![Sachin Shukla](/img/default-banner.jpg)
- 50
- 99 294
Sachin Shukla
เข้าร่วมเมื่อ 12 ก.ย. 2013
Hands on Kafka Cluster in KRaft mode setup in AWS
This automates bringing up 3 node Kafka Cluster set up in AWS in KRaft mode.
Terraform: github.com/sks336/terraform-kafka/tree/main
Terraform: github.com/sks336/terraform-kafka/tree/main
มุมมอง: 123
วีดีโอ
AWS S3 presigned URLs - Demo
มุมมอง 381ปีที่แล้ว
This short tutorial explains how the presigned urls are generated and various use cases where this can be useful. This also talks about when the permissions for presigned urls are taken away.
MTLS - Mutual TLS (Everything you need to know)
มุมมอง 30Kปีที่แล้ว
MTLS Part-I: medium.com/@skshukla.0336/mtls-everything-you-need-to-know-e03804b30804 MTLS Part - II (API Gateway) medium.com/@skshukla.0336/mtls-aws-api-gateway-part-ii-15d338385c65 Github: github.com/skshukla/tlsdemo.git
CloudFront - Restrict Viewer Policy, with API Gateway and Lambda
มุมมอง 373ปีที่แล้ว
Use Cloud Front Restrict View Policy to privately allow content to be accessible. Use API Gateway and Lambda to authorise and grant permissions. Some Commands used in Demo for reference: Generate Private Key: openssl genrsa -out rsa.private 2048 Generate Public Key: openssl rsa -in rsa.private -out rsa.public -pubout -outform PEM Sign Request: aws cloudfront sign url [CloudFrontURL].cloudfront....
Shared Services VPCs Architecture and Demo
มุมมอง 965ปีที่แล้ว
- What is Shared Services VPC and how to Design/Architect it. - Enabling Internet and inter VPC connectivity using TGW. - Implementing Interface End points to inject ENIs and access services securely. - Create Private Hosted Zones (PHZ) and associate VPCs for Accessing services as Hub and Spoke model. GitHub: github.com/skshukla/aws-infra/tree/master/016_vpc_tgw Useful Article on Shared Service...
VPC Architecture - Centralized Outbound Routing To Internet
มุมมอง 1.3Kปีที่แล้ว
AWS Document: docs.aws.amazon.com/vpc/latest/tgw/transit-gateway-nat-igw.html AWS Transit Gateway (more info) th-cam.com/video/fmLUDgy-x7A/w-d-xo.html th-cam.com/video/Gc3uwLVbqW4/w-d-xo.html Git: github.com/skshukla/aws-infra/tree/master/016_vpc_tgw
Inter Region VPC connectivity using Transit Gateways
มุมมอง 728ปีที่แล้ว
Inter Region VPC connectivity using Transit Gateways. Connect multiple VPCs within and inter region using Transit Gateways. aws.amazon.com/about-aws/whats-new/2019/12/aws-transit-gateway-supports-inter-region-peering/ Github: github.com/skshukla/aws-infra/tree/master/02_tgw_demo AWS Transit Gateway Demo th-cam.com/video/fmLUDgy-x7A/w-d-xo.html
Design and Deploy Components to Cloud using BrainBoard
มุมมอง 292ปีที่แล้ว
You can use the Brain Board UI to design how the architecture should look in cloud after deployment. As the components are designed the respective terraform scripts are auto generated. Once done, simply deploy to cloud using the scripts or UI. This would ensure the design is consistent with the architecture being deployed. Visit the git repo for the reference for the designed used in this tutor...
Configuring Kafka for SSL with design and steps
มุมมอง 2.8Kปีที่แล้ว
It explains the step by step process to setup SSL in Kafka. The Docker Compose file and the shell script used in this tutorial are available at below links github.com/skshukla/infra/blob/dev/run_kafka/docker-compose-ssl.yaml github.com/skshukla/infra/blob/dev/run_kafka/run_kafka-ssl.sh
Understanding X-Forwarded-For header in ALB
มุมมอง 6Kปีที่แล้ว
Understanding X-Forwarded-For header in ALB. This header helps to retain the original Client IP address while accessing via Load Balancer.
Interface End point with PrivateDNS
มุมมอง 297ปีที่แล้ว
How seamlessly connect from an EC2 instance, which is having no Internet connectivity, to any public AWS service like SQS without the need of changing any end point url. Interface Endpoint Concept: th-cam.com/video/RYpxj1oZCwI/w-d-xo.html Command to see messages in SQS: aws sqs receive-message queue-url sqs.ap-southeast-1.amazonaws.com/839006695980/myqueue attribute-names All message-attribute-...
AWS Elastic Container Service (ECS) with ALB and dynamic port mapping
มุมมอง 2.1K2 ปีที่แล้ว
Architecure to create a fault tolerant scalable service to deploy containers by using Amazon ECS. With dynamic port mapping option same types of multiple containers can be deployed in single EC2.
AWS - Publish S3 events to SQS
มุมมอง 1.5K2 ปีที่แล้ว
Use Push Notification from S3 to publish events directly to SQS queue.
Build Serverless Architecutre using Lambda Function
มุมมอง 1712 ปีที่แล้ว
This demo shows how lambda can be easily integrated with various other components and build a server-less architecture.
CloudFront with ALB as Custom Origin with SSL
มุมมอง 7K2 ปีที่แล้ว
CloudFront with ALB as Custom Origin with SSL
AWS Interface EndPoint, Securely Accessing AWS Services
มุมมอง 2192 ปีที่แล้ว
AWS Interface EndPoint, Securely Accessing AWS Services
AWS Application Load Balancer (ALB) Demo
มุมมอง 2032 ปีที่แล้ว
AWS Application Load Balancer (ALB) Demo
Kafka Streams (Suppress Intermediate Events and publish the final result)
มุมมอง 3322 ปีที่แล้ว
Kafka Streams (Suppress Intermediate Events and publish the final result)
Vault Dynamic secrets - AWS Secret Engine
มุมมอง 7232 ปีที่แล้ว
Vault Dynamic secrets - AWS Secret Engine
Kafka Stream KeyStore Expose As Web Endpoint
มุมมอง 633 ปีที่แล้ว
Kafka Stream KeyStore Expose As Web Endpoint
Kafka Stream application with multiple instances for Load Sharing
มุมมอง 6673 ปีที่แล้ว
Kafka Stream application with multiple instances for Load Sharing
Kafka Streaming Util to push CSV file data into kafka topics.
มุมมอง 3.1K3 ปีที่แล้ว
Kafka Streaming Util to push CSV file data into kafka topics.
🎉❤❤ very good just make in hindi
thank you!! 🙏 But i need to reach more audience and so in English
the majority of your audience is Hindi-speaking, so your focus should be on user retention. Once someone watches your video, they should feel compelled to subscribe and watch all your content. Even Dhruv Rathee creates videos in Hindi; if he had made them in English, he might not have reached such a large audience. However, the decision is entirely yours. I really like your videos and hope they reach a wider audience.
Thanks for honest feedback, I will consider.. Its just that there is no appreciation except some likes and some subscribers.. may be if i have more audience one day, i will try to cater these requests.. 🙏🙏
Thanks, so logically, we can't have public subnet in vpc 2 and 3 if we would like to have all traffic come through transit gateway.
How can I do this in Kraft mode
Dear Why I connect by command, curl -sSX GET <minikube ip>:<nginx-service port>/ip, but received: failed, after 21013 ms: Couldn't connect to server. Regard
Hi, Which tool you are using to executr this MTLS?
Hi Sachin, do you have an email, i would like to contact you
brother help is required ..please response if possible
One of best explanation I found so far :) , Loved it. Keep up good work
Root cert was Lil confusing.else it gave me a fair idea
Well explained 👏👏🙌
@06:50 can you explain what is the -cacert you are passing in curl command, is that the client ca cert? if so why we are sending client ca cert to server?
yes this is helpful @sachine
Short and to the point, excellent !!
hmm, your VPC is not private at all, you have a public IPv4 isn't it
One small correction, our browser or any networking tools like curl, wont validate to CA directly , every browser and networking tool while installing will have a default public key of many CA's eg: symantec, digicert public key stored in some location on our host, using that it will decrypt the server certificate sign if public key in certificate and decrypted sign matches then it is legitimate. To view CA public key in linux go to /etc/ssl/certs
Very nice.
Hello Sachin, I appreciate the thorough explanation. I have a question: If AWS VPC1 and AWS VPC2 are in separate accounts, how can we add both VPCs to the hosted zone to utilize a common VPC Interface endpoint created in VPC1?
Why you skip the curl command part?
As your peer, I would say your technical presentation has great coverage and depth, you should get much more exposure and “likes” in TH-cam, if you could zoom in those architecture diagrams and CIDR legend, making them easier to follow.
thanks for the help
Is this ads on video or video on ads
@sachinshukla6047 github link ?
very nice video. thank you @sachin
Very nice explanation. Great job
Lol man u haven't implemented any intermediate events, u still need an input to stream to release hold last event...
Hi Sachin. Thank you for this interesting video. Could you explain me why we need to uncheck the private dns integration during the VPC endpoint creation? Can we have a PHZ automatically integrate with the shared VPC and associate it to spoke VPC? Or manually create PHZ zone for the endpoint service, register the VPC end point dns as alias record and associate it with the spoke VPC while keeping the integrated private dns on the shared service VPC? Thanks
Hello sachin - how do contact you.. I have some professional need
sks336@gmail.com you can email
Thank you, @Sachin, for such great content. It is really helping me a lot! Now, for any ADHD viewer here, like me, just go get your coffee, take your time and come back to focus: i can assure you that it's not your whatsapp notification poping. Just (try to) ignore it and enjoy the lesson.
i mean is it same when i integrate several certificatesfiel which are included in cert chain into one cert file as ca.crt,then i used the client.crt which is not changed and integrated atalld to auth?i just failed in traefik environment.
but when i set up mtls in traefik,the cert returns the server.crt,but my leader told me cert chain containing several cert files including server.crt and ca.crt is normal but not single cert as server.crt
The way you did it, aren't you exposing your ALB to the world? In your diagram, you are considering the ALB as private (which would be accessed only by Cloudfront). Did I miss something? Thanks for the tutorial, anyway.
Very bad audio 🔉🔉
Good One. Explained well.
Thank you 🙏
dude.. loved it. great stuff
Hi sachin, it looks like a CP central
I am sorry but what is CP central?
One trap I fell in for modern browsers, they don't really care about CN field anymore, rather they need it to be listed in the SAN (Subject Alternative Name) field
have you by any chance done a build of this where the go is deployed inside a docker container.... ie to be deployed on a K8s cluster....
Thanks for the video mate, very useful!
One thing I am still confused about. If we use our client public certificate to send to the server and the server simply checks the trust store to make sure it's a trusted client - how does the server know that some other unauthorised/malicious client isn't using our public certificate and pretend to be us? it is a public cert after all Or are we saying this certificate is not truly public and should be treated like a private key? _______________ OR - do we say that no symmetrical key is generated, and instead both parties use the received public key to encrypt data (ensuring that the recipient can only read if they hold the private key)?) My idea would be server would encrypt some data using the public key, send to client and client must send back correct result to verify client holds the private key, THEN and only THEN can a symmetric key be used - but this is not explained anywhere. Please help (::
tks from Brazil!
Hello Sachin - It is a great article! Thanks for explaining the concepts in detail. By the way, is the process of setting up the SSL same if I want to host kafka in openshift container? Thanks!
Hi Sachin, Can you also share your sql scripts? How did you setup the Debezium for Postgres?
@Sachin - Could you please respond and share a link to code?
Hi could you give us link github repo?
Can you explain how to generate a cliente certificate? I’m not sure what to place on the CN field since it’s a server. I would like to talk more in detail to you.
I just realized many other tutorials have missed/skipped step 6 in the pictures. The step to validate the cert with the CA. Thanks for clearing that up. 🎉
Thanks for the video. Just to clarify on step # 6, client doesnt contact CA for validation directly over the network. It is client's browser which contains the CA certificate (Root CA & Issuing CA of the server certificate) in the browser trust store, this is where the validation chaining is computed and trusted.
My application is running in AWS ECS, the path to connect to my app externally is as follows: AWS route53 => Load Balancer => AWS ECS (my app runs here) Do you know if I could still perform mTLS in my app running in ECS? I think that the only way would be to introduce an AWS API Gateway. What do you think? By the way, I love this video, it is the best for this topic.
Sachin, thank you for taking the time to create the content. I have a question - when you said you are deploying your Container hosts in "Private Subnet" what do you mean? Have you used NAT GW?
Wat about farget
Thanks for the video. This part with the graphic was very useful for understanding