When I load my HTML page in my browser, all requests for assets have x-cache: Miss from cloudfront. If I reload my browser very quickly, I can sometimes get a Hit.
If I open my developer tools and "copy request as curl", I reliably get a hit, no matter how fast or slowly I perform the requests.
Why would different user agents making the exact same request get a hit or miss?
Can auditd use a date instead of an integer to name its rotated audit logs? Right now I have
audit.log
audit.log.1
audit.log.2
...
When audit.log fills up all of the files are rotated one number higher. I have a script that backs up the audit logs, and tar gets confused when it sees all the files move underneath it. I'd like to name the files by date so that they don't all get moved when audit.log fills up.
I have an AWS EFS share, which does not support filesystem ACLs. How can I set a folder inside the EFS share to default to mode 664?
I'm using Ansible's jenkins_job task to set up some Jenkins jobs. I'm authenticating with a username+password which is authenticated as a Linux user on the Jenkins machine.
- name: Install my job
jenkins_job:
name: "my-job"
user: "{{ jenkins_admin_user }}"
password: "{{ jenkins_admin_pass}}"
config: "{{ lookup('template', 'templates/jobs/my-job.xml') }}"
When I run Ansible some jobs get installed but part-way through the run, after installing some of my jobs (a different number each time), I get this error:
Unable to validate if job exists, Error in request. Possibly authentication failed [401]: Invalid password/token for user: my-jenkins-user
It's clear that my credentials work - jobs show up in Jenkins. So why am I getting this error?
We're starting to manage Kubernetes resources with Helm, and we have some users who are used to managing resources with kubectl edit. We'd like Helm to sanitize the deployed resources every time it's run, bringing them back into a known-good state.
I've observed that helm upgrade does not overwrite my ConfigMaps. Instead, it merges attributes between the deployed ConfigMap and the Helm template, giving me pieces of my templated ConfigMap and pieces of the hand-edited one. If there were no changes in the Helm ConfigMap template, Helm does not reset any part of my deployed ConfigMap back to a know-good state.
How can I instruct Helm to always reset my entire Kubernetes resource to the Helm-templated versions?
I have an AWS EFS NFS4 share (shareA) that is mounted by some servers where all files are owned by userA/uid=800. I'd like to mount that share onto the b-series servers, configured to look like userB/uid=900 owns all of the files. How can I do this?
I cannot get kubectl to authenticate with the EKS Kubernetes instance my coworker created. I've followed the documentation: the AWS CLI can run aws eks commands (I'm an AWS Full Administrator), and the heptio authenticatior is in my path and can generate tokens.
When I run kubectl I get this error:
$ kubectl version
Client Version: version.Info{Major:"1", Minor:"10", GitVersion:"v1.10.4",
GitCommit:"5ca598b4ba5abb89bb773071ce452e33fb66339d", GitTreeState:"clean",
BuildDate:"2018-06-06T15:22:13Z", GoVersion:"go1.9.6", Compiler:"gc",
Platform:"darwin/amd64"}
error: You must be logged in to the server (the server has asked for the client
to provide credentials)
Here's my ~/.kube/config file. It's the exact kubeconfig my coworker can successfully use.
apiVersion: v1
clusters:
- cluster:
server: https://myinstance.sk1.us-east-1.eks.amazonaws.com
certificate-authority-data: base64_cert name: kubernetes contexts: - context: cluster: kubernetes user: aws name: aws
current-context: aws
kind: Config
preferences: {}
users:
- name: aws
user:
exec:
apiVersion: client.authentication.k8s.io/v1alpha1
command: heptio-authenticator-aws
args:
- "token"
- "-i"
- "dev-qa"
# - "-r"
# - "<role-arn>"
I have Apache in front of my Tomcat installation as a reverse proxy. Most URLs are routed to Tomcat by a JkMount directive in Apache.
For one URL pattern I'd like Apache to route requests to the Tomcat worker only if a static asset isn't found on the filesystem.
Something roughly like this:
RewriteCond /var/www%{REQUEST_FILENAME} !-f
RewriteCond /var/www%{REQUEST_FILENAME} !-d
RewriteCond %{REQUEST_FILENAME} ^/assets/.*$
RewriteRule ^/(.*)$ http://${tomcat-ssl}/$1 [P] # This syntax is wrong
What syntax can I provide for the RewriteRule to route the request to Tomcat?
Is it possible to make cron receive it's instructions from the output of a shell script instead of reading a static file?
I'm trying to manage crontabs across a bunch of machines and maintaining separate crontab files for each machine is a chore. I'd like cron to instead run a shell script that prints out crontab lines for each job based on whether a given machine is assigned to that job. Can I do this?
P.S.- I've seen some suggest Puppet/Chef/etc. for this purpose, but I think that's overkill for handling just this one problem.
I've been told to assume it takes as long as 48 hours for a DNS change to propagate throughout the entire Internet, because some DNS servers cache their entries for longer than my TTL.
However, for years and across ISPs and domains, every time I've made a DNS change I see the effects within a couple of hours.
Is it still true that I need to assume a full two days for everyone to see my changes?
I'm setting up a LAMP server and need to prevent SSH/FTP/etc. brute-force logon attempts from succeeding. I've seen many recommendations for both denyhosts and fail2ban, but few comparisons of the two. I also read that an IPTables rule can fill the same function.
Why would I choose one of these methods over another? How do people on serverfault handle this problem?