The Advanced Kubernetes Ecosystem

1. 1

   Scale a Kafka consumer on lag with KEDA

   The ScaledObject targets the email consumer Deployment: one replica per 1,000 messages of lag, up to the partition count, and zero when idle.

   apiVersion: keda.sh/v1alpha1
   kind: ScaledObject
   metadata:
     name: email-consumer
   spec:
     scaleTargetRef: { name: email-consumer }
     minReplicaCount: 0
     maxReplicaCount: 12          # = partitions of the topic
     cooldownPeriod: 300
     triggers:
       - type: kafka
         metadata:
           bootstrapServers: shop-kafka-bootstrap.kafka:9092
           consumerGroup: email
           topic: payments
           lagThreshold: "1000"

   terminalcopy cmd

   $ kubectl get scaledobject email-consumer; kubectl get hpa keda-hpa-email-consumer

   ── expected output ──

   NAME SCALETARGETKIND SCALETARGETNAME MIN MAX READY ACTIVE

   email-consumer apps/v1.Deployment email-consumer 0 12 True True

   NAME REFERENCE TARGETS MINPODS MAXPODS REPLICAS

   keda-hpa-email-consumer Deployment/email-consumer 4200/1k (avg) 1 12 5

2. 2

   Check for deprecated APIs before an upgrade

   pluto scans live clusters and Helm releases for APIs removed in the target version.

   terminalcopy cmd

   $ pluto detect-all-in-cluster --target-versions k8s=v1.34.0 -o wide

   ── expected output ──

   NAME NAMESPACE KIND VERSION REPLACEMENT DEPRECATED REMOVED

   shop-hpa catalog HorizontalPodAutoscaler autoscaling/v2beta2 autoscaling/v2 true true

3. 3

   A Falco rule for shells in production

   Falco ships a similar default rule; this custom version scopes it to ShopLite's prod namespaces and raises priority.

   - rule: Shell in ShopLite production container
     desc: A shell was started inside a production workload container
     condition: >
       spawned_process and container and proc.name in (bash, sh, zsh)
       and k8s.ns.name startswith "shoplite-prod"
     output: >
       Shell in prod (user=%user.name pod=%k8s.pod.name ns=%k8s.ns.name
       cmd=%proc.cmdline image=%container.image.repository)
     priority: CRITICAL
     tags: [shoplite, mitre_execution]

Each drill is a real failure mode. Read the scenario and the output, decide what's wrong, then reveal the diagnosis.