Today, Cloud Native Security is more and more important. the Falco is sysdig open source cloud security tools. We can install to independent host or kubernetes cluster Please reference previous post about basic and install falco: Change every independent machine hostname to a meaningful name 1hostnamectl set-hostname …

read more

For greater isolation and convenience, we can use farget as the run time environment for eks. Create eks farget execute role named: AmazonEKSFargatePodExecutionRole the TrustPolicy statements like following 1# trust policy 2{ 3 "Version": "2012-10-17", 4 "Statement": [ 5 { 6 "Effect": …

read more

Create eks node group label and taint 1labels = { 2 "node-group" : "spotInstances" 3} 4taints = [ 5 { 6 effect = "NO_SCHEDULE" 7 key = "devops" 8 value = "forceSchedule" 9 } 10] Create priorityClass one to placeholder other one to nornal schedule 1apiVersion: scheduling.k8s.io/v1 …

read more

Sometimes intercept external access traffic in mesh to internal service is needed Http to Internal service when access external domain in mesh network when access http://edition.cnn.com in mesh network then should redirect to hello.test-ns.svc.cluster.local internal service. Create a ServiceEntry resource to defination …

read more

Installation and Configuration istio use terraform Pull helm chats to local 1# add istio helm chat repo url 2helm repo add istio https://istio-release.storage.googleapis.com/charts 3# download latest helm chat packages 4helm pull istio/base 5helm pull istio/istiod 6helm pull istio/gateway 7 8# uncompress to relative …

read more