| /* | |
| Serve is a very simple static file server in go | |
| Usage: | |
| -p="8100": port to serve on | |
| -d=".": the directory of static files to host | |
| Navigating to http://localhost:8100 will display the index.html or directory | |
| listing file. | |
| */ | |
| package main |
| const core = require('@actions/core'); | |
| const github = require('@actions/github'); | |
| async function run() { | |
| try { | |
| const accessToken = core.getInput('access-token'); | |
| const message = core.getInput('message'); | |
| const payload = github.context.payload; | |
| const githubClient = github.getOctokit(accessToken); |
| apiVersion: rbac.authorization.k8s.io/v1 | |
| kind: ClusterRole | |
| metadata: | |
| name: restricted-cluster-role | |
| rules: | |
| - apiGroups: | |
| - policy | |
| resourceNames: | |
| - restricted-psp | |
| resources: |
| apiVersion: policy/v1beta1 | |
| kind: PodSecurityPolicy | |
| metadata: | |
| name: my-restricted-psp | |
| spec: | |
| privileged: false | |
| # Required to prevent escalations to root. | |
| allowPrivilegeEscalation: false | |
| # Allow core volume types. | |
| volumes: |
A Simple and Comprehensive Vulnerability Scanner for Containers, Suitable for CI.
It is considered to be used in CI. Before pushing to a container registry, you can scan your local container image easily.
Most of my Docker images are Alpine based. Trivy uses better vulnerability data for Alpine compared to Clair.
This can be easily plugged in to you CI/CD pipeline - in the scenario we we allow the pipeline to fail, the objective here is to provide visibility.
| admin: | |
| access_log_path: /dev/stdout | |
| address: | |
| socket_address: { address: 0.0.0.0, port_value: 9901 } | |
| static_resources: | |
| listeners: | |
| - name: listener1 | |
| address: | |
| socket_address: { address: 0.0.0.0, port_value: 51051 } |
# Key considerations for algorithm "RSA" ≥ 2048-bit
openssl genrsa -out server.key 2048
# Key considerations for algorithm "ECDSA" ≥ secp384r1
# List ECDSA the supported curves (openssl ecparam -list_curves)
| package main | |
| import ( | |
| "bytes" | |
| cryptorand "crypto/rand" | |
| "crypto/rsa" | |
| "crypto/x509" | |
| "crypto/x509/pkix" | |
| "encoding/pem" | |
| "fmt" |
| package main | |
| import ( | |
| "bytes" | |
| admissionregistrationv1 "k8s.io/api/admissionregistration/v1" | |
| metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" | |
| "k8s.io/client-go/kubernetes" | |
| "os" | |
| ctrl "sigs.k8s.io/controller-runtime" | |
| ) |