►
From YouTube: Using a Managed Kubernetes Service in the Enterprise - Sujit D'Mello & Daniel Selman, Microsoft
Description
Join us for Kubernetes Forums Seoul, Sydney, Bengaluru and Delhi - learn more at kubecon.io
Don't miss KubeCon + CloudNativeCon 2020 events in Amsterdam March 30 - April 2, Shanghai July 28-30 and Boston November 17-20! Learn more at kubecon.io. The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects
Using a Managed Kubernetes Service in the Enterprise - Sujit D'Mello & Daniel Selman, Microsoft
All the major cloud providers have managed Kubernetes services such as GKE (Google Cloud Platform), EKS (Amazon Web Services) and AKS (Microsoft Azure). These managed services aim to provide you a Kubernetes environment which is mostly managed by the cloud vendor. Unfortunately, these services do not give you much access to the underlying Kubernetes cluster resources. You are limited to using the kubectl command. While convenient, Enterprises often have demanding functional and operational requirements to meet compliance or corporate standard needs. Some of these are: - Custom logging and monitoring - Anti-malware - Specific networking and zoning - Custom CA certificates and cipher suites - Custom host files - Externalizing configuration - Etc. We will show you how you can meet these Enterprise requirements with creative use of Kubernetes constructs and container initialization!
To Learn More: https://sched.co/GrU6
A
B
Just
like
Danielle,
my
name
is
Sergey
de
Melo
I'm,
also
in
the
same
group
as
he
is
we're.
Also
a
most
of
Microsoft.
Consulting
services.
I
focus
a
little
more
on
app
dev
side
of
things,
as
opposed
to
Daniel,
who
is
more
on
the
infrastructure
and
of
course,
nowadays,
Kuban
at
ease
is
a
big
thing
with
our
customers.
B
A
To
set
the
stage,
essentially,
enterprises
are
begin
to
more
and
more
move
over
to
past
services
or
managed
services.
However
oftentimes
they
want
to
still
apply
their
existing
requirements
for
infrastructure
hardening
even
on
these
managed
services,
and
so
what
essentially,
they
want
to
have
their
cake
and
eat
it
too.
So
what
we're
gonna
gonna
discuss
is
ways
to
apply
traditional
Enterprise
requirements
in
a
kubernetes
way
that
is
using
the
native
APIs
scalable
solutions.
Additionally,
we're
going
to
show
how
to
do
this
in
order
to
meet
some
of
those
traditional
Linux
requirements.
I
want.
A
B
You
so
we're
not
gonna
talk
about
that
kind
of
stuff.
We're
going
to
talk
about
the
path
offering
where
a
cloud
vendor
like
Amazon
or
Google
or
adder
will
offer
you
a
Cuba
Nettie's
service
as
a
path
offering,
because
that's
where
we
see
and
customers
are
going
towards
that
the
managed
given
eddies
offering
and
how
you
could
take
that
and
still
meet
some
of
the
requirements
that
these
customers
have
yeah.
A
So
in
terms
of
the
topics
that
we're
gonna
cover
today,
first
and
foremost,
security
is
always
top
of
mind
with
with
enterprises,
and
so
we're
going
to
go
through
different
types
of
business
use
cases
and
how
do
establish
solutions
for
them
in
a
kubernetes
native
wave.
Additionally,
monitoring
is
always
top
of
mind,
so
we'll
be
discussing
fundamental
approaches
to
monitoring.
After
that,
we'll
discuss
some
of
the
synergy
that
comes
with
managed
solutions
across
the
technology
stack,
some
additional
advanced
topics
and
then
demos.
A
So
in
terms
of
security,
they're,
very
common
business
use
cases
that
apply
across
enterprises,
regardless
of
the
industry.
These
include
restricting
the
attack
surface
of
the
cluster
configuring
machines
based
off
of
existing
security
requirements,
securing
connections
to
on-prem
resources,
ensuring
all
cluster
egress
follows
regulatory
and
compliance
requirements
and
then
finally
enforcing
secure
communication
between
all
application
components.
What
we're
gonna
do
is
dive
into
each
one
of
these
and
introduce
not
a
comprehensive,
but
rather
a
set
of
potential
solutions
to
do
these
in
a
kubernetes
way.
A
So
first
topic
is
reducing
the
attack
surface
area.
We're
going
to
talk
about
two
different
approaches
for
this.
First
companies
don't
want
to
have
anonymous
access
to
their
cluster
outside
of
just
the
CVE
that
was
announced
last
week
when
it
came
to
anonymous
access.
You
still
also
don't
want
to
expose
your
cluster
publicly
to
the
Internet
or
your
application
publicly
to
the
internet,
so
you
can
get
around
that
using
internal
load
balancers
additionally
for
people
that
are
authorized
to
use
the
cluster,
there's
also
a
consideration
that
you
don't
want
someone
to
be
able
to
delete.
A
Let's
say
your
production
workloads
in
those
situations.
You
want
to
control
users
permissions
even
when
they
are
authorized
using
native
kubernetes
auerbach,
so
briefly
to
touch
on
it.
When
it
comes
to
an
internal
load,
balancer
they're,
pretty
straightforward,
essentially
all
you
do
is
you
define
a
load
balancer,
just
as
you
would
in
the
internal
load
balancer,
just
as
you
would
any
typical
load
balancer
and
then
provide
some
sort
of
flag
for
the
cloud
provider
that
you're
on
this
example
here
is
in
in
the
annotation
space.
A
Is
an
example
of
how
to
how
easy
it
is
to
set
a
ilb
within
a
sure
what
this
then
does
is
it
provides
an
internal
IP
address
in
terms
of
the
actual
resources
that's
created,
so
it's
not
publicly
exposed
to
the
internet,
but
also
from
a
kubernetes
standpoint.
It
still
views
it
as
an
external
IP
address.
Just
as
it
would
you
know
any
load,
balancer
that's
created
next
in
terms
of
our
back.
There
are
two
real
topics
here
at
the
cluster
role
and
the
role
binding
when
it
comes
to
cluster
rule.
A
Essentially,
what
this
is,
is
it
it's
defining
a
class
of
roles,
and
then
it
sets
what
resources
they
have
permissions
for
and
explicitly
how
they
have
access
to
those
sort
of
permissions.
So
an
example
here
is
the
pod
reader.
They
have
access
to
get
watch
and
list
pods,
but
it
doesn't
mean
that
that
new
hire
can
delete
that
production
workload,
and
so
in
order
for
that
these
are
namespace
agnostic
resources,
meaning
that
they
can
be
applied
in
many
different
contexts.
That's
where
the
role
binding
comes
in,
so
what
the
role
binding
does.
A
Is
it
takes
this
class
and
applies
it
in
a
particular
namespace
to
a
particular
resource?
So
what
we're
defining
here
is
me:
I.
Am
the
user
Daniel
we're
setting
a
are
back
authorization
for
the
pod
reader
role
and
that's
in
the
default
namespace,
meaning
that
once
this
cluster
role
is
applied,
I
have
it
access
to
get
watch
enlist,
pods,
but
no
actual
edit
or
delete
functionality,
for
example
all
right?
A
The
second
topic
in
terms
of
security
is
configuring
machines
based
off
of
existing
security
standards,
oftentimes
to
enterprise,
to
have
hardened
standards
for
Linux
machines
that
they
want
to
apply
across
the
board,
even
introduces
like
aks
or
general
manager
kubernetes.
This
is
augmented
by
the
fact
that
when
you
go
into
the
portal
you
can
see
in
the
manage
resource
group
that
their
actual
VM
sitting
there,
meaning
that
raises
some
alarms
when
it
comes
to
security
teams
wanting
to
get
more
hands-on
with
actual
Hardware
there.
A
But
there's
an
issue:
you
can't
ss8,
you
don't
have
access
to
the
machines
in
the
traditional
context,
you
SSH
into
all
the
Linux
machines,
a
isn't
scalable,
because
you
have
things
like
cluster,
auto
scaling
in
terms
of
the
nodes,
meaning
that
you
would
have
to
constantly
reapply
and
also
it's
a
wasted
effort,
because
you
can
do
so.
You
can
do
these
customizations
through
the
kubernetes
native
API.
So
what
we're
going
to
discuss
is
a
solution
to
apply
some
sort
of
custom
system
hardening
using
kubernetes
native
function,
even
in
the
managed
service.
A
The
for
example
here
is
an
anti-malware
daemon
set,
so
the
solution
design
has
three
premises.
First,
as
some
of
you
are
likely
familiar
daemon
sets
can
create
a
pot
on
each
worker
new
in
the
cluster.
This
is
great
because
it
provides
a
scalable
solution,
even
when
our
cluster
expands
and
contracts.
The
second
premise
is
that
pods
came
out
volumes
on
the
underlying
node
using
the
host
path
parameter
for
a
volume.
What
this
means,
then,
is
that
we
have
access
to
the
files
on
the
underlying
VM.
A
This
is
expanded,
or
this
is
great
in
Linux
environments,
because,
as
you
know,
everything
is
a
file
which
makes
things
very,
very
convenient.
The
third
premise
is
that
the
init.d
directory
and
Etsy
on
the
node
tells
the
Telsa
node.
What
programs
need
to
be
run?
Therefore,
in
order
to
customize
the
ultimate
software
running
on
the
node
you'll
create
a
daemon
set
mounting
the
mounting
a
particular
directory.
This
example
dismounts
no
root
on
the
node
copies
a
program
and
then
modifies
n8d
in
order
to
install
and
run
it.
A
This
is
a
useful
for
other
utilities
as
well,
that
aren't
easily
deployed
using
a
container
we're
just
using
anti-malware
as
a
common
use
case.
We
one
word
of
caution,
though
they
should
only
be
used
in
situations
where
it's
absolutely
necessary
and
like
a
go/no-go
situation.
Generally
speaking,
you
don't
want
to
be
mucking
around
too
much
with
the
underlying
notes,
given
the
distributed
nature
of
kubernetes.
However,
in
situations
where
it's
absolutely
necessary,
this
provides
you
a
way
to
ensure
consistency
across
all
worker
nodes.
Yeah.
B
I
just
want
to
mention
something:
you
know
that,
typically,
when
the
cloud
vendor
puts
up
these
nodes,
they
make
sure
that
the
nodes
are
patched
and
so
there's
a
certain
security
that
comes
along
with
it.
So
you
know
you
don't
want
to
go
overboard
with
this
kind
of
solution,
but
there
are
some
customers
that
really
want
to
have
some
presence
on
the
nodes,
and
this
is
a
way
to
do
it.
So.
A
In
terms
of
this,
the
real
bulk
of
the
value
comes
from
the
args
parameter
here.
Essentially,
what
we're
doing
is
we're
changing
the
route
of
the
underlying
container
to
the
node
root
and
then
we're
setting
the
security
context
as
privileged
meaning
that
it
provides
it
permissions
to
alter
things
on
the
underlying
node.
A
Then
what
we're
running
is
just
a
simple
apt-get
update
and
everyone's
favorite
anti-malware
clamavi,
but
just
a
simple
example
of
a
software
that
we're
installing
that
then
updates
and
it
D
installs
the
application
in
Etsy
in
order
to
ensure
that
it's
running
on
the
underlying
node
you'll
notice
that
we
have
this
while
true
do
sleep,
30
done!
That's
something.
You'll
often
see
when
you're
running
administrative,
daemon
sets
or
just
Administrative
Tools,
because
pop
pods
exist
to
run
in
a
job.
So
if
the
job
is
complete,
then
the
pod
will
terminate.
A
B
There's
always
an
on-premises
data
center
could
be
with
your
own
cloud,
own
data
center
provider
and
then,
of
course,
they're
moving
either
in
the
process
of
moving
things
to
the
cloud
or
they
have
you
bought
at
the
same
time,
and
so
typically
you're
gonna
get
in
this
situation,
where
you're
gonna
have
a
virtual
connection
of
virtual
circuits,
so
to
speak
between
your
cloud
provider
and
the
on-premise
system,
and
when
you
would,
when
you
install
Kuban
at
ease,
it
is
possible
to
set
up
so
it
yeah.
So
yeah
you
could.
B
When
you
create
the
virtual
network
in
which
the
kubernetes
cluster
is
is
deployed,
you
can
connect
that
virtual
cluster,
that
that
virtual
network
to
the
circuit
that
is
connected
to
the
on-premise
system
and
that's
just
part
of
the
configuration
of
a
managed
Kuban
any
service.
It's
there,
you
don't
have
to
muck
around
with
the
actual
Lavina
add
go
and
do
any
special
commands
outside
of
the
scope
off
to
manage
that.
Given
any
services,
you
can
do
this
right
out
of
the
box.
Yeah.
A
The
big
the
big
takeaway
here
is
really
when
it
comes
to
enterprises,
there
are
always
going
to
be
legacy
systems
for
most
cases,
in
which
case
peering.
The
v-net
gives
you
the
ability
to
securely
access
resources
on
prim
to
deal
with
those
legacy
requirements
that
might
not
be
a
same
consideration
when
it
comes
to
like
startups,
for
example,.
B
Yeah
and
once
the
once
this
is
connected,
all
the
pods
and
I
was
gonna,
see
all
those
on-premise
systems,
so
that's
the
beauty
of
it.
Well,
the
other
thing
is
egress.
Now
we
talked
about
how
these
clusters
are
locked
down,
I
don't
have
access
to
the
Internet.
At
the
same
time,
sometimes
you
need
to
get
out
of
the
internet,
for
example,
to
look
up
the
CRL
revocation
list
or
call
some
external
web
service
that
you
subscribe
to.
So
how
do
you
do
that?
B
So
you
typically
customers
would
want
to
do
it
through
a
proxy
server,
and
so
they,
you
have
to
force
all
the
applications
to
to
route
traffic
through
the
proxy
server
and
one
way
that
we've
done
it
is
to
set
the
environment
variables,
which
is
the
HTTP
proxy
HTTP
proxy.
You
can
force.
You
can
set
these
as
part
of
your
startup
script
in
the
application,
so
that
every
application
is
no
option
but
to
use
the
proxy
server
to
go
out
when
it
has
to
do
aggress.
B
A
The
final
topic
on
security,
we're
going
to
cover,
is
enforcing
secure
communications
between
all
application
components,
the
way
we're
going
to
approach.
This
is
a
ground-up
set
of
solution,
given
that
oftentimes,
when
it
comes
to
enterprises,
they
want
to
be
able
to
build
their
solution
internally,
rather
than
maybe
leveraging
some
of
the
more
open
source
technology,
and
so,
in
this
case,
we're
going
to
walk
through
a
solution
where
we
install
custom
certificates
as
part
of
an
application,
bootstrapping
process
and
then
enforce
TLS
via
an
app
config.
So
that
means
that
there
are
two
parts
here.
A
The
first
is:
how
do
we
get
the
certificate
onto
the
container
when
we're
pull
when
we
run
these
containers-
and
the
second
part
is
how
do
we
enforce
the
application
to
always
use
this
TLS
standard?
So
we
briefly
talked
about
it.
There
there's
an
initial
concern,
which
is
that
enterprises
also
usually
use
their
own
CA,
and
so
it's
very
important
that
they
have
specific
certificates
that
they
use
in
these
situations.
A
Essentially,
what
you'll
do
is
you'll
use
a
startup
script,
essentially,
you'll
put
the
certificate
in
some
sort
of
cloud
store,
whether
that
be
something
like
Azure
key
ball
or
even
just
a
file
share,
and
then
you'll
create
a
script
that
runs
in
the
container
when
it
initially
booted
up.
That
will
pull
the
certificate
from
the
cloud
storage
and
then
run
some
steps
to
install
it
on
the
container
when
it
comes
to
enforcing
the
application
to
use
TLS.
B
Yeah,
yes,
so
here's
an
example
using
asp.net
for
where
you
can
force
that
the
traffic
that
your
that
you're
accepting
is
only
TLS
one
point
one
or
one
point
two,
depending
on
your
standards,
but
this
is
something
that
has
to
be
integrated
into
your
own
application.
There
is
no
way
to
tell
for
a
linux
to
configure
the
next
to
only
accept
a
particular
protocol.
That's
something
done
at
the
application
that
was
a
few
PHP
or
Java
or
any
other
language,
and
that's
what
you
have
to
do.
A
A
A
We'll
be
demoing
from
the
azure
cloud
shell.
This
is
because
oftentimes,
if
you're
a
Windows
user
and
you
have
a
Windows
subsystem
for
Linux,
it
works
great.
But
if
you're
like
me,
you're,
sometimes
forgetful
to
update
all
your
packages
cloud.
Shell
is
a
very
useful
in
that
regard.
Yeah
so
I've
already
deployed
the
daemon
set.
So
as
we'll
see
so
we
have
the
antivirus
here
all
right,
we'll
exact
into
this
container.
B
All
right,
so
obviously
nobody
done
with
the
security
angle.
Monitoring
is
something
that's
very
important
over
here.
How
many
of
you
guys,
working
with
customers,
either
work
for
customers
or
with
customers
that
you
say
Splunk
as
a
marketing
solution,
yeah
very,
very
popular.
Obviously,
Splunk
is
very
popular,
so
we
wanted
to
show
an
examiner
to
do.
Show
an
example
of
how
you
could
use
plonk
to
to
monitor
your
containers,
and
it's
really
easy.
B
It's
done
through
this
demon
set
that
there's
a
container
or
image
out
there
on
the
on
the
docker
hub
that
Splunk
is
put
out
and
what
you
have
to
do
is
to
run
it
as
a
daemon
set.
As
daniel
said,
every
node
is
going
to
get
one
instance
of
the
demon
set.
It's
going
to
grab
all
the
container
logs
and
ship
it
out
to
the
Splunk
server
for
indexing,
so
that
we-
and
you
know
it's
easy
for
you
to
to
track
it.
B
One
thing
that
applications
should
do,
though,
as
a
can,
you
go
back
for
that
previous
slide,
please
Daniel!
One
thing
applications
should
do
is
to
write
to
send
it
out,
because
that
way,
they'll
be
laws
a
lot
on
that
we
captured
in
just
plonked
without
much
ado,
yes,
and
so
here's
a
good
example
of
how
this
is
a
boilerplate
stunk.
B
A
So,
while
it's
specific
to
spunk,
if
you
have
an
in-house
tool
just
so
long
as
you're
able
to
mount
this
underlying
location
of
the
logs,
you
should
be
good
to
go.
So
another
topic
when
it
comes
to
monitoring
is
log
rolling.
So
when
it
comes
to
monitoring,
the
best
practice
is
usually
more
is
better,
meaning
that
you
want
to
have
verbose
logging
to
ensure
that
you
can
retrace
when
something
goes
wrong
if
it
goes
wrong,
as
well
as
to
better
understand
the
functionality
within
the
cluster.
A
Now
this,
what
this
means
is
that
oftentimes
there
can
be
bloat
to
the
clusters.
If
you
have
verbose
logging
for
a
lot
of
containers
that
are
exist
on
their
manage,
kubernetes
services
typically
do
have
defaults
for
log
rolling.
However,
there
may
be
custom
and
custom
Enterprise
requirements
to
configure
some
sort
of
custom
behavior
for
log
rolling,
or
there
may
be
a
situation
where
you're,
finding
performance
impacts
because
of
the
size
vlogs.
Given
the
volume
of
what
you're
scheduling
on
a
particular
node
in
general,
though,
what
we're
going
to
show
you
is
a
daemon
set.
A
That
is
a
modification
of
the
anti-malware
example
that
runs
as
a
pod
with
software
installed.
That
makes
a
change
to
an
underlying
node,
meaning
that
it
doesn't
act.
It's
not
a
process
running
on
the
node
itself,
but
rather
a
container
with
access
to
the
underlying
node.
So
the
callouts
here
this
is
just
a
like
simple
engine.
X
image
I
believe
that
I
pulled
installed
blog
rotate
on
simple,
as
that.
The
real
magic
here,
though,
is
in
the
arts.
Once
again,
what
we're
doing
is
we're
going
to
the
mounted
route
here.
A
The
/mnt
/
root
node
and
then
to
the
location
of
the
containers,
Barlet
docker,
containers,
star,
star,
dot,
lock,
then
we're
configuring
some
sort
of
custom
behavior
if
you're
familiar
with
log,
rotate
it's
as
simple
as
just
writing
out
that
path
or
writing
out
that
file
in
some
sort
of
printf.
And
so
what
we
do
is
we
schedule
to
roll
all
the
logs
every
week
and
not
to
keep
any
of
the
old
logs?
A
So
it
can
continue
to
run,
and
so
this
is
a
modification
from
the
anti-malware
daemon
set
in
the
sense
that
once
again,
it's
installed
on
the
pod
affecting
the
underlying
node,
whereas
anti-malware
as
you
can
imagine,
needs,
have
visibility
to
all
of
the
containers
running
in
a
particular
node
justifying
the
difference.
So
this
would
be
an
example
where
you
might
use
more
commonly
where,
as
the
anti-malware
would
be
a
situation
where
in
important
situations,
you'd
use,
so
we're
going
to
shift
from
monitoring
now
over
to
some
of
the
synergy
that
comes
with
managed
services.
Yeah.
B
B
All
right,
so
we
do.
You
know,
we've
been
mentioning
a
little
bit
about
these
startup
scripts
and
essentially
the
just
shell
scripts
that
can
do
a
whole
bunch
of
things.
We've
got
some
use
cases
over
here
with
combat
some
use
cases
already
and
there's
some
additional
ones
over
here,
for
example,
you
know
you
may
want
to
set
the
timezone
or.
A
B
Host
file
settings
on
the
on
the
pod
as
you
as
you
run,
and
the
way
that
it
works,
is
you
kind
of
plug
this
into
the
application
startup
process
today,
when
you,
when
you
equate
a
doctor
container,
you
have
you
know
you
just
go
into
your
application
and
you
run
your
application.
What
we're
trying!
What
we're
saying
over
here
is
before
that
you
have
an
extra
step,
which
is
a
bunch
of
scripts
that
essentially
customizes
it
for
your
environment
so
down.
If
you
go
to
the
next
slide
or.
A
One
more
thing
there
is
that
the
biggest
thing
that
you
want
from
a
DevOps
perspective
is
to
be
able
to
change
parts
of
the
DevOps
process,
while
affecting
as
minimal
the
stack
as
possible,
meaning
that
applying
startup
scripts
when
it
comes
to
the
runtime
of
the
containers
has
unique
value
in
that
you
don't
have
to
rebuild
all
of
your
containers
across
the
board.
Every
time
you
update
your
standards,
but
rather
you
can
do
so
in
some
sort
of
single
point,
and
you
won't
have
to
like
replicate
that
effort
across
the
board
for
your
application.
B
It
downloads,
an
actual
bigger,
bigger
script,
runs
all
the
commands
and
finally
said:
okay,
handover
applicator
control
to
the
app
to
the
application,
and
and
that's
it
right
there
by
then
everything's
been
set
up
exactly
the
way
that
the
enterprise
customer
wants
to
do.
Yep
and
yeah
I
mean,
of
course,
if
you,
you
know,
you
would
use
humanity
secrets
to
to
store
the
location
of
these
shell
scripts.
That's
just
normal
best
practice.
B
A
B
Yeah
excitement
about
server
lists,
as
you
know,
in
a
cubed,
a
nice
cluster.
Typically,
you
have
static
nodes,
and
these
days
everybody
is
like
you
know:
do
I
really
need
static.
Noise
can
I
get
something
more
on
demand.
Yes,
you
could
you
know
Kuban
a
nice
clusters
can
scale
up
and
scale
down,
but
we
all
know
that
takes
a
little
bit
of
time.
The
scaling
up
processes
are
not
instantaneous
and
so
by
using
the
new
virtual
node
of
the
virtual
cube.
B
All
that
feature
in
in
the
queue
Benares
back
in
the
recent
version
of
cuban
aires.
Any
cloud
vendor
can
plug
into
that
process
and
provide
their
own.
Like
definition
of
what
a
node
is.
Okay,
no,
doesn't
have
to
be
a
physical
thing,
it
can
be
a
virtual
thing
and
that
virtual
thing
can
point
to,
for
example,
like
a
four
gate.
You
know
environment
in
Amazon
or
ACI
a
container
instances.
I
forget
what
the
Google
one
is
called,
but
yeah
they
all
have.
B
You
know
this
disease
dynamic,
container
services
that
you
can
that
they're
essentially
meant
just
to
run
a
quick
container,
and
then
you
know
teardown
right.
You
build
by
the
second,
and
but
it's
just
very
quick
in
and
out,
and
the
virtual
cubile
that
allows
you
to
plug
in
cuban
at
ease
into
that
feature
such
that
you
don't
have
to
do
anything
you
just
have
to
create
a
pod.
Just
like
you,
do
normally
create
a
deployment,
drought
and
it
will
just
use
the
you
know
the
virtual
note
and
I
could
ship.
We
have
time.
B
I'll
show
you
a
demo
later,
but
that's
something
it's
a
free
recommend.
You
guys
look
at
the
second
one
is
which
we're
seeing
a
lot
in
in
enterprises.
Is
they
typically
have
a
lot
of
file
shares
already
that
they're
using
you
know,
maybe
they've
got
other
third-party
applications
from
on-prem
that
are
writing
to
the
file
shares
and
those
file
shares
have
to
be
made
available
to
the
pod.
That's
running
in
cuba,
Nattie's
and
so
in
cuba.
B
That
is,
you
can
set
up
a
mount
to
a
mentor
to
an
SMB
share,
but
again,
like
I
mentioned
earlier,
make
sure
that
you
use
a
managed
service
for
the
file
share,
and
so
you
know
all
of
all
the
cloud
providers
provide
manage
to
file
shares,
so
I
would
recommend
you
use
that
and
then
connect
your
path
to
the
file
share
and
we've
got
a
couple
of
quick
llamo
files
for
you
to
see
over
here.
This
is
how
you
do
the
virtual
note
setup
again.
B
This
is
possible
with
aks
and
we
have
working
in
in
Azure
container
service.
So
it's
something
you
can
do
in
a
managed,
Cuba,
Nettie's
environment.
You
don't
have
to
you,
do
muck
around
with
the
underlying
infrastructure.
To
do
this.
The
second
one
Daniel
II
because
quote
ya.
This
is
a
phenomenal
file
for
the
file
share
service
and
nothing.
But
you
know
just
mapping
mounting
a
drive
to
the
file
share.
It's
just
baked
into
the
ya
know:
you'll
notice
we're
just
using
cube
control
for
everything
we
don't
really
want
to
muck
around
with
the
underlying
infrastructure.
A
When
it
comes
to
the
file
share,
what
you'll
see
when
you're
defining
the
volume
is
that
there's
native
support
to
define
an
azure
file,
and
then
you
just
provide
the
secret
name
and
the
share
name
in
order
to
access
that.
So
what
we're
seeing
is
more
and
more
integration
with
upstream
amyl
support
for
kubernetes
when
it
comes
to
cloud
provider,
specific
function,
a
healthy
and
oftentimes.
This
it's
replicated
across
multiple
types
of
clouds.
A
B
While
Daniel
is
setting
that
up,
does
this
resonate
with
folks
over
here
in
the
like?
Do
you
guys
see
this
with
your
enterprises?
What
we're
talking
about
is
there
something
that
makes
sense?
Is
there
anything
that
do
you
think
that
we're
you
know
that
that
you're
dealing
with
that
we
have
may
not
have
covered
over
here
any
any
any
specific
topics
that
you
think
that
you're
pressing
at
your
customers,
especially
enterprise
customers?
B
B
Container
hardening,
you
said
the
hardening
of
the
actual
container
yeah,
you
mean
so
before
image,
hardening
the
image
itself
right,
Mir
scanning
the
image,
that's
a
company's
like
twist,
lock
and
whatnot
are
offering
or
have
a
are
offering
we're
yeah.
Definitely
that's
a
very
good
one,
yes,
which
was
matcha
patching
of
the
nodes.
Yeah,
that's
a
good
one.
B
They
would
have
to
do
you
know
the
the
cordon
and
the
drain
of
the
node
reboot
the
node
and
then
on,
coordinate
again.
So
that's
something
they
would
do
like
on
a
weekend.
You
know
off
hours,
but
you
can
do
it
in
a
managed
way
in
a
controlled
way.
I
should
say
such
that
you
don't
impact
any
of
the
pods
that
are
running
on
those
notes,
and
you
do
it
obviously
one
note
at
a
time:
okay,
so.
A
To
jump
into
a
lot
back
into
log
rotate,
thank
you
for
everyone
for
that.
So,
as
you
as
you
remember,
we
have
the
arts
here,
which
is
really
doing
the
bulk
of
the
work.
We're
defining
that,
where
we
should
be
rotating
logs
is
on
the
underlying
node.
However,
the
application
itself
is
being
run
from
the
pot.
So
what
we'll
do
is
a
cube?
Ct
I'll
get
pods
will
exec
in.
B
B
Screen
to
come
up
here-
okay,
great
so
I-
have
a
couple
of
Cuban
Andes
clusters
over
here
that
are
set
up.
So,
as
you
can
see,
you've
got
a
bunch
of
pods
running.
Of
course,
the
spunk
pardon
gotta,
love
goat,
ate
everything
antivirus
or
here,
but
the
important
one
I
want
to
show
the
first
two
are
the
ones
that
I
saw
the
standard,
UI
and
middle
tier
deployments
that
we
put
out
there.
So,
let's
see
you
guys
have
all
teams
supposed
to
be
familiar
that
sort
of
standards,
Blancas
setup.
B
So
let's
run
the
application.
Real,
quick
and
you
can
see
like
from
the
services
that
there
was
an
external
IP
assigned.
I
know:
I
use
an
external
IP,
although
we
said
not
to
use
an
external
IP
use
and
I
internal
labeled
balancer.
It's
just
easy
to
demo
an
external
IP.
So
forgive
me
for
that
so
anyway.
So
we're
gonna
use
that
external
IP
to
just
to
fire
off
a
quick
app
over
here.
B
Hit
the
app
over
there
and
over
here,
I'm
gonna,
just
say,
for
example,
we're
gonna
say,
look
for
all
events
over
the
last
1
minute
right
and
so,
as
this
thing
runs,
you'll
see
that
it's
you
know
very
quickly.
It's
able
to
all
the
events
are
flowing
from
the
Cuban
aries
cluster
into
Splunk,
and
you
can
quickly,
you
know,
track
it
in
this
particular
case
Danya.
B
We
have
to
go
and
take
a
look
at
this
because
I
see
a
lot
of
exceptions
over
here,
so
there's
something
going
on,
but
yeah
you
can
go
in
and
take
a
you
know.
This
is
that's
one
thing
that
it's
good
for
yeah,
so
I
think
that's
where
rap
on
time,
I'll
be
doing
in
time.
Yep
I
said:
okay,
we'll
take
a
few
more.
You
know.
We've
got
a
few
few
minutes
for
questions,
so
why
don't
we
save
some
of
that
last
few
seconds
so
happy
to
take
some.
If
anybody
has
questions
over
here.
C
B
A
The
question
is:
concerns
about
running
multiple
application.
Large
applications
on
a
single
kubernetes
cluster
managed
cluster
in
the
enterprise.
It's
a
really
good
question
and
something
that
a
lot
of
companies
are
having
to
play
around
with
to
decide
what
works
best
with
them.
Generally
speaking,
what
manage
kubernetes
services
do,
at
least
in
the
context
of
IKS,
as
it
provides
a
free
control
plane.
A
This
means
that
it
really
lowers
the
overhead
associated
with
having
multiple
clusters,
and
so
what
we're
seeing
is
that
the
standard
practice
when
it
comes
to
hosting
production
workloads
is
to
have
the
particular
application
hosted
on
a
cluster
of
its
own.
Typically,
then,
that
cluster
there
are
multiple
replicas
of
that
cluster
across
different
time
zones
as
well
for
testing
environment,
it
oftentimes,
makes
sense,
maybe
to
just
have
non
load
bearing
applications
resting
on
the
same
cluster.
B
A
So
currently,
I'm
working
with
a
customer
in
this
in
a
scenario
where
there's
like
over
500
containers
at
rest
across
20
nodes,
and
so
when
you
have
these
large
applications
already
at
rest,
you
want
to
ensure
that
no
process
hungry
elements
of
application
one
can
impact
any
sort
of
application.
Any
have
any
impact
on
application.
Two,
because
that
can
lead
to
some
confusing
troubleshooting,
we'll
say
good.
B
C
B
B
You
know
we
can
only
talk
to
pods
that
have
that
label
and
so
on
and
so
forth,
and
so
you
can
start
enforcing
a
zoning
layer
inside
of
your
kubernetes,
because
your
brilliance
tends
to
be
very
flat.
Yes,
you
have
namespaces
that
you
can
use
in
some
way,
but
the
generators
will
be
very
flat.
All
the
pods
are
very
flat,
so
just
by
using
these
these
nipple
policies
and
and
and
labels,
you
can
effectively
control
who
has
what
access
to
what
and
segment
the
traffic
according
perfect.
Thank.