Four weeks into this newsletter and things are going well. Tooling choices have been made. The product (newsletter) is starting to hum along. Now is when it’s time to ask, “What would you like to see in the newsletter?” Hit reply and let us know.
This week we’ll touch on the new Amazon VPC IPAM tool, Amazon GuardDuty for EKS, Tekton, and more! Thank you for reading, please forward this to a friend or colleague.
New and notable blogs
- Amazon simplifies IP address management through the new Amazon VPC IPAM service. IPAM enables you to plan, track, and monitor your IP spaces across your AWS accounts, VPCs, and AWS resources.
- Built to serve as a single source of truth for all IP address-related usage information across all of your AWS accounts
- Ensures that IP planning does not impede your growth goals
Amazon GuardDuty now protects Amazon Elastic Kubernetes Service clusters
- Amazon GuardDuty is a threat detection service that continuously monitors your AWS accounts and workloads for malicious activity and delivers detailed security findings for visibility and remediation
- Continuously monitor and profile cluster activity to identify malicious or suspicious behavior that represents potential threats to container workloads
- At launch, GuardDuty for EKS Protection includes 27 new GuardDuty finding types
Cloud Native CI/CD with Tekton and ArgoCD on AWS
- A quick introduction about Tekton and an explanation of some key concepts
- Practical example to build and deploy a Spring Boot-based web application with a Tekton native CI/CD Pipeline
- Demo code is here if you want to tinker
Ecosystem News
CVE-2022-0185 in Linux Kernel Can Allow Container Escape in Kubernetes
- Nicknamed: PwnKit
- This vulnerability provides an opportunity for an attacker who has access to a system as an unprivileged user to escalate those rights to root
- Updated AMIs have been released to mitigate CVE-2022-0185 on EKS
- Check your Linux distribution’s updates for patches
Announcing 100% Cloud Service Coverage for Crossplane
- Crossplane now has 100% coverage for major cloud services
- New providers: provider-jet-aws, provider-jet-azure, and provider-jet-gcp
- Introducing Terrajet, a code generation pipeline for creating Crossplane providers
New sync and diff strategies in ArgoCD
- New experimental sync option
- Will verify diffing customizations while preparing the patch to be applied in the cluster
- Useful for resources that are incompatible with GitOps because a field value is required during resource creation and is also mutated by controllers after being applied to the cluster
Cracking Kubernetes Network Policy
- Digs into the Kubernetes
NetworkPolicymodel - Design a policy enforcer based on the technical requirements
- Implement it with less than 100 lines of eBPF code
- Get a deeper understanding on how network policies are enforced
Two reasons Kubernetes is so complex
- Kubernetes is a cluster operating system
- Everything in Kubernetes is a control loop
- Some finer points: “Errors are delayed,” “all configuration is declarative,” and “how pluggable and configurable Kubernetes is.”