Hardik Darji
type: channel
description: Writing about security and stuff
date: 2023-07-23T18:37:35Z
update period: hourly
update frequency: 1
update base: 2000-01-01T12:00+00:00
generator agent: wordpress.com
items: Linux Namespaces, Container Runtime, and Kubernetes Interactions
items: Kubeconfig Files and Cert Files
items: Pod Lifecycle, Probes, and Health Checks
items: Understanding Standard Streams: stdin, stdout, and stderr in Linux
items: All Things Helm 3.0
items: Kubernetes Cheatsheet [WIP]
items: OAuth 2.0 and OpenID Connect Explained
items: Terraform quickstart
items: Arithmetic, Logical and Control Instructions in IA32 Assembly
items: Hello World in Assembly

Linux Namespaces, Container Runtime, and Kubernetes Interactions
type: item
creator: hrdarji
date: 2023-03-06T01:32:00Z
subject: Uncategorized
subject: DevSecOps
subject: kubernetes
description: Linux namespaces are fundamental to isolating system resources for processes. Each namespace type isolates a different system resource: The Role of Container Runtime Container runtime, on the other hand, is the software that executes containers and manages container images on a node. Container runtimes provide the necessary interfaces to interact with the Linux kernel namespaces, … Continue reading Linux Namespaces, Container Runtime, and Kubernetes Interactions →
encoded: Linux namespaces are fundamental to isolating system resources for processes. Each namespace type isolates a different system resource: PID namespace: Isolates the process ID number space, meaning that processes in different PID namespaces can have the same PID. Network namespace (NET): Provides isolation of network controllers, system resources associated with networking, firewall rules, and routing tables. Mount namespace (MNT): Isolates the set of filesystem mount points seen by a group of processes so that processes in different mount namespaces can have different views of the filesystem hierarchy. Interprocess Communication namespace (IPC): Separates the system resources associated with System V IPC and POSIX message queues. User namespace (USER): Isolates the user and group ID number spaces, meaning that a process’s user and group IDs can be different inside and outside a user namespace. UTS namespace: Allows each container to have its own hostname and domain name, isolating the system identifiers nodename and domainname. The Role of Container Runtime Container runtime, on the other hand, is the software that executes containers and manages container images on a node. Container runtimes provide the necessary interfaces to interact with the Linux kernel namespaces, cgroups, and other components to create containers. In the context of Kubernetes, it uses a container runtime to create and manage containers. Kubernetes supports several container runtimes: Docker, containerd, CRI-O, and any implementation of the Kubernetes CRI (Container Runtime Interface). How Kubernetes Creates Containers Using Namespaces In Kubernetes, a Pod is the smallest and simplest unit that you deploy on a Kubernetes cluster. A Pod represents a single instance of a running process in a cluster and can contain one or more containers. These containers in a Pod share the same network, IPC, and optionally UTS and PID namespaces. It’s essentially a co-located group of applications that share th…

Kubeconfig Files and Cert Files
type: item
creator: hrdarji
date: 2023-02-26T19:22:00Z
subject: Uncategorized
subject: DevSecOps
subject: kubernetes
description: Kubernetes has become a leading platform for orchestrating containers in development, staging, and production environments. With its increased adoption, understanding its configuration files is essential. Two key components in the Kubernetes ecosystem are Kubeconfig files and certificate files. These are primarily used for authentication with the Kubernetes API Server. In this post, we will delve … Continue reading Kubeconfig Files and Cert Files →
encoded: Kubernetes has become a leading platform for orchestrating containers in development, staging, and production environments. With its increased adoption, understanding its configuration files is essential. Two key components in the Kubernetes ecosystem are Kubeconfig files and certificate files. These are primarily used for authentication with the Kubernetes API Server. In this post, we will delve deep into what these files are, why they are necessary, and how to use them effectively. What is a Kubeconfig File? A Kubeconfig file is a YAML format file that stores configurations for accessing multiple clusters. It’s the file that kubectl uses to determine the cluster it communicates with and the credentials it needs to do so. By default, it’s located in the ~/.kube/config directory on your system. Each Kubeconfig file can contain multiple ‘context’ entries. A ‘context’ combines a user (as defined in the Kubeconfig) with a cluster, allowing kubectl to target different Kubernetes clusters based on the context. The basic structure of a Kubeconfig file consists of the following: Clusters: Defines the details of the clusters. This includes the name of the cluster and the server URL. Users: Defines the user details used for authentication, such as client certificates, bearer tokens, or username and password. Contexts: A combination of clusters and users, referred to by a unique name. What are Cert Files? Cert files, also known as TLS certificates, are used for authenticating a client (or a user) to the Kubernetes API server. They are one of the types of credentials that can be embedded into the Kubeconfig file. Kubernetes API server supports multiple authentication methods, but the client certificate authentication is widely used because of its robustness and support for automation. In this method, a client certificate (public key) and a private key are generated for a user. The certificate is then signed by the Kubernetes cluster’s Certificate Authority (CA). To validate th…

Pod Lifecycle, Probes, and Health Checks
type: item
creator: hrdarji
date: 2022-08-07T18:04:00Z
subject: Assembly
subject: DevSecOps
subject: kubernetes
description: In Kubernetes, a Pod stands as the smallest, simplest unit that can be created and managed. Every Pod corresponds to a fraction of a workload operating on your cluster. Grasping the Pod Lifecycle allows us to proficiently control our applications and comprehend the situation when things veer off course. Here’s a high-level look at the … Continue reading Pod Lifecycle, Probes, and Health Checks →
encoded: In Kubernetes, a Pod stands as the smallest, simplest unit that can be created and managed. Every Pod corresponds to a fraction of a workload operating on your cluster. Grasping the Pod Lifecycle allows us to proficiently control our applications and comprehend the situation when things veer off course. Here’s a high-level look at the Pod Lifecycle: Pending: The Pod has been acknowledged by the Kubernetes system, but some containers are yet to be readied for running. Running: The Pod has been allocated to a node, all the containers have been created, and at least one container is either running or is in the startup/restart process. Succeeded: All containers within the Pod have exited, and they did so successfully, meaning they won’t restart. Failed: All containers within the Pod have ceased to run. At least one container has terminated due to a failure or system termination. Unknown: The Pod’s state could not be determined. Dissecting Liveness, Readiness, and Startup Probes A Probe in Kubernetes is a diagnostic conducted periodically by the kubelet on a Container. There are three distinct types of probes: liveness, readiness, and startup. Kubernetes employs these probes to determine the Pod’s health and make subsequent decisions based on the Pod’s state. Liveness Probe The liveness probe serves as an indicator of when to restart a container. If a liveness probe encounters a failure, the kubelet terminates the container, which is then subjected to its designated restart policy. If no liveness probe is provided by a Container, the default state is ‘Success’. Here’s an example of a liveness probe in a Kubernetes Pod specification: apiVersion: v1 kind: Pod metadata: name: liveness-pod spec: containers: - name: liveness-container image: k8s.gcr.io/busybox args: - /bin/sh - -c - touch /tmp/healthy; sleep 30; rm -rf /tmp/healthy; sleep 600 livenessProbe: exec: command: - cat - /tmp/healthy initialDelaySeconds: 5 periodSeconds: 5 Readiness Probe Readiness probes signal when…

Understanding Standard Streams: stdin, stdout, and stderr in Linux
type: item
creator: hrdarji
date: 2022-04-23T18:01:00Z
subject: Uncategorized
description: Today we’re going to dive into an important topic for anyone using a Linux-based operating system or writing software for such a system: the standard streams – stdin, stdout, and stderr. These three data streams are the primary means of communication between your Linux operating system and the processes it runs. What are Standard Streams? … Continue reading Understanding Standard Streams: stdin, stdout, and stderr in Linux →
encoded: Today we’re going to dive into an important topic for anyone using a Linux-based operating system or writing software for such a system: the standard streams – stdin, stdout, and stderr. These three data streams are the primary means of communication between your Linux operating system and the processes it runs. What are Standard Streams? Standard streams are communication channels between a program and its environment. When a Linux process starts, three streams are created: stdin (Standard Input): This is the data stream where a program reads its input. By default, stdin refers to the keyboard input. stdout (Standard Output): This is where a program writes its output data. The default destination is the text terminal that initiated the program. stderr (Standard Error): This is another output stream typically used by programs to output error messages or diagnostics. Just like stdout, the default destination is the text terminal that initiated the program. How Do Standard Streams Work? When you execute a command in your terminal, the system initiates a process to run the command. This process comes with an input channel (stdin) and two output channels (stdout and stderr). These channels function like pipelines, enabling the smooth flow of data. Let’s delve into some practical examples of how these streams are used in Linux: Redirecting stdin: The < operator is used to redirect the input of a command. For example, if you type sort < file.txt, the system will use the contents of file.txt as input to the sort command, as opposed to keyboard input. Redirecting stdout: The > operator serves to redirect the output of a command. For instance, ls > files.txt will write the output of the ls command to a file named files.txt instead of displaying it in the terminal. Redirecting stderr: You can redirect error output of a command using the 2> operator. For example, ls /nonexistent 2> error.txt will direct any error message to the file error.txt. Piping: The | operator is used to…

All Things Helm 3.0
type: item
creator: hrdarji
date: 2021-05-24T19:05:15Z
subject: all things
subject: DevSecOps
subject: quickstarts
subject: helm
subject: kubernetes
description: What is Helm? Helm is a package manager for Kubernetes. A package manager generally aims to provide a single command to install some software. Installing software likely has dependencies – a package manager should be able to resolve those dependencies. A package manager is supposed to abstract some complexities of installing software and making it … Continue reading All Things Helm 3.0 →
encoded: What is Helm? Helm is a package manager for Kubernetes. A package manager generally aims to provide a single command to install some software. Installing software likely has dependencies – a package manager should be able to resolve those dependencies. A package manager is supposed to abstract some complexities of installing software and making it easier to update, upgrade and remove the software. What can Helm do for us? Single command installation – helm install Ability to roll back – helm rollback Get state information – helm status Simplified upgrades- helm upgrade Single command uninstall – helm uninstall Want to install helm? Grab the installation script from the official guide, and run it. curl -fsSL -o get_helm.sh https://raw.githubusercontent.com/helm/helm/master/scripts/get-helm-3 chmod 700 get_helm.sh ./get_helm.sh #Confirm that the installation was successful helm version version.BuildInfo{Version:"v3.5.0", GitCommit:"32c22239423b3b4ba6706d450bd044baffdcf9e6", GitTreeState:"clean", GoVersion:"go1.15.6"} Helm Charts Charts is the packaging format for Helm. A chart is nothing but a collection of files with a specific file structure that represents resources within Kubernetes. The name of the folder is the name of the chart. A chart contains all the files for a Kubernetes deployment. Chart Repositories A chart repository is an HTTP server that serves the packaged charts. A packaged chart is a Helm chart that is processed into an archive (tar) by using the following command and a name. helm package chartname Note: A chart repository serves an index.yaml file. This file is the source of truth of packaged charts and where they are. (Example: https://charts.helm.sh/stable/index.yaml) The following section contains some commonly used commands. Add a repository: helm repo add stable https://charts.helm.sh/stable "stable" has been added to your repositories # Note: "stable" after the add argument is the name of the repository which can be changed. List the added r…

Kubernetes Cheatsheet [WIP]
type: item
creator: hrdarji
date: 2021-03-14T13:19:37Z
subject: Cheatsheets
encoded: kubectl get pods #get pods from default namespace kubectl get pods -o wide #get pods from default namespace kubectl get nodes #get nodes kubectl get pods --all-namespaces #list all pods kubectl drain node_name --ignore-deamonsets --force #drain a node, cannot delete pods managed by replicationcontroller, replicaset, job, deamonset, statefulset kubectl uncordon node_name # allow pods to run on the node after draining # implement a manifest, create a pod kubectl apply -f pod.yaml # List of supported resources kubectl api-resources # get output in a different format or filter the results kubectl get pods -o json kubectl get pods -o yaml kubectl get pods -o wide --sort-by .spec.nodeName kubectl get pods -n kube-system --selector k8s-app=calico-node # info-gathering kubectl describe pod pod_name # execute commands in pods # -c is the containername kubectl exec my-pod -c busybox -- echo "test output" # delete a pod kubectl delete pod my-pod # describe a deployment kubectl describe deployment my-deployment # get a deamonset Kubectl get deamonset Those are two different approaches of managing resources Imperative Management kubectl create is what we call Imperative Management. On this approach you tell the Kubernetes API what you want to create, replace or delete, not how you want your K8s cluster world to look like. Declarative Management kubectl apply is part of the Declarative Management approach, where changes that you may have applied to a live object (i.e. through scale) are "maintained" even if you apply other changes to the object. # Run kubectl create to see a list of objects that can be created with imperative commands. kubectl create # Create a deployment imperatively. kubectl create deployment my-deployment --image=nginx # Do a dry run to get some sample yaml without creating the object. kubectl create deployment my-deployment --image=nginx --dry-run -o yaml # Save the yaml to a file. kubectl create deployment my-deployment --image=nginx --dry-run -o yaml > depl…

OAuth 2.0 and OpenID Connect Explained
type: item
creator: hrdarji
date: 2020-12-02T17:44:00Z
subject: AppSec
subject: Oauth2
subject: Oauth2.0
subject: ODIC
subject: OpenID Connect
description: What are OAuth 2.0 and OpenID Connect? OAuth 2.0 is an authorization framework developed by IETF defined in RFC 6749. OpenID Connect (AKA OIDC) is an identity layer built on top of OAuth 2.0. OpenID connect specification is built by OpenID Foundation. The Problem Statement If you wanted a service or an application to access … Continue reading OAuth 2.0 and OpenID Connect Explained →
encoded: What are OAuth 2.0 and OpenID Connect? OAuth 2.0 is an authorization framework developed by IETF defined in RFC 6749. OpenID Connect (AKA OIDC) is an identity layer built on top of OAuth 2.0. OpenID connect specification is built by OpenID Foundation. The Problem Statement If you wanted a service or an application to access and process some resources that you own on your behalf, you’ll need to find a way to provide that access to that application or that service. For example, if you want a third-party application to read your tweets, you’ll need to give that third-party application the rights to access the Twitter API. This problem is called the access delegation problem. One way to provide that access is to share your Twitter login credentials – which is quite dangerous considering that not only the third-party application can read all tweets, it can also tweet on your behalf and also read your private messages. The Solution With OAuth 2.0 flow, the third-party application which is trying to access your tweets redirects the user to Twitter. Then the user authenticates to Twitter and provides consent that third-party is allowed to read your tweets. Twitter then provides a temporary token to the third-party application, by which the third-party application will get read access to the user’s tweets for a limited time. The subsequent requests from the third-party application send that token along with the request. <img width="1024" height="855" data-attachment-id="394" data-permalink="https://hardik.info/image-2/" data-orig-file="https://hardik.info/wp-content/uploads/2021/04/image-2.png" data-orig-size="1661,1387" data-comments-opened="1" data-image-meta="{"aperture":"0","credit":"","camera":"","caption":"","created_timestamp":"0","copyright":"","focal_length":"0","iso":"0","shutter_speed":"0","title":"","orientation":"0"}" data-image-title="image-2" data-image-description="" data-image-caption="" data-large-file="https://hardik.info/wp-content/uploads/2021/04/image-2…

Terraform quickstart
type: item
creator: hrdarji
date: 2018-10-31T18:31:00Z
subject: quickstarts
subject: terraform quickstart
description: What is Terraform? Terraform is an open-source IoC (infrastructure as code) software by HashiCorp. It allows us to define and provision infrastructure using a high-level configuration language. For example, the following piece of code will create a server on AWS. To deploy it, we can just run one command: Great right? Here are some Terraform … Continue reading Terraform quickstart →
encoded: What is Terraform? Terraform is an open-source IoC (infrastructure as code) software by HashiCorp. It allows us to define and provision infrastructure using a high-level configuration language. For example, the following piece of code will create a server on AWS. provider "aws" { region = "us-east-1" } resource "aws_instance" "example" { ami = "ami-12345678" instance_type = "t2.micro" } To deploy it, we can just run one command: > terraform apply Great right? Here are some Terraform quick-basics: We interact with Terraform with its CLI. Once we have created our .tf files (configuration files) in our Terraform project, we first need to run init command to initialize the directory as a starting point of our project. > terraform init The above command will download the provider and take all the actions required for project initialization. Now Let’s say we want to check what changes will be made in our environment before applying it to our environment. We can run the following command for that. > terraform plan After checking the configuration that will be applied, if we want to proceed with deployment, we can run the apply command. > terraform apply The above command will deploy our configuration. Secure VPC design using Terraform To deploy any kind of Infrastructure in AWS environment, first we need to create a VPC in AWS. We don’t want to use default VPC provided by AWS as the default VPC is a VPC with public subnets only where each EC2 instance will automatically receive a public IP Address. The following Terraform source creates a VPC with the following attributes: – Has public and private subnets – Has internet gateway – EC2 instances in private subnets do not get public IP addresses – Two route tables for public and private subnets – Association of public route table to public subnets – Association of private route table to private subnets – NAT gateway in case EC2 instances in private subnets needs to connect to the internet (For example, fetching updates) Creat…

Arithmetic, Logical and Control Instructions in IA32 Assembly
type: item
creator: hrdarji
date: 2017-09-17T18:01:00Z
subject: Assembly
description: This is not a blog post, per se, but rather an example program that contains basic usage of arithmetic, logical and control instructions. For this blog post, I thought that it is better to describe the example program in the program comments and not in separate paragraphs. We will write a simple program that will … Continue reading Arithmetic, Logical and Control Instructions in IA32 Assembly →
encoded: This is not a blog post, per se, but rather an example program that contains basic usage of arithmetic, logical and control instructions. For this blog post, I thought that it is better to describe the example program in the program comments and not in separate paragraphs. We will write a simple program that will have examples of the following: Arithmetic Addition Subtraction Increment/Decrement Multiplication Division Logical AND OR XOR NOT Control Unconditional Jump Conditional Jump Loop ; Author: HRDARJI ; This program was created to understand arithmetic, logical and control ; instructions of assembly language programming. global _start section .text _start: ; ----------- Arithmetic Instructions---------------- ; The below instructions are register based addition. &lt;span data-mce-type="bookmark" id="mce_SELREST_start" data-mce-style="overflow:hidden;line-height:0" style="overflow:hidden;line-height:0" &gt;&lt;/span&gt; mov eax, 0x0 add eax, 0x10 ; memory based addition mov eax, 0x0 add word [var2], 0x1111 clc ; clear carry flag stc ; set carry flag cmc ; complement carry flag ; subtract mov eax, 0x3 sub eax, 0x2 ; increment and decrement instructions inc eax dec eax ; multiplication mov eax, 0x0 mov ebx, 0x0 mov ax, 0x1111 mov bx, 0x0002 mul bx ; divistion mov dx, 0x0 mov ax, 0x1234 mov cx, 0x2 div cx ; ----------- Logical Instructions---------------- ; AND mov al, 0x10 and al, 0x01 ; AND can also be used for memory locations and byte [var1], 0x22 ; OR mov al, 0x10 or al, 0x01 ; XOR mov al, 0x10 xor al, 0x01 ; NOT mov eax, 0xFFFFFFFF not eax ; ----------- Control Instructions---------------- jmp LabelExample2 ; instructions under LabelExample1 will never be executed. LabelExample1: mov eax, 0x11 add eax, 0x22 LabelExample2: ; we are updating eax to 5 because we will print hello world 5 times mov eax, 0x5 PrintString: push eax ; print hello world 5 times mov eax, 0x4 mov ebx, 1 mov ecx, message mov edx, mlen int 0x80 pop eax dec eax jnz PrintString ;-----------…

Hello World in Assembly
type: item
creator: hrdarji
date: 2017-08-22T00:40:10Z
subject: Assembly
subject: "Hellow world in assembly"
description: This post is a part of my attempts at learning Assembly with NASM as our assembler with explanation of a simple, helloworld program. ; helloworld.nasm ; Author: HRDARJI global _start section .text _start: ; printing hello world mov eax, 0x4 mov ebx, 0x1 mov ecx, message mov edx, mlen int 0x80 ; exiting properly mov … Continue reading Hello World in Assembly →
encoded: This post is a part of my attempts at learning Assembly with NASM as our assembler with explanation of a simple, helloworld program. ; helloworld.nasm ; Author: HRDARJI global _start section .text _start: ; printing hello world mov eax, 0x4 mov ebx, 0x1 mov ecx, message mov edx, mlen int 0x80 ; exiting properly mov eax, 0x1 mov ebx, 0x5 int 0x80 section .data message: db "Hello World" mlen equ $-message ; in the above line mlen will store length of the message. First, to let the linker know where my program starts, we need to add “_start:” as an identifier to the start of our program (line 8). To add comments in an assembly program, we can use “;” at the start of the line. All the code (instructions) for our program will remain in text section. For our program, the text section declaration syntax can be seen on line 6. All the initialized data will be in our data section. The declaration of data section is on line 24. The message that we want to print, “Hello World” is initialized under label “message”. db is “define bytes”; It will store our string in consecutive memory location (thanks to nasm). To print our string, we will use a system call that can print our string. In IA-32, we will use interrupt 0x80 (line 16)to enter a system call. For more information on interrupt and int 0x80, I will recommend reading this stackoverflow post and wiki page on interrupt vector table. How a system call with interrupt instruction works? When the interrupt handler catches an interrupt, the program will execute as per the current state or values of the registers in the processor. In our case, when the system receives an interrupt on line 18, the value of eax register is 0x4. Which means, that OS will know that write syscall needs to be executed. The mapping of the values to specific syscall can be fonund in “/usr/include/i386-linux-gnu/asm/unistd_32.h” in Ubuntu 21 bit. There are many system calls defined in “/usr/include/i386-linux-gnu/asm/unistd_32.h” (in Ubuntu 32 OS). Example…