To give a little context, this about research using Home assistant and Google Assistant integration without exposing the service to the internet, relying only on local fulfillment. I know the fulfillment URL defined in an action need to be publicly accessible and secure for the Google Assistant to transfer the intent. But in the case of a local fulfillment, and if we don't want any cloud fallback option, why couldn't we configure a local unsecure webhook ?
The workflow would be :
Send an action request via Google Assistant (from phone app) to the cloud
Google cloud send the action to the local connected google home equipment
That action is handled by a local fulfillment script run on the Google home device so that it can now send the intent on the local network using the local IP of the device (home assistant)
The local device can still communicate back to google cloud (device not exposed but still connected to the internet)
I still don't know why we don't have that option available. Maybe I don't understand the Google Assistant stack well, so I need some enlightenment.
Related
I am new to Cloud Foundry.
Is there any way that only specific users can view and update an app deployed in Cloud Foundry?
1.I deployed an app in Cloud Foundry using “cf push”command.
2.After entering “cf push “command I’ve got an message below.
Using manifest file /home/stevemar/node-hello-world/manifest.yml
enter Creating app node-hello-world-example...
name: node-hello-world-example
requested state: started
routes: {route-information}
last uploaded: Mon 14 Sep 13:46:54 UTC 2020
stack: cflinuxfs3
buildpacks: sdk-for-nodejs
type: web
instances: 1/1
memory usage: 256M
3.Using the {route-information} above,I can see the app deployed via browser entering below URL.
https://{route-information}
By this way ,anyone can see app from browser, but I don’t want that to be seen by everyone and limit access to specific user.
I heard that this global IP will be allocated to {route-information} by default.
Is there any way to limit access to only between specific users?
(For example,is there any function like “private registry” at Kubernetes in Cloud Foundry which is not open to public)
Since I am using Cloud Foundry in IBM Cloud it would be better if there is solution using IBM Cloud.
I’ve already granted cloud foundry role to the other user.
Thank you.
The CloudFoundry platform itself does not provide any access controls for applications. If you assign a public route to your application, where the DNS is publicly resolvable and the foundation is on the public Internet, like IBM Bluemix, then anyone can access your app.
There's a number of things you can do to limit access, but they do require some work on your part.
Use a private DNS. You can add any domain you want to Cloud Foundry, even ones that don't resolve. That means you could add my-cool-domain.local which does not resolve anywhere. You could then add a record to /etc/hosts for this domain or perhaps run DNS on your local network to resolve this DNS domain and direct traffic to the CloudFoundry.
With this setup, most people cannot access your application because the DNS domain for the route to your application does not resolve anywhere. It's important to understand that this isn't really security, but obscurity. It would stop most traffic from making it to your app, but if someone knew the domain, they could add their own /etc/hosts header or send fake Host headers to access your application.
This type of setup can work well if you have light security requirements like you just want to hide something while you work on it, or it can work well paired with other options below.
You can set up access controls in your application. Many application servers & frameworks can do things like restrict access by IP address or require user access (Basic auth is easy and it is OK, if you're only allowing HTTPS traffic to your app which you should always do anyway).
You can use OAuth2 to secure apps too. Again, many app servers & frameworks have support for this and make it relatively simple to secure your apps. If you don't have a corporate OAuth2 solution, there are public providers you can use. Exactly how you do OAuth2 in your app is beyond the scope of this question, but there's plenty of material out there on how to do this. Google information for your application language/framework of choice.
You could set up an access Gateway. This would be an application that's job is to proxy traffic to other applications on the foundation. The Gateway could be something like Nginx, Apache HTTPD, or Spring Cloud Gateway. The idea is that the gateway would be publicly accessible, and would almost certainly apply access controls/restrictions (see #2, many of these proxies have access control options that only take a few lines of config). Your actual applications would not be deployed publicly though. When you deploy your actual applications, they would only be on the internal Cloud Foundry domain.
CloudFoundry has local domains, often apps.internal (run cf domains to see if that shows up), which you can use to easily route traffic across the internal container-to-container network. Using this domain and the C2C network, you can have apps deployed to CF that are not accessible to the public Internet, except through your Gateway.
Again, how you configure this exactly is outside the scope of this question, but check out the docs I linked to for info on using the C2C network & internal routes. Then check out your proxy server of choice's documentation.
Cloud Run is providing a domain *.run.app to access the service deployed. I am wondering how Google Cloud Run handling requests from one to another Cloud Run service. Is all the service to service communication internal even we have a custom domain instead of *.run.app?
The definition of "internal" is not clear.
Your request stay in the Google Network. Is it internal or external?
To resolve the Custom Domain, a DNS resolution request (port 53) is performed on the public network, but the content of the request stays in the Google Network and forwarded after the resolution. Is it internal or external?
So, as long as you use Google Services (in premium network option), you don't go out of the Google Network and thus you can consider this as highly secured.
I assume, my answer isn't very clear, in fact all depend if you trust or not the Google Cloud network.
We want to use a shared Bluemix org which contains a number of demo apps. Is there a way of detecting, which apps haven't been used (e.g few http requests) in order to stop inactive apps?
These cloud foundry docs state the following:
The Router emits RTR logs when it routes HTTP requests to the app. Router messages include the app name followed by a Router timestamp and then selections from the HTTP request.
You should get an idea of how many requests your apps are receiving by looking for RTR log entries.
Manually, you could check the console logs using the cf logs .. command, or by visiting the log page in the Bluemix console.
You could automate the check using the cloud foundry tools or using the cloud foundry apis to parse the applications logs.
https://docs.cloudfoundry.org/devguide/deploy-apps/streaming-logs.html#rtr
I am trying to access a barebone MEAN stack application with Google's glcloud one click deployments. I have successfully been able to add the code for the MEAN app and can access (via ssh) and run/start app using grunt. Neither of the external links provided by gcloud is working: http://:3000 or http://
Any idea on how to access app for viewing/testing?
I figured it out by allowing the default MEAN JS port 3000 on the firewall rules in the Google Developer Console. Networking > Firewall rules. You must also allow http port for incoming traffic.
I have an organization using google email app. They just switched hosts for their website and now the email is disabled because google doesn't have the right configurations for the new host of the web. How do I deliver the correct info to google to get the email enabled again?
It is probably due to changes in DNS rather switching web hosting provider. You should read the guide to setting up DNS for google mail.