Updates after 20231103

Author: nicholasdille

120_kubernetes/network_policy/slides.md

@@ -44,7 +44,7 @@ No audit logging
 
 ### No support for network policy
 
-kubenet, [flannel](https://github.com/flannel-io/flannel)
+kubenet, [flannel](https://github.com/flannel-io/flannel), [kindnet](https://github.com/aojea/kindnet)
 
 ### Calico
 

120_kubernetes/rbac/rakkess.demo

@@ -0,0 +1,7 @@
+# rakkess (access-matrix)
+
+# Install
+krew install access-matrix
+
+# Check jane
+kubectl access-matrix resource pod --namespace default --as jane

120_kubernetes/rbac/rbac.demo

@@ -33,8 +33,9 @@ roleRef:
 EOF
 
 # Check Role and RoleBinding
-kubectl auth can-i get pods --as jane
+kubectl auth can-i get pods --namespace default --as jane
 kubectl auth can-i get pods --namespace kube-system --as jane
+kubectl auth can-i --namespace default --list --as jane
 
 # Create ClusteRole and ClusterRoleBinding
 cat <<EOF | kubectl apply -f -
@@ -88,6 +89,6 @@ roleRef:
 EOF
 
 # Check ClusterRole and RoleBinding
-kubectl auth can-i get secrets --as jane
-kubectl auth can-i get secrets --as dave
+kubectl auth can-i get secrets --namespace default --as jane
+kubectl auth can-i get secrets --namespace default --as dave
 kubectl auth can-i get secrets --namespace kube-system --as dave

120_kubernetes/rbac/rbac.drawio.svg

@@ -28,6 +28,8 @@ Show mixed permissions
 
 Using `kubectl auth can-i` to check RBAC [](https://kubernetes.io/docs/reference/access-authn-authz/authorization/#checking-api-access)
 
+Demonstrate [rakkess](https://github.com/corneliusweig/rakkess) [<i class="fa fa-comment-code"></i>](https://github.com/nicholasdille/container-slides/blob/master/120_kubernetes/rbac/rakkess.demo "rakkess.demo")
+
 ---
 
 ## How to write roles

120_kubernetes/rbac/slides.md

@@ -1,13 +1,13 @@
 # SBoM generation and scanning
 
 # Install tools
-docker-setup --tools=docker,buildx,docker-compose,kind,helm,kubectl,gvisor,cosign,kyverno,syft,grype,trivy install
+uniget install docker buildx docker-compose kind helm kubectl gvisor cosign kyverno syft grype trivy
 
 # Generate SBoM of trivy
-syft packages aquasec/trivy:0.34.0 --file trivy.json --output cyclonedx-json
+syft packages aquasec/trivy:0.34.0 --output cyclonedx-json=trivy.json
 
 # Generate SBoM of alpine 3.18
-syft packages alpine:3.18 --file alpine-3.18.json --output cyclonedx-json
+syft packages alpine:3.18 --output cyclonedx-json=alpine-3.18.json
 
 # Scan trivy.json
 grype sbom:trivy.json

170_supply_chain_security/sbom/sbom.demo

@@ -1,9 +1,2 @@
-- Fix RBAC image
-- can-i namespace
-- krew, https://github.com/corneliusweig/rakkess
-- kubectl auth can-i --list --as jane
 - automountServiceAccountToken: false
 - kyverno: fix and note automountServiceAccountToken
-- kindnet no netpol
-- syft deprecated
-- docker-setup