Cloud Native Computing Foundation CNCF Webinars, 20 Mar 2018

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Webinar: Writing Less YAML – Using jsonnet and kubecfg to Manage Kubernetes Resources

Description

Using YAML and kubectl is an easy way to describe simple Kubernetes workloads, but the devil is in the detail when you want to change “just” a few bits here and there to accommodate for multiple different environments, CI/CD pipelines and so on. Kubernetes users have quickly encountered the “face full of YAML” problem and need better solutions to manage their application manifests.

In this webinar, we’ll look at how jsonnet can help create declarative manifests, using its features like modularity, lazy evaluation, etc. to allow using common templates and derived manifest trees. Additionally we’ll explore the features provided by kubecfg CLI tool to ease interacting with Kubernetes directly from these jsonnet files and/or stock YAML manifests.
Join us for KubeCon + CloudNativeCon in Barcelona May 20 - 23, Shanghai June 24 - 26, and San Diego November 18 - 21! Learn more at https://kubecon.io. The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy and all of the other CNCF-hosted projects.

A

So welcome everyone. My name is Deirdre wretzky I am a developer, dedicated cloud native computing foundation and arm together. Today we is Kaitlyn about not who is integrated marketing specialist at cloud native computing foundation. Who will help us with the webinar driver, and today we will speak about the best practices of his and chaser net and keep config to manage Panetta's environments as a cold. Our presenter today is one Tara want a senior at bitNami and also he's a certified. It is administrative, so one more if you are ready to start go ahead. Please thank.

B

You very much here thanks everyone for joining in the copy. You can hear me well and I hope her will be taking care of your questions. So please do so. If you have any Dobbs I'm speaking.

A

From Melissa yeah yeah, just just one note about the Q&A section and I'm sort of interrupted, so we will hold around 10 or 15 minutes at the end of the webinar to cover your Q&A. If you cover your questions at the end, I'm sort of interested thank.

B

You indeed so I'm speaking from mendoza argentina near the end, this beautiful Andes Mountains autumn autumn is starting to pop up here. So it's pretty cool. um So what were we talking about? Creating your kubernetes manifest is ingesting it on applying them, live with cube, CFG zeolite, its dissolved main topics for today, and indeed work in a similar 3-4 vietname. That's the main motivation. We kinda start to share with new folks what all the goodness to say that this is tool. Scott's brother brought us in our day to day level for workflows.

B

If you worry about banana, if you don't know us, we packaged application for all the major cloud providers that he said that we as Google Asia. We talked about 150, open source application, will package and publish them into their map marked places. We also be a standalone VM image, docking containers and so on, and we have contributed with many production-ready hun charts and keep doing so. Also, we recently launched an enterprise resolution calls Dartmouth, would captured us out knowledge number practices on packaging application.

B

The whole companies with moving were lost because in communities itself we have many projects in the community ecosystem. Give ups cubes essentially, is an in cluster application that you can deploy. It includes home, charts dashboard that you can use to browse um and deploy on deploy your charts in your classroom cumulus our Cuban. It is native several s platform cultures. Indeed, as US as I mentioned, give CFD. That will be the main focus.

B

One of the main focus of this talk and then see the secrets, this a pretty cool project where you can use public crypto to handle your secrets in the clear that means. That, indeed, means having your secrets, for example, committee into your own source, called repose, so more or less it agenda. So we will try to frame the scope of this talk and then essentially, the the table will be kind of couple parts. One will be talking about: JSON I deserved language apply to kubernetes, manifests and then how?

B

How can we we can use Q CFG to take advantage of it so for Cuban, nudists I, guess that you ran out yeah manifest you may have used helm in the past is right to to use more templated way to deploy them.

B

So we know that llamo manifests are not really declared of tip by design. This is the holy sign behind kubernetes under its controllers.

B

Indeed, with people use them to describe work, our workloads, usually we we talk about this as infrastructure as code, but actually there is a link there in the slides that you will cover this infrastructure of software. From the point of view that you upload what you want to be the state of of worldwide, you want to express in your manifest and then the Cuban is controller, with the will take care of the actual work blows, respecting or following that young.

B

That's sorry that the manifest, but then the question comes on. Writing the manifest themselves, and there is where there is that's the place where infrastructure, as called half assist place. How, for example, I'm sure that you have faced the situation where you have the same application deployed in different environments, typically staging on production, and there are a few difference between these two that's a few and then the key there. The question is how you handle this difference. Do you have a common template that you replace by some shell scripting?

B

Do you actually use some language to try to template ice them, so the focus of this talk will be talking about one of these options. Doing this using json it um by the way. Also in in this scope of application deployment projects, there are kind of 60-something entries got it are. I don't recall his something: has a very cool spreadsheet there with with indeed more sixty something or is there more or less, the players in this space are indeed calm.

B

K compose that is more oriented to people coming from the doctor wall kept the old case on it. This actually was a project together with, within that with bitNami what we will be talking today. I bananas key of g FG using json it um by the way. Indeed, if you see case annette and keep CFG, they have a common root.

B

Essentially this was the same project up to was september past year, and then they diverged it a bit regarding the approach on how to describe your manifest, we will mention something about this in the next slides. So sorry, for that top, this seems to be some something regarding my full screen at replicas thing, be there on the left so just mentioned this is this is kind of common yeah Mel manifest? Well, you see their kind deployment.

B

We with feels like, for example, metadata labels, and so one thing to keep in mind here that you see a lot of repetition, and this is kind of a common pattern.

B

When you describe your manifest, you will see that you are repeating, for example, some you want to name their to deployment some way, my nginx in this case, but you also want to create a label that casts that is up with the same value and also you want the bots to have the same label and also, of course, the the probe needs to know about the labels of the posts to be able to control them, and so we needs to have the match labels to match the labels here.

B

So there is kind of a lot of using this from a point of view of template, you need to trying to come up with variables. You see a lot of repetition that will be achievable by some kind of more powerful language than yellow by the way, just to mention yeah Mel does have Alice's, we I have seen them in the past the. If you see the yellow specification, you can actually create some kind of variables that are called Isis yeah, but they just stop there.

B

You cannot yes against the string or maybe a piece of structure, but there is not much much more than you can so keeping in mind this I'm going to switch into home, I'd I, don't know how much keen eye are you on hand, but just to do a brief introduction. Helm is what is called the package manager for kubernetes.

B

Essentially, the approach of helm is having an in cluster deployment is called tiller. That will handle your. You will talk to tiller, to be able to to to deploy or warlow's and indeed has a way to template eyes. All these manifests deployments, config maps on and what not, in a way like this I'm going to switch between the two screens just to highlight the. How hum template takes? What's the approach from there, as you can see, it has replaced at all.

B

This can fix it values that we have in a universe, something that is written in, go templates. You can see the braces there. These couple braces is this: go template, lingo and indeed the approach taken by him is to have a common template that will have all these replaceable values express it on the root of these common templates. I mentioned this because this is exactly the opposite. Take of JSON it from the point of view that in helm, your template needs to know about everything that must be replaceable.

B

For example, there down there, you can see the content important in the context of engine exits audience. But let's say this was the says: the application will have the power of configurable. Indeed, engineers have it be a command-line argument. If you wanted a part to be different than eight, then you will need in the common template.

B

You will need to actually create the space for this variable with this template a limitation so that later, when you materialize this deployment, you will be able to overwrite the default value, and this is the main difference in Jason Jason it, as as we will see you start with an opinionated, very small, original template, and you have the capability to override these values at rendering time to say.

B

The next slice- and we will stop here for a moment to describe what we see by the way just a question here. Do you see my my mouse pointer? Yes, we can see it awesome cool, because if I click it will switch to the next slide, so I wanted to be sure.

A

B

Thank you so um here you can see, this will be more or less equivalent of what we seen in the in the previous slide, because what we we saw, the plane Yambol we saw the templated approached by hum here we see a kind of a very different beast on the on the right. You see something is called cube. The prime ended lips on it that Potenza to tackle what would what would be common fields in in a kubernetes deployment.

B

As you can see, there is nothing specific here to nginx but kind of places, places where we can override this just a beast of JSON it here, so essentially JSON ID. You can think of an adjacent that can be programmable to say you can see several difference here. The one that spot at first is that the left side of the column does not need to be a pot string.

B

Essentially, as you can see, for example, API version is not what that kind is not cotton. If this was a JSON this product, and then you can certainly see these dollar things, um just keep in mind that these braces aren't, let's say natural Jason, Jason braces they're, not strictly part of the layout of language, how this works. So essentially you can. You can see I created here, nginx based a sonnet that imports from this deployment, and then it overrides some values here, like name and container this name I'm container. Here they are replaced.

B

They they actually deserve values for this fields, as you can see, name, double column, container double column, so that when at render time they will have the value that I specify here how you fill up the actual template. With these you can. You can see, for example, dollar dots name. This is not. The type is not.

B

Dollar name is dollar dot, name, because dollar refers to the root of the object like whether I have the mouse here, so dollar dot name will be indeed the field that is from the root called name and so called container. You can also see some interesting construction here. This Annette has what is called the lazy evaluation like late evaluation, and you can see here's that even even defining containers here that will be the list of containers that we want to deploy.

B

We can do a late of a right, but the name provided by the actual file Dallas. That is important this. So all this resolution of this variable will happen late after after the this is imported and then and then Leslie root, result.

B

Here are some some annotated things, so dollar name points there and then you can see in different colors like, for example, light blue. You can see dollar dot metadata at labels pointing to metadata labels here, and so, as we talked when we saw the original yum all template that we were repeating a lot of fields there, you can see how how Jason it tackles this by the way I'd mentioned, but Jason eighteen is not really is agnostic.

B

Regarding the the scope of what you do, you want to use the language for is not that is meant to be used for kubernetes. This happens that you can. You can express your your manifest in jason for kubernetes, but, for example, in vietname we use we use Jason L, for example, to build a graph Anna dashboards to Bill premises, configuration that obviously their lingo, that the struct the schema is, is not a quality scheme I, something that is application.

B

Specific I will use all these features of being able to create a template and then do elate elate replacement and raishin of the fields.

B

You can see here this will be when we do the demo in the last part of a dog. How are we show this again, but essentially taking going back so I will take this nginx bass that Jason it that imports the cube deployment deep station it's from here and then you can see the output from a couple of tools. There is indeed a JSON it CLI that will essentially evaluate your JSON it, and you see the output of this is Jason, so in this JSON it can only Apple Jason.

B

Maybe string of Yama with pieces of Jason inside I cannot output Yama. We will see that q CFG the sea level. We will talk in today, indeed curve by default, as output Yemen and this yellow output, it's mostly equal, if not completely equal to the template we saw we were originally so they're.

B

Following up on on on this, you can see how this works. Of course, we can do multiple imports by the way I didn't change at the right. I didn't change the quick deployment that lips on it. There.

A

B

The same that we we were occurring since couple styles before we see that nginx space imports from Cuba planning here and define some opinionated opinionated BIOS, for what would be my engine expert deployment, it will be I put their name but a container. I I used a specific image because it's the image that I'm working with and at this very moment and then you can see him again like by creating another file. You can import from here and you can overwrite things like, for example, the name. Indeed.

B

This would be my engine action instead of being and you next place and then I will overload with replicas equals to. As you can see, we stop here. If you search replicas anywhere else in the screen, you won't find them, and this is pretty cool because and that's the whole point be behind not not needing to inflate your original manifest. So this this template manifest.

B

You can express whatever opinions there. You have over cities in in deployments. You can express things like, for example, Mac, Mac's, sewers or Macs and available balls. When you want you to a deployment update- and you can certainly opinionate this but you're free from overloading this later later, while doing the evaluation you see, indeed that replicas was not present originally, of course, I need to know how the scheme of what I am what I'm working with in this particular case. I, do know that this is a kubernetes deployment, replicas goals in specs file.

B

By the way, there is something subtle here you can see: spec plus column. This is a language construct. Indeed, if I didn't put that plus here, essentially, you can imagine what would happen. Spec will become just replicas equal to completely ignoring what I'm calling from the specs on the right. So this spec plus is a language construct to kind that smells kind of object-oriented, essentially I kind of deriving this deriving these from the based spec and an overloading it with this particular field, which is particular value doing the same as we did some slides before.

B

If we do the JSON at or keep CFC show, of course, you can see the new fields here and in particular you see by the way these are. These are actual screen. Captures are pasted here. You can see that everywhere the my nginx name is present like in the name of the deployment itself, but also all the labels all the way down, and also, of course, the replicas overloading and the same in the young output provided by cube. Cfc show I'm going back just to just to show the difference just to do recall.

B

This was originally one day where you can see nginx base everywhere there with no replicas and then now we have these overloaded. By these.

B

Now that we have seen a bit of Jason ed, we're just to to kind of better describe it. Indeed, Jason is his language language, created by Google as a kind of Jason like programming. Language Smuggler's is deterministic, for example, and indeed is a very it's indeed oriented to create Jason outputs, for example, there is no printf to say is declarative. There is no being deterministic also, you cannot say, for example, creative random values, so it's indeed by design done in a way such as provided with the same inputs.

B

It will always give the same output, because it's an STD leap, standard library, it's pretty powerful you when you're going to start working with more than suggesting it. You will see that you will need things like, for example. Give me all the keys of, for example, I want all the values here here you may have.

B

You may have not metadata, or maybe labels here, give me give me all the fields, the keys for all the labels, and then you will have the labels name or maybe all the values, because you want to you want to derive something from that. So this kind of things that you have in a standard library are pretty powerful and, as we mentioned, it's not restricted to 20 particular use.

B

Anything that can eat Jason can be expressed in adjacent and I will mention couple C lies here: Jason, it's a lie that is pure Jason until I saw you provide it with a single decent file and will indeed do the rendering and give you a JSON output does not do any schema validation, as at the at the moment, compare it with clip CFG Cilla you can, you can think of keep CFG CLI as a Jason net inflated with with quani this knowledge schema knowledge and and being able to talk to the API, or maybe you can put the other way, it's kind of cube, CTL but augmented with Jason net capabilities.

B

So essentially, indeed, it passes Jason files and to yum below or Jason to construct. Kubernetes manifest is written in gold and you can you can get it from there by the way. All these tools, of course, are, as you can see there are. The links are all open source and you can download it. Don't download them all or maybe even a binary, build.

B

Now go more into the scope of this talk, usually you will which seen so far. Essentially we were playing with three files. We created something that is called cube deployment that Lipson either it wasn't an agnostic deployment with no particular things and we have nginx place and then with is my nginx. But usually there is a point where you have this kind of this levels of group of indirection of templating. With a couple of common template, you define your service in this case would be nginx place, for example, and here you want to do.

B

You want to differentiate between staging and production and I'd like to hear some interesting things as as we talked before, these are the same replicas overloading. But, as you can see, you are free here in the final rendering to overload whatever you want, for example, for on the right for nginx production.

B

Your tree may want to be more strict regarding run a rolling update strategy to provide, say something like marks unavailable 10%, so that when you do rolling update when you do something like keeps it it'll apply or as we will see something like cubes CFG update, your only allow 10% of your pots to be unavailable. You allow that percentage of search that is exposed in the deployment you are making diff you, you put different number of replicas for staging on production and again I want to highlight here.

B

This dis construct see how we again we augment metadata by the namespace, and in this case this is pretty powerful from the point of view that allows you much freedom regarding how you want to tackle, in this particular case, staging versus production, depending on on how you work, for example, you may want to have in this case we'll we are selecting different namespace. We are doing a pub staging up production of our different namespace with the same name, but you may want to do actually the opposite. You may want to use.

B

You may be forced to use same namespace item and you may need to use use a different name for production versus staging, and essentially this is just a way you will this, how you will write your this final JSON files here, a quick kind of trying trying to compare now down talking about the QCF g-give CFG CLI, you see, that's not replaced if CTL is not is not meant to be so, but indeed it provides. Some cool features features like we would see during the demo.

B

Essentially, there are more or less the birds that we will see. Just put us in context, give CFG update, and then you provide the file is more or less equivalent to keep CTL apply, and actually it will create resource it will it will stretch your souls apply the patch it's over existing to to operate the resource you are referring to.

B

One very interesting thing here is that in cube, CFG can also operate on a sonnet, but also on ya Milles. So, even if you don't switch or maybe auntie, if you move your, your your manifest to Jason that you can still use, gives power to those things like update like showing the diff against around deployment delete. This is more or less equivalent, and then things like validate this is pretty powerful.

B

For example, when you build sea ice pipelines, the fact, for example, to be able to do a validation before going for an update so that in the scissors you have a Jenkins pipeline to deploy your workflows and then in one of the stages of your pile and you will you do qcg validate and then, of course, stop. If it doesn't pass validation.

B

I wonder if there are any any doubts about Jason head I, guess that there may be many, but something that is blocking you folks, from from more or less grasping the scope of of Jason it does we just before we move to the more demo demo moment with cube CFG.

B

Okay, cool so essentially, I have here more or less the same, the same fighter that I described there in the slides. You can see.

B

Here, but why come it's nice to beam already? Has Jason it syntax, colitis, all's else, videos.

B

So, let's see how Hollywood look so indeed, ax will essentially more or less at least on stars. The demo repeat what we saw during the slides, the see how this works by the way. This will fail. Indeed, and I want to stop here for a moment. So, as you can see, this will fail. Indeed, if this is more or less the same as trying to stand shade, a class with with real tall beautiful component.

B

So you have to need to in meant something because you cannot move forward, and this is written here in the in the in the in this lip sonnet template. Indeed, there is an error. This is part part of the language, and indeed it will stop. If it does not have a value here doesn't have value, as you can see, is referring to a value, but it's not providing that value, no name, neither container another thing I didn't mention, but it's pretty important. You can see it switch yourself to read in a kubernetes manifest.

B

We do know that this feels this manifest at the API version, but is it not so there is no name or container filled at the root of the kubernetes manifest so Jason it provides. Is this very, very convenient way of describing this this double column? This other common is a place. Indeed is a field that can be evaluated on lightly I've already provided value, but will not appear in the output so that, for example, this is more or less more or less equivalent of what what would be arguments to this.

B

This class is not exactly that, because you can also build functions. We have many of them with with J's net, but it behaves like if these were the main arguments for this function. That is not for this class I would say if you see how this works, if you see in the next base, you will see the indeed does satisfy the fact of providing a name and providing container was what the best class to say was was requiring so that, indeed, as this guy previously failed, this guy will not. This guy would actually provide.

B

An output, hopefully a valid output.

B

By the way, I said, hopefully, because we are using JSON here, this is agnostic. You can write whatever you like here. We are just in the scope of kubernetes, manifest The Seeker with those when you, when we do cube CFG. So you will see that you see indeed that by default it does yeah I'm, also much more friendly to our human eyes. Llamo.

B

Another thing that we can do here is keep CFG validate. This will indeed talk to a cornet when it is API endpoint and indeed it does require equal, a valid life kubernetes api endpoint, because it will fetch the schema and validate that all the fields right I have. There are indeed solid.

B

You can see it went well. This is the kind of thing I was I was mentioned regarding building your your CI pipeline.

B

If we go further or recall that we have nginx production Jason it that imports nginx space and overrides and feels in the same way, of course, you can do sorry, you can show and you can build a.

B

um One interesting thing that we we use, we use when we deplore the sea ice, is being able to even able to assess the final rendering differences, because the thing is that I'm going to introduce here, another example will be easy to follow. This is this is an example that author brings in.

B

Let me do a comparison here by the way these are this is this is VI.

B

So the difference here this is nginx production- be to these things here is that we we already have the deploy, but now we include another thing, a config that inherits from cube config. That is a variable that has been filled up with a cube. Config map lives on it, as you can guess, keep config model son is essentially the same tangle. We did with cube deployment that that lives on and trying to come up with simple, very simple but valid template for for config map for granese compliment here. You can see something.

B

Interesting is the fact that this is quite a different object here you can see on the left. This is the one we were playing with in the slides. This is essentially single objects, a single map, a single- if you want dictionary that will that will be indeed a deployment with his name and blah with all the substitutions.

B

This is quite different, because this is a map, a dictionary with several keys here you can see the keys deployed, I could I could have chosen any and any key, but the thing this construct, as you can see this deploy, feel, has the value that is the nginx apply coming from nginx place that then I override with with what I wants there, the new things that I have here.

B

If you have played before with your with volume months, you know, you know that you can for config maps, you can mount it as volume, they will appear as a directory with each of the concrete Maquis being a file there, and this is what we are doing here in this particular case below we have a config map. We will take a look in a few, but here the difference is that we are doing this volume mount.

B

We are calling it with something what we can refer to later and we're mounting exactly on the path where the service part in particular nginx, expects the index sorry their assets to be, and then we are referring. We are referring here from inside the container. Again, we call that in the original in all the previous lip sonnet, there was no mention of any volume months. We am. We are building it late on the evaluation on the evaluation, pile on that again.

B

Stop for me, that's that's kind of my blog, some goodies from from here, for example, here we we may manually made this body human name to match the balloons is this is required for for kubernetes. You know that this is these. Are the volumes expect for the pot and one this container to mount to mount this particular volume? But, for example, here, as you can see, counted map is using again jason'll construct to go there and refer to it by the by its replacement.

B

You see here that you have the config map that has this particular name, that is config dot name. This will be obviously replaced on on rendering time when it's finalized, another pretty cool property of I, mean sorry feature of the Internet.

B

You can not only import, jasonich or Jason by the way, for example, you can even have you can even have original original kubernetes manifest within Jason, and you will be able to do something like import plainly here, like import, that Jason that describe describes the standard Cuban is manifest and imported here into this namespace to say into this object and then be labeled there to overwrite any any feel and with any value you may miss in this particular case. This is different. This is import string and you can.

B

You can see how this works I'm, creating here in this confident I'm populating this data with index dot, HTM edge, T Melky. That will be which value we've come from this particular file and this particular file asking gases are some kind of full simple in the excited mail they take from from. This is how this the first, how the thing on the right differs from the thing on the last thing on the right, we have several different, this guy and this guy.

B

We have different container objects, layer or maps by the way I have here the same construct like namespace and default into up production, because indeed this is the production deployment, but is, if I, even another, another file that derives from for me that in classes you will be able to override it.

B

Let me show you a little bit of magic.

B

So what I'm trying to get here is what I mentioned regarding being able to see the differences between the two. Of course, you usually have this in a proper source control I get, for example.

B

This is really bad practice like nginx production and engine exploration, be it's just for aspect of clarity here and being able to have them both to be able to show it, but usually you you do something like things like, for example, showing the previous commit of the Jason net grabbing it and then passing it to give CFG to show to show the output. I will show you here the difference between the rendering of these two.

B

As you can see here, you can see that we created the completely new object in D, either comfort map communities, because this industry I have not shown the content, but you can see it. You can see it here, it's counted, it came from import string in it and you can see also they added volume on some volumes referring to the config map.

B

We can try the ploy in this. Let's validate, it is before sorry give CFG holidayed by the way. I didn't mention that show is it does not talk to the kubernetes. Api is essentially just behaves like mostly like local jason. It.

B

So just try to see how this works, so we showed update, is essentially the equivalent to keep CTL apply or left, and then you can see that indeed, this is applying this. The output here is showing the namespace under name, so we can do something like cubes yeah pause, namespace production.

B

There we have it have them running. I could even do something like you know they do a gives. It gives it a rock see on sorry poor for where and then try to hit one of the nginx, and we will see the index.html there, but I won't spend time on that, because we have more interesting thing to talk about. Let's say that we want to actually handle both here. I said: I want to indeed a single invocation. We want to update both recall that keep CTL.

B

You can pass only a single file, and this we will see there is a very strong reason, all on files being able to use to pass several files they signifies to give CFG. In this case, we will do the same as you can imagine here. We will have the nginx deploy to upstaging.

B

And you can see the difference here. You know like it says, updating and then it repeats updating this here is actually creating the non-existent the planet.

B

Another another very interesting feature is that you have diff by the way, I will take the liberty to do this construct. This is just shell. Foo on buffer comes from the expect package, just provided why to qcg, to provide me color unless that are in the to show me color, as this will be pretty flood without colors, if I pop it to nakedness.

B

This is the difference record where we are, we did keep CFG update and then immediately we do it cube CFG, the on the things with the prior, but the fold keep CFG. We show you the divs, and then you can see that this thing has been indeed annotated by by kubernetes itself by the API endpoints. Sorry, the controller will be in this case.

B

It did some annotations, for example, uniquely identify this particular deployment, so that, if you do a save on you say the state and then you don't apply, you can refer to the same, and this is actually say pretty noisy. These are, from a point of view. Kind of runtime values that were not were default by communities were not strictly defined by you on, like this value is, for example, they come from ik from the increase ik kubernetes defaults, so.

B

Keep seats keep CAG, DIF does have something that is the if subset, and this will be the difference that we will show. You will be a subset where this subset comes from what you did, what you defined there in your manifest. So we, if we do so I'm, just going to clean this, because it will be a very short output.

B

You can see that unchanging, so we are getting rid of these extra fees and only considering the fees that we have here. One very cool feature of cube CFG is that it has something that is called garbage collector. So, let's stop sorry done.

B

Let's stop here for a moment, usually when you, when you, when you have your set of manifest it's very hard to get rid of what was deleted from your manifest. So how do you, how you describe the new the new leaf occasion of one manifest? Do you put in new money filter that will be out to be an invalid? An invalid object for kubernetes so give CFG provides an this digitech feature that will actually annotate the deployment with whatever value you put here.

B

Let's say, for example, that we call this whole deployment nginx haul, where nginx all is this particular tag to describe the universe of nginx that I want to deploy here this particular case I'm not going to delete all sources because kubernetes sorry, cube CFG will be able to see that there live and will actually apply the tag on top.

B

So essentially, this is kind of in India tagging. Indeed, marking these all those resources with this particular tile, so that, let's say if I wanted to get rid of the stage in deployment. Indeed, because this tag covers the whole universe of this particular stock. Usually in this case, you will call that not nginx Oliver, something like the whole applications.

B

Title will be service, not service from the point of view of a communities by kind of service full being said for whatever set of all resources in communities, you need to describe your whole service and indeed you will pass all these assets. That would even be a single gesture that that imports from the mall and then that's a composition of all the other objects, or maybe there are there, are different files, but here because we already tagged this by the way I would like to show how that tags looks like.

B

What I'm going to here, I'm going to to take with cube CTO I'm, going to get the deployment in those nine space? I know that this is its name I'll put in JSON and going to grab just metadata and then, as you can see, there is this new annotation here.

B

This particular tation, that is, has the value that I put there in the GC tag so such as, if I do this.

B

You will grass won't happen. What will happen.

B

In this it garbage-collected what was previously tariff with the same value by the way is some important note regarding this feature. As you can see, it actually went there take a moment to think about this QC AG update with this tile and the next reduction bit too. We know that engine exploration b2 in this particular case goes against this namespace, but there is no information here for cube CFG to know about the other namespaces.

B

So it's important to mention that it's kind of pretty expensive operation somehow because it will need to if we need to fetch from online spaces all the objects that have this particular notation. So also all the our buck I mean all the rules I'm. Sorry, all the permissions are back and will apply here. So you need to obviously need to have access to all these other namespaces. To do this garbage collecting and just to do a cool thing, non dot, JSON it that's, essentially an eel JSON it. So you can guess. If I do this.

B

This, this kind of to show your friends I, do not believe I do not believe when its resources I specify this a digital with an eel value to get rid of all well I tagged it before I.

A

A

B

You yeah- this is essentially this essentially wrapping up so just to to to show you you can see that it garbage collected also this, because essentially what I told it here is get rid of anything that has this particular term because non Jason 18. This is an eel. A new spec.

B

Cool so I wonder: is there any any questions if.

A

We have one question in our shed, so we'll count rhodium deploying llamó deployment method, change, it would use hips hip hip, can fake instead.

B

B

I know that that there is some process trying to bring these two together, but that wouldn't be this completely missing for it, because essentially their tiller is, is in the middle between the hum sea lion tiller to do this yeah, it's not a critical question that nothing will actually prevent the internals of home to use tensioner to describe templates yeah.

B

Indeed, I wonder that the thing is that the the the whole tackle off of him, how you, how you override the values but bypassing the values in our command line or creating your values that gamble to fulfill them, interacts there. So, if I think that it would be prosecuted to do an implementation as as such, but I, it will be kind of a mismatch.

B

I think this- and this is mostly my opinion regarding the takeoff of Jason at and on this, by the way it's something I didn't mention I like here, though, I really don't want to rant anything about them. We we actively contribute to Chrome Charles, and so we didn't, we didn't choose help him to do all the planets, because ham is not secure in a multi-tenant environment. You will see you will see there in the slice.

B

I left there, a pointer to very good article by a colleague of us, Angus Lee actually works for the enemy, also, which is very, very clearly described, the security issues essentially tiller. There is kind of full admin of the cluster, and anyone can talk to tiller in the Falcon default configuration and can do anything even become custom. In yourself, this was one of reasons of did not use in home. We are not, for this very reason we're not using Herrmann in any of our production questions.

B

Like that, just just to mention that at least can be to the current instance iation home there is, there is a fortune he'll be three to actually fix this and come up with it with feeling schemas like instead of directly talking from the same hands, he lied to the tiller to the tiller pot. Actually do something be a CR D that is customer sausage mission in impunity, but this is a much much working progress.

A

Profit, so another question is: if your April air BC role, allows you to read some namespaces, but not to update since either I would keep config to see take behave. Would it give an informative.

B

huh I would actually need to look at the call my might take also knowing gas, the author. It would be that it will actually fail. There are some common lines that recently have been added to do a kind of soft thing, but like soft failure, but it will were not in the these were not in this scope, my guess, if I had to actually implemented it will be it will.

B

Indeed, you will be able to list the resources there, but because the Arbat doesn't allow you to delete, it will fail and it would be cool for it to fail, because you are being imperative on the fact that you want to get rid of the resources, and indeed you want to file, especially if say, if you're implementing this in a CI.

B

Yo, for some reason, your goal you want to get rid of, but I'm talking from what would be a kind of reasonable design of it. I don't know the answers, but we can look at the code.

A

Sounds good, so we have extra two questions and I hope that we can finish with that, because under five minutes so is GC taking actually removing deployments. What's the scope of GC here.

B

What's the scope of GC so essentially.

B

Because this is this: is a community saponin?

B

Sorry, indeed I. Let's take this one in particular recall that this guy had to kubernetes resources. One is a deployment, and one is a config map recall that these are. These are provided by this kind of mini library that we created here when I did the digital recall that I applied this command against this guy, this digital it overall, so it ended top with a PRI.

B

An overload here, as if I had put here, something like annotations call with this particular key, this particular value, so it modified every single kubernetes resources here and annotated with this digital. So this allows me, for example, I'm not going to do it because of of time. But let's say that later we decided to change this to a secret or something so I get rid of this config and I.

B

Really I really do that very common indeed, because the previous resource was already disturbed will get will be actually removed here, because this manifests are not expressed at resource. So indeed, the scope will be the scope of all the kubernetes objects that are present in your json Ettore m'lord some manifests. This is this cop. He says these are all the results that get target in the first place.

A

Perfect, the final question is which pieces should be committed on a loop sonnet base and J sonnet or degenerate Tiana's as well.

B

That's a very, very good question. Indeed, we have that discussion internally with Nami. We currently are committing both because we like one piece of CI integration to do something like so the thing is that um in a perfect world, you will not need to commit the generated output. You will just commit the source but in, but that will be in the case that, where you, you have your CI protecting you from making mistake what I mean by it is I mean like something like.

B

For example, let's say that you have a CI step that we actually do the equivalent of these recalls. What I did here these days between production and production, be to to show you something like this sorry I'm going to save this.

B

So this is the key thing, the feedback ozzie of this difference, because the thing is that when, when you start learning about JSON it- and you become more more empowered on on this net, you start to you, you try to you know as well. We all promised right. So you try to create more common strategy. You have to create functions. You try to to create more code to describe your your manifest and then the thing is how you, how you assess that the output has not changed.

B

That's the key question: if you have a CI that will show you what I have here in the screen and then will say, wait for a human or some or something to actually validate okay yeah. This is what I really wanted, or maybe you have some scripts there. That will do something like imagine. A get show previous commit fit into Q CFG and do the equivalent of the common line that I have here diff between the previous and a and the current one, so that the reviewer of my call will say: okay sure yeah.

B

This is what is it to be changed here? But if you don't have such you may want to actually commit the generated so that, in a review from your peers, you will actually see the difference in whatever you have to do. The reduce like, for example, APR and get house, and you will be able to assess okay, yeah I, do understand the finally I know. Difference I do understand that this is what I want to do. um That would be more or less in there.

B

This just to mention that in this we are with the latter, because we don't have these this particular see I integration completed. We indeed are committing the generator such so that the one would review other other guys called. We are able to do this assessment on the final.

A

Perfect, unfortunately, we ran out of time, but thank you for presenting this. This amazing topic today and you are thank for all the participants who joined us today like to remind you that this webinar has been recorded and will be available shortly on the CNC of the Deo website. Also I'd like to remind you that we are running our native webinars every next week, so I hope to see you on our next webinar next week and here and but thank you guys too.