PodSecurityPolicy on existing Kubernetes clusters

Burnt by enabling PSPs on existing Kubernetes and wondering why everything still works

Suraj Deshmukh

2 minute read

I enabled PodSecurityPolicy on a minikube cluster by appending PodSecurityPolicy to the apiserver flag in minikube like this: –extra-config=apiserver.enable-admission-plugins=Initializers,NamespaceLifecycle,\ LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,\ NodeRestriction,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,\ ResourceQuota,PodSecurityPolicy Ideally when you have PSP enabled and if you don’t define any PSP and authorize it with right RBAC no pod will start in the cluster. But what I saw was that there were some pods still running in kube-system namespace. $ kubectl -n kube-system get pods NAME READY STATUS RESTARTS AGE coredns-576cbf47c7-g2t8v 11 Running 4 5d11h etcd-minikube 11 Running 2 5d11h heapster-bn5xp 11 Running 2 5d11h influxdb-grafana-qzpv4 22 Running 4 5d11h kube-addon-manager-minikube 11 Running 2 5d11h kube-controller-manager-minikube 11 Running 1 4d20h kube-scheduler-minikube 11 Running 2 5d11h kubernetes-dashboard-5bb6f7c8c6-9d564 11 Running 8 5d11h storage-provisioner 11 Running 7 5d11h Which got me thinking what is wrong with the way PSPs work.

Road to CKA

My experience with CKA exam preparation

Suraj Deshmukh

4 minute read

I passed CKA exam with 92% marks on 19th October 2018. A lot of folks are curious about how to prepare and what resources to follow. Here is my list of things to do and list of resources that might help you on successful CKA exam. The duration of exam is three hours, which is enough time if you do good practice. The exam is pretty straight forward and tests your Kubernetes hands-on knowledge, so whatever you read please try to do it on a real cluster.

How to disable your Chrome Ctrl + W keybinding

Learn how to disable the shortcut Ctrl + W altogether on your GNOME

Suraj Deshmukh

2 minute read

I am about to attempt the CKA exam and it has a browser based terminal. And I am used to this terminal shortcut Ctrl + W which deletes a word. But the same shortcut in browser can close a tab. Since this exam is combination of both I am afraid I might close my exam tab while deleting a word in terminal. Now the only solution to this is disabling the shortcut in chrome.

Add new Node to k8s cluster with cert rotation

Use this technique to add node to the cluster without providing any certificates

Suraj Deshmukh

3 minute read

The setup here is created by following Kubernetes the Hard Way by Kelsey Hightower. So if you are following along in this then do all the setup till the step Bootstrapping the Kubernetes Worker Nodes. In this just don’t start the kubelet, start other services like containerd and kube-proxy. master node Following the docs of TLS Bootstrapping, let’s first create the token authentication file. Create a file with following content:

Adding new worker to existing Kubernetes cluster

Step by step guide to add new node

Suraj Deshmukh

5 minute read

To setup a multi-node Kubernetes cluster just run this script and you will have a cluster with 3 masters and 3 workers. $ kubectl get nodes -o wide NAME STATUS ROLES AGE VERSION INTERNAL-IP EXTERNAL-IP OS-IMAGE KERNEL-VERSION CONTAINER-RUNTIME worker-0 Ready <none> 1h v1.11.2 192.168.199.20 <none> Ubuntu 18.04.1 LTS 4.15.0-33-generic cri-o://1.11.2 worker-1 Ready <none> 1h v1.11.2 192.168.199.21 <none> Ubuntu 18.04.1 LTS 4.15.0-33-generic cri-o://1.11.2 worker-2 Ready <none> 1h v1.11.2 192.168.199.22 <none> Ubuntu 18.

Single node Kubernetes Cluster on Fedora with SELinux enabled

Kubeadm to install Single Node K8S with SELinux

Suraj Deshmukh

2 minute read

Start a single node fedora machine, using whatever method but I have used this Vagrantfile to do it:

-- mode: ruby -- # vi: set ft=ruby : Vagrant.configure("2") do |config| config.vm.define "fedora" do |fedora| fedora.vm.box = "fedora/28-cloud-base" config.vm.hostname = "fedora" end config.vm.provider "virtualbox" do |virtualbox, override| virtualbox.memory = 4096 virtualbox.cpus = 4 end config.vm.provision "shell", privileged: false, inline: <<-SHELL echo ‘127.0.0.1 localhost’ | cat - /etc/hosts > temp && sudo mv temp /etc/hosts SHELL end Now start it and ssh into it:

HostPath volumes and it's problems

Kubernetes HostPath volume good way to nuke your Kubernetes Nodes

Suraj Deshmukh

8 minute read

This post will demonstrate how Kubernetes HostPath volumes can help you get access to the Kubernetes nodes. Atleast you can play with the filesystem of the node on which you pod is scheduled on. You can get access to other containers running on the host, certificates of the kubelet, etc. I have a 3-master and 3-node cluster and setup using this script, running in a Vagrant environment. All the nodes are in ready state:

HTTPS during development using 'mkcert'

Use https even during your development

Suraj Deshmukh

2 minute read

It’s always a hassle creating certificates and lot of technical jargons involved. This can be simplified, using mkcert. Install by following one of the steps mentioned in the docs. Once installed just run: $ mkcert -install Created a new local CA at "/home/hummer/.local/share/mkcert" 💥 [sudo] password for hummer: The local CA is now installed in the system trust store! ⚡ The local CA is now installed in the Firefox and/or Chrome/Chromium trust store (requires browser restart)!

Golang struct tags gotchas

Struct tags can give you problems you didn't see coming ;-)

Suraj Deshmukh

1 minute read

In golang while using struct tag, the spaces make a lot of difference. For example look at the following code. type PodStatus struct { Status string json: &quot;,status&quot; } If you run go vet on this piece of code you will get following error: $ go vet types.go # command-line-arguments ./types.go:28: struct field tag json: &quot;,status&quot; not compatible with reflect.StructTag.Get: bad syntax for struct tag value Now this does not tell us what is wrong with the struct tag, json: ",status".

Access etcd in OpenShift origin

Access the etcd in OpenShift started by oc cluster up

Suraj Deshmukh

1 minute read

How do you access the etcd that is being used by the OpenShift started by oc cluster up or using minishift. If you are using minishift then get docker environment access of the minishift VM by running following commands. eval $(minishift docker-env) && eval $(minishift oc-env) Exec into the container named origin that runs OpenShift and all the needed services. $ docker exec -it origin bash First install the etcdctl needed to talk to etcd.