gatekeeper | Kubernetes Operator to manage Dynamic Admission Controllers | SDK library

I'm trying to deploy kubeflow on and OVH managed k8 cluster.

After the initial setup of the k8 cluster, I ran the following commands to install kubeflow, as suggested here:

In Open Policy Agent (https://www.openpolicyagent.org/)

regarding to Kubernetes, depending which engine is used:

• Gatekeeper: https://github.com/open-policy-agent/gatekeeper

OR

• Plain OPA with kube-mgmt: https://www.openpolicyagent.org/docs/latest/kubernetes-introduction/#how-does-it-work-with-plain-opa-and-kube-mgmt

There are different ways to define validation rules:

• In Gatekeeper the violation is used. See sample rules here: https://github.com/open-policy-agent/gatekeeper-library/tree/master/library/general

• In plain OPA samples, the deny rule, see sample here: https://www.openpolicyagent.org/docs/latest/kubernetes-introduction/#how-does-it-work-with-plain-opa-and-kube-mgmt

It seems to be the OPA constraint framework defines it as violation: https://github.com/open-policy-agent/frameworks/tree/master/constraint#rule-schema

So what is the exact "story" behind this, why it is not consistent between the different engines?

Notes:

• This doc reflects on this: https://www.openshift.com/blog/better-kubernetes-security-with-open-policy-agent-opa-part-2

• Here is mentioned how to support interoperability in the script: https://github.com/open-policy-agent/gatekeeper/issues/1168#issuecomment-794759747

• https://github.com/open-policy-agent/gatekeeper/issues/168 In this issue is the migration mentioned, is just because of "dry run" support?.

I have access to a number of AWS accounts belonging to a client, and would like to set up a public certificate using DNS validation. I believe this means I also need to set up DNS too.

I have two accounts:

• dsc-staging (contains new cert, local DNS for subdomain)
• eds-staging (contains root of new subdomain)

The new cert/DNS shall be:

gatekeeper.s.aws.example.com

This is set up in account dsc-staging. I have gone through the "DNS validation" option, and it says that it is pending. To start with there is no DNS for this name in either account, so this would eventually fail if left like that.

So, in the same account, I have created a HostedZone in Route 53, which creates default NS and SOA records.

Now, in the other account, eds-staging, there are existing records for:

• s.aws.example.internal (NS record with four rows in a single value)
• s.aws.example.internal (SOA record)

I have added the validation record in here, as a CNAME. (I am informed that it would be OK to have put the validation record in the local Route 53, but I have chosen for now to do it here).

Now, I believe that I need to inform AWS how to connect gatekeeper.s.aws.example.com with the known internal name s.aws.example.internal, which already exists, and is used by other things. I believe the process of connecting the two is called "delegation". I was given some instructions to take the NS records from the local account for gatekeeper.s.aws.example.com and copy them to the parent domain s.aws.example.internal in the other account.

However, the AWS UI in Route 53 seems to disallow adding another NS record - is it because one already exists? If so can I just add my four records under the existing four (ie. in the same record)?

I believe that if I wire up this DNS so that it is resolvable, the certificate will automatically become validate-able, and that will happen automatically. Is this assumption correct?

I have already compiled QEMU by myself in MacBook pro M1, and downloaded ubuntu 20.04.

When I am trying to install ubuntu by:

I'm using ad hoc (outside App Store) distribution for my document-based app. The app is NOT sandboxed, and entitlements are set correctly:

I have a problem when trying to implement a WMS/WMTS service in mapbox. I'm using java and android studio. I managed to place the map in the right coordinates, but when I zoom in the tiles from the service duplicates and scatters on the map. It also does not scale with the rest of the map as I zoom. I first tried with WMS service, then tried with a WMTS service to se if that helped, but i get the same problem.

It looks like I don't get the new tile from the WMS/WMTS and it just puts the same map on all the sub-tiles.

My WMS link: https://wms.geonorge.no/skwms1/wms.sjokartraster2?&service=wms&version=1.3.0&request=GetMap&BBOX=-20026376.39,-20048966.10,20026376.39,20048966.10&transparent=true&width=512&height=512&layers=all&CRS=EPSG:3857&format=image/png

My WMTS link: https://opencache.statkart.no/gatekeeper/gk/gk.open_wmts?service=WMTS&request=GetTile&layer=sjokartraster&style=default&tileMatrixSet=EPSG:3857&tileMatrix=EPSG:3857:0&format=image/png&TILECOL=0&TILEROW=0

I use this website to test my urls: http://trailbehind.github.io/TilejsonTester/

[Image shows when I zoom. Map of Norway shows four places in the world and does not get bigger][1]

I have some TypeScript code that uses CDK to create an API Gateway and a Lambda. It works and deploys to a standard AWS URL. So far so good.

I now need to transfer the API Gateway so that it operates on a custom domain, so that it can set a cookie in a web app. This is proving far harder, and I suspect I am having difficulty because I am new to TypeScript, AWS, and CDK all at the same time. There are a number of documentation resources on the web, but most would require me to rewrite the precious little working code I have, which I am reluctant to do.

I have created a certificate manually, because that requires validation and thus it does not make sense to create it in code. Other than that I want all other resources to be created by CDK code in a Stack. In my view, it defeats the purpose of CDK if I have to configure things manually.

The below code deploys everything I need to gatekeeper.d.aws.example.com - a HostedZone, an ARecord, a LambdaRestApi and a Function (lambda). However it does not work because the NS records newly assigned to gatekeeper.d.aws.example.com do not match the ones in the parent d.aws.example.com.

I think this means that although d.aws.example.com is "known", the gateway subdomain cannot delegate to it.

Here is my working code:

I have a K8S cluster running in Azure AKS service.

I want to enforce MustRunAsNonRoot policy. How to do it?

The following policy is created:

I'm trying to build a bar graph with echarts, where each bar has an hour and date associated with it. How can I group the dates so that they do not repeat? This should also update if the graph is zoomed in / panned accordingly. Thanks for the help!

What I have :

What I would like :

And what I currently have for my code :