►
From YouTube: Pushing Mongo: How You Can Use Eirini, CSI, and k8sbroker to Skate Like a Clown - Julian Hjortshoj
Description
Pushing Mongo: How You Can Use Eirini, CSI, and k8sbroker to Skate Like a Clown - Julian Hjortshoj, Dell EMC
"Pushing Mongo” is skater slang for kicking with the wrong foot. Urban Dictionary defines it as “a stupid way to skateboard.” The cloud native community agrees. Pushing your stateful services to Cloud Foundry is generally accepted to be an anti-pattern, and if you feel like doing it, you’re wrong. But what if you still feel like doing it? In the past, we haven’t been able to push databases to Cloud Foundry because the Diego scheduler favors high availability, and doesn’t provide the requisite guarantees needed to offer single-attach or block storage. But Cloud Foundry running with Eirini no longer uses Diego. In this talk, we will demonstrate how Project Eirini allows us to provision and attach block storage to our containerized workloads and yes, to “cf push” MongoDB. What could possibly go wrong?
For more info: https://www.cloudfoundry.org/
A
Welcome
everyone.
Thank
you
for
coming
my
talk
about
pushing,
and
this
was
the
title
as
I
wrote
it
in
the
abstract,
but
that's
not
that
long,
but
we
I
wrote
the
abstract
quite
a
while
ago.
So
since
then,
well,
we
didn't
get
around
to
using
CSI.
So,
but
we
are
going
to
talk
about
mutating
webhooks
quite
a
bit
and
Kate's
Broker
isn't
really
a
thing
anymore.
That
was
this
experimental
thing
and
it
was
very
poorly
and
generically
named.
It's
been
since
replaced
by
the
suzay
folks
with
something
called
a
Rainey
Percy.
A
A
So
now
that
we've
got
the
name
figured
out,
my
name
is
julian
yard.
So
I
I
work
for
the
CTO
office
at
Dell
EMC,
but
I'm.
Also,
the
PM
of
the
Cloud
Foundry
volume,
Services
team
and
when
I
was
trying
to
figure
out
the
abstract
for
this
talk
and
what
to
submit
I
win
googled,
pushing
hoping
to
find
some
juicy
quote
about
how
this
would
be
an
idiotic
thing
to
do,
and
you
shouldn't
do
it
turns
out.
A
It's
not
really
a
thing,
except
in
the
skating
community,
where
pushing
means
kicking
with
your
front
foot
instead
of
your
back
foot,
which
I
guess
I'm
not
really
skater,
so
I
don't
really
know,
but
this
makes
you
look
incredibly
stupid.
So
not
what
I
was
looking
for,
but
I
thought
made
a
great
metaphor
for
what
we're
doing
here.
A
A
You
can
use
it
with
any
Cloud
Foundry
and
what
this
thing
is
is
you
know
basically
the
binary
plus
a
little
bit
of
start
script
that
goes
and
tries
to
find
which
would
store
stuff
and
mysteriously
refused
to
listen
on
all
IP
addresses
and
we'd.
Everybody
know
what
IP
address
we
were
gonna
be
so
I,
rather
than
worry
about
why
that
was.
We
threw
so
caddy
in
there
to
listen
on
all
the
IP
addresses
and
port
forward
to,
and
that's
that's
it.
So
how
does
this
work
when
we
push
it.
A
A
Basically,
now
I
see
I
have
two
of
these
things.
It
believes
they're
both
running
if
I
connect
to
it.
It
looks
like
it
connected.
So,
okay,
if
I
connect
to
it
again,
whoo
yeah,
so
we
got
a
load
balance
to
the
other
one
and
that
one
is
sad:
it's
not
starting
up
because
of
rocks
and
junk.
So
there
isn't
really
a
good
solution
for
this
and
Cloud
Foundry
heritage
or
whatever
we're
calling
it.
A
You
know
Cloud
Foundry
on
Diego,
because
you
know
we
could
kind
of
put
some
hacks
in
and
say
oh
well,
on
my
second
instance
to
use
the
instance
index
environment
variable
so
that
it
stores
it
stuff
in
a
different
subdirectory
or
something
like
that.
But
Diego
doesn't
really
give
us
any
guarantees
that
it's
only
gonna
start
one
of
our
instances
like,
for
instance,
if
you're
deploying
a
new
version
of
Cloud
Foundry
and
your
cell
is
evacuating
Diego's
gonna
helpfully
start
up
other
instances
on
a
different
cell
before
it
tears
down
your
instances.
A
Now
you've
got
two
instances:
they
both
think
they're
instance
index
zero
and
they're
gonna,
run
into
the
same
kinds
of
problems
and
data,
corruption
and
bad
things
right
so
also
shared
volumes,
NFS,
yes
and
B.
Those
kinds
of
protocols
are
not
very
performant
and
not
typically
like
people,
don't
use
them
for
databases
because
they
don't
scale
they
don't
perform.
So
what
do
we
need
to
solve
this?
We
need
single,
attach
block
storage.
This
is
how
all
this
stuff
is
typically
laid
out
when
it's
deployed
as
a
service.
A
It's
what
Bosh
does,
for
example,
so
to
get
that
with
Cloud
Foundry.
We
need
all
of
these.
Things
need
Guarini
rainy
acts,
the
rainy
percy
and
that'll
mostly
get
us
there.
So
what
are
these
things?
But
you
probably
know
what
arena
is
already
if
you've
been
unless
you've
been
asleep
for
two
years
or
something,
but
arena
is
essentially
an
alternate
schedule
that
schedules
Cloud,
Foundry
workloads
on
to
kubernetes
instead
of
diego
rainy
x,
is
this
cool
new
library.
You
can
hear
about
it
in
depth
that
I
think
it's
like
around
three
o'clock
there.
A
This
Tuesday
folks
are
gonna,
give
a
better
talk
about
it.
This
is
a
base.
Library
that
allows
us
to
add
extensions
to
Irini
by
installing
these
things
called
mutating
web
hooks
into
kubernetes
mutating
web
hook
is
something
that
sits
at
the
kubernetes
api
and
gives
us
the
opportunity
to
take
things
that
are
just
about
to
head
into
kubernetes
and
twist
them
a
little
bit
and
arena.
A
Percy
is
an
instance
of
an
arena
axe
plug-in
that
intercepts
pods
and
inserts
persistent
volume
claims
into
the
pods
and
there's
an
Associated
araignee
percy
broker
that
when
you
bind
a
service
to
an
app
will
create
a
PVC
and
then
remember
the
name
of
that
PVC,
so
that
it
knows
what
to
inject
into
your
pod
when
your
pod
starts
up.
So
this
sounds
about
right
right.
This
is
what
we
need
more
or
less.
A
Hopefully,
our
original
volume
service,
POC
that
we
did
back
year
or
so
ago,
was
using
NFS
when
the
suzay
folks
kind
of
pulled
that
out,
tease
that
out
and
built
it
into
a
rainy
percy.
They,
for
whatever
reason,
switched
it
to
use
single,
attach
block
storage,
so
cool
one
less
thing.
We
have
to
worry
about:
we've
already
got
block
storage,
so
so
we're
good
right
now.
So
the
problem,
of
course,
is
single.
Attach
block
storage
only
attaches
to
a
single
instance.
A
So
if
you
scale
this
thing
up,
that
mechanism
is
going
to
intercept
the
first
pod
in
your
stateful
set
when
it
starts
up
and
attach
the
BBC
to
it,
and
that
one
will
be
cool.
It
has
a
device
and
then,
when
you
start
up
the
second
instance,
unless
you're
just
on
a
couplet
with
only
one
worker,
you
get
some
error.
That
looks
like
this
right.
A
A
So
there
has
to
be
a
way
to
do
this
right
and
there
is-
and
this
is
kind
of
what
it
looks
like
we
in
arena
already
used
stateful
sets,
but
this
is
also
typically
what
people
would
use
for
a
stateful
application
with
multiple
instances
and
rather
than
a
persistent
volume
claim
the
stateful
set.
Has
this
thing
called
a
volume
claim
template
which
kind
of
means
like
okay,
we're
not
going
to
make
the
volume
claims
right
away,
but
we're
gonna
associate
them
to
they.
A
We
then
changed
to
Rainey
Percy
so
that
it
matched
the
new
interface
that
has
a
stateful
set
instead
of
a
pod,
and
we
hacked
that
up
so
that
any
time
it
sees
a
volume
mount,
it
goes
and
puts
one
of
these
volume
claim
templates
in.
We
didn't
do
the
careful
plumbing
where
you
get
to
decide
what
their
volume
claim
template
looks
like,
but
that's
kind
of
exercise
left
for
later,
but
but
the
gist
is
we
put.
A
A
So
if
we
go
look
at
the
marketplace
here
and
see,
we've
got
a
nice
arena,
Percy
broker.
We
didn't
actually
change
this,
so
it's
still
making
a
PVC
when
we
create
a
service
instance.
We
just
don't
use
it
because
it
wasn't
really
necessary
for
our
experiment
so
see.
We've
created
a
service
instance
so
now
we're
pushing
we're
making
two
of
it.
A
A
A
So
now,
if
I
go
look
in
kubernetes
at
the
PVCs
that
have
been
created
and
specifically
the
ones
for
CF
workloads,
you
could
see
there
are
three
of
them.
The
one
is
the
one
that
arena
Percy
broker
originally
created
and
the
other
two
are
the
ones
that
were
actually
using
that
were
created
by
the
volume
claim,
template
and.
A
But
you
can
see
here's
my
two
running
instances
and
I
can
use
coop
control
to
get
the
IP
addresses
for
those
and
then
because
this
is
Google's
cloud
I
can
get
to
my
pods
from
anywhere
inside
that
network.
So
so,
in
this
case
we're
going
to
just
SSH
into
the
router
the
which
will
then
have
access
to
that
10.40
for
network.
A
So
here
we're
just
connecting
to
that
specific
IP
address
and
then
because
we're
talking
directly
to
the
pod,
it's
actually
listening
on
port
8080,
which
is
where
a
Cloud
Foundry
wants
it
listening.
So
you
can
see
here
we're
in
the
shell,
so
cool
we've
got
a
database.
We
can
insert
something
into
it.
A
So,
theoretically,
we
ought
to
be
able
to
find
our
record
here
right.
So
no
so
the
problem
here,
of
course,
is
we've
got
two
instances
of
they
both
have
their
own
block
storage
they're,
both
relatively
happy.
They
know
nothing
about
one
another
right
haven't
done
anything
all
we're
doing
is
running
so
not
going
to
magically
understand
that
they
have
a
buddy
so
so
to
solve
that
we
need
to
set
up
a
cluster
right.
We
have
to
somehow
tell
that
it's
running
in
a
replica
set-
and
here
are
your
other
things-
said
to
cut
that
working.
A
A
A
A
A
A
A
There's
been
rumblings
at
various
times
about
using
replica
sets
instead
of
stateful
sets.
If
we
were
to
do
that,
then
we
wouldn't
be
able
to
use
volume
claim
templates,
so
that
could
happen.
This
is
also
provisioning
volumes
at
CF
start
time.
So
I'm
starting
up
my
app
the
normal
expectation
cloud
boundaries,
that's
going
to
be
real,
quick,
but
now
all
of
a
sudden
I'm
doing
this
block
device
provisioning
thing
right
in
the
middle
of
the
start
flow.
A
A
The
bigger
disclaimer
is
that
we're
using
mutating
web
hooks
for
this
and
for
vini
acts
and
I
still
a
beta
feature.
It's
kind
of
a
dangerous
beta
feature
that
allows
you
to
you
know
essentially
call
into
a
void,
pointer
and
totally
change.
What
somebody
asked
you
to
do
and
there's
disclaimers
on
it,
saying
that,
like
the
stuff
that
you
do
with
your
mutating,
Meg
webhook
today
might
not
be
possible
tomorrow,
because
you
know
we
might
decide
that
it
was
a
bad
idea.
After
all,
so
maybe
it's
fine.
A
Choirs
really
requires
TCP
routing
in
order
to
work
which
we
don't
have
yet
but
I'm,
confident
that
eventually
that'll
happen
and,
on
the
back
end
we're
doing
this
kind
of
reach
around
the
sidecar.
We
added
to
go
set
the
things
out.
Then
a
cluster
is
finding
out
about
the
cluster
by
calling
back
out
into
the
kubernetes
api
and
that
for
Cloud
Foundry
apps
is
kind
of
a
no-no.
A
You
know,
for
starters,
it's
not
really
CF
pushing
if
you're
doing
kubernetes
things
after
UCF
bush
right
I
mean
we
could
just
as
well
see
I've
pushed
something
that
does
a
coop
cuddle,
apply
and,
and
also
normally
in
Rini,
when
we're
starting
up
pods.
There's
this
auto
mount
service
account
token
thing
which
is
set
to
false,
which
kind
of
says
yeah
we're
not
going
to
give
you
the
credentials.
You
need
in
your
Cloud
Foundry
app
to
go
talk
to
the
kubernetes
api.
A
I
mean
this
kind
of
basic
bread-and-butter
stuff,
but
you
know
that's
it.
That's
it
for
the
those
are
the
only
copy
odds.
So
so
just
a
few,
so
you
know
that's
that's
about
the
size
of
it
I.
You
know
I
think.
Ultimately,
this
exercise
was
less
about
and
more
about
what,
if
you
have
a
nap
workload
that
maybe
wants
to
do
block
device
things
or
single
attached
storage
things,
because
you've
got
a
lot
of
data
I.
A
Think
there's
a
lot
of
you
know
less
obviously
wrong
use
cases
that
may
still
want
to
consume
single
attached,
storage
and
I.
Think
that's
one
of
the
things
that
we're
starting
to
think
about,
as
we
start
to
think
about
like
what
does
it
mean
to
run
Cloud
Foundry
on
top
of
kubernetes
this?
What
are
those
workloads
that
that
we
couldn't
really
address
before
that?
We
might
be
able
to
expand
out
into.
A
So
all
of
this
delightful
code
that
I've
been
showing
you
is
available
on
github,
both
flavors
of
the
push
app
and
then
all
of
the
various
hacks.
It's
by
no
means
production-ready
or
probably
won't
even
work
when
you
first
pick
it
up,
because
if
there's
a
few
things
hard-coded.
But
but
it's
there
to
be
played
with.
If
you
so
desire
and
having
said
that
there
were
any
questions.