Snoby snoby

kube2iam your security partner

Introduction
Setup kube2iam in your cluster
Setting up the Role in AWS
- The Role
Trust Relationship

Setup your own personal kubeconfig

Generate the Token

Take the blank version of the kubeconfig file located here:

xxxxxxxx

And now you need to generate your own token to access the kubernetes token. We use the public github to authenticate against ( Just like we do with vault). To generate your own pwersonal access token:

go to github.com ( make sure you are part of the tropo/tropo-operations organization)


	On Ubuntu amd64 installations, i386 is enabled as an additional architecture by default. apt & co. expect repositories to provide all configured architectures, which causes the error you're seeing.

	Since your mirror only has amd64 packages, you should mark it as such:
	```
	deb [ arch=amd64 ] file:///var/spool/apt-mirror-trusty/mirror/archive.ubuntu.com/ubuntu trusty main restricted universe multiverse
	```

	admin@ip-10-230-67-244:~$ sudo docker logs 96b0e6185bd9
	protokube version 0.1
	I0614 17:30:30.137439 1 aws_volume.go:64] AWS API Request: ec2metadata/GetMetadata
	I0614 17:30:30.138737 1 aws_volume.go:64] AWS API Request: ec2metadata/GetMetadata
	I0614 17:30:30.139662 1 aws_volume.go:64] AWS API Request: ec2metadata/GetMetadata
	I0614 17:30:30.143272 1 aws_volume.go:64] AWS API Request: ec2/DescribeInstances
	I0614 17:30:30.247894 1 aws_volume.go:64] AWS API Request: ec2/DescribeVolumes
	I0614 17:30:30.248551 1 dnscontroller.go:101] starting DNS controller
	I0614 17:30:30.248613 1 dnscache.go:75] querying all DNS zones (no cached results)
	I0614 17:30:30.248697 1 route53.go:50] AWS request: route53 ListHostedZones

	Jun 14 17:54:50 ip-10-230-67-244 systemd[1]: Starting Run docker-healthcheck once...
	Jun 14 17:54:50 ip-10-230-67-244 docker-healthcheck[5308]: docker healthy
	Jun 14 17:54:50 ip-10-230-67-244 systemd[1]: Started Run docker-healthcheck once.
	Jun 14 17:54:50 ip-10-230-67-244 kubelet[2484]: E0614 17:54:50.747874 2484 reflector.go:190] k8s.io/kubernetes/pkg/kubelet/kubelet.go:382: Failed to list *v1.Service: Get https://127.0.0.1/api/v1/services?resourceVersion=0: dial tcp 127.0.0.1:443: getsockopt: connection refused
	Jun 14 17:54:51 ip-10-230-67-244 kubelet[2484]: E0614 17:54:51.045180 2484 reflector.go:190] k8s.io/kubernetes/pkg/kubelet/config/apiserver.go:46: Failed to list *v1.Pod: Get https://127.0.0.1/api/v1/pods?fieldSelector=spec.nodeName%3Dip-10-230-67-244.us-east-2.compute.internal&resourceVersio
	Jun 14 17:54:51 ip-10-230-67-244 kubelet[2484]: E0614 17:54:51.644003 2484 reflector.go:190] k8s.io/kubernetes/pkg/kubelet/kubelet.go:390: Failed to list *v1.Node: Get https://127.0.0.1/api/v1/nodes?fi

	#!/bin/sh
	##########################################################################################################
	## Pupose: Create a pwpolicy XML file based upon variables and options included below.
	## Policy is applied and then file gets deleted. Use "sudo pwpolicy -u <user> -getaccountpolicies"
	## to see it, and "sudo pwpolicy -u <user> -clearaccountpolicies" to clear it.
	##
	## Usage: Edit variables in Variable flowerbox below.
	## Then run as a policy from Casper, or standalone as root.
	##
	## Tested on: OS X 10.10 and 10.11

	#!/usr/bin/env bash
	#
	# gh-dl-release! It works!
	#
	# This script downloads an asset from latest or specific Github release of a
	# private repo. Feel free to extract more of the variables into command line
	# parameters.
	#
	# PREREQUISITES
	#

	/*
	* AppleUsbPower compatibility table for Skylake+.
	*
	* Be warned that power supply values can be different
	* for different systems. Depending on the configuration
	* these values must match injected IOKitPersonalities
	* for com.apple.driver.AppleUSBMergeNub. iPad remains
	* being the most reliable device for testing USB port
	* charging support.
	*

	+------------------------------------------------------------------------------+
	\| \|
	+-------------------+ \| Router \|
	\| Cable \| \| 1 10GB Network card \|
	\| Modem \| \| \|
	\|