just sal's blog

2022-11-30

my blog and the random stuff i work out of interest and on behalf of customers….or just things i didn’t know before and want to share.

recent articles:

November, 30, 2022: Propagating SSO SAML Attributes to IAP Protected application
November 21, 2022: Restricting GCP API calls with X-Goog-Allowed-Resources header using Envoy and Squid
November 16, 2022: Building go applications using Google Cloud Build private go modules in Google Artifact Registry
October 25, 2022: Proxyless gRPC with Google Traffic Director
October 22, 2022: Container Signing with Cosign and TPM PKCS-11
October 20, 2022: Envoy External Processing filter for decoding Google gRPC PubSub Messages
October 20, 2022: Envoy Dynamic Forward Proxy configuration with Downstream SNI for Google APIs and httpbin
October 19, 2022: Using docker SDK to launch a container from a container
October 19, 2022: Decoding gRPC Messages using Envoy
October 10, 2022: mTLS using GCP KMS Keys
September 26, 2022: Deterministic container hashes and container signing using Cosign, Bazel and Google Cloud Build
September 13, 2022: Security Token Service (STS) Credentials for HTTP and gRPC (rfc8693)
August 26, 2022: Using Google Cloud Workforce Identity Federation with SAML
August 12, 2022: KMS, TPM and HSM based Azure Certificate Credentials
August 12, 2022: golang-jwt using arbitrary crypto.Signer
August 11, 2022: Federate Google Cloud OIDC tokens for AWS Access Tokens
August 11, 2022: Federate Google Cloud OIDC tokens for Azure Access Tokens
July 08, 2022: BigQuery Write API using protobuf
June 26, 2022: Bring your own Key for BigQuery SQL column-level encryption
June 10, 2022: AEAD Encryption with BQ Remote Functions
June 08, 2022: Basic Math with BigQuery Remote Functions using Homomorphic Encryption
June 08, 2022: Managing and Restricting Google API KEYS programmatically
June 06, 2022: Creating and using gRPC HealthCheck encoded wireformat with curl
May 27, 2022: gRPC Unary requests the hard way: using protorefelect, dynamicpb and wire-encoding to send messages
May 24, 2022: Envoy GCP Authentication Filter with Application Layer Transport Security (ALTS)
May 19, 2022: Authorization Control using OpenPolicy Agent and Google Groups
May 16, 2022: Search Transitive Group Membership using Google Cloud Identity
May 12, 2022: GCP Service Account Last usage auditing using Golang
May 12, 2022: Realtime GCP assets monitoring using Cloud Asset Monitor and Cloud Log Streaming
May 12, 2022: GCP Service Account Last usage auditing using Go
May 01, 2022: Distributed HTTP Proxy on Google Cloud using Terraform
April 29, 2022 Google Workspace as Identity Provider for your SAML Application
April 26, 2022 GCP Workload Identity Federation using SAML
April 24, 2022 Issuing Service Account Self-Signed JWTs on AppEngine, GCE, Cloud Run and Cloud Functions
April 20, 2022 Exempting Application Default Credentials for Google MFA Reauth
April 11, 2022 Hashicorp Vault default Identity Provider for Google Workload Identity Federation
April 01, 2022 Concentric IAMCredentials Permissions: The secret life of signBlob
March 30, 2022 GCP Cloud Status Dashboard Public Dataset
March 21, 2022 Browser WebAssembly with Google Storage golang client library
March 21, 2022 Browser WebAssembly with golang http client
March 20, 2022 Decoding WireGuard with WireShark
March 18, 2022 Limiting file-size and Content using GCS SignedURL v4
March 17, 2022 Extend GCP ServiceAccount access_token upto 12 hours
March 14, 2022 Using stickfigures to show how Google Credentials work
March 13, 2022 Google Cloud Storage client-side Stream encryption with gsutil and TINK
March 11, 2022 BlobZapper: Deleting 1M files on GCS in
March 09, 2022 Using Google Cloud IAM Deny
February 28, 2022 BigQuery Remote Functions in Go
February 21, 2022 Federating Firebase to Google Cloud APIs

See the Catalog for a list of all articles.

the stuff here isn’t supported by google, caveat emptor; the views here are my own