Here is the app built by a GH Action and published to a GH repository
The app config contains Kubernetes manifests used to deploy to the published artifact the target Kubernetes clusters.
Using config-sync, the config is pulled into the Kubernetes cluster leveraging GH branches to deploy across clusters. Using nomos, Kelsey checks the config status on the clusters
Pushed v2 to the repo which published a new container which bumps the deployment manifest to the v2 container. That is then rolled out to a canary cluster attached to a canary LB.
• • •
Missing some Tweet in this thread? You can try to
force a refresh
Every #Kubernetes cluster admin MUST watch "Advanced Persistence Threats" session from @IanColdwater@bradgeesaman#KubeCon#CloudNative. So much knowledge and goodness - thanks for sharing. I've been trying to get people to understand this attack vector for a long time 👇
You all did a much better job than me articulating it. Ahhh!!! Watching this hurts! I even wrote a chapter on this in Kubernetes Best Practices O'Reilly book. I wake up in cold sweats knowing how easy it is to leave this open! Biting my nails again.
Heartburn watching this. I suspect my pain isn't going to stop here. Anxious for what's going to happen here.
A heartwarming story on the power of open source community, a thread - @khnidk and I have been working on a rather large change in #Kubernetes to allow support for ipv4/ipv6 dual stack. It's a MASSIVE change which touches many parts of the code (as you can imagine). 1/10
This week is code freeze for the 1.15 release and we are trying to get this change in. It needs review by the sponsoring sig of the KEP. Which in this case is sig-network 2/10
So Kal did the work and got the PR ready and handed it over to sig-network. Extremely tight timeline given the size. Could we have gotten it to them earlier, sure. We probably could have done a lot of things to make this easier on everyone. 3/10