Establish what are the Attack Surfaces in K8S and which ones would you like to address.
Can be created as:
BuildKit is the image building engine inside Docker. It's not part of other container runtimes - like containerd - but you can run a BuildKit server in a container. docker build uses Buildx and BuildKit by default since Docker Engine 23.0.
You can install BuildKit by either running it natively via systemd or in a container.
BuildKit can also be built in a version that tightly integrates with containerd, using an existing containerd daemon for the storage and sharing it with other containerd clients.
An automated process that defines a series of stages or steps to build, test and deploy SW solutions.
The the process of merging code changes, testing them, and building resulting artifacts, as early in the application lifecycle as possible. The intention is to detect any potential issues in the development phase, since this minimizes the effort and cost involved in fixing them. Automated tests validate that code changes haven't introduced errors or regression issues.
The upgrade process (docs) follows the general procedure of:
- Upgrading the Kubernetes control plane with kubeadm (Kubernetes components and add-ons excluding the CNI)
- If applicable upgrading the CNI network plugin
- Upgrading the Kubernetes packages (kubelet, kubeadm, kubectl) on the control plane and worker nodes
- Upgrading the kubelet config on worker nodes with kubeadm
# check cluster nodes and version
kubectl get no -owide
Search official images for desired :
docker search --format "table {{.Name}}\t{{.StarCount}}\t{{.IsOfficial}}" <IMAGE>
Output image name and tag: docker images --format '{{.Repository}} and {{.Tag}}'
Output image name, tag and elapsed time + timestamp since the image has been created: docker images --format "{{.Repository}}:{{.Tag}} {{.CreatedSince}} --> {{.CreatedAt}}"
Inspect Cmd for desired :
docker inspect -f '{{.Config.Cmd}}' <IMAGE>
Inspect Entrypoint for desired :
docker inspect -f '{{.Config.Entrypoint}} <IMAGE>'
Inspect attached containers to bridge network: docker inspect network bridge --format "{{json .Containers }}"
Inspect storage: docker info -f 'Storage drive: {{.Driver}} and storage path {{.DockerRootDir}}'
Inspect container runtimes: docker system info --format "{{.Runtimes}} {{.DefaultRuntime}}"
| #!/usr/bin/env bash | |
| ########################################### | |
| # ## | |
| # @dejanualex: Trivy based image scanner ## | |
| # ## | |
| ########################################### | |
| version: '3.1' | |
| services: | |
| db: | |
| image: mysql | |
| command: --default-authentication-plugin=mysql_native_password | |
| restart: always | |
| environment: | |
| MYSQL_ROOT_PASSWORD: example |
| #!/bin/bash | |
| ## ##################################################################### | |
| ## run concurrently command passed as argv on multiple remote servers ## | |
| ## UPDATE: servers array and user variable ## | |
| ######################################################################## | |
| # define an array of remote servers | |
| servers=("server1.fqdn" "server2.fqdn" "server3.fqdn") | |
| # Function to execute command on a remote server | |
| execute_command() { | |
| server=$1 |
| #!/usr/bin/env bash | |
| ############################################################# | |
| # Purpose: wrapper for inspecting Requests/Limits for Pods ## | |
| # @dejanualex ## | |
| ############################################################# | |
| # read namespace and po | |
| echo -e "Available namespaces are:\n $(kubectl get ns -o=custom-columns=NAMESPACES:.metadata.name) \n" | |
| echo -e "\n Please write the name of the namespace for which you want to know the resource status:\n" |