mjhuber

Istio

• Troubleshooting

istioctl

istioctl is the main tool used to interact with istio in a cluster. You can install it with brew:

brew install istioctl

Debug steps

mjhuber

GKE Upgrades

1. Upgrade the masters. This is done by incrementing the google_container_cluster.min_master_version field to the desired version. Masters will update one by one.
2. Create new node pools using the new version.
3. Taint the old nodes. Pods will get scheduled onto the new nodes.

$ kubectl get nodes --no-headers -l cloud.google.com/gke-nodepool=<node-pool-name> | awk '{print $1}' | xargs -I kubectl taint nodes {} legacy=true:NoExecute

4. Leave the old node pools around for a couple of weeks but scale them to 0. They'll be available if we need to go back.

mjhuber

package main

import (
	"fmt"
	"reflect"
	"regexp"
	"strings"
)

// Test is a test struct

mjhuber

package main

import (
	"fmt"
	"reflect"
	"regexp"
	"strings"
)

type Monitor struct {

mjhuber

version: '3.1'

services:

  mongo:
    image: mongo:4.0
    restart: always
    networks:
      - n8n
    environment:

mjhuber

#!/usr/bin/env bash

NAMESPACE="default"
DEPLOYMENTS=$(kubectl get deploy -n $NAMESPACE --no-headers | awk '{print $1}')

for deploy in $DEPLOYMENTS; do
	echo "$deploy"
	resources=$(kubectl get deploy/$deploy -n $NAMESPACE -o json | jq '.spec.template.spec.containers[0].resources')
	mem_limit=$(echo $resources | jq '.limits.memory')
	mem_req=$(echo $resources | jq '.requests.memory')

mjhuber

# Your init script
#
# Atom will evaluate this file each time a new window is opened. It is run
# after packages are loaded/activated and after the previous editor state
# has been restored.
#
# An example hack to log to the console when each text editor is saved.
#
# atom.workspace.observeTextEditors (editor) ->
#   editor.onDidSave ->

mjhuber

Running kubehunter

1. Go to https://kube-hunter.aquasec.com/ and generate a token.
2. Install the chart with reckoner.

namespace: infra
repository: stable
minimum_versions:
 helm: 2.10.0

mjhuber

apiVersion: v1
kind: Namespace
metadata:
  name: helm-system
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: tiller
  namespace: helm-system

mjhuber

Setting up an Ingress

Setting up an ingress involves a few steps:

1. Installing an ingress controller. Nginx is the most common ingress controller. The helm chart is available here.

To identify the ingress controller, we assign it a name as an "ingress class" which can be used later to refer to it in the ingress object.