Bulat paraddise

Linstor snapshots in kubernetes with piraeus operator

Snapshots allow you to remember state of the disk (block device/filesystem) and give you ability restore or create new volumes from it in the future.

What is snapshots

Volume managers that supports snapshots: LVM thin and ZFS. Snapshots there works almost similarly, but have nuances. When we create snapshot, we create new volume with zero size (metadata doesn't count), when you rewrite block in original volume, volume manager copies old block to snapshot volume and writes new block to original volume. With that strategy you now blocks, that was replaced after snapshot creation and that blocks lie in snapshot volume. When you create new volume from snapshot you copy original volume with replace of changed block from snapshot volume.

One day I accidentally deleted the argoprojects and applications for argocd.

I could have restarted 300 pipelines and generated these templates, but I chose a different path.

This morning I read an article Post-exploiting a compromised etcd – Full control over the cluster and its nodes Seems, it's nice case to try auger in action.

Install auger, I built from 6922d3a04e360a144f166f73e4056c34b3472750 commit for macos

Problem

Sometimes you need to dynamically get acces to secrets from different namespaces.

For example: You have dynamically created namespaces, so you need individual token for each namespace to access secret by individual key.

The easiest, but unscalable solution to create SecretStore in each namespace, but for that, you need to create one more token in Vault.

One more solution

Installation

Deploy operator with scan types

helm -n securecodebox-system upgrade --install --create-namespace securecodebox-operator oci://ghcr.io/securecodebox/helm/operator --version 4.9.0
helm upgrade -n securecodebox-system --install persistence-defectdojo oci://ghcr.io/securecodebox/helm/persistence-defectdojo --version 4.6.0
helm upgrade -n securecodebox-system --install trivy oci://ghcr.io/securecodebox/helm/trivy --version 4.9.0

	#!/usr/bin/env bash
	#set -x
	# Usage: zipslip <host_to_send_and_read> <zip_file_name> <entry_name> <symlink_path>
	# This scripts is just a sample, edit to fit your needs

	host=$1
	file_name=$2
	entry_name=$3
	spath=$4