k8s service discovery

A quick walk through k8s service discovery.

There is a need for background service discovery mechanism due to the dynamic nature of the cluster.

k8s addon kube-dns provide a domain name (DN) based third party service discovery mechanism (pattern) for all the microservices (aka pods in k8s - good idea to keep one microservice in each pod) in the cluster.

k8s assigns domain names for all the pods and services to communicate with them. It runs the infrastructure required for resolving the domain names of the microservices to locate each other.

kubelet - A k8s component in each minion node - configures the DN server location for each container when creating it, using "--cluster-dns="/ "--resolv-conf=" - the IP? it's statically assigned.

Whenever the IP of the service or Pod changes, kubelet sends the updated IP to the API server running in the master.

kubedns - The DN server (with static IP known to pods) listens to the k8s API server for pod or service change and updates its DN records.

And thus, each microservice can communicate with each other via DNs.

The k8s native mechanism runs kube2sky, etcd and skyDNS for DN resolution. kube2sky gets the pod IP changes from API server and stores it in etcd. skyDNS DN server is configured for the pods, looks up etcd and returns the IP addresses.


References:
https://www.nginx.com/blog/service-discovery-in-a-microservices-architecture/
http://microservices.io/patterns/3rd-party-registration.html
https://kubernetes.io/docs/tasks/administer-cluster/dns-custom-nameservers/
https://kubernetes.io/docs/concepts/services-networking/dns-pod-service
https://blog.sophaskins.net/blog/misadventures-with-kube-dns/
https://sysdig.com/blog/understanding-how-kubernetes-services-dns-work/
https://www.projectatomic.io/blog/2015/10/setting-up-skydns/
https://rsmitty.github.io/Manually-Checking-Out-KubeDNS/
https://github.com/coreos/coreos-kubernetes/issues/625
https://thenewstack.io/hackers-guide-kubernetes-networking/
https://www.stratoscale.com/blog/kubernetes/networking-in-kubernetes/

Can i spoof a web application by spoofing its SSL certificate?

If the web server serves the SSL certificate to anyone visiting the site, can i spoof the web server by spoofing its certificate?

short answer, yes and no! not for long!

I can spoof the legitimate site by spoofing its certificate. I can trick the client to believe I am the legitimate site but I will not be able to further trick the client to communicate with me.

Though the client will trust the server and initiate an SSL connection, the spoof server cannot establish a secure HTTPS connection with the client. The server receives encrypted handshake payload from the client and cannot decrypt without the private key, secured by the legitimate site. ANd thereby, the spoof server cannot complete the SSL handshake and read the traffic from the client.

Background notes:

- SSL negotiation is based on Asymmetric cryptography. Client encrypts the pre-master/ master key -a symmetric encryption key - with the public key of the server (presented by the server in its certificate). Server decrypts the traffic with its private key. Once the client and the server agree on the symmetric key, the further traffic will be encrypted by this symmetric key.

- The certificate stands valid only if it is not modified or tampered. The signature of the certificate is signed by the private key and can be verified by the corresponding public key alone.

- Certificates are issued to web sites by a trusted CA (certificate authority) to legitimate sites. If the given certificate is not backed by a chain of trusted CA's. This certificate must not be trusted.

- Client or the User must verify the server's certificate to ensure it is communicating with the server it is intending to do. This means the client can send sensitive data to any spoofed site if it does not verify its certificate.

Cordova android REST client test with localhost

Say you have a REST service running on your local machine which is tested using a HTTP client from the same machine.

Now, you have your cordova android client that consumes your REST service.

How do you make requests to the web service running on your local machine (not hosted yet!)?

We will setup your local network for the android client [, infact any client on the internet] to access the web server on your local machine!

We will setup the home router to route the traffic from a specific port (on the router) to a specific port on your local machine (the port to which the web service is listening to). So that any request sent to the router port is routed to the local machine - PORT FORWARDING.

1. Find your router's setup page. Usually 192.168.0.1 or 192.168.1.1 (know your login and password - usually admin, admin).

NOTE: The router setup screens could be different for your router. However, the steps should be the same.

2. Assign a static IP for your local machine on your router:

• Choose static IP address for the local machine from a valid range. Go to DHCP -> DHCP settings -> between start IP address and end IP address.
• Go to DHCP -> address reservation -> Add new -> enter a IP and the MAC address of your local machine.

3. Route the traffic from router port to local machine port (service port):

• Go to Forwarding -> virtual servers -> add new -> enter the protocol (TCP), router port, web service port and the local machine IP address (static IP).
• Some routers support only same port numbers for the router port and service port.

4. Restart the router for the settings to take effect.

5. Find the WAN IP to post requests: Go to Status -> WAN IP. post requests to WAN_IP:ROUTER_PORT.

Beware! now that you have opened up the access to your local server from the internet, take necessary security measures to keep it safe!

If your WAN IP is same as your public IP, there is no carrier grade NAT, and anyone can access your server (If they know the port on which you are working).

This setup is not specific to your android client. This can be used to configure ACCESS to a local web service from the local network.

There are certain configurations (Security) to be made in Cordova so that the client can make requests to the web service.

1. CSP (Content Security Policy) header overrides the same-origin policy and restricts the origin to a set of sources. Apart from the HTTP header, the <meta> tag in the HTML header also whitelists the origins. Add your web server in the meta tag.

<meta http-equiv="Content-Security-Policy" content="default-src 'self' <protocol://WAN_IP:ROUTER_PORT/path> data: gap: https://ssl.gstatic.com 'unsafe-eval'; style-src 'self' 'unsafe-inline'; media-src *">

2. Cordova config (config.xml) by default allows all the origins. Modify the config to restrict requests to known domains.
Cordova version: 6.2.0

<access origin="*://<WAN_IP:ROUTER_PORT>" subdomains="true"/>
<allow-intent href="http://*/*" />
<allow-intent href="https://*/*" />

I'd like to draw, this time, it's a cloud :D

Beginners thoughts on Client-Server/ Cloud!

Trivial references:

https://en.wikipedia.org/wiki/Zeus
https://en.wikipedia.org/wiki/Vajra

formspree for your static page, suitable for github pages.

Formspree home has all the information you need to set up a form for email submission without a mail server of your own, like the github pages.

If you think,
- The thank you page is not necessary for your site.
- And you do not want to reload the page.
- And you cannot whitelist formspree for CORS (example, the github pages).
- And there should be something that can be done on the client side.

continue reading...

I have reasoned out it is not possible without a thank you page. If you would like to know more, continue reading...

Option 1 with a form leads you to formspree's standard thank you page due to the form's action. I'm happy formspree supports our custom thank you page too.

Now, you need dynamic handling of the response and AJAX is the way...

Option 2 with AJAX request returns error response due to CORS request even though the mail is successfully sent.

How can you now differentiate the CORS error from the rest. You don't want to give false hopes for the form submitter, do you!

This is not possible from the client side or with the response alone. W3C specifies that CORS failures should be handled the same way as network errors and the response headers shouldn't be completely revealed by the browsers. If you want to have a non standard check anyway which is not recommended, you can check for status code 0 on chrome.

Long story Short - AJAX response cannot distinguish an error is due to un-whitelisted CORS request made to a expected domain.

Turns out CORS response was the motive of this post!

If you think its not convincing - or probably have a hack, leave a comment!

Set up NFS volume on Windows client.

Steps to work on a remote NFS workspace (Hosted on linux) from the Windows client machine.

GOAL:

- Work from the Windows local machine on a remote NFS workspace.

solution: Mount the remote NFS volume on the client Windows machine.

- Set up an editor to work with the workspace.

solution: Sublime Text is a good fit for C++ and various other languages, currently almost FREE!

1. Set up windows as NFS client. 

• Click “start” -> search for “windows features” -> click “Turn Windows features on or off” -> “select services for NFS”

  2. Set up user credentials for write access. [WARNING! A hacker who gains access to this machine can get the UID and GID of the remote server]

•  click start -> search for “regedit” -> goto “HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ClientForNFS\CurrentVersion\Default” -> right click “new”

• Create DWORD(32-bit) keys as shown below.

• Find UID and GID :

           - goto to the remote server machine -> enter “id” at the bash shell -> the UID and GID are in decimal.

3. Mount NWS to your local machine.

• Open Cmd and enter,

          mount IP_Addr:/vol/vol_nfs_janani z: (replace volume name and drive letter)

• Find the new drive under "my Computer".

4. Download Sublime Text 3 from https://www.sublimetext.com/

•  Configure the workspace.
•  Goto “File” -> Goto “Open Folder” -> open your workspace (on the mount drive)
•  Goto “Project” ->click “save  project as..” (to open it next time)

5. Some sublime short cuts:

   end search: Esc

   Find in current file: Ctrl + F

   Find in complete folder : Ctrl + Shift + F (double click the line to open the line in the file)

   Goto Anything/ open file: Ctrl + P

   Function list : Ctrl + R

   Navigate Fwd: Alt + Shift + -

   Navigate Bck: Alt + -

   Goto Line : Ctrl + G

   Goto Definition: F12

   Automatic auto completion!

Recommended sublime Plug in's: Cscope, 

This is the basic use of this editor. Documentation has more. 

Typedef's must learn to be stronger

A typedef is aliasing a type.

Syntax: typedef type name
Example: typedef int length

Uses:

1. Give meaningful shorter names for really long type names. Specially, in case of template types and function pointers.

typedef myLongLongMeaningfulType tMeaningfulType
typedef std::map<int,std::map<int, std::vector<int> > > doubleIndexMap;

2. Change the underlying type when needed.
Requirement:  I am writing a math library with support for unsigned integers of 8 bit long.

without Typedef,

uint8_t add (uint8_t a, uint8_t b);

Why only 8 bit long!... The same library can handle 16 bit integers.
Uh-Oh! I must change all the types throughout the library.

with Typedef's,

typedef uint8_t supportType_t;
supportType_t add (supportType_t a, supportType_t b);

voila, I can now support 16 bit integers with a single change!!

typedef uint16_t supportType_t;

3. Document Types.

typedef uint8_t length_t; // always stores lengths in uint8 format.
typedef uint8_t area_t; // always stores area's in uint8 format.

The typedef's are weakly typed and cause problems. During syntax and semantic analysis (C++ is not context free grammar), all the alias types are resolved to the same underlying type.

typedef uint8_t length_t;
typedef uint8_t area_t;

length_t

and

area_t

are still uint8.

1. No type safety: The synonym types can be used interchangeably or together,

length_t m_boxLength = 10_CM;
area_t m_boxArea = 100_SQCM;

length_t getLength()
{
     return m_boxArea; // Bug, no compiler warning. both area and length are uint8
}

if(box1.getLength() == box2.getArea()) // Bug, no compiler warning. both area and length are uint8

2. Prevent overloading: Both aliases are actually the same types.

Boost library provides a wrapper to achieve strong type'ing with typedef's with a macro BOOST_STRONG_TYPEDEF.

Epilogue:
There are reasons why no proposal's for strong typedef (N1706 and N1891) made it to the standard. Could be simply because it can be achieved with a wrapper. Not delving deeper into this!