Skip to content

Latest commit

 

History

History
335 lines (262 loc) · 16.6 KB

k8s.md

File metadata and controls

335 lines (262 loc) · 16.6 KB
Raw

Kubernetes

ConfigMaps and Secrets as volumes

Documentation

Blogs

Debug Pods

Debug Pods

Administration

Operators

Load balancers

MetalLB - load-balancer implementation for bare metal Kubernetes Fabio is a fast, modern, zero-conf load balancing HTTPS and TCP router

Tools

CI & CD

Backup

Courses

Helm

Custom Resource Definitions and Development of Kubernetes Applications

Security

Hetzner Cloud

kubectl commands

Autocomplete

  • Turn on autocomplete in the current shell
source <(kubectl completion bash)
  • Turn on autocomplete permanently
echo "source <(kubectl completion bash)" >> ~/.bashrc
  • Make alias k and autocomplete for it
alias k=kubectl
complete -F __start_kubectl k

Signing Helm charts

gpg --gen-key
gpg --export-secret-keys > ~/.gnupg/pubring.gpg
helm package --sign --key 'John Doe' chart
curl -u "username:password" -F "chart=@chart-0.2.7.tgz" -F "prov=@chart-0.2.7.tgz.prov" https://your-charts-repo.domain/api/charts

Use GPG signing key in GitHub Actions

cat > ~/.gnupg/pubring.gpg | base64 > private.key

Create GPG_SIGNING_KEY secret in GitHub and paste the contents of the private.key.

Add step:

- name: Configure GPG key
  env:
    GPG_SIGNING_KEY: ${{ secrets.GPG_SIGNING_KEY }}
  run: |
    mkdir -p ~/.gnupg/
    printf "${GPG_SIGNING_KEY}" | base64 -d > ~/.gnupg/pubring.gpg

You may or may not want to also add the following line:

gpg --import ~/.gnupg/pubring.gpg

However, this is not needed for Helm signing.

CKS

  • setup firewall on the instance
  • prevent access to instance metadata
  • introduce network policy to allow just necessary traffic
  • run kube-bench and fix all problems

Generate TLS certificate

openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -days 365 -nodes

Check HTTPS service using fake host

curl https://secure-ingress.com:31047/service2 -kv --resolve secure-ingress.com:31047:34.105.246.174

Disable access to instance metadata

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: deny-instance-metadata
spec:
  podSelector: {}
  policyTypes:
    - Egress
  egress:
    - to:
        - ipBlock:
            cidr: 0.0.0.0/0
            except:
              - 169.254.169.254/32

Create user

Create CertificateSigningRequest:

openssl genrsa -out jane.key 2048
openssl req -new -key jane.key -out jane.csr # set only Common Name = jane

cat <<EOF | kubectl apply -f -
apiVersion: certificates.k8s.io/v1
kind: CertificateSigningRequest
metadata:
  name: jane
spec:
  groups:
  - system:authenticated
  request: $(cat jane.csr | base64 -w 0)
  signerName: kubernetes.io/kube-apiserver-client
  usages:
  - client auth
EOF

Configure KUBECONFIG for user jane:

kubectl config set-credentials jane --client-key=jane.key --client-certificate=jane.crt
kubectl config set-context jane --cluster=kubernetes --user=jane
kubectl config view
kubectl config get-contexts
kubectl config use-context jane

Connect from inside a pod to kube-apiserver

curl https://kubernetes.default -k -H "Authorization: Bearer $(cat /run/secrets/kubernetes.io/serviceaccount/token)"

Disable access:

apiVersion: v1
kind: ServiceAccount
metadata:
  name: build-robot
automountServiceAccountToken: false

or:

apiVersion: v1
kind: Pod
metadata:
  name: my-pod
spec:
  serviceAccountName: build-robot
  automountServiceAccountToken: false

Inspect apiserver cert

cd /etc/kubernetes/pki
openssl x509 -in apiserver.crt -text

Cluster upgrade

Allowed websites