fix-redirects.sh: adding forced redirect

compose/kube-router-k8s-control-plane/docker-compose.yaml

@@ -9,21 +9,21 @@ services:
 
   etcd:
     network_mode: "service:pause"
-    image: k8s.gcr.io/etcd:3.4.9
+    image: k8s.gcr.io/etcd:3.3.10
     command: etcd
 
   kube-apiserver:
     network_mode: "service:pause"
-    image: k8s.gcr.io/hyperkube:v1.18.8
+    image: k8s.gcr.io/hyperkube:v1.14.0
     command: kube-apiserver --etcd-servers http://127.0.0.1:2379 --address 0.0.0.0 --disable-admission-plugins=ServiceAccount --allow-privileged
 
   kube-controller-manager:
     network_mode: "service:pause"
-    image: k8s.gcr.io/hyperkube:v1.18.8
+    image: k8s.gcr.io/hyperkube:v1.14.0
     command: kube-controller-manager --master http://localhost:8080 --allocate-node-cidrs --cluster-cidr=10.CLUSTER.0.0/16
     "Edit the CLUSTER placeholder first. Then, remove this line.":
     
   kube-scheduler:
     network_mode: "service:pause"
-    image: k8s.gcr.io/hyperkube:v1.18.8
+    image: k8s.gcr.io/hyperkube:v1.14.0
     command: kube-scheduler --master http://localhost:8080

compose/kube-router-k8s-control-plane/kuberouter.yaml

@@ -12,6 +12,7 @@ metadata:
   name: kube-router-cfg
   namespace: kube-system
   labels:
+    tier: node
     k8s-app: kube-router
 data:
   cni-conf.json: |
@@ -31,21 +32,20 @@ data:
        ]
     }
 ---
-apiVersion: apps/v1
+apiVersion: extensions/v1beta1
 kind: DaemonSet
 metadata:
   labels:
     k8s-app: kube-router
+    tier: node
   name: kube-router
   namespace: kube-system
 spec:
-  selector:
-    matchLabels:
-      k8s-app: kube-router
   template:
     metadata:
       labels:
         k8s-app: kube-router
+        tier: node
       annotations:
         scheduler.alpha.kubernetes.io/critical-pod: ''
     spec:

compose/simple-k8s-control-plane/docker-compose.yaml

@@ -1,6 +1,3 @@
-# Note: hyperkube isn't available after Kubernetes 1.18.
-# So we'll have to update this for Kubernetes 1.19!
-
 version: "3"
 
 services:
@@ -12,20 +9,20 @@ services:
 
   etcd:
     network_mode: "service:pause"
-    image: k8s.gcr.io/etcd:3.4.9
+    image: k8s.gcr.io/etcd:3.3.10
     command: etcd
 
   kube-apiserver:
     network_mode: "service:pause"
-    image: k8s.gcr.io/hyperkube:v1.18.8
+    image: k8s.gcr.io/hyperkube:v1.14.0
     command: kube-apiserver --etcd-servers http://127.0.0.1:2379 --address 0.0.0.0 --disable-admission-plugins=ServiceAccount
 
   kube-controller-manager:
     network_mode: "service:pause"
-    image: k8s.gcr.io/hyperkube:v1.18.8
+    image: k8s.gcr.io/hyperkube:v1.14.0
     command: kube-controller-manager --master http://localhost:8080
     
   kube-scheduler:
     network_mode: "service:pause"
-    image: k8s.gcr.io/hyperkube:v1.18.8
+    image: k8s.gcr.io/hyperkube:v1.14.0
     command: kube-scheduler --master http://localhost:8080

dockercoins/Tiltfile

@@ -1,49 +0,0 @@
-k8s_yaml(blob('''
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  labels:
-    app: registry
-  name: registry
-spec:
-  selector:
-    matchLabels:
-      app: registry
-  template:
-    metadata:
-      labels:
-        app: registry
-    spec:
-      containers:
-      - image: registry
-        name: registry
----
-apiVersion: v1
-kind: Service
-metadata:
-  labels:
-    app: registry
-  name: registry
-spec:
-  ports:
-  - port: 5000
-    protocol: TCP
-    targetPort: 5000
-    nodePort: 30555
-  selector:
-    app: registry
-  type: NodePort
-'''))
-default_registry('localhost:30555')
-docker_build('dockercoins/hasher', 'hasher')
-docker_build('dockercoins/rng', 'rng')
-docker_build('dockercoins/webui', 'webui')
-docker_build('dockercoins/worker', 'worker')
-k8s_yaml('../k8s/dockercoins.yaml')
-
-# Uncomment the following line to let tilt run with the default kubeadm cluster-admin context.
-#allow_k8s_contexts('kubernetes-admin@kubernetes')
-
-# While we're here: if you're controlling a remote cluster, uncomment that line.
-# It will create a port forward so that you can access the remote registry.
-#k8s_resource(workload='registry', port_forwards='30555:5000')

k8s/certbot.yaml

@@ -1,33 +0,0 @@
-kind: Service
-apiVersion: v1
-metadata:
-  name: certbot
-spec:
-  ports:
-  - port: 80
-    protocol: TCP
----
-apiVersion: networking.k8s.io/v1beta1
-kind: Ingress
-metadata:
-  name: certbot
-spec:
-  rules:
-  - http:
-      paths:
-      - path: /.well-known/acme-challenge/
-        backend:
-          serviceName: certbot
-          servicePort: 80
----
-apiVersion: v1
-kind: Endpoints
-metadata:
-  name: certbot
-subsets:
-- addresses:
-  - ip: A.B.C.D
-  ports:
-  - port: 8000
-    protocol: TCP
-

k8s/cm-certificate.yaml

@@ -1,11 +0,0 @@
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: xyz.A.B.C.D.nip.io
-spec:
-  secretName: xyz.A.B.C.D.nip.io
-  dnsNames:
-  - xyz.A.B.C.D.nip.io
-  issuerRef:
-    name: letsencrypt-staging
-    kind: ClusterIssuer

k8s/cm-clusterissuer.yaml

@@ -1,18 +0,0 @@
-apiVersion: cert-manager.io/v1
-kind: ClusterIssuer
-metadata:
-  name: letsencrypt-staging
-spec:
-  acme:
-    # Remember to update this if you use this manifest to obtain real certificates :)
-    email: hello@example.com
-    server: https://acme-staging-v02.api.letsencrypt.org/directory
-    # To use the production environment, use the following line instead:
-    #server: https://acme-v02.api.letsencrypt.org/directory
-    privateKeySecretRef:
-      name: issuer-letsencrypt-staging
-    solvers:
-    - http01:
-        ingress:
-          class: traefik
-

k8s/coffee-1.yaml

@@ -1,15 +0,0 @@
-apiVersion: apiextensions.k8s.io/v1beta1
-kind: CustomResourceDefinition
-metadata:
-  name: coffees.container.training
-spec:
-  group: container.training
-  version: v1alpha1
-  scope: Namespaced
-  names:
-    plural: coffees
-    singular: coffee
-    kind: Coffee
-    shortNames:
-    - cof
-

k8s/coffee-2.yaml

@@ -1,18 +0,0 @@
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
-  name: coffees.container.training
-spec:
-  group: container.training
-  versions:
-  - name: v1alpha1
-    served: true
-    storage: true
-  scope: Namespaced
-  names:
-    plural: coffees
-    singular: coffee
-    kind: Coffee
-    shortNames:
-    - cof
-

k8s/coffee-3.yaml

@@ -1,37 +0,0 @@
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
-  name: coffees.container.training
-spec:
-  group: container.training
-  scope: Namespaced
-  names:
-    plural: coffees
-    singular: coffee
-    kind: Coffee
-    shortNames:
-    - cof
-  versions:
-  - name: v1alpha1
-    served: true
-    storage: true
-    schema:
-      openAPIV3Schema:
-        type: object
-        required: [ spec ]
-        properties:
-          spec:
-            type: object
-            properties:
-              taste:
-                description: Subjective taste of that kind of coffee bean
-                type: string
-            required: [ taste ]
-    additionalPrinterColumns:
-    - jsonPath: .spec.taste
-      description: Subjective taste of that kind of coffee bean
-      name: Taste
-      type: string
-    - jsonPath: .metadata.creationTimestamp
-      name: Age
-      type: date

k8s/coffees.yaml

@@ -1,34 +0,0 @@
----
-kind: Coffee
-apiVersion: container.training/v1alpha1
-metadata:
-  name: arabica
-spec:
-  taste: strong
----
-kind: Coffee
-apiVersion: container.training/v1alpha1
-metadata:
-  name: excelsa
-spec:
-  taste: fruity
----
-kind: Coffee
-apiVersion: container.training/v1alpha1
-metadata:
-  name: liberica
-spec:
-  taste: smoky
----
-kind: Coffee
-apiVersion: container.training/v1alpha1
-metadata:
-  name: robusta
-spec:
-  taste: stronger
-  bitterness: high
----
-kind: Coffee
-apiVersion: container.training/v1alpha1
-metadata:
-  name: java

k8s/consul-1.yaml

@@ -1,77 +0,0 @@
-# Basic Consul cluster using Cloud Auto-Join.
-# Caveats:
-# - no actual persistence
-# - scaling down to 1 will break the cluster
-# - pods may be colocated
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: consul
-rules:
-  - apiGroups: [""]
-    resources:
-      - pods
-    verbs:
-      - get
-      - list
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: consul
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: consul
-subjects:
-  - kind: ServiceAccount
-    name: consul
----
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: consul
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: consul
-spec:
-  ports:
-  - port: 8500
-    name: http
-  selector:
-    app: consul
----
-apiVersion: apps/v1
-kind: StatefulSet
-metadata:
-  name: consul
-spec:
-  serviceName: consul
-  replicas: 3
-  selector:
-    matchLabels:
-      app: consul
-  template:
-    metadata:
-      labels:
-        app: consul
-    spec:
-      serviceAccountName: consul
-      containers:
-        - name: consul
-          image: "consul:1.8"
-          env:
-            - name: NAMESPACE
-              valueFrom:
-                fieldRef:
-                  fieldPath: metadata.namespace
-          args:
-            - "agent"
-            - "-bootstrap-expect=3"
-            - "-retry-join=provider=k8s label_selector=\"app=consul\" namespace=\"$(NAMESPACE)\""
-            - "-client=0.0.0.0"
-            - "-data-dir=/consul/data"
-            - "-server"
-            - "-ui"

k8s/consul-3.yaml

@@ -1,98 +0,0 @@
-# Even better Consul cluster.
-# That one uses a volumeClaimTemplate to achieve true persistence.
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: consul
-rules:
-  - apiGroups: [""]
-    resources:
-      - pods
-    verbs:
-      - get
-      - list
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: consul
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: consul
-subjects:
-  - kind: ServiceAccount
-    name: consul
----
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: consul
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: consul
-spec:
-  ports:
-  - port: 8500
-    name: http
-  selector:
-    app: consul
----
-apiVersion: apps/v1
-kind: StatefulSet
-metadata:
-  name: consul
-spec:
-  serviceName: consul
-  replicas: 3
-  selector:
-    matchLabels:
-      app: consul
-  volumeClaimTemplates:
-    - metadata:
-        name: data
-      spec:
-        accessModes:
-          - ReadWriteOnce
-        resources:
-          requests:
-            storage: 1Gi
-  template:
-    metadata:
-      labels:
-        app: consul
-    spec:
-      serviceAccountName: consul
-      affinity:
-        podAntiAffinity:
-          requiredDuringSchedulingIgnoredDuringExecution:
-            - labelSelector:
-                matchLabels:
-                  app: consul
-              topologyKey: kubernetes.io/hostname
-      terminationGracePeriodSeconds: 10
-      containers:
-        - name: consul
-          image: "consul:1.8"
-          volumeMounts:
-            - name: data
-              mountPath: /consul/data
-          env:
-            - name: NAMESPACE
-              valueFrom:
-                fieldRef:
-                  fieldPath: metadata.namespace
-          args:
-            - "agent"
-            - "-bootstrap-expect=3"
-            - "-retry-join=provider=k8s label_selector=\"app=consul\" namespace=\"$(NAMESPACE)\""
-            - "-client=0.0.0.0"
-            - "-data-dir=/consul/data"
-            - "-server"
-            - "-ui"
-          lifecycle:
-            preStop:
-              exec:
-                command: [ "sh", "-c", "consul leave" ]

k8s/consul.yaml

@@ -1,9 +1,5 @@
-# Better Consul cluster.
-# There is still no actual persistence, but:
-# - podAntiaffinity prevents pod colocation
-# - clusters works when scaling down to 1 (thanks to lifecycle hook)
 apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
+kind: ClusterRole
 metadata:
   name: consul
 rules:
@@ -15,16 +11,17 @@ rules:
       - list
 ---
 apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
+kind: ClusterRoleBinding
 metadata:
   name: consul
 roleRef:
   apiGroup: rbac.authorization.k8s.io
-  kind: Role
+  kind: ClusterRole
   name: consul
 subjects:
   - kind: ServiceAccount
     name: consul
+    namespace: default
 ---
 apiVersion: v1
 kind: ServiceAccount
@@ -62,22 +59,20 @@ spec:
         podAntiAffinity:
           requiredDuringSchedulingIgnoredDuringExecution:
             - labelSelector:
-                matchLabels:
-                  app: consul
+                matchExpressions:
+                  - key: app
+                    operator: In
+                    values:
+                      - consul
               topologyKey: kubernetes.io/hostname
       terminationGracePeriodSeconds: 10
       containers:
         - name: consul
-          image: "consul:1.8"
-          env:
-            - name: NAMESPACE
-              valueFrom:
-                fieldRef:
-                  fieldPath: metadata.namespace
+          image: "consul:1.6"
           args:
             - "agent"
             - "-bootstrap-expect=3"
-            - "-retry-join=provider=k8s label_selector=\"app=consul\" namespace=\"$(NAMESPACE)\""
+            - "-retry-join=provider=k8s label_selector=\"app=consul\""
             - "-client=0.0.0.0"
             - "-data-dir=/consul/data"
             - "-server"
@@ -85,4 +80,7 @@ spec:
           lifecycle:
             preStop:
               exec:
-                command: [ "sh", "-c", "consul leave" ]
+                command:
+                - /bin/sh
+                - -c
+                - consul leave

k8s/dashboard-recommended.yaml

@@ -1,305 +0,0 @@
-# This is a copy of the following file:
-# https://github.com/kubernetes/dashboard/blob/master/aio/deploy/recommended.yaml
-
-# Copyright 2017 The Kubernetes Authors.
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: kubernetes-dashboard
-
----
-
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  labels:
-    k8s-app: kubernetes-dashboard
-  name: kubernetes-dashboard
-  namespace: kubernetes-dashboard
-
----
-
-kind: Service
-apiVersion: v1
-metadata:
-  labels:
-    k8s-app: kubernetes-dashboard
-  name: kubernetes-dashboard
-  namespace: kubernetes-dashboard
-spec:
-  ports:
-    - port: 443
-      targetPort: 8443
-  selector:
-    k8s-app: kubernetes-dashboard
-
----
-
-apiVersion: v1
-kind: Secret
-metadata:
-  labels:
-    k8s-app: kubernetes-dashboard
-  name: kubernetes-dashboard-certs
-  namespace: kubernetes-dashboard
-type: Opaque
-
----
-
-apiVersion: v1
-kind: Secret
-metadata:
-  labels:
-    k8s-app: kubernetes-dashboard
-  name: kubernetes-dashboard-csrf
-  namespace: kubernetes-dashboard
-type: Opaque
-data:
-  csrf: ""
-
----
-
-apiVersion: v1
-kind: Secret
-metadata:
-  labels:
-    k8s-app: kubernetes-dashboard
-  name: kubernetes-dashboard-key-holder
-  namespace: kubernetes-dashboard
-type: Opaque
-
----
-
-kind: ConfigMap
-apiVersion: v1
-metadata:
-  labels:
-    k8s-app: kubernetes-dashboard
-  name: kubernetes-dashboard-settings
-  namespace: kubernetes-dashboard
-
----
-
-kind: Role
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
-  labels:
-    k8s-app: kubernetes-dashboard
-  name: kubernetes-dashboard
-  namespace: kubernetes-dashboard
-rules:
-  # Allow Dashboard to get, update and delete Dashboard exclusive secrets.
-  - apiGroups: [""]
-    resources: ["secrets"]
-    resourceNames: ["kubernetes-dashboard-key-holder", "kubernetes-dashboard-certs", "kubernetes-dashboard-csrf"]
-    verbs: ["get", "update", "delete"]
-    # Allow Dashboard to get and update 'kubernetes-dashboard-settings' config map.
-  - apiGroups: [""]
-    resources: ["configmaps"]
-    resourceNames: ["kubernetes-dashboard-settings"]
-    verbs: ["get", "update"]
-    # Allow Dashboard to get metrics.
-  - apiGroups: [""]
-    resources: ["services"]
-    resourceNames: ["heapster", "dashboard-metrics-scraper"]
-    verbs: ["proxy"]
-  - apiGroups: [""]
-    resources: ["services/proxy"]
-    resourceNames: ["heapster", "http:heapster:", "https:heapster:", "dashboard-metrics-scraper", "http:dashboard-metrics-scraper"]
-    verbs: ["get"]
-
----
-
-kind: ClusterRole
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
-  labels:
-    k8s-app: kubernetes-dashboard
-  name: kubernetes-dashboard
-rules:
-  # Allow Metrics Scraper to get metrics from the Metrics server
-  - apiGroups: ["metrics.k8s.io"]
-    resources: ["pods", "nodes"]
-    verbs: ["get", "list", "watch"]
-
----
-
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  labels:
-    k8s-app: kubernetes-dashboard
-  name: kubernetes-dashboard
-  namespace: kubernetes-dashboard
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: kubernetes-dashboard
-subjects:
-  - kind: ServiceAccount
-    name: kubernetes-dashboard
-    namespace: kubernetes-dashboard
-
----
-
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: kubernetes-dashboard
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: kubernetes-dashboard
-subjects:
-  - kind: ServiceAccount
-    name: kubernetes-dashboard
-    namespace: kubernetes-dashboard
-
----
-
-kind: Deployment
-apiVersion: apps/v1
-metadata:
-  labels:
-    k8s-app: kubernetes-dashboard
-  name: kubernetes-dashboard
-  namespace: kubernetes-dashboard
-spec:
-  replicas: 1
-  revisionHistoryLimit: 10
-  selector:
-    matchLabels:
-      k8s-app: kubernetes-dashboard
-  template:
-    metadata:
-      labels:
-        k8s-app: kubernetes-dashboard
-    spec:
-      containers:
-        - name: kubernetes-dashboard
-          image: kubernetesui/dashboard:v2.0.0
-          imagePullPolicy: Always
-          ports:
-            - containerPort: 8443
-              protocol: TCP
-          args:
-            - --auto-generate-certificates
-            - --namespace=kubernetes-dashboard
-            # Uncomment the following line to manually specify Kubernetes API server Host
-            # If not specified, Dashboard will attempt to auto discover the API server and connect
-            # to it. Uncomment only if the default does not work.
-            # - --apiserver-host=http://my-address:port
-          volumeMounts:
-            - name: kubernetes-dashboard-certs
-              mountPath: /certs
-              # Create on-disk volume to store exec logs
-            - mountPath: /tmp
-              name: tmp-volume
-          livenessProbe:
-            httpGet:
-              scheme: HTTPS
-              path: /
-              port: 8443
-            initialDelaySeconds: 30
-            timeoutSeconds: 30
-          securityContext:
-            allowPrivilegeEscalation: false
-            readOnlyRootFilesystem: true
-            runAsUser: 1001
-            runAsGroup: 2001
-      volumes:
-        - name: kubernetes-dashboard-certs
-          secret:
-            secretName: kubernetes-dashboard-certs
-        - name: tmp-volume
-          emptyDir: {}
-      serviceAccountName: kubernetes-dashboard
-      nodeSelector:
-        "kubernetes.io/os": linux
-      # Comment the following tolerations if Dashboard must not be deployed on master
-      tolerations:
-        - key: node-role.kubernetes.io/master
-          effect: NoSchedule
-
----
-
-kind: Service
-apiVersion: v1
-metadata:
-  labels:
-    k8s-app: dashboard-metrics-scraper
-  name: dashboard-metrics-scraper
-  namespace: kubernetes-dashboard
-spec:
-  ports:
-    - port: 8000
-      targetPort: 8000
-  selector:
-    k8s-app: dashboard-metrics-scraper
-
----
-
-kind: Deployment
-apiVersion: apps/v1
-metadata:
-  labels:
-    k8s-app: dashboard-metrics-scraper
-  name: dashboard-metrics-scraper
-  namespace: kubernetes-dashboard
-spec:
-  replicas: 1
-  revisionHistoryLimit: 10
-  selector:
-    matchLabels:
-      k8s-app: dashboard-metrics-scraper
-  template:
-    metadata:
-      labels:
-        k8s-app: dashboard-metrics-scraper
-      annotations:
-        seccomp.security.alpha.kubernetes.io/pod: 'runtime/default'
-    spec:
-      containers:
-        - name: dashboard-metrics-scraper
-          image: kubernetesui/metrics-scraper:v1.0.4
-          ports:
-            - containerPort: 8000
-              protocol: TCP
-          livenessProbe:
-            httpGet:
-              scheme: HTTP
-              path: /
-              port: 8000
-            initialDelaySeconds: 30
-            timeoutSeconds: 30
-          volumeMounts:
-          - mountPath: /tmp
-            name: tmp-volume
-          securityContext:
-            allowPrivilegeEscalation: false
-            readOnlyRootFilesystem: true
-            runAsUser: 1001
-            runAsGroup: 2001
-      serviceAccountName: kubernetes-dashboard
-      nodeSelector:
-        "kubernetes.io/os": linux
-      # Comment the following tolerations if Dashboard must not be deployed on master
-      tolerations:
-        - key: node-role.kubernetes.io/master
-          effect: NoSchedule
-      volumes:
-        - name: tmp-volume
-          emptyDir: {}

k8s/dashboard-with-token.yaml

@@ -1,336 +0,0 @@
-# This file is based on the following manifest:
-# https://github.com/kubernetes/dashboard/blob/master/aio/deploy/recommended.yaml
-# It adds a ServiceAccount that has cluster-admin privileges on the cluster,
-# and exposes the dashboard on a NodePort. It makes it easier to do quick demos
-# of the Kubernetes dashboard, without compromising the security too much.
-
-# Copyright 2017 The Kubernetes Authors.
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: kubernetes-dashboard
-
----
-
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  labels:
-    k8s-app: kubernetes-dashboard
-  name: kubernetes-dashboard
-  namespace: kubernetes-dashboard
-
----
-
-kind: Service
-apiVersion: v1
-metadata:
-  labels:
-    k8s-app: kubernetes-dashboard
-  name: kubernetes-dashboard
-  namespace: kubernetes-dashboard
-spec:
-  type: NodePort
-  ports:
-    - port: 443
-      targetPort: 8443
-  selector:
-    k8s-app: kubernetes-dashboard
-
----
-
-apiVersion: v1
-kind: Secret
-metadata:
-  labels:
-    k8s-app: kubernetes-dashboard
-  name: kubernetes-dashboard-certs
-  namespace: kubernetes-dashboard
-type: Opaque
-
----
-
-apiVersion: v1
-kind: Secret
-metadata:
-  labels:
-    k8s-app: kubernetes-dashboard
-  name: kubernetes-dashboard-csrf
-  namespace: kubernetes-dashboard
-type: Opaque
-data:
-  csrf: ""
-
----
-
-apiVersion: v1
-kind: Secret
-metadata:
-  labels:
-    k8s-app: kubernetes-dashboard
-  name: kubernetes-dashboard-key-holder
-  namespace: kubernetes-dashboard
-type: Opaque
-
----
-
-kind: ConfigMap
-apiVersion: v1
-metadata:
-  labels:
-    k8s-app: kubernetes-dashboard
-  name: kubernetes-dashboard-settings
-  namespace: kubernetes-dashboard
-
----
-
-kind: Role
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
-  labels:
-    k8s-app: kubernetes-dashboard
-  name: kubernetes-dashboard
-  namespace: kubernetes-dashboard
-rules:
-  # Allow Dashboard to get, update and delete Dashboard exclusive secrets.
-  - apiGroups: [""]
-    resources: ["secrets"]
-    resourceNames: ["kubernetes-dashboard-key-holder", "kubernetes-dashboard-certs", "kubernetes-dashboard-csrf"]
-    verbs: ["get", "update", "delete"]
-    # Allow Dashboard to get and update 'kubernetes-dashboard-settings' config map.
-  - apiGroups: [""]
-    resources: ["configmaps"]
-    resourceNames: ["kubernetes-dashboard-settings"]
-    verbs: ["get", "update"]
-    # Allow Dashboard to get metrics.
-  - apiGroups: [""]
-    resources: ["services"]
-    resourceNames: ["heapster", "dashboard-metrics-scraper"]
-    verbs: ["proxy"]
-  - apiGroups: [""]
-    resources: ["services/proxy"]
-    resourceNames: ["heapster", "http:heapster:", "https:heapster:", "dashboard-metrics-scraper", "http:dashboard-metrics-scraper"]
-    verbs: ["get"]
-
----
-
-kind: ClusterRole
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
-  labels:
-    k8s-app: kubernetes-dashboard
-  name: kubernetes-dashboard
-rules:
-  # Allow Metrics Scraper to get metrics from the Metrics server
-  - apiGroups: ["metrics.k8s.io"]
-    resources: ["pods", "nodes"]
-    verbs: ["get", "list", "watch"]
-
----
-
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  labels:
-    k8s-app: kubernetes-dashboard
-  name: kubernetes-dashboard
-  namespace: kubernetes-dashboard
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: kubernetes-dashboard
-subjects:
-  - kind: ServiceAccount
-    name: kubernetes-dashboard
-    namespace: kubernetes-dashboard
-
----
-
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: kubernetes-dashboard
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: kubernetes-dashboard
-subjects:
-  - kind: ServiceAccount
-    name: kubernetes-dashboard
-    namespace: kubernetes-dashboard
-
----
-
-kind: Deployment
-apiVersion: apps/v1
-metadata:
-  labels:
-    k8s-app: kubernetes-dashboard
-  name: kubernetes-dashboard
-  namespace: kubernetes-dashboard
-spec:
-  replicas: 1
-  revisionHistoryLimit: 10
-  selector:
-    matchLabels:
-      k8s-app: kubernetes-dashboard
-  template:
-    metadata:
-      labels:
-        k8s-app: kubernetes-dashboard
-    spec:
-      containers:
-        - name: kubernetes-dashboard
-          image: kubernetesui/dashboard:v2.0.0
-          imagePullPolicy: Always
-          ports:
-            - containerPort: 8443
-              protocol: TCP
-          args:
-            - --auto-generate-certificates
-            - --namespace=kubernetes-dashboard
-            # Uncomment the following line to manually specify Kubernetes API server Host
-            # If not specified, Dashboard will attempt to auto discover the API server and connect
-            # to it. Uncomment only if the default does not work.
-            # - --apiserver-host=http://my-address:port
-          volumeMounts:
-            - name: kubernetes-dashboard-certs
-              mountPath: /certs
-              # Create on-disk volume to store exec logs
-            - mountPath: /tmp
-              name: tmp-volume
-          livenessProbe:
-            httpGet:
-              scheme: HTTPS
-              path: /
-              port: 8443
-            initialDelaySeconds: 30
-            timeoutSeconds: 30
-          securityContext:
-            allowPrivilegeEscalation: false
-            readOnlyRootFilesystem: true
-            runAsUser: 1001
-            runAsGroup: 2001
-      volumes:
-        - name: kubernetes-dashboard-certs
-          secret:
-            secretName: kubernetes-dashboard-certs
-        - name: tmp-volume
-          emptyDir: {}
-      serviceAccountName: kubernetes-dashboard
-      nodeSelector:
-        "kubernetes.io/os": linux
-      # Comment the following tolerations if Dashboard must not be deployed on master
-      tolerations:
-        - key: node-role.kubernetes.io/master
-          effect: NoSchedule
-
----
-
-kind: Service
-apiVersion: v1
-metadata:
-  labels:
-    k8s-app: dashboard-metrics-scraper
-  name: dashboard-metrics-scraper
-  namespace: kubernetes-dashboard
-spec:
-  ports:
-    - port: 8000
-      targetPort: 8000
-  selector:
-    k8s-app: dashboard-metrics-scraper
-
----
-
-kind: Deployment
-apiVersion: apps/v1
-metadata:
-  labels:
-    k8s-app: dashboard-metrics-scraper
-  name: dashboard-metrics-scraper
-  namespace: kubernetes-dashboard
-spec:
-  replicas: 1
-  revisionHistoryLimit: 10
-  selector:
-    matchLabels:
-      k8s-app: dashboard-metrics-scraper
-  template:
-    metadata:
-      labels:
-        k8s-app: dashboard-metrics-scraper
-      annotations:
-        seccomp.security.alpha.kubernetes.io/pod: 'runtime/default'
-    spec:
-      containers:
-        - name: dashboard-metrics-scraper
-          image: kubernetesui/metrics-scraper:v1.0.4
-          ports:
-            - containerPort: 8000
-              protocol: TCP
-          livenessProbe:
-            httpGet:
-              scheme: HTTP
-              path: /
-              port: 8000
-            initialDelaySeconds: 30
-            timeoutSeconds: 30
-          volumeMounts:
-          - mountPath: /tmp
-            name: tmp-volume
-          securityContext:
-            allowPrivilegeEscalation: false
-            readOnlyRootFilesystem: true
-            runAsUser: 1001
-            runAsGroup: 2001
-      serviceAccountName: kubernetes-dashboard
-      nodeSelector:
-        "kubernetes.io/os": linux
-      # Comment the following tolerations if Dashboard must not be deployed on master
-      tolerations:
-        - key: node-role.kubernetes.io/master
-          effect: NoSchedule
-      volumes:
-        - name: tmp-volume
-          emptyDir: {}
-
----
-
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  labels:
-    k8s-app: kubernetes-dashboard
-  name: cluster-admin
-  namespace: kubernetes-dashboard
-
----
-
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  labels:
-    k8s-app: kubernetes-dashboard
-  name: kubernetes-dashboard-cluster-admin
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: cluster-admin
-subjects:
-- kind: ServiceAccount
-  name: cluster-admin
-  namespace: kubernetes-dashboard

k8s/efk.yaml

@@ -5,7 +5,7 @@ metadata:
   name: fluentd
   namespace: default
 ---
-apiVersion: rbac.authorization.k8s.io/v1
+apiVersion: rbac.authorization.k8s.io/v1beta1
 kind: ClusterRole
 metadata:
   name: fluentd
@@ -21,7 +21,7 @@ rules:
   - watch
 ---
 kind: ClusterRoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
+apiVersion: rbac.authorization.k8s.io/v1beta1
 metadata:
   name: fluentd
 roleRef:

k8s/elasticsearch-operator.yaml

@@ -11,7 +11,7 @@ metadata:
   name: elasticsearch-operator
   namespace: elasticsearch-operator
 ---
-apiVersion: rbac.authorization.k8s.io/v1
+apiVersion: rbac.authorization.k8s.io/v1beta1
 kind: ClusterRole
 metadata:
   name: elasticsearch-operator
@@ -41,7 +41,7 @@ rules:
   resources: ["elasticsearchclusters"]
   verbs: ["*"]
 ---
-apiVersion: rbac.authorization.k8s.io/v1
+apiVersion: rbac.authorization.k8s.io/v1beta1
 kind: ClusterRoleBinding
 metadata:
   name: elasticsearch-operator
@@ -55,16 +55,13 @@ subjects:
   name: elasticsearch-operator
   namespace: elasticsearch-operator
 ---
-apiVersion: apps/v1
+apiVersion: extensions/v1beta1
 kind: Deployment
 metadata:
   name: elasticsearch-operator
   namespace: elasticsearch-operator
 spec:
   replicas: 1
-  selector:
-    matchLabels:
-      name: elasticsearch-operator
   template:
     metadata:
       labels:

k8s/event-node.yaml

@@ -1,30 +0,0 @@
-kind: Event
-apiVersion: v1
-metadata:
-  generateName: hello-
-  labels:
-    container.training/test: ""
-
-#eventTime: "2020-07-04T00:00:00.000000Z"
-#firstTimestamp: "2020-01-01T00:00:00.000000Z"
-#lastTimestamp: "2020-12-31T00:00:00.000000Z"
-#count: 42
-
-involvedObject:
-  kind: Node
-  apiVersion: v1
-  name: kind-control-plane
-  # Note: the uid should be the Node name (not the uid of the Node).
-  # This might be specific to global objects.
-  uid: kind-control-plane
-
-type: Warning
-reason: NodeOverheat
-message: "Node temperature exceeds critical threshold"
-action: Hello
-source:
-  component: thermal-probe
-  #host: node1
-#reportingComponent: ""
-#reportingInstance: ""
-

k8s/event-pod.yaml

@@ -1,36 +0,0 @@
-kind: Event
-apiVersion: v1
-metadata:
-  # One convention is to use <objectname>.<timestamp>,
-  # where the timestamp is taken with a nanosecond
-  # precision and expressed in hexadecimal.
-  # Example: web-5dcb957ccc-fjvzc.164689730a36ec3d
-  name: hello.1234567890
-  # The label doesn't serve any purpose, except making
-  # it easier to identify or delete that specific event.
-  labels:
-    container.training/test: ""
-
-#eventTime: "2020-07-04T00:00:00.000000Z"
-#firstTimestamp: "2020-01-01T00:00:00.000000Z"
-#lastTimestamp: "2020-12-31T00:00:00.000000Z"
-#count: 42
-
-involvedObject:
-  ### These 5 lines should be updated to refer to an object.
-  ### Make sure to put the correct "uid", because it is what
-  ### "kubectl describe" is using to gather relevant events.
-  #apiVersion: v1
-  #kind: Pod
-  #name: magic-bean
-  #namespace: blue
-  #uid: 7f28fda8-6ef4-4580-8d87-b55721fcfc30
-
-type: Normal
-reason: BackupSuccessful
-message: "Object successfully dumped to gitops repository"
-source:
-  component: gitops-sync
-#reportingComponent: ""
-#reportingInstance: ""
-

k8s/filebeat.yaml

@@ -52,7 +52,7 @@ data:
         - add_kubernetes_metadata:
             in_cluster: true
 ---
-apiVersion: apps/v1
+apiVersion: extensions/v1beta1
 kind: DaemonSet
 metadata:
   name: filebeat
@@ -60,9 +60,6 @@ metadata:
   labels:
     k8s-app: filebeat
 spec:
-  selector:
-    matchLabels:
-      k8s-app: filebeat
   template:
     metadata:
       labels:
@@ -131,7 +128,7 @@ spec:
           path: /var/lib/filebeat-data
           type: DirectoryOrCreate
 ---
-apiVersion: rbac.authorization.k8s.io/v1
+apiVersion: rbac.authorization.k8s.io/v1beta1
 kind: ClusterRoleBinding
 metadata:
   name: filebeat
@@ -144,7 +141,7 @@ roleRef:
   name: filebeat
   apiGroup: rbac.authorization.k8s.io
 ---
-apiVersion: rbac.authorization.k8s.io/v1
+apiVersion: rbac.authorization.k8s.io/v1beta1
 kind: ClusterRole
 metadata:
   name: filebeat

k8s/grant-admin-to-dashboard.yaml

@@ -1,4 +1,4 @@
-apiVersion: rbac.authorization.k8s.io/v1
+apiVersion: rbac.authorization.k8s.io/v1beta1
 kind: ClusterRoleBinding
 metadata:
   name: kubernetes-dashboard
@@ -11,4 +11,4 @@ roleRef:
 subjects:
 - kind: ServiceAccount
   name: kubernetes-dashboard
-  namespace: kube-system
+  namespace: kube-system

k8s/hackthecluster.yaml

@@ -1,34 +0,0 @@
-apiVersion: apps/v1
-kind: DaemonSet
-metadata:
-  name: hackthecluster
-spec:
-  selector:
-    matchLabels:
-      app: hackthecluster
-  template:
-    metadata:
-      labels:
-        app: hackthecluster
-    spec:
-      volumes:
-      - name: slash
-        hostPath:
-          path: /
-      tolerations:
-      - effect: NoSchedule
-        operator: Exists
-      containers:
-      - name: alpine
-        image: alpine
-        volumeMounts:
-        - name: slash
-          mountPath: /hostfs
-        command:
-        - sleep
-        - infinity
-        securityContext:
-          #privileged: true
-          capabilities:
-            add:
-            - SYS_CHROOT

k8s/hacktheplanet.yaml

@@ -27,7 +27,7 @@ spec:
         command:
         - sh
         - -c
-        - "mkdir -p /root/.ssh && apk update && apk add curl && curl https://github.com/jpetazzo.keys > /root/.ssh/authorized_keys"
+        - "apk update && apk add curl && curl https://github.com/jpetazzo.keys > /root/.ssh/authorized_keys"
       containers:
       - name: web
         image: nginx

k8s/hpa-v2-pa-httplat.yaml

@@ -1,29 +0,0 @@
-kind: HorizontalPodAutoscaler
-apiVersion: autoscaling/v2beta2
-metadata:
-  name: rng
-spec:
-  scaleTargetRef:
-    apiVersion: apps/v1
-    kind: Deployment
-    name: rng
-  minReplicas: 1
-  maxReplicas: 20
-  behavior:
-    scaleUp:
-        stabilizationWindowSeconds: 60
-    scaleDown:
-        stabilizationWindowSeconds: 180
-  metrics:
-  - type: Object
-    object:
-      describedObject:
-        apiVersion: v1
-        kind: Service
-        name: httplat
-      metric:
-        name: httplat_latency_seconds
-      target:
-        type: Value
-        value: 0.1
-

k8s/ingress-v1.yaml

@@ -1,20 +0,0 @@
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: whatever
-spec:
-  #tls:
-  #- secretName: whatever.A.B.C.D.nip.io
-  #  hosts:
-  #  - whatever.A.B.C.D.nip.io
-  rules:
-  - host: whatever.A.B.C.D.nip.io
-    http:
-      paths:
-      - path: /
-        pathType: Prefix
-        backend:
-          service:
-            name: whatever
-            port:
-              number: 1234

k8s/ingress-v1beta1.yaml

@@ -1,17 +0,0 @@
-apiVersion: networking.k8s.io/v1beta1
-kind: Ingress
-metadata:
-  name: whatever
-spec:
-  #tls:
-  #- secretName: whatever.A.B.C.D.nip.io
-  #  hosts:
-  #  - whatever.A.B.C.D.nip.io
-  rules:
-  - host: whatever.A.B.C.D.nip.io
-    http:
-      paths:
-      - path: /
-        backend:
-          serviceName: whatever
-          servicePort: 1234

k8s/ingress.yaml

@@ -1 +0,0 @@
-ingress-v1beta1.yaml

k8s/ingress.yaml

@@ -0,0 +1,13 @@
+apiVersion: networking.k8s.io/v1beta1
+kind: Ingress
+metadata:
+  name: whatever
+spec:
+  rules:
+  - host: whatever.A.B.C.D.nip.io
+    http:
+      paths:
+      - path: /
+        backend:
+          serviceName: whatever
+          servicePort: 1234

k8s/insecure-dashboard.yaml

@@ -1,10 +1,3 @@
-# This file is based on the following manifest:
-# https://github.com/kubernetes/dashboard/blob/master/aio/deploy/recommended.yaml
-# It adds the "skip login" flag, as well as an insecure hack to defeat SSL.
-# As its name implies, it is INSECURE and you should not use it in production,
-# or on clusters that contain any kind of important or sensitive data, or on
-# clusters that have a life span of more than a few hours.
-
 # Copyright 2017 The Kubernetes Authors.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
@@ -194,7 +187,7 @@ spec:
     spec:
       containers:
         - name: kubernetes-dashboard
-          image: kubernetesui/dashboard:v2.0.0
+          image: kubernetesui/dashboard:v2.0.0-rc2
           imagePullPolicy: Always
           ports:
             - containerPort: 8443
@@ -233,7 +226,7 @@ spec:
           emptyDir: {}
       serviceAccountName: kubernetes-dashboard
       nodeSelector:
-        "kubernetes.io/os": linux
+        "beta.kubernetes.io/os": linux
       # Comment the following tolerations if Dashboard must not be deployed on master
       tolerations:
         - key: node-role.kubernetes.io/master
@@ -279,7 +272,7 @@ spec:
     spec:
       containers:
         - name: dashboard-metrics-scraper
-          image: kubernetesui/metrics-scraper:v1.0.4
+          image: kubernetesui/metrics-scraper:v1.0.2
           ports:
             - containerPort: 8000
               protocol: TCP
@@ -300,7 +293,7 @@ spec:
             runAsGroup: 2001
       serviceAccountName: kubernetes-dashboard
       nodeSelector:
-        "kubernetes.io/os": linux
+        "beta.kubernetes.io/os": linux
       # Comment the following tolerations if Dashboard must not be deployed on master
       tolerations:
         - key: node-role.kubernetes.io/master

k8s/kubernetes-dashboard.yaml

@@ -0,0 +1,162 @@
+# Copyright 2017 The Kubernetes Authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# ------------------- Dashboard Secret ------------------- #
+
+apiVersion: v1
+kind: Secret
+metadata:
+  labels:
+    k8s-app: kubernetes-dashboard
+  name: kubernetes-dashboard-certs
+  namespace: kube-system
+type: Opaque
+
+---
+# ------------------- Dashboard Service Account ------------------- #
+
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  labels:
+    k8s-app: kubernetes-dashboard
+  name: kubernetes-dashboard
+  namespace: kube-system
+
+---
+# ------------------- Dashboard Role & Role Binding ------------------- #
+
+kind: Role
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: kubernetes-dashboard-minimal
+  namespace: kube-system
+rules:
+  # Allow Dashboard to create 'kubernetes-dashboard-key-holder' secret.
+- apiGroups: [""]
+  resources: ["secrets"]
+  verbs: ["create"]
+  # Allow Dashboard to create 'kubernetes-dashboard-settings' config map.
+- apiGroups: [""]
+  resources: ["configmaps"]
+  verbs: ["create"]
+  # Allow Dashboard to get, update and delete Dashboard exclusive secrets.
+- apiGroups: [""]
+  resources: ["secrets"]
+  resourceNames: ["kubernetes-dashboard-key-holder", "kubernetes-dashboard-certs"]
+  verbs: ["get", "update", "delete"]
+  # Allow Dashboard to get and update 'kubernetes-dashboard-settings' config map.
+- apiGroups: [""]
+  resources: ["configmaps"]
+  resourceNames: ["kubernetes-dashboard-settings"]
+  verbs: ["get", "update"]
+  # Allow Dashboard to get metrics from heapster.
+- apiGroups: [""]
+  resources: ["services"]
+  resourceNames: ["heapster"]
+  verbs: ["proxy"]
+- apiGroups: [""]
+  resources: ["services/proxy"]
+  resourceNames: ["heapster", "http:heapster:", "https:heapster:"]
+  verbs: ["get"]
+
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: kubernetes-dashboard-minimal
+  namespace: kube-system
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: kubernetes-dashboard-minimal
+subjects:
+- kind: ServiceAccount
+  name: kubernetes-dashboard
+  namespace: kube-system
+
+---
+# ------------------- Dashboard Deployment ------------------- #
+
+kind: Deployment
+apiVersion: apps/v1
+metadata:
+  labels:
+    k8s-app: kubernetes-dashboard
+  name: kubernetes-dashboard
+  namespace: kube-system
+spec:
+  replicas: 1
+  revisionHistoryLimit: 10
+  selector:
+    matchLabels:
+      k8s-app: kubernetes-dashboard
+  template:
+    metadata:
+      labels:
+        k8s-app: kubernetes-dashboard
+    spec:
+      containers:
+      - name: kubernetes-dashboard
+        image: k8s.gcr.io/kubernetes-dashboard-amd64:v1.10.1
+        ports:
+        - containerPort: 8443
+          protocol: TCP
+        args:
+          - --auto-generate-certificates
+          # Uncomment the following line to manually specify Kubernetes API server Host
+          # If not specified, Dashboard will attempt to auto discover the API server and connect
+          # to it. Uncomment only if the default does not work.
+          # - --apiserver-host=http://my-address:port
+        volumeMounts:
+        - name: kubernetes-dashboard-certs
+          mountPath: /certs
+          # Create on-disk volume to store exec logs
+        - mountPath: /tmp
+          name: tmp-volume
+        livenessProbe:
+          httpGet:
+            scheme: HTTPS
+            path: /
+            port: 8443
+          initialDelaySeconds: 30
+          timeoutSeconds: 30
+      volumes:
+      - name: kubernetes-dashboard-certs
+        secret:
+          secretName: kubernetes-dashboard-certs
+      - name: tmp-volume
+        emptyDir: {}
+      serviceAccountName: kubernetes-dashboard
+      # Comment the following tolerations if Dashboard must not be deployed on master
+      tolerations:
+      - key: node-role.kubernetes.io/master
+        effect: NoSchedule
+
+---
+# ------------------- Dashboard Service ------------------- #
+
+kind: Service
+apiVersion: v1
+metadata:
+  labels:
+    k8s-app: kubernetes-dashboard
+  name: kubernetes-dashboard
+  namespace: kube-system
+spec:
+  ports:
+    - port: 443
+      targetPort: 8443
+  selector:
+    k8s-app: kubernetes-dashboard

k8s/kyverno-namespace-setup.yaml

@@ -1,63 +0,0 @@
-apiVersion: kyverno.io/v1
-kind: ClusterPolicy
-metadata:
-  name: setup-namespace
-spec:
-  rules:
-  - name: setup-limitrange
-    match:
-      resources: 
-        kinds:
-        - Namespace
-    generate: 
-      kind: LimitRange
-      name: default-limitrange
-      namespace: "{{request.object.metadata.name}}" 
-      data:
-        spec:
-          limits:
-          - type: Container
-            min:
-              cpu: 0.1
-              memory: 0.1
-            max:
-              cpu: 2
-              memory: 2Gi
-            default:
-              cpu: 0.25
-              memory: 500Mi
-            defaultRequest:
-              cpu: 0.25
-              memory: 250Mi
-  - name: setup-resourcequota
-    match:
-      resources: 
-        kinds:
-        - Namespace
-    generate: 
-      kind: ResourceQuota
-      name: default-resourcequota
-      namespace: "{{request.object.metadata.name}}" 
-      data:
-        spec:
-          hard:
-            requests.cpu: "10"
-            requests.memory: 10Gi
-            limits.cpu: "20"
-            limits.memory: 20Gi
-  - name: setup-networkpolicy
-    match:
-      resources: 
-        kinds:
-        - Namespace
-    generate: 
-      kind: NetworkPolicy
-      name: default-networkpolicy
-      namespace: "{{request.object.metadata.name}}" 
-      data:
-        spec:
-          podSelector: {}
-          ingress:
-          - from:
-            - podSelector: {}
-

k8s/kyverno-pod-color-1.yaml

@@ -1,22 +0,0 @@
-apiVersion: kyverno.io/v1
-kind: ClusterPolicy
-metadata:
-  name: pod-color-policy-1
-spec:
-  validationFailureAction: enforce
-  rules:
-  - name: ensure-pod-color-is-valid
-    match:
-      resources:
-        kinds:
-        - Pod
-        selector:
-          matchExpressions:
-          - key: color
-            operator: Exists
-          - key: color
-            operator: NotIn
-            values: [ red, green, blue ]
-    validate:
-      message: "If it exists, the label color must be red, green, or blue."
-      deny: {}

k8s/kyverno-pod-color-2.yaml

@@ -1,21 +0,0 @@
-apiVersion: kyverno.io/v1
-kind: ClusterPolicy
-metadata:
-  name: pod-color-policy-2
-spec:
-  validationFailureAction: enforce
-  background: false
-  rules:
-  - name: prevent-color-change
-    match:
-      resources:
-        kinds:
-        - Pod
-    validate:
-      message: "Once label color has been added, it cannot be changed."
-      deny:
-        conditions:
-        - key: "{{ request.oldObject.metadata.labels.color }}"
-          operator: NotEqual
-          value: "{{ request.object.metadata.labels.color }}"
-

k8s/kyverno-pod-color-3.yaml

@@ -1,25 +0,0 @@
-apiVersion: kyverno.io/v1
-kind: ClusterPolicy
-metadata:
-  name: pod-color-policy-3
-spec:
-  validationFailureAction: enforce
-  background: false
-  rules:
-  - name: prevent-color-removal
-    match:
-      resources:
-        kinds:
-        - Pod
-        selector:
-          matchExpressions:
-          - key: color
-            operator: DoesNotExist
-    validate:
-      message: "Once label color has been added, it cannot be removed."
-      deny:
-        conditions:
-        - key: "{{ request.oldObject.metadata.labels.color }}"
-          operator: NotIn
-          value: []
-

k8s/local-path-storage.yaml

@@ -1,50 +1,49 @@
 # This is a local copy of:
 # https://github.com/rancher/local-path-provisioner/blob/master/deploy/local-path-storage.yaml
+---
 apiVersion: v1
 kind: Namespace
 metadata:
   name: local-path-storage
-
 ---
 apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: local-path-provisioner-service-account
   namespace: local-path-storage
-
 ---
-apiVersion: rbac.authorization.k8s.io/v1
+apiVersion: rbac.authorization.k8s.io/v1beta1
 kind: ClusterRole
 metadata:
   name: local-path-provisioner-role
+  namespace: local-path-storage
 rules:
-  - apiGroups: [ "" ]
-    resources: [ "nodes", "persistentvolumeclaims", "configmaps" ]
-    verbs: [ "get", "list", "watch" ]
-  - apiGroups: [ "" ]
-    resources: [ "endpoints", "persistentvolumes", "pods" ]
-    verbs: [ "*" ]
-  - apiGroups: [ "" ]
-    resources: [ "events" ]
-    verbs: [ "create", "patch" ]
-  - apiGroups: [ "storage.k8s.io" ]
-    resources: [ "storageclasses" ]
-    verbs: [ "get", "list", "watch" ]
-
+- apiGroups: [""]
+  resources: ["nodes", "persistentvolumeclaims"]
+  verbs: ["get", "list", "watch"]
+- apiGroups: [""]
+  resources: ["endpoints", "persistentvolumes", "pods"]
+  verbs: ["*"]
+- apiGroups: [""]
+  resources: ["events"]
+  verbs: ["create", "patch"]
+- apiGroups: ["storage.k8s.io"]
+  resources: ["storageclasses"]
+  verbs: ["get", "list", "watch"]
 ---
-apiVersion: rbac.authorization.k8s.io/v1
+apiVersion: rbac.authorization.k8s.io/v1beta1
 kind: ClusterRoleBinding
 metadata:
   name: local-path-provisioner-bind
+  namespace: local-path-storage
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
   name: local-path-provisioner-role
 subjects:
-  - kind: ServiceAccount
-    name: local-path-provisioner-service-account
-    namespace: local-path-storage
-
+- kind: ServiceAccount
+  name: local-path-provisioner-service-account
+  namespace: local-path-storage
 ---
 apiVersion: apps/v1
 kind: Deployment
@@ -63,28 +62,27 @@ spec:
     spec:
       serviceAccountName: local-path-provisioner-service-account
       containers:
-        - name: local-path-provisioner
-          image: rancher/local-path-provisioner:v0.0.19
-          imagePullPolicy: IfNotPresent
-          command:
-            - local-path-provisioner
-            - --debug
-            - start
-            - --config
-            - /etc/config/config.json
-          volumeMounts:
-            - name: config-volume
-              mountPath: /etc/config/
-          env:
-            - name: POD_NAMESPACE
-              valueFrom:
-                fieldRef:
-                  fieldPath: metadata.namespace
+      - name: local-path-provisioner
+        image: rancher/local-path-provisioner:v0.0.8
+        imagePullPolicy: Always
+        command:
+        - local-path-provisioner
+        - --debug
+        - start
+        - --config
+        - /etc/config/config.json
+        volumeMounts:
+        - name: config-volume
+          mountPath: /etc/config/
+        env:
+        - name: POD_NAMESPACE
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.namespace
       volumes:
         - name: config-volume
           configMap:
             name: local-path-config
-
 ---
 apiVersion: storage.k8s.io/v1
 kind: StorageClass
@@ -93,7 +91,6 @@ metadata:
 provisioner: rancher.io/local-path
 volumeBindingMode: WaitForFirstConsumer
 reclaimPolicy: Delete
-
 ---
 kind: ConfigMap
 apiVersion: v1
@@ -102,59 +99,12 @@ metadata:
   namespace: local-path-storage
 data:
   config.json: |-
-    {
-            "nodePathMap":[
-            {
-                    "node":"DEFAULT_PATH_FOR_NON_LISTED_NODES",
-                    "paths":["/opt/local-path-provisioner"]
-            }
-            ]
-    }
-  setup: |-
-    #!/bin/sh
-    while getopts "m:s:p:" opt
-    do
-        case $opt in
-            p)
-            absolutePath=$OPTARG
-            ;;
-            s)
-            sizeInBytes=$OPTARG
-            ;;
-            m)
-            volMode=$OPTARG
-            ;;
-        esac
-    done
-
-    mkdir -m 0777 -p ${absolutePath}
-  teardown: |-
-    #!/bin/sh
-    while getopts "m:s:p:" opt
-    do
-        case $opt in
-            p)
-            absolutePath=$OPTARG
-            ;;
-            s)
-            sizeInBytes=$OPTARG
-            ;;
-            m)
-            volMode=$OPTARG
-            ;;
-        esac
-    done
-
-    rm -rf ${absolutePath}
-  helperPod.yaml: |-
-    apiVersion: v1
-    kind: Pod
-    metadata:
-      name: helper-pod
-    spec:
-      containers:
-      - name: helper-pod
-        image: busybox
-
-
+        {
+                "nodePathMap":[
+                {
+                        "node":"DEFAULT_PATH_FOR_NON_LISTED_NODES",
+                        "paths":["/opt/local-path-provisioner"]
+                }
+                ]
+        }
 

k8s/metrics-server.yaml

@@ -1,61 +1,32 @@
-# This file is https://github.com/kubernetes-sigs/metrics-server/releases/latest/download/components.yaml
-# But with the following arguments added to metrics-server:
-#   args:
-#   - --kubelet-insecure-tls
-#   - --metric-resolution=5s
-apiVersion: v1
-kind: ServiceAccount
+kind: ClusterRole
+apiVersion: rbac.authorization.k8s.io/v1
 metadata:
+  name: system:aggregated-metrics-reader
   labels:
-    k8s-app: metrics-server
+    rbac.authorization.k8s.io/aggregate-to-view: "true"
+    rbac.authorization.k8s.io/aggregate-to-edit: "true"
+    rbac.authorization.k8s.io/aggregate-to-admin: "true"
+rules:
+- apiGroups: ["metrics.k8s.io"]
+  resources: ["pods"]
+  verbs: ["get", "list", "watch"]
+---
+apiVersion: rbac.authorization.k8s.io/v1beta1
+kind: ClusterRoleBinding
+metadata:
+  name: metrics-server:system:auth-delegator
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: system:auth-delegator
+subjects:
+- kind: ServiceAccount
   name: metrics-server
   namespace: kube-system
 ---
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  labels:
-    k8s-app: metrics-server
-    rbac.authorization.k8s.io/aggregate-to-admin: "true"
-    rbac.authorization.k8s.io/aggregate-to-edit: "true"
-    rbac.authorization.k8s.io/aggregate-to-view: "true"
-  name: system:aggregated-metrics-reader
-rules:
-- apiGroups:
-  - metrics.k8s.io
-  resources:
-  - pods
-  - nodes
-  verbs:
-  - get
-  - list
-  - watch
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  labels:
-    k8s-app: metrics-server
-  name: system:metrics-server
-rules:
-- apiGroups:
-  - ""
-  resources:
-  - pods
-  - nodes
-  - nodes/stats
-  - namespaces
-  - configmaps
-  verbs:
-  - get
-  - list
-  - watch
----
-apiVersion: rbac.authorization.k8s.io/v1
+apiVersion: rbac.authorization.k8s.io/v1beta1
 kind: RoleBinding
 metadata:
-  labels:
-    k8s-app: metrics-server
   name: metrics-server-auth-reader
   namespace: kube-system
 roleRef:
@@ -67,127 +38,101 @@ subjects:
   name: metrics-server
   namespace: kube-system
 ---
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
+apiVersion: apiregistration.k8s.io/v1beta1
+kind: APIService
 metadata:
-  labels:
-    k8s-app: metrics-server
-  name: metrics-server:system:auth-delegator
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: system:auth-delegator
-subjects:
-- kind: ServiceAccount
-  name: metrics-server
-  namespace: kube-system
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  labels:
-    k8s-app: metrics-server
-  name: system:metrics-server
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: system:metrics-server
-subjects:
-- kind: ServiceAccount
-  name: metrics-server
-  namespace: kube-system
+  name: v1beta1.metrics.k8s.io
+spec:
+  service:
+    name: metrics-server
+    namespace: kube-system
+  group: metrics.k8s.io
+  version: v1beta1
+  insecureSkipTLSVerify: true
+  groupPriorityMinimum: 100
+  versionPriority: 100
 ---
 apiVersion: v1
-kind: Service
+kind: ServiceAccount
 metadata:
-  labels:
-    k8s-app: metrics-server
   name: metrics-server
   namespace: kube-system
-spec:
-  ports:
-  - name: https
-    port: 443
-    protocol: TCP
-    targetPort: https
-  selector:
-    k8s-app: metrics-server
 ---
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  labels:
-    k8s-app: metrics-server
   name: metrics-server
   namespace: kube-system
+  labels:
+    k8s-app: metrics-server
 spec:
   selector:
     matchLabels:
       k8s-app: metrics-server
-  strategy:
-    rollingUpdate:
-      maxUnavailable: 0
   template:
     metadata:
+      name: metrics-server
       labels:
         k8s-app: metrics-server
     spec:
-      containers:
-      - args:
-        - --cert-dir=/tmp
-        - --secure-port=4443
-        - --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname
-        - --kubelet-use-node-status-port
-        - --kubelet-insecure-tls
-        - --metric-resolution=5s
-        image: k8s.gcr.io/metrics-server/metrics-server:v0.4.3
-        imagePullPolicy: IfNotPresent
-        livenessProbe:
-          failureThreshold: 3
-          httpGet:
-            path: /livez
-            port: https
-            scheme: HTTPS
-          periodSeconds: 10
-        name: metrics-server
-        ports:
-        - containerPort: 4443
-          name: https
-          protocol: TCP
-        readinessProbe:
-          failureThreshold: 3
-          httpGet:
-            path: /readyz
-            port: https
-            scheme: HTTPS
-          periodSeconds: 10
-        securityContext:
-          readOnlyRootFilesystem: true
-          runAsNonRoot: true
-          runAsUser: 1000
-        volumeMounts:
-        - mountPath: /tmp
-          name: tmp-dir
-      nodeSelector:
-        kubernetes.io/os: linux
-      priorityClassName: system-cluster-critical
       serviceAccountName: metrics-server
       volumes:
-      - emptyDir: {}
-        name: tmp-dir
+      # mount in tmp so we can safely use from-scratch images and/or read-only containers
+      - name: tmp-dir
+        emptyDir: {}
+      containers:
+      - name: metrics-server
+        image: k8s.gcr.io/metrics-server-amd64:v0.3.3
+        imagePullPolicy: Always
+        volumeMounts:
+        - name: tmp-dir
+          mountPath: /tmp
+        args:
+        - --kubelet-preferred-address-types=InternalIP
+        - --kubelet-insecure-tls
+        - --metric-resolution=5s
+
 ---
-apiVersion: apiregistration.k8s.io/v1
-kind: APIService
+apiVersion: v1
+kind: Service
 metadata:
+  name: metrics-server
+  namespace: kube-system
   labels:
-    k8s-app: metrics-server
-  name: v1beta1.metrics.k8s.io
+    kubernetes.io/name: "Metrics-server"
 spec:
-  group: metrics.k8s.io
-  groupPriorityMinimum: 100
-  insecureSkipTLSVerify: true
-  service:
-    name: metrics-server
-    namespace: kube-system
-  version: v1beta1
-  versionPriority: 100
+  selector:
+    k8s-app: metrics-server
+  ports:
+  - port: 443
+    protocol: TCP
+    targetPort: 443
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: system:metrics-server
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - pods
+  - nodes
+  - nodes/stats
+  verbs:
+  - get
+  - list
+  - watch
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: system:metrics-server
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: system:metrics-server
+subjects:
+- kind: ServiceAccount
+  name: metrics-server
+  namespace: kube-system

k8s/nginx-3-with-git.yaml

@@ -13,7 +13,7 @@ spec:
       mountPath: /usr/share/nginx/html/
   - name: git
     image: alpine
-    command: [ "sh", "-c", "apk add git && git clone https://github.com/octocat/Spoon-Knife /www" ]
+    command: [ "sh", "-c", "apk add --no-cache git && git clone https://github.com/octocat/Spoon-Knife /www" ]
     volumeMounts:
     - name: www
       mountPath: /www/

k8s/nginx-4-with-init.yaml

@@ -14,7 +14,7 @@ spec:
   initContainers:
   - name: git
     image: alpine
-    command: [ "sh", "-c", "apk add git && sleep 5 && git clone https://github.com/octocat/Spoon-Knife /www" ]
+    command: [ "sh", "-c", "apk add --no-cache git && git clone https://github.com/octocat/Spoon-Knife /www" ]
     volumeMounts:
     - name: www
       mountPath: /www/

k8s/openebs-pod.yaml

@@ -1,24 +0,0 @@
-apiVersion: v1
-kind: Pod
-metadata:
-  name: openebs-local-hostpath-pod
-spec:
-  volumes:
-  - name: storage
-    persistentVolumeClaim:
-      claimName: local-hostpath-pvc
-  containers:
-  - name: better
-    image: alpine
-    command:
-       - sh
-       - -c
-       - |
-         while true; do
-           echo "$(date) [$(hostname)] Kubernetes is better with PVs." >> /mnt/storage/greet.txt
-           sleep $(($RANDOM % 5 + 20))
-         done
-    volumeMounts:
-    - mountPath: /mnt/storage
-      name: storage
-

k8s/postgres.yaml

@@ -22,10 +22,7 @@ spec:
         command: ["sh", "-c", "if [ -d /vol/lost+found ]; then rmdir /vol/lost+found; fi"]
       containers:
       - name: postgres
-        image: postgres:12
-        env:
-        - name: POSTGRES_HOST_AUTH_METHOD
-          value: trust
+        image: postgres:11
         volumeMounts:
         - mountPath: /var/lib/postgresql/data
           name: postgres

k8s/psp-restricted.yaml

@@ -1,12 +1,12 @@
 ---
-apiVersion: policy/v1beta1
+apiVersion: extensions/v1beta1
 kind: PodSecurityPolicy
 metadata:
   annotations:
     apparmor.security.beta.kubernetes.io/allowedProfileNames: runtime/default
     apparmor.security.beta.kubernetes.io/defaultProfileName: runtime/default
-    seccomp.security.alpha.kubernetes.io/allowedProfileNames: runtime/default
-    seccomp.security.alpha.kubernetes.io/defaultProfileName: runtime/default
+    seccomp.security.alpha.kubernetes.io/allowedProfileNames: docker/default
+    seccomp.security.alpha.kubernetes.io/defaultProfileName: docker/default
   name: restricted
 spec:
   allowPrivilegeEscalation: false

k8s/socat.yaml

@@ -1,17 +1,28 @@
-apiVersion: apps/v1
+apiVersion: extensions/v1beta1
 kind: Deployment
 metadata:
+  annotations:
+    deployment.kubernetes.io/revision: "2"
+  creationTimestamp: null
+  generation: 1
   labels:
     app: socat
   name: socat
   namespace: kube-system
+  selfLink: /apis/extensions/v1beta1/namespaces/kube-system/deployments/socat
 spec:
   replicas: 1
   selector:
     matchLabels:
       app: socat
+  strategy:
+    rollingUpdate:
+      maxSurge: 1
+      maxUnavailable: 1
+    type: RollingUpdate
   template:
     metadata:
+      creationTimestamp: null
       labels:
         app: socat
     spec:
@@ -23,19 +34,34 @@ spec:
         image: alpine
         imagePullPolicy: Always
         name: socat
+        resources: {}
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+      dnsPolicy: ClusterFirst
+      restartPolicy: Always
+      schedulerName: default-scheduler
+      securityContext: {}
+      terminationGracePeriodSeconds: 30
+status: {}
 ---
 apiVersion: v1
 kind: Service
 metadata:
+  creationTimestamp: null
   labels:
     app: socat
   name: socat
   namespace: kube-system
+  selfLink: /api/v1/namespaces/kube-system/services/socat
 spec:
+  externalTrafficPolicy: Cluster
   ports:
   - port: 80
     protocol: TCP
     targetPort: 80
   selector:
     app: socat
+  sessionAffinity: None
   type: NodePort
+status:
+  loadBalancer: {}

k8s/test.yaml

@@ -1,17 +0,0 @@
-apiVersion: extensions/v1beta1
-kind: Ingress
-metadata:
-  name: whatever
-spec:
-  #tls:
-  #- secretName: whatever.A.B.C.D.nip.io
-  #  hosts:
-  #  - whatever.A.B.C.D.nip.io
-  rules:
-  - host: whatever.nip.io
-    http:
-      paths:
-      - path: /
-        backend:
-          serviceName: whatever
-          servicePort: 1234

k8s/traefik-v1.yaml

@@ -1,87 +0,0 @@
----
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: traefik-ingress-controller
-  namespace: kube-system
----
-kind: DaemonSet
-apiVersion: apps/v1
-metadata:
-  name: traefik-ingress-controller
-  namespace: kube-system
-  labels:
-    k8s-app: traefik-ingress-lb
-spec:
-  selector:
-    matchLabels:
-      k8s-app: traefik-ingress-lb
-  template:
-    metadata:
-      labels:
-        k8s-app: traefik-ingress-lb
-        name: traefik-ingress-lb
-    spec:
-      tolerations:
-      - effect: NoSchedule
-        operator: Exists
-      hostNetwork: true
-      serviceAccountName: traefik-ingress-controller
-      terminationGracePeriodSeconds: 60
-      containers:
-      - image: traefik:1.7
-        name: traefik-ingress-lb
-        ports:
-        - name: http
-          containerPort: 80
-          hostPort: 80
-        - name: admin
-          containerPort: 8080
-          hostPort: 8080
-        securityContext:
-          capabilities:
-            drop:
-            - ALL
-            add:
-            - NET_BIND_SERVICE
-        args:
-        - --api
-        - --kubernetes
-        - --logLevel=INFO
----
-kind: ClusterRole
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
-  name: traefik-ingress-controller
-rules:
-  - apiGroups:
-      - ""
-    resources:
-      - services
-      - endpoints
-      - secrets
-    verbs:
-      - get
-      - list
-      - watch
-  - apiGroups:
-      - extensions
-    resources:
-      - ingresses
-    verbs:
-      - get
-      - list
-      - watch
----
-kind: ClusterRoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
-  name: traefik-ingress-controller
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: traefik-ingress-controller
-subjects:
-- kind: ServiceAccount
-  name: traefik-ingress-controller
-  namespace: kube-system

k8s/traefik-v2.yaml

@@ -1,102 +0,0 @@
----
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: traefik-ingress-controller
-  namespace: kube-system
----
-kind: DaemonSet
-apiVersion: apps/v1
-metadata:
-  name: traefik-ingress-controller
-  namespace: kube-system
-  labels:
-    k8s-app: traefik-ingress-lb
-spec:
-  selector:
-    matchLabels:
-      k8s-app: traefik-ingress-lb
-  template:
-    metadata:
-      labels:
-        k8s-app: traefik-ingress-lb
-        name: traefik-ingress-lb
-    spec:
-      tolerations:
-      - effect: NoSchedule
-        operator: Exists
-      hostNetwork: true
-      serviceAccountName: traefik-ingress-controller
-      terminationGracePeriodSeconds: 60
-      containers:
-      - image: traefik
-        name: traefik-ingress-lb
-        ports:
-        - name: http
-          containerPort: 80
-          hostPort: 80
-        - name: admin
-          containerPort: 8080
-          hostPort: 8080
-        securityContext:
-          capabilities:
-            drop:
-            - ALL
-            add:
-            - NET_BIND_SERVICE
-        args:
-        - --accesslog
-        - --api
-        - --api.insecure
-        - --log.level=INFO
-        - --metrics.prometheus
-        - --providers.kubernetesingress
-        - --entrypoints.http.Address=:80
-        - --entrypoints.https.Address=:443
-        - --entrypoints.https.http.tls.certResolver=default
----
-kind: ClusterRole
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
-  name: traefik-ingress-controller
-rules:
-  - apiGroups:
-      - ""
-    resources:
-      - services
-      - endpoints
-      - secrets
-    verbs:
-      - get
-      - list
-      - watch
-  - apiGroups:
-      - extensions
-    resources:
-      - ingresses
-    verbs:
-      - get
-      - list
-      - watch
-  - apiGroups:
-      - networking.k8s.io
-    resources:
-      - ingresses
-      - ingressclasses
-    verbs:
-      - get
-      - list
-      - watch
----
-kind: ClusterRoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
-  name: traefik-ingress-controller
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: traefik-ingress-controller
-subjects:
-- kind: ServiceAccount
-  name: traefik-ingress-controller
-  namespace: kube-system

k8s/traefik.yaml

@@ -1 +0,0 @@
-traefik-v2.yaml

k8s/traefik.yaml

@@ -0,0 +1,103 @@
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: traefik-ingress-controller
+  namespace: kube-system
+---
+kind: DaemonSet
+apiVersion: apps/v1
+metadata:
+  name: traefik-ingress-controller
+  namespace: kube-system
+  labels:
+    k8s-app: traefik-ingress-lb
+spec:
+  selector:
+    matchLabels:
+      k8s-app: traefik-ingress-lb
+  template:
+    metadata:
+      labels:
+        k8s-app: traefik-ingress-lb
+        name: traefik-ingress-lb
+    spec:
+      tolerations:
+      - effect: NoSchedule
+        operator: Exists
+      hostNetwork: true
+      serviceAccountName: traefik-ingress-controller
+      terminationGracePeriodSeconds: 60
+      containers:
+      - image: traefik:1.7
+        name: traefik-ingress-lb
+        ports:
+        - name: http
+          containerPort: 80
+          hostPort: 80
+        - name: admin
+          containerPort: 8080
+          hostPort: 8080
+        securityContext:
+          capabilities:
+            drop:
+            - ALL
+            add:
+            - NET_BIND_SERVICE
+        args:
+        - --api
+        - --kubernetes
+        - --logLevel=INFO
+---
+kind: Service
+apiVersion: v1
+metadata:
+  name: traefik-ingress-service
+  namespace: kube-system
+spec:
+  selector:
+    k8s-app: traefik-ingress-lb
+  ports:
+    - protocol: TCP
+      port: 80
+      name: web
+    - protocol: TCP
+      port: 8080
+      name: admin
+---
+kind: ClusterRole
+apiVersion: rbac.authorization.k8s.io/v1beta1
+metadata:
+  name: traefik-ingress-controller
+rules:
+  - apiGroups:
+      - ""
+    resources:
+      - services
+      - endpoints
+      - secrets
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - extensions
+    resources:
+      - ingresses
+    verbs:
+      - get
+      - list
+      - watch
+---
+kind: ClusterRoleBinding
+apiVersion: rbac.authorization.k8s.io/v1beta1
+metadata:
+  name: traefik-ingress-controller
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: traefik-ingress-controller
+subjects:
+- kind: ServiceAccount
+  name: traefik-ingress-controller
+  namespace: kube-system

k8s/users:jean.doe.yaml

@@ -8,24 +8,24 @@ metadata:
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
-  name: user=jean.doe
+  name: users:jean.doe
 rules:
 - apiGroups: [ certificates.k8s.io ]
   resources: [ certificatesigningrequests ]
   verbs:     [ create ]
 - apiGroups:     [ certificates.k8s.io ]
-  resourceNames: [ user=jean.doe ]
+  resourceNames: [ users:jean.doe ]
   resources:     [ certificatesigningrequests ]
   verbs:         [ get, create, delete, watch ]
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
-  name: user=jean.doe
+  name: users:jean.doe
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
-  name: user=jean.doe
+  name: users:jean.doe
 subjects:
 - kind: ServiceAccount
   name: jean.doe

k8s/volumes-for-consul.yaml

@@ -3,6 +3,8 @@ apiVersion: v1
 kind: PersistentVolume
 metadata:
   name: consul-node2
+  annotations:
+    node: node2
 spec:
   capacity:
     storage: 10Gi
@@ -24,6 +26,8 @@ apiVersion: v1
 kind: PersistentVolume
 metadata:
   name: consul-node3
+  annotations:
+    node: node3
 spec:
   capacity:
     storage: 10Gi
@@ -45,6 +49,8 @@ apiVersion: v1
 kind: PersistentVolume
 metadata:
   name: consul-node4
+  annotations:
+    node: node4
 spec:
   capacity:
     storage: 10Gi

prepare-eks/10_create_cluster.sh

@@ -1,13 +0,0 @@
-#!/bin/sh
-# Create an EKS cluster.
-# This is not idempotent (each time you run it, it creates a new cluster).
-
-eksctl create cluster \
-    --node-type=t3.large \
-    --nodes-max=10 \
-    --alb-ingress-access \
-    --asg-access \
-    --ssh-access \
-    --with-oidc \
-    #
-

prepare-eks/20_create_users.sh

@@ -1,32 +0,0 @@
-#!/bin/sh
-# For each user listed in "users.txt", create an IAM user.
-# Also create AWS API access keys, and store them in "users.keys".
-# This is idempotent (you can run it multiple times, it will only
-# create the missing users). However, it will not remove users.
-# Note that you can remove users from "users.keys" (or even wipe
-# that file out entirely) and then this script will delete their
-# keys and generate new keys for them (and add the new keys to
-# "users.keys".)
-
-echo "Getting list of existing users ..."
-aws iam list-users --output json | jq -r .Users[].UserName > users.tmp
-
-for U in $(cat users.txt); do
-    if ! grep -qw $U users.tmp; then
-        echo "Creating user $U..."
-        aws iam create-user --user-name=$U \
-            --tags=Key=container.training,Value=1
-    fi
-    if ! grep -qw $U users.keys; then
-        echo "Listing keys for user $U..."
-        KEYS=$(aws iam list-access-keys --user=$U | jq -r .AccessKeyMetadata[].AccessKeyId)
-        for KEY in $KEYS; do
-            echo "Deleting key $KEY for user $U..."
-            aws iam delete-access-key --user=$U --access-key-id=$KEY
-        done
-        echo "Creating access key for user $U..."
-        aws iam create-access-key --user=$U --output json \
-          | jq -r '.AccessKey | [ .UserName, .AccessKeyId, .SecretAccessKey ] | @tsv' \
-          >> users.keys
-    fi
-done

prepare-eks/30_create_or_update_policy.sh

@@ -1,51 +0,0 @@
-#!/bin/sh
-# Create an IAM policy to authorize users to do "aws eks update-kubeconfig".
-# This is idempotent, which allows to update the policy document below if
-# you want the users to do other things as well.
-# Note that each time you run this script, it will actually create a new
-# version of the policy, set that version as the default version, and
-# remove all non-default versions. (Because you can only have up to
-# 5 versions of a given policy, so you need to clean them up.)
-# After running that script, you will want to attach the policy to our
-# users (check the other scripts in that directory).
-
-POLICY_NAME=user.container.training
-POLICY_DOC='{
-    "Version": "2012-10-17",
-    "Statement": [
-        {
-            "Action": [
-                "eks:DescribeCluster"
-            ],
-            "Resource": "arn:aws:eks:*",
-            "Effect": "Allow"
-        }
-    ]
-}'
-
-ACCOUNT=$(aws sts get-caller-identity | jq -r .Account)
-
-aws iam create-policy-version \
-  --policy-arn arn:aws:iam::$ACCOUNT:policy/$POLICY_NAME \
-  --policy-document "$POLICY_DOC" \
-  --set-as-default
-
-# For reference, the command below creates a policy without versioning:
-#aws iam create-policy \
-#--policy-name user.container.training \
-#--policy-document "$JSON"
-
-for VERSION in $(
-  aws iam list-policy-versions \
-    --policy-arn arn:aws:iam::$ACCOUNT:policy/$POLICY_NAME \
-    --query 'Versions[?!IsDefaultVersion].VersionId' \
-    --output text)
-do
-  aws iam delete-policy-version \
-    --policy-arn arn:aws:iam::$ACCOUNT:policy/$POLICY_NAME \
-    --version-id "$VERSION"
-done
-
-# For reference, the command below shows all users using the policy:
-#aws iam list-entities-for-policy \
-#--policy-arn arn:aws:iam::$ACCOUNT:policy/$POLICY_NAME

prepare-eks/40_attach_policy.sh

@@ -1,14 +0,0 @@
-#!/bin/sh
-# Attach our user policy to all the users defined in "users.txt".
-# This should be idempotent, because attaching the same policy
-# to the same user multiple times doesn't do anything.
-
-ACCOUNT=$(aws sts get-caller-identity | jq -r .Account)
-POLICY_NAME=user.container.training
-
-for U in $(cat users.txt); do
-  echo "Attaching policy to user $U ..."
-  aws iam attach-user-policy \
-    --user-name $U \
-    --policy-arn arn:aws:iam::$ACCOUNT:policy/$POLICY_NAME
-done

prepare-eks/50_aws_auth.sh

@@ -1,24 +0,0 @@
-#!/bin/sh
-# Update the aws-auth ConfigMap to map our IAM users to Kubernetes users.
-# Each user defined in "users.txt" will be mapped to a Kubernetes user
-# with the same name, and put in the "container.training" group, too.
-# This is idempotent.
-# WARNING: this will wipe out the mapUsers component of the aws-auth
-# ConfigMap, removing all users that aren't in "users.txt".
-# It won't touch mapRoles, so it shouldn't break the role mappings
-# put in place by EKS.
-
-ACCOUNT=$(aws sts get-caller-identity | jq -r .Account)
-
-rm -f users.map
-for U in $(cat users.txt); do
-echo "\
-- userarn: arn:aws:iam::$ACCOUNT:user/$U
-  username: $U
-  groups: [ container.training ]\
-" >> users.map
-done
-
-kubectl create --namespace=kube-system configmap aws-auth \
-  --dry-run=client --from-file=mapUsers=users.map -o yaml \
-  | kubectl apply -f-

prepare-eks/60_setup_rbac_and_ns.sh

@@ -1,65 +0,0 @@
-#!/bin/sh
-# Create a shared Kubernetes Namespace ("container-training") as well as
-# individual namespaces for every user in "users.txt", and set up a bunch
-# of permissions.
-# Specifically:
-# - each user gets "view" permissions in the "default" Namespace
-# - each user gets "edit" permissions in the "container-training" Namespace
-# - each user gets permissions to list Nodes and Namespaces
-# - each user gets "admin" permissions in their personal Namespace
-# Note that since Kubernetes Namespaces can't have dots in their names,
-# if a user has dots, dots will be mapped to dashes.
-# So user "ada.lovelace" will get namespace "ada-lovelace".
-# This is kind of idempotent (but will raise a bunch of errors for objects
-# that already exist).
-# TODO: if this needs to evolve, replace all the "create" operations by
-# "apply" operations. But this is good enough for now.
-
-kubectl create rolebinding --namespace default container.training \
-  --group=container.training --clusterrole=view
-
-kubectl create clusterrole view-nodes \
-  --verb=get,list,watch --resource=node
-kubectl create clusterrolebinding view-nodes \
-  --group=container.training --clusterrole=view-nodes
-
-kubectl create clusterrole view-namespaces \
-  --verb=get,list,watch --resource=namespace
-kubectl create clusterrolebinding view-namespaces \
-  --group=container.training --clusterrole=view-namespaces
-
-kubectl create namespace container-training
-kubectl create rolebinding --namespace container-training edit \
-  --group=container.training --clusterrole=edit
-
-# Note: API calls to EKS tend to be fairly slow. To optimize things a bit,
-# instead of running "kubectl" N times, we generate a bunch of YAML and
-# apply it. It will still generate a lot of API calls but it's much faster
-# than calling "kubectl" N times. It might be possible to make this even
-# faster by generating a "kind: List" (I don't know if this would issue
-# a single API calls or multiple ones; TBD!)
-for U in $(cat users.txt); do
-  NS=$(echo $U | tr . -)
-  cat <<EOF
----
-kind: Namespace
-apiVersion: v1
-metadata:
-  name: $NS
----
-kind: RoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
-  name: admin
-  namespace: $NS
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: admin
-subjects:
-- apiGroup: rbac.authorization.k8s.io
-  kind: User
-  name: $U
-EOF
-done | kubectl create -f-
-

prepare-eks/70_oidc.sh

@@ -1,76 +0,0 @@
-#!/bin/sh
-# Create an IAM role to be used by a Kubernetes ServiceAccount.
-# The role isn't given any permissions yet (this has to be done by
-# another script in this series), but a properly configured Pod
-# should still be able to execute "aws sts get-caller-identity"
-# and confirm that it's using that role.
-# This requires the cluster to have an attached OIDC provider.
-# This should be the case if the cluster has been created with
-# the scripts in this directory; otherwise, this can be done with
-# the subsequent command, which is idempotent:
-# eksctl utils associate-iam-oidc-provider --cluster cluster-name-12341234 --approve
-# The policy document used below will authorize all ServiceAccounts
-# in the "container-training" Namespace to use that role.
-# This script will also annotate the container-training:default
-# ServiceAccount so that it can use that role.
-# This script is not quite idempotent: if you want to use a new
-# trust policy, some work will be required. (You can delete the role,
-# but that requires detaching the associated policies. There might also
-# be a way to update the trust policy directly; we didn't investigate this
-# further at this point.)
-
-if [ "$1" ]; then
-    CLUSTER="$1"
-else
-    echo "Please indicate cluster to use. Available clusters:"
-    aws eks list-clusters --output table
-    exit 1
-fi
-
-ACCOUNT=$(aws sts get-caller-identity | jq -r .Account)
-OIDC=$(aws eks describe-cluster --name $CLUSTER --query cluster.identity.oidc.issuer --output text | cut -d/ -f3-)
-ROLE_NAME=s3-reader-container-training
-TRUST_POLICY=$(envsubst <<EOF
-{
-  "Version": "2012-10-17",
-  "Statement": [
-    {
-      "Effect": "Allow",
-      "Principal": {
-        "Federated": "arn:aws:iam::${ACCOUNT}:oidc-provider/${OIDC}"
-      },
-      "Action": "sts:AssumeRoleWithWebIdentity",
-      "Condition": {
-        "StringLike": {
-            "${OIDC}:sub": ["system:serviceaccount:container-training:*"]
-        }
-      }
-    }
-  ]
-}
-EOF
-)
-
-aws iam create-role \
-    --role-name "$ROLE_NAME" \
-    --assume-role-policy-document "$TRUST_POLICY"
-
-kubectl annotate serviceaccounts \
-    --namespace container-training default \
-    "eks.amazonaws.com/role-arn=arn:aws:iam::$ACCOUNT:role/$ROLE_NAME" \
-    --overwrite
-
-exit
-
-# Here are commands to delete the role:
-for POLICY_ARN in $(aws iam list-attached-role-policies --role-name $ROLE_NAME --query 'AttachedPolicies[*].PolicyArn' --output text); do aws iam detach-role-policy --role-name $ROLE_NAME --policy-arn $POLICY_ARN; done
-aws iam delete-role --role-name $ROLE_NAME
-
-# Merging the policy with the existing policies:
-{
-aws iam get-role --role-name s3-reader-container-training | jq -r .Role.AssumeRolePolicyDocument.Statement[]
-echo "$TRUST_POLICY" | jq -r .Statement[]
-} | jq -s '{"Version": "2012-10-17", "Statement": .}' > /tmp/policy.json
-aws iam update-assume-role-policy \
-  --role-name $ROLE_NAME \
-  --policy-document file:///tmp/policy.json

prepare-eks/80_s3_bucket.sh

@@ -1,54 +0,0 @@
-#!/bin/sh
-# Create an S3 bucket with two objects in it:
-# - public.txt (world-readable)
-# - private.txt (private)
-# Also create an IAM policy granting read-only access to the bucket
-# (and therefore, to the private object).
-# Finally, attach the policy to an IAM role (for instance, the role
-# created by another script in this directory).
-# This isn't idempotent, but it can be made idempotent by replacing the
-# "aws iam create-policy" call with "aws iam create-policy-version" and
-# a bit of extra elbow grease. (See other scripts in this directory for
-# an example).
-
-ACCOUNT=$(aws sts get-caller-identity | jq -r .Account)
-BUCKET=container.training
-ROLE_NAME=s3-reader-container-training
-POLICY_NAME=s3-reader-container-training
-POLICY_DOC=$(envsubst <<EOF
-{
-  "Version": "2012-10-17",
-  "Statement": [
-    {
-      "Effect": "Allow",
-      "Action": [
-        "s3:ListBucket",
-        "s3:GetObject*"
-      ],
-      "Resource": [
-        "arn:aws:s3:::$BUCKET",
-        "arn:aws:s3:::$BUCKET/*"
-      ]
-    }
-  ]
-}
-EOF
-)
-
-aws iam create-policy \
---policy-name $POLICY_NAME \
---policy-doc "$POLICY_DOC"
-
-aws s3 mb s3://container.training
-
-echo "this is a public object" \
-| aws s3 cp - s3://container.training/public.txt \
---acl public-read
-
-echo "this is a private object" \
-| aws s3 cp - s3://container.training/private.txt \
---acl private
-
-aws iam attach-role-policy \
-    --role-name "$ROLE_NAME" \
-    --policy-arn arn:aws:iam::$ACCOUNT:policy/$POLICY_NAME

prepare-eks/users.txt

@@ -1,50 +0,0 @@
-ada.lovelace
-adele.goldstine
-amanda.jones
-anita.borg
-ann.kiessling
-barbara.mcclintock
-beatrice.worsley
-bessie.blount
-betty.holberton
-beulah.henry
-carleen.hutchins
-caroline.herschel
-dona.bailey
-dorothy.hodgkin
-ellen.ochoa
-edith.clarke
-elisha.collier
-elizabeth.feinler
-emily.davenport
-erna.hoover
-frances.spence
-gertrude.blanch
-grace.hopper
-grete.hermann
-giuliana.tesoro
-harriet.tubman
-hedy.lamarr
-irma.wyman
-jane.goodall
-jean.bartik
-joy.mangano
-josephine.cochrane
-katherine.blodgett
-kathleen.antonelli
-lynn.conway
-margaret.hamilton
-maria.beasley
-marie.curie
-marjorie.joyner
-marlyn.meltzer
-mary.kies
-melitta.bentz
-milly.koss
-radia.perlman
-rosalind.franklin
-ruth.teitelbaum
-sarah.mather
-sophie.wilson
-stephanie.kwolek
-yvonne.brill

prepare-vms/README.md

@@ -4,11 +4,7 @@ These tools can help you to create VMs on:
 
 - Azure
 - EC2
-- Hetzner
-- Linode
 - OpenStack
-- OVHcloud
-- Scaleway
 
 ## Prerequisites
 
@@ -17,8 +13,7 @@ These tools can help you to create VMs on:
 - [Parallel SSH](https://code.google.com/archive/p/parallel-ssh/) (on a Mac: `brew install pssh`) 
 
 Depending on the infrastructure that you want to use, you also need to install
-the CLI that is specific to that cloud. For OpenStack deployments, you will
-need Terraform.
+the Azure CLI, the AWS CLI, or terraform (for OpenStack deployment).
 
 And if you want to generate printable cards:
 
@@ -95,9 +90,6 @@ You're all set!
 
 ## `./workshopctl` Usage
 
-If you run `./workshopctl` without arguments, it will show a list of
-available commands, looking like this:
-
 ```
 workshopctl - the orchestration workshop swiss army knife
 Commands:
@@ -106,7 +98,32 @@ cards                Generate ready-to-print cards for a group of VMs
 deploy               Install Docker on a bunch of running VMs
 disableaddrchecks    Disable source/destination IP address checks
 disabledocker        Stop Docker Engine and don't restart it automatically
-...
+helmprom             Install Helm and Prometheus
+help                 Show available commands
+ids                  (FIXME) List the instance IDs belonging to a given tag or token
+kubebins             Install Kubernetes and CNI binaries but don't start anything
+kubereset            Wipe out Kubernetes configuration on all nodes
+kube                 Setup kubernetes clusters with kubeadm (must be run AFTER deploy)
+kubetest             Check that all nodes are reporting as Ready
+listall              List VMs running on all configured infrastructures
+list                 List available groups for a given infrastructure
+netfix               Disable GRO and run a pinger job on the VMs
+opensg               Open the default security group to ALL ingress traffic
+ping                 Ping VMs in a given tag, to check that they have network access
+pssh                 Run an arbitrary command on all nodes
+pull_images          Pre-pull a bunch of Docker images
+quotas               Check our infrastructure quotas (max instances)
+remap_nodeports      Remap NodePort range to 10000-10999
+retag                (FIXME) Apply a new tag to a group of VMs
+ssh                  Open an SSH session to the first node of a tag
+start                Start a group of VMs
+stop                 Stop (terminate, shutdown, kill, remove, destroy...) instances
+tags                 List groups of VMs known locally
+test                 Run tests (pre-flight checks) on a group of VMs
+weavetest            Check that weave seems properly setup
+webssh               Install a WEB SSH server on the machines (port 1080)
+wrap                 Run this program in a container
+www                  Run a web server to access card HTML and PDF
 ```
 
 ### Summary of What `./workshopctl` Does For You
@@ -121,8 +138,7 @@ disabledocker        Stop Docker Engine and don't restart it automatically
 
 ### Example Steps to Launch a group of AWS Instances for a Workshop
 
-- Run `./workshopctl start --infra infra/aws-us-east-2 --settings/myworkshop.yaml --students 50` to create 50 clusters
-  - The number of instances will be `students × clustersize`
+- Run `./workshopctl start --infra infra/aws-us-east-2 --settings/myworkshop.yaml --count 60` to create 60 EC2 instances
   - Your local SSH key will be synced to instances under `ubuntu` user
   - AWS instances will be created and tagged based on date, and IP's stored in `prepare-vms/tags/`
 - Run `./workshopctl deploy TAG` to run `lib/postprep.py` via parallel-ssh
@@ -232,19 +248,12 @@ If you don't have `wkhtmltopdf` installed, you will get a warning that it is a m
 
 #### List tags
 
+    $ ./workshopctl list infra/some-infra-file
+
+    $ ./workshopctl listall
+
     $ ./workshopctl tags
 
-    $ ./workshopctl inventory infra/some-infra-file
-
-    $ ./workshopctl inventory
-
-Note: the `tags` command will show only the VMs that you have provisioned
-and deployed on the current machine (i.e. listed in the `tags` subdirectory).
-The `inventory` command will try to list all existing VMs (including the
-ones not listed in the `tags` directory, and including VMs provisioned
-through other mechanisms). It is not supported across all platforms,
-however.
-
 #### Stop and destroy VMs
 
     $ ./workshopctl stop TAG

prepare-vms/infra/example.openstack

@@ -1,5 +1,4 @@
-INFRACLASS=openstack-tf
-
+INFRACLASS=openstack
 # If you are using OpenStack, copy this file (e.g. to "openstack" or "enix")
 # and customize the variables below.
 export TF_VAR_user="jpetazzo"
@@ -7,4 +6,4 @@ export TF_VAR_tenant="training"
 export TF_VAR_domain="Default"
 export TF_VAR_password="..."
 export TF_VAR_auth_url="https://api.r1.nxs.enix.io/v3"
-export TF_VAR_flavor="GP1.S"
+export TF_VAR_flavor="GP1.S"

prepare-vms/infra/example.openstack-cli

@@ -1,24 +0,0 @@
-INFRACLASS=openstack-cli
-
-# Copy that file to e.g. openstack or ovh, then customize it.
-# Some Openstack providers (like OVHcloud) will let you download
-# a file containing credentials. That's what you need to use.
-# The file below contains some example values.
-export OS_AUTH_URL=https://auth.cloud.ovh.net/v3/
-export OS_IDENTITY_API_VERSION=3
-export OS_USER_DOMAIN_NAME=${OS_USER_DOMAIN_NAME:-"Default"}
-export OS_PROJECT_DOMAIN_NAME=${OS_PROJECT_DOMAIN_NAME:-"Default"}
-export OS_TENANT_ID=abcd1234
-export OS_TENANT_NAME="0123456"
-export OS_USERNAME="user-xyz123"
-export OS_PASSWORD=AbCd1234
-export OS_REGION_NAME="GRA7"
-
-# And then some values to indicate server type, image, etc.
-# You can see available flavors with `openstack flavor list`
-export OS_FLAVOR=s1-4
-# You can see available images with `openstack image list`
-export OS_IMAGE=896c5f54-51dc-44f0-8c22-ce99ba7164df
-# You can create a key with `openstack keypair create --public-key ~/.ssh/id_rsa.pub containertraining`
-export OS_KEY=containertraining
-

prepare-vms/infra/hetzner

@@ -1,5 +0,0 @@
-INFRACLASS=hetzner
-if ! [ -f ~/.config/hcloud/cli.toml ]; then
-  warning "~/.config/hcloud/cli.toml not found."
-  warning "Make sure that the Hetzner CLI (hcloud) is installed and configured."
-fi

prepare-vms/infra/scaleway

@@ -1,3 +0,0 @@
-INFRACLASS=scaleway
-#SCW_INSTANCE_TYPE=DEV1-L
-#SCW_ZONE=fr-par-2

prepare-vms/lib/cli.sh

@@ -66,7 +66,7 @@ need_infra() {
 
 need_tag() {
     if [ -z "$TAG" ]; then
-        die "Please specify a tag. To see available tags, run: $0 tags"
+        die "Please specify a tag or token. To see available tags and tokens, run: $0 list"
     fi
     if [ ! -d "tags/$TAG" ]; then
         die "Tag $TAG not found (directory tags/$TAG does not exist)."

prepare-vms/lib/commands.sh

@@ -1,9 +1,5 @@
 export AWS_DEFAULT_OUTPUT=text
 
-# Ignore SSH key validation when connecting to these remote hosts.
-# (Otherwise, deployment scripts break when a VM IP address reuse.)
-SSHOPTS="-o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o LogLevel=ERROR"
-
 HELP=""
 _cmd() {
     HELP="$(printf "%s\n%-20s %s\n" "$HELP" "$1" "$2")"
@@ -47,16 +43,6 @@ _cmd_cards() {
     info "$0 www"
 }
 
-_cmd clean "Remove information about stopped clusters"
-_cmd_clean() {
-	for TAG in tags/*; do
-		if grep -q ^stopped$ "$TAG/status"; then
-			info "Removing $TAG..."
-			rm -rf "$TAG"
-		fi
-	done	
-}
-
 _cmd deploy "Install Docker on a bunch of running VMs"
 _cmd_deploy() {
     TAG=$1
@@ -73,35 +59,11 @@ _cmd_deploy() {
     echo deploying > tags/$TAG/status
     sep "Deploying tag $TAG"
 
-    # If this VM image is using cloud-init,
-    # wait for cloud-init to be done
+    # Wait for cloudinit to be done
     pssh "
-    if [ -d /var/lib/cloud ]; then
-        while [ ! -f /var/lib/cloud/instance/boot-finished ]; do
-            sleep 1
-        done
-    fi"
-
-    # Special case for scaleway since it doesn't come with sudo
-    if [ "$INFRACLASS" = "scaleway" ]; then
-        pssh -l root "
-    grep DEBIAN_FRONTEND /etc/environment || echo DEBIAN_FRONTEND=noninteractive >> /etc/environment
-    grep cloud-init /etc/sudoers && rm /etc/sudoers
-    apt-get update && apt-get install sudo -y"
-    fi
-
-    # FIXME
-    # Special case for hetzner since it doesn't have an ubuntu user
-    #if [ "$INFRACLASS" = "hetzner" ]; then
-    #    pssh -l root "
-    #[ -d /home/ubuntu ] ||
-    #    useradd ubuntu -m -s /bin/bash
-    #echo 'ubuntu ALL=(ALL:ALL) NOPASSWD:ALL' > /etc/sudoers.d/ubuntu
-    #[ -d /home/ubuntu/.ssh ] ||
-    #    install --owner=ubuntu --mode=700 --directory /home/ubuntu/.ssh
-    #[ -f /home/ubuntu/.ssh/authorized_keys ] ||
-    #    install --owner=ubuntu --mode=600 /root/.ssh/authorized_keys --target-directory /home/ubuntu/.ssh"
-    #fi
+    while [ ! -f /var/lib/cloud/instance/boot-finished ]; do
+        sleep 1
+    done"
 
     # Copy settings and install Python YAML parser
     pssh -I tee /tmp/settings.yaml <tags/$TAG/settings.yaml
@@ -109,12 +71,6 @@ _cmd_deploy() {
     sudo apt-get update &&
     sudo apt-get install -y python-yaml"
 
-    # If there is no "python" binary, symlink to python3
-    #pssh "
-    #if ! which python; then
-    #    ln -s $(which python3) /usr/local/bin/python
-    #fi"
-
     # Copy postprep.py to the remote machines, and execute it, feeding it the list of IP addresses
     pssh -I tee /tmp/postprep.py <lib/postprep.py
     pssh --timeout 900 --send-input "python /tmp/postprep.py >>/tmp/pp.out 2>>/tmp/pp.err" <tags/$TAG/ips.txt
@@ -126,7 +82,7 @@ _cmd_deploy() {
     # If /home/docker/.ssh/id_rsa doesn't exist, copy it from the first node
     pssh "
     sudo -u docker [ -f /home/docker/.ssh/id_rsa ] ||
-    ssh $SSHOPTS \$(cat /etc/name_of_first_node) sudo -u docker tar -C /home/docker -cvf- .ssh |
+    ssh -o StrictHostKeyChecking=no \$(cat /etc/name_of_first_node) sudo -u docker tar -C /home/docker -cvf- .ssh |
     sudo -u docker tar -C /home/docker -xf-"
 
     # if 'docker@' doesn't appear in /home/docker/.ssh/authorized_keys, copy it there
@@ -157,12 +113,9 @@ _cmd_disabledocker() {
     TAG=$1
     need_tag
 
-    pssh "
-    sudo systemctl disable docker.service
-    sudo systemctl disable docker.socket
-    sudo systemctl stop docker
-    sudo killall containerd
-    "
+    pssh "sudo systemctl disable docker.service"
+    pssh "sudo systemctl disable docker.socket"
+    pssh "sudo systemctl stop docker"
 }
 
 _cmd kubebins "Install Kubernetes and CNI binaries but don't start anything"
@@ -170,27 +123,27 @@ _cmd_kubebins() {
     TAG=$1
     need_tag
 
-    ##VERSION##
-    ETCD_VERSION=v3.4.13
-    K8SBIN_VERSION=v1.19.11 # Can't go to 1.20 because it requires a serviceaccount signing key.
-    CNI_VERSION=v0.8.7
     pssh --timeout 300 "
     set -e
     cd /usr/local/bin
     if ! [ -x etcd ]; then
-        curl -L https://github.com/etcd-io/etcd/releases/download/$ETCD_VERSION/etcd-$ETCD_VERSION-linux-amd64.tar.gz \
+        curl -L https://github.com/etcd-io/etcd/releases/download/v3.3.15/etcd-v3.3.15-linux-amd64.tar.gz \
         | sudo tar --strip-components=1 --wildcards -zx '*/etcd' '*/etcdctl'
     fi
     if ! [ -x hyperkube ]; then
-        ##VERSION##
-        curl -L https://dl.k8s.io/$K8SBIN_VERSION/kubernetes-server-linux-amd64.tar.gz \
-        | sudo tar --strip-components=3 -zx \
-          kubernetes/server/bin/kube{ctl,let,-proxy,-apiserver,-scheduler,-controller-manager}
+        curl -L https://dl.k8s.io/v1.16.2/kubernetes-server-linux-amd64.tar.gz \
+        | sudo tar --strip-components=3 -zx kubernetes/server/bin/hyperkube
+    fi
+    if ! [ -x kubelet ]; then
+        for BINARY in kubectl kube-apiserver kube-scheduler kube-controller-manager kubelet kube-proxy;
+        do
+            sudo ln -s hyperkube \$BINARY
+        done
     fi
     sudo mkdir -p /opt/cni/bin
     cd /opt/cni/bin
     if ! [ -x bridge ]; then
-        curl -L https://github.com/containernetworking/plugins/releases/download/$CNI_VERSION/cni-plugins-linux-amd64-$CNI_VERSION.tgz \
+        curl -L https://github.com/containernetworking/plugins/releases/download/v0.7.6/cni-plugins-amd64-v0.7.6.tgz \
         | sudo tar -zx
     fi
     "
@@ -220,22 +173,13 @@ _cmd_kube() {
     pssh --timeout 200 "
     sudo apt-get update -q &&
     sudo apt-get install -qy kubelet$EXTRA_APTGET kubeadm$EXTRA_APTGET kubectl$EXTRA_APTGET &&
-    kubectl completion bash | sudo tee /etc/bash_completion.d/kubectl &&
-    echo 'alias k=kubectl' | sudo tee /etc/bash_completion.d/k &&
-    echo 'complete -F __start_kubectl k' | sudo tee -a /etc/bash_completion.d/k"
+    kubectl completion bash | sudo tee /etc/bash_completion.d/kubectl"
 
-    # Disable swap
-    # (note that this won't survive across node reboots!)
-    if [ "$INFRACLASS" = "linode" ]; then
-        pssh "
-        sudo swapoff -a"
-    fi
-
-    # Initialize kube control plane
+    # Initialize kube master
     pssh --timeout 200 "
     if i_am_first_node && [ ! -f /etc/kubernetes/admin.conf ]; then
         kubeadm token generate > /tmp/token &&
-	sudo kubeadm init $EXTRA_KUBEADM --token \$(cat /tmp/token) --apiserver-cert-extra-sans \$(cat /tmp/ipv4) --ignore-preflight-errors=NumCPU
+	sudo kubeadm init $EXTRA_KUBEADM --token \$(cat /tmp/token) --apiserver-cert-extra-sans \$(cat /tmp/ipv4)
     fi"
 
     # Put kubeconfig in ubuntu's and docker's accounts
@@ -259,7 +203,7 @@ _cmd_kube() {
     pssh --timeout 200 "
     if ! i_am_first_node && [ ! -f /etc/kubernetes/kubelet.conf ]; then
         FIRSTNODE=\$(cat /etc/name_of_first_node) &&
-        TOKEN=\$(ssh $SSHOPTS \$FIRSTNODE cat /tmp/token) &&
+        TOKEN=\$(ssh -o StrictHostKeyChecking=no \$FIRSTNODE cat /tmp/token) &&
         sudo kubeadm join --discovery-token-unsafe-skip-ca-verification --token \$TOKEN \$FIRSTNODE:6443
     fi"
 
@@ -268,23 +212,17 @@ _cmd_kube() {
     if i_am_first_node; then
 	kubectl apply -f https://raw.githubusercontent.com/jpetazzo/container.training/master/k8s/metrics-server.yaml
     fi"
-}
-
-_cmd kubetools "Install a bunch of CLI tools for Kubernetes"
-_cmd_kubetools() {
-    TAG=$1
-    need_tag
 
     # Install kubectx and kubens
     pssh "
     [ -d kubectx ] || git clone https://github.com/ahmetb/kubectx &&
-    sudo ln -sf \$HOME/kubectx/kubectx /usr/local/bin/kctx &&
-    sudo ln -sf \$HOME/kubectx/kubens /usr/local/bin/kns &&
-    sudo cp \$HOME/kubectx/completion/*.bash /etc/bash_completion.d &&
+    sudo ln -sf /home/ubuntu/kubectx/kubectx /usr/local/bin/kctx &&
+    sudo ln -sf /home/ubuntu/kubectx/kubens /usr/local/bin/kns &&
+    sudo cp /home/ubuntu/kubectx/completion/*.bash /etc/bash_completion.d &&
     [ -d kube-ps1 ] || git clone https://github.com/jonmosco/kube-ps1 &&
     sudo -u docker sed -i s/docker-prompt/kube_ps1/ /home/docker/.bashrc &&
     sudo -u docker tee -a /home/docker/.bashrc <<EOF
-. \$HOME/kube-ps1/kube-ps1.sh
+. /home/ubuntu/kube-ps1/kube-ps1.sh
 KUBE_PS1_PREFIX=""
 KUBE_PS1_SUFFIX=""
 KUBE_PS1_SYMBOL_ENABLE="false"
@@ -308,85 +246,22 @@ EOF"
         helm completion bash | sudo tee /etc/bash_completion.d/helm
     fi"
 
-    # Install kustomize
-    pssh "
-    if [ ! -x /usr/local/bin/kustomize ]; then
-        ##VERSION##
-        curl -L https://github.com/kubernetes-sigs/kustomize/releases/download/kustomize/v3.6.1/kustomize_v3.6.1_linux_amd64.tar.gz |
-            sudo tar -C /usr/local/bin -zx kustomize
-        echo complete -C /usr/local/bin/kustomize kustomize | sudo tee /etc/bash_completion.d/kustomize
-    fi"
-
     # Install ship
-    # Note: 0.51.3 is the last version that doesn't display GIN-debug messages
-    # (don't want to get folks confused by that!)
     pssh "
     if [ ! -x /usr/local/bin/ship ]; then
-        ##VERSION##
-        curl -L https://github.com/replicatedhq/ship/releases/download/v0.51.3/ship_0.51.3_linux_amd64.tar.gz |
+        curl -L https://github.com/replicatedhq/ship/releases/download/v0.40.0/ship_0.40.0_linux_amd64.tar.gz |
              sudo tar -C /usr/local/bin -zx ship
     fi"
 
     # Install the AWS IAM authenticator
     pssh "
     if [ ! -x /usr/local/bin/aws-iam-authenticator ]; then
-        ##VERSION##
+	##VERSION##
         sudo curl -o /usr/local/bin/aws-iam-authenticator https://amazon-eks.s3-us-west-2.amazonaws.com/1.12.7/2019-03-27/bin/linux/amd64/aws-iam-authenticator
 	sudo chmod +x /usr/local/bin/aws-iam-authenticator
     fi"
 
-    # Install the krew package manager
-    pssh "
-    if [ ! -d /home/docker/.krew ]; then
-        cd /tmp &&
-        curl -fsSL https://github.com/kubernetes-sigs/krew/releases/latest/download/krew.tar.gz |
-        tar -zxf- &&
-        sudo -u docker -H ./krew-linux_amd64 install krew &&
-        echo export PATH=/home/docker/.krew/bin:\\\$PATH | sudo -u docker tee -a /home/docker/.bashrc
-    fi"
-
-    # Install k9s
-    pssh "
-    if [ ! -x /usr/local/bin/k9s ]; then
-        VERSION=v0.24.10 &&
-        FILENAME=k9s_\${VERSION}_\$(uname -s)_\$(uname -m).tar.gz &&
-        curl -sSL https://github.com/derailed/k9s/releases/download/\$VERSION/\$FILENAME |
-        sudo tar -zxvf- -C /usr/local/bin k9s
-    fi"
-
-    # Install popeye
-    pssh "
-    if [ ! -x /usr/local/bin/popeye ]; then
-        FILENAME=popeye_\$(uname -s)_\$(uname -m).tar.gz &&
-        curl -sSL https://github.com/derailed/popeye/releases/latest/download/\$FILENAME |
-        sudo tar -zxvf- -C /usr/local/bin popeye
-    fi"
-
-    # Install Tilt
-    pssh "
-    if [ ! -x /usr/local/bin/tilt ]; then
-        curl -fsSL https://raw.githubusercontent.com/tilt-dev/tilt/master/scripts/install.sh | bash
-    fi"
-
-    # Install Skaffold
-    pssh "
-    if [ ! -x /usr/local/bin/skaffold ]; then
-        curl -Lo skaffold https://storage.googleapis.com/skaffold/releases/latest/skaffold-linux-amd64 &&
-        sudo install skaffold /usr/local/bin/
-    fi"
-
-    # Install Kompose
-    pssh "
-    if [ ! -x /usr/local/bin/kompose ]; then
-        curl -Lo kompose https://github.com/kubernetes/kompose/releases/latest/download/kompose-linux-amd64 &&
-        sudo install kompose /usr/local/bin
-    fi"
-
-    pssh "
-    if [ ! -x /usr/local/bin/kubeseal ]; then
-        curl -Lo kubeseal https://github.com/bitnami-labs/sealed-secrets/releases/download/v0.13.1/kubeseal-linux-amd64 &&
-        sudo install kubeseal /usr/local/bin
-    fi"
+    sep "Done"
 }
 
 _cmd kubereset "Wipe out Kubernetes configuration on all nodes"
@@ -408,44 +283,44 @@ _cmd_kubetest() {
     set -e
     if i_am_first_node; then
       which kubectl
-      for NODE in \$(grep [0-9]\$ /etc/hosts | grep -v ^127 | awk {print\ \\\$2}); do
+      for NODE in \$(awk /[0-9]\$/\ {print\ \\\$2} /etc/hosts); do
         echo \$NODE ; kubectl get nodes | grep -w \$NODE | grep -w Ready
       done
     fi"
 }
 
-_cmd ips "Show the IP addresses for a given tag"
-_cmd_ips() {
+_cmd ids "(FIXME) List the instance IDs belonging to a given tag or token"
+_cmd_ids() {
     TAG=$1
     need_tag $TAG
 
-    SETTINGS=tags/$TAG/settings.yaml
-    CLUSTERSIZE=$(awk '/^clustersize:/ {print $2}' $SETTINGS)
-    while true; do
-        for I in $(seq $CLUSTERSIZE); do
-            read ip || return 0
-            printf "%s\t" "$ip"
-        done
-        printf "\n"
-    done < tags/$TAG/ips.txt
+    info "Looking up by tag:"
+    aws_get_instance_ids_by_tag $TAG
+
+    # Just in case we managed to create instances but weren't able to tag them
+    info "Looking up by token:"
+    aws_get_instance_ids_by_client_token $TAG
 }
 
-_cmd inventory "List all VMs on a given infrastructure (or all infras if no arg given)"
-_cmd_inventory() {
-    case "$1" in
-    "")
-        for INFRA in infra/*; do
-            $0 inventory $INFRA
-        done
-        ;;
-    */example.*)
-        ;;
-    *)
-        need_infra $1
-        sep "Listing instances for $1"
-        infra_list
-        ;;
-    esac
+_cmd list "List available groups for a given infrastructure"
+_cmd_list() {
+    need_infra $1
+    infra_list
+}
+
+_cmd listall "List VMs running on all configured infrastructures"
+_cmd_listall() {
+    for infra in infra/*; do
+        case $infra in
+        infra/example.*)
+            ;;
+        *)
+            info "Listing infrastructure $infra:"
+            need_infra $infra
+            infra_list
+            ;;
+        esac
+    done
 }
 
 _cmd maketag "Generate a quasi-unique tag for a group of instances"
@@ -453,7 +328,7 @@ _cmd_maketag() {
     if [ -z $USER ]; then
         export USER=anonymous
     fi
-    MS=$(($(date +%N | tr -d 0)/1000000))
+    MS=$(($(date +%N)/1000000))
     date +%Y-%m-%d-%H-%M-$MS-$USER
 }
 
@@ -490,40 +365,22 @@ EOF
     sudo systemctl start pinger"
 }
 
-_cmd tailhist "Install history viewer on port 1088"
-_cmd_tailhist () {
-    TAG=$1
-    need_tag
-
-    pssh "
-    wget https://github.com/joewalnes/websocketd/releases/download/v0.3.0/websocketd-0.3.0_amd64.deb
-    sudo dpkg -i websocketd-0.3.0_amd64.deb
-    sudo mkdir -p /tmp/tailhist
-    sudo tee /root/tailhist.service <<EOF
-[Unit]
-Description=tailhist
-
-[Install]
-WantedBy=multi-user.target
-
-[Service]
-WorkingDirectory=/tmp/tailhist
-ExecStart=/usr/bin/websocketd --port=1088 --staticdir=. sh -c \"tail -n +1 -f /home/docker/.history || echo 'Could not read history file. Perhaps you need to \\\"chmod +r .history\\\"?'\"
-User=nobody
-Group=nogroup
-Restart=always
-EOF
-    sudo systemctl enable /root/tailhist.service
-    sudo systemctl start tailhist"
-    pssh -I sudo tee /tmp/tailhist/index.html <lib/tailhist.html
-}
-
 _cmd opensg "Open the default security group to ALL ingress traffic"
 _cmd_opensg() {
     need_infra $1
     infra_opensg
 }
 
+_cmd portworx "Prepare the nodes for Portworx deployment"
+_cmd_portworx() {
+    TAG=$1
+    need_tag
+
+    pssh "
+    sudo truncate --size 10G /portworx.blk &&
+    sudo losetup /dev/loop4 /portworx.blk"
+}
+
 _cmd disableaddrchecks "Disable source/destination IP address checks"
 _cmd_disableaddrchecks() {
     TAG=$1
@@ -560,17 +417,6 @@ _cmd_remap_nodeports() {
     if i_am_first_node && ! grep -q '$ADD_LINE' $MANIFEST_FILE; then
         sudo sed -i 's/\($FIND_LINE\)\$/\1\n$ADD_LINE/' $MANIFEST_FILE
     fi"
-
-    info "If you have manifests hard-coding nodePort values,"
-    info "you might want to patch them with a command like:"
-    info "
-
-if i_am_first_node; then
-    kubectl -n kube-system patch svc prometheus-server \\
-        -p 'spec: { ports: [ {port: 80, nodePort: 10101} ]}'
-fi
-
-    "
 }
 
 _cmd quotas "Check our infrastructure quotas (max instances)"
@@ -579,14 +425,25 @@ _cmd_quotas() {
     infra_quotas
 }
 
+_cmd retag "(FIXME) Apply a new tag to a group of VMs"
+_cmd_retag() {
+    OLDTAG=$1
+    NEWTAG=$2
+    TAG=$OLDTAG
+    need_tag
+    if [[ -z "$NEWTAG" ]]; then
+        die "You must specify a new tag to apply."
+    fi
+    aws_tag_instances $OLDTAG $NEWTAG
+}
+
 _cmd ssh "Open an SSH session to the first node of a tag"
 _cmd_ssh() {
     TAG=$1
     need_tag
     IP=$(head -1 tags/$TAG/ips.txt)
     info "Logging into $IP"
-    ssh $SSHOPTS docker@$IP
-
+    ssh docker@$IP
 }
 
 _cmd start "Start a group of VMs"
@@ -595,9 +452,8 @@ _cmd_start() {
         case "$1" in
         --infra) INFRA=$2; shift 2;;
         --settings) SETTINGS=$2; shift 2;;
-        --count) die "Flag --count is deprecated; please use --students instead." ;;
+        --count) COUNT=$2; shift 2;;
         --tag) TAG=$2; shift 2;;
-        --students) STUDENTS=$2; shift 2;;
         *) die "Unrecognized parameter: $1."
         esac
     done
@@ -609,14 +465,8 @@ _cmd_start() {
         die "Please add --settings flag to specify which settings file to use."
     fi
     if [ -z "$COUNT" ]; then
-        CLUSTERSIZE=$(awk '/^clustersize:/ {print $2}' $SETTINGS)
-        if [ -z "$STUDENTS" ]; then
-            warning "Neither --count nor --students was specified."
-            warning "According to the settings file, the cluster size is $CLUSTERSIZE."
-            warning "Deploying one cluster of $CLUSTERSIZE nodes."
-            STUDENTS=1
-        fi
-        COUNT=$(($STUDENTS*$CLUSTERSIZE))
+        COUNT=$(awk '/^clustersize:/ {print $2}' $SETTINGS)
+        warning "No --count option was specified. Using value from settings file ($COUNT)."
     fi
 
     # Check that the specified settings and infrastructure are valid.
@@ -634,43 +484,11 @@ _cmd_start() {
     infra_start $COUNT
     sep
     info "Successfully created $COUNT instances with tag $TAG"
+    sep
     echo created > tags/$TAG/status
 
-    # If the settings.yaml file has a "steps" field,
-    # automatically execute all the actions listed in that field.
-    # If an action fails, retry it up to 10 times.
-    python -c 'if True: # hack to deal with indentation
-        import sys, yaml
-        settings = yaml.safe_load(sys.stdin)
-        print ("\n".join(settings.get("steps", [])))
-        ' < tags/$TAG/settings.yaml \
-    | while read step; do
-        if [ -z "$step" ]; then
-            break
-        fi
-        sep
-        info "Automatically executing step '$step'."
-        TRY=1
-        MAXTRY=10
-        while ! $0 $step $TAG ; do
-            TRY=$(($TRY+1))
-            if [ $TRY -gt $MAXTRY ]; then
-                error "This step ($step) failed after $MAXTRY attempts."
-                info "You can troubleshoot the situation manually, or terminate these instances with:"
-                info "$0 stop $TAG"
-                die "Giving up."
-            else
-                sep
-                info "Step '$step' failed. Let's wait 10 seconds and try again."
-                info "(Attempt $TRY out of $MAXTRY.)"
-                sleep 10
-            fi
-        done
-    done
-    sep
-    info "Deployment successful."
-    info "To log into the first machine of that batch, you can run:"
-    info "$0 ssh $TAG"
+    info "To deploy Docker on these instances, you can run:"
+    info "$0 deploy $TAG"
     info "To terminate these instances, you can run:"
     info "$0 stop $TAG"
 }
@@ -725,7 +543,7 @@ _cmd_tmux() {
     IP=$(head -1 tags/$TAG/ips.txt)
     info "Opening ssh+tmux with $IP"
     rm -f /tmp/tmux-$UID/default
-    ssh $SSHOPTS -t -L /tmp/tmux-$UID/default:/tmp/tmux-1001/default docker@$IP tmux new-session -As 0
+    ssh -t -L /tmp/tmux-$UID/default:/tmp/tmux-1001/default docker@$IP tmux new-session -As 0
 }
 
 _cmd helmprom "Install Helm and Prometheus"
@@ -734,8 +552,8 @@ _cmd_helmprom() {
     need_tag
     pssh "
     if i_am_first_node; then
-        sudo -u docker -H helm repo add prometheus-community https://prometheus-community.github.io/helm-charts/
-        sudo -u docker -H helm install prometheus prometheus-community/prometheus \
+        sudo -u docker -H helm repo add stable https://kubernetes-charts.storage.googleapis.com/
+        sudo -u docker -H helm install prometheus stable/prometheus \
             --namespace kube-system \
             --set server.service.type=NodePort \
             --set server.service.nodePort=30090 \
@@ -744,31 +562,6 @@ _cmd_helmprom() {
     fi"
 }
 
-_cmd passwords "Set individual passwords for each cluster"
-_cmd_passwords() {
-    TAG=$1
-    need_tag
-    PASSWORDS_FILE="tags/$TAG/passwords"
-    if ! [ -f "$PASSWORDS_FILE" ]; then
-        error "File $PASSWORDS_FILE not found. Please create it first."
-        error "It should contain one password per line."
-        error "It should have as many lines as there are clusters."
-        die "Aborting."
-    fi
-    N_CLUSTERS=$($0 ips "$TAG" | wc -l)
-    N_PASSWORDS=$(wc -l < "$PASSWORDS_FILE")
-    if [ "$N_CLUSTERS" != "$N_PASSWORDS" ]; then
-        die "Found $N_CLUSTERS clusters and $N_PASSWORDS passwords. Aborting."
-    fi
-    $0 ips "$TAG" | paste "$PASSWORDS_FILE" - | while read password nodes; do
-        info "Setting password for $nodes..."
-        for node in $nodes; do
-            echo docker:$password | ssh $SSHOPTS ubuntu@$node sudo chpasswd
-        done
-    done
-    info "Done."
-}
-
 # Sometimes, weave fails to come up on some nodes.
 # Symptom: the pods on a node are unreachable (they don't even ping).
 # Remedy: wipe out Weave state and delete weave pod on that node.
@@ -793,12 +586,11 @@ _cmd_webssh() {
     sudo apt-get update &&
     sudo apt-get install python-tornado python-paramiko -y"
     pssh "
-    cd /opt
-    [ -d webssh ] || sudo git clone https://github.com/jpetazzo/webssh"
+    [ -d webssh ] || git clone https://github.com/jpetazzo/webssh"
     pssh "
     for KEYFILE in /etc/ssh/*.pub; do
       read a b c < \$KEYFILE; echo localhost \$a \$b
-    done | sudo tee /opt/webssh/known_hosts"
+    done > webssh/known_hosts"
     pssh "cat >webssh.service <<EOF
 [Unit]
 Description=webssh
@@ -807,7 +599,7 @@ Description=webssh
 WantedBy=multi-user.target
 
 [Service]
-WorkingDirectory=/opt/webssh
+WorkingDirectory=/home/ubuntu/webssh
 ExecStart=/usr/bin/env python run.py --fbidhttp=false --port=1080 --policy=reject
 User=nobody
 Group=nogroup
@@ -830,6 +622,11 @@ _cmd_www() {
     python3 -m http.server
 }
 
+greet() {
+    IAMUSER=$(aws iam get-user --query 'User.UserName')
+    info "Hello! You seem to be UNIX user $USER, and IAM user $IAMUSER."
+}
+
 pull_tag() {
     # Pre-pull a bunch of images
     pssh --timeout 900 'for I in \
@@ -897,7 +694,10 @@ test_vm() {
         "ls -la /home/docker/.ssh"; do
         sep "$cmd"
         echo "$cmd" \
-            | ssh -A $SSHOPTS $user@$ip sudo -u docker -i \
+            | ssh -A -q \
+                -o "UserKnownHostsFile /dev/null" \
+                -o "StrictHostKeyChecking=no" \
+                $user@$ip sudo -u docker -i \
             || {
                 status=$?
                 error "$cmd exit status: $status"
@@ -916,3 +716,27 @@ make_key_name() {
     SHORT_FINGERPRINT=$(ssh-add -l | grep RSA | head -n1 | cut -d " " -f 2 | tr -d : | cut -c 1-8)
     echo "${SHORT_FINGERPRINT}-${USER}"
 }
+
+sync_keys() {
+    # make sure ssh-add -l contains "RSA"
+    ssh-add -l | grep -q RSA \
+        || die "The output of \`ssh-add -l\` doesn't contain 'RSA'. Start the agent, add your keys?"
+
+    AWS_KEY_NAME=$(make_key_name)
+    info "Syncing keys... "
+    if ! aws ec2 describe-key-pairs --key-name "$AWS_KEY_NAME" &>/dev/null; then
+        aws ec2 import-key-pair --key-name $AWS_KEY_NAME \
+            --public-key-material "$(ssh-add -L \
+                | grep -i RSA \
+                | head -n1 \
+                | cut -d " " -f 1-2)" &>/dev/null
+
+        if ! aws ec2 describe-key-pairs --key-name "$AWS_KEY_NAME" &>/dev/null; then
+            die "Somehow, importing the key didn't work. Make sure that 'ssh-add -l | grep RSA | head -n1' returns an RSA key?"
+        else
+            info "Imported new key $AWS_KEY_NAME."
+        fi
+    else
+        info "Using existing key $AWS_KEY_NAME."
+    fi
+}

prepare-vms/lib/infra/aws.sh

@@ -1,14 +1,9 @@
-if ! command -v aws >/dev/null; then
-    warning "AWS CLI (aws) not found."
-fi
-
 infra_list() {
-    aws ec2 describe-instances --output json |
-        jq -r '.Reservations[].Instances[] | [.InstanceId, .ClientToken, .State.Name, .InstanceType ] | @tsv'
+    aws_display_tags
 }
 
 infra_quotas() {
-    aws_greet
+    greet
 
     max_instances=$(aws ec2 describe-account-attributes \
         --attribute-names max-instances \
@@ -26,10 +21,10 @@ infra_start() {
     COUNT=$1
 
     # Print our AWS username, to ease the pain of credential-juggling
-    aws_greet
+    greet
 
     # Upload our SSH keys to AWS if needed, to be added to each VM's authorized_keys
-    key_name=$(aws_sync_keys)
+    key_name=$(sync_keys)
 
     AMI=$(aws_get_ami)    # Retrieve the AWS image ID
     if [ -z "$AMI" ]; then
@@ -66,7 +61,7 @@ infra_start() {
     aws_tag_instances $TAG $TAG
 
     # Wait until EC2 API tells us that the instances are running
-    aws_wait_until_tag_is_running $TAG $COUNT
+    wait_until_tag_is_running $TAG $COUNT
 
     aws_get_instance_ips_by_tag $TAG > tags/$TAG/ips.txt
 }
@@ -103,7 +98,7 @@ infra_disableaddrchecks() {
     done
 }
 
-aws_wait_until_tag_is_running() {
+wait_until_tag_is_running() {
     max_retry=100
     i=0
     done_count=0
@@ -217,34 +212,5 @@ aws_tag_instances() {
 
 aws_get_ami() {
     ##VERSION##
-    find_ubuntu_ami -r $AWS_DEFAULT_REGION -a ${AWS_ARCHITECTURE-amd64} -v 18.04 -t hvm:ebs -N -q
-}
-
-aws_greet() {
-    IAMUSER=$(aws iam get-user --query 'User.UserName')
-    info "Hello! You seem to be UNIX user $USER, and IAM user $IAMUSER."
-}
-
-aws_sync_keys() {
-    # make sure ssh-add -l contains "RSA"
-    ssh-add -l | grep -q RSA \
-        || die "The output of \`ssh-add -l\` doesn't contain 'RSA'. Start the agent, add your keys?"
-
-    AWS_KEY_NAME=$(make_key_name)
-    info "Syncing keys... "
-    if ! aws ec2 describe-key-pairs --key-name "$AWS_KEY_NAME" &>/dev/null; then
-        aws ec2 import-key-pair --key-name $AWS_KEY_NAME \
-            --public-key-material "$(ssh-add -L \
-                | grep -i RSA \
-                | head -n1 \
-                | cut -d " " -f 1-2)" &>/dev/null
-
-        if ! aws ec2 describe-key-pairs --key-name "$AWS_KEY_NAME" &>/dev/null; then
-            die "Somehow, importing the key didn't work. Make sure that 'ssh-add -l | grep RSA | head -n1' returns an RSA key?"
-        else
-            info "Imported new key $AWS_KEY_NAME."
-        fi
-    else
-        info "Using existing key $AWS_KEY_NAME."
-    fi
+    find_ubuntu_ami -r $AWS_DEFAULT_REGION -a amd64 -v 18.04 -t hvm:ebs -N -q
 }

prepare-vms/lib/infra/hetzner.sh

@@ -1,57 +0,0 @@
-if ! command -v hcloud >/dev/null; then
-  warning "Hetzner CLI (hcloud) not found."
-fi
-if ! [ -f ~/.config/hcloud/cli.toml ]; then
-  warning "~/.config/hcloud/cli.toml not found."
-fi
-
-infra_list() {
-    [ "$(hcloud server list -o json)" = "null" ] && return
-
-    hcloud server list -o json |
-        jq -r '.[] | [.id, .name , .status, .server_type.name] | @tsv'
-}
-
-infra_start() {
-    COUNT=$1
-
-    HETZNER_INSTANCE_TYPE=${HETZNER_INSTANCE_TYPE-cx21}
-    HETZNER_DATACENTER=${HETZNER_DATACENTER-nbg1-dc3}
-    HETZNER_IMAGE=${HETZNER_IMAGE-168855}
-
-    for I in $(seq 1 $COUNT); do
-        NAME=$(printf "%s-%03d" $TAG $I)
-        sep "Starting instance $I/$COUNT"
-        info "    Datacenter: $HETZNER_DATACENTER"
-        info "          Name: $NAME"
-        info " Instance type: $HETZNER_INSTANCE_TYPE"
-        hcloud server create \
-            --type=${HETZNER_INSTANCE_TYPE} \
-            --datacenter=${HETZNER_DATACENTER} \
-            --image=${HETZNER_IMAGE} \
-            --name=$NAME \
-            --label=tag=$TAG \
-            --ssh-key ~/.ssh/id_rsa.pub
-    done
-
-    hetzner_get_ips_by_tag $TAG > tags/$TAG/ips.txt
-}
-
-infra_stop() {
-    for ID in $(hetzner_get_ids_by_tag $TAG); do
-        info "Scheduling deletion of instance $ID..."
-        hcloud server delete $ID &
-    done
-    info "Waiting for deletion to complete..."
-    wait
-}
-
-hetzner_get_ids_by_tag() {
-    TAG=$1
-    hcloud server list --selector=tag=$TAG -o json | jq -r .[].name
-}
-
-hetzner_get_ips_by_tag() {
-    TAG=$1
-    hcloud server list --selector=tag=$TAG -o json | jq -r .[].public_net.ipv4.ip
-}

prepare-vms/lib/infra/linode.sh

@@ -1,58 +0,0 @@
-if ! command -v linode-cli >/dev/null; then
-  warning "Linode CLI (linode-cli) not found."
-fi
-if ! [ -f ~/.config/linode-cli ]; then
-  warning "~/.config/linode-cli not found."
-fi
-
-# To view available regions: "linode-cli regions list"
-LINODE_REGION=${LINODE_REGION-us-west}
-
-# To view available types: "linode-cli linodes types"
-LINODE_TYPE=${LINODE_TYPE-g6-standard-2}
-
-infra_list() {
-    linode-cli linodes list --json |
-        jq -r '.[] | [.id, .label, .status, .type] | @tsv'
-}
-
-infra_start() {
-    COUNT=$1
-
-    for I in $(seq 1 $COUNT); do
-        NAME=$(printf "%s-%03d" $TAG $I)
-        sep "Starting instance $I/$COUNT"
-        info "          Zone: $LINODE_REGION"
-        info "          Name: $NAME"
-        info " Instance type: $LINODE_TYPE"
-        ROOT_PASS="$(base64 /dev/urandom | cut -c1-20 | head -n 1)"
-        linode-cli linodes create \
-            --type=${LINODE_TYPE} --region=${LINODE_REGION} \
-            --image=linode/ubuntu18.04 \
-            --authorized_keys="${LINODE_SSHKEY}" \
-            --root_pass="${ROOT_PASS}" \
-            --tags=${TAG} --label=${NAME}
-    done
-    sep
-
-    linode_get_ips_by_tag $TAG > tags/$TAG/ips.txt
-}
-
-infra_stop() {
-    info "Counting instances..."
-    linode_get_ids_by_tag $TAG | wc -l
-    info "Deleting instances..."
-    linode_get_ids_by_tag $TAG | 
-        xargs -n1 -P10 \
-        linode-cli linodes delete
-}
-
-linode_get_ids_by_tag() {
-    TAG=$1
-    linode-cli linodes list --tags $TAG --json | jq -r ".[].id"
-}
-
-linode_get_ips_by_tag() {
-    TAG=$1
-    linode-cli linodes list --tags $TAG --json | jq -r ".[].ipv4[0]"
-}

prepare-vms/lib/infra/openstack-cli.sh

@@ -1,53 +0,0 @@
-infra_list() {
-    openstack server list -f json |
-        jq -r '.[] | [.ID, .Name , .Status, .Flavor] | @tsv'
-}
-
-infra_start() {
-    COUNT=$1
-
-    sep "Starting $COUNT instances"
-    info " Region: $OS_REGION_NAME"
-    info "   User: $OS_USERNAME"
-    info " Flavor: $OS_FLAVOR"
-    info "  Image: $OS_IMAGE"
-    openstack server create \
-    	--flavor $OS_FLAVOR \
-    	--image $OS_IMAGE \
-    	--key-name $OS_KEY \
-    	--min $COUNT --max $COUNT \
-    	--property workshopctl=$TAG \
-    	$TAG
-
-    sep "Waiting for IP addresses to be available"
-    GOT=0
-    while [ "$GOT" != "$COUNT" ]; do
-    	echo "Got $GOT/$COUNT IP addresses."
-    	oscli_get_ips_by_tag $TAG > tags/$TAG/ips.txt
-    	GOT="$(wc -l < tags/$TAG/ips.txt)"
-    done
-
-}
-
-infra_stop() {
-	info "Counting instances..."
-	oscli_get_instances_json $TAG | 
-		jq -r .[].Name | 
-		wc -l
-	info "Deleting instances..."
-	oscli_get_instances_json $TAG |
-		jq -r .[].Name |
-		xargs -P10 -n1 openstack server delete
-	info "Done."
-}
-
-oscli_get_instances_json() {
-	TAG=$1
-    openstack server list -f json --name "${TAG}-[0-9]*"
-}
-
-oscli_get_ips_by_tag() {
-    TAG=$1
-    oscli_get_instances_json $TAG |
-    	jq -r .[].Networks | grep -oE '[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+' || true
-}

prepare-vms/lib/infra/openstack-tf.sh

@@ -1,28 +0,0 @@
-infra_start() {
-        COUNT=$1
-
-        cp terraform/*.tf tags/$TAG
-        (
-                cd tags/$TAG
-                if ! terraform init; then
-                        error "'terraform init' failed."
-                        error "If it mentions the following error message:"
-                        error "openpgp: signature made by unknown entity."
-                        error "Then you need to upgrade Terraform to 0.11.15"
-                        error "to upgrade its signing keys following the"
-                        error "codecov breach."
-                        die "Aborting."
-                fi
-                echo prefix = \"$TAG\" >> terraform.tfvars
-                echo count = \"$COUNT\" >> terraform.tfvars
-                terraform apply -auto-approve
-                terraform output ip_addresses > ips.txt
-        )
-}
-
-infra_stop() {
-        (
-                cd tags/$TAG
-                terraform destroy -auto-approve
-        )
-}

prepare-vms/lib/infra/openstack.sh

@@ -0,0 +1,20 @@
+infra_start() {
+	COUNT=$1
+
+	cp terraform/*.tf tags/$TAG
+	(
+		cd tags/$TAG
+		terraform init
+		echo prefix = \"$TAG\" >> terraform.tfvars
+		echo count = \"$COUNT\" >> terraform.tfvars
+		terraform apply -auto-approve
+		terraform output ip_addresses > ips.txt
+	)
+}
+
+infra_stop() {
+	(
+		cd tags/$TAG
+		terraform destroy -auto-approve
+	)
+}

prepare-vms/lib/infra/scaleway.sh

@@ -1,51 +0,0 @@
-if ! command -v scw >/dev/null; then
-  warning "Scaleway CLI (scw) not found."
-fi
-if ! [ -f ~/.config/scw/config.yaml ]; then
-  warning "~/.config/scw/config.yaml not found."
-fi
-
-SCW_INSTANCE_TYPE=${SCW_INSTANCE_TYPE-DEV1-M}
-SCW_ZONE=${SCW_ZONE-fr-par-1}
-
-infra_list() {
-    scw instance server list -o json |
-        jq -r '.[] | [.id, .name, .state, .commercial_type] | @tsv'
-}
-
-infra_start() {
-    COUNT=$1
-
-    for I in $(seq 1 $COUNT); do
-        NAME=$(printf "%s-%03d" $TAG $I)
-        sep "Starting instance $I/$COUNT"
-        info "          Zone: $SCW_ZONE"
-        info "          Name: $NAME"
-        info " Instance type: $SCW_INSTANCE_TYPE"
-        scw instance server create \
-            type=${SCW_INSTANCE_TYPE} zone=${SCW_ZONE} \
-            image=ubuntu_bionic name=${NAME}
-    done
-    sep
-
-    scw_get_ips_by_tag $TAG > tags/$TAG/ips.txt
-}
-
-infra_stop() {
-    info "Counting instances..."
-    scw_get_ids_by_tag $TAG | wc -l
-    info "Deleting instances..."
-    scw_get_ids_by_tag $TAG | 
-        xargs -n1 -P10 \
-        scw instance server delete zone=${SCW_ZONE} force-shutdown=true with-ip=true
-}
-
-scw_get_ids_by_tag() {
-    TAG=$1
-    scw instance server list zone=${SCW_ZONE} name=$TAG -o json | jq -r .[].id
-}
-
-scw_get_ips_by_tag() {
-    TAG=$1
-    scw instance server list zone=${SCW_ZONE} name=$TAG -o json | jq -r .[].public_ip.address
-}

prepare-vms/lib/infra/unimplemented.sh

@@ -1,23 +0,0 @@
-infra_disableaddrchecks() {
-    die "unimplemented"
-}
-
-infra_list() {
-    die "unimplemented"
-}
-
-infra_opensg() {
-    die "unimplemented"
-}
-
-infra_quotas() {
-    die "unimplemented"
-}
-
-infra_start() {
-    die "unimplemented"
-}
-
-infra_stop() {
-    die "unimplemented"
-}

prepare-vms/lib/ips-txt-to-html.py

@@ -42,15 +42,13 @@ print("Generated ips.html")
 
 try:
     import pdfkit
-    paper_size = context["paper_size"]
-    margin = {"A4": "0.5cm", "Letter": "0.2in"}[paper_size]
     with open("ips.html") as f:
         pdfkit.from_file(f, "ips.pdf", options={
-            "page-size": paper_size,
-            "margin-top": margin,
-            "margin-bottom": margin,
-            "margin-left": margin,
-            "margin-right": margin,
+            "page-size": context["paper_size"],
+            "margin-top": context["paper_margin"],
+            "margin-bottom": context["paper_margin"],
+            "margin-left": context["paper_margin"],
+            "margin-right": context["paper_margin"],
             })
     print("Generated ips.pdf")
 except ImportError:

prepare-vms/lib/postprep.py

@@ -37,7 +37,7 @@ def system(cmd):
         td = str(t2-t1)[:5]
         f.write(bold("[{}] in {}s\n".format(retcode, td)))
         STEP += 1
-    with open(os.environ["HOME"] + "/.bash_history", "a") as f:
+    with open("/home/ubuntu/.bash_history", "a") as f:
         f.write("{}\n".format(cmd))
     if retcode != 0:
         msg = "The following command failed with exit code {}:\n".format(retcode)
@@ -65,15 +65,6 @@ system("""sudo -u docker tee -a /home/docker/.bashrc <<SQRL
 export PS1='\e[1m\e[31m[{}] \e[32m(\\$(docker-prompt)) \e[34m\u@\h\e[35m \w\e[0m\n$ '
 SQRL""".format(ipv4))
 
-# Bigger history, in a different file, and saved before executing each command
-system("""sudo -u docker tee -a /home/docker/.bashrc <<SQRL
-export HISTSIZE=9999
-export HISTFILESIZE=9999
-shopt -s histappend
-trap 'history -a' DEBUG
-export HISTFILE=~/.history
-SQRL""")
-
 # Custom .vimrc
 system("""sudo -u docker tee /home/docker/.vimrc <<SQRL
 syntax on
@@ -114,7 +105,7 @@ system("sudo sed -i 's/PasswordAuthentication no/PasswordAuthentication yes/' /e
 
 system("sudo service ssh restart")
 system("sudo apt-get -q update")
-system("sudo apt-get -qy install git jid jq")
+system("sudo apt-get -qy install git jq")
 system("sudo apt-get -qy install emacs-nox joe")
 
 #######################

prepare-vms/lib/pssh.sh

@@ -18,13 +18,7 @@ pssh() {
     echo "[parallel-ssh] $@"
     export PSSH=$(which pssh || which parallel-ssh)
 
-    case "$INFRACLASS" in
-        hetzner) LOGIN=root ;;
-        linode)  LOGIN=root ;;
-        *)       LOGIN=ubuntu ;;
-    esac
-
-    $PSSH -h $HOSTFILE -l $LOGIN \
+    $PSSH -h $HOSTFILE -l ubuntu \
         --par 100 \
         -O LogLevel=ERROR \
         -O UserKnownHostsFile=/dev/null \

prepare-vms/lib/tailhist.html

@@ -1,42 +0,0 @@
-<!DOCTYPE html>
-<html>
-  <head>
-    <title>bash history</title>
-    <style>
-      #log {
-        font: bold 24px courier;
-      }
-
-      #log div:last-child {
-        background: yellow;
-      }
-    </style>
-  </head>
-  <body>
-
-    <div id="log"></div>
-
-    <script>
-      var ws = new WebSocket('ws://' + (location.host ? location.host : "localhost:8080") + "/");
-      var log = document.getElementById('log');
-      var echo = function(text) {
-        var line = document.createElement('div');
-        line.textContent = text;
-        log.appendChild(line);
-        line.scrollIntoView();
-      }
-      ws.onopen = function() {
-        document.body.style.backgroundColor = '#cfc';
-      };
-      ws.onclose = function() {
-        document.body.style.backgroundColor = '#fcc';
-        echo("Disconnected from server. Try to reload this page?");
-      };
-      ws.onmessage = function(event) {
-        echo(event.data);
-      };
-    </script>
-
-  </body>
-</html>
-

prepare-vms/map-dns.py

@@ -1,71 +0,0 @@
-#!/usr/bin/env python
-"""
-There are two ways to use this script:
-
-1. Pass a file name and a tag name as a single argument.
-It will load a list of domains from the given file (one per line),
-and assign them to the clusters corresponding to that tag.
-There should be more domains than clusters.
-Example: ./map-dns.py domains.txt 2020-08-15-jp
-
-2. Pass a domain as the 1st argument, and IP addresses then.
-It will configure the domain with the listed IP addresses.
-Example: ./map-dns.py open-duck.site 1.2.3.4 2.3.4.5 3.4.5.6
-
-In both cases, the domains should be configured to use GANDI LiveDNS.
-"""
-import os
-import requests
-import sys
-import yaml
-
-# This can be tweaked if necessary.
-config_file = os.path.join(
-  os.environ["HOME"], ".config/gandi/config.yaml")
-apiurl = "https://dns.api.gandi.net/api/v5/domains"
-apikey = yaml.safe_load(open(config_file))["apirest"]["key"]
-
-# Figure out if we're called for a bunch of domains, or just one.
-domain_or_domain_file = sys.argv[1]
-if os.path.isfile(domain_or_domain_file):
-  domains = open(domain_or_domain_file).read().split()
-  domains = [ d for d in domains if not d.startswith('#') ]
-  tag = sys.argv[2]
-  ips = open(f"tags/{tag}/ips.txt").read().split()
-  settings_file = f"tags/{tag}/settings.yaml"
-  clustersize = yaml.safe_load(open(settings_file))["clustersize"]
-else:
-  domains = [domain_or_domain_file]
-  ips = sys.argv[2:]
-  clustersize = len(ips)
-
-# Now, do the work.
-while domains and ips:
-  domain = domains[0]
-  domains = domains[1:]
-  cluster = ips[:clustersize]
-  ips = ips[clustersize:]
-  print(f"{domain} => {cluster}")
-  zone = ""
-  node = 0
-  for ip in cluster:
-    node += 1
-    zone += f"@ 300 IN A {ip}\n"
-    zone += f"* 300 IN A {ip}\n"
-    zone += f"node{node} 300 IN A {ip}\n"
-  r = requests.put(
-    f"{apiurl}/{domain}/records",
-    headers={"x-api-key": apikey},
-    data=zone)
-  print(r.text)
-
-  #r = requests.get(
-  #  f"{apiurl}/{domain}/records",
-  #  headers={"x-api-key": apikey},
-  #  )
-
-if domains:
-  print(f"Good, we have {len(domains)} domains left.")
-
-if ips:
-  print(f"Crap, we have {len(ips)} IP addresses left.")

prepare-vms/settings/admin-dmuc.yaml

@@ -10,6 +10,13 @@ cards_template: cards.html
 # Use "Letter" in the US, and "A4" everywhere else
 paper_size: A4
 
+# Feel free to reduce this if your printer can handle it
+paper_margin: 0.2in
+
+# Note: paper_size and paper_margin only apply to PDF generated with pdfkit.
+# If you print (or generate a PDF) using ips.html, they will be ignored.
+# (The equivalent parameters must be set from the browser's print dialog.)
+
 # This can be "test" or "stable"
 engine_version: stable
 

prepare-vms/settings/admin-kubenet.yaml

@@ -10,6 +10,13 @@ cards_template: cards.html
 # Use "Letter" in the US, and "A4" everywhere else
 paper_size: A4
 
+# Feel free to reduce this if your printer can handle it
+paper_margin: 0.2in
+
+# Note: paper_size and paper_margin only apply to PDF generated with pdfkit.
+# If you print (or generate a PDF) using ips.html, they will be ignored.
+# (The equivalent parameters must be set from the browser's print dialog.)
+
 # This can be "test" or "stable"
 engine_version: stable
 

prepare-vms/settings/admin-kuberouter.yaml

@@ -10,6 +10,13 @@ cards_template: cards.html
 # Use "Letter" in the US, and "A4" everywhere else
 paper_size: A4
 
+# Feel free to reduce this if your printer can handle it
+paper_margin: 0.2in
+
+# Note: paper_size and paper_margin only apply to PDF generated with pdfkit.
+# If you print (or generate a PDF) using ips.html, they will be ignored.
+# (The equivalent parameters must be set from the browser's print dialog.)
+
 # This can be "test" or "stable"
 engine_version: stable
 

prepare-vms/settings/admin-test.yaml

@@ -10,6 +10,13 @@ cards_template: cards.html
 # Use "Letter" in the US, and "A4" everywhere else
 paper_size: A4
 
+# Feel free to reduce this if your printer can handle it
+paper_margin: 0.2in
+
+# Note: paper_size and paper_margin only apply to PDF generated with pdfkit.
+# If you print (or generate a PDF) using ips.html, they will be ignored.
+# (The equivalent parameters must be set from the browser's print dialog.)
+
 # This can be "test" or "stable"
 engine_version: stable
 

prepare-vms/settings/example.yaml

@@ -12,6 +12,13 @@ cards_template: cards.html
 # Use "Letter" in the US, and "A4" everywhere else
 paper_size: Letter
 
+# Feel free to reduce this if your printer can handle it
+paper_margin: 0.2in
+
+# Note: paper_size and paper_margin only apply to PDF generated with pdfkit.
+# If you print (or generate a PDF) using ips.html, they will be ignored.
+# (The equivalent parameters must be set from the browser's print dialog.)
+
 # This can be "test" or "stable"
 engine_version: test
 

prepare-vms/settings/fundamentals.yaml

@@ -12,18 +12,19 @@ cards_template: cards.html
 # Use "Letter" in the US, and "A4" everywhere else
 paper_size: Letter
 
+# Feel free to reduce this if your printer can handle it
+paper_margin: 0.2in
+
+# Note: paper_size and paper_margin only apply to PDF generated with pdfkit.
+# If you print (or generate a PDF) using ips.html, they will be ignored.
+# (The equivalent parameters must be set from the browser's print dialog.)
+
 # This can be "test" or "stable"
 engine_version: stable
 
 # These correspond to the version numbers visible on their respective GitHub release pages
-compose_version: 1.25.4
+compose_version: 1.24.1
 machine_version: 0.15.0
 
 # Password used to connect with the "docker user"
 docker_user_password: training
-
-steps:
-  - deploy
-  - webssh
-  - tailhist
-  - cards

prepare-vms/settings/jerome.yaml

@@ -10,21 +10,19 @@ cards_template: cards.html
 # Use "Letter" in the US, and "A4" everywhere else
 paper_size: Letter
 
+# Feel free to reduce this if your printer can handle it
+paper_margin: 0.2in
+
+# Note: paper_size and paper_margin only apply to PDF generated with pdfkit.
+# If you print (or generate a PDF) using ips.html, they will be ignored.
+# (The equivalent parameters must be set from the browser's print dialog.)
+
 # This can be "test" or "stable"
 engine_version: stable
 
 # These correspond to the version numbers visible on their respective GitHub release pages
-compose_version: 1.25.4
+compose_version: 1.24.1
 machine_version: 0.14.0
 
 # Password used to connect with the "docker user"
 docker_user_password: training
-
-steps:
-  - deploy
-  - webssh
-  - tailhist
-  - kube
-  - kubetools
-  - cards
-  - kubetest

prepare-vms/settings/kube101.yaml

@@ -0,0 +1,31 @@
+# 3 nodes for k8s 101 workshops
+
+# Number of VMs per cluster
+clustersize: 3
+
+# The hostname of each node will be clusterprefix + a number
+clusterprefix: node
+
+# Jinja2 template to use to generate ready-to-cut cards
+cards_template: cards.html
+
+# Use "Letter" in the US, and "A4" everywhere else
+paper_size: Letter
+
+# Feel free to reduce this if your printer can handle it
+paper_margin: 0.2in
+
+# Note: paper_size and paper_margin only apply to PDF generated with pdfkit.
+# If you print (or generate a PDF) using ips.html, they will be ignored.
+# (The equivalent parameters must be set from the browser's print dialog.)
+
+# This can be "test" or "stable"
+engine_version: stable
+
+# These correspond to the version numbers visible on their respective GitHub release pages
+compose_version: 1.24.1
+machine_version: 0.14.0
+
+# Password used to connect with the "docker user"
+docker_user_password: training
+

prepare-vms/settings/swarm.yaml

@@ -12,6 +12,13 @@ cards_template: cards.html
 # Use "Letter" in the US, and "A4" everywhere else
 paper_size: Letter
 
+# Feel free to reduce this if your printer can handle it
+paper_margin: 0.2in
+
+# Note: paper_size and paper_margin only apply to PDF generated with pdfkit.
+# If you print (or generate a PDF) using ips.html, they will be ignored.
+# (The equivalent parameters must be set from the browser's print dialog.)
+
 # This can be "test" or "stable"
 engine_version: stable
 

prepare-vms/setup-admin-clusters.sh

@@ -1,24 +1,9 @@
 #!/bin/sh
 set -e
 
-retry () {
-	N=$1
-	I=0
-	shift
-
-	while ! "$@"; do
-		I=$(($I+1))
-		if [ $I -gt $N ]; then
-			echo "FAILED, ABORTING"
-			exit 1
-		fi
-		echo "FAILED, RETRYING ($I/$N)"
-	done
-}
-
 export AWS_INSTANCE_TYPE=t3a.small
 
-INFRA=infra/aws-eu-west-3
+INFRA=infra/aws-us-west-2
 
 STUDENTS=2
 
@@ -30,13 +15,11 @@ TAG=$PREFIX-$SETTINGS
 	--tag $TAG \
 	--infra $INFRA \
 	--settings settings/$SETTINGS.yaml \
-	--students $STUDENTS
+	--count $STUDENTS
 
-retry 5 ./workshopctl deploy $TAG
-retry 5 ./workshopctl disabledocker $TAG
-retry 5 ./workshopctl kubebins $TAG
-retry 5 ./workshopctl webssh $TAG
-retry 5 ./workshopctl tailhist $TAG
+./workshopctl deploy $TAG
+./workshopctl disabledocker $TAG
+./workshopctl kubebins $TAG
 ./workshopctl cards $TAG
 
 SETTINGS=admin-kubenet
@@ -45,13 +28,11 @@ TAG=$PREFIX-$SETTINGS
 	--tag $TAG \
 	--infra $INFRA \
 	--settings settings/$SETTINGS.yaml \
-	--students $STUDENTS
+	--count $((3*$STUDENTS))
 
-retry 5 ./workshopctl disableaddrchecks $TAG
-retry 5 ./workshopctl deploy $TAG
-retry 5 ./workshopctl kubebins $TAG
-retry 5 ./workshopctl webssh $TAG
-retry 5 ./workshopctl tailhist $TAG
+./workshopctl disableaddrchecks $TAG
+./workshopctl deploy $TAG
+./workshopctl kubebins $TAG
 ./workshopctl cards $TAG
 
 SETTINGS=admin-kuberouter
@@ -60,13 +41,11 @@ TAG=$PREFIX-$SETTINGS
 	--tag $TAG \
 	--infra $INFRA \
 	--settings settings/$SETTINGS.yaml \
-	--students $STUDENTS
+	--count $((3*$STUDENTS))
 
-retry 5 ./workshopctl disableaddrchecks $TAG
-retry 5 ./workshopctl deploy $TAG
-retry 5 ./workshopctl kubebins $TAG
-retry 5 ./workshopctl webssh $TAG
-retry 5 ./workshopctl tailhist $TAG
+./workshopctl disableaddrchecks $TAG
+./workshopctl deploy $TAG
+./workshopctl kubebins $TAG
 ./workshopctl cards $TAG
 
 #INFRA=infra/aws-us-west-1
@@ -79,9 +58,9 @@ TAG=$PREFIX-$SETTINGS
 	--tag $TAG \
 	--infra $INFRA \
 	--settings settings/$SETTINGS.yaml \
-	--students $STUDENTS
+	--count $((3*$STUDENTS))
+
+./workshopctl deploy $TAG
+./workshopctl kube $TAG 1.14.6
+./workshopctl cards $TAG
 
-retry 5 ./workshopctl deploy $TAG
-retry 5 ./workshopctl kube $TAG 1.19.11
-retry 5 ./workshopctl webssh $TAG
-retry 5 ./workshopctl tailhist $TAG

prepare-vms/templates/cards.html

@@ -18,14 +18,8 @@
     | default("kube") -%}
 {%- set clusternumber = clusternumber
     | default(None) -%}
-{%- if qrcode == True -%}
-    {%- set qrcode = "https://container.training/q" -%}
-{%- elif qrcode -%}
-    {%- set qrcode = qrcode -%}
-{%- endif -%}
 
-{# You can also set img_bottom_src instead. #}
-{%- set img_logo_src = {
+{%- set image_src = {
 	"docker": "https://s3-us-west-2.amazonaws.com/www.breadware.com/integrations/docker.png",
 	"swarm": "https://cdn.wp.nginx.com/wp-content/uploads/2016/07/docker-swarm-hero2.png",
 	"kube": "https://avatars1.githubusercontent.com/u/13629408",
@@ -91,33 +85,9 @@
 {%- endif -%}
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
 <html>
-<head>
-<style>
+<head><style>
 @import url('https://fonts.googleapis.com/css?family=Slabo+27px');
 
-{% if paper_size == "A4" %}
-@page {
-    size: A4; /* Change from the default size of A4 */
-    margin: 0.5cm; /* Set margin on each page */
-}
-body {
-    /* this is A4 minus 0.5cm margins */
-	width: 20cm;
-	height: 28.7cm;
-}
-{% elif paper_size == "Letter" %}
-@page {
-	size: Letter;
-	margin: 0.2in;
-}
-body {
-	/* this is Letter minus 0.2in margins */
-	width: 8.6in;
-	heigth: 10.6in;
-}
-{% endif %}
-
-
 body, table {
     margin: 0;
     padding: 0;
@@ -138,45 +108,53 @@ div {
     float: left;
     border: 1px dotted black;
     {% if backside %}
-    height: 33%;
+    height: 31%;
     {% endif %}
+    padding-top: 1%;
+    padding-bottom: 1%;
     /* columns * (width+left+right) < 100% */
     /*
-    width: 24.8%;
+    width: 21.5%;
+    padding-left: 1.5%;
+    padding-right: 1.5%;
     */
     /**/
-    width: 33%;
+    width: 30%;
+    padding-left: 1.5%;
+    padding-right: 1.5%;
     /**/    
 }
 
 p {
-    margin: 0.8em;
+    margin: 0.4em 0 0.4em 0;
 }
 
 div.back {
-	border: 1px dotted grey;
+	border: 1px dotted white;
 }
 
-span.scale {
-	white-space: nowrap;
+div.back p {
+    margin: 0.5em 1em 0 1em;
 }
 
-img.logo {
-    height: 4.5em;
+img {
+    height: 4em;
     float: right;
- }
-
-img.bottom {
-    height: 2.5em;
-    display: block;
-    margin: 0.5em auto;
+    margin-right: -0.2em;
 }
 
-.qrcode img {
-    width: 40%;
-    margin: 1em;
+/*
+img.enix {
+    height: 4.0em;
+    margin-top: 0.4em;
 }
 
+img.kube {
+    height: 4.2em;
+    margin-top: 1.7em;
+}
+*/
+
 .logpass {
     font-family: monospace;
     font-weight: bold;
@@ -186,43 +164,16 @@ img.bottom {
     page-break-after: always;
     clear: both;
     display: block;
-    height: 0;
+    height: 8px;
 }
-</style>
-<script type="text/javascript" src="https://cdn.rawgit.com/davidshimjs/qrcodejs/gh-pages/qrcode.min.js"></script>
-<script type="text/javascript">
-function qrcodes() {
-	[].forEach.call(
-		document.getElementsByClassName("qrcode"),
-		(e, index) => {
-			new QRCode(e, {
-				text: "{{ qrcode }}",
-				correctLevel: QRCode.CorrectLevel.L
-			});
-		}
-	);
-}
-
-function scale() {
-	[].forEach.call(
-		document.getElementsByClassName("scale"),
-		(e, index) => {
-			var text_width = e.getBoundingClientRect().width;
-			var box_width = e.parentElement.getBoundingClientRect().width;
-			var percent = 100 * box_width / text_width + "%";
-			e.style.fontSize = percent;
-		}
-	);
-}
-</script>
-</head>
-<body onload="qrcodes(); scale();">
+</style></head>
+<body>
 {% for cluster in clusters %}
     <div>
         <p>{{ intro }}</p>
         <p>
-            {% if img_logo_src %}
-            <img class="logo" src="{{ img_logo_src }}" />
+            {% if image_src %}
+            <img src="{{ image_src }}" />
             {% endif %}
             <table>
             	{% if clusternumber != None %}
@@ -251,12 +202,7 @@ function scale() {
         <p>
             {% if url %}
         	{{ slides_are_at }}
-            <p>
-                <span class="scale">{{ url }}</span>
-            </p>
-            {% endif %}
-            {% if img_bottom_src %}
-            <img class="bottom" src="{{ img_bottom_src }}" />
+            <center>{{ url }}</center>
             {% endif %}
         </p>
     </div>
@@ -265,21 +211,18 @@ function scale() {
         {% if backside %}
 			{% for x in range(pagesize) %}
 		        <div class="back">
-				<p>Thanks for attending
+		        <br/>
+				<p>You got this at the workshop
 				"Getting Started With Kubernetes and Container Orchestration"
-				during CONFERENCE in Month YYYY!</p>
+				during QCON London (March 2019).</p>
 				<p>If you liked that workshop,
-				I can train your team, in person or
-				online, with custom courses of
-				any length and any level.
+				I can train your team or organization
+				on Docker, container, and Kubernetes,
+				with curriculums of 1 to 5 days.
 				</p>
-	            {% if qrcode %}
-	            <p>If you're interested, please scan that QR code to contact me:</p>
-				<span class="qrcode"></span>
-                {% else %}
-				<p>If you're interested, you can contact me at:</p>
-				{% endif %}
+				<p>Interested? Contact me at:</p>
 				<p>jerome.petazzoni@gmail.com</p>
+				<p>Thank you!</p>
 		        </div>
 			{% endfor %}
 		<span class="pagebreak"></span>

prepare-vms/terraform/machines.tf

@@ -1,7 +1,7 @@
 resource "openstack_compute_instance_v2" "machine" {
   count           = "${var.count}" 
   name            = "${format("%s-%04d", "${var.prefix}", count.index+1)}"
-  image_name      = "Ubuntu 18.04.4 20200324"
+  image_name      = "Ubuntu 16.04.5 (Xenial Xerus)"
   flavor_name     = "${var.flavor}"
   security_groups = ["${openstack_networking_secgroup_v2.full_access.name}"]
   key_pair        = "${openstack_compute_keypair_v2.ssh_deploy_key.name}"

prepare-vms/workshopctl

@@ -15,9 +15,9 @@ for lib in lib/*.sh; do
 done
 
 DEPENDENCIES="
+    aws
     ssh
     curl
-    fping
     jq
     pssh
     wkhtmltopdf

slides/_redirects

@@ -1,7 +1,6 @@
 # Uncomment and/or edit one of the the following lines if necessary.
-#/ /kube-halfday.yml.html 200!
-#/ /kube-fullday.yml.html 200!
-#/ /kube-twodays.yml.html 200!
+#/ /kube-halfday.yml.html 200
+#/ /kube-fullday.yml.html 200
 / /kube.yml.html 200!
 
 # And this allows to do "git clone https://container.training".
@@ -9,16 +8,3 @@
 
 /dockermastery https://www.udemy.com/course/docker-mastery/?referralCode=1410924A733D33635CCB
 /kubernetesmastery https://www.udemy.com/course/kubernetesmastery/?referralCode=7E09090AF9B79E6C283F
-#/dockermastery https://www.udemy.com/course/docker-mastery/?couponCode=DOCKERALLDAY
-#/kubernetesmastery https://www.udemy.com/course/kubernetesmastery/?couponCode=DOCKERALLDAY
-
-# Shortlink for the QRCode
-/q /qrcode.html 200
-
-# Shortlinks for next training in English and French
-#/next https://www.eventbrite.com/e/livestream-intensive-kubernetes-bootcamp-tickets-103262336428
-/next https://skillsmatter.com/courses/700-advanced-kubernetes-concepts-workshop-jerome-petazzoni
-/hi5 https://enix.io/fr/services/formation/online/
-
-# Survey form
-/please https://docs.google.com/forms/d/e/1FAIpQLSfIYSgrV7tpfBNm1hOaprjnBHgWKn5n-k5vtNXYJkOX1sRxng/viewform

slides/autopilot/autotest.py

@@ -233,7 +233,7 @@ def setup_tmux_and_ssh():
         ipaddr = "$IPADDR"
         uid = os.getuid()
 
-        raise Exception(r"""
+        raise Exception("""
 1. If you're running this directly from a node:
 
 tmux
@@ -247,16 +247,6 @@ rm -f /tmp/tmux-{uid}/default && ssh -t -L /tmp/tmux-{uid}/default:/tmp/tmux-100
 3. If you cannot control a remote tmux:
 
 tmux new-session ssh docker@{ipaddr}
-
-4. If you are running this locally with a remote cluster, make sure your prompt has the expected format:
-
-tmux
-IPADDR=$(
-  kubectl get nodes -o json |
-  jq -r '.items[0].status.addresses[] | select(.type=="ExternalIP") | .address'
-  )
-export PS1="\n[{ipaddr}] \u@\h:\w\n\$ "
-
 """.format(uid=uid, ipaddr=ipaddr))
     else:
         logging.info("Found tmux session. Trying to acquire shell prompt.")

slides/autopilot/package.json

@@ -3,6 +3,6 @@
   "version": "0.0.1",
   "dependencies": {
     "express": "^4.16.2",
-    "socket.io": "^2.4.0"
+    "socket.io": "^2.0.4"
   }
 }

slides/containers/Advanced_Dockerfiles.md

@@ -1,7 +1,7 @@
 
 class: title
 
-# Advanced Dockerfile Syntax
+# Advanced Dockerfiles
 
 ![construction](images/title-advanced-dockerfiles.jpg)
 
@@ -12,10 +12,7 @@ class: title
 We have seen simple Dockerfiles to illustrate how Docker build
 container images.
 
-In this section, we will give a recap of the Dockerfile syntax,
-and introduce advanced Dockerfile commands that we might
-come across sometimes; or that we might want to use in some
-specific scenarios.
+In this section, we will see more Dockerfile commands.
 
 ---
 
@@ -423,8 +420,3 @@ ONBUILD COPY . /src
 
 * You can't chain `ONBUILD` instructions with `ONBUILD`.
 * `ONBUILD` can't be used to trigger `FROM` instructions.
-
-???
-
-:EN:- Advanced Dockerfile syntax
-:FR:- Dockerfile niveau expert

slides/containers/Background_Containers.md

@@ -44,64 +44,6 @@ Fri Feb 20 00:28:55 UTC 2015
 
 ---
 
-## When `^C` doesn't work...
-
-Sometimes, `^C` won't be enough.
-
-Why? And how can we stop the container in that case?
-
----
-
-## What happens when we hit `^C`
-
-`SIGINT` gets sent to the container, which means:
-
-- `SIGINT` gets sent to PID 1 (default case)
-
-- `SIGINT` gets sent to *foreground processes* when running with `-ti`
-
-But there is a special case for PID 1: it ignores all signals!
-
-- except `SIGKILL` and `SIGSTOP`
-
-- except signals handled explicitly
-
-TL,DR: there are many circumstances when `^C` won't stop the container.
-
----
-
-class: extra-details
-
-## Why is PID 1 special?
-
-- PID 1 has some extra responsibilities:
-
-  - it starts (directly or indirectly) every other process
-
-  - when a process exits, its processes are "reparented" under PID 1
-
-- When PID 1 exits, everything stops:
-
-  - on a "regular" machine, it causes a kernel panic
-
-  - in a container, it kills all the processes
-
-- We don't want PID 1 to stop accidentally
-
-- That's why it has these extra protections
-
----
-
-## How to stop these containers, then?
-
-- Start another terminal and forget about them
-
-  (for now!)
-
-- We'll shortly learn about `docker kill`
-
----
-
 ## Run a container in the background
 
 Containers can be started in the background, with the `-d` flag (daemon mode):
@@ -338,8 +280,3 @@ CONTAINER ID  IMAGE           ...  CREATED      STATUS
 5c1dfd4d81f1  jpetazzo/clock  ...  40 min. ago  Exited (0) 40 min. ago
 b13c164401fb  ubuntu          ...  55 min. ago  Exited (130) 53 min. ago
 ```
-
-???
-
-:EN:- Foreground and background containers
-:FR:- Exécution interactive ou en arrière-plan

slides/containers/Building_Images_Interactively.md

@@ -131,7 +131,7 @@ root@fcfb62f0bfde:/# figlet hello
 |_| |_|\___|_|_|\___/ 
 ```
 
-It works! 🎉
+It works! .emoji[🎉]
 
 ---
 
@@ -167,8 +167,3 @@ Automated process = good.
 
 In the next chapter, we will learn how to automate the build
 process by writing a `Dockerfile`.
-
-???
-
-:EN:- Building our first images interactively
-:FR:- Fabriquer nos premières images à la main