Co-founder of Palmera Health Sciences and Terpomo Software. I build tools for AI agents.
When kubectl throws "x509: certificate signed by unknown authority", the API server certificate does not validate against the CA in your kubeconfig.
For quick local testing you can temporarily skip verification. Do not use this in production.
clusters:
- name: my-cluster
cluster:
server: https://your-api-server:6443
insecure-skip-tls-verify: trueBetter fix: update certificate-authority-data or certificate-authority to match the cluster CA.
To keep an S3 bucket private behind CloudFront, use an Origin Access Identity (OAI) or Origin Access Control (OAC) and restrict the bucket policy.
Reference: Restrict access to S3 with CloudFront.
By default, Vim can move the cursor after you exit search mode. If you want the cursor to stay on the match, set the cpoptions flag.
set cpoptions+=xAdd it to ~/.vimrc to make it persistent.
Big Sur defaults to zsh, but you can switch shells with chsh as long as the shell is listed in /etc/shells.
cat /etc/shells
chsh -s /bin/bashLog out and back in for the change to take effect.
macOS ships /usr/libexec/java_home to manage multiple JDKs. Use it to switch JAVA_HOME cleanly.
/usr/libexec/java_home -V
export JAVA_HOME=$(/usr/libexec/java_home -v 1.8)
export PATH="$JAVA_HOME/bin:$PATH"Put the export lines in ~/.zshrc or ~/.bash_profile to persist.
Android 9+ blocks cleartext HTTP by default. In Ionic debug builds this often breaks local APIs.
Quick debug fix: allow cleartext traffic in the app manifest.
<application
android:usesCleartextTraffic="true"
...>
For production, prefer HTTPS or a network security config scoped to specific hosts.
WKWebView blocks file:// to http:// XHR which can lead to a blank screen in Ionic iOS apps.
Install the file XHR plugin and rebuild.
cordova plugin add cordova-plugin-wkwebview-file-xhr
ionic cordova prepare ios
ionic cordova run iosThis allows local file origins to reach http(s) resources during development.
On macOS, Git can still use credentials stored in the Keychain even if git config shows a different user. This leads to permission denied for the old user.
git credential-osxkeychain erase
host=github.com
protocol=https
Retry the operation and save the correct credentials.
macOS can read NTFS but not write. For external drives you can install an NTFS driver.
One option: Seagate NTFS Driver for Mac.
After install, replug the drive to enable write access.
Problem: on refresh, the AuthGuard runs before credentials are restored, so the app redirects to login even though a valid session exists.
Solution: move the credential bootstrap into an APP_INITIALIZER so it runs before routing.
// app.module.ts
providers: [
{
provide: APP_INITIALIZER,
useFactory: initAuth,
deps: [AuthService],
multi: true,
},
]Dispatch refresh logic inside initAuth so guards see the correct state.
To search inside .ear/.war/.jar files, treat them like zip archives.
zipgrep -R "MyClass" app.ear
jar tf app.war | grep -i "spring"For nested archives, extract first and repeat.
Importing an Angular module that declares routes merges those routes into the parent, which can lead to unexpected route matches.
Split the module into:
Import FeatureModule where you want the components without routes, and FeatureRoutingModule only in the feature's own module.
Behind a corporate proxy, minikube and kubectl need a local proxy like cntlm.
Enable gateway in cntlm and start the service:
# /etc/cntlm.conf
Gateway yesInstall kubectl and minikube:
curl -LO https://storage.googleapis.com/kubernetes-release/release/$(curl -s https://storage.googleapis.com/kubernetes-release/release/stable.txt)/bin/linux/amd64/kubectl
chmod +x ./kubectl
sudo mv ./kubectl /usr/local/bin/kubectl
curl -Lo minikube https://storage.googleapis.com/minikube/releases/latest/minikube-linux-amd64
chmod +x minikube
sudo mv minikube /usr/local/bin/minikubeStart minikube with proxy envs and resolv.conf override:
sudo minikube start --vm-driver=none --docker-env http_proxy=http://172.10.0.1:3128 --docker-env https_proxy=http://172.10.0.1:3128 --extra-config=kubelet.resolv-conf=/run/systemd/resolve/resolv.confOn subsequent runs, the shorter start command is usually enough.
Reference: Linux Network Administrator's Guide (PDF).
When a Cognito user is forced to reset a password, you must respond to NEW_PASSWORD_REQUIRED.
aws cognito-idp admin-initiate-auth --user-pool-id POOL_ID --client-id CLIENT_ID --auth-flow ADMIN_NO_SRP_AUTH --auth-parameters USERNAME=USERNAME,PASSWORD=TEMP_PASSWORDThen respond to the challenge using the session from the first call:
aws cognito-idp admin-respond-to-auth-challenge --user-pool-id POOL_ID --client-id CLIENT_ID --challenge-name NEW_PASSWORD_REQUIRED --challenge-responses file://auth.json --session "SESSION"{
"USERNAME": "USERNAME",
"NEW_PASSWORD": "NEW_PASSWORD",
"userAttributes.name": "FIRST_NAME",
"userAttributes.family_name": "LAST_NAME",
"userAttributes.email": "EMAIL"
}Using AWS SDK in Angular can trigger "Cannot find name 'Buffer'" because Node types are missing.
npm install --save-dev @types/node// tsconfig.app.json
{
"compilerOptions": {
"types": ["node"]
}
}Restart the TypeScript server after the change.
SonarQube project keys must be unique. If scans overwrite each other, set an explicit key.
sonar-scanner -Dsonar.projectKey=my_project_keyUse the same key across CI to keep history consistent.
Grab-bag of Ionic and Angular CLI maintenance and debugging notes.
npm outdated -g
npm cache clean --force
ionic cordova run android --device -l --debugCommon fixes:
Use KeePass URL Overrides to launch PuTTY with the selected entry.
URL Override: Scheme: putty
URL Override: cmd://C:\Program Files\PuTTY\putty.exe -ssh {USERNAME}@{BASE:HOST} -pw {PASSWORD}Set the entry URL to putty://host to trigger the override.
To connect JConsole to a local WebLogic instance, enable JMX and set the host and port.
# setDomainEnv.cmd
set JAVA_OPTIONS=%JAVA_OPTIONS% ^
-Djava.rmi.server.hostname=localhost ^
-Dcom.sun.management.jmxremote ^
-Dcom.sun.management.jmxremote.port=10313 ^
-Dcom.sun.management.jmxremote.ssl=false ^
-Dcom.sun.management.jmxremote.authenticate=falseFor verbose JConsole logging, launch with a logging config:
jconsole.exe -J-Djava.util.logging.config.file=C:\temp\jconsole_logging.propertieshandlers = java.util.logging.ConsoleHandler
.level = DEBUG
java.util.logging.ConsoleHandler.level = FINEST
java.util.logging.ConsoleHandler.formatter = java.util.logging.SimpleFormatter
javax.management.level = FINEST
javax.management.remote.level = FINERIf Git keeps reusing stored credentials, configure the credential helper to prompt or cache.
git config --global credential.helper cache
git config --global credential.https://github.com.username youruser
git clone https://github.com/youruser/repository.gitUse credential.helper osxkeychain or manager if you want native storage instead of cache.
To ensure an OIM EventHandler runs after all others, set its order to LAST in eventHandler.xml.
<event-handler ... order="LAST" />This can fix org changes not applying when handled too early.
When OAAM servers get into a bad state, a clean reinstall may require removing server entries and backing files.
rm -rf /u01/oracle/config/domains/IAMAccessDomain/servers/wls_oaam1.bkp
rm -rf /u01/oracle/config/domains/IAMAccessDomain/servers/wls_oaam_admin1.bkp
# edit init-info backups
/u01/oracle/config/domains/IAMAccessDomain/init-info/domain-info.xml.bkp
/u01/oracle/config/domains/IAMAccessDomain/init-info/config-groups.xml.bkpValidate the domain configuration before starting the servers again.
The Fusion Middleware Configuration Wizard can write a detailed log if you pass a log flag.
$MW_HOME/oracle_common/common/bin/config.sh -log=logfileUse this when troubleshooting domain creation or extension steps.
Quick WebLogic notes: version lookup and a common Hibernate Validator classloader issue.
Check version
locate registry.xml
# example: /u01/oracle/products/identity/registry.xml
java -cp weblogic.jar weblogic.versionHibernate Validator ClassCastException
If you see a ClassCastException around XMLStreamInputFactory during startup, add Woodstox to the domain lib.
cp woodstox-core-asl-4.2.0.jar $DOMAIN_HOME/libClass loading debug
-verbose:classOAM can bypass authorization checks if SSOOnlyMode is enabled. Disable it for policy-based authorization.
<Setting Name="SSOOnlyMode" Type="xsd:boolean">false</Setting>Restart OAM servers after the change.
Some legacy OIM and OAM installers require 32-bit compatibility libraries on 64-bit Linux. This is a messy workaround but it can unblock the installer.
rpm --force -ivh compat-libstdc++-33-3.2.3-61.i386.rpm
rpm --force --nodeps -ivh glibc-devel-2.5-123.i386.rpm
rpm --force --nodeps -ivh glibc-2.5-123.i686.rpm
rpm --force --nodeps -ivh glibc-common-2.5-123.i386.rpm
rpm --force --nodeps -ivh glibc-headers-2.5-123.i386.rpm
rpm --force --nodeps -ivh libaio-0.3.106-5.i386.rpm
rpm --force --nodeps -ivh libgcc-4.1.2-55.el5.i386.rpm
rpm --force --nodeps -ivh libstdc++-4.1.2-55.el5.i386.rpmA cleaner fix is to update refhost.xml to use i686 instead of i386:
cd $REPOS_HOME/installers
for FILE in $(find . -name refhost.xml | grep linux64); do
sed -i.bak 's/i386/i686/g' $FILE
doneUse at your own risk and only in isolated build environments.
Two small Linux shell reminders: redirect stderr and disable password expiration.
command arg1 arg2 2>/dev/null
chage -I -1 -m 0 -M 99999 -E -1 usernameIdentity management reference links collected during project work:
IE8 sometimes fails SSL handshakes with local WebLogic, resulting in ERROR_INTERNET_SECURITY_CHANNEL_ERROR.
In one case the fix was to trust the Fiddler root certificate:
After trusting the cert, the local site loaded.
JMX monitoring references:
Oracle Application Testing Suite quick start:
Java memory analysis tools and guides:
Linux command snippets for everyday admin work:
lsb_release -a
/usr/ucb/ps -aw
find . -name "*.ear" -printf "%f\n"
find . -name "*.ear" -exec cp {} ./ears \;Google App Engine and REST resources:
WebCenter Portal field notes, condensed and cleaned up.
Too many redirects when installing extensions
JDeveloper can keep using a proxy even after you uncheck it. Add * to the proxy exceptions to fully bypass it.
Deploying a portlet WAR into WebCenter Portal
Convert the WAR to a WSRP application using the predeploy tool, then deploy the resulting EAR to WebLogic.
java -jar C:\Oracle\Middleware2\jdeveloper\webcenter\modules\oracle.portlet.server_11.1.1\wsrp-predeploy.jar ch7_HelloWorldPortlet.war PortletEAR.earAfter deployment, open the application in the WebLogic console and copy the WSRP WSDL URL from the info page. Use that URL to create a WSRP connection in JDeveloper.
NoClassDefFoundError for JSTL
Add JSTL to the integrated WebLogic classpath in the start script:
set CLASSPATH=%CLASSPATH%;C:\Oracle\Middleware2\oracle_common\modules\jstl-1.2.jarREST and JavaScript references:
VirtualBox quick fixes:
usermod -a -G vboxsf oracleUse Machine > ACPI Shutdown to power off cleanly.
Gadget development resources:
When WebCenter Sites runs on a VM and you connect from a local Eclipse/CSDT install, CAS URLs can still point to localhost and break logins.
Update SSOConfig.xml to point to the VM IP:
<property name="casUrl" value="http://vm_ip:port/cas" />Typical location:
/home/oracle/Oracle/Middleware/user_projects/domains/csDomain/servers/CS_Server/stage/CS/CS/WEB-INF/classes/SSOConfig.xmlLarge collection of Oracle WebCenter resources: