CoderCo

**So, how long does it take to complete the trifecta?**

152 hours / hours (per week) = Number of weeks to get the Trifecta
alias k=kubectl # To set up the alias
> export do="--dry-run=client -o yaml"# To call on the export, use $do> k run test --image nginx $do > test.yaml
> vi test.yaml
> export now="--force --grace-period=0"# To call on this export, use $now# Create the pod
> k run test --image nginx # Delete the pod with 0 grace period
> k delete test $now
po - PODs
rs - ReplicaSets
deploy - Deployments
svc - Services
ns - Namespaces
netpol - Network Policies
pv - Persistent Volumes
pvc - Persistent Volume Claims
sa - Service Accounts
> ssh node1
-------SSH message-------node1 > systemctl restart kubelet
node1 > systemctl daemon-reload
node1 > exit------Exit message-------> k get nodes# Node is schedulable again
> ETCDCTL_API=3 etcdctl --endpoints=https://127.0.0.1:2379 \\
  --cacert= --cert= --key= \\
  snapshot save 
> vi np1.yaml
---------------------
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: test-network-policy
  namespace: default
spec:
  podSelector:
    matchLabels:
      role: db
  policyTypes:
  - Ingress
  - Egress
  ingress:
  - from:
    - ipBlock:                           # delete
        cidr: 172.17.0.0/16              # delete
        except:                          # delete
        - 172.17.1.0/24                  # delete
    - namespaceSelector:
        matchLabels:
          project: myproject
    - podSelector:
        matchLabels:
          role: frontend
    ports:
    - protocol: TCP
      port: 6379
  egress:
  - to:
    - ipBlock:
        cidr: 10.0.0.0/24
    ports:
    - protocol: TCP
      port: 5978
apiVersion: v1
kind: Pod
metadata:
  name: task-pv-pod
spec:
  volumes:
    - name: task-pv-storage                   # add
      persistentVolumeClaim:                  # add
        claimName: task-pv-claim              # add
  containers:
    - name: task-pv-container
      image: nginx
      ports:
        - containerPort: 80
          name: "http-server"
      volumeMounts:                           # add
        - mountPath: "/usr/share/nginx/html". # add
          name: task-pv-storage               # add
> kubectl label node key1=value1> kubectl get nodes --show-labels> kubectl edit po test-----Add label to pod-----
> vi configmap-pod-volume.yamlapiVersion: v1
kind: Pod
metadata:
  name: mypod
spec:
  containers:
  - name: mypod
    image: redis
    volumeMounts:
    - name: foo
      mountPath: "/etc/foo"
      readOnly: true
  volumes:
  - name: foo
    configMap:
      name: myconfigmap> vi secret-pod-env.yamlapiVersion: v1
kind: Pod
metadata:
  name: secret-env-pod
spec:
  containers:
  - name: mycontainer
    image: redis
    env:                                 # add
      - name: SECRET_USERNAME            # add
        valueFrom:                       # add
          secretKeyRef:                  # add
            name: mysecret               # add
            key: username                # add
            optional: false              # add

      - name: SECRET_PASSWORD            # add
        valueFrom:                       # add
          secretKeyRef:                  # add
            name: mysecret               # add
            key: password                # add
            optional: false              # add

  restartPolicy: Never
> systemctl start falco> systemctl list-units --type services | grep > systemctl stop > systemctl disable 
apiVersion: v1
kind: Pod
metadata:
  name: security-context-demo
spec:
  securityContext:
    runAsUser: 1000                                     # change
    runAsGroup: 3000
    fsGroup: 2000
  volumes:
  - name: sec-ctx-vol
    emptyDir: {}
  containers:
  - name: sec-ctx-demo
    image: busybox
    command: [ "sh", "-c", "sleep 1h" ]
    volumeMounts:
    - name: sec-ctx-vol
      mountPath: /data/demo
    securityContext:                                    # add
      allowPrivilegeEscalation: false                   # add
apiVersion: v1
kind: Pod
metadata:
  name: audit-pod
  labels:
    app: audit-pod
spec:
  securityContext:                                 # add
    seccompProfile:                                # add
      type: Localhost                              # add
      localhostProfile: profiles/audit.json        # add
  containers:
  - name: test-container
    image: hashicorp/http-echo:0.2.3
    args:
    - "-text=just made some syscalls!"
    securityContext:
      allowPrivilegeEscalation: false
> cd /etc/kubernetes/manifests
> cp kube-apiserver.yaml ~/kube1.yaml
> vi kube-apiserver.yaml-----Changes-made--------> k get po
---Connection to host failed message---
> rm kube-apiserver.yaml
> mv ~/kube1.yaml /etc/kubernetes/manifests/kube-apiserver.yaml# When resetting api-server> cd /etc/kubernetes/manifests
> vi kube-apiserver.yaml-----Changes-made--------> mv kube-apiserver.yaml ../
> crictl ps 
> mv ../kube-apiserver.yaml ./
### VolumeMounts for auditing in kube-apiserver manifest file
...
volumeMounts:
- mountPath: /etc/kubernetes/audit-policy.yaml
  name: audit
  readOnly: true
- mountPath: /var/log/kubernetes/audit/
  name: audit-log
  readOnly: false### Volumes for auditing in kube-apiserver manifest file
...
volumes:
- name: audit
  hostPath:
    path: /etc/kubernetes/audit-policy.yaml
    type: File
- name: audit-log
  hostPath:
    path: /var/log/kubernetes/audit/
    type: DirectoryOrCreate
127.0.0.1 localhost mo.test server.test ca.test
brew install dnsmasq

vi /usr/local/etc/dnsmasq.conf

Edit dnsmasq Configuration: Open /usr/local/etc/dnsmasq.conf in a text editor and add your custom DNS settings. For example, to resolve .test domains to your local machine, add:

address=/.test/127.0.0.1

brew services start dnsmasq
----
Configure your macOS to Use dnsmasq

- Open System Preferences: Go to System Preferences > Network.

- Select Your Network: Choose your active network interface (like Wi-Fi) and click Advanced.

- Add DNS Server: Go to the DNS tab and add 127.0.0.1 as a DNS server. This will direct DNS queries to your local dnsmasq instance.

- Apply Changes: Click OK, then Apply to save the changes.

--- 
Then test it

dig mo.test
or
dig mo.test @127.0.0.1

step ca init --profile=test.ca --context=test.ca 

? What deployment type would you like to configure?: 
Use the arrow keys to navigate: ↓ ↑ → ← 
✔ Deployment Type: Standalone
What would you like to name your new PKI?
✔ (e.g. Smallstep): Test
What DNS names or IP addresses will clients use to reach your CA?
✔ (e.g. ca.example.com[,10.1.2.3,etc.]): localhost,ca.test
What IP and port will your new CA bind to? (:443 will bind to 0.0.0.0:443)
✔ (e.g. :443 or 127.0.0.1:443): :54321
What would you like to name the CA's first provisioner?
✔ (e.g. you@smallstep.com): mo@example.com
Choose a password for your CA keys and first provisioner.
✔ Password: <...>
✔ Password: <...>
Generating root certificate... done!
Generating intermediate certificate... done!

step ca provisioner add acme --type ACME --x509-min-dur 1h --x509-default-dur 9490h1m0s --x509-max-dur 9490h1m0s
step certificate install /Users/mohameda/.step/authorities/test.ca/certs/root_ca.crt

## add system password ^
step-ca --context=test.ca
providers:
  file:
    directory: /etc/traefik/conf
    watch: true
  http:
    endpoint: http://host.docker.internal/config

ping:
  entryPoint: "traefik"

entryPoints:
  http:
    address: ":80"

  https:
    address: ":443"

# API and dashboard configuration
api:
  insecure: true
  dashboard: true

accessLog:
  bufferingSize: 100
  filePath: log-access.log 

log:
  filePath: log-file.log
  level: DEBUG

serversTransport:
  insecureSkipVerify: true
certificatesResolvers:
  local:
    acme:
      caserver: https://ca.test:54321/acme/acme/directory
      storage: acme.json
      httpChallenge:
        entryPoint: https

metrics:
  prometheus:
    addRoutersLabels: true

http:
  routers:
    dashboard:
      rule: "Host(`mo.test`)"
      service: "noop@internal"
      entryPoints:
        - "http"
      middlewares:
        - "secured-redirect"
    dashboard-secured:
      entryPoints:
        - "https"
      rule: "Host(`mo.test`)"
      service: "api@internal"
      tls:
        certResolver: "local"
        domains:
          - main: "mo.test"

    moab:
      rule: "Host(`mo.ab`)"
      service: "noop@internal"
      entryPoints:
        - "http"
      middlewares:
        - "secured-redirect"
    moab-secured:
      entryPoints:
        - "https"
      rule: "Host(`mo.ab`)"
      service: "example-service"
      tls:
        certResolver: "local"
        options: acmeClient
        domains:
          - main: "mo.ab"          

  middlewares:
    secured-redirect:
      redirectscheme:
        scheme: https
        permanent: true

  services:
    example-service:
      loadBalancer:
        passHostHeader: true
        servers:
          - url: "http://localhost:8080/"

tls:
  options:
    acmeClient:
      clientAuth:
        caFiles:
          - /Users/mohameda/.step/authorities/test.ca/certs/root_ca.crt
# the path of root certificate might be like below:-
# Users//.step/authorities/test.ca/certs/root_ca.crt
        clientAuthType: RequireAndVerifyClientCert

log:
  filePath: log-file.log # relative to current location, will be created
  level: DEBUG

sudo ln -s $(pwd)/dynamic.yml /etc/traefik/conf/dynamic.yml
traefik --configfile=./static.yml
step ca certificate client client.crt client.key --set emailAddresses=mo@example.com --context=test.ca --size=4096 --kty=RSA

## if you run the above, make sure the CA server is running!! (step-ca --context=test.ca)

use the provisioner created previously to create a certificate for the client. (Provisioner: mo@example.com (JWK))
step certificate p12 client.p12 client.crt client.key
# Example of a suboptimal Dockerfile

FROM ubuntu:latest

RUN apt-get update && apt-get install -y python3 python3-pip python3-dev
COPY . /app
WORKDIR /app
RUN pip3 install -r requirements.txt

CMD ["python3", "app.py"]

# Example of a more secure Dockerfile

FROM python:3.9-slim

RUN useradd -m dockeruser
WORKDIR /home/dockeruser
COPY . .

RUN pip install --no-cache-dir -r requirements.txt
USER dockeruser

CMD ["python", "app.py"]

name: CI

on: [push]

jobs:
  trivy_scan:
    runs-on: ubuntu-latest
    steps:
    - name: Check out the repo
      uses: actions/checkout@v2

    - name: Set up Docker Buildx
      uses: docker/setup-buildx-action@v1

    - name: Login to DockerHub
      uses: docker/login-action@v1
      with:
        username: ${{ secrets.DOCKERHUB_USERNAME }}
        password: ${{ secrets.DOCKERHUB_TOKEN }}

    - name: Build and push Docker image
      uses: docker/build-push-action@v2
      with:
        context: .
        push: true
        tags: yourdockerimage:tag

    - name: Run Trivy vulnerability scanner
      uses: aquasecurity/trivy-action@master
      with:
        image-ref: 'yourdockerimage:tag'
        format: 'table'
        exit-code: '1'

docker run -it --memory=500m --cpus="1.5" ubuntu:latest /bin/bash

# Original Dockerfile
FROM nginx:latest
COPY . /usr/share/nginx/html

# Modified Dockerfile with CIS Benchmark
FROM nginx:latest
RUN useradd -m dockeruser
USER dockeruser
COPY . /usr/share/nginx/html

export DOCKER_CONTENT_TRUST=1
docker build -t secureapp .

# Launch Traefik v1.7 as the reverse proxy
docker run -d \
  --name my_traefik \
  -p 8080:80 \
  -v /var/run/docker.sock:/var/run/docker.sock \
  traefik:v1.7 \
    --docker \
    --docker.exposedbydefault=false

# Start your application containers with new weight distributions
docker run -d --name app_v1 \
  --label "traefik.enable=true" \
  --label "traefik.backend=myapp" \
  --label "traefik.frontend.rule=Host:myapp.local" \
  --label "traefik.weight=30" \
  nginx:stable

docker run -d --name app_v2 \
  --label "traefik.enable=true" \
  --label "traefik.backend=myapp" \
  --label "traefik.frontend.rule=Host:myapp.local" \
  --label "traefik.weight=70" \
  nginx:stable-alpine

# dynamic_config.yml
http:
  routers:
    myapp-router:
      rule: "Host(`myapp.local`)"
      service: myapp-service

  services:
    myapp-service:
      weighted:
        services:
          - name: app-v1-service@docker
            weight: 3
          - name: app-v2-service@docker
            weight: 7

docker run -d --rm --name traefik-v2.5 \
  -p 9999:80 \
  -v /var/run/docker.sock:/var/run/docker.sock \
  -v `pwd`:/etc/traefik_providers \
  traefik:v2.5 \
    --providers.docker \
    --providers.docker.exposedbydefault=false \
    --providers.file.filename=/etc/traefik_providers/file_provider.yml
# Starting containers with Traefik v2 labels
docker run -d --name app_v1 \
  --label "traefik.enable=true" \
  --label "traefik.http.services.app-v1-service.loadbalancer.server.port=80" \
  nginx:stable

docker run -d --name app_v2 \
  --label "traefik.enable=true" \
  --label "traefik.http.services.app-v2-service.loadbalancer.server.port=80" \
  nginx:stable-alpine

for i in {1..50}; do curl -s -o /dev/null -D - -H "Host:myapp.local" localhost:8080 | grep X-Powered-By; done | sort | uniq -c

## Ansible Exercise 1: Configure a Web Server

### Objective

Your task is to write an Ansible playbook that automates the following tasks on a remote Ubuntu server:

- **Step 1**: Update the package manager cache.

- **Step 2**: Install the Apache web server package (`apache2`).

- **Step 3**: Enable and start the Apache service.

- **Step 4**: Deploy a simple `index.html` file to the document root `/var/www/html/`. The HTML should display "Hello, Ansible!"

### Requirements

- The playbook should be idempotent, meaning it can be run multiple times without changing the outcome.

- The target hosts should be defined in your Ansible inventory

[webserver]
192.168.1.2 ansible_ssh_user=ubuntu
---
- hosts: webserver
  tasks:
    - name: Update package manager cache
      apt:
        update_cache: yes

    - name: Install Apache web server
      apt:
        name: apache2

    - name: Enable and start Apache service
      systemd:
        name: apache2
        enabled: yes
        state: started

    - name: Deploy index.html
      copy:
        content: "Hello, Ansible!"
        dest: /var/www/html/index.html
ansible-playbook web_server_setup.yml

## Terraform Exercise 1: Create an AWS S3 Bucket

### Objective

Your task is to write a Terraform script that does the following:

- **Step 1**: Create an AWS S3 bucket named `tf-test-bucket-yourname`.

- **Step 2**: Enable versioning on the S3 bucket.

- **Step 3**: Create a folder within that S3 bucket and name it `uploads`.

---

## Terraform Exercise 2: Set up a VPC

### Objective

Write a Terraform script to set up a Virtual Private Cloud (VPC) in AWS with the following:

- **Step 1**: Create a VPC with CIDR block `10.0.0.0/16`.

- **Step 2**: Create a subnet in that VPC with CIDR block `10.0.1.0/24`.

- **Step 3**: Attach an internet gateway to the VPC.

## Terraform Exercise 3: Managing EC2 Instances

### Objective

Your objective is to create a Terraform script that automates the following:

- **Step 1**: Launch an EC2 instance with type `t2.micro`.

- **Step 2**: Make sure to use an Amazon Linux 2 AMI.

- **Step 3**: Tag the instance with "Environment: Dev".

resource "aws_s3_bucket" "my_bucket" {
  bucket = "tf-test-bucket-yourname"
  acl    = "private"

  versioning {
    enabled = true
  }
}

resource "aws_s3_bucket_object" "my_folder" {
  bucket = aws_s3_bucket.my_bucket.id
  key    = "uploads/"
  source = "/dev/null"
}
resource "aws_vpc" "my_vpc" {
  cidr_block = "10.0.0.0/16"
}

resource "aws_subnet" "my_subnet" {
  vpc_id     = aws_vpc.my_vpc.id
  cidr_block = "10.0.1.0/24"
}

resource "aws_internet_gateway" "my_gw" {
  vpc_id = aws_vpc.my_vpc.id
}
resource "aws_instance" "my_instance" {
  ami           = "ami-0c55b159cbfafe1f0"
  instance_type = "t2.micro"

  tags = {
    Environment = "Dev"
  }
}
git clone https://github.com/moabukar/zmq-demo.git
cd zmq-demo
cd go/pubsub
go run pub.go
go run sub.go
cd py/reqreply
python3 server.py
python3 client.py
cd rust/pubsub
cargo run --bin pub
cargo run --bin sub
variable "mongodbatlas_public_key" {
  type        = string
  description = "MongoDB Atlas public API key used to authenticate with MongoDB provider"
  sensitive = true
}

variable "mongodbatlas_private_key" {
  type        = string
  description = "MongoDB Atlas private API key used to authenticate with MongoDB provider"
  sensitive = true
}
module "mongodb_atlas_cluster" {
  source = "../../terraform/modules/mongodb2.0"

  atlas_org_id               = var.org_id
  cloud_provider             = "AWS"
  mongodb_version            = "6.0"

  mongodbatlas_public_key  = var.mongodbatlas_public_key
  mongodbatlas_private_key = var.mongodbatlas_private_key

  ip_address = var.ip_address
jobs: 
  tf_deploy:
    name: TF deploy
    env:
      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      TF_ACTION_WORKING_DIR: './examples/basic-2'
      AWS_ACCESS_KEY_ID:  ${{ secrets.AWS_ACCESS_KEY_ID }}
      AWS_SECRET_ACCESS_KEY:  ${{ secrets.AWS_SECRET_ACCESS_KEY }}
      TF_VAR_mongodbatlas_public_key: ${{ secrets.MONGODBATLAS_PUBLIC_KEY }}
      TF_VAR_mongodbatlas_private_key: ${{ secrets.MONGODBATLAS_PRIVATE_KEY }}
      TF_VAR_ip_address: ${{ secrets.IP_ADDRESS }}

variable "instance_tags" {
  type    = map(string)
  default = {
    Environment = "Production"
    Application = "Web"
  }
}

resource "aws_instance" "example_instance" {
  # ...
  tags = var.instance_tags
}
output "distribution_domain_name" {
  value       = module.cloudfront-distribution.domain_name
  description = "Domain Name of the CloudFront Distribution"
}

output "distribution_arn" {
  value       = module.cloudfront-distribution.arn
  description = "ARN of the CloudFront Distribution"
}

output "instance_id" {
  description = "ID of the instance"
  value       = aws_instance.example_instance.id
}
module "complex_logic" {
  source = "./submodules/complex_logic"

  input_variable = var.some_value
}
# s3-module/main.tf
resource "aws_s3_bucket" "my_bucket" {
  bucket = "my-unique-bucket"
  # ...
}

# ec2-module/main.tf
resource "aws_instance" "my_instance" {
  ami           = "ami-12345678"
  instance_type = "t2.micro"
  # ...
}

--- Separated modules below

# main.tf
module "s3" {
  source = "./s3-module"
}

module "ec2" {
  source = "./ec2-module"
}

## By organising your infrastructure this way, each module has a clear purpose, making it easier to understand, update, and manage. This approach fosters collaboration and allows teams to focus on specific areas without risking unintended changes to unrelated resources.
resource "aws_elastic_beanstalk_environment" "existing_env" {
  name = "my-existing-environment"
}

# Import the existing environment
terraform import aws_elastic_beanstalk_environment.existing_env my-existing-environment
# main.tf

provider "aws" {
  region = "us-west-2"
}

resource "aws_security_group" "example_sg" {
  name_prefix = "example-sg-"
  description = "Example Security Group"
}

variable "ingress_rules" {
  type = list(object({
    from_port   = number
    to_port     = number
    protocol    = string
    cidr_blocks = list(string)
  }))
}

dynamic "ingress" {
  for_each = var.ingress_rules
  content {
    from_port   = ingress.value.from_port
    to_port     = ingress.value.to_port
    protocol    = ingress.value.protocol
    cidr_blocks = ingress.value.cidr_blocks
  }
}

# terraform.tfvars

ingress_rules = [
  {
    from_port   = 80
    to_port     = 80
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  },
  {
    from_port   = 443
    to_port     = 443
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }
]
# main.tf

provider "aws" {
  region = "us-west-2"
}

locals {
  allowed_instance_types = ["t2.micro", "m5.large"]
}

variable "instance_type" {
  description = "Type of EC2 instance"
  type        = string

  validation {
    condition = var.instance_type in local.allowed_instance_types
    error_message = "Invalid instance type. Choose either t2.micro or m5.large."
  }
}

resource "aws_instance" "example_instance" {
  ami           = "ami-0123456789abcdef0"
  instance_type = var.instance_type
  tags = {
    Name = "ExampleInstance"
  }
}

Error: Invalid instance type. Choose either t2.micro or m5.large.

# modules/s3_bucket/variables.tf

variable "bucket_name" {
  description = "Name of the S3 bucket"
  type        = string
  validation {
    condition     = can(regex("^my-bucket-", var.bucket_name))
    error_message = "Bucket name must start with 'my-bucket-'"
  }
}

----

# modules/s3_bucket/main.tf

resource "aws_s3_bucket" "my_bucket" {
  bucket = var.bucket_name
  # Other bucket configuration...
}

#### Required Variables ####
variable "region" {
  description = "The AWS region where resources will be created."
}

variable "vpc_cidr_block" {
  description = "The CIDR block for the VPC."
}

#### Optional Variables ####
variable "instance_type" {
  description = "The EC2 instance type. Defaults to t2.micro."
  default     = "t2.micro"
}

variable "subnet_count" {
  description = "The number of subnets to create. Defaults to 3."
  default     = 3
}

locals {
  sg_name = "sg-${var.environment}-${var.app_name}"
}

resource "aws_security_group" "example_sg" {
  name        = local.sg_name
  description = "Security group for ${var.app_name}"
  vpc_id      = aws_vpc.example_vpc.id
}

locals {
  transform_name = upper("my-resource-name")
}

resource "aws_s3_bucket" "example_bucket" {
  bucket = local.transform_name
  # other configurations...
}

locals {
  create_bucket = true
}

resource "aws_s3_bucket" "example_bucket" {
  count         = local.create_bucket ? 1 : 0
  bucket        = "my-example-bucket"
  force_destroy = true
}

locals {
  instance_suffixes = [
    for i in range(3) : random_string.example_suffix[i].result
  ]
}

resource "aws_instance" "example_instance" {
  count = 3
  ami           = "ami-0c55b159cbfafe1f0"
  instance_type = "t2.micro"
  tags = {
    Name = "instance-${count.index + 1}-${local.instance_suffixes[count.index]}"
  }
}

resource "random_string" "example_suffix" {
  count     = 3
  length    = 4
  upper     = false
  special   = false
  number    = true
}

# s3_bucket.tf

variable "bucket_name" {
  description = "Name of the S3 bucket"
  type        = string
  default     = "my-s3-bucket"
}

variable "acl" {
  description = "Access control list for the bucket"
  type        = string
  default     = "private"
}

variable "versioning_enabled" {
  description = "Enable versioning for the bucket"
  type        = bool
  default     = false
}

resource "aws_s3_bucket" "example_bucket" {
  bucket = var.bucket_name
  acl    = var.acl

  versioning {
    enabled = var.versioning_enabled
  }
}

# main.tf

module "custom_s3_bucket" {
  source            = "./modules/s3_bucket"
  bucket_name       = "my-custom-bucket"
  acl               = "public-read"
  versioning_enabled = true
}

Create a file named .git/hooks/pre-commit

#!/bin/sh

# Run Terraform fmt on all Terraform files
terraform_fmt_files=$(git diff --cached --name-only --diff-filter=ACM | grep '\.tf$')
if [ -n "$terraform_fmt_files" ]; then
    echo "Running 'terraform fmt' on the following files:"
    echo "$terraform_fmt_files"
    terraform fmt -check=true $terraform_fmt_files
fi

---
## Now, when you try to commit changes, the pre-commit hook will automatically run terraform fmt on your Terraform files and check if they are properly formatted. If any files are not properly formatted, the commit will be rejected, and you'll need to fix the formatting before committing.
my-module/
├── main.tf
├── variables.tf
├── outputs.tf
├── README.md
├── examples/
│   ├── basic-usage/
│   │   ├── main.tf
│   │   ├── variables.tf
│   │   ├── terraform.tfvars
│   ├── complete/
│   │   ├── main.tf
│   │   ├── variables.tf
│   │   ├── terraform.tfvars
│   ├── ...

module "my_vpc" {
  source = "./modules/vpc"
  version = "1.2.0"  # Specify the desired version
  # Other module inputs...
}
# Format and validate Terraform code
terraform fmt
terraform validate
package test

import (
	"testing"
	"github.com/gruntwork-io/terratest/modules/terraform"
	"github.com/stretchr/testify/assert"
)

func TestTerraformEC2Instance(t *testing.T) {
	t.Parallel()

	terraformOptions := terraform.WithDefaultRetryableErrors(t, &terraform.Options{
		TerraformDir: "../examples/aws-ec2-instance",
		Vars: map[string]interface{}{
			"instance_type": "t2.micro",
		},
	})

	defer terraform.Destroy(t, terraformOptions)

	terraform.InitAndApply(t, terraformOptions)

	instanceID := terraform.Output(t, terraformOptions, "instance_id")
	assert.NotNil(t, instanceID)
}

# policies.rego

package main

deny_instance_types = {
  "t2.nano",
  "m1.small"
}

default allow

deny {
  input.aws_instance.instance_type = deny_instance_types[_]
}

# Install conftest
brew install conftest   # For macOS

# Run OPA checks against Terraform code
conftest test path/to/your/terraform/code

## Example TF code

# main.tf

provider "aws" {
  region = "us-west-2"
}

resource "aws_instance" "example_instance" {
  ami           = "ami-12345678"
  instance_type = "t2.micro"
  tags = {
    Name = "ExampleInstance"
  }
}
{
  "builders": [
    {
      "type": "amazon-ebs",
      "region": "us-west-2",
      "source_ami": "ami-0123456789abcdef0",
      "instance_type": "t2.micro",
      "ssh_username": "ec2-user",
      "ami_name": "my-server-{{timestamp}}"
    }
  ]
}

fruits=('Apple' 'Banana' 'Cherry')

echo ${fruits[0]}  # Outputs: Apple

fruits+=('Dragonfruit')

unset fruits[1]

for i in {1..5}; do
    echo "Number $i"
done

for fruit in "${fruits[@]}"; do
    echo "$fruit"
done

count=1
while [ $count -le 5 ]; do
    echo "Count: $count"
    ((count++))
done

number=5
if [ $number -gt 3 ]; then
    echo "Number is greater than 3."
fi

word="apple"
case $word in
    apple)
        echo "This is an apple."
        ;;
    banana)
        echo "This is a banana."
        ;;
    *)
        echo "Unknown fruit."
        ;;
esac

sleep 30 &

jobs

fg %1

kill [PID]

killall [process_name]

#!/bin/bash
set -x
echo "Debugging my script."

#!/bin/bash
trap "echo 'Interrupted!'" SIGINT SIGTERM
echo "Press Ctrl+C to interrupt."
sleep 30

module "vpc" {
  source = "./modules/vpc"
  # module arguments
}
terraform/
├── dev/
│ ├── main.tf
│ ├── variables.tf
├── staging/
│ ├── main.tf
│ ├── variables.tf
├── prod/
│ ├── main.tf
│ ├── variables.tf
terraform/
├── modules/
│ ├── network/
│ │ ├── main.tf
│ │ ├── variables.tf
│ ├── database/
│ │ ├── main.tf
│ │ ├── variables.tf
├── environments/
│ ├── dev/
│ │ ├── main.tf
│ │ ├── variables.tf
│ ├── prod/
│ │ ├── main.tf
│ │ ├── variables.tf
# terraform.tfvars
region = "us-west1"
instance_type = "t2.micro"
terraform apply -var 'region=us-east-1'

# variables/defaults.tfvars

region = "us-west-1"
instance_type = "t2.micro"

---
To run:

terraform apply -var-file=variables/defaults.tfvars
terraform {
  backend "s3" {
    bucket         = "my-terraform-state"
    key            = "terraform.tfstate"
    region         = "us-west-1"
    encrypt        = true
    dynamodb_table = "terraform-lock"
  }
}
terraform {
  backend "s3" {
    bucket         = "my-terraform-state"
    key            = "terraform.tfstate"
    region         = "us-west-1"
    encrypt        = true
    dynamodb_table = "terraform-lock" >> state locking here
  }
}
resource "aws_instance" "coderco_ec2" {
  ami           = "ami-0c55b159cbfafe1f0"
  instance_type = "t2.micro"
  tags = {
    Name = "ExampleInstance"
  }

  user_data = <<-EOF
    #!/bin/bash
    echo "API_KEY=${data.aws_secretsmanager_secret_version.api_key.secret_string}" >> /etc/environment
  EOF
}

data "aws_secretsmanager_secret_version" "api_key" {
  secret_id = "my-api-key-secret-id"
}
# Generate a plan
terraform plan -out=tfplan

# Review the plan
terraform show -json tfplan
name: Terraform CI/CD using GitHub Actions

on:
  push:
    branches:
      - main

jobs:
  terraform:
    runs-on: ubuntu-latest

    steps:
    - name: Checkout code
      uses: actions/checkout@v2

    - name: Set up Terraform
      uses: hashicorp/setup-terraform@v1
      with:
        terraform_version: 1.0.0  # Specify the desired Terraform version

    - name: Initialize Terraform
      run: terraform init

    - name: Generate Terraform plan
      run: terraform plan -out=tfplan

    - name: Apply Terraform changes
      run: terraform apply -auto-approve tfplan

# OWNERS
# Responsible Teams for Terraform Modules

modules/aws-vpc: @network-team
modules/aws-eks: @infra-team
modules/aws-lambda: @dev-team
git tag v1.0.0
git push origin v1.0.0
provider "aws" {
  version = "~> 2.0"
  region  = "us-west-1"
}

## In this example, we've specified that we want to use version 2.0 of the AWS provider, allowing for any bug fix releases or minor updates within the 2.x series.
#!/bin/bash
# This is a bash script that greets the user
echo "Hello, $1!"

#!/bin/bash
# This script prints out the number of arguments and all arguments
echo "You provided $# arguments: $@"

#!/bin/bash
# This script reads a file line by line
while IFS= read -r line
do
    echo "$line"
done < "file.txt"

#!/bin/bash
# This script writes to a file
echo "Hello, world!" > file.txt

#!/bin/bash
# This script checks if a file exists and is a regular file
if [ -f "file.txt" ]
then
    echo "file.txt exists and is a regular file."
else
    echo "file.txt does not exist or is not a regular file."
fi

#!/bin/bash
# This script checks the success of a command
ls /nonexistent_directory
if [ $? -ne 0 ]
then
    echo "An error occurred."
fi

#!/bin/bash
# This script exits on the first error
set -e
ls /nonexistent_directory
echo "This line will not be printed if an error occurs."

#!/bin/bash
# This script is for debugging
set -x
echo "Hello, world!"

#!/bin/bash
# This script defines and calls a function
greet() {
    echo "Hello, $1!"
}
greet "Alice"

function maxSumSubarray(arr, K) {
  let windowSum = 0;
  let maxSum = 0;

  for (let i = 0; i < arr.length; i++) {
    windowSum += arr[i];

    if (i >= K - 1) {
      maxSum = Math.max(maxSum, windowSum);
      windowSum -= arr[i - (K - 1)];
    }
  }

  return maxSum;
}
function hasTwoSum(arr, target) {
  let left = 0;
  let right = arr.length - 1;

  while (left < right) {
    const sum = arr[left] + arr[right];

    if (sum === target) {
      return true;
    } else if (sum < target) {
      left++;
    } else {
      right--;
    }
  }

  return false;
}
class TreeNode {
  constructor(val) {
    this.val = val;
    this.left = this.right = null;
  }
}

function levelOrderTraversal(root) {
  if (!root) {
    return [];
  }

  const result = [];
  const queue = [root];

  while (queue.length > 0) {
    const levelSize = queue.length;
    const currentLevel = [];

    for (let i = 0; i < levelSize; i++) {
      const node = queue.shift();
      currentLevel.push(node.val);

      if (node.left) {
        queue.push(node.left);
      }
      if (node.right) {
        queue.push(node.right);
      }
    }

    result.push(currentLevel);
  }

  return result;
}

const root = new TreeNode(3);
root.left = new TreeNode(9);
root.right = new TreeNode(20);
root.right.left = new TreeNode(15);
root.right.right = new TreeNode(7);

console.log(levelOrderTraversal(root)); // Output: [[3], [9, 20], [15, 7]]

function binarySearch(arr, target) {
  let left = 0;
  let right = arr.length - 1;

  while (left <= right) {
    const mid = Math.floor((left + right) / 2);

    if (arr[mid] === target) {
      return mid;
    } else if (arr[mid] < target) {
      left = mid + 1;
    } else {
      right = mid - 1;
    }
  }

  return -1;
}

const sortedArr = [2, 5, 8, 12, 16, 23, 38, 45];
const target = 16;

console.log(binarySearch(sortedArr, target)); // Output: 4

CoderCo

The Kubernetes Trifecta in 40 days - think you got what it takes❓❗️

Introduction

On to the article…

Understanding the essentials

CKA (Certified Kubernetes Administrator):

CKAD (Certified Kubernetes Application Developer):

CKS (Certified Kubernetes Security Specialist)

Parting words

Psst, before you leave…

Simply click on the button below to become a paid subscriber…

📌 The Linux Boot Process: An INTERVIEW favourite

Introduction

Some quick announcements ❗️❗️:

On to article…

Step 1: BIOS/UEFI - The System's Initial Checkpoint

BIOS - The Legacy Firmware

UEFI - The Modern Alternative

Step 2: Detecting Devices - The Hardware Roll Call

How Devices are Detected

Step 3: Choosing a Boot Device - The Launchpad Selection

Boot Priority

Why the Right Boot Device Matters

Step 4: The Boot Loader - Orchestrating the Kernel Launch

The Role of GRUB

What GRUB Does

Why GRUB is Important

Step 5: The Kernel Takes Charge - Core System Initialization

Kernel Initialization

System Services and Processes

The Importance of the Kernel

Step 6: Systemd - The System and Service Manager

The Initial Handover to Systemd

Systemd Targets

Why Systemd is a Game-Changer

Step 7: Target Files - Establishing the User Environment

Understanding Targets

Default and Custom Targets

Role of Target Files

Step 8: Users Can Log In - Welcome to Your Linux System

Logging In

User Profiles and Environment

System Readiness

The Final Touch

Conclusion: The Significance of Understanding the Linux Boot Process

Vital in Interviews

Essential for System Administrators

Broader Linux Ecosystem Understanding

A final word from us…

The Ultimate AWS re:Invent Grant Guide

Table of Contents

1. Introduction

2. What is re:Invent and how can I get the Grant?

Applying for the Grant Program

3. What is All Builders Welcome (ABW)?

4. Building up to the Event - Things to Know Before You Go!

So You've Been Accepted as a Grant Attendee...

Certification at AWS re:Invent

Visa Requirements for Entry to the US

Confirming Flights and Hotel Reservations

Apps and Social Media (You can’t escape them!)

Stay Connected with Apps

Join Your Mentor Group Virtual Meetup

Uber App

Packing Smart for AWS re:Invent

Essentials for any tech conference

Clothing and Comfort

Travel Essentials

Networking and Socialising

5. At re:Invent

Getting around

Understanding the Venue Layout:

Utilising Shuttle Services

In Case of Confusion

ABW Grant hotel information

Badge Pickup

Badge Pickup Locations

Badge Pickup Times

Tips for Badge Pickup

ABW Grant Schedule of Events