Introduction When we use affinity rules for our deployment, we often prefer to use preferredDuringSchedulingIgnoredDuringExecution. This rule is a soft requirement that attempts to allocate pods across different nodes. However, when only one worker node is in the Ready state, all replicas can be allocated to the single available worker node. …

Overview In this document, we will discuss the Kyverno PolicyWriter Operator which is housed in this GitHub repository. This operator is specifically built for Kubernetes using a Kind named PolicyWriter. Its main function is to dynamically generate Kyverno policy rules based on the specifications of the PolicyWriter and enforce these rules…

I will try to explain how webhooks work inside Kubernetes and how we use the same logic with Kyverno. Before starting to go in deep into Kyverno Policy and ClusterPolicy rules, we must understand how Admission controllers work and how they communicate with Validation/Mutation webhooks in Kubernetes. I offer to read this documentation before starting to watch the video. All code files used in the video are located in this repository.

In this article I will try to explain usage of Kubernetes operators with Python Kopf. Unfortunately I cannot write real use case of operator which we use right now but, I have tried to write details which used in our operator. Just imagine when you will apply CRD with kind…

With this Python code files, we will compare statically defined MAC address list with MAC addresses of selected Cisco switches for special VlanID. Statically defined MAC address list you must write in the StaticMacs file. If script couldn’t find statically defined StaticMacs file it will print you how you can…

In this article I will show the way how to connect to some database which, works in Private subnet in GCP with automated secure way. What does it means, each time when some member of our team comes to devops engineers to get an access to the database, after official…

Before starting go in deep to the article I want to explain how I became to prepare these code files to achieve goal. …

In this article I will show the way how to automatically restart all pods in your deployment when secret value changed in predefined secret path. Hashicorp Vault deployed with HA mode (configured autounseal) and GC bucket backend. For authentication integrated with GitHub and Google OIDC. To get secrets inside of…

In this article I will show usage of Bank-Vaults prepared with BANZAICLOUD (now part of Cisco)team. Bank-Vaults have three components vault-operator , vault-secrets-webhook, and Hashicorp Vault itself. Vault Operator — after deployment of this operator we can install and configure Hashicorp vault in HA or single mode with CRD of…