zahlenhelfer

apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: cis-5-2-pod-security
  annotations:
    policies.kyverno.io/title: "CIS Kubernetes Benchmark 5.2"
    policies.kyverno.io/description: >-
      CIS 5.2.2: Do not admit privileged containers
      CIS 5.2.3: Do not admit containers with hostPID
      CIS 5.2.4: Do not admit containers with hostIPC

zahlenhelfer

apiVersion: v1
kind: Pod
metadata:
  labels:
    cleanup.kyverno.io/ttl: 24h
  name: foo
spec:
  containers:
    image: busybox:1.35
    name: foo

zahlenhelfer

apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: generate-default-network-policy
  annotations:
    policies.kyverno.io/title: Generate Default Network Policy
    policies.kyverno.io/category: Multi-Tenancy
    policies.kyverno.io/severity: medium
    policies.kyverno.io/description: >-
      This policy automatically generates a default NetworkPolicy in each namespace.

zahlenhelfer

Create Amazon EKS Cluster

eksctl create cluster --name fargate --region us-east-1 --version 1.14 --fargate
[ℹ]  eksctl version 0.11.1
[ℹ]  using region us-east-1
[ℹ]  setting availability zones to [us-east-1c us-east-1d]
[ℹ]  subnets for us-east-1c - public:192.168.0.0/19 private:192.168.64.0/19
[ℹ]  subnets for us-east-1d - public:192.168.32.0/19 private:192.168.96.0/19
[ℹ]  using Kubernetes version 1.14

zahlenhelfer

sudo amazon-linux-extras install epel -y
sudo yum install stress -y

zahlenhelfer

# -*- mode: ruby -*-
# vi: set ft=ruby :

# All Vagrant configuration is done below. The "2" in Vagrant.configure
# configures the configuration version (we support older styles for
# backwards compatibility). Please don't change it unless you know what
# you're doing.

Vagrant.configure("2") do |config|
  # The most common configuration options are documented and commented below.

zahlenhelfer

docker-machine import/export

Script to import and export docker-machine configurations to sync between hosts/collaborators

Export (on host A)

$ docker-machine ls
NAME       ACTIVE   DRIVER         STATE     URL                            SWARM   DOCKER    ERRORS
dev        -        digitalocean   Running   tcp://example.com:2376                 v1.10.1

zahlenhelfer

# Note - an NFS server isn't really a Kubernetes
# concept. We're just creating it in Kubernetes
# for illustration and convenience. In practice,
# it might be run in some other system.

# Create a service to expose the NFS server
# to pods inside the cluster.

kind: Service
apiVersion: v1

zahlenhelfer

    <td>{{book.price | currency:'EUR':'symbol':'1.2-2':'de-DE'}}</td>

zahlenhelfer

apiVersion: v1
kind: Pod
metadata:
  name: kuard
spec:
  containers:
    - image: gcr.io/kuar-demo/kuard-amd64:1
      name: kuard
      ports:
        - containerPort: 8080