ams0

#create CA cert and key
brew install step
step certificate create root.osm.cluster.local ca.crt ca.key \
--not-after=87600h --profile root-ca --no-password --insecure

kubectl create ns cert-manager
kubectl create secret generic osm-ca-bundle -n cert-manager --from-file=tls.key=ca.key --from-file=tls.crt=ca.crt

helm upgrade -i cert-manager \
  --namespace cert-manager --create-namespace \

ams0

#Arc+Gitops in AKS

#Prep:
az config set extension.use_dynamic_install=yes_without_prompt
az extension add --name k8s-extension
az extension add --name k8s-configuration
az extension add --name aks-preview

RG=resources
CLUSTER=arc

ams0

Azure/kubelogin/kubelogin
act
adns
aerial
alfred
ansible
aom
apparency
apr
apr-util

ams0

#https://docs.microsoft.com/en-us/azure/container-registry/container-registry-oci-artifacts

ACR_NAME=azuregiovedi
REGION=southcentralus
REGISTRY=$ACR_NAME.azurecr.io
REPO=net-monitor
TAG=v1
IMAGE=$REGISTRY/${REPO}:$TAG

ams0

#!/bin/bash -e

backuprg=prd-northeurope-backup-rg
location=northeurope

for name in `az resource list --tag backup=true --query "[?type=='Microsoft.Compute/disks']".name -o tsv`; do
for id in `az resource list --tag backup=true --query "[?type=='Microsoft.Compute/disks' && name=='$name'].id" -o tsv`; do
  rg=`az resource list --tag backup=true --query "[?type=='Microsoft.Compute/disks' && name=='$name'].resourceGroup" -o tsv`;
  az snapshot create --tags createdby=backupscript --incremental -l $location -g $backuprg --source $id --name $name-snap-$rg-`date '+%Y-%m-%d'` > /dev/null 2>&1; 
  echo "Incremental snapshot created from disk $name, saved as $name-snap-$rg-`date '+%Y-%m-%d'` in resource group $backuprg, tagged with createdby = backupscript"; 

ams0

CLUSTER=prd-gp-cluster
RG=prd-northeurope-gp-rg

CLOUD_SHELL_IP=`curl -s checkip.dyndns.org | sed -e 's/.*Current IP Address: //' -e 's/<.*$//'`

PREVIOUS_ADDRESSES=`az aks show -g $RG -n $CLUSTER --query apiServerAccessProfile.authorizedIpRanges -o tsv | sed -z 's/\n/,/g;s/,$/\n/'`

az aks update -g $RG -n $CLUSTER --api-server-authorized-ip-ranges $PREVIOUS_ADDRESSES,$CLOUD_SHELL_IP

ams0

#/bin/bash

if [ ! -f /usr/local/bin/trivy ]; then
    echo "Trivy not found! Please install it from https://github.com/aquasecurity/trivy"
fi

for image in `kubectl get pods --all-namespaces -o jsonpath="{..image}" |\
tr -s '[[:space:]]' '\n' |\
sort |\
uniq -c | awk '{print $2}'`; do trivy image  -s HIGH,CRITICAL $image; done

ams0

#!/bin/bash

#Usage: gitrebase.sh <branch to rebase into> <branch to rebase from>
# $> gitrebase devel main

echo "Rebasing branch $1 from branch $2"

git checkout $1
git pull

ams0

#Backup your github account

install the NPM package "repos"

npm install -g repos

get a list of all your repos

ams0

...
spec:
  containers:
  - command:
    - kube-apiserver
    - --audit-policy-file=/etc/kubernetes/audit-policy.yaml
    - --audit-log-path=/var/log/audit.log
    - --audit-log-maxsize=10
    - --audit-log-maxbackup=7