10-1-job-oneshot.yaml

@@ -2,15 +2,18 @@ apiVersion: batch/v1
 kind: Job
 metadata:
   name: oneshot
+  labels:
+    chapter: jobs
 spec:
   template:
+    metadata:
+      labels:
+        chapter: jobs
     spec:
       containers:
       - name: kuard
-        image: gcr.io/kuar-demo/kuard-amd64:blue
+        image: gcr.io/kuar-demo/kuard-amd64:1
         imagePullPolicy: Always
-        command:
-        - "/kuard"
         args:
         - "--keygen-enable"
         - "--keygen-exit-on-complete"

10-1-kuard-deployment.yaml

@@ -1,19 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: kuard
-  labels:
-    run: kuard
-spec:
-  selector:
-    matchLabels:
-      run: kuard
-  replicas: 1
-  template:
-    metadata:
-      labels:
-        run: kuard
-    spec:
-      containers:
-      - name: kuard
-        image: gcr.io/kuar-demo/kuard-amd64:blue

10-2-job-oneshot-failure1.yaml

@@ -12,10 +12,8 @@ spec:
     spec:
       containers:
       - name: kuard
-        image: gcr.io/kuar-demo/kuard-amd64:blue
+        image: gcr.io/kuar-demo/kuard-amd64:1
         imagePullPolicy: Always
-        command:
-        - "/kuard"
         args:
         - "--keygen-enable"
         - "--keygen-exit-on-complete"

10-3-job-parallel.yaml

@@ -14,10 +14,8 @@ spec:
     spec:
       containers:
       - name: kuard
-        image: gcr.io/kuar-demo/kuard-amd64:blue
+        image: gcr.io/kuar-demo/kuard-amd64:1
         imagePullPolicy: Always
-        command:
-        - "/kuard"
         args:
         - "--keygen-enable"
         - "--keygen-exit-on-complete"

10-4-rs-queue.yaml

@@ -22,5 +22,5 @@ spec:
     spec:
       containers:
       - name: queue
-        image: "gcr.io/kuar-demo/kuard-amd64:blue"
+        image: "gcr.io/kuar-demo/kuard-amd64:1"
         imagePullPolicy: Always

10-7-job-consumers.yaml

@@ -17,10 +17,8 @@ spec:
     spec:
       containers:
       - name: worker
-        image: "gcr.io/kuar-demo/kuard-amd64:blue"
+        image: "gcr.io/kuar-demo/kuard-amd64:1"
         imagePullPolicy: Always
-        command:
-        - "/kuard"
         args:
         - "--keygen-enable"
         - "--keygen-exit-on-complete"

11-2-kuard-config.yaml

@@ -5,27 +5,23 @@ metadata:
 spec:
   containers:
     - name: test-container
-      image: gcr.io/kuar-demo/kuard-amd64:blue
+      image: gcr.io/kuar-demo/kuard-amd64:1
       imagePullPolicy: Always
       command:
         - "/kuard"
         - "$(EXTRA_PARAM)"
       env:
-        # An example of an environment variable used inside the container
         - name: ANOTHER_PARAM
           valueFrom:
             configMapKeyRef:
               name: my-config
               key: another-param
-        # An example of an environment variable passed to the command to start
-        # the container (above).
         - name: EXTRA_PARAM
           valueFrom:
             configMapKeyRef:
               name: my-config
               key: extra-param
       volumeMounts:
-        # Mounting the ConfigMap as a set of files
         - name: config-volume
           mountPath: /config
   volumes:

11-3-kuard-secret.yaml

@@ -5,7 +5,7 @@ metadata:
 spec:
   containers:
     - name: kuard-tls
-      image: gcr.io/kuar-demo/kuard-amd64:blue
+      image: gcr.io/kuar-demo/kuard-amd64:1
       imagePullPolicy: Always
       volumeMounts:
       - name: tls-certs

11-4-kuard-secret-ips.yaml

@@ -5,7 +5,7 @@ metadata:
 spec:
   containers:
     - name: kuard-tls
-      image: gcr.io/kuar-demo/kuard-amd64:blue
+      image: gcr.io/kuar-demo/kuard-amd64:1
       imagePullPolicy: Always
       volumeMounts:
       - name: tls-certs

14-1-parse.yaml

@@ -0,0 +1,26 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: parse-server
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      run: parse-server
+  template:
+    metadata:
+      labels:
+        run: parse-server
+    spec:
+      containers:
+      - name: parse-server
+        image: ${DOCKER_USER}/parse-server
+        env:
+        - name: PARSE_SERVER_DATABASE_URI
+          value: "mongodb://mongo-0.mongo:27017,\
+            mongo-1.mongo:27017,mongo-2.mongo\
+            :27017/dev?replicaSet=rs0"
+        - name: PARSE_SERVER_APP_ID
+          value: "my-app-id"
+        - name: PARSE_SERVER_MASTER_KEY
+          value: "my-master-key"

14-10-redis.yaml

@@ -0,0 +1,40 @@
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: redis
+spec:
+  replicas: 3
+  serviceName: redis
+  selector:
+    matchLabels:
+      app: redis
+  template:
+    metadata:
+      labels:
+        app: redis
+    spec:
+      containers:
+      - command: [sh, -c, source /redis-config/init.sh ]
+        image: redis:3.2.7-alpine
+        name: redis
+        ports:
+        - containerPort: 6379
+          name: redis
+        volumeMounts:
+        - mountPath: /redis-config
+          name: config
+        - mountPath: /redis-data
+          name: data
+      - command: [sh, -c, source /redis-config/sentinel.sh]
+        image: redis:3.2.7-alpine
+        name: sentinel
+        volumeMounts:
+        - mountPath: /redis-config
+          name: config
+      volumes:
+      - configMap:
+          defaultMode: 420
+          name: redis-config
+        name: config
+      - emptyDir:
+        name: data

14-2-parse-service.yaml

@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: parse-server
+  namespace: default
+spec:
+  ports:
+  - port: 1337
+    protocol: TCP
+    targetPort: 1337
+  selector:
+    run: parse-server

14-3-ghost-config.js

@@ -0,0 +1,25 @@
+var path = require('path'),
+    config;
+
+config = {
+    development: {
+        url: 'http://localhost:2368',
+        database: {
+            client: 'sqlite3',
+            connection: {
+                filename: path.join(process.env.GHOST_CONTENT,
+                                    '/data/ghost-dev.db')
+            },
+            debug: false
+        },
+        server: {
+            host: '0.0.0.0',
+            port: '2368'
+        },
+        paths: {
+            contentPath: path.join(process.env.GHOST_CONTENT, '/')
+        }
+    }
+};
+
+module.exports = config;

14-4-ghost.yaml

@@ -0,0 +1,30 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: ghost
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      run: ghost
+  template:
+    metadata:
+      labels:
+        run: ghost
+    spec:
+      containers:
+      - image: ghost
+        name: ghost
+        command:
+        - sh
+        - -c
+        - cp /ghost-config/ghost-config.js /var/lib/ghost/config.js
+          && docker-entrypoint.sh node current/index.js
+        volumeMounts:
+        - mountPath: /ghost-config
+          name: config
+      volumes:
+      - name: config
+        configMap:
+          defaultMode: 420
+          name: ghost-config

14-4-master.conf

@@ -0,0 +1,4 @@
+bind 0.0.0.0
+port 6379
+
+dir /redis-data

14-5-slave.conf

@@ -0,0 +1,6 @@
+bind 0.0.0.0
+port 6379
+
+dir .
+
+slaveof redis-0.redis 6379

14-6-sentinel.conf

@@ -0,0 +1,7 @@
+bind 0.0.0.0
+port 26379
+
+sentinel monitor redis redis-0.redis 6379 2
+sentinel parallel-syncs redis 1
+sentinel down-after-milliseconds redis 10000
+sentinel failover-timeout redis 20000

14-7-init.sh

@@ -0,0 +1,6 @@
+#!/bin/bash
+if [[ ${HOSTNAME} == 'redis-0' ]]; then
+  redis-server /redis-config/master.conf
+else
+  redis-server /redis-config/slave.conf
+fi

14-8-sentinel.sh

@@ -0,0 +1,8 @@
+#!/bin/bash
+while ! ping -c 1 redis-0.redis; do
+    echo 'Waiting for server'
+    sleep 1
+done
+
+redis-sentinel /redis-config/sentinel.conf
+

14-9-redis-service.yaml

@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: redis
+spec:
+  ports:
+  - port: 6379
+    name: peer
+  clusterIP: None
+  selector:
+    app: redis

19-1-kuard-pod-securitycontext.yaml

@@ -1,21 +0,0 @@
-apiVersion: v1
-kind: Pod
-metadata:
-  name: kuard
-spec:
-  securityContext:
-    runAsNonRoot: true
-    runAsUser: 1000
-    runAsGroup: 3000
-    fsGroup: 2000
-  containers:
-    - image: gcr.io/kuar-demo/kuard-amd64:blue
-      name: kuard
-      securityContext:
-          allowPrivilegeEscalation: false
-          readOnlyRootFilesystem: true
-          privileged: false
-      ports:
-        - containerPort: 8080
-          name: http
-          protocol: TCP

19-10-kuard-pod.yaml

@@ -1,14 +0,0 @@
-apiVersion: v1
-kind: Pod
-metadata:
-  name: kuard
-  labels:
-    app: kuard
-spec:
-  containers:
-    - image: gcr.io/kuar-demo/kuard-amd64:blue
-      name: kuard
-      ports:
-        - containerPort: 8080
-          name: http
-          protocol: TCP

19-11-networkpolicy-default-deny.yaml

@@ -1,8 +0,0 @@
-apiVersion: networking.k8s.io/v1
-kind: NetworkPolicy
-metadata:
-  name: default-deny-ingress
-spec:
-  podSelector: {}
-  policyTypes:
-  - Ingress

19-12-networkpolicy-kuard-allow-test-source.yaml

@@ -1,13 +0,0 @@
-kind: NetworkPolicy
-apiVersion: networking.k8s.io/v1
-metadata:
-  name: access-kuard
-spec:
-  podSelector:
-    matchLabels:
-      app: kuard
-  ingress:
-    - from:
-      - podSelector:
-          matchLabels:
-            run: test-source

19-2-amicontained-pod.yaml

@@ -1,10 +0,0 @@
-apiVersion: v1
-kind: Pod
-metadata:
-  name: amicontained
-spec:
-  containers:
-    - image: jess/amicontained:v0.4.9
-      name: amicontained
-      command: [ "/bin/sh", "-c", "--" ]
-      args: [ "amicontained" ]

19-3-amicontained-pod-securitycontext.yaml

@@ -1,26 +0,0 @@
-apiVersion: v1
-kind: Pod
-metadata:
-  name: amicontained
-  annotations:
-    container.apparmor.security.beta.kubernetes.io/amicontained: "runtime/default"
-spec:
-  securityContext:
-    runAsNonRoot: true
-    runAsUser: 1000
-    runAsGroup: 3000
-    fsGroup: 2000
-    seccompProfile:
-      type: RuntimeDefault
-  containers:
-    - image: jess/amicontained:v0.4.9
-      name: amicontained
-      command: [ "/bin/sh", "-c", "--" ]
-      args: [ "amicontained" ]
-      securityContext:
-        capabilities:
-            add: ["SYS_TIME"]
-            drop: ["NET_BIND_SERVICE"]
-        allowPrivilegeEscalation: false
-        readOnlyRootFilesystem: true
-        privileged: false

19-4-baseline-ns.yaml

@@ -1,11 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: baseline-ns
-  labels:
-    pod-security.kubernetes.io/enforce: baseline
-    pod-security.kubernetes.io/enforce-version: v1.22
-    pod-security.kubernetes.io/audit: restricted
-    pod-security.kubernetes.io/audit-version: v1.22
-    pod-security.kubernetes.io/warn: restricted
-    pod-security.kubernetes.io/warn-version: v1.22

19-5-baseline-ns.yaml

@@ -1,11 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: baseline-ns
-  labels:
-    pod-security.kubernetes.io/enforce: baseline
-    pod-security.kubernetes.io/enforce-version: v1.22
-    pod-security.kubernetes.io/audit: restricted
-    pod-security.kubernetes.io/audit-version: v1.22
-    pod-security.kubernetes.io/warn: restricted
-    pod-security.kubernetes.io/warn-version: v1.22

19-6-kuard-pod.yaml

@@ -1,14 +0,0 @@
-apiVersion: v1
-kind: Pod
-metadata:
-  name: kuard
-  labels:
-    app: kuard
-spec:
-  containers:
-    - image: gcr.io/kuar-demo/kuard-amd64:blue
-      name: kuard
-      ports:
-        - containerPort: 8080
-          name: http
-          protocol: TCP

19-7-service-account.yaml

@@ -1,5 +0,0 @@
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: default
-automountServiceAccountToken: false

19-8-kuard-pod-runtimeclass.yaml

@@ -1,15 +0,0 @@
-apiVersion: v1
-kind: Pod
-metadata:
-  name: kuard
-  labels:
-    app: kuard
-spec:
-  runtimeClassName: firecracker
-  containers:
-    - image: gcr.io/kuar-demo/kuard-amd64:blue
-      name: kuard
-      ports:
-        - containerPort: 8080
-          name: http
-          protocol: TCP

19-9-networkpolicy-default-deny.yaml

@@ -1,8 +0,0 @@
-apiVersion: networking.k8s.io/v1
-kind: NetworkPolicy
-metadata:
-  name: default-deny-ingress
-spec:
-  podSelector: {}
-  policyTypes:
-  - Ingress

20-1-allowedrepos-constraint-template.yaml

@@ -1,42 +0,0 @@
-apiVersion: templates.gatekeeper.sh/v1beta1
-kind: ConstraintTemplate
-metadata:
-  name: k8sallowedrepos
-  annotations:
-    description: Requires container images to begin with a repo string from a 
-      specified list.
-spec:
-  crd:
-    spec:
-      names:
-        kind: K8sAllowedRepos
-      validation:
-        # Schema for the `parameters` field
-        openAPIV3Schema:
-          properties:
-            repos:
-              type: array
-              items:
-                type: string
-  targets:
-    - target: admission.k8s.gatekeeper.sh
-      rego: |
-        package k8sallowedrepos
-
-        violation[{"msg": msg}] {
-          container := input.review.object.spec.containers[_]
-          not strings.any_prefix_match(container.image, input.parameters.repos)
-          msg := sprintf("container <%v> has an invalid image repo <%v>, allowed repos are %v", [container.name, container.image, input.parameters.repos])
-        }
-
-        violation[{"msg": msg}] {
-          container := input.review.object.spec.initContainers[_]
-          not strings.any_prefix_match(container.image, input.parameters.repos)
-          msg := sprintf("initContainer <%v> has an invalid image repo <%v>, allowed repos are %v", [container.name, container.image, input.parameters.repos])
-        }
-
-        violation[{"msg": msg}] {
-          container := input.review.object.spec.ephemeralContainers[_]
-          not strings.any_prefix_match(container.image, input.parameters.repos)
-          msg := sprintf("ephemeralContainer <%v> has an invalid image repo <%v>, allowed repos are %v", [container.name, container.image, input.parameters.repos])
-        }

20-2-allowedrepos-constraint.yaml

@@ -1,15 +0,0 @@
-apiVersion: constraints.gatekeeper.sh/v1beta1
-kind: K8sAllowedRepos
-metadata:
-  name: repo-is-kuar-demo
-spec:
-  enforcementAction: deny
-  match:
-    kinds:
-      - apiGroups: [""]
-        kinds: ["Pod"]
-    namespaces:
-      - "default"
-  parameters:
-    repos:
-      - "gcr.io/kuar-demo/"

20-3-compliant-pod.yaml

@@ -1,12 +0,0 @@
-apiVersion: v1
-kind: Pod
-metadata:
-  name: kuard
-spec:
-  containers:
-    - image: gcr.io/kuar-demo/kuard-amd64:blue
-      name: kuard
-      ports:
-        - containerPort: 8080
-          name: http
-          protocol: TCP

20-4-noncompliant-pod.yaml

@@ -1,8 +0,0 @@
-apiVersion: v1
-kind: Pod
-metadata:
-  name: nginx-noncompliant
-spec:
-  containers:
-    - name: nginx
-      image: nginx

20-5-allowedrepos-constraint-dryrun.yaml

@@ -1,15 +0,0 @@
-apiVersion: constraints.gatekeeper.sh/v1beta1
-kind: K8sAllowedRepos
-metadata:
-  name: repo-is-kuar-demo
-spec:
-  enforcementAction: dryrun
-  match:
-    kinds:
-      - apiGroups: [""]
-        kinds: ["Pod"]
-    namespaces:
-      - "default"
-  parameters:
-    repos:
-      - "gcr.io/kuar-demo/"

20-6-imagepullpolicyalways-mutation.yaml

@@ -1,19 +0,0 @@
-apiVersion: mutations.gatekeeper.sh/v1alpha1
-kind: Assign
-metadata:
-  name: demo-image-pull-policy
-spec:
-  applyTo:
-  - groups: [""]
-    kinds: ["Pod"]
-    versions: ["v1"]
-  match:
-    scope: Namespaced
-    kinds:
-    - apiGroups: ["*"]
-      kinds: ["Pod"]
-    excludedNamespaces: ["system"]
-  location: "spec.containers[name:*].imagePullPolicy"
-  parameters:
-    assign:
-      value: Always

20-7-config-sync.yaml

@@ -1,14 +0,0 @@
-apiVersion: config.gatekeeper.sh/v1alpha1
-kind: Config
-metadata:
-  name: config
-  namespace: "gatekeeper-system"
-spec:
-  sync:
-    syncOnly:
-      - group: ""
-        version: "v1"
-        kind: "Namespace"
-      - group: ""
-        version: "v1"
-        kind: "Pod"

20-8-uniqueingresshost-constraint-template.yaml

@@ -1,31 +0,0 @@
-apiVersion: templates.gatekeeper.sh/v1beta1
-kind: ConstraintTemplate
-metadata:
-  name: k8suniqueingresshost
-  annotations:
-    description: Requires all Ingress hosts to be unique.
-spec:
-  crd:
-    spec:
-      names:
-        kind: K8sUniqueIngressHost
-  targets:
-    - target: admission.k8s.gatekeeper.sh
-      rego: |
-        package k8suniqueingresshost
-
-        identical(obj, review) {
-          obj.metadata.namespace == review.object.metadata.namespace
-          obj.metadata.name == review.object.metadata.name
-        }
-
-        violation[{"msg": msg}] {
-          input.review.kind.kind == "Ingress"
-          regex.match("^(extensions|networking.k8s.io)$", input.review.kind.group)
-          host := input.review.object.spec.rules[_].host
-          other := data.inventory.namespace[_][otherapiversion]["Ingress"][name]
-          regex.match("^(extensions|networking.k8s.io)/.+$", otherapiversion)
-          other.spec.rules[_].host == host
-          not identical(other, input.review)
-          msg := sprintf("ingress host conflicts with an existing ingress <%v>", [host])
-        }

5-1-kuard-pod.yaml

@@ -4,7 +4,7 @@ metadata:
   name: kuard
 spec:
   containers:
-  - image: gcr.io/kuar-demo/kuard-amd64:blue
+  - image: gcr.io/kuar-demo/kuard-amd64:1
     name: kuard
     ports:
     - containerPort: 8080

5-2-kuard-pod-health.yaml

@@ -4,7 +4,7 @@ metadata:
   name: kuard
 spec:
   containers:
-    - image: gcr.io/kuar-demo/kuard-amd64:blue
+    - image: gcr.io/kuar-demo/kuard-amd64:1
       name: kuard
       livenessProbe:
         httpGet:

5-3-kaurd-pod-resreq.yaml

@@ -4,7 +4,7 @@ metadata:
   name: kuard
 spec:
   containers:
-    - image: gcr.io/kuar-demo/kuard-amd64:blue
+    - image: gcr.io/kuar-demo/kuard-amd64:1
       name: kuard
       resources:
         requests:

8-1-kuard-rs.yaml

@@ -5,6 +5,9 @@ metadata:
     app: kuard
     version: "2"
   name: kuard
+  labels:
+    app: kuard
+    version: "2"
 spec:
   replicas: 1
   selector:
@@ -19,8 +22,4 @@ spec:
     spec:
       containers:
         - name: kuard
-          image: "gcr.io/kuar-demo/kuard-amd64:green"
-          resources:
-            requests:
-              cpu: "500m"
-              memory: "128Mi"
+          image: "gcr.io/kuar-demo/kuard-amd64:2"

8-1-simple-ingress.yaml

@@ -1,10 +0,0 @@
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: simple-ingress
-spec:
-  defaultBackend:
-    service:
-      name: alpaca
-      port:
-        number: 8080

8-2-host-ingress.yaml

@@ -1,21 +0,0 @@
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: host-ingress
-spec:
-  defaultBackend:
-    service:
-      name: be-default
-      port:
-        number: 8080
-  rules:
-  - host: alpaca.example.com
-    http:
-      paths:
-      - pathType: Prefix
-        path: /
-        backend:
-          service:
-            name: alpaca
-            port:
-              number: 8080

8-3-path-ingress.yaml

@@ -1,23 +0,0 @@
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: path-ingress
-spec:
-  rules:
-  - host: bandicoot.example.com
-    http:
-      paths:
-      - pathType: Prefix
-        path: "/"
-        backend:
-          service:
-            name: bandicoot
-            port:
-              number: 8080
-      - pathType: Prefix
-        path: "/a/"
-        backend:
-          service:
-            name: alpaca
-            port:
-              number: 8080

8-4-tls-secret.yaml

@@ -1,9 +0,0 @@
-apiVersion: v1
-kind: Secret
-metadata:
-  creationTimestamp: null
-  name: tls-secret-name
-type: kubernetes.io/tls
-data:
-  tls.crt: <base64 encoded certificate>
-  tls.key: <base64 encoded private key>

8-5-tls-ingress.yaml

@@ -1,20 +0,0 @@
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: tls-ingress
-spec:
-  tls:
-  - hosts:
-    - alpaca.example.com
-    secretName: tls-secret-name
-  rules:
-  - host: alpaca.example.com
-    http:
-      paths:
-        - pathType: Prefix
-          path: "/"
-          backend:
-            service:
-              name: alpaca
-              port:
-                number: 8080

9-2-nginx-fast-storage.yaml

@@ -1,5 +1,5 @@
 apiVersion: apps/v1
-kind: DaemonSet
+kind: "DaemonSet"
 metadata:
   labels:
     app: nginx