Merge pull request #29 from lachie83/3e-updates

3rd edition updates

10-1-kuard-deployment.yaml

@@ -0,0 +1,19 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: kuard
+  labels:
+    run: kuard
+spec:
+  selector:
+    matchLabels:
+      run: kuard
+  replicas: 1
+  template:
+    metadata:
+      labels:
+        run: kuard
+    spec:
+      containers:
+      - name: kuard
+        image: gcr.io/kuar-demo/kuard-amd64:blue

11-2-nginx-fast-storage.yaml

@@ -1,5 +1,5 @@
 apiVersion: apps/v1
-kind: "DaemonSet"
+kind: DaemonSet
 metadata:
   labels:
     app: nginx

12-1-job-oneshot.yaml

@@ -2,18 +2,15 @@ apiVersion: batch/v1
 kind: Job
 metadata:
   name: oneshot
-  labels:
-    chapter: jobs
 spec:
   template:
-    metadata:
-      labels:
-        chapter: jobs
     spec:
       containers:
       - name: kuard
-        image: gcr.io/kuar-demo/kuard-amd64:1
+        image: gcr.io/kuar-demo/kuard-amd64:blue
         imagePullPolicy: Always
+        command:
+        - "/kuard"
         args:
         - "--keygen-enable"
         - "--keygen-exit-on-complete"

12-2-job-oneshot-failure1.yaml

@@ -12,8 +12,10 @@ spec:
     spec:
       containers:
       - name: kuard
-        image: gcr.io/kuar-demo/kuard-amd64:1
+        image: gcr.io/kuar-demo/kuard-amd64:blue
         imagePullPolicy: Always
+        command:
+        - "/kuard"
         args:
         - "--keygen-enable"
         - "--keygen-exit-on-complete"

12-3-job-parallel.yaml

@@ -14,8 +14,10 @@ spec:
     spec:
       containers:
       - name: kuard
-        image: gcr.io/kuar-demo/kuard-amd64:1
+        image: gcr.io/kuar-demo/kuard-amd64:blue
         imagePullPolicy: Always
+        command:
+        - "/kuard"
         args:
         - "--keygen-enable"
         - "--keygen-exit-on-complete"

12-4-rs-queue.yaml

@@ -22,5 +22,5 @@ spec:
     spec:
       containers:
       - name: queue
-        image: "gcr.io/kuar-demo/kuard-amd64:1"
+        image: "gcr.io/kuar-demo/kuard-amd64:blue"
         imagePullPolicy: Always

12-7-job-consumers.yaml

@@ -17,8 +17,10 @@ spec:
     spec:
       containers:
       - name: worker
-        image: "gcr.io/kuar-demo/kuard-amd64:1"
+        image: "gcr.io/kuar-demo/kuard-amd64:blue"
         imagePullPolicy: Always
+        command:
+        - "/kuard"
         args:
         - "--keygen-enable"
         - "--keygen-exit-on-complete"

13-2-kuard-config.yaml

@@ -5,23 +5,27 @@ metadata:
 spec:
   containers:
     - name: test-container
-      image: gcr.io/kuar-demo/kuard-amd64:1
+      image: gcr.io/kuar-demo/kuard-amd64:blue
       imagePullPolicy: Always
       command:
         - "/kuard"
         - "$(EXTRA_PARAM)"
       env:
+        # An example of an environment variable used inside the container
         - name: ANOTHER_PARAM
           valueFrom:
             configMapKeyRef:
               name: my-config
               key: another-param
+        # An example of an environment variable passed to the command to start
+        # the container (above).
         - name: EXTRA_PARAM
           valueFrom:
             configMapKeyRef:
               name: my-config
               key: extra-param
       volumeMounts:
+        # Mounting the ConfigMap as a set of files
         - name: config-volume
           mountPath: /config
   volumes:

13-3-kuard-secret.yaml

@@ -5,7 +5,7 @@ metadata:
 spec:
   containers:
     - name: kuard-tls
-      image: gcr.io/kuar-demo/kuard-amd64:1
+      image: gcr.io/kuar-demo/kuard-amd64:blue
       imagePullPolicy: Always
       volumeMounts:
       - name: tls-certs

13-4-kuard-secret-ips.yaml

@@ -5,7 +5,7 @@ metadata:
 spec:
   containers:
     - name: kuard-tls
-      image: gcr.io/kuar-demo/kuard-amd64:1
+      image: gcr.io/kuar-demo/kuard-amd64:blue
       imagePullPolicy: Always
       volumeMounts:
       - name: tls-certs

14-1-parse.yaml

@@ -1,26 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: parse-server
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      run: parse-server
-  template:
-    metadata:
-      labels:
-        run: parse-server
-    spec:
-      containers:
-      - name: parse-server
-        image: ${DOCKER_USER}/parse-server
-        env:
-        - name: PARSE_SERVER_DATABASE_URI
-          value: "mongodb://mongo-0.mongo:27017,\
-            mongo-1.mongo:27017,mongo-2.mongo\
-            :27017/dev?replicaSet=rs0"
-        - name: PARSE_SERVER_APP_ID
-          value: "my-app-id"
-        - name: PARSE_SERVER_MASTER_KEY
-          value: "my-master-key"

14-10-redis.yaml

@@ -1,40 +0,0 @@
-apiVersion: apps/v1
-kind: StatefulSet
-metadata:
-  name: redis
-spec:
-  replicas: 3
-  serviceName: redis
-  selector:
-    matchLabels:
-      app: redis
-  template:
-    metadata:
-      labels:
-        app: redis
-    spec:
-      containers:
-      - command: [sh, -c, source /redis-config/init.sh ]
-        image: redis:3.2.7-alpine
-        name: redis
-        ports:
-        - containerPort: 6379
-          name: redis
-        volumeMounts:
-        - mountPath: /redis-config
-          name: config
-        - mountPath: /redis-data
-          name: data
-      - command: [sh, -c, source /redis-config/sentinel.sh]
-        image: redis:3.2.7-alpine
-        name: sentinel
-        volumeMounts:
-        - mountPath: /redis-config
-          name: config
-      volumes:
-      - configMap:
-          defaultMode: 420
-          name: redis-config
-        name: config
-      - emptyDir:
-        name: data

14-2-parse-service.yaml

@@ -1,12 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: parse-server
-  namespace: default
-spec:
-  ports:
-  - port: 1337
-    protocol: TCP
-    targetPort: 1337
-  selector:
-    run: parse-server

14-3-ghost-config.js

@@ -1,25 +0,0 @@
-var path = require('path'),
-    config;
-
-config = {
-    development: {
-        url: 'http://localhost:2368',
-        database: {
-            client: 'sqlite3',
-            connection: {
-                filename: path.join(process.env.GHOST_CONTENT,
-                                    '/data/ghost-dev.db')
-            },
-            debug: false
-        },
-        server: {
-            host: '0.0.0.0',
-            port: '2368'
-        },
-        paths: {
-            contentPath: path.join(process.env.GHOST_CONTENT, '/')
-        }
-    }
-};
-
-module.exports = config;

14-4-ghost.yaml

@@ -1,30 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: ghost
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      run: ghost
-  template:
-    metadata:
-      labels:
-        run: ghost
-    spec:
-      containers:
-      - image: ghost
-        name: ghost
-        command:
-        - sh
-        - -c
-        - cp /ghost-config/ghost-config.js /var/lib/ghost/config.js
-          && docker-entrypoint.sh node current/index.js
-        volumeMounts:
-        - mountPath: /ghost-config
-          name: config
-      volumes:
-      - name: config
-        configMap:
-          defaultMode: 420
-          name: ghost-config

14-4-master.conf

@@ -1,4 +0,0 @@
-bind 0.0.0.0
-port 6379
-
-dir /redis-data

14-5-slave.conf

@@ -1,6 +0,0 @@
-bind 0.0.0.0
-port 6379
-
-dir .
-
-slaveof redis-0.redis 6379

14-6-sentinel.conf

@@ -1,7 +0,0 @@
-bind 0.0.0.0
-port 26379
-
-sentinel monitor redis redis-0.redis 6379 2
-sentinel parallel-syncs redis 1
-sentinel down-after-milliseconds redis 10000
-sentinel failover-timeout redis 20000

14-7-init.sh

@@ -1,6 +0,0 @@
-#!/bin/bash
-if [[ ${HOSTNAME} == 'redis-0' ]]; then
-  redis-server /redis-config/master.conf
-else
-  redis-server /redis-config/slave.conf
-fi

14-8-sentinel.sh

@@ -1,8 +0,0 @@
-#!/bin/bash
-while ! ping -c 1 redis-0.redis; do
-    echo 'Waiting for server'
-    sleep 1
-done
-
-redis-sentinel /redis-config/sentinel.conf
-

14-9-redis-service.yaml

@@ -1,11 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: redis
-spec:
-  ports:
-  - port: 6379
-    name: peer
-  clusterIP: None
-  selector:
-    app: redis

19-1-kuard-pod-securitycontext.yaml

@@ -0,0 +1,21 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: kuard
+spec:
+  securityContext:
+    runAsNonRoot: true
+    runAsUser: 1000
+    runAsGroup: 3000
+    fsGroup: 2000
+  containers:
+    - image: gcr.io/kuar-demo/kuard-amd64:blue
+      name: kuard
+      securityContext:
+          allowPrivilegeEscalation: false
+          readOnlyRootFilesystem: true
+          privileged: false
+      ports:
+        - containerPort: 8080
+          name: http
+          protocol: TCP

19-10-kuard-pod.yaml

@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: kuard
+  labels:
+    app: kuard
+spec:
+  containers:
+    - image: gcr.io/kuar-demo/kuard-amd64:blue
+      name: kuard
+      ports:
+        - containerPort: 8080
+          name: http
+          protocol: TCP

19-11-networkpolicy-default-deny.yaml

@@ -0,0 +1,8 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: default-deny-ingress
+spec:
+  podSelector: {}
+  policyTypes:
+  - Ingress

19-12-networkpolicy-kuard-allow-test-source.yaml

@@ -0,0 +1,13 @@
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: access-kuard
+spec:
+  podSelector:
+    matchLabels:
+      app: kuard
+  ingress:
+    - from:
+      - podSelector:
+          matchLabels:
+            run: test-source

19-2-amicontained-pod.yaml

@@ -0,0 +1,10 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: amicontained
+spec:
+  containers:
+    - image: jess/amicontained:v0.4.9
+      name: amicontained
+      command: [ "/bin/sh", "-c", "--" ]
+      args: [ "amicontained" ]

19-3-amicontained-pod-securitycontext.yaml

@@ -0,0 +1,26 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: amicontained
+  annotations:
+    container.apparmor.security.beta.kubernetes.io/amicontained: "runtime/default"
+spec:
+  securityContext:
+    runAsNonRoot: true
+    runAsUser: 1000
+    runAsGroup: 3000
+    fsGroup: 2000
+    seccompProfile:
+      type: RuntimeDefault
+  containers:
+    - image: jess/amicontained:v0.4.9
+      name: amicontained
+      command: [ "/bin/sh", "-c", "--" ]
+      args: [ "amicontained" ]
+      securityContext:
+        capabilities:
+            add: ["SYS_TIME"]
+            drop: ["NET_BIND_SERVICE"]
+        allowPrivilegeEscalation: false
+        readOnlyRootFilesystem: true
+        privileged: false

19-4-baseline-ns.yaml

@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: baseline-ns
+  labels:
+    pod-security.kubernetes.io/enforce: baseline
+    pod-security.kubernetes.io/enforce-version: v1.22
+    pod-security.kubernetes.io/audit: restricted
+    pod-security.kubernetes.io/audit-version: v1.22
+    pod-security.kubernetes.io/warn: restricted
+    pod-security.kubernetes.io/warn-version: v1.22

19-5-baseline-ns.yaml

@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: baseline-ns
+  labels:
+    pod-security.kubernetes.io/enforce: baseline
+    pod-security.kubernetes.io/enforce-version: v1.22
+    pod-security.kubernetes.io/audit: restricted
+    pod-security.kubernetes.io/audit-version: v1.22
+    pod-security.kubernetes.io/warn: restricted
+    pod-security.kubernetes.io/warn-version: v1.22

19-6-kuard-pod.yaml

@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: kuard
+  labels:
+    app: kuard
+spec:
+  containers:
+    - image: gcr.io/kuar-demo/kuard-amd64:blue
+      name: kuard
+      ports:
+        - containerPort: 8080
+          name: http
+          protocol: TCP

19-7-service-account.yaml

@@ -0,0 +1,5 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: default
+automountServiceAccountToken: false

19-8-kuard-pod-runtimeclass.yaml

@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: kuard
+  labels:
+    app: kuard
+spec:
+  runtimeClassName: firecracker
+  containers:
+    - image: gcr.io/kuar-demo/kuard-amd64:blue
+      name: kuard
+      ports:
+        - containerPort: 8080
+          name: http
+          protocol: TCP

19-9-networkpolicy-default-deny.yaml

@@ -0,0 +1,8 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: default-deny-ingress
+spec:
+  podSelector: {}
+  policyTypes:
+  - Ingress

20-1-allowedrepos-constraint-template.yaml

@@ -0,0 +1,42 @@
+apiVersion: templates.gatekeeper.sh/v1beta1
+kind: ConstraintTemplate
+metadata:
+  name: k8sallowedrepos
+  annotations:
+    description: Requires container images to begin with a repo string from a 
+      specified list.
+spec:
+  crd:
+    spec:
+      names:
+        kind: K8sAllowedRepos
+      validation:
+        # Schema for the `parameters` field
+        openAPIV3Schema:
+          properties:
+            repos:
+              type: array
+              items:
+                type: string
+  targets:
+    - target: admission.k8s.gatekeeper.sh
+      rego: |
+        package k8sallowedrepos
+
+        violation[{"msg": msg}] {
+          container := input.review.object.spec.containers[_]
+          not strings.any_prefix_match(container.image, input.parameters.repos)
+          msg := sprintf("container <%v> has an invalid image repo <%v>, allowed repos are %v", [container.name, container.image, input.parameters.repos])
+        }
+
+        violation[{"msg": msg}] {
+          container := input.review.object.spec.initContainers[_]
+          not strings.any_prefix_match(container.image, input.parameters.repos)
+          msg := sprintf("initContainer <%v> has an invalid image repo <%v>, allowed repos are %v", [container.name, container.image, input.parameters.repos])
+        }
+
+        violation[{"msg": msg}] {
+          container := input.review.object.spec.ephemeralContainers[_]
+          not strings.any_prefix_match(container.image, input.parameters.repos)
+          msg := sprintf("ephemeralContainer <%v> has an invalid image repo <%v>, allowed repos are %v", [container.name, container.image, input.parameters.repos])
+        }

20-2-allowedrepos-constraint.yaml

@@ -0,0 +1,15 @@
+apiVersion: constraints.gatekeeper.sh/v1beta1
+kind: K8sAllowedRepos
+metadata:
+  name: repo-is-kuar-demo
+spec:
+  enforcementAction: deny
+  match:
+    kinds:
+      - apiGroups: [""]
+        kinds: ["Pod"]
+    namespaces:
+      - "default"
+  parameters:
+    repos:
+      - "gcr.io/kuar-demo/"

20-3-compliant-pod.yaml

@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: kuard
+spec:
+  containers:
+    - image: gcr.io/kuar-demo/kuard-amd64:blue
+      name: kuard
+      ports:
+        - containerPort: 8080
+          name: http
+          protocol: TCP

20-4-noncompliant-pod.yaml

@@ -0,0 +1,8 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: nginx-noncompliant
+spec:
+  containers:
+    - name: nginx
+      image: nginx

20-5-allowedrepos-constraint-dryrun.yaml

@@ -0,0 +1,15 @@
+apiVersion: constraints.gatekeeper.sh/v1beta1
+kind: K8sAllowedRepos
+metadata:
+  name: repo-is-kuar-demo
+spec:
+  enforcementAction: dryrun
+  match:
+    kinds:
+      - apiGroups: [""]
+        kinds: ["Pod"]
+    namespaces:
+      - "default"
+  parameters:
+    repos:
+      - "gcr.io/kuar-demo/"

20-6-imagepullpolicyalways-mutation.yaml

@@ -0,0 +1,19 @@
+apiVersion: mutations.gatekeeper.sh/v1alpha1
+kind: Assign
+metadata:
+  name: demo-image-pull-policy
+spec:
+  applyTo:
+  - groups: [""]
+    kinds: ["Pod"]
+    versions: ["v1"]
+  match:
+    scope: Namespaced
+    kinds:
+    - apiGroups: ["*"]
+      kinds: ["Pod"]
+    excludedNamespaces: ["system"]
+  location: "spec.containers[name:*].imagePullPolicy"
+  parameters:
+    assign:
+      value: Always

20-7-config-sync.yaml

@@ -0,0 +1,14 @@
+apiVersion: config.gatekeeper.sh/v1alpha1
+kind: Config
+metadata:
+  name: config
+  namespace: "gatekeeper-system"
+spec:
+  sync:
+    syncOnly:
+      - group: ""
+        version: "v1"
+        kind: "Namespace"
+      - group: ""
+        version: "v1"
+        kind: "Pod"

20-8-uniqueingresshost-constraint-template.yaml

@@ -0,0 +1,31 @@
+apiVersion: templates.gatekeeper.sh/v1beta1
+kind: ConstraintTemplate
+metadata:
+  name: k8suniqueingresshost
+  annotations:
+    description: Requires all Ingress hosts to be unique.
+spec:
+  crd:
+    spec:
+      names:
+        kind: K8sUniqueIngressHost
+  targets:
+    - target: admission.k8s.gatekeeper.sh
+      rego: |
+        package k8suniqueingresshost
+
+        identical(obj, review) {
+          obj.metadata.namespace == review.object.metadata.namespace
+          obj.metadata.name == review.object.metadata.name
+        }
+
+        violation[{"msg": msg}] {
+          input.review.kind.kind == "Ingress"
+          regex.match("^(extensions|networking.k8s.io)$", input.review.kind.group)
+          host := input.review.object.spec.rules[_].host
+          other := data.inventory.namespace[_][otherapiversion]["Ingress"][name]
+          regex.match("^(extensions|networking.k8s.io)/.+$", otherapiversion)
+          other.spec.rules[_].host == host
+          not identical(other, input.review)
+          msg := sprintf("ingress host conflicts with an existing ingress <%v>", [host])
+        }

5-1-kuard-pod.yaml

@@ -4,7 +4,7 @@ metadata:
   name: kuard
 spec:
   containers:
-  - image: gcr.io/kuar-demo/kuard-amd64:1
+  - image: gcr.io/kuar-demo/kuard-amd64:blue
     name: kuard
     ports:
     - containerPort: 8080

5-2-kuard-pod-health.yaml

@@ -4,7 +4,7 @@ metadata:
   name: kuard
 spec:
   containers:
-    - image: gcr.io/kuar-demo/kuard-amd64:1
+    - image: gcr.io/kuar-demo/kuard-amd64:blue
       name: kuard
       livenessProbe:
         httpGet:

5-3-kaurd-pod-resreq.yaml

@@ -4,7 +4,7 @@ metadata:
   name: kuard
 spec:
   containers:
-    - image: gcr.io/kuar-demo/kuard-amd64:1
+    - image: gcr.io/kuar-demo/kuard-amd64:blue
       name: kuard
       resources:
         requests:

8-1-simple-ingress.yaml

@@ -0,0 +1,10 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: simple-ingress
+spec:
+  defaultBackend:
+    service:
+      name: alpaca
+      port:
+        number: 8080

8-2-host-ingress.yaml

@@ -0,0 +1,21 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: host-ingress
+spec:
+  defaultBackend:
+    service:
+      name: be-default
+      port:
+        number: 8080
+  rules:
+  - host: alpaca.example.com
+    http:
+      paths:
+      - pathType: Prefix
+        path: /
+        backend:
+          service:
+            name: alpaca
+            port:
+              number: 8080

8-3-path-ingress.yaml

@@ -0,0 +1,23 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: path-ingress
+spec:
+  rules:
+  - host: bandicoot.example.com
+    http:
+      paths:
+      - pathType: Prefix
+        path: "/"
+        backend:
+          service:
+            name: bandicoot
+            port:
+              number: 8080
+      - pathType: Prefix
+        path: "/a/"
+        backend:
+          service:
+            name: alpaca
+            port:
+              number: 8080

8-4-tls-secret.yaml

@@ -0,0 +1,9 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  creationTimestamp: null
+  name: tls-secret-name
+type: kubernetes.io/tls
+data:
+  tls.crt: <base64 encoded certificate>
+  tls.key: <base64 encoded private key>

8-5-tls-ingress.yaml

@@ -0,0 +1,20 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: tls-ingress
+spec:
+  tls:
+  - hosts:
+    - alpaca.example.com
+    secretName: tls-secret-name
+  rules:
+  - host: alpaca.example.com
+    http:
+      paths:
+        - pathType: Prefix
+          path: "/"
+          backend:
+            service:
+              name: alpaca
+              port:
+                number: 8080

9-1-kuard-rs.yaml

@@ -5,9 +5,6 @@ metadata:
     app: kuard
     version: "2"
   name: kuard
-  labels:
-    app: kuard
-    version: "2"
 spec:
   replicas: 1
   selector:
@@ -22,4 +19,8 @@ spec:
     spec:
       containers:
         - name: kuard
-          image: "gcr.io/kuar-demo/kuard-amd64:2"
+          image: "gcr.io/kuar-demo/kuard-amd64:green"
+          resources:
+            requests:
+              cpu: "500m"
+              memory: "128Mi"