Posts

JWT Auth in Kong

A JSON Web Token carries claims about an identity inside a signed token. Kong can verify its signature and time constraints before the request reaches the backend. This article separates the token structure, the cryptographic credential stored in Kong, and the Consumer representing the client. We then build a reproducible Kong Ingress Controller lab with an HS256-signed JWT and a /jwt route. This lab continues directly from Installing KIC. It reuses the kong Gateway, the echo Service, and the 192.168.121.200 address assigned by MetalLB to kong-gateway-proxy.

Sunday, July 26, 2026 | 7 minutes Read

13 - Verify the Minimum OpenStack Installation

On this post we perform an end-to-end verification from the controller node (controller01). First we check the network agents, then we create the internal network and subnet, configure a router, prepare the external network, check image and flavor, create an SSH keypair, launch an instance and validate connectivity (ICMP/SSH) using a floating IP. Example outputs are included to compare against your environment. Before starting, load your admin credentials if they are not already in the environment:

Sunday, November 23, 2025 | 6 minutes Read

OAuth 2.0 Token Introspection in Kong

Kong Enterprise includes an official OAuth 2.0 Introspection plugin, but it requires a license. In this lab, we will overcome that limitation by installing an open community or free-software plugin on Kong Gateway 3.10. In addition to the plugin, we will deploy Keycloak in Kubernetes. Keycloak will issue access tokens through client_credentials and expose the introspection endpoint defined by RFC 7662. Every response shown in this article comes from this real scenario.

Sunday, July 26, 2026 | 9 minutes Read

14 - Install Cinder (controller node)

This post details the steps we follow to install and configure Cinder, the OpenStack block storage service, on the controller node (controller01). We include the commands to create the database, configure services, endpoints and the Nova integration. Create the Cinder database Access MySQL and create the database and user: vagrant@controller01:~$ sudo mysql CREATE DATABASE cinder; GRANT ALL PRIVILEGES ON cinder.* TO 'cinder'@'localhost' IDENTIFIED BY 'CINDER_DB_PASS'; GRANT ALL PRIVILEGES ON cinder.* TO 'cinder'@'%' IDENTIFIED BY 'CINDER_DB_PASS'; EXIT; Create the Cinder user and assign the admin role Load the admin credentials and create the cinder user in the service project:

Sunday, November 23, 2025 | 3 minutes Read

OpenID Connect in Kong

Kong’s official OpenID Connect plugin requires an Enterprise license. In this lab, we use the open community or free-software cuongntr/kong-openid-connect-plugin adapter on top of lua-resty-openidc to complete an Authorization Code flow without a license. We will deploy a separate Keycloak instance in Kubernetes, log in with a real user, and verify both the callback and cookie reuse. Every response in this article comes from the lab VM. This lab continues from Installing KIC. It reuses the kong Gateway, the echo Service, KIC 3.5, and 192.168.121.200 as the kong-gateway-proxy address.

Sunday, July 26, 2026 | 5 minutes Read

15 - Install and configure Cinder on storage nodes

This post explains how to install and configure OpenStack’s volume service (Cinder) on a storage node using LVM. Note: run commands on the storage node (storage01) and use them as shown. Install required packages sudo apt install -y lvm2 thin-provisioning-tools Verify the /dev/vdb disk fdisk -l Make sure /dev/vdb appears and has no partitions before continuing. Create the LVM physical volume sudo pvcreate /dev/vdb Create the cinder-volumes volume group sudo vgcreate cinder-volumes /dev/vdb Edit /etc/lvm/lvm.conf Under the devices section, add or modify the filter line to prevent LVM from scanning unwanted disks:

Sunday, November 23, 2025 | 2 minutes Read

SAML in Kong through Keycloak

Kong’s official saml plugin requires an Enterprise license. After reviewing the open community and free-software alternatives, I could not find a direct, maintained SAML plugin compatible with Kong 3.x that would be responsible to recommend. This lab therefore uses a different, fully open architecture: Keycloak acts as the SAML Service Provider and identity broker, while Kong uses the open community or free-software kong-openid-connect plugin installed in the previous article. User authentication still performs a real SAML request and response. Keycloak validates the signed XML and returns an OpenID Connect Authorization Code to Kong.

Sunday, July 26, 2026 | 5 minutes Read

16 - Install and configure Horizon on the controller node

This post explains how to install and configure the Horizon web dashboard on the controller node (controller01). Install required packages sudo apt update sudo apt install -y openstack-dashboard Edit Horizon main configuration Edit /etc/openstack-dashboard/local_settings.py and ensure the following lines are set. Use sudo with vim or nano if preferred. sudo nano /etc/openstack-dashboard/local_settings.py Key entries: OPENSTACK_HOST = "controller01" SESSION_ENGINE = 'django.contrib.sessions.backends.cache' CACHES = { 'default': { 'BACKEND': 'django.core.cache.backends.memcached.PyMemcacheCache', 'LOCATION': 'controller01:11211', } } OPENSTACK_KEYSTONE_URL = "http://%s:5000/v3" % OPENSTACK_HOST OPENSTACK_KEYSTONE_MULTIDOMAIN_SUPPORT = True OPENSTACK_API_VERSIONS = { "identity": 3, "image": 2, "volume": 3, } OPENSTACK_KEYSTONE_DEFAULT_DOMAIN = "Default" OPENSTACK_KEYSTONE_DEFAULT_ROLE = "user" Note: change volume: 2 to volume: 3 because we use Cinder v3 endpoints. If you prefer v2, set OPENSTACK_API_VERSIONS['volume'] = 2.

Sunday, November 23, 2025 | 2 minutes Read

Session in Kong

The Session plugin lets an authenticated client reuse its identity through a cookie. It does not authenticate clients on its own and must work alongside another mechanism that validates the first request. This lab combines Session with Key Auth. The first request presents an API key, Kong creates a session, and later requests use only the cookie. We also configure an explicit anonymous branch to prevent requests without either credential from reaching the backend.

Sunday, July 26, 2026 | 7 minutes Read

17 - Installing OpenStack using kolla-ansible on virtual machines

Up to now we installed OpenStack manually, configuring each step one by one. Now we jump to automation with Ansible, which lets you run deployments with almost no human intervention. The idea is simple: define your settings in a few files and Ansible runs the whole process unattended. These files can be versioned in Git so you can repeat or tweak deployments later. Ansible simplifies OpenStack by concentrating most settings in a handful of files with sensible defaults, valid for both simple environments and more complex ones (multi-node, clustering, advanced networking, etc.).

Sunday, November 23, 2025 | 18 minutes Read

LDAP Auth in Kong

LDAP Authentication lets Kong validate a username and password directly against a corporate directory. The backend does not receive those credentials and does not need to implement LDAP. This article explains how the authentication header is built, how Kong locates the user in the directory, and how to protect /ldap-auth through Kong Ingress Controller. This lab continues from Installing KIC. It reuses the kong Gateway, the echo Service, and the 192.168.121.200 address assigned by MetalLB to kong-gateway-proxy.

Sunday, July 26, 2026 | 5 minutes Read

How to create and manage snapshots in KVM

Snapshots let you capture a VM’s state at a specific moment so you can roll back if something goes wrong (updates, risky changes, tests). In KVM with libvirt there are two main families: Internal snapshots: the snapshot content is stored inside the qcow2 file itself. They usually require the VM to be powered off and only work with qcow2 storage (not raw, LVM, etc.). External snapshots: they create separate overlay files (qcow2), these are the most used for hot snapshots (running VM). They allow more flexible flows and can be consolidated later (blockcommit). Additionally, a snapshot can be:

Friday, October 17, 2025 | 5 minutes Read