nvimq/

Tools 7

Things I built to make the writeups hands-on: audit a manifest, break a cluster, boot Linux.

01 manifest audit What admission would say about your YAML Paste a manifest and get the verdict the API server would give it. First the full Kubernetes schema, so a misspelled field or a wrong type is caught the way kubectl catches it. Pods go through both Pod Security profiles, control by control. Roles, bindings, Services, Ingresses, NetworkPolicies and volumes go through a second pass for wildcards, cluster-admin, exposure and missing TLS. Every finding names the field and the fix, and the opinionated ones are labelled as opinions. the whole Kubernetes schema, in your browser, nothing leaves the page

pod.yaml scanning3 findings

apiVersion: v1kind: Podmetadata: { name: webapp }spec: hostNetwork: true containers: - name: web image: nginx:latest securityContext: privileged: true runAsUser: 0

baselineHost namespacesspec.hostNetwork baselinePrivilegedspec.containers[0].securityContext.privileged restrictedrunAsUserspec.containers[0].securityContext.runAsUser
02 architecture shapes What each shape costs you to run Seven ways to arrange a service, from one process to functions, each drawn the same way and answering the same seven questions: how many pipelines, what happens to your data, how much network and secret surface appears, what you must be able to see, and what wakes you up. Comparable instead of persuasive. opinion, not a standard, and it says so
03 terminal Replay of the verified sessions from my writeups Type the commands from an article and get the output I actually captured on a live cluster. Nothing is simulated by guesswork, every response here was copied from a real terminal. about 6 KB, starts instantly
04 kubernetes playground A cluster you can break on purpose Deploy pods in 3D, watch a rollout, then fix the CrashLoopBackOff you caused. Twenty campaign levels, a chaos mode and a sandbox, all driven by real kubectl commands. Progress is kept in your browser and can be exported to a file. Includes K8s Draw for sketching an architecture and exporting it as YAML. restyled from an Apache 2.0 project, runs on your machine
05 linux A real x86 machine emulated in your browser Boots a genuine Linux kernel with a busybox userland. Runs fully on your machine, keeps nothing, and disappears the moment you leave the page. It cannot reach the network or run containers. about 21 MB, boots on click
06 cloud shell A real Linux machine with Docker, on Google The emulator above cannot run containers, because an emulated CPU has no nested virtualisation. Cloud Shell can: a free Linux VM from Google with Docker and root already on it, enough to actually run the walkthroughs from my writeups. free, 50 hours a week, needs a Google account
07 ready-made clusters A real kubeadm cluster, already running Cloud Shell gives you a machine and leaves the cluster to you. iximiuz Labs hands over four small VMs with a multi-node Kubernetes cluster already provisioned and kubectl pointed at it, so a walkthrough starts at the interesting part instead of at the setup. There is a plain Docker box there too. free, one hour a day, needs an account with them