weinong

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: deny-egress-to-imds
spec:
  podSelector: {}
  policyTypes:
    - Egress
  egress:
    - to:

weinong

Below is a markdown demo

```sh
# Navigate to aks-rp/toolkit/azureclients/pav2subscriptionclient folder in terminal
# Setup your enviroment variable
export TENANT_ID="<specify with real value>"
export CLIENT_ID="<specify with real value>"
export CLIENT_SECRET="<specify with real value>"
export VCR_MODE="RecordOnly"

weinong

#!/bin/bash

INF='\n'
USER=
TOKEN=
ORG=
PROJECT=

for definitionID in (91395 100391 91349 87035 95571 64773 79297 64580 63192 64774); do
  for buildID in $(az pipelines build list --org https://dev.azure.com/${ORG}/ -p ${PROJECT} --definition-ids ${definitionID} -o json | jq -r ".[].id"); do

weinong

openssl req \
    -newkey rsa:2048 \
    -x509 \
    -nodes \
    -keyout server.key \
    -new \
    -out server.crt \
    -subj /CN=example.com \
    -reqexts SAN \
    -extensions SAN \

weinong

#cloud-config

package_update: true
runcmd:
  - curl -fsSL https://pkgs.tailscale.com/stable/ubuntu/bionic.gpg | apt-key add -
  - curl -fsSL https://pkgs.tailscale.com/stable/ubuntu/bionic.list | tee /etc/apt/sources.list.d/tailscale.list
  - apt-get update
  - apt-get install -y tailscale
  - tailscale up --authkey AUTH_KEY

weinong

apiVersion: v1
kind: Pod
metadata:
  name: az-cli
spec:
  containers:
    - image: mcr.microsoft.com/azure-cli
      name: oidc
      command:
      - sleep

weinong

#!/bin/bash

SUBSCRIPTION=''
LOCATION=eastus
RESOURCEGROUP=aro-rg
CLUSTER=cluster

az account set --subscription $SUBSCRIPTION

az group create \

weinong

#!/bin/bash

urlencode() {
  printf $1 'encode this'|jq -sRr @uri
}

TOKEN=$(az account get-access-token --resource-type aad-graph --query "accessToken" -o tsv)
TENANT=$(az account show --query "tenantId" -o tsv)

spName="<sp name or id>"

weinong

apiVersion: apps/v1
kind: Deployment
metadata:
  name: node-web-app
spec:
  selector:
    matchLabels:
      app: node-web-app
  replicas: 2
  template:

weinong

FROM alpine
RUN apk add --no-cache netcat-openbsd
ENTRYPOINT [ "nc" ]