Authenticate to private JFrog npm registry

This always gets me, npm publish fails to authenticate:

npm ERR! code E401
npm ERR! Unable to authenticate, need: Basic realm="Artifactory Realm"

npm ERR! A complete log of this run can be found in:
npm ERR!     /Users/rad/.npm/_logs/...Z-debug.log

The solution is:

  1. Sign-in to JFrog.
  2. Find Edit profile under the Welcome, ... menu.
  3. Put JFrog password in and unlock.
  4. Copy the encrypted password.
  5. Issue a curl request like this:
1
curl -u ${JFROG_USER}:${JFROG_ENCRYPTED_PASSWORD} https://${JFROG_ORG}.jfrog.io/${JFROG_ORG}/api/npm/auth
  1. Copy the output and put it in ~/.npmrc. The file should be like:
1
2
3
4
_auth="cm...M="
always-auth=true
email=email@address
registry=https://${JFROG_ORG}.jfrog.io/${JFROG_ORG}/api/npm/${JFROG_REPO}/

Multi-tenant Vault PKI with custom root PEM bundles

In the previous article1, I have investigated modern PKI software alternatives. One of the options on the list was HashiCorp Vault. The natural next step is to set up a Vault PKI.

This article documents setting up an imaginary multi-tenant Vault PKI with custom PEM bundles generated with OpenSSL. The steps the following:

Certificate Authority is not Voodoo

Modern applications tend to get fairly complex pretty quick. A usual stack will consist of many moving parts. Starting from a cloud environment, maybe abstracted behind Kubernetes or Mesos, through multitude of web servers, GRPC services, to monitoring systems like Grafana, Jaeger, Prometheus, all fronted with load balancers or proxies like Traefik. Many of these components have fairly complex dependencies, ETCD or Zookeeper come to mind. All these power a highly dynamic environment where containers and virtual machines iterate and get replaced often. Some businesses operate multiple copies of stacks for development, staging and production environments.

Introduction to Keycloak Authorization Services

As the number of applications and websites in the organization grows, the developer will inevitably receive a request to implement Single Sign-On. Single Sign-On (SSO for short) is an authentication scheme allowing the user to log in with a single set of credentials and share the session across multiple, independent, potentially unrelated systems.

Keycloak With Docker Compose

Updated on 15th of May 2021 for Keycloak 13.0.0 with Postgres 13.2.

6th of June 2021: Follow up: setting up Keycloak with TLS for local development.

Keycloak is an open source Identity and Access Management System developed as a JBoss community project under the stewardship of Red Hat. Keycloak makes it is easy to secure apps and services written in many technologies using a large number client libraries.

The case for Kafka cold storage

It is entirely possible that what I am going to describe here is an edge case not many people hit with their Kafka deployments. However, in my experience, when Kafka is used to ingest large volumes of data, it makes perfect sense. Considering that every now and then people ask for a cold storage feature on the Kafka mailing list, I am not the only one who would find this useful.

Apache Spark on Mesos with Docker bridge networking

About two weeks ago, Virdata released a set of patches for Apache Spark enabling Spark to work on Mesos with Docker bridge networking. We are using these in production for our multi tenant Spark environment.

SPARK-11638: Spark patches

All patches for all components described below are available in Spark JIRA. We’ve released patches for all versions of Spark available at the time of creating them - from 1.4.0 to 1.5.2. We have also released patches for Akka 2.3.4 and Akka 2.3.11; these are required to make this solution usable.

Gossiperl at EUC 2015 and next steps

Wow. It’s difficult to believe it’s been almost a week since I gave a talk about gossip protocols at Erlang User Conference in Stockholm. It was a fantastic event, great agenda, great topics, fantastic networking. EUC is one of those events you should attend, you will not regret it. No matter if you are interested in Erlang/Elixir or not. Big “Thank You” to all who made it happen.