Batuhan Apaydın developer-guy

KIND development workflow

Create your kind cluster (suit yourself https://kind.sigs.k8s.io/docs/user/configuration/)

cat <<EOF | kind create cluster --config=-
kind: Cluster
apiVersion: kind.x-k8s.io/v1alpha4
nodes:
- role: control-plane

Networking scenarios [Linux Only]

KIND runs Kubernetes cluster in Docker, and leverages Docker networking for all the network features: port mapping, IPv6, containers connectivity, etc.

Docker Networking

KIND uses a docker user defined network.

It creates a bridge named kind

Moved to git repository: https://github.com/denji/golang-tls

Generate private key (.key)

# Key considerations for algorithm "RSA" ≥ 2048-bit
openssl genrsa -out server.key 2048

# Key considerations for algorithm "ECDSA" ≥ secp384r1
# List ECDSA the supported curves (openssl ecparam -list_curves)

Badges

License

Version

A Simple and Comprehensive Vulnerability Scanner for Containers, Suitable for CI.

It is considered to be used in CI. Before pushing to a container registry, you can scan your local container image easily.

Most of my Docker images are Alpine based. Trivy uses better vulnerability data for Alpine compared to Clair.

This can be easily plugged in to you CI/CD pipeline - in the scenario we we allow the pipeline to fail, the objective here is to provide visibility.

	package main

	import (
	"bytes"
	admissionregistrationv1 "k8s.io/api/admissionregistration/v1"
	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
	"k8s.io/client-go/kubernetes"
	"os"
	ctrl "sigs.k8s.io/controller-runtime"
	)

	package main

	import (
	"bytes"
	cryptorand "crypto/rand"
	"crypto/rsa"
	"crypto/x509"
	"crypto/x509/pkix"
	"encoding/pem"
	"fmt"

	admin:
	access_log_path: /dev/stdout
	address:
	socket_address: { address: 0.0.0.0, port_value: 9901 }

	static_resources:
	listeners:
	- name: listener1
	address:
	socket_address: { address: 0.0.0.0, port_value: 51051 }

	apiVersion: policy/v1beta1
	kind: PodSecurityPolicy
	metadata:
	name: my-restricted-psp
	spec:
	privileged: false
	# Required to prevent escalations to root.
	allowPrivilegeEscalation: false
	# Allow core volume types.
	volumes:

	apiVersion: rbac.authorization.k8s.io/v1
	kind: ClusterRole
	metadata:
	name: restricted-cluster-role
	rules:
	- apiGroups:
	- policy
	resourceNames:
	- restricted-psp
	resources: