"BearSSL is an implementation of the SSL/TLS protocol (RFC 5246) written in C. It aims at offering the following features:
Be correct and secure. In particular, insecure protocol versions and choices of algorithms are not supported, by design; cryptographic algorithm implementations are constant-time by default.
Be small, both in RAM and code footprint. For instance, a minimal server implementation may fit in about 20 kilobytes of compiled code and 25 kilobytes of RAM.
Be highly portable. BearSSL targets not only "big" operating systems like Linux and Windows, but also small embedded systems and even special contexts like bootstrap code.
Be feature-rich and extensible. SSL/TLS has many defined cipher suites and extensions; BearSSL should implement most of them, and allow extra algorithm implementations to be added afterwards, possibly from third parties."
for
incoming connections from other members in the group
The server listens on this port for member-to-member
connections. This port must not be used for user
applications at all
The loose- prefix used for the
group_replication variables above instructs the server to
continue to start if the Group Replication plugin has not
been loaded at the time the server is started.
For example, if
each server instance is on a different machine use the IP
and port of the machine, such as 10.0.0.1:33061. The
recommended port for
group_replication_local_address
is 33061
does not
need to list all members in the group
The server that starts the group does not make use of this
option, since it is the initial server and as such, it is
in charge of bootstrapping the group
start the bootstrap member first,
and let it create the group
Creating a group and joining multiple members at the
same time is not supported.
must only be used on one server instance at
any time
Disable this option after the first server
instance comes online
Create an additional staging environment that closely resembles the
production one
Keep any additional configuration in YAML files under the config/ directory
Rails::Application.config_for(:yaml_file)
Use nested routes to express better the relationship between ActiveRecord
models
nest routes more than 1 level deep then use the shallow: true option
namespaced routes to group related actions
Don't use match to define any routes unless there is need to map multiple request types among [:get, :post, :patch, :put, :delete] to a single action using :via option.
Keep the controllers skinny
all the business logic
should naturally reside in the model
Share no more than two instance variables between a controller and a view.
using a template
Prefer render plain: over render text
Prefer corresponding symbols to numeric HTTP status codes
without abbreviations
Keep your models for business logic and data-persistence
only
Group macro-style methods (has_many, validates, etc) in the beginning of
the class definition
Prefer has_many :through to has_and_belongs_to_many
self[:attribute]
self[:attribute] = value
validates
Keep custom validators under app/validators
Consider extracting custom validators to a shared gem
preferable to make a class method instead which serves the
same purpose of the named scope
returns an ActiveRecord::Relation
object
.update_attributes
Override the to_param method of the model
Use the friendly_id gem. It allows creation of human-readable URLs by
using some descriptive attribute of the model instead of its id
find_each to iterate over a collection of AR objects
.find_each
.find_each
Looping through a
collection of records from the database (using the all method, for example)
is very inefficient since it will try to instantiate all the objects at once
always call
before_destroy callbacks that perform validation with prepend: true
Define the dependent option to the has_many and has_one associations
always use the exception raising bang! method or handle the method return value.
When persisting AR objects
Avoid string interpolation in
queries
param will be properly escaped
Consider using named placeholders instead of positional placeholders
use of find over where
when you need to retrieve a single record by id
use of find_by over where and find_by_attribute
use of where.not over SQL
use
heredocs with squish
Keep the schema.rb (or structure.sql) under version control.
Use rake db:schema:load instead of rake db:migrate to initialize an empty
database
Enforce default values in the migrations themselves instead of in the
application layer
change_column_default
imposing data integrity from
the Rails app is impossible
use the change method instead of up and down methods.
constructive migrations
use models in migrations, make sure you define them
so that you don't end up with broken migrations in the future
Don't use non-reversible migration commands in the change method.
In this case, block will be used by create_table in rollback
Never call the model layer directly from a view
Never make complex formatting in the views, export the formatting to a method
in the view helper or the model.
When the labels of an ActiveRecord model need to be translated, use the
activerecord scope
Separate the texts used in the views from translations of ActiveRecord
attributes
Place the locale files for the models in a folder locales/models
the
texts used in the views in folder locales/views
Use the dot-separated keys in the controllers and models
Reserve app/assets for custom stylesheets, javascripts, or images
Third party code such as jQuery or
bootstrap should be placed in
vendor/assets
Provide both HTML and plain-text view templates
config.action_mailer.raise_delivery_errors = true
Use a local SMTP server like
Mailcatcher in the development
environment
Provide default settings for the host name
The _url methods include the host name and the _path
methods don't
_url
Format the from and to addresses properly
default from:
sending html emails all styles should be inline
Sending emails while generating page response should be avoided. It causes
delays in loading of the page and request can timeout if multiple email are
sent.
.start_with?
.end_with?
&.
Config your timezone accordingly in application.rb
config.active_record.default_timezone = :local
it can be only :utc or :local
Don't use Time.parse
Time.zone.parse
Don't use Time.now
Time.zone.now
Put gems used only for development or testing in the appropriate group in the
Gemfile
Add all OS X specific gems to a darwin group in the Gemfile, and
all Linux specific gems to a linux group
Do not remove the Gemfile.lock from version control.
There’s a lot wrong with this: you could be using the wrong version of code that has exploits, has a bug in it, or worse it could have malware bundled in on purpose—you just don’t know.
Keep Base Images Small
Node.js for example, it includes an extra 600MB of libraries you don’t need.
Once you have a cluster running and you want to add/reconnect another node to it, you must supply an address of one of the cluster members in the cluster address URL
The new node only needs to connect to one of the existing members
It will automatically retrieve the cluster map and reconnect to the rest of the nodes
it's better to list all nodes of the cluster so that any node can join a cluster connecting to any other node, even if one or more are down
The wsrep_cluster_address parameter should be added in my.cnf of each node, listing all the nodes of the cluster,
the minimum recommended number of
nodes in a cluster is 3
While two of the members will
be engaged in state transfer, the remaining member(s) will be able to keep on
serving client requests.
Edge routerA router that enforces the firewall policy for your cluster.
Cluster networkA set of links, logical or physical, that facilitate communication within a cluster according to the Kubernetes networking model.
A Kubernetes ServiceA way to expose an application running on a set of Pods as a network service. that identifies a set of Pods using labelTags objects with identifying attributes that are meaningful and relevant to users. selectors.
Services are assumed to have virtual IPs only routable within the cluster network.
Ingress exposes HTTP and HTTPS routes from outside the cluster to
services within the cluster.
Traffic routing is controlled by rules defined on the Ingress resource.
An Ingress can be configured to give Services externally-reachable URLs, load balance traffic, terminate SSL / TLS, and offer name based virtual hosting.
Exposing services other than HTTP and HTTPS to the internet typically
uses a service of type Service.Type=NodePort or
Service.Type=LoadBalancer.
You must have an ingress controller to satisfy an Ingress. Only creating an Ingress resource has no effect.
As with all other Kubernetes resources, an Ingress needs apiVersion, kind, and metadata fields
Ingress frequently uses annotations to configure some options depending on the Ingress controller,
Ingress resource only supports rules
for directing HTTP traffic.
An optional host.
A list of paths
A backend is a combination of Service and port names
has an associated backend
Both the host and path must match the content of an incoming request before the
load balancer directs traffic to the referenced Service.
HTTP (and HTTPS) requests to the
Ingress that matches the host and path of the rule are sent to the listed backend.
A default backend is often configured in an Ingress controller to service any requests that do not
match a path in the spec.
An Ingress with no rules sends all traffic to a single default backend.
Ingress controllers and load balancers may take a minute or two to allocate an IP address.
A fanout configuration routes traffic from a single IP address to more than one Service,
based on the HTTP URI being requested.
nginx.ingress.kubernetes.io/rewrite-target: /
describe ingress
get ingress
Name-based virtual hosts support routing HTTP traffic to multiple host names at the same IP address.
route requests based on
the Host header.
an Ingress resource without any hosts defined in the rules, then any
web traffic to the IP address of your Ingress controller can be matched without a name based
virtual host being required.
secure an Ingress by specifying a SecretStores sensitive information, such as passwords, OAuth tokens, and ssh keys.
that contains a TLS private key and certificate.
Currently the Ingress only
supports a single TLS port, 443, and assumes TLS termination.
An Ingress controller is bootstrapped with some load balancing policy settings
that it applies to all Ingress, such as the load balancing algorithm, backend
weight scheme, and others.
persistent sessions, dynamic weights) are not yet exposed through the
Ingress. You can instead get these features through the load balancer used for
a Service.
review the controller
specific documentation to see how they handle health checks
edit ingress
After you save your changes, kubectl updates the resource in the API server, which tells the
Ingress controller to reconfigure the load balancer.
kubectl replace -f on a modified Ingress YAML file.
Node: A worker machine in Kubernetes, part of a cluster.
in most common Kubernetes deployments, nodes in the cluster are not part of the public internet.
Edge router: A router that enforces the firewall policy for your cluster.
a gateway managed by a cloud provider or a physical piece of hardware.
Cluster network: A set of links, logical or physical, that facilitate communication within a cluster according to the Kubernetes networking model.
Service: A Kubernetes Service that identifies a set of Pods using label selectors.
An Ingress may be configured to give Services externally-reachable URLs, load balance traffic, terminate SSL / TLS, and offer name-based virtual hosting.
An Ingress does not expose arbitrary ports or protocols.
You must have an Ingress controller to satisfy an Ingress. Only creating an Ingress resource has no effect.
The name of an Ingress object must be a valid
DNS subdomain name
The Ingress spec
has all the information needed to configure a load balancer or proxy server.
Ingress resource only supports rules
for directing HTTP(S) traffic.
An Ingress with no rules sends all traffic to a single default backend and .spec.defaultBackend
is the backend that should handle requests in that case.
If defaultBackend is not set, the handling of requests that do not match any of the rules will be up to the
ingress controller
A common
usage for a Resource backend is to ingress data to an object storage backend
with static assets.
Exact: Matches the URL path exactly and with case sensitivity.
Prefix: Matches based on a URL path prefix split by /. Matching is case
sensitive and done on a path element by element basis.
multiple paths within an Ingress will match a request. In those
cases precedence will be given first to the longest matching path.
Hosts can be precise matches (for example “foo.bar.com”) or a wildcard (for
example “*.foo.com”).
No match, wildcard only covers a single DNS label
Each Ingress should specify a class, a reference to an
IngressClass resource that contains additional configuration including the name
of the controller that should implement the class.
secure an Ingress by specifying a Secret
that contains a TLS private key and certificate.
The Ingress resource only
supports a single TLS port, 443, and assumes TLS termination at the ingress point
(traffic to the Service and its Pods is in plaintext).
TLS will not work on the default rule because the
certificates would have to be issued for all the possible sub-domains.
hosts in the tls section need to explicitly match the host in the rules
section.