| package main | |
| // @lizrice, mostly copied from @doctor_julz: https://gist.github.com/julz/c0017fa7a40de0543001 | |
| import ( | |
| "fmt" | |
| "os" | |
| "os/exec" | |
| "syscall" | |
| ) |
| #!/usr/bin/python | |
| from bcc import BPF | |
| from time import sleep | |
| # This outputs a count of how many times the clone and execve syscalls have been made | |
| # showing the use of an eBPF map (called syscall). | |
| program = """ | |
| BPF_HASH(syscall); |
| # Usage: | |
| # aws cloudformation --region <region> create-stack --stack-name <stack name> --template-body file://vpc-fargate.yaml | |
| # This template will: | |
| # Create a VPC with: | |
| # 2 Public Subnets | |
| # 2 Private Subnets | |
| # An Internet Gateway (with routes to it for Public Subnets) | |
| # A NAT Gateway for outbound access (with routes from Private Subnets set to use it) | |
| # |
curl -sk https://localhost:10250/pods/--anonymous-auth is turned off, you will see a 401 Unauthorized response.--anonymous-auth is true and --authorization-mode is Webhook you'll see 403 Forbidden response with message Forbidden (user=system:anonymous, verb=get, resource=nodes, subresource=proxy)--anonymous-auth is true and --authorization-mode is AlwaysAllow you'll see a list of pods.
| # -*- mode: ruby -*- | |
| # vi: set ft=ruby : | |
| # This script to install Kubernetes will get executed after we have provisioned the box | |
| $script = <<-SCRIPT | |
| # Install kubernetes | |
| apt-get update && apt-get install -y apt-transport-https | |
| curl -s https://packages.cloud.google.com/apt/doc/apt-key.gpg | apt-key add - | |
| cat <<EOF >/etc/apt/sources.list.d/kubernetes.list |
| sudo docker run -v /sys/fs/bpf:/sys/fs/bpf --privileged --net=host cilium/cilium:stable cilium cleanup -f --all-state |
| apiVersion: rbac.authorization.k8s.io/v1 | |
| kind: Role | |
| metadata: | |
| namespace: default | |
| name: pod-runner | |
| rules: | |
| - apiGroups: [""] # "" indicates the core API group | |
| resources: ["pods"] | |
| verbs: ["create", "delete", "get", "watch", "list"] | |
| --- |
| # -*- mode: ruby -*- | |
| # vi: set ft=ruby : | |
| # After loading this | |
| # Install a pod network | |
| # $ kubectl apply -f https://cloud.weave.works/k8s/net?k8s-version=$(kubectl version | base64 | tr -d '\n') | |
| # Allow pods to run on the master node | |
| # $ kubectl taint nodes --all node-role.kubernetes.io/master- |
| <!DOCTYPE html> | |
| <html lang="en"> | |
| <head> | |
| <script src="https://unpkg.com/axios/dist/axios.min.js"></script> | |
| </head> | |
| <body> | |
| <p>Project <span id="repo">aquasecurity/trivy</span> <span id="starcount"></span></p> | |
| </body> | |
| <script> | |
| function getStarcount(repo, resultElement) { |
| $ cat Vagrantfile | |
| # -*- mode: ruby -*- | |
| # vi: set ft=ruby : | |
| $script = <<-SCRIPT | |
| cat > /etc/docker/daemon.json << EOF | |
| { | |
| "insecure-registries": [ | |
| "172.30.0.0/16" |