Proposal - encrypted cache
by Sebastian Laskawiec
Hey!
A while ago I stumbled upon [1]. The article talks about encrypting data
before they reach the server, so that the server doesn't know how to
decrypt it. This makes the data more secure.
The idea is definitely not new and I have been asked about something
similar several times during local JUGs meetups (in my area there are lots
of payments organizations who might be interested in this).
Of course, this can be easily done inside an app, so that it encrypts the
data and passes a byte array to the Hot Rod Client. I'm just thinking about
making it a bit easier and adding a default encryption/decryption mechanism
to the Hot Rod client.
What do you think? Does it make sense?
Thanks
Sebastian
[1] https://eprint.iacr.org/2016/920.pdf
5 years, 9 months
Hot Rod secured by default
by Tristan Tarrant
Dear all,
after a mini chat on IRC, I wanted to bring this to everybody's attention.
We should make the Hot Rod endpoint require authentication in the
out-of-the-box configuration.
The proposal is to enable the PLAIN (or, preferably, DIGEST) SASL
mechanism against the ApplicationRealm and require users to run the
add-user script.
This would achieve two goals:
- secure out-of-the-box configuration, which is always a good idea
- access to the "protected" schema and script caches which is prevented
when not on loopback on non-authenticated endpoints.
Tristan
--
Tristan Tarrant
Infinispan Lead
JBoss, a division of Red Hat
6 years, 1 month
Jenkins - HTTPS only
by Sebastian Laskawiec
Hey,
During the upgrade of SSL certificate there was a recommendation to disable
HTTP. It actually makes sense, so from now on, please use HTTPS only.
Thanks,
Sebastian
6 years, 6 months
Code examples in multiple languages
by Tristan Tarrant
One thing that I wish we had is the ability, when possible, to give code
examples for our API in all of our implementations (embedded, hotrod
java, c++, c#, node.js and REST).
Currently each one handles documentation differently and we are not very
consistent with structure, content and examples.
I've been looking at Slate [1] which uses Markdown and is quite nice,
but has the big disadvantage that it would create something which is
separate from our current documentation...
An alternative approach would be to implement an asciidoctor plugin
which provides some kind of tabbed code block.
Any other ideas ?
Tristan
[1] https://lord.github.io/slate/
--
Tristan Tarrant
Infinispan Lead
JBoss, a division of Red Hat
6 years, 6 months
Unable to cluster Infinispan ephemeral template instances
by Galder Zamarreño
Hey Sebastian,
I've started 2 instances of Infinispan ephemeral [1] and they don't seem to cluster together with the pods showing this message:
10:51:12,014 WARN [org.jgroups.protocols.kubernetes.KUBE_PING] (jgroups-4,datagrid-1-187kx) failed getting JSON response from Kubernetes Client[masterUrl=https://172.30.0.1:443/api/v1, headers={Authorization=#MASKED:862#}, connectTimeout=5000, readTimeout=30000, operationAttempts=3, operationSleep=1000, streamProvider=org.jgroups.protocols.kubernetes.stream.InsecureStreamProvider@51522f72] for cluster [cluster], namespace [openshift], labels [application=datagrid]; encountered [java.lang.Exception: 3 attempt(s) with a 1000ms sleep to execute [OpenStream] failed. Last failure was [java.io.IOException: Server returned HTTP response code: 403 for URL: https://172.30.0.1:443/api/v1/namespaces/openshift/pods?labelSelector=app...
These are the options I'm giving to the template:
oc process infinispan-ephemeral -p \
NUMBER_OF_INSTANCES=2 \
APPLICATION_NAME=datagrid \
APPLICATION_USER=developer \
APPLICATION_PASSWORD=developer
I'd expect this to work out of the box, or do you need to pass in a management usr/pwd for it to work?
Cheers,
[1] https://github.com/infinispan/infinispan-openshift-templates
--
Galder Zamarreño
Infinispan, Red Hat
6 years, 6 months
Infinispan 9.2 schedule
by Tristan Tarrant
With the release of 9.1.1.Final, and the delay it introduced, I have
updated the 9.2.x schedule and roadmap.
These are the expected release dates:
9.2.0.Alpha1 Oct 4th
9.2.0.Alpha2 Oct 18th
9.2.0.Beta1 Nov 1st
9.2.0.Beta2 Nov 15th (feature freeze)
9.2.0.CR1 Nov 29th (component upgrade freeze)
9.2.0.Final Dec 13th
Tristan
--
Tristan Tarrant
Infinispan Lead
JBoss, a division of Red Hat
6 years, 7 months
