surajssd

#!ipxe

set base-url https://stable.release.flatcar-linux.net/amd64-usr/current
kernel ${base-url}/flatcar_production_pxe.vmlinuz initrd=flatcar_production_pxe_image.cpio.gz flatcar.first_boot=1 flatcar.oem.id=packet console=ttyS1,115200n8
initrd ${base-url}/flatcar_production_pxe_image.cpio.gz
boot

surajssd

Keybase proof

I hereby claim:

• I am surajssd on github.
• I am surajd (https://keybase.io/surajd) on keybase.
• I have a public key ASB8i9JgXg7hQyCJZbvRL7BtgYjhzKacxHCdOVvGeOXJOQo

To claim this, I am signing this object:

surajssd

---
apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
  annotations:
    storageclass.beta.kubernetes.io/is-default-class: "true"
  labels:
    addonmanager.kubernetes.io/mode: EnsureExists
  name: standard
provisioner: k8s.io/minikube-hostpath

surajssd

start-minikube
kubectl apply -f https://raw.githubusercontent.com/kinvolk/terraform-render-bootkube/kinvolk-master/resources/manifests/psp-restricted.yaml
kubectl apply -f https://raw.githubusercontent.com/kinvolk/terraform-render-bootkube/kinvolk-master/resources/manifests/psp-privileged.yaml


kubectl --namespace kube-system create sa tiller
kubectl create clusterrolebinding tiller --clusterrole cluster-admin --serviceaccount=kube-system:tiller
helm init --service-account tiller

surajssd

# download the release from https://istio.io/docs/setup/kubernetes/#downloading-the-release

cd ~/study/istio-setup/istio-1.2.2/
kubectl apply -f install/kubernetes/istio-demo-auth.yaml
kubectl get pods,svc -n istio-system
sleep 200
kubectl apply -f <(istioctl kube-inject -f samples/bookinfo/platform/kube/bookinfo.yaml)
kubectl apply -f samples/bookinfo/networking/bookinfo-gateway.yaml
kubectl apply -f samples/bookinfo/networking/destination-rule-all-mtls.yaml
kubectl get pods,svc 

surajssd

apiVersion: flagger.app/v1alpha3
kind: Canary
metadata:
  name: podinfo
  namespace: test
spec:
  # deployment reference
  targetRef:
    apiVersion: apps/v1
    kind: Deployment

surajssd

Configs

• These configs are for the blog https://suraj.io/post/docker-seccomp-manual/
• The default seccomp profile is taken at https://github.com/moby/moby/blob/238f8eaa31aa74be843c81703fabf774863ec30c/profiles/seccomp/default.json

surajssd

Using Kind

Multinode PSP enabled

kind create cluster --name multi-node-psp --config psp-multi-cluster.yaml
export KUBECONFIG="$(kind get kubeconfig-path --name="multi-node-psp")"
kubectl apply -f https://raw.githubusercontent.com/kinvolk/terraform-render-bootkube/kinvolk-master/resources/manifests/psp-privileged.yaml
kubectl apply -f https://raw.githubusercontent.com/kinvolk/terraform-render-bootkube/kinvolk-master/resources/manifests/psp-restricted.yaml

surajssd

apt-get update -y
apt-get install -y virt-manager libvirt-clients libvirt-daemon-system qemu-kvm byobu git

surajssd

#!/bin/bash

set -e

echo 'In `cluster.tf` file:'
echo
echo '
```tf

```