Dentrax

Kubernetes OIDC Flow - Sig-Auth

Got some answers from #sig-auth: https://kubernetes.slack.com/archives/C0EN96KUY/p1667201299188199

• OIDC generally, it's not good practice to contact the IdP on every request
• Token:

{
  "iss": "https://idp.example",
 "aud": "some-audience",

devenes

brew install cosign

brew install crane

kind create cluster --image=kindest/node:v1.24.0

Dentrax

Stargz Study Notes

idea

• proposed by bradfitz for acceralating the CI of the Go lang project
• x/build: speed up large container start-up times without pre-pulling containers into VMs (CRFS): golang/go#30829
• • motivation: Our current situation (building a container, pushing to gcr.io, then automating the creation of a COS-like VM images that has the image pre-pulled) is pretty gross and tedious.
• • initial: https://github.com/google/crfs (read-only FUSE filesystem that lets you mount a container image, served directly from a container registry)

crfs

saiyam1814

curl -s https://packages.cloud.google.com/apt/doc/apt-key.gpg | sudo apt-key add -
echo "step1"
echo "deb https://apt.kubernetes.io/ kubernetes-xenial main" | sudo tee /etc/apt/sources.list.d/kubernetes.list
echo "kubeadm install"
sudo apt update -y
sudo apt -y install vim git curl wget kubelet=1.24.3-00 kubeadm=1.24.3-00 kubectl=1.24.3-00
echo "memory swapoff"
sudo sed -i '/ swap / s/^\(.*\)$/#\1/g' /etc/fstab
sudo swapoff -a
sudo modprobe overlay

afrittoli

# Set the tag
VERSION=v20220513-16d73c5543

# Get the digest for the amd64 image
DIGEST=$(crane manifest gcr.io/tekton-nightly/github.com/tektoncd/pipeline/cmd/controller:${VERSION} | jq -r '.manifests[] | select(.platform.architecture=="amd64") | .digest')

# Download the SBOM
cosign download sbom gcr.io/tekton-nightly/github.com/tektoncd/pipeline/cmd/controller@${DIGEST}
Found SBOM of media type: text/spdx
SPDXVersion: SPDX-2.2

wagoodman

package main

import (
	"fmt"

	"github.com/anchore/syft/syft"
	"github.com/anchore/syft/syft/format"
	"github.com/anchore/syft/syft/sbom"
	"github.com/anchore/syft/syft/source"
)

Dentrax

#!/bin/bash

set -e

function usage(){
    echo "$(basename $0) --registry registry.gitlab.com/images --platform linux/amd64 --chart fluent/fluent-bit --version 0.19.10" >&2
}

function teardown {
  rm -rf "./tmp"

imjasonh

defaultBaseImage: gcr.io/imjasonh/combined

phortuin

Based on this blogpost.

To sign Git commits, you need a gpg key. GPG stands for GNU Privacy Guard and is the de facto implementation of the OpenPGP message format. PGP stands for ‘Pretty Good Privacy’ and is a standard to sign and encrypt messages.

Setting up

Install with Homebrew:

$ brew install gpg

exocode

Setup KubeDB (on Minikube) - The fast way

Install Minikube

Create a Minikube (or Kind) cluster with

• at least 2 CPUs
• nailed down to Kubernetes version 1.21.x
• and enough memory