IngussNeilands

0002a8365afe4ada8663a73e4a09a244
76561198113225245

IngussNeilands

---
apiVersion: extensions/v1beta1
kind: DaemonSet
metadata:
  namespace: kube-system
  name: node-custom-setup
  labels:
    k8s-app: node-custom-setup
  annotations:
    command: &cmd apt-get update -qy && apt-get install -qy tgt ceph-fs-common ceph-common xfsprogs

IngussNeilands

#!/bin/sh
# Launch a Pod ab-using a hostPath mount to land on a Kubernetes node cluster as root
# without requiring `privileged: true`, in particular can abuse `DenyExecOnPrivileged`
# admission controller.
# Pod command in turn runs a privileged container using node's /var/run/docker.sock.
#
# Tweaked for PKS nodes, which run their docker stuff from different
# /var/vcap/... paths
node=${1}
case "${node}" in

IngussNeilands

# set Digital Ocean token with:
# export TF_VAR_do_token="..."
variable "do_token" {}

# set health check port
variable "hc_port" {
  default = 8000
}

# Initialize provider

IngussNeilands

# Get IAM Role name from Instance Profile Id
curl http://169.254.169.254/latest/meta-data/iam/info

# Get credentials
curl http://169.254.169.254/latest/meta-data/iam/security-credentials/<role-name>

# More info
http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-metadata.html

IngussNeilands

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "NonResourceBasedReadOnlyPermissions",
            "Action": [
              "ec2:DescribeSubnets",
              "ec2:DescribeSnapshots",
              "ec2:DescribeImages",
              "ec2:DescribeVolumes",

IngussNeilands

{
    "Statement": [
        {
            "Sid": "PackerSecurityGroupAccess",
            "Action": [
                "ec2:CreateSecurityGroup",
                "ec2:DeleteSecurityGroup",
                "ec2:DescribeSecurityGroups",
                "ec2:AuthorizeSecurityGroupIngress",
                "ec2:RevokeSecurityGroupIngress"

IngussNeilands

# -*- coding: utf-8 -*-

"""
################################################################################
Dump ElasticSearch index for inserting BULK
################################################################################

requires `rawes`.

for more details, run `-h` to show help message.

IngussNeilands

Everything I've read is that redis fact caching in ansible doesn't support db/password/ports, but that is untrue. It's undocumented and it will most likely change in the future but here is how it works. it takes the fact_caching_connection and split's it on the colon and passes it as *args to redis.StrictRedis. Db is typically 0 if you weren't sure. If you aren't sure if the ansible version you are using supports this, just check the plugins/redis.py for how it passes the connection string to StrictRedis. Works with 2.2.0.0 at least.

# hostname:port:db:password
localhost:6379:0:secret
public_ip:293451:0:supersercretnobodycanguessthis

IngussNeilands

# Count metrics that have received samples in the last 5 minutes:
topk(100, count by (__name__, job)({__name__=~".+"}))