DEV Community: Dilanka Rathnasiri

🔐 OTP CLI Utils — A Simple and Powerful CLI tool for TOTP Codes

Dilanka Rathnasiri — Sat, 25 Oct 2025 12:29:50 +0000

Hello everyone 👋

I recently built a new Python CLI tool called OTP CLI Utils — a lightweight command-line utility to generate, validate, and manage Time-based One-Time Password (TOTP) codes. If you use Google Authenticator or work with 2FA systems, this tool can make your developer workflow a lot smoother.

🔗 GitHub: https://github.com/dilanka-rathnasiri/otp-cli-utils
🔗 PyPI: https://pypi.org/project/otp-cli-utils

🚀 What It Does

OTP CLI Utils provides a simple interface to handle everything related to TOTP (used in 2FA systems). You can:

🔑 Generate current OTP codes from a secret
✅ Validate OTP codes against a secret
🔄 Generate secure random OTP secrets
📱 Create Google Authenticator compatible QR codes
🧰 All from your command line, no web tools or GUIs needed

⚙️ Installation

You can install it easily from PyPI:

pip install otp-cli-utils

💡 Usage Examples

🔹 Generate the Current OTP Code

otp-cli-utils get-otp <secret>

Example:

otp-cli-utils get-otp ABCDEF1234567890

🔹 Validate an OTP

Check if an OTP code is valid for a given secret.

otp-cli-utils validate <secret> <otp> [--window-count <count> | --time-period <seconds>]

Examples:

otp-cli-utils validate ABCDEF1234567890 123456
otp-cli-utils validate ABCDEF1234567890 123456 --window-count 2
otp-cli-utils validate ABCDEF1234567890 123456 --time-period 120

🔹 Generate a New OTP Secret

otp-cli-utils generate-secret

🔹 Create a QR Code for Google Authenticator

Easily generate a QR code image to scan directly with authenticator apps.

otp-cli-utils generate-secret-qr-code "user@example.com" "GitHub" github_2fa

🤝 Contribute

Contributions, ideas, and feedback are welcome!
Check out the project on GitHub and feel free to open an issue or PR.

🧾 License

Released under the MIT License — completely open source.

🏗️ Simple K8s — A Minimal Kubernetes Stack for Learning

Dilanka Rathnasiri — Fri, 08 Aug 2025 11:52:51 +0000

I wanted a lightweight, reproducible way to explore how modern cloud-native tools work together — without a full complex setup. So, I built Simple K8s — a local minimal Kubernetes stack.

🔗 GitHub Repo: github.com/dilanka-rathnasiri/simple-k8s

🛠️ Stack Overview

Tool	Purpose
Minikube	Local Kubernetes cluster
Helm	Kubernetes package manager
Envoy Gateway	Kubernetes native API Gateway
Knative Serving	Serverless platform with scale-to-zero support
Headlamp	User-friendly Kubernetes dashboard

💡 Why I Built This

I wanted a setup that:

Runs locally on my machine
Quickly set up and clean up
Uses real-world tools
Let me experiment freely without worrying about costs

🎯 What It is For

Learning Kubernetes Gateway API with Envoy Gateway
Understanding Kubernetes native serverless deployments via Knative
Playing with a modern Kubernetes dashboard (Headlamp)
Experimenting with HTTP routing between multiple services
Running sample apps in a safe, local environment

🚀 How to Use It

🏁 Quick Start

git clone https://github.com/dilanka-rathnasiri/simple-k8s.git
cd simple-k8s
sh setup.sh

🧹 Clean Up

sh clean-up.sh

I Built My Personal Portfolio with Angular and Hosted It on GitHub Pages

Dilanka Rathnasiri — Sat, 28 Jun 2025 14:26:19 +0000

Hello devs! 👋

I'm excited to share that I've built and launched my personal portfolio — a simple, modern web app to showcase my projects, skills, and background as a backend engineer.

🔗 Web url: https://dilanka-rathnasiri.github.io/portfolio/

Why I Built It

I wanted a clean and professional place to highlight my experience, work, and technical skills. Angular felt like the right choice due to its:

Modular architecture
Strong tooling ecosystem
Great documentation and community

🛠️ Tech Stack

Framework: Angular
Styling: SCSS + Bootstrap
Hosting: GitHub Pages

The project is fully open-source and available on GitHub:

💻 https://github.com/dilanka-rathnasiri/portfolio

🚀 Just published my first Python package on PyPI: py-sse-client

Dilanka Rathnasiri — Sat, 12 Apr 2025 14:16:30 +0000

Hey devs! 👋

I'm thrilled to announce the release of my first PyPI package: py-sse-client!

🔗 Links
→ GitHub: https://github.com/dilanka-rathnasiri/py-sse-client
→ PyPI: https://pypi.org/project/py-sse-client

📦 What is py-sse-client?
It's a lightweight asynchronous Server-Sent Events (SSE) client for Python that helps you connect to real-time SSE streams in a clean and Pythonic way.

🚀 Why I built it
I've worked with SSE in some of my backend projects and always wanted a minimalist and reliable client that just works. So I decided to build one, and finally took the step to publish it on PyPI. Also, I believe this will be a good starting point for my open source development.

🛤️ "This is one small step — but it’s a significant milestone in my software development journey."

It feels great to give back to the community, and I plan to keep improving this package and work on more open-source tools.

Check it out and feel free to contribute or drop feedback!

Kubernetes ReplicaSet

Dilanka Rathnasiri — Sun, 17 Nov 2024 15:32:01 +0000

cover image: Photo by frank mckenna on Unsplash

In this article, we'll talk about Kubernetes ReplicaSet. Being familiar with the earlier articles in this series is helpful for a better understanding.

What Is a ReplicaSet?

A ReplicaSet is a Kubernetes object that ensures a specified number of pods of a given template are running at any given time
It guarantees the availability of a specified number of identical pods
Most of the time, we don't directly manage ReplicaSets
Instead, we use Deployments for managing ReplicaSet

Creating a ReplicaSet With a Manifest File

To understand how ReplicaSets work, let’s start with the manifest file
Here’s an example of a ReplicaSet manifest file:

apiVersion: apps/v1
kind: ReplicaSet
metadata:
  name: my-replicaset
spec:
  replicas: 3
  selector:
    matchLabels:
      app: my-app
  template:
    metadata:
      labels:
        app: my-app
    spec:
      containers:
        - name: my-container
          image: nginx
          ports:
            - containerPort: 80

Then we can create this ReplicaSet using kubectl with one of the following commands

kubectl create -f my-replicaset.yaml

kubectl apply -f my-replicaset.yaml

The above manifest file creates ReplicaSet my-replicaset

Key Fields in the ReplicaSet Manifest File

.spec.replicas:
- Number of pods managed by the ReplicaSet
- In the above ReplicaSet, we have 3 pods
- If we don't specify a value, then the default value is 1
.spec.template:
- The pod template used to create the ReplicaSet’s pods
.spec.template.metadata.labels:
- labels of the pods created from the pod template
- These labels must match .spec.selector.matchLabels labels
- In the above ReplicaSet, the labels of the pods are app: my-app
.spec.selector.matchLabels:
- Replicaset identifies the pods required to be managed by the ReplicaSet from these labels
- ReplicaSet will manage pods with matching labels (even if not created by the ReplicaSet)
- e.g., if 2 pods with the label app: my-app already exist, the ReplicaSet will create only 1 more pod but manage all 3 pods
- ReplicaSets can also use advanced label selectors like matchExpressions instead of matchLabels

How a ReplicaSet Links to Its Pods

A ReplicaSet links to its pods via the metadata.ownerReferences field in the pod's metadata.
Field metadata.ownerReferences specifies the owner of the object
This field specifies the ReplicaSet my-replicaset as the owner
Here's an example output YAML of a pod managed by my-replicaset

apiVersion: v1
kind: Pod
metadata:
  generateName: my-replicaset-
  labels:
    app: my-app
  name: my-replicaset-dxzzg
  namespace: default
  ownerReferences:
    - apiVersion: apps/v1
      blockOwnerDeletion: true
      controller: true
      kind: ReplicaSet
      name: my-replicaset
      uid: a93e48a6-9ec6-46e6-b92f-c61ccd9a2d40
  resourceVersion: "472"
  uid: 6cf20e31-a73a-4846-ad8d-a4b41e7711ac
spec:
  containers:
    - image: nginx
      imagePullPolicy: Always
      name: my-container
      ports:
        - containerPort: 80
          protocol: TCP

Deleting a ReplicaSet

We can delete the above ReplicaSet using kubectl with one of the following commands

kubectl delete -f my-replicaset.yaml

kubectl delete rs my-replicaset

Replicaset vs. Replication Controller

ReplicaSet is the next generation of Replication Controller
Kubernetes documentation recommends using ReplicaSets instead of Replications Controllers

Summary

In this article, we discussed the Kubernetes ReplicaSet. We looked at what ReplicaSet is, how it works, and how to create and delete a ReplicaSet.

References

Kubernetes Pods

Dilanka Rathnasiri — Sun, 03 Nov 2024 14:15:02 +0000

cover image: Photo by Nilantha Ilangamuwa on Unsplash

In this article, we’ll talk about Kubernetes pods. We'll discuss what they are, how they work, and why they’re essential in the Kubernetes ecosystem.

What are Kubernetes Objects?

Kubernetes Objects are the foundational entities of Kubernetes
We can consider Kubernetes objects as the building blocks of the Kubernetes
Each Kubernetes object has its own specific attributes and responsibilities
There are many types of Kubernetes objects
The following are some of them
- Pods
- Deployments
- Services

What is a Pod?

In Kubernetes, pods are the smallest deployable units of computing
Kubernetes pod is one type of the Kubernetes objects
A pod can contain one container or a group of tightly coupled containers
So, Pods can be considered as abstractions that encapsulate one or more containers
In most use cases, we use pods that contain a single container
Pods are ephemeral and disposable

Creating a Pod with a Manifest File

Here’s an example of a basic pod manifest file:

apiVersion: v1
kind: Pod
metadata:
  name: nginx
spec:
  containers:
  - name: nginx
    image: nginx:latest
    ports:
    - containerPort: 80

Then we can create this pod using kubectl with one of the following commands

kubectl create -f nginx.yaml

kubectl apply -f nginx.yaml

The above manifest file creates a pod with a single nginx container
In many use cases, we don't directly create and manipulate pods
Instead, we’ll use workload resources like Deployments or ReplicaSets to manage pods at scale

We can delete above pod using kubectl with one of the following commands

kubectl delete -f nginx.yaml

kubectl delete pod nginx

Multi-container pods

Containers that are tightly coupled and required to work together can be encapsulated into a single pod
These containers are automatically co-located and co-scheduled in the same physical or virtual machine
So, this allows them to
- communicate and coordinate with each other
- share resources and dependencies

Example Multi-Container Pod Manifest:

apiVersion: v1
kind: Pod
metadata:
  name: nginx
spec:
  containers:
  - name: nginx
    image: nginx:latest
    ports:
    - containerPort: 80
  - name: redis
    image: redis:latest
    ports:
    - containerPort: 6379

The above pod has two containers; nginx container and redis container
There are several types of multi-container pods
The following are 3 types used commonly
- Sidecar Containers
- Ambassador Containers
- Adapter Containers

Sidecar Containers

Sidecar containers are the secondary containers that run along with the main application container within the same Pod
They provide additional services or functionalities such as logging, monitoring, etc.
In most cases, we don't directly manage sidecar containers
Instead, Helm charts manage sidecar containers

Init Container

Init container is a container that runs before the main application containers of the pod
They’re used for tasks required to be completed once before the application container startup
Init containers are also regular containers
But unlike regular containers,
- Init containers always run to completion
- Init containers run only at the pod startup
A pod can have multiple init containers and they execute sequentially
Init containers are specified within the initContainers section of the manifest file
Init containers run sequentially in the order of initContainers section of the manifest file
Only one init container runs at a time
If an init container fails, it'll be restarted until it succeeds
However, we can control the restart behavior by using restartPolicy of the pod
If an init container fails, the whole pod will fail
Example Kubernetes Manifest with Init Containers:

apiVersion: v1
kind: Pod
metadata:
  name: myapp-pod
  labels:
    app.kubernetes.io/name: MyApp
spec:
  containers:
    - name: myapp-container
      image: busybox:1.28
      command: ['sh', '-c', 'echo The app is running! && sleep 3600']
  initContainers:
    - name: init-myservice
      image: busybox:1.28
      command: ['sh', '-c', "until nslookup myservice.$(cat /var/run/secrets/kubernetes.io/serviceaccount/namespace).svc.cluster.local; do echo waiting for myservice; sleep 2; done"]
    - name: init-mydb
      image: busybox:1.28
      command: ['sh', '-c', "until nslookup mydb.$(cat /var/run/secrets/kubernetes.io/serviceaccount/namespace).svc.cluster.local; do echo waiting for mydb; sleep 2; done"]

In the above example init-myservice and init-mydb are init containers
Containers of the above manifest run in the following order,
1. init-myservice init container starts first and runs to completion
2. After successfully completing init-myservice init container, init-mydb init container starts and runs to the completion
3. After successfully completing init-mydb init container, myapp-container container starts

Summary

In this article, we covered the basics of Kubernetes pods. We looked at what pods are, how they can encapsulate one or more containers, and the different types of containers that can run within a pod, including sidecar and init containers.

References

Kubernetes Cluster Architecture

Dilanka Rathnasiri — Sun, 06 Oct 2024 15:00:54 +0000

cover image: Photo by Manuel Nägeli on Unsplash

Kubernetes is the most popular container orchestration platform. It's open-source, production-ready, and extensible. Kubernetes has emerged as the de facto standard for container orchestration, empowering organizations to scale and manage containerized applications effortlessly. Its open-source nature, coupled with its robust ecosystem, makes it a go-to platform for automating deployment, scaling, and operations in the cloud-native world. In this article, we will talk about the architecture of Kubernetes. Understanding the architecture and components of Kubernetes will be a good starting point for the Kubernetes journey.

Kubernetes Cluster Architecture

Figure 1: Basic Kubernetes cluster architecture; Image from Kubernetes docs

Figure 1 shows the architecture of a basic Kubernetes cluster. More components can be added to the cluster depending on the use cases.

There are 2 main parts in the Kubernetes cluster.

Control plane
Worker nodes

Control plane

Control plane controls the cluster. It acts as the brain of the cluster. It makes decisions about the cluster. Also, It detects and responds to cluster events.

Components of the control plane:

kube-apiserver
etcd
kube-scheduler
kube-controller-manager
cloud-controller-manager

Worker nodes

Worker nodes do the actual workload of applications. They act as the muscles of the cluster. There will be one or more worker nodes.

Components of the worker node:

kubelet
kube-proxy
Container runtime

Each worker node consists of the above node components.

What is a pod?

Understanding the pods will be more helpful for talking about Kubernetes cluster architecture.

In Kubernetes, pods are the smallest deployable units of computing. A pod can be one container or a group of containers.

Control plane components

kube-apiserver

Kube-apiserver exposes Kubernetes APIs (Application Programming Interface) for interacting with the Kubernetes cluster. It acts as the front-end of the control plane. Also, kube-apiserver can be scaled horizontally.

We can access Kubernetes APIs via:

REST API calls
CLI tools such as kubectl, kubeadm

etcd

Etcd is a key value store for all cluster data. It is an etcd data store. So, It is highly available, reliable, and distributed.

Data stored in the etcd:

Cluster configuration data
Information about Kubernetes objects' states

kube-scheduler

Kube-scheduler maintains the health of the cluster. It watches the pods. Also, it schedules pods to an appropriate node. Various factors are considered when scheduling. The following are some of them:

individual and collective resource requirements
hardware/software/policy constraints
affinity and anti-affinity specifications

kube-controller-manager

Kube-controller-manager consists of multiple controllers. These controllers make the decisions about the cluster and maintain the cluster. Logically, each controller can be considered as a separate process. To reduce the complexity, all the controller processes are compiled into a single binary and run as a single process. The following are some of them:

Node Controller: Noticing and responding when nodes go down
Job Controller: Watches the job objects and executes them
EndpointSlice Controller: Populate EndpointSlice objects
ServiceAccount Controller: Create default ServiceAccounts for new namespaces

We actually don't need to know in-depth about these controllers to use a Kubernetes cluster. However, in-depth knowledge will be valuable for Kubernetes administrators.

cloud-controller-manager

Cloud-controller-manager contains cloud service provider's (e.g., AWS, GCP, etc.) specific controller logics. It links the cluster with the cloud provider's APIs.

Similar to the kube-controller-manager, cloud-controller-manager consists of multiple control logics compiled into a single binary and run as a single process.

If the Kubernetes cluster is on-premise or in a learning environment (e.g., Minikube, kind, etc.), there's no cloud-controller-manager.

Worker nodes components

Container Runtime

Container runtime empowers Kubernetes to run containers effectively. It manages the execution and lifecycle of containers.

Kubernetes supports container runtimes that are any implementation of Kubernetes CRI (Container Runtime Interface). The following are some of the Container runtimes:

kubelet

Kubelet is an application that communicates with the control plane. It acts as an agent of the control plane. It executes the decisions made by the control plane. It takes a set of PodSpecs and ensures that the containers described in the PodSpecs are running and healthy.

kube-proxy

Kube-proxy is a network proxy for facilitating Kubernetes networking services. It handles communication inside or outside the cluster.

If there is a network plugin that has similar functionalities to the kube-proxy, kube-proxy won't be necessary.

Production Kubernetes Cluster

Creating a production Kubernetes cluster from scratch is tedious. Also, I don't recommend it at all.

We can use a deployment tool to create a production Kubernetes cluster. The following are some of the deployment tools:

kubeadm
kops

The easiest way to have a production-grade Kubernetes cluster is by using a managed Kubernetes service. The following are some of the managed Kubernetes services:

My thoughts

Since I use AWS as my day-to-day cloud provider, I personally have used EKS only. Honestly, my experience with EKS is awful. Although AWS EKS is a managed service, I'm encountering many issues with it. Also, managing AWS EKS cluster with IaC (Infrastructure as Code) such as Terraform or Pulumi is very challenging. The only reason I use EKS is that my current organization's whole system is in AWS.

[!IMPORTANT]
If you're planning to use AWS EKS, I highly recommend using eksctl.

But keep in mind as of 6th October 2024, eksctl doesn't have a stable major release yet. Its latest version is still 0.191.0.

I recommend reading this medium article for having a comparison of managed Kubernetes services.

In my opinion, for a simple production system, Kubernetes is unnecessary. But for a complex large-distributed system, Kubernetes is the best solution.

Summary

In this article, we explored the architecture of Kubernetes. Understanding the architecture and components of Kubernetes will be valuable for a solid foundation of Kubernetes. Also, I encourage you to get hands-on experience with Kubernetes. MiniKube will be a good starting point for that.

References

Deploying Kubernetes dashboard on a Kubernetes cluster

Dilanka Rathnasiri — Sat, 10 Aug 2024 08:19:46 +0000

cover image: Photo by Joseph Barrientos on Unsplash

In this article, we will talk about deploying Kubernetes dashboard on a Kubernetes cluster. Kubernetes dashboard is the official web user interface for getting an overview of a Kubernetes cluster. It can be used for managing, monitoring, and troubleshooting a Kubernetes cluster. Kubernetes dashboard is one of the easiest ways to have a dashboard for Kubernetes cluster managing and monitoring.

Install Kubernetes dashboard

Kubernetes dashboard can be easily installed with Helm. Execute the following commands in a terminal for installation.

# Add kubernetes-dashboard repository
helm repo add kubernetes-dashboard https://kubernetes.github.io/dashboard/
# Deploy a Helm Release named "kubernetes-dashboard" using the kubernetes-dashboard chart
helm upgrade --install kubernetes-dashboard kubernetes-dashboard/kubernetes-dashboard --create-namespace --namespace kubernetes-dashboard

We'll get a reply similar to the following.

Reply-A:

Release "kubernetes-dashboard" does not exist. Installing it now.
NAME: kubernetes-dashboard
LAST DEPLOYED: Fri Aug  9 20:35:55 2024
NAMESPACE: kubernetes-dashboard
STATUS: deployed
REVISION: 1
TEST SUITE: None
NOTES:
*************************************************************************************************
*** PLEASE BE PATIENT: Kubernetes Dashboard may need a few minutes to get up and become ready ***
*************************************************************************************************

Congratulations! You have just installed Kubernetes Dashboard in your cluster.

To access Dashboard run:
  kubectl -n kubernetes-dashboard port-forward svc/kubernetes-dashboard-kong-proxy 8443:443

NOTE: In case port-forward command does not work, make sure that kong service name is correct.
      Check the services in Kubernetes Dashboard namespace using:
        kubectl -n kubernetes-dashboard get svc

Dashboard will be available at:
  https://localhost:8443 # ‼ Note down this url for accessing the dashboard

Create a user for accessing kubernetes dashboard

We need a user to access the Kubernetes dashboard. We can regulate access control with Role-based access control (RBAC). Reference [3] provides a detailed explanation of RBAC.

Service Account:
A service account provides a distinct identity in a Kubernetes cluster. We can consider a service account to be similar to a user. But a Service account and a user account are two different things. Reference [4] provides a detailed explanation of the service account. We can use the following YAML configuration for creating a service account for the Kubernetes dashboard.

apiVersion: v1
kind: ServiceAccount
metadata:
  name: admin-user
  namespace: kubernetes-dashboard

Cluster Role:
A cluster role is a set of rules that provides specific permissions. We only discuss four predefined roles for simplicity.

They are,

cluster-admin:

Provides superuser access to do anything on any resource.

admin:

Provides permissions to do most of the actions on most of the resources.
It doesn't give the permission for the following,
- write access to the resource quota or to the namespace itself
- write access to EndpointSlices (or Endpoints)

edit:

Provides permission to read and write access for most of the resources
It doesn't give the permission for the following,
- viewing or modifying roles or role bindings
- permissions aren't provided by the admin cluster role

view:

Provides read-only access for most of the resources
It doesn't give the permission for the following,
- viewing roles or role bindings
- viewing Secrets
- permissions aren't provided by the edit cluster role

Since great power comes with great responsibility, it is good to use minimum permission as much as possible.

In this example Kubernetes configuration, we use the predefined admin cluster role.

Cluster Role Binding:
Cluster role binding attaches a cluster role to a service account. We can use the following YAML configuration for creating a cluster role binding for the created user.

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: admin-user
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin
subjects:
- kind: ServiceAccount
  name: admin-user
  namespace: kubernetes-dashboard

Generating token for accessing Kubernetes dashboard

We can generate an access token using the following.

kubectl -n kubernetes-dashboard create token admin-user

Accessing kubernetes dashboard

There are two ways of accessing the Kubernetes dashboard.

1.kubectl port-forward (I prefer this way)

execute the following command in the terminal,

kubectl -n kubernetes-dashboard port-forward svc/kubernetes-dashboard-kong-proxy 8443:443

Now we can access Kubernetes dashboard from https://localhost:8443 (URL in Reply-A)
We use HTTPS for accessing because the URL in Reply-A is a https request
If the URL in Reply-A is an HTTP request, we have to access the Kubernetes dashboard with HTTP
Since we'll get a short URL in this method, I prefer this method.

2.kubectl proxy

execute the following command in the terminal,

kubectl proxy --port=8001

Now we can access the kubernetes dashboard from http://localhost:8001/api/v1/namespaces/kubernetes-dashboard/services/https:kubernetes-dashboard-kong-proxy:443/proxy/

Create a long-lived Bearer Token for accessing the Kubernetes dashboard

We can create a token and save it as a secret with the following YAML configuration.

apiVersion: v1
kind: Secret
metadata:
  name: admin-user
  namespace: kubernetes-dashboard
  annotations:
    kubernetes.io/service-account.name: "admin-user"
type: kubernetes.io/service-account-token

Then we can get the created token by executing the following command on the terminal.

kubectl get secret admin-user -n kubernetes-dashboard -o jsonpath={".data.token"} | base64 -d

That's it! We’ve successfully deployed the Kubernetes dashboard on our cluster.

Pulumi Infrastructure as Code for Kubernetes dashboard deployment (Optional)

simple-k8s

This GitHub project is an example of Infrastructure as Code with Pulumi for Kubernetes dashboard deployment. Since this article doesn't focus on Infrastructure as Code, we'll not discuss the code here. But I think this will help to get a rough idea.

Summary

In this article, we’ve discussed deploying the Kubernetes dashboard on a Kubernetes cluster. The Kubernetes dashboard is one of the easiest ways to get an overview of a Kubernetes cluster. Hands-on experience with the Kubernetes dashboard is valuable in learning Kubernetes. Also, it'll be a good jumpstart. Even though the Kubernetes dashboard provides an overview of the cluster to some extent, I think it'll not be enough for an advanced production Kubernetes cluster.

References

Introduction to Authentication and Authorization

Dilanka Rathnasiri — Fri, 05 Apr 2024 12:50:52 +0000

cover image: Photo by Erik Mclean on Unsplash

We will talk about the basics of authentication and authorization in this blog. I hope to write a blog series on IAM (Identity and Access Management). Understanding authentication and authorization is essential for IAM. So, this is the first article of my IAM blog series.

1. What is Authentication?

Authentication is the process of verifying the identity of someone or something. Simply authentication means proving identity.

Let's consider traveling from Sri Lanka to Germany by airplane. We use passports to prove our identity at the airport before leaving Sri Lanka and after arriving in Germany. This process of proving the identity using a passport is an example of authentication.

2. Authorization

Authorization is the process of verifying permission of someone or something to take some action. Simply that means checking whether someone can access a resource or not.

Let's go to our airplane traveling example again. Even though we have a passport, we cannot leave or enter a country. We should have legal permission to leave or enter the country. As an example, some countries have banned the passports of certain nations. So, those passport holders cannot enter the country. Our permission for leaving or entering a country is checked at the airport. This process of verifying having legal permissions is an example of authorization.

3. Authentication vs Authorization

Many people have a confusion about authentication and authorization. Even though authentication and authorization are related to each other in many use cases, they are different terms with different meanings.

Authentication	Authorization
Verifying the identity of the user	Checking whether the user has permission to access a resource
Password, PIN, biometrics, and authentication apps are a few ways for authentication	Access policy and security settings are a few ways for authorization
Usually done before authorization	Usually done after authentication
OpenID Connect can be used for authentication	OAuth 2.0 can be used for authorization
Usually, transmit information through ID tokens	Usually, transmit information through Access token

Summary

We talked about the basics of authentication and authorization in this blog. These basics will help to understand the next blogs of this IAM blog series.

Reference

Delivering images in AWS S3 bucket through AWS API gateway

Dilanka Rathnasiri — Sat, 16 Mar 2024 11:57:54 +0000

cover image: Photo by Francesco Ungaro on Unsplash

In this article, we will talk about creating an AWS REST API as an AWS S3 proxy and delivering images in an S3 bucket through the API gateway.

What are the different ways to deliver images in the s3 bucket?

Deliver images using public S3 URLs
Deliver images in S3 using AWS Lambda API Gateway Integration
Creating an AWS REST API as an S3 proxy

Why deliver images in the S3 bucket through the API gateway?

The simplest way to deliver images in the S3 bucket is public S3 URLs. However, the major drawback of this approach is that the S3 bucket will be public. Public cloud resources are vulnerable to attacks, and avoiding public cloud resources is a good practice.

AWS API gateway will be a public interface for most endpoints. Many security methods can be used with AWS API gateway such as IAM, request throttling, and many more.

AWS Lambda can be integrated into the AWS API gateway. Images in an S3 bucket can be delivered using a Lambda. But then we have to develop and maintain an additional Lambda function. Also, there will be an extra cost for it.

When we use AWS API Gateway REST API as an S3 proxy, we can use security features in the AWS API gateway and we do not want to maintain an additional Lambda function. Also, we can keep our S3 bucket as a private resource.

Use AWS API Gateway REST API as an S3 proxy

I explain the method using an example scenario. Also, I write this article with multiple steps for better understanding. Names and AWS regions can be changed according to the requirements. I use the new version of the AWS console (as of March 2024) in this article.

Table of content

Create an IAM role for allowing API gateway to access S3 bucket objects
Create an S3 bucket and upload an image
Create an AWS API Gateway REST API
Create REST resource
Create REST method
Configure method request
Configure integration request
Configure integration response
Configure Method response
Enable binary support in API Gateway

1. Create an IAM role for allowing API gateway to access S3 bucket objects

Log into the AWS console
Navigate to IAM → Roles
Click on the Create role button
Select Custom trust policy as the trusted entity type
Enter the following policy as the custom trust policy

       {
           "Version": "2012-10-17",
           "Statement": [
               {
                   "Sid": "",
                   "Effect": "Allow",
                   "Principal": {
                       "Service": "apigateway.amazonaws.com"
                   },
                   "Action": "sts:AssumeRole"
               }
           ]
       }

Click on the Next button
Search for AmazonS3ReadOnlyAccess and select it
Then Click on the Next button
Enter a role name as iam-test-role
Then click on the Create role button

2. Create an S3 bucket and upload an image

Log into the AWS console
Navigate to S3
Click on the Create bucket button
Select us-east-1 as the region
Enter api-gw-image-test-s3 as the bucket name
Leave default values for other configurations
Click on the Create bucket button
Create a folder named images
Upload an image into the created folder

3. Create an AWS API Gateway REST API

Log into your AWS console
Navigate to API Gateway → APIs
Click on the Create API button
Click on the Build button on Rest API pane
Select New API and use test-api as the name
Leave default values for other configurations
Then click on the Create API button

4. Create REST resource

Click on the Create resource button
Create a resource and create REST resource s3

5. Create REST method

Click on the Create method button to create a method
Choose as following
- Method type → GET
- Integration type → AWS service
- AWS Region → us-east-1
- AWS service → Simple Storage Service (S3)
- HTTP method → GET
- Action type → Use path override
- Path override → api-gw-image-test-s3/images/{image}
- Execution role → arn of the created aws role in the step (1)
Leave the other options as default
Click on the Create method button

6. Configure method request

Select Method request tab pane
Click on Edit button
Expand URL query string parameters
Click on Add query string button
Enter image as the Name
Check Required button
Click on Save button

7. Configure integration request

Select Integration request tab pane
Click on Edit button
Select When there are no templates defined (recommended) as Request body passthrough
Expand URL path parameters
Click on Add path parameter button
Enter image as the name
Enter method.request.querystring.image as the path
Expand URL request headers parameters
Click on Add query string parameter button
Enter Accept as Name
Enter '*/*' (Value should be given with single quotes) as Mapped from
Click on Save button

8. Configure integration response

Select Integration responses tab pane
Delete Default - Response
Click on Create response
Enter 2\d{2} as HTTP status regex
Click on Create button

9. Configure Method response

Select Method responses tab pane
Click on Edit button on Response 200
Click on Add header button
Enter Content-Type as Header name
Remove Response body items
Click on Save button
Then again select Integration responses tab pane
Click on Edit button
Enter '*/*' (Value should be given with single quotes) as Mapping value of the Content-Type response header
Click on Save button

10. Enable binary support in API Gateway

Navigate to API settings
Click on Manage media type button on Binary media types
Click on Add binary media type button
Enter */* as Binary media type
Click on Save changes

Finally,

Click on Deploy API and do an API Gateway deployment
Enter the invoked URI on the browser with the image query string (e.g.: https://aabhd7xr1z.execute-api.us-east-1.amazonaws.com/test/s3?image=porsche-911.jpg)
Ultimately, the Image is displayed in the browser

Summary

In this article, we have discussed creating an AWS REST API as an Amazon S3 proxy and delivering images in an S3 bucket through the API gateway. We can use AWS API Gateway as a secure and cost-effective way to deliver S3 images.

References

Introduction to Java Servlets

Dilanka Rathnasiri — Fri, 15 Mar 2024 15:05:33 +0000

cover image: Photo by Evan Smogor on Unsplash

We are discussing the basics of Java Servlets in this article.

What is Java Servlet?

Java servlet is the Java way to develop a web application that can generate dynamic web pages. Servlets are on the server side.

What is the web container?

The web container is the interface between the servlets and the web server. All the servlets are run inside the web container. In this article, I use Apache Tomcat as the web container. Also, you can use Java EE servers like JBoss or GlassFish for running Java servlets. But Apache Tomcat is lightweight and easy to use.

Let’s build our first Java Servlet

Technologies used in this article

Java 11
Apache Maven 3.6.3
Apache Tomcat 10.1.7
IntelliJ IDEA Community Edition

Do we need IntelliJ Idea Ultimate?

No, we do not need it.

Create Maven project

Let’s generate a Maven project in batch mode. For that, enter the following command on the command line.

mvn archetype:generate -B -DgroupId="com.example" -DartifactId="servlet-example-1"

We can change “groupId” and “artifactId” as we want. In this example project

groupId = com.example
artifactId = servlet-example-1

Project structure

We need to set up the project structure as followings.

Modify POM file

First, we open the project from IntelliJ IDEA.

<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
  xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">

  <modelVersion>4.0.0</modelVersion>
  <groupId>com.example</groupId>
  <artifactId>servlet-example-1</artifactId>
  <packaging>war</packaging>
  <version>1.0-SNAPSHOT</version>
  <name>servlet-example-1</name>

  <properties>
    <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
    <maven.compiler.source>11</maven.compiler.source>
    <maven.compiler.target>11</maven.compiler.target>
  </properties>

  <dependencies>
    <dependency>
      <groupId>jakarta.servlet</groupId>
      <artifactId>jakarta.servlet-api</artifactId>
      <version>6.0.0</version>
      <scope>provided</scope>
    </dependency>
  </dependencies>

  <build>
    <plugins>
      <plugin>
        <groupId>org.apache.maven.plugins</groupId>
        <artifactId>maven-war-plugin</artifactId>
        <version>3.3.2</version>
        <configuration>
          <webappDirectory>src/main/webapp</webappDirectory>
          <webXml>src/main/webapp/WEB-INF/web.xml</webXml>
        </configuration>
      </plugin>
    </plugins>
  </build>
</project>

The POM file of the example project is shown above. Let’s discuss each required component in the POM file.

1 → We use war (web application archive) files in java servlets. Therefore, we have to set the packaging to WAR.

2 → We set the encoding system of Apache Maven to UTF-8. This is not related to the Java servlets. This is done for Apache Maven.

3 and 4 → We set the Java version to 11.

5 → Adding required “servlet-api” dependency for Java servlet. Since Apache Tomcat has all the required libraries, we set the scope to “provided”.

6 → We need “maven-war-plugin” for creating a Java WAR file.

7 → Web app directory path from the content root.

8 → web.xml file path from the content root.

Servlet App.java class source code

package com.example;

import jakarta.servlet.ServletException;
import jakarta.servlet.http.HttpServlet;
import jakarta.servlet.http.HttpServletRequest;
import jakarta.servlet.http.HttpServletResponse;

import java.io.IOException;
import java.io.PrintWriter;

public class App extends HttpServlet {
    @Override
    protected void doGet(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
        PrintWriter out = resp.getWriter();
        out.println("Hello!");
        out.close();
    }
}

“HttpServlet” class provides methods for handling REST API methods such as GET, POST, PUT, and POST.

“doGet” method → Java method for handling GET requests
“doPost” method → Java method for handling POST requests
“doPut” method → Java method for handling PUT requests
“doDelete” method → Java method for handling DELETE requests

In this example project, we only used the “doGet” method. It provides a “Hello!” response for GET requests.

What is web.xml?

The web.xml file is the deployment descriptor of the project. This deployment descriptor contains information about the servlet. The deployment descriptor tells the web container how to handle the files in the servlet project.

Content of the deployment descriptor

<!DOCTYPE web-app PUBLIC
        "-//Sun Microsystems, Inc.//DTD Web Application 2.3//EN"
        "http://java.sun.com/dtd/web-app_2_3.dtd" >

<web-app>
    <servlet>
        <servlet-name>hello</servlet-name>
        <servlet-class>com.example.App</servlet-class>
    </servlet>
    <servlet-mapping>
        <servlet-name>hello</servlet-name>
        <url-pattern>/hello</url-pattern>
    </servlet-mapping>
</web-app>

The web descriptor of the example project is shown above.

All the servlet related tags have to use inside the "" and “” tags.
The “” tag is used to define the name of the servlet. “” and “” tags are used inside the "" and “” tags. The “” tag is used to provide the name of the servlet. The “” tag is used to provide the Java class for the relevant servlet.
The “” tag is used to define the mapping of the servlet. “” and “” tags are used inside the “" and “” tags. The “” tag is used to provide the name of the servlet. The “” tag is used to provide the URL pattern of the relevant servlet.

Deploying servlet

First, we have to build the WAR file. We can do that by executing the following command in the terminal or PowerShell.

mvn clean install

This WAR file can be deployed in Apache Tomcat. First, we have to start the Apache Tomcat. Then let’s go to the “Manager App”. In the “deploy” section, let’s click on the “Choose File” button in the “WAR file to deploy” subsection. Then let’s choose the WAR file and click on the “Deploy” button. Then, we can see the “/servlet-example-2–1.0-SNAPSHOT” in the “Application” section. Now, we can call the servlet by sending requests to “http://localhost:8080/servlet-example-2-1.0-SNAPSHOT/hello”.

Servlet Annotations

We can replace the web.xml file with annotations.

We can use “@WebServlet” annotation for “” and “” tags in web.xml. We can use the “value” attribute to define the URL pattern of the servlet. We can use the “name” attribute to define the name of the servlet.

We can rewrite App.java class with annotations as followings.

package com.example;

import jakarta.servlet.ServletException;
import jakarta.servlet.annotation.WebServlet;
import jakarta.servlet.http.HttpServlet;
import jakarta.servlet.http.HttpServletRequest;
import jakarta.servlet.http.HttpServletResponse;

import java.io.IOException;
import java.io.PrintWriter;

@WebServlet(
        value = "/hello",
        name = "hello"
)
public class App extends HttpServlet {
    @Override
    protected void doGet(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
        PrintWriter out = resp.getWriter();
        out.println("Hello!");
        out.close();
    }
}

Also, we need to change the POM file to stop searching for the web.xml file. For that, we have to change the configurations of the “maven-war-plugin” in the POM file as followings.

<plugin>

  <groupId>org.apache.maven.plugins</groupId>

  <artifactId>maven-war-plugin</artifactId>

  <version>3.3.2</version>

  <configuration>

    <failOnMissingWebXml>false</failOnMissingWebXml>

  </configuration>

</plugin>

Summary

In this article, we have discussed the basics of Java Servlets with an example. We can create a Java servlet with a web.xml file or annotations. We can use Apache Tomcat for deploying Java servlet.

References

Java Tutorial Network
Introduction to Java Servlets - GeeksforGeeks
The Web Container (Your First Cup: An Introduction to the Java EE Platform)
What is a web container?

Java Method overriding

Dilanka Rathnasiri — Fri, 15 Mar 2024 14:51:24 +0000

cover image: Photo by Erik Witsoe on Unsplash

We are discussing Java Method overriding in this article with examples.

What is Java Method Overriding?

There is a child class. Let’s take it as class A. Its parent class is B. All methods in B are inherited from B to A. A has a method c. It has the same signature (method name and parameter types) as a method in B. Method c in A has its own implementation specific to A. This is called method overriding.

Why do we need Java Method Overriding?

When we want specific implementation for a function in the child class
Achieve Runtime Polymorphism in Java
When we want to have customized implementation of java native methods

Run Time Polymorphism

In Run Time Polymorphism, Java Virtual Machine determines which methods to call at the run time. A child class has its own specific implementation for a method that already exists in the parent class.

Example 1

First, we see a simple example of how to do Java Method overriding.

public class Car {
    public void running() {
        System.out.println("Car is running");
    }
}

public class Benz extends Car{
}

public class BMW extends Car{
    @Override
    public void running() {
        System.out.println("BMW car is running");
    }
}

public class Example1 {
    public static void main( String[] args ) {
        Car car1 = new Benz();
        Car car2 = new BMW();

        car1.running();
        car2.running();
    }
}

Output:

Car is running
BMW car is running

In this example, we have overridden running method in BMW class.

Example 2

Also, we can use Java method overriding for customizing the implementation of java native methods.

Let’s see how we implement a simple case-insensitive Java HashMap.

public class Student {
    private String name;
    private int grade;

    public Student(String name, int grade) {
        this.name = name;
        this.grade = grade;
    }

    public String getName() {
        return name;
    }

    public int getGrade() {
        return grade;
    }
}

import java.util.HashMap;
import java.util.Map;

public class Example2 {
    public static void main(String[] args) {
        Student student1 = new Student("Kamal", 10);
        Student student2 = new Student("Nimal", 7);

        Map<String, Student> studentOverrideMap = new HashMap<>() {
            @Override
            public Student put(String key, Student value) {
                return super.put(key.toLowerCase(), value);
            }

            @Override
            public Student get(Object key) {
                return super.get(key.toString().toLowerCase());
            }

            @Override
            public boolean containsKey(Object key) {
                return super.containsKey(key.toString().toLowerCase());
            }
        };

        studentOverrideMap.put("Kamal", student1);
        studentOverrideMap.put("Nimal", student2);

        System.out.println("Student1 name:" + studentOverrideMap.get("KAMAL").getName() + " grade:" + studentOverrideMap.get("KAMAL").getGrade());
        System.out.println("Student2 name:" + studentOverrideMap.get("NIMAL").getName() + " grade:" + studentOverrideMap.get("NIMAL").getGrade());
        System.out.println("KAMAL is in map: " + studentOverrideMap.containsKey("KAMAL"));
    }
}

Output:

Student1 name:Kamal grade:10
Student2 name:Nimal grade:7
KAMAL is in map: true

In this example, we have overridden put, get, and containsKey methods in Java HashMap. In put method, we have converted the HashMap key to lowercase before we add an element to the HashMap. In get method, we have converted the HashMap key to lowercase before getting the object. In containsKey method, we have converted the HashMap key to lowercase before searching for the key.

The situations when we cannot use Java Method Overriding

We cannot use Java Method Overriding for static methods
We cannot use Java Method Overriding for final methods

Summary

A child class has its own specific implementation for a method that already exists in the parent class. This is called Java Method Overriding. We can use Java Method Overriding for having a specific implementation for a function in the child class, achieving Runtime Polymorphism in Java, and having a customized implementation of java native methods. We cannot use Java Method Overriding for final or static methods.

Thank you for reading!