add more examples

module10/prometheus/readme.MD

@@ -1,10 +1,11 @@
 ### sync VM time with host
 ```
 shutdown vm
-cd VirtualBox\ VMs
+cd ~/"VirtualBox VMs"
 VBoxManage list vms
 "localkube" {014a8874-1cbe-43ec-a47c-ce7248bce13e}
 vboxmanage setextradata "localkube" "VBoxInternal/Devices/VMMDev/0/Config/GetHostTimeDisabled" "1"
+vboxmanage setextradata "crane" "VBoxInternal/Devices/VMMDev/0/Config/GetHostTimeDisabled" "1"
 ```
 ### start VM and then you can get prometheus data
 

module12/istio/1.http-gw/simple.yaml

@@ -0,0 +1,36 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: simple
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: simple
+  template:
+    metadata:
+      annotations:
+        prometheus.io/scrape: "true"
+        prometheus.io/port: "80"
+      labels:
+        app: simple
+    spec:
+      containers:
+        - name: simple
+          imagePullPolicy: Always
+          image: cncamp/httpserver:v1.0-metrics
+          ports:
+            - containerPort: 80
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: simple
+spec:
+  ports:
+    - name: http
+      port: 80
+      protocol: TCP
+      targetPort: 80
+  selector:
+    app: simple

module12/istio/3.https-gw/cncamp.io.crt

@@ -1,18 +1,18 @@
 -----BEGIN CERTIFICATE-----
-MIIC1DCCAbwCCQDNrZW+NEze6DANBgkqhkiG9w0BAQsFADAsMRQwEgYDVQQKDAtj
-bmNhbXAgSW5jLjEUMBIGA1UEAwwLKi5jbmNhbXAuaW8wHhcNMjExMTI4MDkwMjU2
-WhcNMjIxMTI4MDkwMjU2WjAsMRQwEgYDVQQKDAtjbmNhbXAgSW5jLjEUMBIGA1UE
-AwwLKi5jbmNhbXAuaW8wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDA
-jcjW+NqNF3RRvjkw5+aij1e2F//Ay06rOzDdpsloPJ4vTQIZug+0bflmxYEqKkVC
-Mz9+4f/UuYwY6SNa+ajp9/jbO4hMOqsABP7D2IdnXD0E4+eDvYiQddldr51r1UfW
-0hsgsfTkwU6nlQKHSPWXiV4RXONpOSsu6RB2Zf9/0MiQzeHpWJ8NB/osDBBMfm2z
-BTPb4mCWM5lRxI4E3McEs1uQi1knPpMs3nm0dvD14kzG0nSSETyYFQ7Uch5Da0az
-mFWsYigbguxA9ZTgD2CAsP6YT08fiSShMbFHE+vCXnKjBPXtozt/rqu1MSwyZQzb
-PkfvZa6gbk1YGvo1pP0zAgMBAAEwDQYJKoZIhvcNAQELBQADggEBAJbIQOvKQRWK
-PKxd9Vj+vqx3PtpwAzTPy1Q0x10DIO4PnGmGJqesgfXiLHA3Np0Ykp1LCB6D4oqF
-FGScLc4GmC8RbQHxw8RyPHefrNQr4x2ZMu9kBVmnQfGD8AnkbMp7ltfMakg+rcky
-hC6utTMjHjvUMbKAvRzLD1DlGuOT3CjCiW7XhfLNg9qfww4ZSXkTHczOCS/7AXE0
-myoLfvgD8rEiQk/klX+VIfT3HcI1xaJ46YugqHushGARVwf3J0gF/CxfUJG50wIV
-Zg6bUjY7T5Mh70k3kOlby7LHQPEkm16HvXDc9RWVy+TCChFtY07fj+onlkbyZR8C
-LoA815gtTLM=
+MIIC1DCCAbwCCQCPNLGdLUqaJzANBgkqhkiG9w0BAQsFADAsMRQwEgYDVQQKDAtj
+bmNhbXAgSW5jLjEUMBIGA1UEAwwLKi5jbmNhbXAuaW8wHhcNMjExMjE4MTIzNjQz
+WhcNMjIxMjE4MTIzNjQzWjAsMRQwEgYDVQQKDAtjbmNhbXAgSW5jLjEUMBIGA1UE
+AwwLKi5jbmNhbXAuaW8wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDN
+KftOzu8h1UbRw2Rj35BI/DClzdDcOHyhTGBZV/fKf6cISyImR/COehjyCl36vBW/
+VT4esxcwjCLuUYDOVX6ROqkJPBNWkHv3ExU4BqkzTm2sG2aZ4kgnHMjtcS4F/lnD
+NFuuUcwlUOfOcV3KV2z1U1U/0NL4UMyPoBlWkkOq1vNnYn48qeQ1cT6oB722/ill
+Ex/ttCT/m6E5sv6ho36MhVsW2OQskQIjhi7bo6cSARHx1SxQI1Bt+kg5i36FrP62
+sAaiDg588A+5bBNhtIl7/dg0afAqZmcxLuQHZ2RSQj+lGi4qsvRl71hBdDJwSJ7Z
+uPPslBJ1eInzua3xVG3xAgMBAAEwDQYJKoZIhvcNAQELBQADggEBAMVIW9n5htvX
+sFpJUFrDIILvzgoVfsaE71V/Qa1SyjgjNUOgr7TH7vZLSdXMAPXhjKlhByYTXuUG
+6X/54I8f8PdG+5QUkOH8nUC2KuxAsbNY0yxYHQT8G3YBOnJXGSro2/Nmyoww8Bw3
+ETjzlBSxTQez1QzJwqgtv9uUfu92+53cZZ0/mPxnBZJFj8OoA+TAH1nVlELhsA6o
+PmZS/3D97JzharoFa2yznfbUHWsYGmUI+xj4UcG+VuaZg8zwvLXJyFQqnlfJ/GhM
+oTj4bipm7l6XeR283hLGeuyhXrNkM0lU93PuG+4Z6C9bJ3S7xdQNg4pywgdXszyg
++OHht9cP7b8=
 -----END CERTIFICATE-----

module12/istio/3.https-gw/cncamp.io.key

@@ -1,28 +1,28 @@
 -----BEGIN PRIVATE KEY-----
-MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQDAjcjW+NqNF3RR
-vjkw5+aij1e2F//Ay06rOzDdpsloPJ4vTQIZug+0bflmxYEqKkVCMz9+4f/UuYwY
-6SNa+ajp9/jbO4hMOqsABP7D2IdnXD0E4+eDvYiQddldr51r1UfW0hsgsfTkwU6n
-lQKHSPWXiV4RXONpOSsu6RB2Zf9/0MiQzeHpWJ8NB/osDBBMfm2zBTPb4mCWM5lR
-xI4E3McEs1uQi1knPpMs3nm0dvD14kzG0nSSETyYFQ7Uch5Da0azmFWsYigbguxA
-9ZTgD2CAsP6YT08fiSShMbFHE+vCXnKjBPXtozt/rqu1MSwyZQzbPkfvZa6gbk1Y
-Gvo1pP0zAgMBAAECggEAE2Ky46GuLyI7Xbdu/pN6TsdrpzOHVhuh0e9lngsan9nq
-ewyft4NZ7Wpc/5HGzT3wNxf9voJ2RS5hAmkGXDRiYxvJ/BhkQnhtmtTl6UW1bByH
-MCTZvBOq2hBjT+FMUfzo/KGuhX4lD5q+lnSUCpa30wfLZqgZZRCSXmisdZ8TOATa
-FfcsxUPvTaXJxkaVD4tai69r9mR6J9fE+ZuR2VEwKk0hslWeJonueimZEnYBfCmF
-jRmvAR7Gn/n7Mzg8q6yUbesHyWKFWPt2XnFeV7DYxfcHOrUDXkHcbdMfnphRfnoZ
-CifBJZIyH2dMuVf/aZY7pBiZmUSKa383E8ALhvolcQKBgQD3KYjfxunqH8gg3N2p
-wmlxYF7EubcpEY+J/fk0rK76WB0zs7idQsLoFKlmUvootbFxZhT1fRhcQRCML68Q
-kklD4KoMIRpOsU75/SU1cEAO6g7oKNfBXymVNrVBjjnKAd1/BO2bvkhzr6JB1Iak
-OQRORaNmArBxwVxdUpFMFvGkvwKBgQDHcGCa6Q8o9DDlBjleJ1wQJeBqGMMijczs
-RtBp/m8UoOV2Vg9R9qNcGEgx4AKQwsBZX/5xZKzWxBlC41QrGwHhg7kQzYnbm16S
-0kvhX9sYhX3NbL3bEZJwT5OVIscJ+cmuT8NDAkuBXjuWyFl8+J2cvQQedQtilUmN
-0jN+0oLAjQKBgAlkAJlP+28zyezFt35NrqfqG2+qBrV+v09k4OUJcpR8aI+gUnFX
-KgSbVFxY5rxJOvauBDnXiOdoaXKKFUKx7CqyDIPtdgxrXC7PWWyQWT630d0sQBZO
-wUu0Cmr1NmjgbUP4Mfbq4eHTWHzb0EnJCMrYhn7Ht2B7EkFRc8fKT2ANAoGBAKlQ
-mFMrRPmJxfDJRe7PD3OOFGU+PHubUrvMqqcxoHAs4GGEUmFNOAa5fqEJAmSPUekO
-e98cjzeNJ70Hba9isEgaIgVH2Z+c2b9f1ZeyXzkEK3c4uD3BP0cl568W5U9sxnG7
-uZOr4RolPAWYdZCJKJWmSlbpGw9ImjdSmvEyGlsJAoGAdL1jorqfohKRFlc5L9Hz
-4rKX58OiJbCuEYSL4v7W7SFlYCU1+wiv45y9YnLBVqUQKzIlfd28YhlW37NiehbX
-rN9il/5Dt9RUZDyc5wgYH/xDHO1z2anTomNUAVrGzB89z6dfyQrDBybR2tAvspdH
-frS5y+yhaUCMKFPSjpP6MZE=
+MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQDNKftOzu8h1UbR
+w2Rj35BI/DClzdDcOHyhTGBZV/fKf6cISyImR/COehjyCl36vBW/VT4esxcwjCLu
+UYDOVX6ROqkJPBNWkHv3ExU4BqkzTm2sG2aZ4kgnHMjtcS4F/lnDNFuuUcwlUOfO
+cV3KV2z1U1U/0NL4UMyPoBlWkkOq1vNnYn48qeQ1cT6oB722/illEx/ttCT/m6E5
+sv6ho36MhVsW2OQskQIjhi7bo6cSARHx1SxQI1Bt+kg5i36FrP62sAaiDg588A+5
+bBNhtIl7/dg0afAqZmcxLuQHZ2RSQj+lGi4qsvRl71hBdDJwSJ7ZuPPslBJ1eInz
+ua3xVG3xAgMBAAECggEBAK4zPTzXG9hgXPdyrmTWyI4QA8ZkkTjLhZb3YL+7n5wC
+83JpSR+z6Z8wMMoi31UsKlMBL/OlIMWJ14b/ER0hHox1gF1k8w6HM5rASz38+eGk
+cB64TU/QAG+lUz244dkY9GJ4rHfA4FO29HwnafmKbeuHzFSZHOjWwjoZOCp3mpkM
+z1N0pun5nKUEUy19E4LjE3QU7AFNx8oFlkE9k0pL6t6VZolVhJBPpxGapwj5K0Uu
+HZjJjSrZok8qCFJfMauOA6avIIAdxvFrZpHVJflMg0Nu+pEVsYfVzPjOzSMmdHgf
+eVSvDf+nxAvb09Oa10iKH/UCGjzTVfH6UjdAyoskxDkCgYEA+44hxd/P/Wo2mGiT
+ilELJEOfVHlZIBrGvrrOHPZc1LB0hLxTK9VzN7VYRu+ZSdS5V5ahPkfa4/fgNBfz
+zXoioA6Li3bcRCOFlDyAqhBaEXk+YWHH0poeqmSnV6XlRqDOKCSjsHojYfasBGju
+g1N2Gh7JusY5ttLjufv7Bt2BRpcCgYEA0MoBvyZxcIMIjuMoRPQ2eJ3W1Yms4CVa
+HT/lPOguZSKI/1vywK1doVnrgikUQRLNSVFMGeHwRcbNbWNyTGafc/Q2hNVR8XBc
+mRwNcmWqwRqYiN2eOtWOyxN9IhA1vXUAxyYIkDCOq/NmQYwtoqhB4Esmp1ZDv1vh
+IkqO+VEDyLcCgYB3u+1DXAaJ3nZiENS5L14YQr+h26iaaWRUAGJ+0pzY96xeSa1k
+3dJbn8uG6CCUTdZyZFYXaOg9PgzPft8i3JGCkanGFis9m5LHPg0X5XSZgJY6j+om
+ygjynboxM9tvxLab0OTA6UHSLTEvYCq3A5DhWeo3JobuCG8wZUnUuLYBvQKBgGhG
+a2bnMUKq/qw2QRdnDIli8zfEwcVUglQXZErt/rXd8KPwbSXTr+50tU1VbNsvI73Z
+T3Ohxtlid5iJUT1dB4fm0Q+4Zmt53ZVOUFzw773vpXy9ilgB7oX33sgTZnOPqurL
+UP2KcsboEgrskqIo/HWjstNiHwXEQoVYzV0xG/2zAoGAI50SRG1Gxv0HqVJJ+DHR
+OI0gBiGVNqo31f+IvQSB4xhX0wzBjV56ov4eNByq/eWVbkOA5kjo3zUyZ9zu9ZFi
+A8VTczIQyd1vmTzApsbxI5UVRzwc49vSzQWi7NcoO7YlSrzr6hU/zqtWTnNAyupz
+lyKjB5MXvtypRS46hxPCRXU=
 -----END PRIVATE KEY-----

module12/istio/tracing/readme.MD

@@ -6,7 +6,7 @@ set tracing.sampling=100
 ```
 ### deploy tracing
 ```
-kubectl apply ns tracing
+kubectl create ns tracing
 kubectl label ns tracing istio-injection=enabled
 kubectl -n tracing apply -f service0.yaml
 kubectl -n tracing apply -f service1.yaml

module13/federation/readme.MD

@@ -1,3 +1,4 @@
+## install kubefed by kind
 ### 下载federation代码
 ```
 git clone https://github.com/kubernetes-sigs/kubefed.git
@@ -18,14 +19,18 @@ current-context: `cluster1`
 ```
 kind create cluster
 make deploy.kind
-kubectl -n kube-federation-system get kubefedcluster
+kubectl -n kube-federation-system get kubefedcluster -oyaml
 ```
 ### fix
 ```
-k get po -n kube-system kube-apiserver-kind-control-plane 
+k get po -n kube-system kube-apiserver-kind-control-plane -owide
 kube-system              kube-apiserver-kind-control-plane             1/1     Running   0          24m     172.18.0.2    kind-control-plane   <none>           <none>
 172.18.0.2
 ```
+#### edit kubefedcluster and change apiEndpoint to 172.18.0.2:6443
+```
+kubectl -n kube-federation-system edit kubefedcluster
+```
 ### 安装完成后查看federation
 ```
 kubectl get all -n kube-federation-system

module15/2.security-hardening/bookinfo.crt

@@ -0,0 +1,18 @@
+-----BEGIN CERTIFICATE-----
+MIIC1jCCAb4CCQCH8EwL/M05iTANBgkqhkiG9w0BAQsFADAtMRQwEgYDVQQKDAtj
+bmNhbXAgSW5jLjEVMBMGA1UEAwwMMTkyLjE2OC4zNC4yMB4XDTIxMTIxOTExNDI1
+NloXDTIyMTIxOTExNDI1NlowLTEUMBIGA1UECgwLY25jYW1wIEluYy4xFTATBgNV
+BAMMDDE5Mi4xNjguMzQuMjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB
+APUMvc+6ITQ6ET5nMRzoxROqFFQMCqUkNjZATSMsCxI0Kfv3biXkACU4SXGMONQ3
+AOewCHOQEPTIsF1Jh8AjHyAeIRH4YM6YL1hKuFwqKKwa/lDqw4ovAhGjweQapuxx
+0hkAPqhypvEhfaiA6awJg8hK/UPYhKJSwu0fsUJy9fZRDX1Qyy22lqbARTStTjt1
+Elef6UTURlXAYhQMJA7ZBqcdH6epceiFr9rKieFb2I09/niZ89WiJ7Kt0O52pJNl
+zNz2KHnraNIXNjSTxrKkyY1BGyQsXXNW03erCKRv4iJBSUMcgRInT5TiWEOPdtyS
+3gFloM/qNPqyezwMX99wWF8CAwEAATANBgkqhkiG9w0BAQsFAAOCAQEA3xqOmtTv
+D+hFuDW+w9Ajg1jfMto4e0vRV71aCLXnHJ0YnRmwagfj3Iejjzq4Bd/SpgFMol2D
+DDZGT8UcJyYZp1IEdyspf8l10JUyAuqi/nZyGy/1kcdPCJtyIqwkh56vSD+/3Pc2
+WPx/+IoQuZogJaCo/ZaP/cm6703ZM+btgnjA4kE/h61n68hKMvfMX9hUf1l/wLBT
+3iTOedBQ0ogbXf+tTDq9q80m33S7gC13MwFHE8YY7tK9ibOwagcgTNLwGbBM7+zB
+2V9aKVoSc8MSLdMtlUyjimq50i7BeQzfmXrTXZ5pK94sgp+b9iuvreMWTpZRjlpt
+dBdZ7TX3WLnA4Q==
+-----END CERTIFICATE-----

module15/2.security-hardening/bookinfo.key

@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQD1DL3PuiE0OhE+
+ZzEc6MUTqhRUDAqlJDY2QE0jLAsSNCn7924l5AAlOElxjDjUNwDnsAhzkBD0yLBd
+SYfAIx8gHiER+GDOmC9YSrhcKiisGv5Q6sOKLwIRo8HkGqbscdIZAD6ocqbxIX2o
+gOmsCYPISv1D2ISiUsLtH7FCcvX2UQ19UMsttpamwEU0rU47dRJXn+lE1EZVwGIU
+DCQO2QanHR+nqXHoha/ayonhW9iNPf54mfPVoieyrdDudqSTZczc9ih562jSFzY0
+k8aypMmNQRskLF1zVtN3qwikb+IiQUlDHIESJ0+U4lhDj3bckt4BZaDP6jT6sns8
+DF/fcFhfAgMBAAECggEAIr5nuygcxRbmkv52jC7EooEe2LvMVpXHyfFb/nykJTSY
+L01ppJ2rF5vfbeX/uLcDvdXLnPb0MICz4MYoJSnVo+whrDaXIzOYouAVO5wOoDhD
+jp16lAEOPgoF152fxS5uJ3VNbPy0hsPE2TtN5kKDGMbpGdF9HLa3RH+V1mIOVZnp
+VYM0OMckhOeuMICA+wq6Of+UipO3RFCJWdNjknWzmwPaFXYPpU/grppTGBUzpXZe
+4F3TvTWTpC+IV/zCs1w4pSMr+8dYEZe7MfvUzreql/E9tOlmON8iK7Mr1UmSdQTa
+QOEzA1A5XfTR8wPVA3AmTpQYWMllIyM6+qfk0AK4IQKBgQD6qxNiFkCMosUsM+Or
+b2HJzIVLkQU4y6AInKKQppTZl7hh1+OB/Oo4ctPSIltiESVby3RaBhlc+ZLQDnYI
+8gSZSOYHMJOkjwj9KeFVc8Q2J44E8onuniMd/o3KxLnRMeAci1jEKtTVD+LAggS2
+uAGKAbUNWMVEe8us06JRZq6WCwKBgQD6QxJ+eK1TMEbU5Jyh7ZW6XMTrObKR5Eb8
+D1xsWEB7gSMkCw7cUlQ4hb7onA88xomVYG06u40tMgUrNLewrPsLNPakdMf08g/2
+34ZI12JbpUp1kd2irPDXqv+4Z/4lQUmAUEy47BT3igHo3pYZweeRhteBzwmqnN3S
+UrxIOGlffQKBgGl2UphhDlVdIiG/zxjQqs7RWn95iz3jBfi5lffP7i5CFBQuVYza
+EN0hCpeNVu9CkXo2dkRt7nvckPUyMF0BHggz0HvT5zpD559D4IcoRrQWHj1cocWg
+CNxUvelCrX8jQcwgoH8gGh1uKpOd4EfT0On0X+02nQB8KSwUemVPE0MTAoGBAJgs
+NJCmfG37Cvbk08E6oDKjujF18fj4H5mhFYfj2cG/cki2WKDrhr6fxMfYLQO9jWdB
+LOnrpRp4MeBlu9Q4OqZD3D1/rR5qGf75R8P/A5XKWg5HVcdW9VOObNQKl+S7YCAf
+s6c2FkG2rxaUUhzzZQV+QohyBeSyYcdD+6zGcHxZAoGAAnrcBHvkj6UEQVYrLoZ3
+Kot7HvHwvEHCsR2mYZPr2KM+fJBaNiJ36Muz469dF3dJCJKoQC27iZmJIwuEJuT+
+qaAi8G7ab7efZVhuX2sS6udHVYYtIeVVzRHFl26kmI9eXk6DESvhDkEppZ3GYRmR
+BDpNpq6UhhBlgL2b5zV1RCc=
+-----END PRIVATE KEY-----

module15/2.security-hardening/https-gateway.MD

@@ -0,0 +1,5 @@
+```
+openssl req -x509 -sha256 -nodes -days 365 -newkey rsa:2048 -subj '/O=cncamp Inc./CN=192.168.34.2' -keyout bookinfo.key -out bookinfo.crt
+kubectl create -n istio-system secret tls bookinfo-credential --key=bookinfo.key --cert=bookinfo.crt
+kubectl apply -f https-gateway.yaml
+```

module15/2.security-hardening/https-gateway.yaml

@@ -0,0 +1,17 @@
+apiVersion: networking.istio.io/v1beta1
+kind: Gateway
+metadata:
+  name: bookinfo-gateway
+spec:
+  selector:
+    istio: ingressgateway
+  servers:
+    - hosts:
+        - '*'
+      port:
+        name: https-bookinfo
+        number: 443
+        protocol: HTTPS
+      tls:
+        mode: SIMPLE
+        credentialName: bookinfo-credential

module7/controller-manager/job.yaml

@@ -3,13 +3,12 @@ kind: Job
 metadata:
   name: pi
 spec:
-  parallelism: 1
+  parallelism: 2
   completions: 5
   template:
     spec:
       containers:
         - name: pi
           image: perl
           command: ["perl",  "-Mbignum=bpi", "-wle", "print bpi(2000)"]
-      restartPolicy: OnFailure
-  backoffLimit: 4
+      restartPolicy: OnFailure

module7/cri/docker2containerd.md

@@ -14,20 +14,11 @@ systemctl stop containerd
 sudo mkdir -p /etc/containerd
 containerd config default | sudo tee /etc/containerd/config.toml
 ```
-
-### Update default config
-
-```sh
-vi /etc/containerd/config.toml
-sed -i s#k8s.gcr.io/pause:3.5#registry.aliyuncs.com/google_containers/pause:3.5#g /etc/containerd/config.toml
-sed -i s#'SystemdCgroup = false'#'SystemdCgroup = true'#g /etc/containerd/config.toml
-```
-
 ### Edit kubelet config and add extra args
 
 ```sh
 vi /etc/systemd/system/kubelet.service.d/10-kubeadm.conf
-Environment="KUBELET_EXTRA_ARGS=--container-runtime=remote --container-runtime-endpoint=unix:///run/containerd/containerd.sock"
+Environment="KUBELET_EXTRA_ARGS=--container-runtime=remote --container-runtime-endpoint=unix:///run/containerd/containerd.sock --pod-infra-container-image=registry.aliyuncs.com/google_containers/pause:3.5"
 ```
 
 ### Restart