ref: https://www.cncf.io/blog/2021/09/03/kubescape-the-first-open-source-tool-for-running-nsa-and-cisa-kubernetes-hardening-tests/

本篇文章是一個專案介紹文，該專案是個名為 Kubescape 的安全性掃描專案，該專案主要是用來檢驗目標 Kubernetes 是否能夠通過 NSA/CISA 等安全性檢查。

National Security Agency(NSA) 以及 Cybersecurity and Infrastructure Security Agency (CISA) 最近有發佈一個高達 52 頁的安全性指南，
該指南探討如何設立與強化 Kubernetes 叢集的安全性。
https://media.defense.gov/2021/Aug/03/2002820425/-1/-1/1/CTR_KUBERNETES%20HARDENING%20GUIDANCE.PDF

而 Kubescape 專案是一個基於 OPA(OpenPolicyAgent) 引擎的安全性檢查專案，該專案會從 Kubernetes API 取得各類型 Kubernetes 專案的資訊並且針對這些資訊去進行檢查。
檢查是基於上述 NSA/CISA 發布的安全性報告，該檢查的類別包含

1. Non-root containers
2. Immutable container filesystem
3. Building secure container images
4. Privileged containers
5. hostPID, hostIPC privileges
6. hostNetwork access
7. allowedHostPaths field
8. Protecting pod service account tokens
9. Pods in kube-system and kube-public
10. Resource policies
11. Control plane hardening
12. Encrypted secrets
13. Anonymous Requests

有興趣的可以試試看這個專案

How God Can Bless and Multiply You

“For when God made a promise to Abraham, since he could swear by no one greater, he swore by himself, saying, “Surely blessing I will bless you, and multiplying I will multiply you.” Thus, having patiently endured, he obtained the promise. For men indeed swear by a greater one, and in every dispute of theirs the oath is final for confirmation. In this way God, being determined to show more abundantly to the heirs of the promise the immutability of his counsel, interposed with an oath; that by two immutable things, in which it is impossible for God to lie, we may have a strong encouragement, who have fled for refuge to take hold of the hope set before us. This hope we have as an anchor of the soul, a hope both sure and steadfast and entering into that which is within the veil; where as a forerunner Jesus entered for us, having become a high priest forever after the order of Melchizedek.” (Hebrews‬ ‭6:13-20‬ ‭WEB‬‬)

God wanted Abraham to be absolutely sure that He would bless him, so He swore by Himself.

The truth that is impossible for God to lie and His sworn oath gives us a doubly confident hope of receiving His blessing as the seed of Abraham.

When tough times come, just remember that our God who cannot lie has sworn to bless and multiply you, and He is surely doing it.

Even when the world is floundering and men’s hearts are melting because of fear, we can remain stable and unshaken because Jesus is our anchor. He keeps us in shalom peace and leads us to navigate through any storm.

Right now in Heaven, Jesus our high priest is with the Father, praying for us, representing us before the Father.

Whereas the Levitical priesthood under the Law had curses upon those who disobey God’s laws, Jesus’ priesthood after the order of Melchizedek is one that only bestows blessings.

Melchizedek brought the bread and wine to Abraham, and blessed Abraham. In Christ, we are the seed of Abraham, and we can receive God‘s blessings through the same pattern.

Partaking of the Lord’s Supper is such a precious and important time of our day. As we set aside a minute in our day to proclaim the Lord’s death and what that accomplished for us, we benefit from His victory wrought at the cross.

“The cup of blessing which we bless, isn’t it a sharing of the blood of Christ? The bread which we break, isn’t it a sharing of the body of Christ?” (1 Corinthians‬ ‭10:16‬ ‭WEB‬‬)

The apostle Paul called it “the cup of blessing”. Could it be that when we partake, we receive the fulfillment of God’s oath to bless and multiply us? I believe so.

The blood and body of Christ are full of divine life, and when we receive that, we experience close fellowship and identification with Him. This means “I am as You are.” Whatever Jesus is, you also become and have.

If you are not already making the Lord’s Supper the highlight of every day, I encourage you to prioritize this token of Jesus’ love, and see what wonderful things happen in your life!

God has given us many powerful spiritual weapons in Christ that destroy Satanic strongholds, yokes, and bondages. In “Silencing the Serpent”, you will discover how to emerge victorious in spiritual warfare, and be finally set free from cycles of defeat that have perpetuated in your life. Don’t miss it: https://bit.ly/silence-the-serpent-now

https://itnext.io/great-cks-kubernetes-security-exam-preparation-guide-to-help-you-pass-14fe5ab30ce1

本文是作者的心路歷程分享分享文，想要探討什麼是 Certified Kubernetes Security(CKS) Specialist 以及如果要準備這個考試可以如何準備

CKS
1. 根據 CNCF 官網的介紹, CKS 測驗是用來確認 CKS 能夠擁有與掌握如何安全的管理 Kubernetes Clusters，安全的概念包含安全的去處理這些 Container 以及整個 Kubernetes 平台的安全性(建置，部署，運行等所有階段)
2. 考取 CKS 之前要先通過 CKA (Certified Kubernetes Administrator) 的測試
3. Kubernetes 官網上其實有非常多的文件與操作說明， CKS 更像是一個幫助你去挑戰自我，確認自己有能力與知識去處理 k8s 安全相關的設定與操作。

如何準備 CKS
作者列舉了幾個重點概念
1. Docker Image 實作上的最佳實踐
2. 理解下列內容
a. CIS Kube-bench
b. Trivy
c. Sysdig/Falco
d. AppArmor
e. Seccomp
f. OPA/Gatekeeper
3. Linux 基礎理解，特別是 cGroup
4. Kubernetes 架構以及相關元件，譬如 RBAC, NetworkPolicy, PSP 等
5. API Server 相關操作，包含 Admission control, Audit 以及如何除錯

作者於文章後半部分列出了很多文章與影片連結，資源非常豐富，其中還提到 CKS/CKA/CKAD 的模擬器 (https://killer.sh/)，對於該考試有興趣的一定要使用這些資源來練習

最後列出一些純 k8s 的一些考試內容
1. Admission controllers.
請確保你熟悉各種不同類型，如 PodSecurityPolicy,ImagePolicyWebhook 的實作與差異，並一定要知道這些是如何跟 API Server 互動的。
2. Immutable containers
如何使用 securitycontext 創造一個 Immutable 的容器並且避免一些可能會造成 mutable 的操作
3. Network Policy
4. PodSecurityPolicy(隨者 OPA 的發展，這個考試內容將會慢慢的被捨去)
5. gVisor

對於 CKS 考試有興趣的建議看看本篇文章，其中文章內有滿多跟安全相關的影片與文章也都值得閱讀

《DAWN》
君を待つ / Kimi wo Matsu / 等你 / I'll Wait for You
作詞 / Lyricist：aimerrythm
作曲 / Composer：古川貴浩
編曲 / Arranger：玉井健二、大西省吾
歌 / Singer：Aimer
翻譯：夏德爾
English Translation: Thaerin

背景 / Background - 探してた道 - とちちま :
https://www.pixiv.net/artworks/82604893

版權聲明:
本頻道不握有任何音樂所有權，亦無任何營利，一切僅為推廣用途。音樂所有權歸原始創作者所有。請支持正版。

Copyright Info:
Be aware this channel is for promotion purposes only without any illegal profit. All music's ownership belongs to the original creators.
Please support the original creator.

すべての権利は正当な所有者/作成者に帰属します。あなたがこの音楽（または画像）の作成者で、この動画に使用されたくない場合はメッセージまたはこのYoutubeチャンネルの概要のメールアドレスにご連絡ください。私はすぐに削除します。

如果你喜歡我的影片，不妨按下喜歡和訂閱，你的支持就是我創作的最大原動力！
If you like my videos, please click like and subscribe! Thx :)

粉絲團隨時獲得最新訊息！
https://www.facebook.com/chschannel/

Check my Facebook page for more information!
https://www.facebook.com/chschannel/

中文翻譯 / Chinese Translation :
https://home.gamer.com.tw/creationDetail.php?sn=2889359

英文翻譯 / English Translation :
https://www.lyrical-nonsense.com/lyrics/aimer/kimi-wo-matsu/

日文歌詞 / Japanese Lyrics :
さよなら おやすみ いつかまたね
手を振った夕暮れ
どこへ帰るかも分からないまま
ただ　歩いた

冷たい雨から逃げるように
駆け込んだ木陰で 刹那の息をつき
下弦の月 闇に堕ちる

笑った顔は　すぐに思い出せるはずなのに
少しずつ滲んでく 零れ落ちた涙

眠れない夜 見上げた空
揺れる夜光は 身を焦がす
瞳閉じれば 記憶の海
深く沈み 手を伸ばす

幾千年も変わらず 君を待つ

冷たい夜風に 吹かれるまま
騒ぎ立つ葉音に
重ねる言葉も分からないまま
またふるえた

紡いだ花は　すぐに枯れてしまうだけなのに
とめどなく望んでる 壊れ出した 何か

眠れないまま かけた膝
香る闇間に 目を凝らす
後に戻れば 孤独の森
深く潜み 声を断つ

不変の冬の中でも 春を待つ

笑った顔は　すぐに思い出せるはずなのに
少しずつ滲んでく 零れ落ちた涙

眠れない夜 見上げた空
ちりばめられた星屑を指でつないで
十字の鳥 翼求め 手を伸ばす

幾千年も変わらず 君を待つ

中文歌詞 / Chinese Lyrics :
再見、晚安，總有一天再會吧
在揮手離別的黃昏裡
連自己該回去哪裡，也不曉得
僅是這樣走著

像是要逃離冰冷的雨點
在倉促藏身的樹蔭底下，吐出留存剎那的嘆息
而下弦的月，正朝著黑暗墜落

明明，馬上就能想起你的笑容
然而那笑容卻漸漸地模糊，模糊在滾落的淚水之中

在無法入睡的夜晚裡仰望的天空
搖晃夜晚的雷光，擺弄身軀的苦悶
閉上眼，看見的便是記憶的大海
只能深深地沉入海中，對回憶中的你伸出手——

在一如過往的千年好幾中，等待著你

放任自己，被冰冷的晚風吹拂
在那之中，仍然聽不見
聽不見累積在樹葉間隨風騷動的呼喚
身軀也因為寒冷與無助，而再次顫抖

早就知曉，編織的花只會一眨眼地枯萎
卻仍然無止盡地渴求著，那已經開始壞去的，某個事物

在無法入睡而擁抱的膝蓋
凝視那之間瀰漫著香氣的黑暗
若是回首而去，便是孤獨的森林
只好埋身記憶的森林，埋藏那片自責的聲音

即便在這一如往常的冬天，也僅是等待著春天的來到

明明，馬上就能夠想起你的笑容
然而那個笑容，卻在滾落的淚水中漸漸模糊

在無法入睡的夜晚所仰望的天空
用手指，連接被撒開的星塵
勾勒出十字的天鵝，伸出手渴求牠的羽翼——

就這樣在一如往常的千年好幾中，等你

英文歌詞 / English Lyrics :
Farewell… goodnight… see you again sometime…
I waved at twilight.
Not knowing where I would go home to,
I just walked.

In order to escape the chilling rain,
I rushed under a tree’s shadow and let out a moment’s breath,
As a waning moon fell to darkness.

※I expect that I can instantly recall your smiling face,
But it begins to blur with my falling tears…

On sleepless nights, I looked up to the sky,
And the swaying nightglow had me burning with love.
When I close my eyes, it’s a sea of memories –
I sink deep, reaching out my hand…

Thousands of years, without fail, I’ll wait for you.

Blown along by a chilling wind,
I hear the sounds of leaves disturbed –
Unable to understand their amassing words,
My body shakes again.

Flowers that tell their story just end up wilting right away –
I’m ceaselessly wishing for something in the process of breaking down.

Unable to sleep, I was clutching my knees,
As I strained my eyes into the fragrant space of darkness.
If I could later return to that forest of solitude,
I’d delve deep and cut off my voice.

Even amidst and immutable winter, I’ll wait for spring.

※repeat

On sleepless nights, I looked up to the sky,
Connecting the scattered stardust with my fingers,
Seeking the wings of the Swan of the Cross, I reach out my hand…

Thousands of years, without fail, I’ll wait for you.

★Cat Merch! https://crowdmade.com/collections/junskitchen

- THUS WE VENTURED FORTH, seeking the elusive ladybug, so that we may build an army of custodians to ward for all eternity our balcony garden against the immutable blight of aphids

▼For more G100 information.
https://www.panasonic.com/global/consumer/lumix/announcement.html

▼PanasonicLumixVideo channel
https://www.youtube.com/panasoniclumixvideo

▼Lumix Instagram
https://www.instagram.com/lumix/

★ Patreon! http://patreon.com/junskitchen


►FOLLOW US　ε=┌(　･д･)┘
Our Japan channel ⇀ https://www.youtube.com/RachelandJun
Jun's Kitchen ⇀ https://www.youtube.com/JunsKitchen
Twitch ⇀ https://www.twitch.tv/rachelandjun
Twitter | Instagram *@RachelandJun*

►EQUIPMENT (Amazon affiliates links) ＿〆(・∀ ・ )
Camera ⇀ GH5 (http://amzn.to/2GJWsN2)

►MUSIC ♪♪(o*゜∇゜)o～♪♪
Music from Epidemic Sound: http://share.epidemicsound.com/rDvsz

Life has no limits! Get out there and do something new today!
*･゜ﾟ･*:.｡..｡.:*･'ヽ(*^▽^*)ノ'･*:.｡. .｡.:*･゜ﾟ･*

Subtitles are available! Lest Eurasian girl gets paranoid I am speaking ill of her. lol

Original snowflake Millennials video: https://www.facebook.com/millennialsofsingapore/videos/764221640405922/

Related: People are outraged Karlie Kloss wore a kimono for Vogue, claiming cultural appropriation. The Japanese are confused why they are outraged - https://youtu.be/0pXotxxYFlk

Related: Racist Muslim Affairs minister Yaacob Ibrahim says Malays are bad at maths - http://forums.sgclub.com/singapore/no_short_cut_231799.html

Related: Donald Trump did NOT actually mock a disabled reporter - https://youtu.be/5aYFC_7ZIn4

Before we go, some valuable quotes from Ayn Rand: "Today, racism is regarded as a crime if practiced by a majority—but as an inalienable right if practiced by a minority.... Remember also that the smallest minority on earth is the individual. Those who deny individual rights, cannot claim to be defenders of minorities."

JUDGE PEOPLE AS INDIVIDUALS, NOT THEIR RACE. Yes I am aware in this entire video I have addressed the 4 Millennials by their race only. This is because they were SPECIFICALLY chosen to be a part of this video to represent their race and to fulfil the diverse and racially inclusive CIMO quota of Singapore. They are reduced to their race as their immutable identit, not because they are there as qualified individuals by their own virtue. Edna is not there as Edna, Edna is there as "Eurasian girl". If they wish to speak for their racial group, then so be it, I will address you as speaker of your racial group.

Identity politics segregate society. There is no end to segregation, and you end up with the individual anyway - Watch: https://youtu.be/JpIpHOaN16M?t=21m1s