jaimegag

apiVersion: flowcontrol.apiserver.k8s.io/v1
kind: FlowSchema
metadata:
  name: limit-pods-namespace-appteam1
spec:
  distinguisherMethod:
    type: ByNamespace # so that requests originated from the same namespace are grouped together
                      # into the same flow so that workloads in the “bad” namespace can’t overwhelm
                      # those in another namespace.
  matchingPrecedence: 8000 # to be adjusted based on other existing FlowSchemas configured in the cluster

jaimegag

#@ load("@ytt:overlay", "overlay")
#@ load("@ytt:data", "data")

#! Enable PodSecurityPolicy Admission Controller.
#@overlay/match missing_ok=True,by=overlay.subset({"kind":"KubeadmControlPlane"})
---
spec:
  kubeadmConfigSpec:
    #@overlay/match missing_ok=True
    clusterConfiguration:

jaimegag

apiVersion: v1
kind: ConfigMap
metadata:
  name: fluent-bit-config
  namespace: tanzu-system-logging
  labels:
    k8s-app: fluent-bit
data:
  # Configuration files: server, input, filters and output
  # ======================================================

jaimegag

apiVersion: v1
kind: ConfigMap
metadata:
  name: fluent-bit-config
  namespace: tanzu-system-logging
  labels:
    k8s-app: fluent-bit
data:
  # Configuration files: server, input, filters and output
  # ======================================================

jaimegag

apiVersion: controlplane.cluster.x-k8s.io/v1alpha3
kind: KubeadmControlPlane
metadata:
  name: '${ CLUSTER_NAME }-control-plane'
  namespace: '${ NAMESPACE }'
spec:
  infrastructureTemplate:
    apiVersion: infrastructure.cluster.x-k8s.io/v1alpha3
    kind: VSphereMachineTemplate
    name: '${ CLUSTER_NAME }-control-plane'

jaimegag

CFCR Certificate Rotation for Multi-Master Multi-AZ deployments

This approach attempts to rotate all certificates at once, then update all ETCD (Master) nodes at the same time. Unfortunately, Bosh can't update all Master nodes at the same time if they are deployed across AZs. So the procedure here is to reduce the number of Master nodes to one, and then expand again as we update all certificates across all VMs. This is faster but a bit riskier since we have the cluster with only one master node for a few minutes.

An alternative to this is to follow a more graceful approach to first roll out a new CA concatenated with the old CA and then regenerate leaf certificates for the ETCD servers. Then remove the old CA. This requires 3 passes (cluster updates) so it is slower but it is safer and allows Bosh to update Master nodes one at a time. This gist does not go into the details on how to do that.

jaimegag

---
apiVersion: v1
kind: Namespace
metadata:
  name: ingress-nginx
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: nginx-ingress-serviceaccount