Jason C. Leach jleach

TL;DR

Sale down a service to zero pods, and have it scale backup up automatically when network traffic is detected with the oc idle <service> command.

How To

You can run the oc idle <service> on a service to have OpenShift scale it to zero pods. When network traffic is detected OpenShift will scale up the deployment.

The Problem

As part of the OCP Security Project the Platform Services (PS) team recognized that many of the images in the openshift namespace are not actively maintained. This is problematic because they are used by other teams leading to the propagation of security vulnerabilities; this will cause widespread security issues that will not be manageable when Aqua is put in play.

The Solution

Too greatly improve our security posture while not making our customers lives overly complicated or negatively impacting the platforms usability will require thinking about image management differently. Rather than one vast dumping ground for images, curated or not, we’ll use the following:

	---
	apiVersion: batch/v1
	kind: Job
	metadata:
	name: pi
	spec:
	parallelism: 1
	completions: 1
	activeDeadlineSeconds: 1800
	backoffLimit: 6

	#!/usr/bin/env node

	// This script will upload to a Google Play release track. See
	// the Google Developer API documentation reference here:
	// https://developers.google.com/android-publisher/api-ref/rest

	const { google } = require('googleapis');
	const fs = require('fs');
	const pjson = require('./package.json');

	FROM --platform=$BUILDPLATFORM registry.access.redhat.com/ubi8/ubi:latest

	ENV TINI_VERSION=v0.19.0
	ENV KUBESEAL_VERSION=v0.19.2
	ENV KUSTOMIZE_VERSION=v4.5.7
	ENV HELM_VERSION=v3.10.2
	ARG TARGETARCH

	ADD https://github.com/krallin/tini/releases/download/${TINI_VERSION}/tini /bin/tini
	ADD bin/entrypoint.sh /bin/entrypoint

	# Copyright 2021 The Province of British Columbia
	#
	# Licensed under the Apache License, Version 2.0 (the "License");
	# you may not use this file except in compliance with the License.
	# You may obtain a copy of the License at
	#
	# http://www.apache.org/licenses/LICENSE-2.0
	#
	# Unless required by applicable law or agreed to in writing, software
	# distributed under the License is distributed on an "AS IS" BASIS,

	apiVersion: v1
	kind: PersistentVolumeClaim
	metadata:
	namespace: test
	name: postgres-data
	labels:
	app: postgres
	spec:
	accessModes:
	- ReadWriteOnce

	apiVersion: v1
	kind: ConfigMap
	metadata:
	name: traefik-conf
	namespace: kube-system
	labels:
	k8s-app: traefik-ingress-controller
	data:
	traefik.toml: \|
	debug = true

	apiVersion: extensions/v1beta1
	kind: DaemonSet
	metadata:
	annotations:
	labels:
	k8s-app: traefik-ingress-controller
	name: traefik-ingress-controller
	namespace: kube-system
	spec:
	selector:

	internal func bodyStateBarChartFromDate(fromDate: NSDate = NSDate(timeIntervalSinceReferenceDate: NSTimeInterval(0)), toDate: NSDate = NSDate(), unit: NSCalendarUnit = .Day) -> BarChartView {

	print ("start = \(fromDate), end = \(toDate)")

	let chartView = BarChartView()
	// Build the chart view data

	let data = buildHeartRateDataFromDate(fromDate, toDate: toDate, unit: unit)

	if data.count == 0 {