1. Background As shown above, the business team needs to isolate the services in a namespace, forbidding access from workloads in the bar namespace while allowing users to reach the service through a Load Balancer (LB) via NodePort. It is easy to write a network policy: 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 apiVersion: networking.

This document is mainly meant to demonstrate the dangers of Docker privileged mode, so please proceed with caution. Users without CLI access can copy the example YAML and directly create cluster workloads such as Pod, Job, and DaemonSet to carry out the operations. 1. Directly Deleting All Resources If you can log in to the machine, pack your things, and run the command:

1. A Strange Requirement My boss had a strange requirement: use a single kubeconfig file to fetch all kinds of host status information, such as the process list and process states. My first reaction was that he must not understand containers — how could anyone use them that way, and if you were going to use them that way, why use containers at all?

1. What Problem Kata Solves Security and isolation are what make Kata Container stand out from Docker Container. Kata Container comes from the merger of the Intel Clear Containers and Hyper runV projects. Intel Clear Containers used Intel VT-x technology to provide containers through lightweight virtual machines, solving the security problem while delivering excellent performance.

When Base64-decoding a JWT, I found that the JSON data was incomplete. This article mainly introduces the relevant knowledge and solves this problem. 1. Introduction to JWT JWT passes authentication by setting Authorization: Bearer <token> in the Header. A JWT Token is a Base64-encoded string joined by dots, something like