saschagrunert

#!/usr/bin/env bash
set -euo pipefail

# Following: https://developer.hashicorp.com/vault/tutorials/kubernetes/vault-secrets-operator

# Install vault
helm repo add hashicorp https://helm.releases.hashicorp.com
helm repo update

helm search repo hashicorp/vault

saschagrunert

{
  "ociVersion": "1.2.0",
  "process": {
    "user": {
      "uid": 0,
      "gid": 0,
      "additionalGids": [0, 10]
    },
    "args": ["sh", "-c", "top"],
    "env": [

saschagrunert

execve("/usr/sbin/ping6", ["ping6", "-c1", "1100:200::3"], 0xffffdc418380 /* 16 vars */) = 0
brk(NULL)                               = 0xaaaabc4f5000
mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xffffb63e4000
faccessat(AT_FDCWD, "/etc/ld.so.preload", R_OK) = -1 ENOENT (No such file or directory)
openat(AT_FDCWD, "/etc/ld.so.cache", O_RDONLY|O_CLOEXEC) = 3
newfstatat(3, "", {st_mode=S_IFREG|0644, st_size=9207, ...}, AT_EMPTY_PATH) = 0
mmap(NULL, 9207, PROT_READ, MAP_PRIVATE, 3, 0) = 0xffffb63e1000
close(3)                                = 0
openat(AT_FDCWD, "/lib64/libcap.so.2", O_RDONLY|O_CLOEXEC) = 3
read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0\267\0\1\0\0\0\0\0\0\0\0\0\0\0"..., 832) = 832

saschagrunert

The k8s.io/cri-client Staging Repository

Timeline: March 7 - May 31

• k/k: External Repository Staging Area

Paperwork

• Mailing list discussion
• Tracking issue: REQUEST: Create kubernetes/cri-client staging repository

saschagrunert

---
# Verify signed image using a public key without a fulcio issued certificate.
apiVersion: config.openshift.io/v1alpha1
kind: ImagePolicy
metadata:
  name: image-is-signed
spec:
  images:
    - hostname:5000/myns/sigstore-signed-with-full-references
  policy:

saschagrunert

package api

import (
	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
)

type ImagePolicy struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`
	Spec              ImagePolicySpec   `json:"spec"`

saschagrunert

# -*- mode: ruby -*-
# vi: set ft=ruby :

# Vagrant box for testing
Vagrant.configure("2") do |config|
  config.vm.box = "fedora/35-cloud-base"
  memory = 6144
  cpus = 4

  config.vm.provider :virtualbox do |v|

saschagrunert

apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
metadata:
  labels:
    machineconfiguration.openshift.io/role: worker
  name: recreate-backingfsblockdev
spec:
  config:
    ignition:
      version: 3.2.0

saschagrunert

#!/usr/bin/env bash
set -euox pipefail

TAG=v1.26.0-rc.1
URL=https://dl.k8s.io/release/$TAG/bin/linux/amd64
BIN=kubectl

for EXT in "" .sig .cert; do
    FILE=$BIN$EXT
    curl -sSfL --retry 3 --retry-delay 3 $URL/$FILE -o $FILE

saschagrunert

{
  "defaultAction": "SCMP_ACT_ERRNO",
  "architectures": ["SCMP_ARCH_X86_64", "SCMP_ARCH_X86", "SCMP_ARCH_X32"],
  "syscalls": [
    {
      "names": [
        "accept4",
        "access",
        "arch_prctl",
        "bind",