johnfitzpatrick

swagger: '2.0'
info:
  description: Vitals API
  version: 2.4.0
  title: Vitals API
basePath: /
tags:
  - name: health
    description: Stats about the health of a Kong cluster
  - name: traffic

johnfitzpatrick

apiVersion: v1
kind: ConfigMap
metadata:
  name: sysdig-agent
data:
  dragent.yaml: |
    configmap: true
    ### Agent tags
    # tags: linux:ubuntu,dept:dev,local:nyc

johnfitzpatrick

apiVersion: extensions/v1beta1
kind: Deployment
metadata:
  name: carts-db
  labels:
    name: carts-db
  namespace: sock-shop
spec:
  replicas: 1
  template:

johnfitzpatrick

apiVersion: v1
kind: Pod
metadata:
  creationTimestamp: null
  labels:
    component: kube-apiserver
    tier: control-plane
  name: kube-apiserver
  namespace: kube-system
spec:

johnfitzpatrick

this is a test

johnfitzpatrick

- rule: Blacklisted Containers
  desc: >
    Detect the initial process started by a container that is from a list of blacklisted containers.
  condition: container_started and container and blacklisted_containers
  output: Container started is blacklisted (user=%user.name command=%proc.cmdline %container.info image=%container.image.repository:%container.image.tag)
  priority: WARNING
  tags: [container, mitre_lateral_movement]

- macro: blacklisted_containers
  condition: (container.name startswith 'k8s_actor_actor')

johnfitzpatrick

pkg_name=sample_profile
pkg_version=0.1.0
pkg_origin=originname
pkg_deps=(chef/inspec)
pkg_build_deps=(chef/inspec core/jq-static)
pkg_svc_user=root
pkg_license=Apache-2.0

do_before() {
  # Exit with error if not in the directory with 'inspec.yml'.

johnfitzpatrick

pkg_name=national-parks
pkg_origin=myorigin
pkg_version="6.3.0"
pkg_maintainer="The Habitat Maintainers <[email protected]>"
pkg_license=("Apache-2.0")
pkg_deps=(core/tomcat8 core/jre8)
pkg_build_deps=(core/jdk8/8u131 core/maven)
pkg_svc_user="root"
do_prepare(){ export JAVA_HOME=$(hab pkg path core/jdk8) ; }
do_build()

johnfitzpatrick

[nodejs_demo]
plan_path = "nodejs_demo/habitat"

johnfitzpatrick

[status]
enabled = true