Prompt:
Complete this text code:

apparmor-test-deny-write (enforce)
apparmor-test-audit-write (enforce)

Response:
docker-default (enforce)
k8s-nginx (enforce)


Prompt:
Explain this text code:

apparmor-test-deny-write (enforce)
apparmor-test-audit-write (enforce)
docker-default (enforce)
k8s-nginx (enforce)

Response: This text code 4.3 - Restrict a Container's Access to Resources with AppArmor | For more details on loading profiles on nodes, see Setting up nodes with profiles.

Context: 4.3 - Restrict a Container's Access to Resources with AppArmor | For more details on loading profiles on nodes, see Setting up nodes with profiles.


Prompt:
Explain this yaml code:

securityContext:
  appArmorProfile:
    type: <profile_type>

Response: This yaml code 4.3 - Restrict a Container's Access to Resources with AppArmor | Where <profile_type> is one of:

Context: 4.3 - Restrict a Container's Access to Resources with AppArmor | Where <profile_type> is one of:


Prompt:
Explain this shell code:

kubectl exec <pod_name> -- cat /proc/1/attr/current

Response: This shell code 4.3 - Restrict a Container's Access to Resources with AppArmor | The output should look something like this:

Context: 4.3 - Restrict a Container's Access to Resources with AppArmor | The output should look something like this:


Prompt:
Complete this cpp code:

#include <tunables/global>

profile k8s-apparmor-example-deny-write flags=(attach_disconnected) {
  #include <abstractions/base>

Response:
  file,

  # Deny all file writes.
  deny /** w,
}

Context: 4.3 - Restrict a Container's Access to Resources with AppArmor | The profile needs to be loaded onto all nodes, since you don't know where the pod will be scheduled. For this example you can use SSH to install the profiles, but other approaches are discussed in Set


Prompt:
Explain this cpp code:

#include <tunables/global>

profile k8s-apparmor-example-deny-write flags=(attach_disconnected) {
  #include <abstractions/base>

  file,

  # Deny all file writes.
  deny /** w,
}

Response: This cpp code 4.3 - Restrict a Container's Access to Resources with AppArmor | The profile needs to be loaded onto all nodes, since you don't know where the pod will be scheduled. For this example you can use SSH to install the profiles, but other approaches are discussed in Set


Prompt:
Complete this shell code:

# This example assumes that node names match host names, and are reachable via SSH.
NODES=($( kubectl get node -o jsonpath='{.items[*].status.addresses[?(.type == "Hostname")].address}' ))

for NODE in ${NODES[*]}; do ssh $NODE 'sudo apparmor_parser -q <<EOF
#include <tunables/global>

profile k8s-apparmor-example-deny-write flags=(attach_disconnected) {
  #include <abstractions/base>

Response:
  file,

  # Deny all file writes.
  deny /** w,
}
EOF'
done

Context: 4.3 - Restrict a Container's Access to Resources with AppArmor | Next, run a simple "Hello AppArmor" Pod with the deny-write profile:


Prompt:
Explain this shell code:

# This example assumes that node names match host names, and are reachable via SSH.
NODES=($( kubectl get node -o jsonpath='{.items[*].status.addresses[?(.type == "Hostname")].address}' ))

for NODE in ${NODES[*]}; do ssh $NODE 'sudo apparmor_parser -q <<EOF
#include <tunables/global>

profile k8s-apparmor-example-deny-write flags=(attach_disconnected) {
  #include <abstractions/base>

  file,

  # Deny all file writes.
  deny /** w,
}
EOF'
done

Response: This shell code 4.3 - Restrict a Container's Access to Resources with AppArmor | Next, run a simple "Hello AppArmor" Pod with the deny-write profile:


Prompt:
Complete this yaml code:

apiVersion: v1
kind: Pod
metadata:
  name: hello-apparmor
spec:
  securityContext:

Response:
    appArmorProfile:
      type: Localhost
      localhostProfile: k8s-apparmor-example-deny-write
  containers:
  - name: hello
    image: busybox:1.28
    command: [ "sh", "-c", "echo 'Hello AppArmor!' && sleep 1h" ]

Context: 4.3 - Restrict a Container's Access to Resources with AppArmor | You can verify that the container is actually running with that profile by checking /proc/1/attr/current:


Prompt:
Explain this yaml code:

apiVersion: v1
kind: Pod
metadata:
  name: hello-apparmor
spec:
  securityContext:
    appArmorProfile:
      type: Localhost
      localhostProfile: k8s-apparmor-example-deny-write
  containers:
  - name: hello
    image: busybox:1.28
    command: [ "sh", "-c", "echo 'Hello AppArmor!' && sleep 1h" ]

Response: This yaml code 4.3 - Restrict a Container's Access to Resources with AppArmor | You can verify that the container is actually running with that profile by checking /proc/1/attr/current:


Prompt:
Explain this shell code:

kubectl exec hello-apparmor -- cat /proc/1/attr/current

Response: This shell code 4.3 - Restrict a Container's Access to Resources with AppArmor | The output should be:

Context: 4.3 - Restrict a Container's Access to Resources with AppArmor | The output should be:


Prompt:
Explain this text code:

touch: /tmp/test: Permission denied
error: error executing remote command: command terminated with non-zero exit code: Error executing in Docker Container: 1

Response: This text code 4.3 - Restrict a Container's Access to Resources with AppArmor | To wrap up, see what happens if you try to specify a profile that hasn't been loaded:

Context: 4.3 - Restrict a Container's Access to Resources with AppArmor | To wrap up, see what happens if you try to specify a profile that hasn't been loaded:


Prompt:
Complete this shell code:

kubectl create -f /dev/stdin <<EOF
apiVersion: v1
kind: Pod
metadata:
  name: hello-apparmor-2
spec:
  securityContext:

Response:
    appArmorProfile:
      type: Localhost
      localhostProfile: k8s-apparmor-example-allow-write
  containers:
  - name: hello
    image: busybox:1.28
    command: [ "sh", "-c", "echo 'Hello AppArmor!' && sleep 1h" ]
EOF

Context: 4.3 - Restrict a Container's Access to Resources with AppArmor | Although the Pod was created successfully, further examination will show that it is stuck in pending:


Prompt:
Explain this shell code:

kubectl create -f /dev/stdin <<EOF
apiVersion: v1
kind: Pod
metadata:
  name: hello-apparmor-2
spec:
  securityContext:
    appArmorProfile:
      type: Localhost
      localhostProfile: k8s-apparmor-example-allow-write
  containers:
  - name: hello
    image: busybox:1.28
    command: [ "sh", "-c", "echo 'Hello AppArmor!' && sleep 1h" ]
EOF

Response: This shell code 4.3 - Restrict a Container's Access to Resources with AppArmor | Although the Pod was created successfully, further examination will show that it is stuck in pending:


Prompt:
Complete this text code:

Name:          hello-apparmor-2
Namespace:     default
Node:          gke-test-default-pool-239f5d02-x1kf/10.128.0.27
Start Time:    Tue, 30 Aug 2016 17:58:56 -0700
Labels:        <none>
Annotations:   container.apparmor.security.beta.kubernetes.io/hello=localhost/k8s-apparmor-example-allow-write
Status:        Pending
...

Response:
Events:
  Type     Reason     Age              From               Message
  ----     ------     ----             ----               -------
  Normal   Scheduled  10s              default-scheduler  Successfully assigned default/hello-apparmor to gke-test-default-pool-239f5d02-x1kf
  Normal   Pulled     8s               kubelet            Successfully pulled image "busybox:1.28" in 370.157088ms (370.172701ms including waiting)
  Normal   Pulling    7s (x2 over 9s)  kubelet            Pulling image "busybox:1.28"
  Warning  Failed     7s (x2 over 8s)  kubelet            Error: failed to get container spec opts: failed to generate apparmor spec opts: apparmor profile not found k8s-apparmor-example-allow-write
  Normal   Pulled     7s               kubelet            Successfully pulled image "busybox:1.28" in 90.980331ms (91.005869ms including waiting)

Context: 4.3 - Restrict a Container's Access to Resources with AppArmor | An Event provides the error message with the reason, the specific wording is runtime-dependent:


Prompt:
Explain this text code:

Name:          hello-apparmor-2
Namespace:     default
Node:          gke-test-default-pool-239f5d02-x1kf/10.128.0.27
Start Time:    Tue, 30 Aug 2016 17:58:56 -0700
Labels:        <none>
Annotations:   container.apparmor.security.beta.kubernetes.io/hello=localhost/k8s-apparmor-example-allow-write
Status:        Pending
...
Events:
  Type     Reason     Age              From               Message
  ----     ------     ----             ----               -------
  Normal   Scheduled  10s              default-scheduler  Successfully assigned default/hello-apparmor to gke-test-default-pool-239f5d02-x1kf
  Normal   Pulled     8s               kubelet            Successfully pulled image "busybox:1.28" in 370.157088ms (370.172701ms including waiting)
  Normal   Pulling    7s (x2 over 9s)  kubelet            Pulling image "busybox:1.28"
  Warning  Failed     7s (x2 over 8s)  kubelet            Error: failed to get container spec opts: failed to generate apparmor spec opts: apparmor profile not found k8s-apparmor-example-allow-write
  Normal   Pulled     7s               kubelet            Successfully pulled image "busybox:1.28" in 90.980331ms (91.005869ms including waiting)

Response: This text code 4.3 - Restrict a Container's Access to Resources with AppArmor | An Event provides the error message with the reason, the specific wording is runtime-dependent:


Prompt:
Explain this text code:

Warning  Failed     7s (x2 over 8s)  kubelet            Error: failed to get container spec opts: failed to generate apparmor spec opts: apparmor profile not found

Response: This text code 4.3 - Restrict a Container's Access to Resources with AppArmor | Kubernetes 1.34 does not provide any built-in mechanisms for loading AppArmor profiles onto Nodes. Profiles can be loaded through custom infrastructure or tools like the Kubernetes Security Profiles O

Context: 4.3 - Restrict a Container's Access to Resources with AppArmor | Kubernetes 1.34 does not provide any built-in mechanisms for loading AppArmor profiles onto Nodes. Profiles can be loaded through custom infrastructure or tools like the Kubernetes Security Profiles O


Prompt:
Complete this json code:

{
    "defaultAction": "SCMP_ACT_ERRNO",
    "architectures": [
        "SCMP_ARCH_X86_64",
        "SCMP_ARCH_X86",
        "SCMP_ARCH_X32"
    ],
    "syscalls": [
        {
            "names": [
                "accept4",
                "epoll_wait",
                "pselect6",
                "futex",
                "madvise",
                "epoll_ctl",
                "getsockname",
                "setsockopt",
                "vfork",
                "mmap",
                "read",
                "write",
                "close",
                "arch_prctl",
                "sched_getaffinity",
                "munmap",
                "brk",
                "rt_sigaction",
                "rt_sigprocmask",
                "sigaltstack",
                "gettid",
                "clone",
                "bind",
                "socket",

Response:
                "openat",
                "readlinkat",
                "exit_group",
                "epoll_create1",
                "listen",
                "rt_sigreturn",
                "sched_yield",
                "clock_gettime",
                "connect",
                "dup2",
                "epoll_pwait",
                "execve",
                "exit",
                "fcntl",
                "getpid",
                "getuid",
                "ioctl",
                "mprotect",
                "nanosleep",
                "open",
                "poll",
                "recvfrom",
                "sendto",
                "set_tid_address",
                "setitimer",
                "writev",
                "fstatfs",
                "getdents64",
                "pipe2",
                "getrlimit"
            ],
            "action": "SCMP_ACT_ALLOW"
        }
    ]
}

Context: 4.4 - Restrict a Container's Syscalls with seccomp | Run these commands:


Prompt:
Explain this json code:

{
    "defaultAction": "SCMP_ACT_ERRNO",
    "architectures": [
        "SCMP_ARCH_X86_64",
        "SCMP_ARCH_X86",
        "SCMP_ARCH_X32"
    ],
    "syscalls": [
        {
            "names": [
                "accept4",
                "epoll_wait",
                "pselect6",
                "futex",
                "madvise",
                "epoll_ctl",
                "getsockname",
                "setsockopt",
                "vfork",
                "mmap",
                "read",
                "write",
                "close",
                "arch_prctl",
                "sched_getaffinity",
                "munmap",
                "brk",
                "rt_sigaction",
                "rt_sigprocmask",
                "sigaltstack",
                "gettid",
                "clone",
                "bind",
                "socket",
                "openat",
                "readlinkat",
                "exit_group",
                "epoll_create1",
                "listen",
                "rt_sigreturn",
                "sched_yield",
                "clock_gettime",
                "connect",
                "dup2",
                "epoll_pwait",
                "execve",
                "exit",
                "fcntl",
                "getpid",
                "getuid",
                "ioctl",
                "mprotect",
                "nanosleep",
                "open",
                "poll",
                "recvfrom",
                "sendto",
                "set_tid_address",
                "setitimer",
                "writev",
                "fstatfs",
                "getdents64",
                "pipe2",
                "getrlimit"
            ],
            "action": "SCMP_ACT_ALLOW"
        }
    ]
}

Response: This json code 4.4 - Restrict a Container's Syscalls with seccomp | Run these commands:


Prompt:
Complete this shell code:

mkdir ./profiles
curl -L -o profiles/audit.json https://k8s.io/examples/pods/security/seccomp/profiles/audit.json

Response:
curl -L -o profiles/violation.json https://k8s.io/examples/pods/security/seccomp/profiles/violation.json
curl -L -o profiles/fine-grained.json https://k8s.io/examples/pods/security/seccomp/profiles/fine-grained.json
ls profiles

Context: 4.4 - Restrict a Container's Syscalls with seccomp | You should see three profiles listed at the end of the final step:


Prompt:
Explain this shell code:

mkdir ./profiles
curl -L -o profiles/audit.json https://k8s.io/examples/pods/security/seccomp/profiles/audit.json
curl -L -o profiles/violation.json https://k8s.io/examples/pods/security/seccomp/profiles/violation.json
curl -L -o profiles/fine-grained.json https://k8s.io/examples/pods/security/seccomp/profiles/fine-grained.json
ls profiles

Response: This shell code 4.4 - Restrict a Container's Syscalls with seccomp | You should see three profiles listed at the end of the final step:


Prompt:
Complete this yaml code:

apiVersion: kind.x-k8s.io/v1alpha4
kind: Cluster
nodes:

Response:
- role: control-plane
  extraMounts:
  - hostPath: "./profiles"
    containerPath: "/var/lib/kubelet/seccomp/profiles"

Context: 4.4 - Restrict a Container's Syscalls with seccomp | Download that example kind configuration, and save it to a file named kind.yaml:


Prompt:
Explain this yaml code:

apiVersion: kind.x-k8s.io/v1alpha4
kind: Cluster
nodes:
- role: control-plane
  extraMounts:
  - hostPath: "./profiles"
    containerPath: "/var/lib/kubelet/seccomp/profiles"

Response: This yaml code 4.4 - Restrict a Container's Syscalls with seccomp | Download that example kind configuration, and save it to a file named kind.yaml:


Prompt:
Explain this shell code:

curl -L -O https://k8s.io/examples/pods/security/seccomp/kind.yaml

Response: This shell code 4.4 - Restrict a Container's Syscalls with seccomp | You can set a specific Kubernetes version by setting the node's container image. See Nodes within the kind documentation about configuration for more details on this. This tutorial assumes you are usi

Context: 4.4 - Restrict a Container's Syscalls with seccomp | You can set a specific Kubernetes version by setting the node's container image. See Nodes within the kind documentation about configuration for more details on this. This tutorial assumes you are usi


Prompt:
Explain this text code:

CONTAINER ID        IMAGE                  COMMAND                  CREATED             STATUS              PORTS                       NAMES
6a96207fed4b        kindest/node:v1.18.2   "/usr/local/bin/entr…"   27 seconds ago      Up 24 seconds       127.0.0.1:42223->6443/tcp   kind-control-plane

Response: This text code 4.4 - Restrict a Container's Syscalls with seccomp | If observing the filesystem of that container, you should see that the profiles/ directory has been successfully loaded into the default seccomp path of the kubelet. Use docker exec to run a command i

Context: 4.4 - Restrict a Container's Syscalls with seccomp | If observing the filesystem of that container, you should see that the profiles/ directory has been successfully loaded into the default seccomp path of the kubelet. Use docker exec to run a command i


Prompt:
Explain this shell code:

# Change 6a96207fed4b to the container ID you saw from "docker ps"
docker exec -it 6a96207fed4b ls /var/lib/kubelet/seccomp/profiles

Response: This shell code 4.4 - Restrict a Container's Syscalls with seccomp | You have verified that these seccomp profiles are available to the kubelet running within kind.

Context: 4.4 - Restrict a Container's Syscalls with seccomp | You have verified that these seccomp profiles are available to the kubelet running within kind.


Prompt:
Complete this yaml code:

apiVersion: v1
kind: Pod
metadata:
  name: default-pod
  labels:
    app: default-pod
spec:
  securityContext:

Response:
    seccompProfile:
      type: RuntimeDefault
  containers:
  - name: test-container
    image: hashicorp/http-echo:1.0
    args:
    - "-text=just made some more syscalls!"
    securityContext:
      allowPrivilegeEscalation: false

Context: 4.4 - Restrict a Container's Syscalls with seccomp | Create that Pod:


Prompt:
Explain this yaml code:

apiVersion: v1
kind: Pod
metadata:
  name: default-pod
  labels:
    app: default-pod
spec:
  securityContext:
    seccompProfile:
      type: RuntimeDefault
  containers:
  - name: test-container
    image: hashicorp/http-echo:1.0
    args:
    - "-text=just made some more syscalls!"
    securityContext:
      allowPrivilegeEscalation: false

Response: This yaml code 4.4 - Restrict a Container's Syscalls with seccomp | Create that Pod:


Prompt:
Explain this shell code:

kubectl apply -f https://k8s.io/examples/pods/security/seccomp/ga/default-pod.yaml

Response: This shell code 4.4 - Restrict a Container's Syscalls with seccomp | The Pod should be showing as having started successfully:

Context: 4.4 - Restrict a Container's Syscalls with seccomp | The Pod should be showing as having started successfully:


Prompt:
Explain this text code:

NAME        READY   STATUS    RESTARTS   AGE
default-pod 1/1     Running   0          20s

Response: This text code 4.4 - Restrict a Container's Syscalls with seccomp | Delete the Pod before moving to the next section:

Context: 4.4 - Restrict a Container's Syscalls with seccomp | Delete the Pod before moving to the next section:


Prompt:
Complete this yaml code:

apiVersion: v1
kind: Pod
metadata:
  name: audit-pod
  labels:
    app: audit-pod
spec:
  securityContext:
    seccompProfile:

Response:
      type: Localhost
      localhostProfile: profiles/audit.json
  containers:
  - name: test-container
    image: hashicorp/http-echo:1.0
    args:
    - "-text=just made some syscalls!"
    securityContext:
      allowPrivilegeEscalation: false

Context: 4.4 - Restrict a Container's Syscalls with seccomp | Create the Pod in the cluster:


Prompt:
Explain this yaml code:

apiVersion: v1
kind: Pod
metadata:
  name: audit-pod
  labels:
    app: audit-pod
spec:
  securityContext:
    seccompProfile:
      type: Localhost
      localhostProfile: profiles/audit.json
  containers:
  - name: test-container
    image: hashicorp/http-echo:1.0
    args:
    - "-text=just made some syscalls!"
    securityContext:
      allowPrivilegeEscalation: false

Response: This yaml code 4.4 - Restrict a Container's Syscalls with seccomp | Create the Pod in the cluster:


Prompt:
Explain this shell code:

kubectl apply -f https://k8s.io/examples/pods/security/seccomp/ga/audit-pod.yaml

Response: This shell code 4.4 - Restrict a Container's Syscalls with seccomp | This profile does not restrict any syscalls, so the Pod should start successfully.

Context: 4.4 - Restrict a Container's Syscalls with seccomp | This profile does not restrict any syscalls, so the Pod should start successfully.


Prompt:
Explain this text code:

NAME        READY   STATUS    RESTARTS   AGE
audit-pod   1/1     Running   0          30s

Response: This text code 4.4 - Restrict a Container's Syscalls with seccomp | In order to be able to interact with this endpoint exposed by this container, create a NodePort Service that allows access to the endpoint from inside the kind control plane container.

Context: 4.4 - Restrict a Container's Syscalls with seccomp | In order to be able to interact with this endpoint exposed by this container, create a NodePort Service that allows access to the endpoint from inside the kind control plane container.


Prompt:
Explain this shell code:

kubectl expose pod audit-pod --type NodePort --port 5678

Response: This shell code 4.4 - Restrict a Container's Syscalls with seccomp | Check what port the Service has been assigned on the node.

Context: 4.4 - Restrict a Container's Syscalls with seccomp | Check what port the Service has been assigned on the node.


Prompt:
Explain this text code:

NAME        TYPE       CLUSTER-IP      EXTERNAL-IP   PORT(S)          AGE
audit-pod   NodePort   10.111.36.142   <none>        5678:32373/TCP   72s

Response: This text code 4.4 - Restrict a Container's Syscalls with seccomp | Now you can use curl to access that endpoint from inside the kind control plane container, at the port exposed by this Service. Use docker exec to run the curl command within the container belonging t

Context: 4.4 - Restrict a Container's Syscalls with seccomp | Now you can use curl to access that endpoint from inside the kind control plane container, at the port exposed by this Service. Use docker exec to run the curl command within the container belonging t


Prompt:
Explain this shell code:

# Change 6a96207fed4b to the control plane container ID and 32373 to the port number you saw from "docker ps"
docker exec -it 6a96207fed4b curl localhost:32373

Response: This shell code 4.4 - Restrict a Container's Syscalls with seccomp | You can see that the process is running, but what syscalls did it actually make? Because this Pod is running in a local cluster, you should be able to see those in /var/log/syslog on your local system

Context: 4.4 - Restrict a Container's Syscalls with seccomp | You can see that the process is running, but what syscalls did it actually make? Because this Pod is running in a local cluster, you should be able to see those in /var/log/syslog on your local system


Prompt:
Explain this shell code:

# The log path on your computer might be different from "/var/log/syslog"
tail -f /var/log/syslog | grep 'http-echo'

Response: This shell code 4.4 - Restrict a Container's Syscalls with seccomp | You should already see some logs of syscalls made by http-echo, and if you run curl again inside the control plane container you will see more output written to the log.

Context: 4.4 - Restrict a Container's Syscalls with seccomp | You should already see some logs of syscalls made by http-echo, and if you run curl again inside the control plane container you will see more output written to the log.


Prompt:
Complete this text code:

Jul  6 15:37:40 my-machine kernel: [369128.669452] audit: type=1326 audit(1594067860.484:14536): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=29064 comm="http-echo" exe="/http-echo" sig=0 arch=c000003e syscall=51 compat=0 ip=0x46fe1f code=0x7ffc0000
Jul  6 15:37:40 my-machine kernel: [369128.669453] audit: type=1326 audit(1594067860.484:14537): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=29064 comm="http-echo" exe="/http-echo" sig=0 arch=c000003e syscall=54 compat=0 ip=0x46fdba code=0x7ffc0000
Jul  6 15:37:40 my-machine kernel: [369128.669455] audit: type=1326 audit(1594067860.484:14538): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=29064 comm="http-echo" exe="/http-echo" sig=0 arch=c000003e syscall=202 compat=0 ip=0x455e53 code=0x7ffc0000
Jul  6 15:37:40 my-machine kernel: [369128.669456] audit: type=1326 audit(1594067860.484:14539): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=29064 comm="http-echo" exe="/http-echo" sig=0 arch=c000003e syscall=288 compat=0 ip=0x46fdba code=0x7ffc0000

Response:
Jul  6 15:37:40 my-machine kernel: [369128.669517] audit: type=1326 audit(1594067860.484:14540): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=29064 comm="http-echo" exe="/http-echo" sig=0 arch=c000003e syscall=0 compat=0 ip=0x46fd44 code=0x7ffc0000
Jul  6 15:37:40 my-machine kernel: [369128.669519] audit: type=1326 audit(1594067860.484:14541): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=29064 comm="http-echo" exe="/http-echo" sig=0 arch=c000003e syscall=270 compat=0 ip=0x4559b1 code=0x7ffc0000
Jul  6 15:38:40 my-machine kernel: [369188.671648] audit: type=1326 audit(1594067920.488:14559): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=29064 comm="http-echo" exe="/http-echo" sig=0 arch=c000003e syscall=270 compat=0 ip=0x4559b1 code=0x7ffc0000
Jul  6 15:38:40 my-machine kernel: [369188.671726] audit: type=1326 audit(1594067920.488:14560): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=29064 comm="http-echo" exe="/http-echo" sig=0 arch=c000003e syscall=202 compat=0 ip=0x455e53 code=0x7ffc0000

Context: 4.4 - Restrict a Container's Syscalls with seccomp | You can begin to understand the syscalls required by the http-echo process by looking at the syscall= entry on each line. While these are unlikely to encompass all syscalls it uses, it can serve as a


Prompt:
Explain this text code:

Jul  6 15:37:40 my-machine kernel: [369128.669452] audit: type=1326 audit(1594067860.484:14536): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=29064 comm="http-echo" exe="/http-echo" sig=0 arch=c000003e syscall=51 compat=0 ip=0x46fe1f code=0x7ffc0000
Jul  6 15:37:40 my-machine kernel: [369128.669453] audit: type=1326 audit(1594067860.484:14537): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=29064 comm="http-echo" exe="/http-echo" sig=0 arch=c000003e syscall=54 compat=0 ip=0x46fdba code=0x7ffc0000
Jul  6 15:37:40 my-machine kernel: [369128.669455] audit: type=1326 audit(1594067860.484:14538): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=29064 comm="http-echo" exe="/http-echo" sig=0 arch=c000003e syscall=202 compat=0 ip=0x455e53 code=0x7ffc0000
Jul  6 15:37:40 my-machine kernel: [369128.669456] audit: type=1326 audit(1594067860.484:14539): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=29064 comm="http-echo" exe="/http-echo" sig=0 arch=c000003e syscall=288 compat=0 ip=0x46fdba code=0x7ffc0000
Jul  6 15:37:40 my-machine kernel: [369128.669517] audit: type=1326 audit(1594067860.484:14540): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=29064 comm="http-echo" exe="/http-echo" sig=0 arch=c000003e syscall=0 compat=0 ip=0x46fd44 code=0x7ffc0000
Jul  6 15:37:40 my-machine kernel: [369128.669519] audit: type=1326 audit(1594067860.484:14541): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=29064 comm="http-echo" exe="/http-echo" sig=0 arch=c000003e syscall=270 compat=0 ip=0x4559b1 code=0x7ffc0000
Jul  6 15:38:40 my-machine kernel: [369188.671648] audit: type=1326 audit(1594067920.488:14559): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=29064 comm="http-echo" exe="/http-echo" sig=0 arch=c000003e syscall=270 compat=0 ip=0x4559b1 code=0x7ffc0000
Jul  6 15:38:40 my-machine kernel: [369188.671726] audit: type=1326 audit(1594067920.488:14560): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=29064 comm="http-echo" exe="/http-echo" sig=0 arch=c000003e syscall=202 compat=0 ip=0x455e53 code=0x7ffc0000

Response: This text code 4.4 - Restrict a Container's Syscalls with seccomp | You can begin to understand the syscalls required by the http-echo process by looking at the syscall= entry on each line. While these are unlikely to encompass all syscalls it uses, it can serve as a


Prompt:
Explain this shell code:

kubectl delete service audit-pod --wait
kubectl delete pod audit-pod --wait --now

Response: This shell code 4.4 - Restrict a Container's Syscalls with seccomp | For demonstration, apply a profile to the Pod that does not allow for any syscalls.

Context: 4.4 - Restrict a Container's Syscalls with seccomp | For demonstration, apply a profile to the Pod that does not allow for any syscalls.


Prompt:
Complete this yaml code:

apiVersion: v1
kind: Pod
metadata:
  name: violation-pod
  labels:
    app: violation-pod
spec:
  securityContext:
    seccompProfile:

Response:
      type: Localhost
      localhostProfile: profiles/violation.json
  containers:
  - name: test-container
    image: hashicorp/http-echo:1.0
    args:
    - "-text=just made some syscalls!"
    securityContext:
      allowPrivilegeEscalation: false

Context: 4.4 - Restrict a Container's Syscalls with seccomp | Attempt to create the Pod in the cluster:


Prompt:
Explain this yaml code:

apiVersion: v1
kind: Pod
metadata:
  name: violation-pod
  labels:
    app: violation-pod
spec:
  securityContext:
    seccompProfile:
      type: Localhost
      localhostProfile: profiles/violation.json
  containers:
  - name: test-container
    image: hashicorp/http-echo:1.0
    args:
    - "-text=just made some syscalls!"
    securityContext:
      allowPrivilegeEscalation: false

Response: This yaml code 4.4 - Restrict a Container's Syscalls with seccomp | Attempt to create the Pod in the cluster:


Prompt:
Explain this shell code:

kubectl apply -f https://k8s.io/examples/pods/security/seccomp/ga/violation-pod.yaml

Response: This shell code 4.4 - Restrict a Container's Syscalls with seccomp | The Pod creates, but there is an issue. If you check the status of the Pod, you should see that it failed to start.

Context: 4.4 - Restrict a Container's Syscalls with seccomp | The Pod creates, but there is an issue. If you check the status of the Pod, you should see that it failed to start.


Prompt:
Explain this text code:

NAME            READY   STATUS             RESTARTS   AGE
violation-pod   0/1     CrashLoopBackOff   1          6s

Response: This text code 4.4 - Restrict a Container's Syscalls with seccomp | As seen in the previous example, the http-echo process requires quite a few syscalls. Here seccomp has been instructed to error on any syscall by setting "defaultAction": "SCMP_ACT_ERRNO". This is ext

Context: 4.4 - Restrict a Container's Syscalls with seccomp | As seen in the previous example, the http-echo process requires quite a few syscalls. Here seccomp has been instructed to error on any syscall by setting "defaultAction": "SCMP_ACT_ERRNO". This is ext


Prompt:
Complete this yaml code:

apiVersion: v1
kind: Pod
metadata:
  name: fine-pod
  labels:
    app: fine-pod
spec:
  securityContext:
    seccompProfile:

Response:
      type: Localhost
      localhostProfile: profiles/fine-grained.json
  containers:
  - name: test-container
    image: hashicorp/http-echo:1.0
    args:
    - "-text=just made some syscalls!"
    securityContext:
      allowPrivilegeEscalation: false

Context: 4.4 - Restrict a Container's Syscalls with seccomp | Create the Pod in your cluster:


Prompt:
Explain this yaml code:

apiVersion: v1
kind: Pod
metadata:
  name: fine-pod
  labels:
    app: fine-pod
spec:
  securityContext:
    seccompProfile:
      type: Localhost
      localhostProfile: profiles/fine-grained.json
  containers:
  - name: test-container
    image: hashicorp/http-echo:1.0
    args:
    - "-text=just made some syscalls!"
    securityContext:
      allowPrivilegeEscalation: false

Response: This yaml code 4.4 - Restrict a Container's Syscalls with seccomp | Create the Pod in your cluster:


Prompt:
Explain this shell code:

kubectl apply -f https://k8s.io/examples/pods/security/seccomp/ga/fine-pod.yaml

Response: This shell code 4.4 - Restrict a Container's Syscalls with seccomp | The Pod should be showing as having started successfully:


Prompt:
Explain this text code:

NAME        READY   STATUS    RESTARTS   AGE
fine-pod   1/1     Running   0          30s

Response: This text code 4.4 - Restrict a Container's Syscalls with seccomp | Open up a new terminal window and use tail to monitor for log entries that mention calls from http-echo:

Context: 4.4 - Restrict a Container's Syscalls with seccomp | Open up a new terminal window and use tail to monitor for log entries that mention calls from http-echo:


Prompt:
Explain this shell code:

# The log path on your computer might be different from "/var/log/syslog"
tail -f /var/log/syslog | grep 'http-echo'

Response: This shell code 4.4 - Restrict a Container's Syscalls with seccomp | Next, expose the Pod with a NodePort Service:

Context: 4.4 - Restrict a Container's Syscalls with seccomp | Next, expose the Pod with a NodePort Service:


Prompt:
Explain this shell code:

kubectl expose pod fine-pod --type NodePort --port 5678

Response: This shell code 4.4 - Restrict a Container's Syscalls with seccomp | Check what port the Service has been assigned on the node:

Context: 4.4 - Restrict a Container's Syscalls with seccomp | Check what port the Service has been assigned on the node:


Prompt:
Explain this text code:

NAME        TYPE       CLUSTER-IP      EXTERNAL-IP   PORT(S)          AGE
fine-pod    NodePort   10.111.36.142   <none>        5678:32373/TCP   72s

Response: This text code 4.4 - Restrict a Container's Syscalls with seccomp | Use curl to access that endpoint from inside the kind control plane container:

Context: 4.4 - Restrict a Container's Syscalls with seccomp | Use curl to access that endpoint from inside the kind control plane container:


Prompt:
Explain this shell code:

# Change 6a96207fed4b to the control plane container ID and 32373 to the port number you saw from "docker ps"
docker exec -it 6a96207fed4b curl localhost:32373

Response: This shell code 4.4 - Restrict a Container's Syscalls with seccomp | You should see no output in the syslog. This is because the profile allowed all necessary syscalls and specified that an error should occur if one outside of the list is invoked. This is an ideal situ

Context: 4.4 - Restrict a Container's Syscalls with seccomp | You should see no output in the syslog. This is because the profile allowed all necessary syscalls and specified that an error should occur if one outside of the list is invoked. This is an ideal situ


Prompt:
Explain this shell code:

kubectl delete service fine-pod --wait
kubectl delete pod fine-pod --wait --now

Response: This shell code 4.4 - Restrict a Container's Syscalls with seccomp | To use seccomp profile defaulting, you must run the kubelet with the --seccomp-default command line flag enabled for each node where you want to use it.

Context: 4.4 - Restrict a Container's Syscalls with seccomp | To use seccomp profile defaulting, you must run the kubelet with the --seccomp-default command line flag enabled for each node where you want to use it.


Prompt:
Complete this yaml code:

kind: Cluster
apiVersion: kind.x-k8s.io/v1alpha4
nodes:
  - role: control-plane
    image: kindest/node:v1.28.0@sha256:9f3ff58f19dcf1a0611d11e8ac989fdb30a28f40f236f59f0bea31fb956ccf5c
    kubeadmConfigPatches:
      - |
        kind: JoinConfiguration
        nodeRegistration:

Response:
          kubeletExtraArgs:
            seccomp-default: "true"
  - role: worker
    image: kindest/node:v1.28.0@sha256:9f3ff58f19dcf1a0611d11e8ac989fdb30a28f40f236f59f0bea31fb956ccf5c
    kubeadmConfigPatches:
      - |
        kind: JoinConfiguration
        nodeRegistration:
          kubeletExtraArgs:
            seccomp-default: "true"

Context: 4.4 - Restrict a Container's Syscalls with seccomp | If the cluster is ready, then running a pod:


Prompt:
Explain this yaml code:

kind: Cluster
apiVersion: kind.x-k8s.io/v1alpha4
nodes:
  - role: control-plane
    image: kindest/node:v1.28.0@sha256:9f3ff58f19dcf1a0611d11e8ac989fdb30a28f40f236f59f0bea31fb956ccf5c
    kubeadmConfigPatches:
      - |
        kind: JoinConfiguration
        nodeRegistration:
          kubeletExtraArgs:
            seccomp-default: "true"
  - role: worker
    image: kindest/node:v1.28.0@sha256:9f3ff58f19dcf1a0611d11e8ac989fdb30a28f40f236f59f0bea31fb956ccf5c
    kubeadmConfigPatches:
      - |
        kind: JoinConfiguration
        nodeRegistration:
          kubeletExtraArgs:
            seccomp-default: "true"

Response: This yaml code 4.4 - Restrict a Container's Syscalls with seccomp | If the cluster is ready, then running a pod:


Prompt:
Explain this shell code:

kubectl run --rm -it --restart=Never --image=alpine alpine -- sh

Response: This shell code 4.4 - Restrict a Container's Syscalls with seccomp | Should now have the default seccomp profile attached. This can be verified by using docker exec to run crictl inspect for the container on the kind worker:

Context: 4.4 - Restrict a Container's Syscalls with seccomp | Should now have the default seccomp profile attached. This can be verified by using docker exec to run crictl inspect for the container on the kind worker:


Prompt:
Explain this shell code:

docker exec -it kind-worker bash -c \
    'crictl inspect $(crictl ps --name=alpine -q) | jq .info.runtimeSpec.linux.seccomp'

Response: This shell code 4.4 - Restrict a Container's Syscalls with seccomp | You can learn more about Linux seccomp:

Context: 4.4 - Restrict a Container's Syscalls with seccomp | You can learn more about Linux seccomp:


Prompt:
Complete this json code:

{
  "defaultAction": "SCMP_ACT_ERRNO",
  "architectures": ["SCMP_ARCH_X86_64", "SCMP_ARCH_X86", "SCMP_ARCH_X32"],
  "syscalls": [

Response:
    {
      "names": ["..."]
    }
  ]
}


Prompt:
Explain this json code:

{
  "defaultAction": "SCMP_ACT_ERRNO",
  "architectures": ["SCMP_ARCH_X86_64", "SCMP_ARCH_X86", "SCMP_ARCH_X32"],
  "syscalls": [
    {
      "names": ["..."]
    }
  ]
}

Response: This json code 4.4 - Restrict a Container's Syscalls with seccomp | You can learn more about Linux seccomp:


Prompt:
Complete this yaml code:

apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app.kubernetes.io/name: load-balancer-example
  name: hello-world
spec:
  replicas: 5
  selector:
    matchLabels:

Response:
      app.kubernetes.io/name: load-balancer-example
  template:
    metadata:
      labels:
        app.kubernetes.io/name: load-balancer-example
    spec:
      containers:
      - image: gcr.io/google-samples/hello-app:2.0
        name: hello-world
        ports:
        - containerPort: 8080

Context: 5.1 - Exposing an External IP Address to Access an Application in a Cluster | The preceding command creates a Deployment and an associated ReplicaSet. The ReplicaSet has five Pods each of which runs the Hello World application.


Prompt:
Explain this yaml code:

apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app.kubernetes.io/name: load-balancer-example
  name: hello-world
spec:
  replicas: 5
  selector:
    matchLabels:
      app.kubernetes.io/name: load-balancer-example
  template:
    metadata:
      labels:
        app.kubernetes.io/name: load-balancer-example
    spec:
      containers:
      - image: gcr.io/google-samples/hello-app:2.0
        name: hello-world
        ports:
        - containerPort: 8080

Response: This yaml code 5.1 - Exposing an External IP Address to Access an Application in a Cluster | The preceding command creates a Deployment and an associated ReplicaSet. The ReplicaSet has five Pods each of which runs the Hello World application.


Prompt:
Explain this shell code:

kubectl apply -f https://k8s.io/examples/service/load-balancer-example.yaml

Response: This shell code 5.1 - Exposing an External IP Address to Access an Application in a Cluster | The preceding command creates a Deployment and an associated ReplicaSet. The ReplicaSet has five Pods each of which runs the Hello World application.


Prompt:
Explain this shell code:

kubectl get deployments hello-world
kubectl describe deployments hello-world

Response: This shell code 5.1 - Exposing an External IP Address to Access an Application in a Cluster | Display information about your ReplicaSet objects:

Context: 5.1 - Exposing an External IP Address to Access an Application in a Cluster | Display information about your ReplicaSet objects:


Prompt:
Explain this shell code:

kubectl get replicasets
kubectl describe replicasets

Response: This shell code 5.1 - Exposing an External IP Address to Access an Application in a Cluster | Create a Service object that exposes the deployment:

Context: 5.1 - Exposing an External IP Address to Access an Application in a Cluster | Create a Service object that exposes the deployment:


Prompt:
Explain this shell code:

kubectl expose deployment hello-world --type=LoadBalancer --name=my-service

Response: This shell code 5.1 - Exposing an External IP Address to Access an Application in a Cluster | Display information about the Service:

Context: 5.1 - Exposing an External IP Address to Access an Application in a Cluster | Display information about the Service:


Prompt:
Explain this console code:

NAME         TYPE           CLUSTER-IP     EXTERNAL-IP      PORT(S)    AGE
my-service   LoadBalancer   10.3.245.137   104.198.205.71   8080/TCP   54s

Response: This console code 5.1 - Exposing an External IP Address to Access an Application in a Cluster | Display detailed information about the Service:

Context: 5.1 - Exposing an External IP Address to Access an Application in a Cluster | Display detailed information about the Service:


Prompt:
Complete this console code:

Name:           my-service
Namespace:      default
Labels:         app.kubernetes.io/name=load-balancer-example
Annotations:    <none>
Selector:       app.kubernetes.io/name=load-balancer-example
Type:           LoadBalancer

Response:
IP:             10.3.245.137
LoadBalancer Ingress:   104.198.205.71
Port:           <unset> 8080/TCP
NodePort:       <unset> 32377/TCP
Endpoints:      10.0.0.6:8080,10.0.1.6:8080,10.0.1.7:8080 + 2 more...
Session Affinity:   None
Events:         <none>

Context: 5.1 - Exposing an External IP Address to Access an Application in a Cluster | Make a note of the external IP address (LoadBalancer Ingress) exposed by your service. In this example, the external IP address is 104.198.205.71. Also note the value of Port and NodePort. In this exa


Prompt:
Explain this console code:

Name:           my-service
Namespace:      default
Labels:         app.kubernetes.io/name=load-balancer-example
Annotations:    <none>
Selector:       app.kubernetes.io/name=load-balancer-example
Type:           LoadBalancer
IP:             10.3.245.137
LoadBalancer Ingress:   104.198.205.71
Port:           <unset> 8080/TCP
NodePort:       <unset> 32377/TCP
Endpoints:      10.0.0.6:8080,10.0.1.6:8080,10.0.1.7:8080 + 2 more...
Session Affinity:   None
Events:         <none>

Response: This console code 5.1 - Exposing an External IP Address to Access an Application in a Cluster | Make a note of the external IP address (LoadBalancer Ingress) exposed by your service. In this example, the external IP address is 104.198.205.71. Also note the value of Port and NodePort. In this exa


Prompt:
Complete this console code:

NAME                         ...  IP         NODE
hello-world-2895499144-1jaz9 ...  10.0.1.6   gke-cluster-1-default-pool-e0b8d269-1afc
hello-world-2895499144-2e5uh ...  10.0.1.8   gke-cluster-1-default-pool-e0b8d269-1afc

Response:
hello-world-2895499144-9m4h1 ...  10.0.0.6   gke-cluster-1-default-pool-e0b8d269-5v7a
hello-world-2895499144-o4z13 ...  10.0.1.7   gke-cluster-1-default-pool-e0b8d269-1afc
hello-world-2895499144-segjf ...  10.0.2.5   gke-cluster-1-default-pool-e0b8d269-cpuc

Context: 5.1 - Exposing an External IP Address to Access an Application in a Cluster | Use the external IP address (LoadBalancer Ingress) to access the Hello World application:


Prompt:
Explain this console code:

NAME                         ...  IP         NODE
hello-world-2895499144-1jaz9 ...  10.0.1.6   gke-cluster-1-default-pool-e0b8d269-1afc
hello-world-2895499144-2e5uh ...  10.0.1.8   gke-cluster-1-default-pool-e0b8d269-1afc
hello-world-2895499144-9m4h1 ...  10.0.0.6   gke-cluster-1-default-pool-e0b8d269-5v7a
hello-world-2895499144-o4z13 ...  10.0.1.7   gke-cluster-1-default-pool-e0b8d269-1afc
hello-world-2895499144-segjf ...  10.0.2.5   gke-cluster-1-default-pool-e0b8d269-cpuc

Response: This console code 5.1 - Exposing an External IP Address to Access an Application in a Cluster | Use the external IP address (LoadBalancer Ingress) to access the Hello World application:


Prompt:
Explain this shell code:

Hello, world!
Version: 2.0.0
Hostname: 0bd46b45f32f

Response: This shell code 5.1 - Exposing an External IP Address to Access an Application in a Cluster | To delete the Service, enter this command:

Context: 5.1 - Exposing an External IP Address to Access an Application in a Cluster | To delete the Service, enter this command:


Prompt:
Complete this yaml code:

# SOURCE: https://cloud.google.com/kubernetes-engine/docs/tutorials/guestbook
apiVersion: apps/v1
kind: Deployment
metadata:
  name: redis-leader
  labels:
    app: redis
    role: leader
    tier: backend
spec:
  replicas: 1
  selector:
    matchLabels:
      app: redis
  template:

Response:
    metadata:
      labels:
        app: redis
        role: leader
        tier: backend
    spec:
      containers:
      - name: leader
        image: "docker.io/redis:6.0.5"
        resources:
          requests:
            cpu: 100m
            memory: 100Mi
        ports:
        - containerPort: 6379

Context: 5.2 - Example: Deploying PHP Guestbook application with Redis | Launch a terminal window in the directory you downloaded the manifest files.


Prompt:
Explain this yaml code:

# SOURCE: https://cloud.google.com/kubernetes-engine/docs/tutorials/guestbook
apiVersion: apps/v1
kind: Deployment
metadata:
  name: redis-leader
  labels:
    app: redis
    role: leader
    tier: backend
spec:
  replicas: 1
  selector:
    matchLabels:
      app: redis
  template:
    metadata:
      labels:
        app: redis
        role: leader
        tier: backend
    spec:
      containers:
      - name: leader
        image: "docker.io/redis:6.0.5"
        resources:
          requests:
            cpu: 100m
            memory: 100Mi
        ports:
        - containerPort: 6379

Response: This yaml code 5.2 - Example: Deploying PHP Guestbook application with Redis | Launch a terminal window in the directory you downloaded the manifest files.


Prompt:
Explain this shell code:

kubectl apply -f https://k8s.io/examples/application/guestbook/redis-leader-deployment.yaml

Response: This shell code 5.2 - Example: Deploying PHP Guestbook application with Redis | Query the list of Pods to verify that the Redis Pod is running:

Context: 5.2 - Example: Deploying PHP Guestbook application with Redis | Query the list of Pods to verify that the Redis Pod is running:


Prompt:
Explain this text code:

NAME                           READY   STATUS    RESTARTS   AGE
redis-leader-fb76b4755-xjr2n   1/1     Running   0          13s

Response: This text code 5.2 - Example: Deploying PHP Guestbook application with Redis | Run the following command to view the logs from the Redis leader Pod:

Context: 5.2 - Example: Deploying PHP Guestbook application with Redis | Run the following command to view the logs from the Redis leader Pod:


Prompt:
Complete this yaml code:

# SOURCE: https://cloud.google.com/kubernetes-engine/docs/tutorials/guestbook
apiVersion: v1
kind: Service
metadata:
  name: redis-leader
  labels:
    app: redis
    role: leader

Response:
    tier: backend
spec:
  ports:
  - port: 6379
    targetPort: 6379
  selector:
    app: redis
    role: leader
    tier: backend

Context: 5.2 - Example: Deploying PHP Guestbook application with Redis | Apply the Redis Service from the following redis-leader-service.yaml file:


Prompt:
Explain this yaml code:

# SOURCE: https://cloud.google.com/kubernetes-engine/docs/tutorials/guestbook
apiVersion: v1
kind: Service
metadata:
  name: redis-leader
  labels:
    app: redis
    role: leader
    tier: backend
spec:
  ports:
  - port: 6379
    targetPort: 6379
  selector:
    app: redis
    role: leader
    tier: backend

Response: This yaml code 5.2 - Example: Deploying PHP Guestbook application with Redis | Apply the Redis Service from the following redis-leader-service.yaml file:


Prompt:
Explain this shell code:

kubectl apply -f https://k8s.io/examples/application/guestbook/redis-leader-service.yaml

Response: This shell code 5.2 - Example: Deploying PHP Guestbook application with Redis | Query the list of Services to verify that the Redis Service is running:

Context: 5.2 - Example: Deploying PHP Guestbook application with Redis | Query the list of Services to verify that the Redis Service is running:


Prompt:
Explain this text code:

NAME           TYPE        CLUSTER-IP   EXTERNAL-IP   PORT(S)    AGE
kubernetes     ClusterIP   10.0.0.1     <none>        443/TCP    1m
redis-leader   ClusterIP   10.103.78.24 <none>        6379/TCP   16s

Response: This text code 5.2 - Example: Deploying PHP Guestbook application with Redis | Although the Redis leader is a single Pod, you can make it highly available and meet traffic demands by adding a few Redis followers, or replicas.

Context: 5.2 - Example: Deploying PHP Guestbook application with Redis | Although the Redis leader is a single Pod, you can make it highly available and meet traffic demands by adding a few Redis followers, or replicas.


Prompt:
Explain this text code:

application/guestbook/redis-follower-deployment.yaml

Response: This text code 5.2 - Example: Deploying PHP Guestbook application with Redis | Apply the Redis Deployment from the following redis-follower-deployment.yaml file:

Context: 5.2 - Example: Deploying PHP Guestbook application with Redis | Apply the Redis Deployment from the following redis-follower-deployment.yaml file:


Prompt:
Complete this yaml code:

# SOURCE: https://cloud.google.com/kubernetes-engine/docs/tutorials/guestbook
apiVersion: apps/v1
kind: Deployment
metadata:
  name: redis-follower
  labels:
    app: redis
    role: follower
    tier: backend
spec:
  replicas: 2
  selector:
    matchLabels:
      app: redis
  template:

Response:
    metadata:
      labels:
        app: redis
        role: follower
        tier: backend
    spec:
      containers:
      - name: follower
        image: us-docker.pkg.dev/google-samples/containers/gke/gb-redis-follower:v2
        resources:
          requests:
            cpu: 100m
            memory: 100Mi
        ports:
        - containerPort: 6379


Prompt:
Explain this yaml code:

# SOURCE: https://cloud.google.com/kubernetes-engine/docs/tutorials/guestbook
apiVersion: apps/v1
kind: Deployment
metadata:
  name: redis-follower
  labels:
    app: redis
    role: follower
    tier: backend
spec:
  replicas: 2
  selector:
    matchLabels:
      app: redis
  template:
    metadata:
      labels:
        app: redis
        role: follower
        tier: backend
    spec:
      containers:
      - name: follower
        image: us-docker.pkg.dev/google-samples/containers/gke/gb-redis-follower:v2
        resources:
          requests:
            cpu: 100m
            memory: 100Mi
        ports:
        - containerPort: 6379

Response: This yaml code 5.2 - Example: Deploying PHP Guestbook application with Redis | Apply the Redis Deployment from the following redis-follower-deployment.yaml file:


Prompt:
Explain this shell code:

kubectl apply -f https://k8s.io/examples/application/guestbook/redis-follower-deployment.yaml

Response: This shell code 5.2 - Example: Deploying PHP Guestbook application with Redis | Verify that the two Redis follower replicas are running by querying the list of Pods:

Context: 5.2 - Example: Deploying PHP Guestbook application with Redis | Verify that the two Redis follower replicas are running by querying the list of Pods:


Prompt:
Complete this text code:

NAME                             READY   STATUS    RESTARTS   AGE
redis-follower-dddfbdcc9-82sfr   1/1     Running   0          37s

Response:
redis-follower-dddfbdcc9-qrt5k   1/1     Running   0          38s
redis-leader-fb76b4755-xjr2n     1/1     Running   0          11m

Context: 5.2 - Example: Deploying PHP Guestbook application with Redis | The guestbook application needs to communicate with the Redis followers to read data. To make the Redis followers discoverable, you must set up another Service.


Prompt:
Explain this text code:

NAME                             READY   STATUS    RESTARTS   AGE
redis-follower-dddfbdcc9-82sfr   1/1     Running   0          37s
redis-follower-dddfbdcc9-qrt5k   1/1     Running   0          38s
redis-leader-fb76b4755-xjr2n     1/1     Running   0          11m

Response: This text code 5.2 - Example: Deploying PHP Guestbook application with Redis | The guestbook application needs to communicate with the Redis followers to read data. To make the Redis followers discoverable, you must set up another Service.


Prompt:
Complete this yaml code:

# SOURCE: https://cloud.google.com/kubernetes-engine/docs/tutorials/guestbook
apiVersion: v1
kind: Service
metadata:
  name: redis-follower
  labels:
    app: redis
    role: follower

Response:
    tier: backend
spec:
  ports:
    # the port that this service should serve on
  - port: 6379
  selector:
    app: redis
    role: follower
    tier: backend

Context: 5.2 - Example: Deploying PHP Guestbook application with Redis | Apply the Redis Service from the following redis-follower-service.yaml file:


Prompt:
Explain this yaml code:

# SOURCE: https://cloud.google.com/kubernetes-engine/docs/tutorials/guestbook
apiVersion: v1
kind: Service
metadata:
  name: redis-follower
  labels:
    app: redis
    role: follower
    tier: backend
spec:
  ports:
    # the port that this service should serve on
  - port: 6379
  selector:
    app: redis
    role: follower
    tier: backend

Response: This yaml code 5.2 - Example: Deploying PHP Guestbook application with Redis | Apply the Redis Service from the following redis-follower-service.yaml file:


Prompt:
Explain this shell code:

kubectl apply -f https://k8s.io/examples/application/guestbook/redis-follower-service.yaml

Response: This shell code 5.2 - Example: Deploying PHP Guestbook application with Redis | Query the list of Services to verify that the Redis Service is running:


Prompt:
Complete this text code:

NAME             TYPE        CLUSTER-IP      EXTERNAL-IP   PORT(S)    AGE
kubernetes       ClusterIP   10.96.0.1       <none>        443/TCP    3d19h

Response:
redis-follower   ClusterIP   10.110.162.42   <none>        6379/TCP   9s
redis-leader     ClusterIP   10.103.78.24    <none>        6379/TCP   6m10s

Context: 5.2 - Example: Deploying PHP Guestbook application with Redis | Now that you have the Redis storage of your guestbook up and running, start the guestbook web servers. Like the Redis followers, the frontend is deployed using a Kubernetes Deployment.


Prompt:
Explain this text code:

NAME             TYPE        CLUSTER-IP      EXTERNAL-IP   PORT(S)    AGE
kubernetes       ClusterIP   10.96.0.1       <none>        443/TCP    3d19h
redis-follower   ClusterIP   10.110.162.42   <none>        6379/TCP   9s
redis-leader     ClusterIP   10.103.78.24    <none>        6379/TCP   6m10s

Response: This text code 5.2 - Example: Deploying PHP Guestbook application with Redis | Now that you have the Redis storage of your guestbook up and running, start the guestbook web servers. Like the Redis followers, the frontend is deployed using a Kubernetes Deployment.


Prompt:
Complete this yaml code:

# SOURCE: https://cloud.google.com/kubernetes-engine/docs/tutorials/guestbook
apiVersion: apps/v1
kind: Deployment
metadata:
  name: frontend
spec:
  replicas: 3
  selector:
    matchLabels:
        app: guestbook
        tier: frontend
  template:
    metadata:
      labels:

Response:
        app: guestbook
        tier: frontend
    spec:
      containers:
      - name: php-redis
        image: us-docker.pkg.dev/google-samples/containers/gke/gb-frontend:v5
        env:
        - name: GET_HOSTS_FROM
          value: "dns"
        resources:
          requests:
            cpu: 100m
            memory: 100Mi
        ports:
        - containerPort: 80

Context: 5.2 - Example: Deploying PHP Guestbook application with Redis | Apply the frontend Deployment from the frontend-deployment.yaml file:


Prompt:
Explain this yaml code:

# SOURCE: https://cloud.google.com/kubernetes-engine/docs/tutorials/guestbook
apiVersion: apps/v1
kind: Deployment
metadata:
  name: frontend
spec:
  replicas: 3
  selector:
    matchLabels:
        app: guestbook
        tier: frontend
  template:
    metadata:
      labels:
        app: guestbook
        tier: frontend
    spec:
      containers:
      - name: php-redis
        image: us-docker.pkg.dev/google-samples/containers/gke/gb-frontend:v5
        env:
        - name: GET_HOSTS_FROM
          value: "dns"
        resources:
          requests:
            cpu: 100m
            memory: 100Mi
        ports:
        - containerPort: 80

Response: This yaml code 5.2 - Example: Deploying PHP Guestbook application with Redis | Apply the frontend Deployment from the frontend-deployment.yaml file:


Prompt:
Explain this shell code:

kubectl apply -f https://k8s.io/examples/application/guestbook/frontend-deployment.yaml

Response: This shell code 5.2 - Example: Deploying PHP Guestbook application with Redis | Query the list of Pods to verify that the three frontend replicas are running:

Context: 5.2 - Example: Deploying PHP Guestbook application with Redis | Query the list of Pods to verify that the three frontend replicas are running:


Prompt:
Complete this text code:

NAME                        READY   STATUS    RESTARTS   AGE
frontend-85595f5bf9-5tqhb   1/1     Running   0          47s

Response:
frontend-85595f5bf9-qbzwm   1/1     Running   0          47s
frontend-85595f5bf9-zchwc   1/1     Running   0          47s

Context: 5.2 - Example: Deploying PHP Guestbook application with Redis | The Redis Services you applied is only accessible within the Kubernetes cluster because the default type for a Service is ClusterIP. ClusterIP provides a single IP address for the set of Pods the Serv


Prompt:
Explain this text code:

NAME                        READY   STATUS    RESTARTS   AGE
frontend-85595f5bf9-5tqhb   1/1     Running   0          47s
frontend-85595f5bf9-qbzwm   1/1     Running   0          47s
frontend-85595f5bf9-zchwc   1/1     Running   0          47s

Response: This text code 5.2 - Example: Deploying PHP Guestbook application with Redis | The Redis Services you applied is only accessible within the Kubernetes cluster because the default type for a Service is ClusterIP. ClusterIP provides a single IP address for the set of Pods the Serv


Prompt:
Complete this yaml code:

# SOURCE: https://cloud.google.com/kubernetes-engine/docs/tutorials/guestbook
apiVersion: v1
kind: Service
metadata:
  name: frontend
  labels:
    app: guestbook
    tier: frontend
spec:

Response:
  # if your cluster supports it, uncomment the following to automatically create
  # an external load-balanced IP for the frontend service.
  # type: LoadBalancer
  #type: LoadBalancer
  ports:
    # the port that this service should serve on
  - port: 80
  selector:
    app: guestbook
    tier: frontend

Context: 5.2 - Example: Deploying PHP Guestbook application with Redis | Apply the frontend Service from the frontend-service.yaml file:


Prompt:
Explain this yaml code:

# SOURCE: https://cloud.google.com/kubernetes-engine/docs/tutorials/guestbook
apiVersion: v1
kind: Service
metadata:
  name: frontend
  labels:
    app: guestbook
    tier: frontend
spec:
  # if your cluster supports it, uncomment the following to automatically create
  # an external load-balanced IP for the frontend service.
  # type: LoadBalancer
  #type: LoadBalancer
  ports:
    # the port that this service should serve on
  - port: 80
  selector:
    app: guestbook
    tier: frontend

Response: This yaml code 5.2 - Example: Deploying PHP Guestbook application with Redis | Apply the frontend Service from the frontend-service.yaml file:


Prompt:
Explain this shell code:

kubectl apply -f https://k8s.io/examples/application/guestbook/frontend-service.yaml

Response: This shell code 5.2 - Example: Deploying PHP Guestbook application with Redis | Query the list of Services to verify that the frontend Service is running:

Context: 5.2 - Example: Deploying PHP Guestbook application with Redis | Query the list of Services to verify that the frontend Service is running:


Prompt:
Complete this text code:

NAME             TYPE        CLUSTER-IP      EXTERNAL-IP   PORT(S)    AGE
frontend         ClusterIP   10.97.28.230    <none>        80/TCP     19s

Response:
kubernetes       ClusterIP   10.96.0.1       <none>        443/TCP    3d19h
redis-follower   ClusterIP   10.110.162.42   <none>        6379/TCP   5m48s
redis-leader     ClusterIP   10.103.78.24    <none>        6379/TCP   11m

Context: 5.2 - Example: Deploying PHP Guestbook application with Redis | Run the following command to forward port 8080 on your local machine to port 80 on the service.


Prompt:
Explain this text code:

NAME             TYPE        CLUSTER-IP      EXTERNAL-IP   PORT(S)    AGE
frontend         ClusterIP   10.97.28.230    <none>        80/TCP     19s
kubernetes       ClusterIP   10.96.0.1       <none>        443/TCP    3d19h
redis-follower   ClusterIP   10.110.162.42   <none>        6379/TCP   5m48s
redis-leader     ClusterIP   10.103.78.24    <none>        6379/TCP   11m

Response: This text code 5.2 - Example: Deploying PHP Guestbook application with Redis | Run the following command to forward port 8080 on your local machine to port 80 on the service.


Prompt:
Explain this text code:

Forwarding from 127.0.0.1:8080 -> 80
Forwarding from [::1]:8080 -> 80

Response: This text code 5.2 - Example: Deploying PHP Guestbook application with Redis | load the page http://localhost:8080 in your browser to view your guestbook.

Context: 5.2 - Example: Deploying PHP Guestbook application with Redis | load the page http://localhost:8080 in your browser to view your guestbook.


Prompt:
Explain this text code:

NAME       TYPE           CLUSTER-IP      EXTERNAL-IP        PORT(S)        AGE
frontend   LoadBalancer   10.51.242.136   109.197.92.229     80:32372/TCP   1m

Response: This text code 5.2 - Example: Deploying PHP Guestbook application with Redis | Copy the external IP address, and load the page in your browser to view your guestbook.

Context: 5.2 - Example: Deploying PHP Guestbook application with Redis | Copy the external IP address, and load the page in your browser to view your guestbook.


Prompt:
Complete this text code:

NAME                             READY   STATUS    RESTARTS   AGE
frontend-85595f5bf9-5df5m        1/1     Running   0          83s
frontend-85595f5bf9-7zmg5        1/1     Running   0          83s
frontend-85595f5bf9-cpskg        1/1     Running   0          15m

Response:
frontend-85595f5bf9-l2l54        1/1     Running   0          14m
frontend-85595f5bf9-l9c8z        1/1     Running   0          14m
redis-follower-dddfbdcc9-82sfr   1/1     Running   0          97m
redis-follower-dddfbdcc9-qrt5k   1/1     Running   0          97m
redis-leader-fb76b4755-xjr2n     1/1     Running   0          108m

Context: 5.2 - Example: Deploying PHP Guestbook application with Redis | Run the following command to scale down the number of frontend Pods:


Prompt:
Explain this text code:

NAME                             READY   STATUS    RESTARTS   AGE
frontend-85595f5bf9-5df5m        1/1     Running   0          83s
frontend-85595f5bf9-7zmg5        1/1     Running   0          83s
frontend-85595f5bf9-cpskg        1/1     Running   0          15m
frontend-85595f5bf9-l2l54        1/1     Running   0          14m
frontend-85595f5bf9-l9c8z        1/1     Running   0          14m
redis-follower-dddfbdcc9-82sfr   1/1     Running   0          97m
redis-follower-dddfbdcc9-qrt5k   1/1     Running   0          97m
redis-leader-fb76b4755-xjr2n     1/1     Running   0          108m

Response: This text code 5.2 - Example: Deploying PHP Guestbook application with Redis | Run the following command to scale down the number of frontend Pods:


Prompt:
Complete this text code:

NAME                             READY   STATUS    RESTARTS   AGE
frontend-85595f5bf9-cpskg        1/1     Running   0          16m
frontend-85595f5bf9-l9c8z        1/1     Running   0          15m

Response:
redis-follower-dddfbdcc9-82sfr   1/1     Running   0          98m
redis-follower-dddfbdcc9-qrt5k   1/1     Running   0          98m
redis-leader-fb76b4755-xjr2n     1/1     Running   0          109m

Context: 5.2 - Example: Deploying PHP Guestbook application with Redis | Deleting the Deployments and Services also deletes any running Pods. Use labels to delete multiple resources with one command.


Prompt:
Explain this text code:

NAME                             READY   STATUS    RESTARTS   AGE
frontend-85595f5bf9-cpskg        1/1     Running   0          16m
frontend-85595f5bf9-l9c8z        1/1     Running   0          15m
redis-follower-dddfbdcc9-82sfr   1/1     Running   0          98m
redis-follower-dddfbdcc9-qrt5k   1/1     Running   0          98m
redis-leader-fb76b4755-xjr2n     1/1     Running   0          109m

Response: This text code 5.2 - Example: Deploying PHP Guestbook application with Redis | Deleting the Deployments and Services also deletes any running Pods. Use labels to delete multiple resources with one command.


Prompt:
Complete this shell code:

kubectl delete deployment -l app=redis
kubectl delete service -l app=redis

Response:
kubectl delete deployment frontend
kubectl delete service frontend

Context: 5.2 - Example: Deploying PHP Guestbook application with Redis | The response should look similar to this:


Prompt:
Explain this shell code:

kubectl delete deployment -l app=redis
kubectl delete service -l app=redis
kubectl delete deployment frontend
kubectl delete service frontend

Response: This shell code 5.2 - Example: Deploying PHP Guestbook application with Redis | The response should look similar to this:


Prompt:
Complete this text code:

deployment.apps "redis-follower" deleted
deployment.apps "redis-leader" deleted

Response:
deployment.apps "frontend" deleted
service "frontend" deleted

Context: 5.2 - Example: Deploying PHP Guestbook application with Redis | Query the list of Pods to verify that no Pods are running:


Prompt:
Explain this text code:

deployment.apps "redis-follower" deleted
deployment.apps "redis-leader" deleted
deployment.apps "frontend" deleted
service "frontend" deleted

Response: This text code 5.2 - Example: Deploying PHP Guestbook application with Redis | Query the list of Pods to verify that no Pods are running:


Prompt:
Complete this yaml code:

apiVersion: v1
kind: Service
metadata:
  name: nginx
  labels:
    app: nginx
spec:
  ports:
  - port: 80
    name: web
  clusterIP: None
  selector:
    app: nginx
---
apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: web
spec:
  serviceName: "nginx"
  replicas: 2
  selector:
    matchLabels:

Response:
      app: nginx
  template:
    metadata:
      labels:
        app: nginx
    spec:
      containers:
      - name: nginx
        image: registry.k8s.io/nginx-slim:0.21
        ports:
        - containerPort: 80
          name: web
        volumeMounts:
        - name: www
          mountPath: /usr/share/nginx/html
  volumeClaimTemplates:
  - metadata:
      name: www
    spec:
      accessModes: [ "ReadWriteOnce" ]
      resources:
        requests:
          storage: 1Gi

Context: 6.1 - StatefulSet Basics | You will need to use at least two terminal windows. In the first terminal, use kubectl get to watch the creation of the StatefulSet's Pods.


Prompt:
Explain this yaml code:

apiVersion: v1
kind: Service
metadata:
  name: nginx
  labels:
    app: nginx
spec:
  ports:
  - port: 80
    name: web
  clusterIP: None
  selector:
    app: nginx
---
apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: web
spec:
  serviceName: "nginx"
  replicas: 2
  selector:
    matchLabels:
      app: nginx
  template:
    metadata:
      labels:
        app: nginx
    spec:
      containers:
      - name: nginx
        image: registry.k8s.io/nginx-slim:0.21
        ports:
        - containerPort: 80
          name: web
        volumeMounts:
        - name: www
          mountPath: /usr/share/nginx/html
  volumeClaimTemplates:
  - metadata:
      name: www
    spec:
      accessModes: [ "ReadWriteOnce" ]
      resources:
        requests:
          storage: 1Gi

Response: This yaml code 6.1 - StatefulSet Basics | You will need to use at least two terminal windows. In the first terminal, use kubectl get to watch the creation of the StatefulSet's Pods.


Prompt:
Explain this shell code:

# use this terminal to run commands that specify --watch
# end this watch when you are asked to start a new watch
kubectl get pods --watch -l app=nginx

Response: This shell code 6.1 - StatefulSet Basics | In the second terminal, use kubectl apply to create the headless Service and StatefulSet:

Context: 6.1 - StatefulSet Basics | In the second terminal, use kubectl apply to create the headless Service and StatefulSet:


Prompt:
Explain this shell code:

kubectl apply -f https://k8s.io/examples/application/web/web.yaml

Response: This shell code 6.1 - StatefulSet Basics | The command above creates two Pods, each running an NGINX webserver. Get the nginx Service...

Context: 6.1 - StatefulSet Basics | The command above creates two Pods, each running an NGINX webserver. Get the nginx Service...


Prompt:
Explain this text code:

NAME      TYPE         CLUSTER-IP   EXTERNAL-IP   PORT(S)   AGE
nginx     ClusterIP    None         <none>        80/TCP    12s

Response: This text code 6.1 - StatefulSet Basics | ...then get the web StatefulSet, to verify that both were created successfully:

Context: 6.1 - StatefulSet Basics | ...then get the web StatefulSet, to verify that both were created successfully:


Prompt:
Explain this shell code:

# Do not start a new watch;
# this should already be running
kubectl get pods --watch -l app=nginx

Response: This shell code 6.1 - StatefulSet Basics | Notice that the web-1 Pod is not launched until the web-0 Pod is Running (see Pod Phase) and Ready (see type in Pod Conditions).

Context: 6.1 - StatefulSet Basics | Notice that the web-1 Pod is not launched until the web-0 Pod is Running (see Pod Phase) and Ready (see type in Pod Conditions).


Prompt:
Complete this text code:

NAME      READY     STATUS    RESTARTS   AGE
web-0     0/1       Pending   0          0s
web-0     0/1       Pending   0         0s
web-0     0/1       ContainerCreating   0         0s

Response:
web-0     1/1       Running   0         19s
web-1     0/1       Pending   0         0s
web-1     0/1       Pending   0         0s
web-1     0/1       ContainerCreating   0         0s
web-1     1/1       Running   0         18s


Prompt:
Explain this text code:

NAME      READY     STATUS    RESTARTS   AGE
web-0     0/1       Pending   0          0s
web-0     0/1       Pending   0         0s
web-0     0/1       ContainerCreating   0         0s
web-0     1/1       Running   0         19s
web-1     0/1       Pending   0         0s
web-1     0/1       Pending   0         0s
web-1     0/1       ContainerCreating   0         0s
web-1     1/1       Running   0         18s

Response: This text code 6.1 - StatefulSet Basics | Notice that the web-1 Pod is not launched until the web-0 Pod is Running (see Pod Phase) and Ready (see type in Pod Conditions).


Prompt:
Explain this text code:

NAME      READY     STATUS    RESTARTS   AGE
web-0     1/1       Running   0          1m
web-1     1/1       Running   0          1m

Response: This text code 6.1 - StatefulSet Basics | As mentioned in the StatefulSets concept, the Pods in a StatefulSet have a sticky, unique identity. This identity is based on a unique ordinal index that is assigned to each Pod by the StatefulSet con

Context: 6.1 - StatefulSet Basics | As mentioned in the StatefulSets concept, the Pods in a StatefulSet have a sticky, unique identity. This identity is based on a unique ordinal index that is assigned to each Pod by the StatefulSet con


Prompt:
Explain this shell code:

for i in 0 1; do kubectl exec "web-$i" -- sh -c 'hostname'; done

Response: This shell code 6.1 - StatefulSet Basics | Use kubectl run to execute a container that provides the nslookup command from the dnsutils package. Using nslookup on the Pods' hostnames, you can examine their in-cluster DNS addresses:

Context: 6.1 - StatefulSet Basics | Use kubectl run to execute a container that provides the nslookup command from the dnsutils package. Using nslookup on the Pods' hostnames, you can examine their in-cluster DNS addresses:


Prompt:
Explain this shell code:

kubectl run -i --tty --image busybox:1.28 dns-test --restart=Never --rm

Response: This shell code 6.1 - StatefulSet Basics | which starts a new shell. In that new shell, run:

Context: 6.1 - StatefulSet Basics | which starts a new shell. In that new shell, run:


Prompt:
Explain this shell code:

# Run this in the dns-test container shell
nslookup web-0.nginx

Response: This shell code 6.1 - StatefulSet Basics | The output is similar to:

Context: 6.1 - StatefulSet Basics | The output is similar to:


Prompt:
Complete this text code:

Server:    10.0.0.10
Address 1: 10.0.0.10 kube-dns.kube-system.svc.cluster.local

Name:      web-0.nginx
Address 1: 10.244.1.6

Response:
nslookup web-1.nginx
Server:    10.0.0.10
Address 1: 10.0.0.10 kube-dns.kube-system.svc.cluster.local

Name:      web-1.nginx
Address 1: 10.244.2.6

Context: 6.1 - StatefulSet Basics | (and now exit the container shell: exit)


Prompt:
Explain this text code:

Server:    10.0.0.10
Address 1: 10.0.0.10 kube-dns.kube-system.svc.cluster.local

Name:      web-0.nginx
Address 1: 10.244.1.6

nslookup web-1.nginx
Server:    10.0.0.10
Address 1: 10.0.0.10 kube-dns.kube-system.svc.cluster.local

Name:      web-1.nginx
Address 1: 10.244.2.6

Response: This text code 6.1 - StatefulSet Basics | (and now exit the container shell: exit)


Prompt:
Explain this shell code:

# Start a new watch
# End this watch when you've seen that the delete is finished
kubectl get pod --watch -l app=nginx

Response: This shell code 6.1 - StatefulSet Basics | In a second terminal, use kubectl delete to delete all the Pods in the StatefulSet:

Context: 6.1 - StatefulSet Basics | In a second terminal, use kubectl delete to delete all the Pods in the StatefulSet:


Prompt:
Explain this shell code:

# This should already be running
kubectl get pod --watch -l app=nginx

Response: This shell code 6.1 - StatefulSet Basics | Use kubectl exec and kubectl run to view the Pods' hostnames and in-cluster DNS entries. First, view the Pods' hostnames:

Context: 6.1 - StatefulSet Basics | Use kubectl exec and kubectl run to view the Pods' hostnames and in-cluster DNS entries. First, view the Pods' hostnames:


Prompt:
Complete this text code:

NAME      READY     STATUS              RESTARTS   AGE
web-0     0/1       ContainerCreating   0          0s
NAME      READY     STATUS    RESTARTS   AGE
web-0     1/1       Running   0          2s

Response:
web-1     0/1       Pending   0         0s
web-1     0/1       Pending   0         0s
web-1     0/1       ContainerCreating   0         0s
web-1     1/1       Running   0         34s


Prompt:
Explain this text code:

NAME      READY     STATUS              RESTARTS   AGE
web-0     0/1       ContainerCreating   0          0s
NAME      READY     STATUS    RESTARTS   AGE
web-0     1/1       Running   0          2s
web-1     0/1       Pending   0         0s
web-1     0/1       Pending   0         0s
web-1     0/1       ContainerCreating   0         0s
web-1     1/1       Running   0         34s

Response: This text code 6.1 - StatefulSet Basics | Use kubectl exec and kubectl run to view the Pods' hostnames and in-cluster DNS entries. First, view the Pods' hostnames:


Prompt:
Explain this shell code:

for i in 0 1; do kubectl exec web-$i -- sh -c 'hostname'; done

Response: This shell code 6.1 - StatefulSet Basics | then, run:

Context: 6.1 - StatefulSet Basics | then, run:


Prompt:
Explain this shell code:

kubectl run -i --tty --image busybox:1.28 dns-test --restart=Never --rm

Response: This shell code 6.1 - StatefulSet Basics | which starts a new shell.In that new shell, run:

Context: 6.1 - StatefulSet Basics | which starts a new shell.In that new shell, run:


Prompt:
Explain this shell code:

# Run this in the dns-test container shell
nslookup web-0.nginx

Response: This shell code 6.1 - StatefulSet Basics | The output is similar to:


Prompt:
Complete this text code:

Server:    10.0.0.10
Address 1: 10.0.0.10 kube-dns.kube-system.svc.cluster.local

Name:      web-0.nginx
Address 1: 10.244.1.7

Response:
nslookup web-1.nginx
Server:    10.0.0.10
Address 1: 10.0.0.10 kube-dns.kube-system.svc.cluster.local

Name:      web-1.nginx
Address 1: 10.244.2.8


Prompt:
Explain this text code:

Server:    10.0.0.10
Address 1: 10.0.0.10 kube-dns.kube-system.svc.cluster.local

Name:      web-0.nginx
Address 1: 10.244.1.7

nslookup web-1.nginx
Server:    10.0.0.10
Address 1: 10.0.0.10 kube-dns.kube-system.svc.cluster.local

Name:      web-1.nginx
Address 1: 10.244.2.8

Response: This text code 6.1 - StatefulSet Basics | (and now exit the container shell: exit)


Prompt:
Explain this text code:

NAME        STATUS    VOLUME                                     CAPACITY   ACCESSMODES   AGE
www-web-0   Bound     pvc-15c268c7-b507-11e6-932f-42010a800002   1Gi        RWO           48s
www-web-1   Bound     pvc-15c79307-b507-11e6-932f-42010a800002   1Gi        RWO           48s

Response: This text code 6.1 - StatefulSet Basics | The StatefulSet controller created two PersistentVolumeClaims that are bound to two PersistentVolumes.

Context: 6.1 - StatefulSet Basics | The StatefulSet controller created two PersistentVolumeClaims that are bound to two PersistentVolumes.


Prompt:
Explain this shell code:

for i in 0 1; do kubectl exec "web-$i" -- sh -c 'echo "$(hostname)" > /usr/share/nginx/html/index.html'; done

for i in 0 1; do kubectl exec -i -t "web-$i" -- curl http://localhost/; done

Response: This shell code 6.1 - StatefulSet Basics | If you instead see 403 Forbidden responses for the above curl command, you will need to fix the permissions of the directory mounted by the volumeMounts (due to a bug when using hostPath volumes), by

Context: 6.1 - StatefulSet Basics | If you instead see 403 Forbidden responses for the above curl command, you will need to fix the permissions of the directory mounted by the volumeMounts (due to a bug when using hostPath volumes), by


Prompt:
Explain this text code:

for i in 0 1; do kubectl exec web-$i -- chmod 755 /usr/share/nginx/html; done

Response: This text code 6.1 - StatefulSet Basics | before retrying the curl command above.

Context: 6.1 - StatefulSet Basics | before retrying the curl command above.


Prompt:
Explain this shell code:

# End this watch when you've reached the end of the section.
# At the start of "Scaling a StatefulSet" you'll start a new watch.
kubectl get pod --watch -l app=nginx

Response: This shell code 6.1 - StatefulSet Basics | In a second terminal, delete all of the StatefulSet's Pods:

Context: 6.1 - StatefulSet Basics | In a second terminal, delete all of the StatefulSet's Pods:


Prompt:
Explain this shell code:

# This should already be running
kubectl get pod --watch -l app=nginx

Response: This shell code 6.1 - StatefulSet Basics | Verify the web servers continue to serve their hostnames:

Context: 6.1 - StatefulSet Basics | Verify the web servers continue to serve their hostnames:


Prompt:
Complete this text code:

NAME      READY     STATUS              RESTARTS   AGE
web-0     0/1       ContainerCreating   0          0s
NAME      READY     STATUS    RESTARTS   AGE
web-0     1/1       Running   0          2s

Response:
web-1     0/1       Pending   0         0s
web-1     0/1       Pending   0         0s
web-1     0/1       ContainerCreating   0         0s
web-1     1/1       Running   0         34s


Prompt:
Explain this text code:

NAME      READY     STATUS              RESTARTS   AGE
web-0     0/1       ContainerCreating   0          0s
NAME      READY     STATUS    RESTARTS   AGE
web-0     1/1       Running   0          2s
web-1     0/1       Pending   0         0s
web-1     0/1       Pending   0         0s
web-1     0/1       ContainerCreating   0         0s
web-1     1/1       Running   0         34s

Response: This text code 6.1 - StatefulSet Basics | Verify the web servers continue to serve their hostnames:


Prompt:
Explain this text code:

for i in 0 1; do kubectl exec -i -t "web-$i" -- curl http://localhost/; done

Response: This text code 6.1 - StatefulSet Basics | Even though web-0 and web-1 were rescheduled, they continue to serve their hostnames because the PersistentVolumes associated with their PersistentVolumeClaims are remounted to their volumeMounts. No

Context: 6.1 - StatefulSet Basics | Even though web-0 and web-1 were rescheduled, they continue to serve their hostnames because the PersistentVolumes associated with their PersistentVolumeClaims are remounted to their volumeMounts. No


Prompt:
Complete this shell code:

# If you already have a watch running, you can continue using that.
# Otherwise, start one.

Response:
# End this watch when there are 5 healthy Pods for the StatefulSet
kubectl get pods --watch -l app=nginx

Context: 6.1 - StatefulSet Basics | In another terminal window, use kubectl scale to scale the number of replicas to 5:


Prompt:
Explain this shell code:

# If you already have a watch running, you can continue using that.
# Otherwise, start one.
# End this watch when there are 5 healthy Pods for the StatefulSet
kubectl get pods --watch -l app=nginx

Response: This shell code 6.1 - StatefulSet Basics | In another terminal window, use kubectl scale to scale the number of replicas to 5:


Prompt:
Explain this shell code:

# This should already be running
kubectl get pod --watch -l app=nginx

Response: This shell code 6.1 - StatefulSet Basics | The StatefulSet controller scaled the number of replicas. As with StatefulSet creation, the StatefulSet controller created each Pod sequentially with respect to its ordinal index, and it waited for ea

Context: 6.1 - StatefulSet Basics | The StatefulSet controller scaled the number of replicas. As with StatefulSet creation, the StatefulSet controller created each Pod sequentially with respect to its ordinal index, and it waited for ea


Prompt:
Complete this text code:

NAME      READY     STATUS    RESTARTS   AGE
web-0     1/1       Running   0          2h
web-1     1/1       Running   0          2h
NAME      READY     STATUS    RESTARTS   AGE
web-2     0/1       Pending   0          0s
web-2     0/1       Pending   0         0s
web-2     0/1       ContainerCreating   0         0s
web-2     1/1       Running   0         19s

Response:
web-3     0/1       Pending   0         0s
web-3     0/1       Pending   0         0s
web-3     0/1       ContainerCreating   0         0s
web-3     1/1       Running   0         18s
web-4     0/1       Pending   0         0s
web-4     0/1       Pending   0         0s
web-4     0/1       ContainerCreating   0         0s
web-4     1/1       Running   0         19s


Prompt:
Explain this text code:

NAME      READY     STATUS    RESTARTS   AGE
web-0     1/1       Running   0          2h
web-1     1/1       Running   0          2h
NAME      READY     STATUS    RESTARTS   AGE
web-2     0/1       Pending   0          0s
web-2     0/1       Pending   0         0s
web-2     0/1       ContainerCreating   0         0s
web-2     1/1       Running   0         19s
web-3     0/1       Pending   0         0s
web-3     0/1       Pending   0         0s
web-3     0/1       ContainerCreating   0         0s
web-3     1/1       Running   0         18s
web-4     0/1       Pending   0         0s
web-4     0/1       Pending   0         0s
web-4     0/1       ContainerCreating   0         0s
web-4     1/1       Running   0         19s

Response: This text code 6.1 - StatefulSet Basics | The StatefulSet controller scaled the number of replicas. As with StatefulSet creation, the StatefulSet controller created each Pod sequentially with respect to its ordinal index, and it waited for ea


Prompt:
Explain this shell code:

# End this watch when there are only 3 Pods for the StatefulSet
kubectl get pod --watch -l app=nginx

Response: This shell code 6.1 - StatefulSet Basics | In another terminal, use kubectl patch to scale the StatefulSet back down to three replicas:

Context: 6.1 - StatefulSet Basics | In another terminal, use kubectl patch to scale the StatefulSet back down to three replicas:


Prompt:
Explain this shell code:

# This should already be running
kubectl get pods --watch -l app=nginx

Response: This shell code 6.1 - StatefulSet Basics | The control plane deleted one Pod at a time, in reverse order with respect to its ordinal index, and it waited for each Pod to be completely shut down before deleting the next one.

Context: 6.1 - StatefulSet Basics | The control plane deleted one Pod at a time, in reverse order with respect to its ordinal index, and it waited for each Pod to be completely shut down before deleting the next one.


Prompt:
Complete this text code:

NAME      READY     STATUS              RESTARTS   AGE
web-0     1/1       Running             0          3h
web-1     1/1       Running             0          3h
web-2     1/1       Running             0          55s
web-3     1/1       Running             0          36s
web-4     0/1       ContainerCreating   0          18s

Response:
NAME      READY     STATUS    RESTARTS   AGE
web-4     1/1       Running   0          19s
web-4     1/1       Terminating   0         24s
web-4     1/1       Terminating   0         24s
web-3     1/1       Terminating   0         42s
web-3     1/1       Terminating   0         42s


Prompt:
Explain this text code:

NAME      READY     STATUS              RESTARTS   AGE
web-0     1/1       Running             0          3h
web-1     1/1       Running             0          3h
web-2     1/1       Running             0          55s
web-3     1/1       Running             0          36s
web-4     0/1       ContainerCreating   0          18s
NAME      READY     STATUS    RESTARTS   AGE
web-4     1/1       Running   0          19s
web-4     1/1       Terminating   0         24s
web-4     1/1       Terminating   0         24s
web-3     1/1       Terminating   0         42s
web-3     1/1       Terminating   0         42s

Response: This text code 6.1 - StatefulSet Basics | The control plane deleted one Pod at a time, in reverse order with respect to its ordinal index, and it waited for each Pod to be completely shut down before deleting the next one.


Prompt:
Complete this text code:

NAME        STATUS    VOLUME                                     CAPACITY   ACCESSMODES   AGE
www-web-0   Bound     pvc-15c268c7-b507-11e6-932f-42010a800002   1Gi        RWO           13h
www-web-1   Bound     pvc-15c79307-b507-11e6-932f-42010a800002   1Gi        RWO           13h

Response:
www-web-2   Bound     pvc-e1125b27-b508-11e6-932f-42010a800002   1Gi        RWO           13h
www-web-3   Bound     pvc-e1176df6-b508-11e6-932f-42010a800002   1Gi        RWO           13h
www-web-4   Bound     pvc-e11bb5f8-b508-11e6-932f-42010a800002   1Gi        RWO           13h

Context: 6.1 - StatefulSet Basics | There are still five PersistentVolumeClaims and five PersistentVolumes. When exploring a Pod's stable storage, you saw that the PersistentVolumes mounted to the Pods of a StatefulSet are not deleted w


Prompt:
Explain this text code:

NAME        STATUS    VOLUME                                     CAPACITY   ACCESSMODES   AGE
www-web-0   Bound     pvc-15c268c7-b507-11e6-932f-42010a800002   1Gi        RWO           13h
www-web-1   Bound     pvc-15c79307-b507-11e6-932f-42010a800002   1Gi        RWO           13h
www-web-2   Bound     pvc-e1125b27-b508-11e6-932f-42010a800002   1Gi        RWO           13h
www-web-3   Bound     pvc-e1176df6-b508-11e6-932f-42010a800002   1Gi        RWO           13h
www-web-4   Bound     pvc-e11bb5f8-b508-11e6-932f-42010a800002   1Gi        RWO           13h

Response: This text code 6.1 - StatefulSet Basics | There are still five PersistentVolumeClaims and five PersistentVolumes. When exploring a Pod's stable storage, you saw that the PersistentVolumes mounted to the Pods of a StatefulSet are not deleted w


Prompt:
Explain this shell code:

kubectl patch statefulset web --type='json' -p='[{"op": "replace", "path": "/spec/template/spec/containers/0/image", "value":"registry.k8s.io/nginx-slim:0.24"}]'

Response: This shell code 6.1 - StatefulSet Basics | In another terminal, watch the Pods in the StatefulSet:

Context: 6.1 - StatefulSet Basics | In another terminal, watch the Pods in the StatefulSet:


Prompt:
Complete this shell code:

# End this watch when the rollout is complete
#

Response:
# If you're not sure, leave it running one more minute
kubectl get pod -l app=nginx --watch

Context: 6.1 - StatefulSet Basics | The output is similar to:


Prompt:
Explain this shell code:

# End this watch when the rollout is complete
#
# If you're not sure, leave it running one more minute
kubectl get pod -l app=nginx --watch

Response: This shell code 6.1 - StatefulSet Basics | The output is similar to:


Prompt:
Complete this text code:

NAME      READY     STATUS    RESTARTS   AGE
web-0     1/1       Running   0          7m
web-1     1/1       Running   0          7m
web-2     1/1       Running   0          8m
web-2     1/1       Terminating   0         8m
web-2     1/1       Terminating   0         8m
web-2     0/1       Terminating   0         8m
web-2     0/1       Terminating   0         8m
web-2     0/1       Terminating   0         8m
web-2     0/1       Terminating   0         8m
web-2     0/1       Pending   0         0s
web-2     0/1       Pending   0         0s
web-2     0/1       ContainerCreating   0         0s
web-2     1/1       Running   0         19s
web-1     1/1       Terminating   0         8m
web-1     0/1       Terminating   0         8m

Response:
web-1     0/1       Terminating   0         8m
web-1     0/1       Terminating   0         8m
web-1     0/1       Pending   0         0s
web-1     0/1       Pending   0         0s
web-1     0/1       ContainerCreating   0         0s
web-1     1/1       Running   0         6s
web-0     1/1       Terminating   0         7m
web-0     1/1       Terminating   0         7m
web-0     0/1       Terminating   0         7m
web-0     0/1       Terminating   0         7m
web-0     0/1       Terminating   0         7m
web-0     0/1       Terminating   0         7m
web-0     0/1       Pending   0         0s
web-0     0/1       Pending   0         0s
web-0     0/1       ContainerCreating   0         0s
web-0     1/1       Running   0         10s

Context: 6.1 - StatefulSet Basics | The Pods in the StatefulSet are updated in reverse ordinal order. The StatefulSet controller terminates each Pod, and waits for it to transition to Running and Ready prior to updating the next Pod. No


Prompt:
Explain this text code:

NAME      READY     STATUS    RESTARTS   AGE
web-0     1/1       Running   0          7m
web-1     1/1       Running   0          7m
web-2     1/1       Running   0          8m
web-2     1/1       Terminating   0         8m
web-2     1/1       Terminating   0         8m
web-2     0/1       Terminating   0         8m
web-2     0/1       Terminating   0         8m
web-2     0/1       Terminating   0         8m
web-2     0/1       Terminating   0         8m
web-2     0/1       Pending   0         0s
web-2     0/1       Pending   0         0s
web-2     0/1       ContainerCreating   0         0s
web-2     1/1       Running   0         19s
web-1     1/1       Terminating   0         8m
web-1     0/1       Terminating   0         8m
web-1     0/1       Terminating   0         8m
web-1     0/1       Terminating   0         8m
web-1     0/1       Pending   0         0s
web-1     0/1       Pending   0         0s
web-1     0/1       ContainerCreating   0         0s
web-1     1/1       Running   0         6s
web-0     1/1       Terminating   0         7m
web-0     1/1       Terminating   0         7m
web-0     0/1       Terminating   0         7m
web-0     0/1       Terminating   0         7m
web-0     0/1       Terminating   0         7m
web-0     0/1       Terminating   0         7m
web-0     0/1       Pending   0         0s
web-0     0/1       Pending   0         0s
web-0     0/1       ContainerCreating   0         0s
web-0     1/1       Running   0         10s

Response: This text code 6.1 - StatefulSet Basics | The Pods in the StatefulSet are updated in reverse ordinal order. The StatefulSet controller terminates each Pod, and waits for it to transition to Running and Ready prior to updating the next Pod. No


Prompt:
Explain this shell code:

for p in 0 1 2; do kubectl get pod "web-$p" --template '{{range $i, $c := .spec.containers}}{{$c.image}}{{end}}'; echo; done

Response: This shell code 6.1 - StatefulSet Basics | All the Pods in the StatefulSet are now running the previous container image.

Context: 6.1 - StatefulSet Basics | All the Pods in the StatefulSet are now running the previous container image.


Prompt:
Explain this text code:

registry.k8s.io/nginx-slim:0.24
registry.k8s.io/nginx-slim:0.24
registry.k8s.io/nginx-slim:0.24

Response: This text code 6.1 - StatefulSet Basics | All the Pods in the StatefulSet are now running the previous container image.


Prompt:
Complete this shell code:

# The value of "partition" determines which ordinals a change applies to
# Make sure to use a number bigger than the last ordinal for the

Response:
# StatefulSet
kubectl patch statefulset web -p '{"spec":{"updateStrategy":{"type":"RollingUpdate","rollingUpdate":{"partition":3}}}}'

Context: 6.1 - StatefulSet Basics | Patch the StatefulSet again to change the container image that this StatefulSet uses:


Prompt:
Explain this shell code:

# The value of "partition" determines which ordinals a change applies to
# Make sure to use a number bigger than the last ordinal for the
# StatefulSet
kubectl patch statefulset web -p '{"spec":{"updateStrategy":{"type":"RollingUpdate","rollingUpdate":{"partition":3}}}}'

Response: This shell code 6.1 - StatefulSet Basics | Patch the StatefulSet again to change the container image that this StatefulSet uses:


Prompt:
Explain this shell code:

kubectl patch statefulset web --type='json' -p='[{"op": "replace", "path": "/spec/template/spec/containers/0/image", "value":"registry.k8s.io/nginx-slim:0.21"}]'

Response: This shell code 6.1 - StatefulSet Basics | Delete a Pod in the StatefulSet:

Context: 6.1 - StatefulSet Basics | Delete a Pod in the StatefulSet:


Prompt:
Explain this shell code:

# End the watch when you see that web-2 is healthy
kubectl get pod -l app=nginx --watch

Response: This shell code 6.1 - StatefulSet Basics | Get the Pod's container image:

Context: 6.1 - StatefulSet Basics | Get the Pod's container image:


Prompt:
Complete this text code:

NAME      READY     STATUS              RESTARTS   AGE
web-0     1/1       Running             0          4m

Response:
web-1     1/1       Running             0          4m
web-2     0/1       ContainerCreating   0          11s
web-2     1/1       Running   0         18s


Prompt:
Explain this text code:

NAME      READY     STATUS              RESTARTS   AGE
web-0     1/1       Running             0          4m
web-1     1/1       Running             0          4m
web-2     0/1       ContainerCreating   0          11s
web-2     1/1       Running   0         18s

Response: This text code 6.1 - StatefulSet Basics | Get the Pod's container image:


Prompt:
Explain this shell code:

kubectl get pod web-2 --template '{{range $i, $c := .spec.containers}}{{$c.image}}{{end}}'

Response: This shell code 6.1 - StatefulSet Basics | Notice that, even though the update strategy is RollingUpdate the StatefulSet restored the Pod with the original container image. This is because the ordinal of the Pod is less than the partition spec

Context: 6.1 - StatefulSet Basics | Notice that, even though the update strategy is RollingUpdate the StatefulSet restored the Pod with the original container image. This is because the ordinal of the Pod is less than the partition spec


Prompt:
Explain this shell code:

# The value of "partition" should match the highest existing ordinal for
# the StatefulSet
kubectl patch statefulset web -p '{"spec":{"updateStrategy":{"type":"RollingUpdate","rollingUpdate":{"partition":2}}}}'

Response: This shell code 6.1 - StatefulSet Basics | The control plane triggers replacement for web-2 (implemented by a graceful delete followed by creating a new Pod once the deletion is complete). Wait for the new web-2 Pod to be Running and Ready.

Context: 6.1 - StatefulSet Basics | The control plane triggers replacement for web-2 (implemented by a graceful delete followed by creating a new Pod once the deletion is complete). Wait for the new web-2 Pod to be Running and Ready.


Prompt:
Explain this shell code:

# This should already be running
kubectl get pod -l app=nginx --watch

Response: This shell code 6.1 - StatefulSet Basics | Get the Pod's container:

Context: 6.1 - StatefulSet Basics | Get the Pod's container:


Prompt:
Complete this text code:

NAME      READY     STATUS              RESTARTS   AGE
web-0     1/1       Running             0          4m

Response:
web-1     1/1       Running             0          4m
web-2     0/1       ContainerCreating   0          11s
web-2     1/1       Running   0         18s


Prompt:
Explain this text code:

NAME      READY     STATUS              RESTARTS   AGE
web-0     1/1       Running             0          4m
web-1     1/1       Running             0          4m
web-2     0/1       ContainerCreating   0          11s
web-2     1/1       Running   0         18s

Response: This text code 6.1 - StatefulSet Basics | Get the Pod's container:


Prompt:
Explain this shell code:

kubectl get pod web-2 --template '{{range $i, $c := .spec.containers}}{{$c.image}}{{end}}'

Response: This shell code 6.1 - StatefulSet Basics | When you changed the partition, the StatefulSet controller automatically updated the web-2 Pod because the Pod's ordinal was greater than or equal to the partition.

Context: 6.1 - StatefulSet Basics | When you changed the partition, the StatefulSet controller automatically updated the web-2 Pod because the Pod's ordinal was greater than or equal to the partition.