Artikel: Kubernetes auf Talos Linux


Listing: Terraform-Datei für Cluster-Erstellung

module "talos" {
source = "hcloud-talos/talos/hcloud"
version = "2.18.0"
talos_version = "v1.11.0"
kubernetes_version = "1.30.3"
hcloud_token =
"<YOUR_HETZNER_CLOUD_API_TOKEN>"
firewall_talos_api_source =
["<YOUR_PUBLIC_IP>"]
firewall_kube_api_source =
["<YOUR_PUBLIC_IP>"]
cluster_name = "<YOUR_CLUSTER_NAME>"
datacenter_name = "fsn1-dc14"
control_plane_count = 1
control_plane_server_type = "cx22"
deploy_prometheus_operator_crds = true
worker_nodes = [
{
type = "cx32"
labels = {
"node.kubernetes.io/instance-type" = "cx32"
} } ] }
output "talosconfig" {
value = module.talos.talosconfig
sensitive = true
}
output "kubeconfig" {
value = module.talos.kubeconfig
sensitive = true
}



Artikel: DevSecOps mit Jenkins, Trivy und Kubernetes

Listing: Trivy in der Pipeline

stage('Trivy Image Scan') {
steps {
sh '''
trivy image --exit-code 0 --severity LOW,
MEDIUM,HIGH
--quiet --format json -o trivy-report.json
myapp:${BUILD_TAG}
trivy image --exit-code 1
--severity CRITICAL
--quiet --format json -o
trivy-report-critical.json
myapp:${BUILD_TAG}
'''
}
post {
always {
sh '''
trivy convert --format template --template
"@/contrib/html.tpl"
-o trivy-report.html trivy-report.json
trivy convert --format template --template
"@/contrib/junit.tpl"
-o trivy-report.xml trivy-report.json
'''
publishHTML(target: [reportName:
'Trivy Report', reportDir: '.',
reportFiles: 'trivy-report.html'])
junit 'trivy-report.xml'
}
}
}



Artikel: Signaturen, Attestationen und Policys im Zusammenspiel


Listing: ClusterPolicy

apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
name: verify-image
spec:
validationFailureAction: Enforce
background: false
rules:
- name: verify-image
match:
any:
- resources:
kinds:
- Pod
verifyImages:
- imageReferences:
- "ghcr.io/kyverno/test-verify-image*"
mutateDigest: true
attestors:
- count: 1
entries:
- keys:
publicKeys: |
-----BEGIN PUBLIC KEY-----
MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE8nXRh950IZbRj8Ra/N9sbqOPZrfM
5/KAQN0/KjHcorm/J5yctVd7iEcnessRQjU917hmKO6JWVGHpDguIyakZA==
-----END PUBLIC KEY-----