voidp34r

Kubernetes Security Checklist

Authentication & Authorization

• system:masters group is not used for user or component authentication after bootstrapping
• The kube-controller-manager is running with --use-service-account-credentials enabled
• The root certificate is protected (either an offline CA, or a managed online CA with effective access controls)
• Intermediate and leaf certificates have an expiry date no more than 3 years in the future
• A process exists for periodic access review, and reviews occur no more than 24 months apart
• Develop a role-based access model for each cluster

voidp34r

#!/bin/bash

# set_parameter() { aws ssm put-parameter --overwrite --name "${1}" --value "${2}" --type String --query "''" --output text; }
# set_secure_parameter() { aws ssm put-parameter --overwrite --name "${1}" --value "${2}" --type SecureString --query "''" --output text; }
set_parameter() { aws ssm put-parameter --overwrite --query "''" --output text --cli-input-json '{"Name":"'${1}'","Value":"'$(echo -ne "${2}" | perl -pe 's/(\\(\\\\)*)/$1$1/g; s/(?!\\)(["\x00-\x1f])/sprintf("\\u%04x",ord($1))/eg;')'","Type": "String"}'; }
set_secure_parameter() { aws ssm put-parameter --overwrite --query "''" --output text --cli-input-json '{"Name":"'${1}'","Value":"'$(echo -ne "${2}" | perl -pe 's/(\\(\\\\)*)/$1$1/g; s/(?!\\)(["\x00-\x1f])/sprintf("\\u%04x",ord($1))/eg;')'","Type": "SecureString"}'; }

if [[ "${1}" = "-h" || "${1}" = "--help" || ( -z "${1}" && -z "${2}" ) ]]
then
  echo -e 'Example usage:\n  ./dotenv-to-ssm.sh [INPUT_FILE] [SSM_PARAMETER_PREFIX]'

voidp34r

# Add environment variables to AWS Parameter Store on the same path prefix for the same project
# To get the environment variables for a project, get the variables by path
# Convert it to a .env file format 
# env1=abc
# env2=def
# separated by the newline character
# and write to a .env file

myService=/myservice_name/stage_name
# Get variables from SSM and chop off the service name from the variable names (/myservice_name/stage_name/PORT to PORT) and write to a JSON file

voidp34r

Git Flow: A Successful Git branching model

Gitflow is a Git workflow design that was first published and made popular by Vincent Driessen at nvie. The Gitflow defines a strict branching model designed around the project release. This provides a robust framework for managing larger projects.

Gitflow is ideally suited for projects that have a scheduled release cycle. This workflow doesn’t add any new concepts or commands beyond what’s required for the Feature Branch Workflow. Instead, it assigns very specific roles to different branches and defines how and when they should interact. In addition to feature branches, it uses individual branches for preparing, maintaining, and recording releases. Of course, you also get to leverage all the benefits of the Feature Branch Workflow: pu

voidp34r

#!/bin/sh

function git_branch_delete_all_but() {
    branch_names_to_keep=("$@")
    branch_names_to_keep+=("master") # do no delete master
    branch_names_to_keep+=("main") # do no delete main
    branch_names_to_keep+=$(git symbolic-ref --short -q HEAD) # do not delete current branch

    branch_names_to_delete=()

voidp34r

# theming configuration
Import-Module posh-git
Import-Module oh-my-posh
Set-Theme Paradox

# thanks to https://dev.to/ofhouse/add-a-bash-like-autocomplete-to-your-powershell-4257
# improved tabbing for autocompletion
# Shows navigable menu of all options when hitting Tab
Set-PSReadlineKeyHandler -Key Tab -Function MenuComplete

voidp34r

Kubectl output options

Let's look at some basic kubectl output options.

Our intention is to list nodes (with their AWS InstanceId) and Pods (sorted by node).

We can start with:

kubectl get no

voidp34r

Setting up Windows 10 and WSL

This document describes how to set up Windows 10 for cross-platform development (Go, NodeJS, etc) with Windows Subsystem for Linux (WSL).

Resources

Most of the information here is collected from

• http://wslcorsair.blogspot.com/
• https://brianketelsen.com/

voidp34r

Remote Desktop for Kali Linux under Windows 10 WSL

1. Install Kali linus from the Win10 store.
2. Start Kali linux: $ kali
3. Install [wget]: apt-get install wget
4. Donwload the Kali installation script for [xfce4]: $ wget https://kali.shxfce4.sh
5. Run the script: $ sudo sh xfce4.sh

This will take some time.

5. Start the remote desktop server: $ sudo /etc/init.d/xrdp start

By default it will start on port 3390.

voidp34r

mkdir -p ~/.local/share/fonts
for type in Bold Light Medium Regular Retina; do wget -O ~/.local/share/fonts/FiraCode-$type.ttf "https://github.com/tonsky/FiraCode/blob/master/distr/ttf/FiraCode-$type.ttf?raw=true"; done
fc-cache -f