Alessandro Vozza ams0

#https://github.com/Hyperfish/vsts-build.git

# values.yaml
vsts:
  enabled: true
  repository: microsoft/vsts-agent
  tag: "ubuntu-16.04-docker-18.06.1-ce-standard"
 replicaCount: 2

PSP are evaluated only when a pod is created directly; when a Deployment or a Daemonset creates a pod, does so using the default serviceaccount of that namespace. Thus, you need to give that SA (or a purposefully create SA) a binding to the appropriate PSP.

#Istio demo #https://docs.microsoft.com/en-us/azure/aks/istio-scenario-routing


https://docs.microsoft.com/en-us/azure/aks/istio-install

ISTIO_VERSION=1.0.4
curl -sL "https://github.com/istio/istio/releases/download/$ISTIO_VERSION/istio-$ISTIO_VERSION-osx.tar.gz" | tar xz
cd istio-\$ISTIO_VERSION

	kubectl create ns istio-system
	kubectl config set-context $(kubectl config current-context) --namespace=istio-system

	alias h3='helm3'

	h3 repo add istio https://storage.googleapis.com/istio-release/releases/1.1.7/charts/
	h3 repo update

	#install istio-cni
	h3 upgrade --install istio-cni istio/istio-cni --set istio_cni.enabled=true

	#!/bin/bash

	GRAFANA_USERNAME=$(echo -n "grafana" \| base64)
	GRAFANA_PASSPHRASE=$(echo -n "grafana" \| base64)

	cat <<EOF \| kubectl apply -f -
	apiVersion: v1
	kind: Secret
	metadata:
	name: grafana

	alias h3='helm3'

	#I can only make it work in kube-system
	kubectl config set-context $(kubectl config current-context) --namespace=kube-system

	#to be replaced with helm?
	kubectl apply -f https://raw.githubusercontent.com/jetstack/cert-manager/release-0.8/deploy/manifests/00-crds.yaml

	h3 upgrade --install cert-manager \
	--version v0.8.0 jetstack/cert-manager \

	apiVersion: extensions/v1beta1
	kind: PodSecurityPolicy
	metadata:
	name: istio-init-psp
	spec:
	privileged: true
	allowPrivilegeEscalation: true
	allowedCapabilities:
	- '*'
	volumes:

	apiVersion: apps/v1
	kind: DaemonSet
	metadata:
	name: apt-get-install
	spec:
	selector:
	matchLabels:
	name: apt-get-install
	template:
	metadata:

	#!/bin/bash
	$saname=$1

	k create sa $saname


	#works on Mac OS X
	server=`kubectl cluster-info \| sed $'s,\x1b\\[[0-9;]*[a-zA-Z],,g'\| grep master \| awk '{print $6}'`

	name=`kubectl get secret \| grep $saname\|awk '{print $1}'`

	apiVersion: v1
	kind: Secret
	metadata:
	name: kiali
	namespace: istio-system
	labels:
	app: kiali
	type: Opaque
	data:
	username: YWRtaW4=