How does the free egress policy in IDrive® e2 work?
The free egress policy in IDrive® e2 is designed to ensure that users can store, download, and access data at a reasonable rate without burdening our service. Here are the guidelines used to determine a good fit use case for e2’s egress policy.
Good fit - If the monthly egress (download) is less than or equal to thrice the storage volume.
Example: If you store 100 TB with IDrive® e2 and download 300 TB or less within a monthly billing cycle, then your storage use case is a good fit for our policy.
Note:
If your use case exceeds the guidelines of our free egress policy, we reserve the right to charge $0.01/GB/Month. In the case of free accounts, your account will be suspended.
Up to 10 Gbps connection speed available for egress.
从图中的 Apple Api Push 域名的证书链中,能发现 Apple IST CA2 - G1 证书由 GeoTrust Global CA 交叉签名出来的 CA,而 GeoTrust Global CA 属于 Symantec,Symantec 在 2018 年由于不规范签发证书,被 Google 以及 Mozilla 等在 2018 年就决定被不信任。
和浏览器不一样,主流 OS 仅维护一个ca-certificates包,并没有什么证书白名单等处理,因此当 Debian 移除了部分 CA 后,程序访问相关证书的网站会直接报错。
由于 Apple 也在慢慢淘汰 Symantec 系列的 CA,因此,本质上问题还是 Apple Push 不应该使用 GeoTrust ROOT CA 包括其交叉签名出的 ROOT CA 所签发出的证书,而既然 Apple 已经这(dian)么(da)做(qi)了(ke),当然选择兼容他啦(如同主流浏览器白名单)!
解决方案
最佳实践当然是和 Mozilla 一样,做个证书白名单,但是稍微麻烦点。Symantec 随便不被信任了,但是也不至于乱签发证书以及挺多厂商可能也没来得及换,所以直接重新信任GeoTrust Global CA也是可以的。
# Official image for Hashicorp's Terraform. It uses light image which is Alpine # based as it is much lighter. # # Entrypoint is also needed as image by default set `terraform` binary as an # entrypoint. image: name: registry.gitlab.com/gitlab-org/gitlab-build-images:terraform entrypoint: - "/usr/bin/env" - "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
# Default output file for Terraform plan variables: PLAN: plan.tfplan JSON_PLAN_FILE: tfplan.json ARGS: -var-file=/etc/terraform/prod.tfvars
# Separate apply job for manual launching Terraform as it can be destructive # action. apply: stage: deploy environment: name: production script: - terraform apply -input=false $PLAN tags: - ops - terraform dependencies: - plan when: manual only: - master
缺陷
Terraform 目前还不支持 CRD,虽然官方 Blog有提到在 alpha 测试,但是距离 GA 还有一段时间吧~