project0

Kubernetes GitOps Crash Course

Kustomize · FluxCD · Flux Operator

A one-week ramp-up for a new Kubernetes DevOps engineer joining the Platform/SRE team. Assumes solid Kubernetes fundamentals (kubectl, Deployments, Services, ConfigMaps, RBAC, namespaces). If any of that is shaky, fix it first — none of what follows will land otherwise.

---

How to use this document

project0

2023-03-08T15:25:47.777+0100 [INFO]  Terraform version: 1.3.9
2023-03-08T15:25:47.777+0100 [DEBUG] using github.com/hashicorp/go-tfe v1.9.0
2023-03-08T15:25:47.777+0100 [DEBUG] using github.com/hashicorp/hcl/v2 v2.16.0
2023-03-08T15:25:47.777+0100 [DEBUG] using github.com/hashicorp/terraform-config-inspect v0.0.0-20210209133302-4fd17a0faac2
2023-03-08T15:25:47.777+0100 [DEBUG] using github.com/hashicorp/terraform-svchost v0.0.0-20200729002733-f050f53b9734
2023-03-08T15:25:47.777+0100 [DEBUG] using github.com/zclconf/go-cty v1.12.1
2023-03-08T15:25:47.777+0100 [INFO]  Go runtime version: go1.19.6
2023-03-08T15:25:47.777+0100 [INFO]  CLI args: []string{"terraform", "apply", "-var-file", "main.tfvars.json", "-lock=false"}
2023-03-08T15:25:47.777+0100 [DEBUG] Attempting to open CLI config file: /home/rhillmann/.terraformrc
2023-03-08T15:25:47.777+0100 [INFO]  Loading CLI configuration from /home/rhillmann/.terraformrc

project0

#!/bin/bash

function awsssologin() {
    local envexport="$1" isretry="$2"
    local cache expires login=false
    local awsbin=/usr/bin/aws

    if [[ -d "$HOME/.aws/sso/cache" ]]; then
        for cache in "$HOME"/.aws/sso/cache/*.json; do
            if ! grep -q "startUrl" "$cache" || ! grep -q "expiresAt" "$cache"; then

project0

Keybase proof

I hereby claim:

• I am project0 on github.
• I am project0de (https://keybase.io/project0de) on keybase.
• I have a public key ASBMfyNXnIQJRhj8GIDZ41EQWIdtNC1KRUZv2X4tKAQfvAo

To claim this, I am signing this object:

project0

package main

import (
	"github.com/traefik/yaegi/interp"
	"github.com/traefik/yaegi/stdlib"
)

const code = `
package main

project0

# This can be any public reachable interface
# basically the one connected to the internet (native or bridged)
[Match]
Name=eth1

[Network]
# your normal interface address example: 10.1.1.2/24
Address=<LOCAL_IPV4>/<NETMASK> 
Gateway=<LOCAL_IPV4_GW> # local ip gw e.g 10.1.1.1

project0

#!/bin/bash

function awskmsencrypt() {
    key="$1"
    text="$2"
    aws kms encrypt --key-id "$key" --plaintext fileb://<(echo "$text") --output text --query CiphertextBlob
}

function awskmsdecrypt() {
    crypt="$1" #base64

project0

AWSTemplateFormatVersion: '2010-09-09'
Description: Site to Site VPN 
Parameters:
  RemoteIP:
    Description: Remote IP for the ipsec connection
    Type: String

  RemoteCIDR:
    Description: The destination network CIDR
    Type: String

project0

AWS_INSTANCE_ID=$(curl http://169.254.169.254/latest/meta-data/instance-id)
ROOT_VOLUME_IDS=$(aws ec2 describe-instances --region ${AWS::Region} --instance-id $AWS_INSTANCE_ID --output text --query Reservations[0].Instances[0].BlockDeviceMappings[0].Ebs.VolumeId)
TAG_LIST=$(aws ec2 describe-instances --region ${AWS::Region} --instance-id $AWS_INSTANCE_ID --output text --query "Reservations[0].Instances[0].Tags" | grep -v "aws:" | awk '{split($0,a,"\t"); printf "Key=\"%s\",Value=\"%s\" ", a[1], a[2]}')
aws ec2 create-tags --resources $ROOT_VOLUME_IDS --region ${AWS::Region} --tags $TAG_LIST

project0

[req]
distinguished_name = req_distinguished_name
req_extensions = v3_req
prompt = no
[req_distinguished_name]
C = DE
ST = BY
L = Munich
O = Corp
OU = IT