►
Description
Join us for Kubernetes Forums Seoul, Sydney, Bengaluru and Delhi - learn more at kubecon.io
Don't miss KubeCon + CloudNativeCon 2020 events in Amsterdam March 30 - April 2, Shanghai July 28-30 and Boston November 17-20! Learn more at kubecon.io. The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects
Building Cloud Native GDPR Friendly Systems for Data Collection - Zsolt Homorodi, VTT
For organizations collecting EU users’ data, the General Data Protection Regulation presents considerable challenges. Data must be anonymized and only essential data can be collected. Users must be able to see, download, and delete their data. Setting up the infrastructure to meet GDPR compliance is complicated and time consuming, particularly for resource constrained teams. In this talk, Zsolt Homorodi from VTT (Technical Research Centre of Finland) will explain how he created a reproducible GDPR compliant lightweight data collection and processing infrastructure that is based on Kubernetes and other Cloud Native technologies. Zsolt will show how he combines Linkerd 2.0, Pulumi, Contour, Prometheus, Grafana, Argo, gRPC and other tools to architect reliable, predictable, observable and reproducible environments for data collection and processing that comply with GDPR.
https://sched.co/MPYC
A
A
Cloud
native
GDP,
our
friendly
data
collection
framework
for
our
project
I,
will
start
a
presentation
with
a
short
introduction
to
GDP
R.
So
if
somebody
is
not
totally
up
to
speed
on
it
understands
why
we
did
to
change
the
choices
that
we
did
so
GDP
R.
Is
this
new
general
data
protection
regulation?
That
became
the
law
in
the
EU
almost
exactly
a
year
ago,
and
it
contains
a
couple
of
rules
and
regulations
about
the
privacy
of
personally
identifiable
data
and.
A
A
Special
category
data
is
something
that
reveals
some
kind
of
sensitive
information
that
in
the
wrong
hands
already,
could
be
used
against
you.
These
things
are
like
your
ethnic
origin,
your
political
views,
racial
origin,
sexual
orientation
and
things
like
that,
and
then
the
highest
level
of
this
law
that
is
related
to
criminal
prosecution.
So
if
your
research
or
your
your
company
needs
to
work
with
that
kind
of
data,
some
really
really
special
rules
apply.
A
It
also
defines
the
rights
of
individuals,
so
the
people
you
are
collecting
the
data
about
you
need
to
be
transparent
of
what
kind
of
data
you
are
collecting
why
you
are
collecting
it.
How
long
are
you
going
to
store
that
data
and
also,
if
you
are
handing
it
over
to
some
other
third
party
data
processors,
who
will
get
your
data?
Who
will
get
the
users
data
and
what
those
companies
will
do
with
it
as
extra
special
care
needs
to
be
done
exercised
when
the
data
leaves
the
EU
zone?
A
A
The
users
has
a
couple
of
rights
that
pertains
to
their
to
their
data,
so
they
have
rights
to
access
the
data
that
you
collected
about
them
and
in
a
format
that
is
easily
consumable
for
them.
So
some
kind
of
standard
format
like
JSON
llamo,
something
like
that
if
they
find
that
the
stored
data
is
incorrect
in
some
ways
or
contains
incorrect
information,
they
have
the
right
to
correct
the
data
or
request
Corrections.
A
A
Access
control
needs
to
be
exercised,
so
there
are
certain
levels
of
the
data.
The
raw
data
should
be
accessible
for
us
few
people
as
possible,
and
then
you
could
do
things
like
anonymization
or
cell
dynamization
steps
that
removes
the
real
sensitive
parts
of
they
are
still
keeping
it
intact
enough
that
you
can
you
do
your
research,
so
that
is
access
control
and
also
it
defines
rules
of
what
a
company
should
do
if
a
data
breach
would
occur.
A
So
it's
not
enough
anymore
that,
after
a
couple
of
months
you
not
like
learn
from
a
blog
post
or
somewhere
that
a
data
breach
occurred
in
this
and
this
company.
There
is
a
quite
short
window
of
time
when
the
company
needs
to
notify
the
local
data
protection
office
that
each
EU
country
has
and
then
collaborate
with
them.
How
the
fact
that
the
data
was
breached
is
communicated
towards
the
users,
and
you
also
need
to
kind
of
do
an
impact
assessment,
usually
already
during
the
project
planning
phase
you.
A
A
So
adopting
these
kind
of
rules
to
our
company
of
course
happened
on
on
multiple
levels,
so
they
improved
our
internal
data
management
and
access
control
system,
a
company
DPO
this
data
protection
officer
was
elected.
So
he
is
the
person
that
in
case
a
user
has
some
kind
of
questions
or
objections
about
our
data
collection
system.
They
can
contact
him
and
get
service.
They
can
also
of
always
contact
the
National
Data
Protection
office,
which
in
Finland
is
the
is
an
ombudsman.
We
also
created
this
gdpr
handbook,
that
is,
for
the
project
managers.
A
So
every
time
we
are
starting
a
new
project,
we
are
doing
a
couple
of
things.
One
is
data
mapping
and
the
other
is
the
impact
analysis.
I
already
talked
about
so
atha
mapping
is
this
tool
that
we
are
using
to
to
understand
what
kind
of
data
are
we
going
to
collect
and
identify
if
there
is
anything
personally
identifiable
in
that
data
set?
A
Because
if
there
is
no
personally
identifiable
data,
then
the
GDP
are
also
don't
need
to
be
applied
to
the
data
collection,
but
in
case
there
is,
we
need
to
define
what
is
the
basis
for
us
to
be
able
to
do
the
data
collection.
It
can
be
a
consent,
so
something
like
a
consent
form
we
show
for
the
user,
and
then
you
collect
data
based
on
that
or
it
can
be
a
contract
between
you
and
your
user
and
in
case
it
can
be
also
public
interest.
A
A
We
also
defined
during
this
phase.
What
kind
of
transportation,
storage
and
archival
security
we
are
going
to
use
for
a
given
project?
Can
we
do
any
kind
of
several
ionization
or
ordinal
anonymization
already
during
the
collection
of
the
data?
So
no
we
try
to
remove
as
much
personally
identify
data
as
possible.
A
That
still
makes
it
makes
the
data
usable
for
the
research
that
you
would
like
to
do,
and
then
we
define
inside
the
project
that
who
will
get
access
to
what
kind
of
data
and
what?
What
is
their
role
inside
the
project.
So,
as
I
said,
gdpr
is
about
a
year
old
right
now.
So
how
does
it
look
in
numbers?
So
far,
so
gdpr
is
enforced
in
the
28
EU
countries,
plus
iceland,
norway
and
so
far
there
are
two.
A
266,000
cases
that
were
reported
to
the
National
Data
Protection
offices,
out
of
this
is
on
one.
Almost
one
hundred
thousand
is
complaints
from
users.
Then
around
65,000
our
data
breach
notifications.
When
companies
realize
that
something
went
wrong
and
notified
the
thing
and
then
the
other
is
about
fifty
thousand
out
of
these
200,000
cases.
Forty-Seven
percent
of
them
is
still
ongoing,
because
the
is
data
protection
offices
were
severely
undermanned
in
practically
all
the
countries
in
the
EU,
so
they
are
now
extending
these
offices.
A
In
some
countries
like
Ireland,
where
many
of
the
big
companies
have
their
headquarters,
they
had
to
extend
this
almost
like
40
percent
of
their
previous
personnel
and
so
far
the
EU
sent
out
fines
in
the
count
of
fifty
five
million
dollars
to
these
companies.
If
you
are
interested
in
the
absolute
details,
you
can
go
to
this
link
on
the
site
and
them
that's
that's
the
place
where
I
got
this
right.
So.
A
A
We
have
researchers
for
nuclear
safety,
biological
research,
food
science
and
then
the
team
that
I'm
working
for
is
belongs
to
this
data-driven
Sciences
part
we
are
having
about
2,000
researchers
or
around
Finland,
and
out
of
these
two
and
thousand
people
around
200
are
those
who
are
involved
in
some
way
or
shape
in
software
development
and
yearly.
We
have
about
between
somewhere
between
10
and
20
projects
that
they
need.
A
But
for
these
projects
that
need
to
collect
their
own
data,
we
wanted
to
create
a
generic
enough
system
that
at
least
parts
of
it
can
be
used
in
multiple
projects
and
then
some
fun
projects
can
use
the
whole
system
ASIS
and
why
we
do
this
is
that
inside
VDT
there
is
no
ops
organization
where
we
could.
Our
project
could
hand
out
its
own.
Let's
say
developed
servers
and
ask
the
hopes
that
please
run
this
for
us
in
productions
instead,
and
this
is
because
of
historical
reasons.
A
The
company
set
up
in
a
way
that
each
project
is
its
own
functional
entity
that
owns
every
thing
that
happens
inside
that
project.
So
we
only
need
to
do
the
software
development.
We
need
to
do
the
data
science
part.
We
need
to
run
our
servers
and
then,
at
the
end
of
the
project,
we
need
to
do
the
archival
work
and
then
hand
that
we
can
hand
over
to
the
IT
organization,
and
the
goal
was
to
empower
the
researchers,
because
most
of
the
people
in
the
company
are
not
like
me,
I'm,
a
software
developer.
A
My
job
is
to
develop
software
for
for
my
team,
but
most
of
the
people
in
my
team
are
researchers,
the
auditor,
researchers,
behavioral,
researchers
and
so
on,
and
they
are
experts
in
their
field
and
the
best
way
to
utilize
that
talent
is
to
let
them
do
what
they
do
best.
So
because
of
this,
we
wanted
to
create
something
that
is
easy
enough
to
use
it
very
little
kubernetes
knowledge.
So
they
don't
need
to
know
much
more
than
how
to
create
a
container,
how
to
write
a
deployment
descriptor
and
the
service
descriptor
and
practically
that's
it.
A
The
rest,
as
I
will
show
in
a
couple
of
slides,
is
handled
for
them,
so
we
selected
a
couple
of
areas
that
we
wanted
to
to
definitely
do
and
the
first
one
was
automated
provisioning.
So
we
didn't
want
to
write
like
a
wiki
page
that
you
need
to
follow
these
steps.
We
want
to
give
a
tool
if
you
run
it
and
then
provisions
your
environment.
We
want
it
to
have
some
really
lightweight
monitoring
that
again
doesn't
need
some
extra
setup
from
the
user.
It
just
comes
when
the
system
is
deployed.
A
We
want
it
to
have
like
security
in
place.
As
I
said,
the
new
regulation
practically
tells
us
that
this
is
a
necessity,
so
we
wanted
our
ingress
and
we
wanted
it
to
do
TLS
termination
and
then
inside
the
the
our
cluster,
because
we
are
sometimes
running
these
clusters
in
the
public
cloud.
We
wanted
to
make
sure
that
between
the
services,
the
data
is
also
encrypted,
so
we
wanted
mutual
TLS
between
the
different
services
and
as
easily
as
possible,
and
then
the
system
had
to
be
like
customizable.
A
So
there
are
these
lego-like
parts
that
you
can
choose
to
use
or
choose
not
to
use,
and
we
also
provide
some
components
that
I'm
not
going
to
show
today.
So
these
are
components
that
we
created
for
internal
use,
at
least
for
the
time
being.
So
we
have
time
stamped
key
value,
store
the
optional
encryption
and
location
data
storage.
We
are
using
Open,
ID
Connect
for
authentication
and
authorization.
A
We
developed
a
couple
of
components
from
taken
from
previous
projects,
so
one
of
them
is
location,
Animas,
ation
that
we
can
utilize.
If
we
have
to
collect
some
kind
of
location
data,
we
found
that
often
we
it's
enough.
We
we
identify
areas
that
a
person
visits
often
and
we
label
them
like
1,
2,
3
4,
and
it's
enough
for
what
we
are
doing
so
that
that
tool
does
that.
We
have
various
kind
of
pre-processing
tools
that
simplify
the
the
use
of
the
data.
A
Usually
our
developers
or
researchers
are
working
with
Python,
so
the
output
of
this
pre-processing
is
the
kind
of
data
that
is
easy
to
use
like
load
in
Python
libraries.
So
something
like
pickle
or
something
like
that,
and
we
also
created
an
on-ride
application
that
acts
as
a
sense
of
data
collection
gateway,
because
my
team
usually
does
science
around
human
data.
So
we
are
collecting
things
like
what
is
it
called
like?
Healthwatch
data,
like
your
heartbeat,
your
press
relation
levels,
your
phone
usage
and
things
like
that,
and
we
try
to
draw
some
conclusion
from
that.
A
So
this
tool
that
you
are
saying
it's
called
pull
Umi
I
will
talk
a
little
bit
about
it
later,
but
we
need
to
vet
her
first.
There
is
one
first
step
here
that
sometimes
there
is
a
synchronization
issue
between
the
tool
and
edger.
So
I
would
like
to
wait
until
we
are
through
that
step
and
if
it
works,
then
I
just
continue
with
the
presentation.
A
Okay
looks
alive,
so
let's
continue
so
we
started
this
project
with
the
early
experiments
in
2017.
We
had
a
proof
of
concept
for
the
pipeline
at
the
end
of
2017,
and
then
I
came
to
cuckoo
Neville
last
year
to
Copenhagen
I
learned
a
lot
I
seen
a
lot
of
good
ideas
and
I
took
that
home
and
continued
developing
the
system,
so
in
September
2018
the
first
version
went
into
production.
A
Again
we
are
a
Research
Institute,
so
our
production
levels
are
a
bit
different
than
you
hear
in
most
of
these
talks,
our
how
to
say
biggest
research
thing
has
like
5,000
users
and
we
are
collecting
data.
So
we
are
not
exactly
a
huge
kubernetes
users
in
the
size
of
our
clusters.
It
most
of
our
clusters.
Avedon,
like
the
5
6
number
of
well
I
mean
the
node
number
is
around
5
6
and
then
it's
perfectly
enough
for
us
with
much
room
to
breed.
A
A
What
are
the
pieces
to
this
cluster
puzzle?
So
our
architecture
looks
something
like
this:
there
is
that
Android
application
that
acts
as
a
gateway.
We
have
an
ingress
controller
in
that
is
already
inside
kubernetes
and
it's
also
merged
into
linker
D.
So
we
are
using
link
early
to
as
our
service
mesh
and
then
inside
those
those
components
are
the
ones
that
I
said
that
they
are
not
open
source
or
not
open
source.
Yet
so
we
are
not
going
to
see
those
ones.
A
A
It
has
a
wrote
above
based
data,
object,
service
definition
model,
so
you
can
define
in
this
protocol
file
how
what
kind
of
data
will
move
through
the
wire
and
what
kind
of
services
do
you
want
to
have,
and
then
the
server
both
the
server
bindings
and
the
client
bindings
are
automatically
generated
by
this.
From
this
definition,
this
is
a
protocol
that
originates
from
Google
and
it
supports
a
lot
of
target
target
languages.
The
most
important
for
us
are
Java
and
Python
and
no
GS.
A
It's
a
really
effective
binary
representation.
When
we
switch
from
JSON
based
beta
protocol
to
this
G
RPC
1
between
the
Android
application
and
the
server's
we
gained
around
30%
throughput,
which
was
really
important
when
you
are
trying
to
gather
a
lot
of
raw
data
like
we
try
to
gather
Rho
heartbeat
data,
we
draw
accelerometer
data
and
things
like
that.
A
So
we
don't
want
to
rely
on
the
heartbeat
algorithms
that
are
by
the
companies
who
put
out
these
watches
and
bands,
and
things
like
that,
then,
is
really
important,
and
lately
there
is
this
new
standard
code
gr
PC
web.
So
it
brings
gr
PC
also
to
the
web
client
world.
So
now
you
can
do
like
end
to
end
systems
using
just
gr
PC,
and
this
is
an
important
thing
to
keep
in
mind
when
you
are
selecting
the
next
component,
which
is
an
ingress.
A
So
if
you
have
clients
that
are
sending
the
exact
same
amount
of
data,
it
will
work,
but
if
there
are
clients
that
require
less
data
and
will
produce
less
data,
the
others
produce
a
lot
more
than
this
load.
Balancing
practically
doesn't
work
at
all,
so
you
need
something
that
understands
a
protocol
and
can
do
protocol
level
load
balancing
we
needed
something
that
can
take
off
care
of
TLS
termination
and
because
I
have
previous
experience.
Working
with
Envoy
I
want
it
to
work
with
something
that
is
based
on
or
around
my.
A
So
that's
why
we
started
to
try
these
three.
The
origin
of
1.0
version
used,
kept
EO,
contour
or
now
VMware
contour,
I,
guess
we
are
moving
away
from
that,
not
because
there
is
anything
wrong
with
it.
It
worked
really
well.
The
problem
we
have
is
that
when
we
want
to
integrate
it
with
link,
add
it
to
service
mesh.
We
need
to
change
or
add,
add
header
to
the
request
and
that's
something
that
at
the
moment,
contour
is
not
capable
to
do
so.
A
You
cannot
define
additional
headers
for
the
request
or
the
responses,
so
we
had
to
try
to
work
with
something
else
in
the
demonstration.
If
demo
gods
are
with
us,
the
demo
uses
Ambassador
and
I'm
working
on
the
glue
integration
it
almost
there,
but
I
didn't
have
time
enough
to
finish
it
before
the
conference
started.
A
So
everything
works,
X
except
G,
RPC
web,
so
DRP
seats
have
the
normal
G
a
piece
of
work
but
share
PC
web
doesn't,
and
one
thing
that
you
could
keep
in
mind
when
you
are
choosing
your
own
English
controller
is
all
of
them.
Offers
features
very
beyond
the
normal
ingress
object
that
kubernetes
defined
so
glue,
for
example,
offers
like
retried
fault
injection
for
testing.
It
can
do
real,
complex
transformation
of
the
request
body
under
header.
Ambasada
refers
like
circuit
breakers
and
contour
it.
A
It
has
like
a
hierarchical
configuration
system
where
you
can
like
define
the
basic
stuff
on
the
default
namespace,
and
then
you
can
delegate
part
of
the
the
ingress
tree
practically
in
two
different
namespaces.
So
you
don't
need
to
give
rights
for
all
of
your
users
to
do
to
be
able
to
manipulate
the
the
root
ingress
object,
but
you
can
give
them
rights
that
inside
this
namespace
you
can
define
your
own
and
then
it
will
always
repair
under
this
path,
or
things
like
that.
So
these
are
really
excellent,
open
source
projects
with
super
nice
communities.
A
Then
the
co
TLS
certificate
management.
We
wanted
to
use
let's
encrypt
and
inside
kubernetes
writing
the
probably
the
easiest
way
to
do
it
is
just
x,
cert
manager,
so
you
are
using
it.
It
supports
both
the
HTTP
and
DNS
based
validation,
small
caveat
there
that
if
you
want
to
have
HTTP
validation,
then
you
need
to
have
an
ingress
controller
that
actually
works
with
ingress
objects,
because
I
forgot
to
tell
you
here
that
both
ambassador
and
Gullu
they
offer
their
own
object
instead
of
ingress.
A
Glue
itself
can
be
installed
in
a
way
that
it
supports
normal
ingress
objects
ambassador.
As
far
as
I
know
doesn't
so
it
uses
a
different
mechanism.
How
to
how
you
define
the
same
kind
of
thing
that
in
ingress
does
with
some
extended
features.
Contour
itself
does
support
in
yes
and
then,
if
you
want
white
card
domain
names
in
your
TLS,
then
you
can
do
that
only
with
the
NS
based
validation,
then
the
next
component
we
selected
is
a
service
mesh.
A
So
we
don't
need
to
always
create
it
for
every
single
project
and,
as
I
said,
we
are
not
running
the
largest
kubernetes
clusters
ever
so
we
wanted
something
that
is
lightweight
both
on
memory
and
CPU,
so
we
selected
linker
D.
Originally,
we
didn't
think
about
MPLS
as
a
feature
that
we
really
want
to
use.
But
when
some
of
our
projects
started
to
work
with
those
sensitive
data
that
we
talked
about
in
the
beginning,
they're
practically
it's
it's
a
necessity.
A
It
comes
with
some
performance
penalty,
but
it
works
really
well
for
us,
and
it
has
some
extra
features
that
that
we
are
not
utilizing
something
like
retry
Bridget,
for
example,
and
okay.
The
next
step
is
what
like,
keeps
the
whole
installation
or
brings
the
whole
installation
process
together.
So
follow
me:
is
this
quite
new
infrastructure
as
a
code.
A
If
you
know
terraform,
this
is
very
similar.
Actually
the
tool
itself
uses
terraform
in
some
of
its
providers.
What
is
the
really
big
change
here
is
that
you
are
using
actual
real
programming
language
when
you
are
putting
together
your
infrastructure
code,
so
no
more
templating
languages,
this
one
uses
or
supports
Java,
zipped
or
typescript,
or
practically
any
language
that
can
run
on
top
of
node.js
and
Python.
At
the
moment,
as
far
as
I
know,
there
is,
there
are
plans
to
support,
go
at
some
point.
A
It
finds
the
dependencies
between
the
different
objects
that
you
are
deploying
automatically
most
of
the
time,
but
you
can
also
define
many
other
dependencies
if
you
want
and
then
they've
wrote
a
really
great
kubernetes
provider
that
supports
three
ways
to
define:
kubernetes
objects,
one
is
programmatic,
so
they
have
an
API
that
you
can
use.
You
can
use
your
hand,
charts.
It
uses
a
locally
installed
ham
in
templating
mode,
so
it
generates
from
the
template,
the
output.
It
doesn't
use.
A
What
is
the
name,
the
server
side
component
of
ham,
and
you
can
also
use
just
simple
yum
files
that
you
already
have
somewhere
and
one
difference
between
how
paluma
deploys
objects
to
kubernetes
compared
to
when
we
are
using
Kubek
tote
to
send
our
young
files
is
that
it
has
a
logic
inside
that
waits
for
completion.
So,
for
example,
when
you
create
a
deployment,
it
validates
that
that
the
deployment
actually
created
life
pods
that
are
ready
or
when
you
create
a
service
objects.
It
only
passes
if
the
service
object
has
both
behind.
A
That
can
actually
serve
the
cluster
and
it
waits
until
these
conditions
happen.
So
you,
you
can
be
sure
that
when
you
install
the
next
component
and
next
component,
they
can
already
talk
to
this
previously
dependent
components,
and
then
the
last
component
that
I
would
like
to
talk
about
is
or
go
so
our
go.
Is
this
vert
flow
engine
for
batch
processing?
A
A
The
workflow
definition
can
be
parameterized,
so
you
can
use
it
practically
as
a
template
and
then
run
it
with
video
meters,
and
it
has
some
conditional
logic
inside
like
loops
conditionals
and
then
whatever
was
created
during
the
earth
flow
as
an
artifact,
it
can
be
uploaded
to
storage
like
s3
and
similar
things.
Okay,
so,
let's
see
if
where
we
are
with
the
demo
oops
there
is
some
l4.
A
So
this
is
the
error.
I
talked
about
it
just
happened
very
later
than
I
thought.
It
really
happened.
The
problem,
as
you
can
see,
there
is
still
a
lot
of
work
to
be
done.
So
I'm
not
sure
I
created,
like
a
recording
of
this,
but
with
the
recording
I,
won't
be
able
to
show
the
live
system
so
I'm
not
sure
how
much
time
we
have
still.
A
So
it's
a
quite
a
bit
sped-up
recording
and
but
you
can
see
how
paluma
works
in
action
it.
The
error
also
happened
in
the
hotel
yesterday,
but
in
the
hotel
I
found
it
much
quicker
so
good.
So
as
you
can
see
it
first,
it
creates
everything.
So
it
first
creates
kubernetes
cluster
with
the
necessary
service
principles
and
passwords.
It
works
in
Azure
and
then
it
will
create
the
kubernetes
cluster
itself
and
then
let's
jump
a
little
bit
ahead,
because
we
don't
need
to
wait
for
that.
It
takes
something
like
seven
minutes
in
real
time.
A
So
alright,
so
as
you
can
see,
then
we
are
putting
linker,
D
and
certain
manager
into
use,
and
on
that
side
that's
the
waiting
logic.
So
you
what
what
is
happening
there
is
it
waits
until
the
services
have
enough
pots
behind
them
and
then
the
deployments
have
the
necessary
requested
amount
of
pots
themselves
and
once
linker
D
and
certainly
already
done
it
installs
the
ingress
controller,
and
then
it
puts
the
application
inside
and
then
that's
it
I
guess.
I
will
have
to
stop
at
some
point,
but
we
have
somebody
tell
me
we
can
go.
I.
A
Yes
and
then,
once
once
the
ingress
controller
is
there,
so
we
now
have
an
IP
address
or
public
IP
address.
We
take
that
IP
address
register
it
using
a
DNS
provider
in
our
case
CloudFlare,
and
then
once
we
have
the
DNS
name.
That's
when
we
can
generate
the
certificate,
we
generate
the
certificate
through
third
manager,
it
creates
it
as
a
secret.
Then
it's
fed
up
fed
back
to
the
ingress
controller
and
then
the
ingress
controller
ambassador.