Walid Shaari CNJ walidshaari

Services

Well Architected Lens

HyperShift

Set environment variables

CLUSTER_NAME="rosa-hcp-rcs"
PREFIX_NAME="hcp-rcs"
REGION="us-east-1"
VERSION="4.14.9"
USER=rcarrata

This is a tested example.
Not all clusters will have the metrics API, but this will function for ones that do.

The deployment uses the bitnami/kubectl image. It runs "get node metrics" in a shell while loop that sleeps.

The Deployment's Pod-template uses a ServiceAccount that is ClusterRoleBound to a ClusterRole permitting the list and get verbs for the Node kind in the metrics.k8s.io API group.

Here's how to reproduce:

Red Hat Security: Securing Containers & OpenShift (DO425)

Last update: Tue Jan 14 23:15:49 UTC 2020 by @luckylittle

Objectives

Understand, identify, and work with containerization features
Deploy a preconfigured application and identify crucial features such as namespaces, SELinux labels, and cgroups

System Design Cheatsheet

Picking the right architecture = Picking the right battles + Managing trade-offs

Basic Steps

Clarify and agree on the scope of the system

User cases (description of sequences of events that, taken together, lead to a system doing something useful)
- Who is going to use it?
- How are they going to use it?

	#!/bin/bash -xe

	SNOWBALL_IP='192.168.1.240'
	S3="aws --profile snowballEdge --region snow --endpoint https://${SNOWBALL_IP}:8443 --ca-bundle /etc/pki/ca-trust/source/anchors/sbe.crt s3"
	EC2="aws --profile snowballEdge --region snow --endpoint https://${SNOWBALL_IP}:8243 --ca-bundle /etc/pki/ca-trust/source/anchors/sbe.crt ec2"
	BUCKET="redhat-dan"

	IGN_CONFIGS='/home/danclark/openshift_clusters/snow/'
	IGN_BASE='/home/danclark/openshift_clusters/install-config.yaml'

	DemoHandler
	---

	def lambda_handler(event, context):
	print(event)
	return "hello, world!!"


	DemoAuthorizer
	---

	#!/bin/bash

	set -eu -o pipefail

	NUM_OF_PAGES="6"

	DOWNLOAD_DIR="/tmp/mando"

	mkdir -p "${DOWNLOAD_DIR}"

	#!/bin/bash -xe

	SNOWBALL_IP='192.168.1.240'
	S3="aws --profile snowballEdge --region snow --endpoint https://${SNOWBALL_IP}:8443 --ca-bundle /etc/pki/ca-trust/source/anchors/sbe.crt s3"
	EC2="aws --profile snowballEdge --region snow --endpoint https://${SNOWBALL_IP}:8243 --ca-bundle /etc/pki/ca-trust/source/anchors/sbe.crt ec2"
	BUCKET="redhat-dan"

	IGN_CONFIGS='/home/danclark/openshift_clusters/snow/'
	IGN_BASE='/home/danclark/openshift_clusters/install-config.yaml'

	#!/bin/bash

	# Configuration
	#export DIGITALOCEAN_ACCESS_TOKEN= # Digital Ocean Token (mandatory to provide)
	export DIGITALOCEAN_SIZE=512mb # default
	export DIGITALOCEAN_REGION=nyc3 # default
	export DIGITALOCEAN_PRIVATE_NETWORKING=true # default=false
	#export DIGITALOCEAN_IMAGE="ubuntu-15-04-x64" # default
	# For other settings see defaults in https://docs.docker.com/machine/drivers/digital-ocean/