Labels, Labels, Labels
0 likes258 views
The document discusses the importance of using labels in software development for security, simplicity, and documentation. It provides specific examples of label schemas for container images, including details about authors, version control, and build information. Additionally, it outlines how to create and view these labels using Docker and Kubernetes commands.
Labels, Labels, Labels
- 1. Andy Clemenko Labels, Labels, Labels… Senior Solutions Engineer, StackRox @clemenko clemenko [email protected]
- 4. Why Labels? • Security • Simplicity • Self Documenting • Audit Trail
- 5. Label Schema Key = Value • Author • Date • Description • Version • and more…
- 6. Labels for CI? • Source - Version Control • Commit Number • How to build • Where it was built • Build number
- 7. Labels for Security • Build Server • Version Control • Commit Number • How to was built • Build number
- 8. Sample Labels "org.opencontainers.image.authors": "[email protected]", "org.opencontainers.image.source": "https://github.com/clemenko/dc20_labels/tree/master/demo_flask", "org.opencontainers.image.build": "docker build -t clemenko/flask_demo..." , "org.opencontainers.image.build_number": 22, "org.opencontainers.image.build.server": http://jenkins.dockr.life/, ”org.opencontainers.image.commit": "98c997f", "org.opencontainers.image.created": "05/07/20", "org.opencontainers.image.description": "The repository contains a simple flask application.", "org.opencontainers.image.healthz": "/healthz", "org.opencontainers.image.version": "0.1", "org.opencontainers.image.title": "clemenko/flask_demo", "org.zdocker.compose": ... , "org.zdocker.k8s": ...
- 9. Create Labels • Dockerfile • Build Argument • docker build - -label key=value LABEL org.opencontainers.image.authors=$BUILD_SIGNATURE org.opencontainers.image.source="https://github.com/cleme org.opencontainers.image.created=$BUILD_DATE org.opencontainers.image.build_number=$BUILD_NUMBER org.opencontainers.image.commit=$GIT_COMMIT org.opencontainers.image.build.server=$JENKINS_URL org.opencontainers.image.title="clemenko/flask_demo" org.opencontainers.image.description="The repository cont flask --> redis." org.opencontainers.image.version=$BUILD_VERSION org.opencontainers.image.healthz="/healthz"
- 10. View Labels • docker pull; docker inspect • skopeo $ skopeo inspect docker://docker.io/clemenko/flask_demo:prod | jq -r ' { "org.opencontainers.image.authors": "[email protected]", "org.opencontainers.image.build.server": "http://jenkins.dockr.life/ "org.opencontainers.image.build_number": "2", "org.opencontainers.image.commit": "cb03b31", "org.opencontainers.image.created": "05/14/20", "org.opencontainers.image.healthz": "/healthz", "org.opencontainers.image.source": "https://github.com/clemenko/dc20 demo_flask", "org.opencontainers.image.title": "clemenko/flask_demo", "org.opencontainers.image.version": “0.1”…
- 11. Use Labels - k8s $ skopeo inspect docker://docker.io/clemenko/flask_demo:prod | jq -r '.Labels."org.zdocker.k8s"'| base64 -D | kubectl apply -f - namespace/flask created deployment.apps/flask created deployment.apps/mongo created deployment.apps/redis created service/flask created service/redis created service/mongo created ingress.networking.k8s.io/flask created ingressroute.traefik.containo.us/flask-ingressroute created
- 12. DEMO
- 13. Demo Stack ● DigitalOcean - Ubuntu 19.10 VMS ● k3s ● Traefik - Ingress Controller ● Jenkins - CI ● StackRox - Image Scanning and policy