...
# Unseal Key: 7ACQHhLZY5ivzNzhMruX9kSa+VXCah3y87hl3dPSWFk=
# Root Token: 858a6658-682e-345a-e4c4-a6e14e6f7853

Marquesledivan

This demonstrates how to make client side certificates with go

First generate the certificates with

./makecert.sh [email protected]

Run the server in one terminal

go run server.go

Marquesledivan

Solution #1 (ManagedCertificate CRD in GKE)

• GKE with Google-managed SSL certificates
  • Use ManagedCertificate CRD to create a object.
  • Associate the ManagedCertificate object to an Ingress by adding an annotation networking.gke.io/managed-certificates to the Ingress. This annotation is a comma-separated list of ManagedCertificate resources, cert1,cert2,cert3 for example.

Solution #2 (Google Cloud SSL Certificate)

Assumption

Assumes you are using the default L7 GLBC ingress controller. default for GKE cluster.

• ingress-gce

Marquesledivan

apiVersion: v1
kind: Secret
metadata:
  name: index-template
stringData:
  template: '{"index_patterns":["logstash-*"],"template":{"aliases":{"logstash":{}},"mappings":{"dynamic":"true","dynamic_date_formats":["strict_date_optional_time","yyyy/MM/dd HH:mm:ss Z||yyyy/MM/dd Z"],"dynamic_templates":[]},"settings":{"index":{"lifecycle":{"name":"logstash_policy","rollover_alias":"logstash"},"number_of_shards":"1","number_of_replicas":"0"}}}}'

Marquesledivan

{# style 1 - long form #}
{% if filepath == '/var/opt/tomcat_1' %}
  {% set tomcat_value = tomcat_1_value %}
{% else %}
  {% set tomcat_value = tomcat_2_value %}
{% endif %}

{# style 2 - short form #}
{% set tomcat_value = tomcat_1_value if (filepath == '/var/opt/tomcat_1') else tomcat_2_value %}

Marquesledivan

## NOTE: when finding file by time, use one of the following flags:
# ctime : the time a file was changed, in hours. On most systems this timestamp cannot be altered by any user, so it is fairly reliable
# atime : the time a file was last accessed, in hours. This is also set by the system.
# mtime : the modified time of a file, in hours. This can be set by any user. So if you are looking for mailcious files, never use this flag.
# cmin  : same as mtime, but in minutes.
# amin  : same as atime, but in minutes.
# mmin  : same as mtime, but in minutes.

find /root/registro.json -cmin +480  -exec rm {} \;

Marquesledivan

$ModLoad imfile
$InputFilePollInterval 10 
$PrivDropToGroup adm


#NGINX access file:

# Path to the file which you want to monitor
$InputFileName /home/logs/nginx-access.log