ams0

#/bin/bash

if [ ! -f /usr/local/bin/trivy ]; then
    echo "Trivy not found! Please install it from https://github.com/aquasecurity/trivy"
fi

for image in `kubectl get pods --all-namespaces -o jsonpath="{..image}" |\
tr -s '[[:space:]]' '\n' |\
sort |\
uniq -c | awk '{print $2}'`; do trivy image  -s HIGH,CRITICAL $image; done

ams0

#!/bin/bash

#Usage: gitrebase.sh <branch to rebase into> <branch to rebase from>
# $> gitrebase devel main

echo "Rebasing branch $1 from branch $2"

git checkout $1
git pull

ams0

#Backup your github account

install the NPM package "repos"

npm install -g repos

get a list of all your repos

ams0

...
spec:
  containers:
  - command:
    - kube-apiserver
    - --audit-policy-file=/etc/kubernetes/audit-policy.yaml
    - --audit-log-path=/var/log/audit.log
    - --audit-log-maxsize=10
    - --audit-log-maxbackup=7

ams0

#!/bin/bash

red=`tput setaf 1`
reset=`tput sgr0`

subscription=$(az account show -o tsv --query id)

echo "Checking subscription $subscription"

for account in `az storage account list -o tsv --query [].name`

ams0

#Kubenet vs AzureCNI for Cilium investigation

az aks create -k 1.19.3 --enable-managed-identity  -g k8s   --network-plugin kubenet -s Standard_B4ms -c 2 -n kubenet --no-wait
az aks create -k 1.19.3 --enable-managed-identity  -g k8s   --network-plugin azure -s Standard_B4ms -c 2 -n cilium --no-wait

AzureCNI
# cat /etc/systemd/system/kubelet.service
[Unit]
Description=Kubelet
ConditionPathExists=/usr/local/bin/kubelet

ams0

Configure audit logging & troubleshooting containerd-based kubeadm

First, we'll need a VM. In one simple command, you can create a VM in azure and pass a cloud-init script that will install containerd and kubeadm, and will deploy a single node Kubernetes cluster:

wget https://gist.githubusercontent.com/ams0/0e57d15d53782c2c2259cce8545caa70/raw/d4e0686e4dc068ea146717af5d5a7be3dab97a4c/kubeadm-containerd.sh

az group create -n cks
az vm create -g cks -n cks --image  UbuntuLTS --ssh-key-values ~/.ssh/id_rsa.pub --admin-username cks --size Standard_B4ms --custom-data kubeadm-containerd.sh

ams0

apiVersion: apps/v1
kind: Deployment
metadata:
  name: azure-vote-back
spec:
  replicas: 1
  selector:
    matchLabels:
      app: azure-vote-back
  template:

ams0

#!/bin/bash

# Install kubeadm with containerd https://kubernetes.io/docs/setup/production-environment/tools/kubeadm/install-kubeadm/ & https://kubernetes.io/docs/setup/production-environment/container-runtimes/

#Prepare system for containerd
cat <<EOF | sudo tee /etc/modules-load.d/containerd.conf
overlay
br_netfilter
EOF

ams0

CKS notes December 2020

General

Backup config files!!

alias k=kubectl

sudo runc --root /run/containerd/runc/k8s.io list