PageSourceSearch

https://szabo.jp/tech/

html szabo.jp collected 2026-10-07 21:52:09 UTC 38,746 bytes, 1,373 lines download raw bytes

1<!DOCTYPE html>
2<html lang="en-us">
3
4  <head>
5  <link href="http://gmpg.org/xfn/11" rel="profile">
6  <meta http-equiv="content-type" content="text/html; charset=utf-8">
7
8  <meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1">
9
10  <title>
11    
12       &middot; szabo.jp
13    
14  </title>
15
16  
17  <link rel="canonical" href="https://szabo.jp/tech/">
18  
19
20  <link rel="stylesheet" href="/public/css/poole.css">
21  <link rel="stylesheet" href="/public/css/syntax.css">
22  <link rel="stylesheet" href="/public/css/lanyon.css">
23  <link rel="stylesheet" href="/public/css/custom.css">
24  <link rel="stylesheet" href="/public/css/followit.css">
25  <link rel="stylesheet" href="https://fonts.googleapis.com/css?family=PT+Serif:400,400italic,700%7CPT+Sans:400">
26
27  <link rel="apple-touch-icon-precomposed" sizes="144x144" href="/public/apple-touch-icon-precomposed.png">
28  <link rel="shortcut icon" href="/public/favicon-32.png">
29
30  <link rel="alternate" type="application/rss+xml" title="RSS" href="https://szabo.jp/atom.xml">
31</head>
32
33
34  <body>
35
36    <!-- Target for toggling the sidebar `.sidebar-checkbox` is for regular
37     styles, `#sidebar-checkbox` for behavior. -->
38<input type="checkbox" class="sidebar-checkbox" id="sidebar-checkbox">
39
40<!-- Toggleable sidebar -->
41<div class="sidebar" id="sidebar">
42  <div class="sidebar-item">
43    <p>Japan and tech</p>
44  </div>
45
46  <nav class="sidebar-nav">
47    <a class="sidebar-nav-item" href="https://szabo.jp/">Home</a>
48
49    
50
51    
52    
53      
54        
55      
56    
57      
58        
59      
60    
61      
62    
63      
64    
65      
66    
67      
68        
69          <a class="sidebar-nav-item" href="/disclaimer/">Disclaimer</a>
70        
71      
72    
73      
74    
75      
76    
77      
78    
79      
80    
81      
82        
83      
84    
85      
86        
87      
88    
89      
90        
91      
92    
93      
94        
95      
96    
97      
98        
99      
100    
101      
102        
103      
104    
105      
106        
107      
108    
109      
110        
111      
112    
113      
114        
115      
116    
117      
118        
119      
120    
121      
122        
123      
124    
125      
126        
127      
128    
129      
130        
131      
132    
133      
134        
135      
136    
137      
138        
139      
140    
141      
142        
143      
144    
145      
146        
147      
148    
149      
150        
151      
152    
153      
154        
155      
156    
157      
158        
159      
160    
161      
162        
163      
164    
165      
166        
167      
168    
169      
170    
171      
172        
173          <a class="sidebar-nav-item" href="/privacy_policy/">Privacy policy</a>
174        
175      
176    
177      
178    
179      
180    
181      
182    
183  </nav>
184
185  <div class="sidebar-item">
186    <p>
187      &copy; 2026. All rights reserved.
188    </p>
189  </div>
190</div>
191
192
193    <!-- Wrap is the content to shift when toggling the sidebar. We wrap the
194         content to avoid any CSS collisions with our real content. -->
195    <div class="wrap">
196      <div class="masthead">
197        <div class="container" id="topmenu">
198          <h3 class="masthead-title">
199            <p class="alignleft">
200              <a href="/" title="Home">szabo.jp</a>
201              <small>
202                <a href="/japan">#japan</a> | <a href="/tech">#tech</a> | <a href="/money">#money</a> | <a href="/parenting">#parenting</a>
203              </small> 
204            </p>
205            <p class="alignright">
206              <small>
207                <a href="/atom.xml">🛜RSS</a> | 
208                <a href="https://newsletter.szabo.jp/" id="followlink">✉️Subscribe</a>
209              </small>
210            </p>
211          </h3>
212        </div>
213      </div>
214
215      <div class="container content">
216        
217<div class="posts">
218  
219    <div class="post">
220  <h1 class="post-title">
221    <a href="/2026/01/19/root-on-buffalo-ls720d/">
222      How to get root access to a Buffalo LS720D NAS
223    </a>
224  </h1>
225
226  <span class="post-date">19 Jan 2026
227    
228      | <a href="/tech">#tech</a>
229    
230  </span>
231
232  <p>I recently got myself a Buffalo LS720D NAS, <a href="https://www.furusato-tax.jp/product/detail/23100/5775685">thanks to furusato nozei</a>. I looked into how to get root access to it, and it seems like an older method still works now.</p>
233
234
235  
236     <a href="/2026/01/19/root-on-buffalo-ls720d/" class="readmore">Read more</a>
237  
238
239  
240
241
242
243
244
245</div>
246
247  
248    <div class="post">
249  <h1 class="post-title">
250    <a href="/2026/01/15/ichijo-hems-to-homeassistant/">
251      Setting up Ichijo's Cloud HEMS, and connecting it to Home Assistant
252    </a>
253  </h1>
254
255  <span class="post-date">15 Jan 2026
256    
257      | <a href="/tech">#tech</a>
258    
259      | <a href="/housing">#housing</a>
260    
261      | <a href="/japan">#japan</a>
262    
263  </span>
264
265  <p>We added <a href="/2025/04/21/ichijo-smart-home/">most of Ichijo’s smart home (HEMS) options to our house</a> and in this post I’ll review how I set them up, and connected them to Home Assistant.</p>
266
267
268  
269     <a href="/2026/01/15/ichijo-hems-to-homeassistant/" class="readmore">Read more</a>
270  
271
272  
273
274
275
276
277
278</div>
279
280  
281    <div class="post">
282  <h1 class="post-title">
283    <a href="/2025/12/28/curtains/">
284      Curtains for our new house
285    </a>
286  </h1>
287
288  <span class="post-date">28 Dec 2025
289    
290      | <a href="/housing">#housing</a>
291    
292      | <a href="/japan">#japan</a>
293    
294      | <a href="/tech">#tech</a>
295    
296  </span>
297
298  <p>We just finished <a href="/2025/05/24/ichijo-referral/">building our house in Tokyo with Ichijo</a> and <a href="/2025/11/01/house-handover/">had the handover at the end of October</a>
298. One thing we had to get from a different company were the curtains.</p>
299
300
301  
302     <a href="/2025/12/28/curtains/" class="readmore">Read more</a>
303  
304
305  
306
307
308
309
310
311</div>
312
313  
314    <div class="post">
315  <h1 class="post-title">
316    <a href="/2025/12/23/unblocking-the-camera/">
317      Post-handover change: moving a spotlight to unblock a camera
318    </a>
319  </h1>
320
321  <span class="post-date">23 Dec 2025
322    
323      | <a href="/housing">#housing</a>
324    
325      | <a href="/japan">#japan</a>
326    
327      | <a href="/tech">#tech</a>
328    
329  </span>
330
331  <p>We just finished <a href="/2025/05/24/ichijo-referral/">building our house in Tokyo with Ichijo</a> and <a href="/2025/11/01/house-handover/">had the handover at the end of October</a>. After moving in we found a problem: the view of one of the security camera was partially blocked by a spotlight installed right under it.</p>
332
333
334  
335     <a href="/2025/12/23/unblocking-the-camera/" class="readmore">Read more</a>
336  
337
338  
339
340
341
342
343
344</div>
345
346  
347    <div class="post">
348  <h1 class="post-title">
349    <a href="/2025/11/22/remove-wan1-on-dream-router-7/">
350      How to configure WAN1 (Ethernet #4) as LAN on a Dream Router 7
351    </a>
352  </h1>
353
354  <span class="post-date">22 Nov 2025
355    
356      | <a href="/tech">#tech</a>
357    
358  </span>
359
360  <p>We <a href="/2025/11/01/house-handover/">just built our house in Tokyo</a> and <a href="/2025/11/15/home-network/">in a recent post I wrote about how I set up our home network using Ubiquiti gear</a>. The central piece is a <a href="https://store.ui.com/us/en/products/udr7">Dream Router 7</a>, which comes with two WAN ports: WAN1 (2.5 GbE RJ45) and WAN2 (10G SPF+). Our internet is connected to WAN2, and wanted to use WAN1 as a LAN port. This post is about how to configure this.</p>
361
362
363  
364     <a href="/2025/11/22/remove-wan1-on-dream-router-7/" class="readmore">Read more</a>
365  
366
367  
368
369
370
371
372
373</div>
374
375  
376    <div class="post">
377  <h1 class="post-title">
378    <a href="/2025/11/15/home-network/">
379      Home network setup for our new house
380    </a>
381  </h1>
382
383  <span class="post-date">15 Nov 2025
384    
385      | <a href="/housing">#housing</a>
386    
387      | <a href="/japan">#japan</a>
388    
389      | <a href="/tech">#tech</a>
390    
391  </span>
392
393  <p>We <a href="/2025/11/01/house-handover/">just built our house in Tokyo</a> and <a href="/2025/11/13/internet/">in a recent post I wrote about how we got internet</a>. In this post I will share how I set up the network within the house.</p>
394
395
396  
397     <a href="/2025/11/15/home-network/" class="readmore">Read more</a>
398  
399
400  
401
402
403
404
405
406</div>
407
408  
409    <div class="post">
410  <h1 class="post-title">
411    <a href="/2025/11/13/internet/">
412      Internet for our new house
413    </a>
414  </h1>
415
416  <span class="post-date">13 Nov 2025
417    
418      | <a href="/housing">#housing</a>
419    
420      | <a href="/japan">#japan</a>
421    
422      | <a href="/tech">#tech</a>
423    
424  </span>
425
426  <p>We <a href="/2025/11/01/house-handover/">just built our house in Tokyo</a>. In this post I will cover how we got internet.</p>
427
428
429  
430     <a href="/2025/11/13/internet/" class="readmore">Read more</a>
431  
432
433  
434
435
436
437
438
439</div>
440
441  
442    <div class="post">
443  <h1 class="post-title">
444    <a href="/2025/10/04/new-blog-notifications/">
445      New notifications system on this blog
446    </a>
447  </h1>
448
449  <span class="post-date">04 Oct 2025
450    
451      | <a href="/tech">#tech</a>
452    
453  </span>
454
455  <p>I’m hosting this blog on GitHub Pages, but wanted to give readers the option to subscribe to new posts. I recently changed how this is done, and I will cover it in this post.</p>
456
457
458  
459     <a href="/2025/10/04/new-blog-notifications/" class="readmore">Read more</a>
460  
461
462  
463
464
465
466
467
468</div>
469
470  
471    <div class="post">
472  <h1 class="post-title">
473    <a href="/2025/04/21/ichijo-smart-home/">
474      Ichijo's smart home options
475    </a>
476  </h1>
477
478  <span class="post-date">21 Apr 2025
479    
480      | <a href="/tech">#tech</a>
481    
482      | <a href="/japan">#japan</a>
483    
484      | <a href="/housing">#housing</a>
485    
486  </span>
487
488  <p>We are building a house in Tokyo with <a href="https://www.ichijo.co.jp/">Ichijo 一条工務店</a>. In previous apartments I always had a limited smart home setup, so now that we got to de
488sign the whole house, I wanted to consider every available options and add them if they make sense. I’ll review what we ended up adding to our design in this post.</p>
489
490
491  
492     <a href="/2025/04/21/ichijo-smart-home/" class="readmore">Read more</a>
493  
494
495  
496
497
498
499
500
501</div>
502
503  
504    <div class="post">
505  <h1 class="post-title">
506    <a href="/2025/01/26/odelic-connected-lighting/">
507      Odelic Connected Lighting
508    </a>
509  </h1>
510
511  <span class="post-date">26 Jan 2025
512    
513      | <a href="/tech">#tech</a>
514    
515      | <a href="/japan">#japan</a>
516    
517      | <a href="/housing">#housing</a>
518    
519  </span>
520
521  <p>We are building a house, and I recently <a href="/2024/07/28/smart-lights-overview/">looked into smart lighting and light switches</a> concluding that the best option for us was likely Panasonic’s Advance Series Link Plus, which later <a href="/2024/11/10/panasonic-advance-series-link-plus/">I did a deep-dive on</a>. Then I took a look at <a href="/2025/01/25/tree-koizumi-smart-lights/">Koizumi’s TRee system</a>, and now to finish up my investigation into Japanese smart lighting systems, I will share what I learned about <a href="https://www.odelic.co.jp/products/connectedlighting/home/">Odelic’s Connected Lighting</a>.</p>
522
523
524  
525     <a href="/2025/01/26/odelic-connected-lighting/" class="readmore">Read more</a>
526  
527
528  
529
530
531
532
533
534</div>
535
536  
537    <div class="post">
538  <h1 class="post-title">
539    <a href="/2025/01/25/tree-koizumi-smart-lights/">
540      TRee: Koizumi's smart light system
541    </a>
542  </h1>
543
544  <span class="post-date">25 Jan 2025
545    
546      | <a href="/tech">#tech</a>
547    
548      | <a href="/japan">#japan</a>
549    
550      | <a href="/housing">#housing</a>
551    
552  </span>
553
554  <p>We are building a house, and I recently <a href="/2024/07/28/smart-lights-overview/">looked into smart lighting and light switches</a> concluding that the best option for us was likely Panasonic’s Advance Series Link Plus, which later <a href="/2024/11/10/panasonic-advance-series-link-plus/">I did a deep-dive on</a>. Then we started looking at the actual lights to see what fits with our design, and found Panasonic’s offerings underwhelming. This made us look at other manufacturers, namely Koizumi and Odelic. They both have smart lights, so I will share what I learned about each, started with Koizumi.</p>
555
556
557  
558     <a href="/2025/01/25/tree-koizumi-smart-lights/" class="readmore">Read more</a>
559  
560
561  
562
563
564
565
566
567</div>
568
569  
570    <div class="post">
571  <h1 class="post-title">
572    <a href="/2024/11/10/panasonic-advance-series-link-plus/">
573      Testing the Panasonic Advance Series Link Plus smart light switches
574    </a>
575  </h1>
576
577  <span class="post-date">10 Nov 2024
578    
579      | <a href="/tech">#tech</a>
580    
581      | <a href="/japan">#japan</a>
582    
583      | <a href="/housing">#housing</a>
584    
585  </span>
586
587  <p>We are building a house, and I recently <a href="/2024/07/28/smart-lights-overview/">looked into smart lighting and light switches</a> concluding that the best option for us is likely Panasonic’s <a href="https://www2.panasonic.biz/jp/densetsu/haisen/switch_concent/advance/lineup/linkplus/">Advance Series Link Plus</a> switches (アドバンスシリーズ リンクプラス). I got my hands on two of the switches and in this post I’ll share what I learned from testing them out.</p>
588
589
590  
591     <a href="/2024/11/10/panasonic-advance-series-link-plus/" class="readmore">Read more</a>
592  
593
594  
595
596
597
598
599
600</div>
601
602  
603    <div class="post">
604  <h1 class="post-title">
605    <a href="/2024/09/19/cc_fuzz_test/">
606      Fuzzing with Bazel: cc_fuzz_test
607    </a>
608  </h1>
609
610  <span class="post-date">19 Sep 2024
611    
612      | <a href="/tech">#tech</a>
613    
614      | <a href="/security">#security</a>
615    
616  </span>
617
618  <p>Recently I have been fuzzing C/C++ projects built with Bazel using libfuzzer, so I thought to share my learnings on some of the details on how to do this.</p>
619
620
621  
622     <a href="/2024/09/19/cc_fuzz_test/" class="readmore">Read more</a>
623  
624
625  
626
627
628
629
630
631</div>
632
633  
634    <div class="post">
635  <h1 class="post-title">
636    <a href="/2024/07/28/smart-lights-overview/">
637      Smart lighting options in Japan
638    </a>
639  </h1>
640
641  <span class="post-date">28 Jul 2024
642    
643      | <a href="/tech">#tech</a>
644    
645      | <a href="/japan">#japan</a>
646    
647      | <a href="/housing">#housing</a>
648    
649  </span>
650
651  <p>We are in the process of building our house, and I want to use this opportunity to add some smart home solutions. Right now my focus is on ensuring that the things that come with the house are capable of “being smart” (controlled with automation). Big part of this is lighting, and in this post I’ll review what I learned about smart lighting options available in Japan.</p>
652
653
654  
655     <a href="/2024/07/28/smart-lights-overview/" class="readmore">Read more</a>
656  
657
658  
659
660
661
662
663
664</div>
665
666  
667    <div class="post">
668  <h1 class="post-title">
669    <a href="/2024/05/17/a-low-effort-way-of-getting-paid-well/">
670      A low-effort way of getting paid well
671    </a>
672  </h1>
673
674  <span class="post-date">17 May 2024
675    
676      | <a href="/tech">#tech</a>
677    
678      | <a href="/money">#money</a>
679    
680  </span>
681
682  <p>I work in IT, which generally means great salaries, but there is still a difference between companies. Moreover <a href="https://www.search.co.uk/insights-advice/career-advice/unlocking-higher-salary-potential-why-changing-jobs-can-boost-your-earnings/">changing jobs leads to higher compensation on average</a>, as one is in a better negotiation position when joining a company compared to when simply asking for a raise.</p>
683
684<p>However constantly looking for jobs and interviewing requires substantial efforts, so I have a more passive approach to it.</p>
685
686
687  
688     <a href="/2024/05/17/a-low-effort-way-of-getting-paid-well/" class="readmore">Read more</a>
689  
690
691  
692
693
694
695
696
697</div>
698
699  
700    <div class="post">
701  <h1 class="post-title">
702    <a href="/2024/03/14/newborn-tech/">
703      Tech that helped us during the first months with a newborn baby
704    </a>
705  </h1>
706
707  <span class="post-date">14 Mar 2024
708    
709      | <a href="/tech">#tech</a>
710    
711      | <a href="/parenting">#parenting</a>
712    
713  </span>
714
715  <p>I work in tech, and while I try to maintain a healthy work-life balance, I still use many gadgets, so I thought to share which tech solutions helped us during the first month with our newborn baby.</p>
716
717
718  
719     <a href="/2024/03/14/newborn-tech/" class="readmore">Read more</a>
720  
721
722  
723
724
725
726
727
728</div>
729
730  
731    <div class="post">
732  <h1 class="post-title">
733    <a href="/2023/11/26/transient-network-issue-at-container-start-istio-holdApplicationUntilProxyStarts/">
734      Transient network issue at container start when using istio (solution: holdApplicationUntilProxyStarts)
735    </a>
736  </h1>
737
738  <span class="post-date">26 Nov 2023
739    
740      | <a href="/tech">#tech</a>
741    
742  </span>
743
744  <p>I was setting up an app on a kubernetes cluster that had istio configured as a service mesh, and I run into an issue: as the application starts, it attempts to communicate to another service over the network (doesn’t matter if it’s an external service or something running on the same cluster), and it fails.
745However when I <code class="language-plaintext highlighter-rouge">kubectl exec</code> into the container, I can successfully reach the same service.
746What’s going on and how to solve it?</p>
747
748
749  
750     <a href="/2023/11/26/transient-network-issue-at-container-start-istio-holdApplicationUntilProxyStarts/" class="readmore">Read more</a>
751  
752
753  
754
755
756
757
758
759</div>
760
761  
762    <div class="post">
763  <h1 class="post-title">
764    <a href="/2023/08/10/istio-proxy-hostname-mismatch-error/">
765      istio-proxy 'NR filter_chain_not_found' / upstream connect error or disconnect/reset before headers. reset reason: connection termination
766    </a>
767  </h1>
768
769  <span class="post-date">10 Aug 2023
770    
771      | <a href="/tech">#tech</a>
772    
773  </span>
774
775  <p>I deployed a vendor’s software on kubernetes and the website showed this error message:</p>
776
777<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>upstream connect error or disconnect/reset before headers. reset reason: connection termination
778</code></pre></div></div>
779
780<p>Looking at the <code class="language-plaintext highlighter-rouge">istio-proxy</code> sidecar logs on the Pod I could see an error message:</p>
781
782<div class="language-bash highlighter-rouge"><div class="highlight"><pre class="highlight"><code>kubectl logs <span class="nt">-c</span> istio-proxy app-ui-543875cf14-a2b33
783<span class="o">[</span>2023-08-09T06:06:22.268Z] <span class="s2">"- - -"</span> 0 NR filter_chain_not_found - <span class="s2">"-"</span> 0 0 0 - <span class="s2">"-"</span> <span class="s2">"-"</span> <span class="s2">"-"</span> <span class="s2">"-"</span> <span class="s2">"-"</span> - - 10.20.223.206:8080 10.20.221.213:42304 - -
784</code></pre></div></div>
785
786
787  
788     <a href="/2023/08/10/istio-proxy-hostname-mismatch-error/" class="readmore">Read more</a>
789  
790
791  
792
793
794
795
796
797</div>
798
799  
800    <div class="post">
801  <h1 class="post-title">
802    <a href="/2023/08/06/get-all-repositories-of-an-enterprise-on-github-enterprise-cloud/">
803      How to get all repositories of an enterprise on GitHub Enterprise Cloud
804    </a>
805  </h1>
806
807  <span class="post-date">06 Aug 2023
808    
809      | <a href="/tech">#tech</a>
810    
811  </span>
812
813  <p>GitHub Enterprise Cloud is an enterprise version of GitHub.com “designed for large businesses or teams who collaborate on GitHub.com”(<a href="https://docs.github.com/en/enterprise-cloud@latest/admin/overview/about-github-enterprise-cloud">source</a>).
814There is a strong emphasis on security, which extends to strong limits on programmatic access, especially to enterprise-wide resources, so getting all organizations or all repositories of the enterprise becomes non-trivial.
815This guide will describe how to do just these.</p>
816
817
818  
819     <a href="/2023/08/06/get-all-repositories-of-an-enterprise-on-github-enterprise-cloud/" class="readmore">Read more</a>
820  
821
822  
823
824
825
826
827
828</div>
829
830  
831    <div class="post">
832  <h1 class="post-title">
833    <a href="/2023/08/02/vault-plugin-secrets-artifactory-without-admin-user/">
834      Using vault-plugin-secrets-artifactory to generate short-lived Artifactory tokens with a non-admin user
835    </a>
836  </h1>
837
838  <span class="post-date">02 Aug 2023
839    
840      | <a href="/tech">#tech</a>
841    
842      | <a href="/security">#security</a>
843    
844  </span>
845
846  <p>How to use the <a href="https://github.com/jfrog/vault-plugin-secrets-artifactory">HashiCorp Vault Secrets Plugin for Artifactory</a> to create short-lived Artifactory tokens scoped to a specific user, without the need for an admin token.
847The main usecase for this is CI workflows (e.g. Github actions) that can authenticate to vault (e.g. <a href="https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/about-security-hardening-with-openid-connect">Github’s workflow OIDC</a>) and need access to Artifactory.</p>
848
849
850  
851     <a href="/2023/08/02/vault-plugin-secrets-artifactory-without-admin-user/" class="readmore">Read more</a>
852  
853
854  
855
856
857
858
859
860</div>
861
862  
863    <div class="post">
864  <h1 class="post-title">
865    <a href="/2023/07/04/authenticating-github-workflows-with-oauth2-proxy/">
866      Authenticating Github workflows with oauth2-proxy
867    </a>
868  </h1>
869
870  <span class="post-date">04 Jul 2023
871    
872      | <a href="/tech">#tech</a>
873    
874  </span>
875
876  <p><a href="https://github.com/oauth2-proxy/oauth2-proxy">oauth2-proxy</a> is often used to handle user authentication for apps, however non-human users (e.g. CI workflows) are often unable to complete the OIDC flow.
877In this post I will show how to configure oauth2-proxy to trust Github’s OIDC provider and use that JWT to authenticate workflows and give them access to the app behind the proxy.</p>
878
879
880  
881     <a href="/2023/07/04/authenticating-github-workflows-with-oauth2-proxy/" class="readmore">Read more</a>
882  
883
884  
885
886
887
888
889
890</div>
891
892  
893    <div class="post">
894  <h1 class="post-title">
895    <a href="/2023/06/18/use-terraform-provider-locally-and-in-ci/">
896      How to use the vault terraform provider locally and in a Github action ci workflow at the same time
897    </a>
898  </h1>
899
900  <span class="post-date">18 Jun 2023
901    
902      | <a href="/tech">#tech</a>
903    
904  </span>
905
906  <p>In one of my the projects I manage vault resources via terraform. 
907The main terraform pipeline runs in a Github action workflow and uses <a href="https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/configuring-openid-connect-in-hashicorp-vault">Github’s JWT to connect to vault</a>.
908Meanwhile user authentication is done using <a href="https://developer.hashicorp.com/vault/tutorials/auth-methods/oidc-auth">vault’s OIDC auth method</a>.</p>
909
910<p>This post will show how to setup the <a href="https://registry.terraform.io/providers/hashicorp/vault/latest/docs#provider-arguments">vault terraform provider</a> so that it uses the Github signed JWT when running in CI, and OIDC authentication when running locally.</p>
911
912
913  
914     <a href="/2023/06/18/use-terraform-provider-locally-and-in-ci/" class="readmore">Read more</a>
915  
916
917  
918
919
920
921
922
923</div>
924
925  
926    <div class="post">
927  <h1 class="post-title">
928    <a href="/2023/06/18/accessing-the-github-token-from-an-action/">
929      Accessing the Github token from a Github action
930    </a>
931  </h1>
932
933  <span class="post-date">18 Jun 2023
934    
935      | <a href="/tech">#tech</a>
936    
937  </span>
938
939  <p>For each Github action workflow, Github creates a unique Github token. This can accessed a either via the  <code class="language-plaintext highlighter-rouge">GITHUB_TOKEN</code> secret (<code class="language-plaintext highlighter-rouge">${{ secrets.GITHUB_TOKEN }}</code>) or via the <code class="language-plaintext highlighter-rouge">github</code> context (<code class="language-plaintext highlighter-rouge">${{ github.token }}</code>).
940The <a href="https://docs.github.com/en/actions/security-guides/automatic-token-authentication#using-the-github_token-in-a-workflow">docs</a> also note that</p>
941
942<blockquote>
943  <p>An action can access the GITHUB_TOKEN through the github.token context even if the workflow does not explicitly pass the GITHUB_TOKEN to the action.</p>
944</blockquote>
945
946<p>However the docs fall short of showing how to do it, and it took me a while to figure it out, so I’m sharing it here.</p>
947
948
949  
950     <a href="/2023/06/18/accessing-the-github-token-from-an-action/" class="readmore">Read more</a>
951  
952
953  
954
955
956
957
958
959</div>
960
961  
962    <div class="post">
963  <h1 class="post-title">
964    <a href="/2021/10/07/snyk-docker-fail-on-workaround/">
965      snyk test docker --fail-on= workaround
966    </a>
967  </h1>
968
969  <span class="post-date">07 Oct 2021
970    
971      | <a href="/tech">#tech</a>
972    
973      | <a href="/security">#security</a>
974    
975  </span>
976
977  <p>I’m running Snyk to scan docker images and break the build if they have high or critical vulnerabilities:</p>
978
979<div class="language-bash highlighter-rouge"><div class="highlight"><pre class="highlight"><code>snyk <span class="nb">test</span> <span class="nt">--severity-threshold</span><span class="o">=</span>high <span class="nt">--docker</span> <span class="nv">$IMAGE_NAME</span>
980</code></pre></div></div>
981
982<p>However sometimes the upstream image has high or critical vulnerabilities (e.g. at the times of writing this, <code class="language-plaintext highlighter-rouge">debian</code>), so there is very little action one can take (other than moving to a different base image, which is usually not easy). Thus I only want to break the build if there are high or critical vulnerabilities AND they can be fixed by ugrading the base image.</p>
983
984
985  
986     <a href="/2021/10/07/snyk-docker-fail-on-workaround/" class="readmore">Read more</a>
987  
988
989  
990
991
992
993
994
995</div>
996
997  
998    <div class="post">
999  <h1 class="post-title">
1000    <a href="/2021/09/22/multicluster-istio-on-eks/">
1001      Multi-cluster multi-primary istio on AWS EKS
1002    </a>
1003  </h1>
1004
1005  <span class="post-date">22 Sep 2021
1006    
1007      | <a href="/tech">#tech</a>
1008    
1009  </span>
1010
1011  <p>Recently I was working on setting up istio in a multi-cluster setup following the <a href="https://istio.io/latest/docs/setup/install/multicluster/multi-primary_multi-network/">Install Multi-Primary on different networks</a> guide on EKS clusters. Everything seemed to work (no errors in logs), until I reached the <a href="https://istio.io/latest/docs/setup/install/multicluster/verify/">verification step</a>, where requests didn’t go to the other mesh: in <code class="language-plaintext highlighter-rouge">CLUSTER1</code> I always got a response from <code class="language-plaintext highlighter-rouge">Hello version: v1, instance: helloworld-v1-86f77cd7bd-cpxhv</code>, while in <code class="language-plaintext highlighter-rouge">CLUSTER2</code> always from <code class="language-plaintext highlighter-rouge">
1011Hello version: v2, instance: helloworld-v2-758dd55874-6x4t8</code>.</p>
1012
1013
1014  
1015     <a href="/2021/09/22/multicluster-istio-on-eks/" class="readmore">Read more</a>
1016  
1017
1018  
1019
1020
1021
1022
1023
1024</div>
1025
1026  
1027    <div class="post">
1028  <h1 class="post-title">
1029    <a href="/2021/09/17/terraform-kubernetes_secret-inconsistent-result-after-apply/">
1030      Terraform's kubernetes_secret giving 'Error: Provider produced inconsistent result after apply'
1031    </a>
1032  </h1>
1033
1034  <span class="post-date">17 Sep 2021
1035    
1036      | <a href="/tech">#tech</a>
1037    
1038  </span>
1039
1040  <p>I’m creating a new <code class="language-plaintext highlighter-rouge">kubernetes_secret</code> via Terraform for an existing service account like this:</p>
1041
1042<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>resource "kubernetes_secret" "my_service_account_token" {
1043  metadata {
1044    name = "my-service-account-token"
1045    namespace = "example"
1046    annotations = {
1047      "kubernetes.io/service-account.name" = "my-service-account"
1048    }
1049  }
1050  type = "kubernetes.io/service-account-token"
1051}
1052</code></pre></div></div>
1053
1054<p>so that then I can use this token elsewhere like: <code class="language-plaintext highlighter-rouge">kubernetes_secret.my_service_account_token.data["token"]</code>.</p>
1055
1056
1057  
1058     <a href="/2021/09/17/terraform-kubernetes_secret-inconsistent-result-after-apply/" class="readmore">Read more</a>
1059  
1060
1061  
1062
1063
1064
1065
1066
1067</div>
1068
1069  
1070    <div class="post">
1071  <h1 class="post-title">
1072    <a href="/2021/08/21/how-to-setup-azure-ad-with-aws-eks-kubernetes-clusters/">
1073      How to setup Azure AD authentication with AWS EKS kubernetes clusters
1074    </a>
1075  </h1>
1076
1077  <span class="post-date">21 Aug 2021
1078    
1079      | <a href="/tech">#tech</a>
1080    
1081  </span>
1082
1083  <p>I recently worked on setting up <a href="https://azure.microsoft.com/en-us/services/active-directory/">Azure Active Directory (AAD from now)</a> authentication with kubernetes clusters running on <a href="https://aws.amazon.com/eks/">AWS EKS (Amazon Elastic Kubernetes Service)</a>. The goal was to let users of the kubernetes cluster authenticate using their AAD identities, and assing permissions using the usernames and also AAD groups. Here is how I did it.</p>
1084
1085
1086  
1087     <a href="/2021/08/21/how-to-setup-azure-ad-with-aws-eks-kubernetes-clusters/" class="readmore">Read more</a>
1088  
1089
1090  
1091
1092
1093
1094
1095
1096</div>
1097
1098  
1099    <div class="post">
1100  <h1 class="post-title">
1101    <a href="/2021/08/19/get-latest-release-from-github/">
1102      How to download the latest release from a Github repository
1103    </a>
1104  </h1>
1105
1106  <span class="post-date">19 Aug 2021
1107    
1108      | <a href="/tech">#tech</a>
1109    
1110  </span>
1111
1112  <p>We often want to download the latest release of an application from Github, however it <a href="https://gist.github.com/steinwaywhw/a4cd19cda655b8249d908261a62687f8">used to be hard without knowing the latest version</a>. But now we can do the followings:</p>
1113
1114<ul>
1115  <li><code class="language-plaintext highlighter-rouge">https://github.com/&lt;user&gt;/&lt;repo&gt;/releases/latest</code> takes you to the latest release page, e.g. <a href="https://github.com/Azure/kubelogin/releases/latest">https://github.com/Azure/kubelogin/releases/latest</a></li>
1116  <li><code class="language-plaintext highlighter-rouge">https://github.com/&lt;user&gt;/&lt;repo&gt;/releases/latest/download/&lt;filename&gt;</code> gets you a binary from the latest release, e.g. <a href="https://github.com/Azure/kubelogin/releases/latest/download/kubelogin-linux-amd64.zip">https://github.com/Azure/kubelogin/releases/latest/download/kubelogin-linux-amd64.zip</a></li>
1117</ul>
1118
1119  
1120
1121  
1122
1123
1124
1125
1126
1127</div>
1128
1129  
1130    <div class="post">
1131  <h1 class="post-title">
1132    <a href="/2021/08/09/moving-a-blog-from-wordpress-to-github-pages/">
1133      Moving a blog from Wordpress to Github pages
1134    </a>
1135  </h1>
1136
1137  <span class="post-date">09 Aug 2021
1138    
1139      | <a href="/tech">#tech</a>
1140    
1141  </span>
1142
1143  <p>This blog is hosted on Github pages, which I end up liking a lot, so I decided to move my other blog (originally hosted on Wordpress) too. I was already planning to update the domain of that blog, so I took the opportunity to do both at the same time. Here are the steps I did.</p>
1144
1145
1146  
1147     <a href="/2021/08/09/moving-a-blog-from-wordpress-to-github-pages/" class="readmore">Read more</a>
1148  
1149
1150  
1151
1152
1153
1154
1155
1156</div>
1157
1158  
1159    <div class="post">
1160  <h1 class="post-title">
1161    <a href="/2021/05/24/authentication-using-k8s-service-account-jwts/">
1162      Authentication using kubernetes service account JWTs
1163    </a>
1164  </h1>
1165
1166  <span class="post-date">24 May 2021
1167    
1168      | <a href="/tech">#tech</a>
1169    
1170  </span>
1171
1172  <p>Permissions for a Pod in kubernetes are managed via <a href="https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/">Service Accounts</a>, and these come with a JWT issued by the cluster. If the Pods need to authenticate to an external service, it would be reasonable to use this JWT, so let’s see how to get it and verify it.</p>
1173
1174
1175  
1176     <a href="/2021/05/24/authentication-using-k8s-service-account-jwts/" class="readmore">Read more</a>
1177  
1178
1179  
1180
1181
1182
1183
1184
1185</div>
1186
1187  
1188    <div class="post">
1189  <h1 class="post-title">
1190    <a href="/2021/05/24/k8s-cannot-get-path-.well-known-openid-configuration/">
1191      Kubernetes: cannot get path "//.well-known/openid-configuration"
1192    </a>
1193  </h1>
1194
1195  <span class="post-date">24 May 2021
1196    
1197      | <a href="/tech">#tech</a>
1198    
1199  </span>
1200
1201  <p>I’ve been <a href="/2021/05/24/authentication-using-k8s-service-account-jwts/">playing with using kubernetes service account JWTs to authenticate Pods</a>. To get the cert for checking the JWT signature, I needed to hit the <code class="language-plaintext highlighter-rouge">https://kubernetes.default.svc/.well-known/openid-configuration</code> endpoint, however as the URL was coming from a config file it ended up being <code class="language-plaintext highlighter-rouge">https://kubernetes.default.svc//.well-known/openid-configuration</code> (mind the double <code class="language-plaintext highlighter-rouge">//</code>). This worked well locally where everything runs under the powerful default service account, but when deployed I got an error saying:</p>
1202
1203
1204  
1205     <a href="/2021/05/24/k8s-cannot-get-path-.well-known-openid-configuration/" class="readmore">Read more</a>
1206  
1207
1208  
1209
1210
1211
1212
1213
1214</div>
1215
1216  
1217    <div class="post">
1218  <h1 class="post-title">
1219    <a href="/2021/05/10/cross-app-scripting-in-android-apps/">
1220      Cross-app Scripting in Android apps
1221    </a>
1222  </h1>
1223
1224  <span class="post-date">10 May 2021
1225    
1226      | <a href="/tech">#tech</a>
1227    
1228      | <a href="/security">#security</a>
1229    
1230  </span>
1231
1232  <p>If an Android app accepts <a href="https://developer.android.com/reference/android/content/Intent?hl=en">Intents</a> to open a URL in a <a href="https://developer.android.com/reference/android/webkit/WebView">WebView</a>, then a malicious app installed on the same device might open a <code class="language-plaintext highlighter-rouge">javascript:alert(1)</code>-like URL, which will run the provided JavaScript in the context of the victim app’s site (that is currently loaded in the WebView). This vulnerability is called <a href="https://support.google.com/faqs/answer/9084685?hl=en-GB">Cross-app Scripting</a>.</p>
1233
1234
1235  
1236     <a href="/2021/05/10/cross-app-scripting-in-android-apps/" class="readmore">Read more</a>
1237  
1238
1239  
1240
1241
1242
1243
1244
1245</div>
1246
1247  
1248    <div class="post">
1249  <h1 class="post-title">
1250    <a href="/2021/05/10/restricting-google-app-script-permissions/">
1251      Restricting Google App Script permissions
1252    </a>
1253  </h1>
1254
1255  <span class="post-date">10 May 2021
1256    
1257      | <a href="/tech">#tech</a>
1258    
1259  </span>
1260
1261  <blockquote>
1262  <p>Google Apps Script is a rapid application development platform that makes it fast and easy to create business applications that integrate with Google Workspace. You write code in modern JavaScript and have access to built-in libraries for favorite Google Workspace applications like Gmail, Calendar, Drive, and more.</p>
1263
1264  <p><a href="https://developers.google.com/apps-script/overview">https://developers.google.com/apps-script/overview</a></p>
1265</blockquote>
1266
1267<p>Google Apps Script provide an easy way to automate repetitive tasks in the Google ecosystem (e.g. Drive). It is somewhat similar to macros in Microsoft Office. An App Script will ask for permissions before it can interact with any document of the user, and by default these permissions are unnecessarily wide. This write up is meant to help restricting these permissions.</p>
1268
1269
1270  
1271     <a href="/2021/05/10/restricting-google-app-script-permissions/" class="readmore">Read more</a>
1272  
1273
1274  
1275
1276
1277
1278
1279
1280</div>
1281
1282  
1283    <div class="post">
1284  <h1 class="post-title">
1285    <a href="/2021/05/10/using-lastpass-on-login-forms-with-more-than-2-inputs/">
1286      Using LastPass on login forms with more than 2 inputs
1287    </a>
1288  </h1>
1289
1290  <span class="post-date">10 May 2021
1291    
1292      | <a href="/tech">#tech</a>
1293    
1294  </span>
1295
1296  <p>LastPass generally handles common login pages with a username and password well, but it breaks on login forms that have more than those two fields. But there is a solution.</p>
1297
1298<h2 id="the-problem">The problem</h2>
1299
1300<p>Here is the site I’ll use as an example: the login page of the SMBC bank: [https://direct.smbc.co.jp/aib/aibgsjsw5001.jsp]</p>
1301
1302<p><img src="/assets/2021-05-10-using-lastpass-on-login-forms-with-more-than-2-inputs/problem.png" alt="" /></p>
1303
1304<p>The first line gives 2 options for identifying your user: either specify your bank account number (branch code and account number) or use your contractor number. I’m using the first one, so let’s focus on that. The problem is that the branch code and the account numbers are two separate text boxes, thus when I fill them out and login, then LastPass will only save one of them as username.</p>
1305
1306
1307  
1308     <a href="/2021/05/10/using-lastpass-on-login-forms-with-more-than-2-inputs/" class="readmore">Read more</a>
1309  
1310
1311  
1312
1313
1314
1315
1316
1317</div>
1318
1319  
1320    <div class="post">
1321  <h1 class="post-title">
1322    <a href="/2021/05/09/getting-a-jp-domian/">
1323      Getting a .jp domain
1324    </a>
1325  </h1>
1326
1327  <span class="post-date">09 May 2021
1328    
1329      | <a href="/tech">#tech</a>
1330    
1331      | <a href="/japan">#japan</a>
1332    
1333  </span>
1334
1335  <p>I have a super common family name in Hungary: Szabo. It means tailor, and appr. 2% of Hungarians have this family name (<a href="https://en.wikipedia.org/wiki/Szab%C3%B3">203,126</a> out of <a href="https://en.wikipedia.org/wiki/Demographics_of_Hungary">9,730,000</a>). Thus szabo.hu, szabo.eu, szabo.com, szabo.net, szabo.info, szabo.me, szabo.xyz etc. are mostly taken. However I recently checked and szabo.jp was available! Following a <a href="https://tokyocheapo.com/business/registering-jp-domains-for-cheap/">Tokyo Cheapo guide</a> I found <a href="https://www.star-domain.jp?ref=NA99yyrv">Star Domain</a> and bought the domain there for 2560 yen/year. (Star Domain has a referral program, so if you use this link, I might earn a little money.)</p>
1336
1337<p>I already had hosting elsewhere, so I only needed the domain and Star Domain has a <a href="https://www.star-domain.jp/man/man_dns_setting.php">pretty straightforward DNS configurator</a>. I read that only people in Japan can register <code class="language-plaintext highlighter-rouge">.jp</code> domains, so I expected some verification, but only my phone number was checked and after I paid for the domain, I could use it immediately.</p>
1338
1339<p>Most part of the site is text based, so Google Translate makes it possible to use it without knowing too much Japanese.</p>
1340
1341  
1342
1343  
1344
1345
1346
1347
1348
1349</div>
1350
1351  
1352</div>
1353
1354
1355      </div>
1356    </div>
1357
1358    <label for="sidebar-checkbox" class="sidebar-toggle"></label>
1359
1360    
1360<script src='/public/js/script.js'></script>
1360
1361    
1361<script src='/public/js/lightboxforimages.js'></script>
1361
1362    
1362<script type="text/javascript" src="/public/js/lightbox.js"></script>
1362
1363    <link rel="stylesheet" href="/public/css/lightbox.css">
1364    <!-- Cookie-less, Privacy Focused Analytics - https://getinsights.io/ -->
1365    
1365<script src="https://getinsights.io/js/insights.js"></script>
1365
1366    
1366<script>
1367    if(!document.cookie.includes("donttrackitsme")){ // disable analytics for mys own siteloads
1368        insights.init('Q8c2JXuQifj3JKNw');
1369        insights.trackPages();
1370    }
1371    </script>
1371
1372  </body>
1373</html>

Line numbers count LF bytes from the start of the resource, as the search results do. Vendor segments are library code the classifier recognised; they are stored but not indexed. Bytes are shown as Latin1 characters, one per byte.