Posts in 2018

  • Shared storage with S3 backend

    Monday, June 11, 2018 in Blogs

    The storage is definitely the most complex and important part of an application setup, once this part is completed, one of the most problematic parts could be solved. Mounting a S3 bucket into a pod using FUSE allows to access data stored in S3 via …

    Read more

  • ReadWriteMany - Dynamically Provisioned Persistent Volumes Using Amazon EFS

    Monday, June 11, 2018 in Blogs

    The efs-provisioner allows you to mount EFS storage as PersistentVolumes in kubernetes. It consists of a container that has access to an AWS EFS resource. The container reads a configmap containing the EFS filesystem ID, the AWS region and the name …

    Read more

  • Namespace Scope

    Monday, June 11, 2018 in Blogs

    Should I use: ❌ one namespace per user/developer? ❌ one namespace per team? ❌ one per service type? ❌ one namespace per application type? 😄 one namespace per running instance of your application? Apply the Principle of Least Privilege All user …

    Read more

  • Namespace Isolation

    Monday, June 11, 2018 in Blogs

    …or DENY all traffic from other namespaces You can configure a NetworkPolicy to deny all traffic from other namespaces while allowing all traffic coming from the same namespace the pod is deployed to. There are many reasons why you may chose …

    Read more

  • Kubernetes is available in Docker for Mac 17.12 CE

    Monday, June 11, 2018 in Blogs

    Kubernetes is only available in Docker for Mac 17.12 CE and higher on the Edge channel. Kubernetes support is not included in Docker for Mac Stable releases. To find out more about Stable and Edge channels and how to switch between them, see …

    Read more

  • Hardening the Gardener Community Setup

    Monday, June 11, 2018 in Blogs

    The Gardener project team has analyzed the impact of the Gardener CVE-2018-2475 and the Kubernetes CVE-2018-1002105 on the Gardener Community Setup. Following some recommendations it is possible to mitigate both vulnerabilities. Read more on …

    Read more

  • Frontend HTTPS

    Monday, June 11, 2018 in Blogs

    For encrypted communication between the client to the load balancer, you need to specify a TLS private key and certificate to be used by the ingress controller. Create a secret in the namespace of the ingress containing the TLS private key and …

    Read more

  • Cookies are dangerous...

    Monday, June 11, 2018 in Blogs

    …they mess up the figure. For a team event during the Christmas season we decided to completely reinterpret the topic cookies… since the vegetables have gone on a well-deserved vacation. :-) Get recipe on Gardener Cookies.

    Read more

  • Big things come in small packages

    Monday, June 11, 2018 in Blogs

    Microservices tend to use smaller runtimes but you can use what you have today - and this can be a problem in kubernetes. Switching your architecture from a monolith to microservices has many advantages, both in the way you write software and the way …

    Read more

  • Auditing Kubernetes for Secure Setup

    Monday, June 11, 2018 in Blogs

    In summer 2018, the Gardener project team asked Kinvolk to execute several penetration tests in its role as third-party contractor. The goal of this ongoing work is to increase the security of all Gardener stakeholders in the open source community. …

    Read more