Continuous Delivery Foundation CDF Twitch Channel, 14 Jul 2020

Previous Meeting

⏯

youtube image

►

From YouTube: First live stream with Adam, Dewan, and JJ on the CD Foundation Twitch Stream!

Description

We install tekton, build an off the shelf pipeline all based around the catapp from https://github.com/a-roberts/catapp.

A

Hello, we are live now. Yes, wonderful! I it's! I can see it in the preview. um Welcome to the first uh cd foundation, twitch stream. um We are live and I have some friends here. uh We're gonna do around quick of introductions, but I want to make sure if anyone's in the chat, the sound sounds okay, um so we can make any major changes that we need to otherwise we'll just jump right in. Let's give that a second or two see if anyone says anything, y'all can actually say some stuff too.

A

If you want, you know just to make sure that people can interact with you. You know: oh hey, hola.

A

There you go um yeah, so let's just jump right there, you're perfect, uh let's jump in who are you dwan? I see that you're a developer advocate.

B

ah Yes, uh uh developer advocate a rare breed indeed, so what we do as developer advocates is basically uh make developers life easier whatever that means, and I'm based out of the beautiful city of toronto, canada and I work at ibm cloud so just uh same team as adam and similar work that digi nice does.

A

So so wait who's adam.

C

A

C

I've worked ibm for a while, I think, seven years, I'm a software developer by trade. I work on techton kind of maybe a third of my time. I work on other kind of secretly ibm projects. I've worked on machine learning in the past. I really like to help customers and end users. So if I can share some tips and tricks and teach people a thing or two about tech ton along the way, that would be great.

A

Thanks, nice and and you're an ambassador, aren't you yeah.

C

Yeah, not just any old ambassador for the cvs.

C

I won a few committees as well and it was a recent appointment. So if I can reach more people through the cdf and spread the word about how good the cdf projects are, and that kind of thing.

A

Nice, nice and.

B

How about you, who's, genji,.

A

Yeah, I just I just started talking not knowing here, no one knowing who I actually am uh yes, hi, I'm jj, uh I'm a developer advocate um for the ibm cloud. My job is as to why I'm so put it is to make developers lives easier. um I get to play with new technology, I.e, techton and things out of the cd foundation, and I I stream on other channels too, and just to kind of bring this all in perspective.

A

We tried to figure out a way to reach the audience for cd foundation to get adam to be his life. He's a developer, we're trying to make his life better.

A

um We we thought we should try twitch streaming here. So uh this is our first one. um We have a couple of things. uh We did a dry run last week, and maybe you saw that maybe you didn't, but this is our first live one. So if you are in the chat- and you are watching, um please don't hesitate to contact us. We are live well. Two second delay um and we're gonna do this, uh so we're gonna basically walk through what we did last week again but live um I'm gonna.

A

Go ahead and start sharing my screen uh just because um you know that's the way, so we can actually see things being done and then um we're gonna have some fun right, guys, yep.

C

A

Awesome all right so and again I apologize ahead of time if anything, embarrassing pops up on my screen. While I'm sharing um live in front of people, I have turned off all my notifications, so hopefully not but we'll see. um Let's see how this goes all right, so um I put a simple agenda together and both do one and adam have access to this, so we'll probably add to it as we go, but I think it's really just a great idea to start off with um adam what what is techdon.

C

Well, there's a very nice paragraph there that kind of explains it. No, I can, but if it was a person on the street or in a pub, they made a pub if I was somewhere with a lot of I.t professionals and they want to know about takedown. Specifically, I would say it's a way to. Basically you can write things like tasks and pipelines in a kubernetes native way, so let's say using kubernetes already it could be. You know open shift or mini cube, or you know a cloud provided platform.

C

You want to start using things of pipelines and automation. So what you might do is install tecton into this cluster and then start to write these tecton tasks and steps. A typical step might be um go and pull in this image from docker somewhere and then run this command with it once you've done that command put the output somewhere. You then chain these things together to form let's say a pipeline, so people made fun of things like travis or jenkins.

C

This thing called jenkins x, which kind of blends text on and jenkins, but it's kind of a newish way to do continuous integration and continuous uh delivery and deployment. That's why I put it in a conversational way: there's a really good website. We have here and it's all open source. So please do keep the tires see if it's good see if it's you know falling over and hopefully today we're going to tell you a little bit more about how to use tecton and show you in action. That's kind of the whistle stop tour.

A

Perfect perfect and I think you uh you tackled, why should I care and um which is true, because I mean obviously you should know why you should care about tecton and it's cloud native pipelines on kubernetes.

C

A

C

I think so so you know you get these custom resources like a tekton pipeline and that will stay in your cluster as a resource like a deployment or a service. Might so you get things like, I guess resiliency, and there are these controllers that make sure the actual state is where it should be. You get all these weird cloud native benefits and it's you know seems quite trendy growing and there's all sorts of different sub projects under the text umbrella that helps make developers lives easier.

A

Do do one you have anything to add around this with the exposure that you have to detect.

B

Yeah, I I work with tecton as well. Adam mentioned most of the key points and as adam put it that whenever he starts the conversation around techton, uh the assumption that those folks are somewhat familiar with kubernetes, because that's that comes in the first page, so I assume that you have some familiarity with kubernetes. So coming from a previous virtualization era, when we agreed that in the cloud world uh using applications running on containers is very helpful and when you know the benefits of kubernetes all the goodies that comes with kubernetes, that is fault tolerance.

B

That means, if your part goes down, it automatically goes up all those all those nice features you get with tecton and what? What? What is one of the one of the biggest selling points? If I might say, also it's an open source project is the reusability.

B

That means you have these blocks of pieces of ci cd, which you can just take and put into your pipeline and that just works with some tweaks awesome.

A

Cool, so so it's repeatability immutability and the ability to build up a pipeline in a cloud-native way on kubernetes yep, yeah, perfect all right. um So we've talked we're a bunch of talking heads right now and we're staring at this agenda. How about we put some goals in um adam? Why don't you put in a couple goals for us here? Okay,.

C

Let's see so, I'm gonna open up your terminal as well. um You will see me typing greatly. I reckon it's going to be um go and look at adam's cat up example, which is on github. This is me typing as fast as I can.

C

It's probably at this place, um see if it works, because what it should do is contain a tecton pipeline and everything in that pipeline is off the shelf apart from one task, so you want to get first-hand experience basically using the text on pipeline looking at the tasks and maybe using protect on dashboard to actually deploy something and then try it out, and hopefully the application itself is quite cool. Tank turn does like its cats.

C

So why don't you give that a try and we'll see if it works, and we can see if tecton was easy or hard to use and hopefully inspire some people as well? That's what I'm thinking.

A

Sounds great, um so I have a um a cube cuddle because we should do it the right way. We've got all get pods. I have a kubernetes cluster um with nothing on it name space I can't type because I'm swell name spaces there we go. We literally have nothing on this cluster. I spun it up, as you can see 112-ish minutes ago, um so uh from the from the ground up. Should we just start installing tecton? Is that the right thing to do.

C

Yeah, I think that the main website is probably the best place to start, so you can install text on and uh I'll come up, we'll go from there.

B

So you're getting it, uh although we're using uh ibm, kubernetes service ics, uh you can use any kubernetes. Basically, any kubernetes cluster will do.

C

Yeah, it's got quite good testing coverage on things like google cloud um open shifts pretty good, so I think you should just you know, give it a go.

A

All right so oops that did not do what I want um so this. This says the installation is just running this release.yaml now I don't know about you, but I don't trust random things from the internet. No.

C

You should have a bunch of deployments and services, so if you do um k, get the new k get all our cube, ctl get all and then do minus n techton dash pipelines.

A

Okay, well, I haven't actually ran it yet. I.

C

B

Should we should we take a look at it.

C

A

Just because you know that.

C

Should continue from the employment and the service, I think.

A

um W get there we go, so we can do them releases. Okay,.

C

So we have right, that's the namespace that I mentioned earlier, and there should be like a service definition and probably a deployment in that as well.

A

So we got some name spaces. We got some security policies now, if you've never seen. uh Kubernetes manifests before this is what it is. um It's just all smushed into one um there's a religious war from what I can see at least on having. If you have multiple files for the thing or all big one thing.

A

Obviously tekton has decided to do it all his release, which is fine, but I just wanted to make sure that the audience members do have an opportunity to see that we are. We did w, get it directly from from the techton website, and now we are going to apply it directly to a machine cool yeah.

A

Okay, so I have alias k to uh coupe cuddle because I'm lazy, that's why you'll see me typing, because I can't actually think about it. In my brain, my brain's, my brain is slow. um Dash f, apply, dash, f, release; okay, this looks like it's doing stuff yep.

A

All right, all right, here's the service! You were talking about or services. You were talking about.

C

Yeah exactly and that should all sit and protect on pipelines, name space you'll want to do a k, get pods and then minus and pipelines I'll switch your default name space. There you go.

C

Can you get pods yep? There should be a controller and a webpack one. Okay, good all right. You've got these techton things installed. um You actually get a bunch of custom resources next of tecton. So if you, for example, cube ctl get pipeline, let's say there you go, these are custom resources and we just installed those as part of the installation.

C

If uk get pipeline, it should be nothing, but at least it knows what a pipeline is. If you were to do how you get a foo, if you do that from it, you should say I don't know what foods.

C

Okay, all right, so I think the next step jj would be to you can install the tecton dashboard. um That would let you see. What's going on with the galaxy taped on itself, so actually create these pipelines. You can interact with them. There's that option all this is good the catap option. We could combine the two together if you like,.

A

I think we should combine them, but just because, for someone who's just walking into this world, is this the best sanity check that we can make sure that we have the crds or is there another sanity check that we could do to make sure that our installation is what we what we hope to expect.

C

You can also text on hello world, so you could, when, um if you go to protect on main github page, there should be some docs and it's like you know you can write a simple echo, hello, world type pipeline. um Hopefully that's that's around here somewhere.

A

Yep this is uh this is what we did. This is the one that uh we actually wrote on a different stream, um but this is just a it's just another like it's a sanity check right.

A

Everybody should have sanity checks, um instead of jumping directly to adding complexity by adding the cad app with all the stuff off of the catalog, though, don't get me wrong, the the goal of this is to show how easy it is, but it's always good to have a sanity check or a smoke test or whatever you want to call that a concept. So you, don't you don't waste your time with a broken installation. Is that.

C

Yeah secure statement, yeah there's a lot of scope, things like permission errors or um persistent volume issues. If you use resources, so yeah run a hello world and let's, let's see what happens.

A

Oh, no, no I'm not saying we. I know I'm good, but I'm just telling other people that they should do this at least once to verify this stuff. Okay, so, okay, um now we were going to go to this url yep. Aha, this looks like a github repo.

C

So hopefully the readme is accurate, but I would recommend giving it a try, so it contains a pipeline, some instructions and it's a little bit more complex in that hello world and again, hopefully, everything can be found in the catalog, which is basically a collection of different tectonic tasks that I've put together as part of one pipeline. So it's like going to a department, store and picking things up off the shelf, putting it on the counter and just saying here it is: it's all gets assembled for you through my pipeline.

C

Everything is freely available, so that's the catalog yet where you can see.

C

Various things, I guess that's the structure of it.

A

uh Where, if I was gonna, look for other things, is it under the task directory here yep.

C

You think so so it's changed quite a bit, but usually they have like a different. You have a folder name and then like an owner's file. So that's who's responsible for a task. You might have like a github task or a slack task and they've all got their own respective maintainers and owners.

A

uh Github, that seems like a pretty consistent thing. People will be using.

C

Yeah this is interesting. This has changed, must have got all the the history and the rights yes yesterday yesterday.

C

So the way I did it was, I actually checked out a certain commit hash just to be safe um and I've got a script called cobb dependencies.sh. That checks out an old version of the catalogue, because all these names are completely different and different from my eyes.

C

You know I need to know it's great.

B

Oh, that's great, just as we are on the this page jd. If you could scroll up please and go to the main repo uh for for someone who's completely new to techton on the main tectonic city like github.com, technon cd, so techton is like an umbrella project with many small sub projects, so what jj just installed? That was the pipeline controller, so that is under pipelines project, and this is a pipeline. This is this is the one and then what adam was showing was the catalog sub project so the umbrella project.

B

It has many helpful pieces, for example, what we'll use uh later is a dashboard project that that adam's team work on yep.

A

Okay, um so so we we've level set that you need to know at least a little bit of kubernetes to be able to use tecton, because it's it's a it's a extension extension question mark of and best practices of, doing pipelines on cloud native infrastructures. That's kind of what we're we've alluded to right. So you need the base knowledge to do that, so we're not going to go very deep into kubernetes, but we're going to touch it quite a bit right. Is that it okay.

C

Yeah, exactly because kubernetes comes in a song like resources like services and deployments, and we extend those and include things like pipelines and tasks. So it's indeed an extension for doing you know: ci cicd,.

A

All right, so um I think we should check out this code that you wrote. This seems like a reasonable thing to do.

A

A

Code, like so yep.

A

Okay, so um archery on here I don't have fine, that's not going to help uh readme.

C

Is a good place to look at okay because the rest of it is kind of just gubbins.

A

C

Go so there's quite a bit to do, and the reason is a bit to do is because we're going to build this source code and push it to your docker registry, so we're going to need to create a secret, I'm not going to say anybody can push to jj's registry, then we're going to use the practice service account and basically tie everything together by doing the deploy command or the ckn command, which is a way to run pipelines referring to your own namespace and service account. So it's this is kind of like you know.

C

If you've seen hello world, you know what it is, but that's actually something that people do all the time. Let's go and come something build and push the thing and then deploy something. That's why it's you know not just one or two steps. That's.

A

Awesome um so uh just because I think I already did it, um I believe I already have the cad app already on my my docker registry oops. I forgot. I forgot to remove that um so I'm going to put I'm going to put up some top secret real quick just because I want to make sure that people, don't you know, steal my stuff.

A

Pub.Doctor.Com and I'm going to delete it so and then I'll bring it up to show you that there's nothing in my docker registry, um so we're.

B

Going to be going.

A

From no cheating exactly so delete this repository cat app, I should have done this before the stream. I'm sorry, okay, uh so back here, um just to prove we do not have anything called cat app on here. If I search cats, I don't see anything with that. I don't have anything with app. I have my app, which I actually generally don't know what that is, um so nothing nothing hidden. This is completely where we are going to be pushing up to this register cool all right.

A

Now um we have so I'm thinking we should probably have the readme open at the same time as we're doing this right, like this seems like something we should refer, refer back to pretty regularly yeah sure.

B

And if it helps the readme could be on the github ui as well, if that readability helps but.

A

Yeah, I see the two.

C

B

But yeah the both screen is.

A

A

Okay, so we're in the directory. Now we have we're not going to build this locally, we're going to trust that your code works, because I don't want to deal with portfol for like forwarding stuff anyway. Okay, so modify config, service.gamo and point it to your own docker registry. So.

C

I think it needs to be deployment.yaml, so the service is where we define like what port it lessons on, but I'll, probably approach within deployment.yaml, because that's more of a sensible place to do it, let's look in there. Instead, I want to see if it's an image reference there.

A

C

A

A

C

A

The bing things, gentlemen, all right do we do anything else here, nope or is that everything we need? Okay, that's it.

A

Oh, um don't we need to install the dashboard also before we go any farther here or should.

C

Yeah now's a good time too, so you can install protect on dashboard and that's going to be a convenient way to see what technology is doing and they'll actually create tech, tons, secrets and package. These service accounts you're going to need a secret to posture registry. So why don't you head to the dashboard repository and see if the installation instructions work yeah? I know that guy yeah.

A

He's very prominent he's.

C

Done the docs calls quite a bit as well yep.

A

Tecton dashboard install yep there you go hey. I know that guy too.

C

A

C

So hopefully you can pick a zero seven one uh release from somewhere. Now, let's not use the installer just yet, because that's kind of experimental thing this is the one that I'm very confident will work.

C

The installer works as well, but that's kind of what we want to push out for 0.8. This is 0.71 of the dashboard. If we do, that command should be good.

A

So, just just doing another cube cut to apply from the internet to say: hey, go, install my my things, there's a little bit of facetiousness in there and they're just saying, curl bash all the way. No.

B

Okay, it's just a yellow trust; trust that you don't you put.

C

Why don't you put a pseudo on there as well jj? Oh, I should.

A

B

C

A

It's hunter two: what are you talking about.

C

That gave you a bunch of other resources as well, um and hopefully the readme tells you how to access the dashboard.

A

So this tells us we should be monitoring for everything in running state. Is that still something.

C

We should do yeah, it's always a nice sanity check just to make sure the pods came up when they're happy. The deal looks good to be happy. So that's good.

A

All right, I did hit control c.

C

And so accessing the dashboard and cube netize is next now they give you a choice. So if it was open shift, you'd get a route but you're not an open shift, so you can either proxy or put forward.

A

Juan which one should we use.

B

Flip coin: well: let's, let's use four four.

A

Four, so what I'll do is, I will do this in another window just so we can have it running, so we don't have to see all this stuff coming back, but what what we are doing is exactly that command where we are going to port. Oh wait hold on this is on a remote machine.

A

No, we need to do this on my local laptop, don't we.

C

On your laptop that's connected to the cube cluster, and then you do the portfolio command, yeah.

A

Crap: okay, hang on back back to the secrets, and I want people to steal.

B

My stuff, so while dj finds it like, although we are using dashboard, you can also do it without the use of dashboard. So for that create the kubernetes software, you create the service account you attach that to your pipeline and then you, but dashboard makes it much more convenient.

C

That's right, you could, you know, just create a modified yaml and you can also use this thing called tecton, cri called tkn and that will basically stream the logs as well for what your pipelines are doing. So you know we're trying to cater towards everyone. Pretty much. You know the folks who, like the ui, a lot folks who want to use it a little bit, maybe for secrets and those that are just preferring to use the command line so give you the.

C

A

ah Here we go all right, just thinking about it, as you see it says, tecton dashboard.

C

Nice- I was never never in doubt about that, so this gives you a nice view of what techton's up to so you've got nothing yet which is good. You know no one's compromised, your machine and there's a really nice secrets, page we're going to use to get that docker thing sorted out, because the way takedown does sequence. Currently it relies on these annotations on secrets like techton.dev, and we handle that fever dashboard.

C

So we're going to want to create a secret here, jj, it's going to be of type password and yet click on that big, create button. And before you do this jj, I want to make a decision. I want you to think whereabouts should my pipeline run be because it needs to be in the same name spaces where your secret is and we've just installed, techton into tecton pipelines.

C

But where do you want to actually run the thing? It could be a separate namespace, for example,.

A

So right now we have everything sitting and just to repeat what you just said. So I'm walking through in my head everything lives inside of tektom pipelines so and we're just well. This is a three node cluster. Nothing crazy! Crazy is going on.

A

um But if I, if I was sitting here as a person with a much more robust um cluster, with a lot of things going on, possibly maybe dev qa sitting on there, um I would imagine we still want to put all our tech tawny things inside of tekton pipelines, because then tekton is completely scoped to that namespace right or is that wrong.

C

So you could think about it in two ways: detect on pipeline's main case is where only tecton itself sits. So those controller policies are real in the dashboard and then you might give duane access to his own namespace called team. One now we have access to team two and our pipelines and pipeline runs are all isolated. You may have some special source secret project and this should be namespace scoped. So you know we can use this one for now, but eventually one might want to set their own namespace and do things in isolation.

B

I'm just going to use this opportunity to ask this question because this this is the type of questions I got from many clients uh who were just trying to think about tecton that if they have their enterprise like multiple clusters, where their secrets are living in one name, space is all the secrets uh and they would like to use team one team, two team n to to run all the different workloads for their devops needs would a single name space with all the secrets be able to hook up with all those different tecton resources.

C

uh No typically, so you could do things in the same, so basically cross reference and across namespaces and cubenet. Isn't really you know that encouraged? So you might do things with your own service accounts and roles and more bindings in their own namespace, and you would have maybe a copy of the pipeline over in that namespace as well. I'm not sure if you can cross-reference pipelines at the moment in tecton, um but you can use things like cluster tasks.

C

uh Cluster task is available across the cluster across namespaces, so I think, for simplicity's sake, you'd go with, let's say using the tecton pipelines namespace, but for production case you.

B

C

Different namespaces, proper role-based access control. That kind of thing would be considered.

A

My gut, my my gut in my, I guess my head, because it's not my gut talking against my head. um It feels like that statement, you're or, if you're doing multiple namespaces with secrets across everything shouldn't you be looking at something like hashicorp vault by that time, because you need a way to have secured secrets across multiple different entities, and you don't want you sharing secrets across name. Spaces is great in development, but in prod you should have rigor to make sure that um you don't do things like that.

C

That that's a good stream idea. I think right there, jj it'd, be nice to them a try and see how um how technology can handle it.

B

Yeah that can spin up a nice architectural security discussion as well.

C

A

Well, I'm sorry, I think I just figured out what we're doing next time.

C

Well, actually, we're nice to extend the pipeline um because there's room for improvement. I think the one might be a summary of slack, so we can. We can consider that.

A

Okay, so I'm just taking some notes because I mean as as we say, this is live then um the next one is going to be to extend the pipeline to be moving forward, but then, eventually we should think about vault and security over um different name spaces on pipelines. Is that a good way to describe it? Yep, that's right.

A

Ns and and no joke one of the hardest things about streaming is to figure out what you're going to do next, so we already have two streams already planned. That's that's really good! That's a really good sign.

C

So jj remind us what we have at the moment.

A

We have, we are we've decided because we don't want to make it too complex or too hard we're going to still put everything inside of protect on pipelines, because we just we want to show this working. We're just doing this in dev. If you will not really dev, but if we were doing it in dell or dell dev dev jeez wow.

C

A

C

A

uh They probably are a bunch of r710s, no joe, but anyway um the uh so yes, we're gonna do stood on uh tecton pipelines for now, because I'm gonna blow this cluster away anyway. We're not gonna have it for next time, because we'll extend it and we want to show what we can do quickly to the point which anyway, yes, so we're going to do this in tact on pipelines. So back to the secrets, honestly, yep darker secret.

C

A

C

Fantastic one of the best very original.

A

Yes, uh we want to put it in techcon pipelines, yep there's a password, a username of jj asgar yep, and I don't actually know what my password is so give me a moment here, I'm putting it in getting it from my little password vault.

C

I simply won't show in plain text: jj.

A

God, I really hope not I'm I'm I'm rolling the dice on this one.

C

Okay, I'm watching the stream and where the master's.

A

Nice, nice and create.

C

uh Look at the access to part, so sequence used in several ways: go on the access to drop down instead of doing git server choose correction now change the annotation. Let's put this on it just say: text on when you're doing your thing with docker or image registries: this is the kind of secret you might want to consider. So that looks good to me now.

A

So so can I add things to this access for things or right now? Is it only these two things could like extend it to like my git web instance, or something like that, so you can use the.

C

Git type secret with github, yes um for anything else, I don't.

A

Because we should be using clay because we're ibm.

C

Yeah I'd say it's key, but yeah. I think you can.

A

C

Can get some red.

A

Headers to extend that, for you interesting.

C

B

And one other point is see how we're creating does the docker secret? We don't have to create the the github secret because it's a public repository.

C

Yeah exactly a very good point, using.

B

A private repository.

C

B

Like jd created a docker industry, there's a access to git registry.

C

Yeah so you'd make multiple secrets: you'd make one forget one for docker and you patch them to the same service account that your pipeline would eventually use.

A

And, of course, if you're doing this in the real world, this would be a lot faster right, because you, you see all this, but we want to make sure that we are clear, walking everyone through this. So if you decide to do this at home, you can see what we're actually doing.

C

Yeah so jj. The next question is who's going to run your pipeline. What service account.

A

That's a great question and if I'm correctly, we had some really really nasty problems with this, and I don't want to go down that path again.

C

You want a service account, that's going to be able to do quite a few things, for example create deployments and services, because the application itself will so detecting is quite powerful, but that is probably meant to be just for the takedown dashboard. So what you could do is go and copy an example service, account.yaml somewhere and basically get that ready for manipulation, because what we can do is we're going to set up a new service account called test.

C

We can give that a bunch of permissions and we can choose that on this menu, because I.

A

Want to keep it.

C

From detecting dashboard.

A

Now it does say this is optional, so can I just leave this open and will our new service account appear.

C

So you can do this and not patching anything yet, and what we can do is use the command lines. We get the service account later and we had basically a reference that secretly just made. This is like a an image: push secret if you like, it's just a normal secret in kubernetes, there's also much pull secrets which have a pulling.

A

Push is it is it the service here. Is that our our service account or.

C

No, that's a service in the sense that you can access something like via a port or an address. So an example. Service account is probably best. If you go to the official keeping it as docs. Look at service account. There should be a little bit of yaml. We can basically copy and use as our base and edit that together and add a bunch of permissions.

A

Kubernetes, I literally googled kubernetes service account. Hey, looks like I've done this before.

C

Yeah, so hopefully, something nice we can. We can build upon, hopefully yep. Okay, that looks like a service account to me. Api.

A

B

C

You see that there copy that and put it into an editor of your choice and because you're.

B

C

Namespace, if you were to apply it, it should sit in this name. Space.

A

Yep, we are in the tech time new space yep.

C

So let me just add that and then there's a little line in the bottom, that I don't think we need particularly relevant.

C

Yeah, I don't need that line on there. I just get rid of that all right and, let's call that's not a bad name, but let's go something like test there. You go yeah, so yep that looks cool. Do that apply that.

B

You probably won't.

C

It's just that.

B

The service account like some kind of testless. That's dash essay so that when you do the we get you, we know that this is a service account.

C

Yeah, that's true.

A

We're not giving you any permissions or anything because we're giving you permissions through the gui correct.

C

We're going to give this permissions by doing cost role and more binding stuff, and they, basically you know a way to give permissions to service accounts.

B

We also need to uh refer the secret right, which we just created in that service account. Yes,.

A

Yes and that's what this.

B

Is uh no it's in the service account.

B

C

Yeah, because the dashboard yeah so in here you get a new secrets. uh Stands there go ahead. John.

B

Yep secrets, colon and then dash name.

B

And we refer, I think we call it docker secret docker, that secret yeah, okay, that's good.

A

Okay, so now k applied, apply, dash, f service count yep, it looks like it.

C

Did something nice all right, so that's gonna need some permissions. I think um what you can do is give it a try now and run the entire pipeline with that secret and service account, and if it does error for whatever commission reason, we can then go and fix that issue. You may want to do that.

A

Okay, so I go back to this: oh it did nice. I want.

C

To check that we don't need because we already just did the packaging. So what do I want? So there's a manual packaging of the service at home that the dashboard could have done for you.

A

A

C

Cool, so what's next in the instructions uh jj.

C

So we've done that determining bit.

A

Yep so now we need to do grab dips.

C

Yes- and this is the thing that goes and looks at the catalog clones- it checks out a certain revision, because we know the ford name is a little bit different now and goes actually applies. All the cube and the tecton tasks that the pipeline have built will actually use. So, if you now do you know cube ctl get task, you should see a bunch of useful looking items.

B

I, like that name.

C

B

A

C

All right- and the next bit says, is to remove the host path references in meepo pvc.yaml, if you're in a real cloud environment. I believe you are so.

A

C

C

There it is in the.

A

Box we do not want that.

C

Yes, get rid of that. That was useful on docker desktop just for testing um and then what's next, if your deployment reveal you've done that uh it's scrolled down a little bit, there's a little bit about role based permissions. We're gonna do that after the fact. That's what I won this pipeline um and now it says studio, tk and run command so open that tk and run script.

C

um You're gonna realize a few things one. We need tkn yeah and two. We have to change it to use that service kind of namespace that we just made.

A

Okay, so tk run command.

C

B

C

A

B

C

Exactly so, it takes a bunch of arguments, but if you go down to the bread and butter, the actual command that gets room it does this pkn command and it does a minus n defaults. That means use the namespace default in the service account default. So you want you to change those two words towards the end of this and make sure it uses the one we just made. So your namespace was ticked on pipelines and the service account was test. Hyphen essay.

C

Exactly yep, okay, so save that and remember we need this gkn thing now and.

B

I added the comment on the the tweet twitch chat just for reference. The brings perfect.

A

Tkn run https github.com, hey roberts,.

C

Says you're getting it ready.

A

A

Is this supposed to be 30, 30 or 3300.

C

um I think, what's in that's.

B

Good okay, viewer discretion ahead. Don't try this at home copy all your urls.

A

Okay, so I got the command ready. What do we do now.

C

I think dubai has given me something that looks useful.

A

I believe I already have tektron tkn installed. Yes, okay,.

B

C

C

A

Great yeah well, this is also a linux box too, so I can't use brew. Unfortunately,.

C

So terrible, okay, so why don't you give that give that command a go? And I think it's going to run the text on pipeline.

C

Hopefully, it'll get to the end, but you may get some permission errors, but the dashboard will show us the pipeline's running and where it got to so I'm ready if you are.

A

All right, so, let's bring this over here and then bring our dashboard over here and we would see it in pipeline runs yep. Okay, it's good place to be so. We got nothing going on here, but if I hit this button yep, oh that didn't like it, I'm in the wrong directory. Am I.

C

uh Oh, you know, but you there's no pipeline. Is there so do k get pipeline for me, jj.

C

That is correct. Okay, so now do a ls tecton. I think I've. Basically, you need to do a k apply tectonics a lot of times I've given you the dependencies we're going to run command the pipeline, but I didn't tell you to create the pipeline. So that's great.

B

And just 10 seconds for people who are trying to understand so the the smaller units are the tasks, so we have the grab dependence created. The task and pipeline consists all these tasks, so pipeline needs to be there in order to have the pipeline run so pipeline run is an instance of pipeline. So if you compare object to instance, like you're, coming from object-oriented background.

C

That's right and all these tasks have got their own steps as well, so you can find them out in the catalog. You can put a link to it or you can check out the code in github just.

A

Like just clone to get clone, which is good, build and push to the docker url that we're changing. So it's it's again back to the modularity right, where we're we're pulling a bunch of modules, if you will catalogs tasks off of the catalog repo, um not master, because we discovered problems with that, um and now we are just taking some very basic changes from the tecton run that we have, as we saw, were just a bunch of urls and variables to get the cad app to do this thing right, yep, yep, absolutely.

C

B

C

Is when you've run that it should push the image somewhere if it doesn't deploy? We can always pull your mission open and run the cat up that way. So, yes, I'm ready to run the pipeline one. If you are.

A

But what's that pvc thing that popped up is that something I should be worried about, because.

C

We use something called workspaces and that's basically a way of passing things between these tasks at the moment. um So when we're using those, we do basically put a flag on the tkn command and it refers to persistent volume claim, and I basically give you an example system volume claim because you're an ibm cloud, you get dark provisioning, it will go and create this volume that the claim will use and then the pipeline will be satisfied and do its thing. It's basically a way of like persisting things in between all the steps.

A

Wonderful, so, and if something breaks you can like well, you can look at the errors or whatever, or is it more just like for historical things,.

C

We can look at well, but both so you can look at the arrows. That's saying the pipeline runs and that's what we'll show you, but if you hit the pipeline run you're going to lose pretty much everything I should play the vlog.

A

So I genuinely didn't think it was going to click off that quickly or click that quickly and go do the thing. So it looks like we're actually running.

C

I don't believe that if you do qct I'll get pods, I can all impending state, but there's going to be one point in pending that'll be the first task in the pipeline.

C

Okay, if we describe describe from catalogue shelf, my bet is gonna say: there's no persistent volume for me just yet.

C

So if you describe that pod, that's the one and if you need the qualifier, I used to describe something. So in your case, it's just a pod.

A

Nah good call: I can never get that right describe.

C

Yep I'll tell you what it's waiting on there you go. So it's waiting on our assistant volume, crane, that's unbound! If you were to do k, get pvc that should show you the claim that I've made called repo pvc and that's probably waiting for something. So now, if you do uh yeah, you can either do that or you can just do a describe. So if you were to do okay describe pvc because there's only one it'll describe just that. Basically, it would be all otherwise and that's saying something it's they might want to be created.

C

Now you can either create one yourself, but on ibm car I think it's made for you and it's looking for this a volume. Basically, so why do you do k get pv? So that's take it persistent volume and just see if you've got any yet.

C

Okay, so now do k get pvc that should no longer be pending. It should be bound now do k get pods. I'm I'm keeping your suspense here, because.

A

There you go that.

C

Was the dashboard it should be satisfied and it's proceed to the next step and because it's persisting, it's gonna be using the same system volume across these steps. So hopefully we'll have to wait longer now. What's this one doing jj, can you click on that and we can see some logs? Maybe we are waiting.

C

So if you were to go to your command on the left on in your shell on the left, you have that tkn command somewhere, because it said you can view the logs with a big massive thing, but definitely don't want that command again, you may have lost it in your shell or yeah.

B

Something like that.

C

There you go it's better, so that should give you the same amount, but the dashboard gives you just in your terminal, and this may take a while, because it's going to clone the repository give a docker build based on its docker file. Then do a push.

A

Thanks so when we're actually watching our our pipeline kick off and run and do actual things now, oh.

C

Here we go it's going from all of those different uh tasks, all the steps.

B

We've seen in both places and he's building a question for uh adam, uh let's say a team: they don't have their build uh based off of docker. uh What would your suggestion be for them if they would like to use techno now to build and push.

C

It's not based off docker, so it's just like a non-containerized app like uh an execute bucket.go file.

B

Right, yeah, non-containerized applications, yeah.

C

So there are things like, uh I think, there's a go task in the catalog. This as a normal go build, so you could use techton for the containerized bit itself, but your application itself needs to be containerized, so you could just do a protect on task that basically clones go, builds and then push the executable somewhere august runs it okay.

C

So what's happened here jj. I think these are permission, errors right. This looks like permissions. Yes, so you've got two options. One is to modify the service account to use basically a role and a binding, or we basically create a deployment on your laptop. If you like that refers to that image, so we just built an image. Remember the cat app in theory. You can do. I think it's docker run and then the image that we just pushed and then the port number, and that should basically do the deployment bit um on your local machine.

C

That'll save us a lot of time doing the the ball based access control, stuff.

A

Soccer run dash night or tv, okay,.

C

I don't have my telescope, can you make it please.

B

I thought it's my eyes.

C

There we go so yeah, you just pushed that image somewhere. I think I think it's called cat app. You can see on the left or your docker hub.

B

And that did not exist.

A

C

A

C

Be brand new just waiting to be old, amused.

A

C

It looks like two minutes ago so if you do docker on jjr catapp, uh maybe 3 000 on the end, how do you do you like to put like a minus p command, because it's going to list on a port that you need to access?

C

Is it minus p? 3000? Yes,.

A

3 000 3000. yeah, you don't.

C

Need minus rt because it won't be interactive. Will they okay, you swipe to just run and be gone.

C

And then go to host 3000, hopefully, should see the wonderful.

A

C

All right good! So what did we do? There.

C

B

C

A

Of cats, we got a bunch of cats.

B

I can quickly do a review and then you can correct me if I missed anything so: first we we installed tecton and by tecton we we mean the the tecton pipeline controller, the tecton cli and the tecton dashboard, so because, if kubernetes based we had to in, we have to create kubernetes secret and kubernetes service account. Now those are not techno crds those are existing resources for kubernetes.

B

Then we used a bunch of off the shelf tecton tasks that were already there on the tecton git uh catalog github catalog, and we installed those. So tasks are the building blocks and then we created the pipeline, which contains those hats.

B

Finally, we ran the pipeline run, which is an instance of the pipeline object and that kicked off the pipeline, and we saw all this happening on on the dashboard. Now the error you saw what was related to some permissions with the service account and, in my my experience, a lot of techno issues related to service accounts. So we had two options: either to change the the request, role and rule binding for the current service uh account we had, or since the image was already pushed.

B

What jj did was he just pulled his image from his docker repository and then ran that locally to access the application anytime.

C

That was perfect. One thing is tkn, we we installed well, we didn't install it. We had tkn already um and that's another project from the protecting umbrella that jj used to create that pipeline run, which dwayne mentioned, was an instance of the pipeline.

C

So again, that's something I think takedown cd, I think it's cli yeah and that's where we got that from, but you didn't need to you could have in theory made a pipeline run object to refer into a pipeline.

C

Instead, we did it through tkn and I think jj, if you were to do qctl, get pipeline run or get pr for short you're going to see that pipeline, one that we just made. We made that through tactum, but it didn't have to through tkm we didn't have to be. It could have been a bunch of yellow. Basically, so you um can you click on that cat picture a few more times. Please sure.

A

um My next question is: hey guys: okay, it's still working go ahead. It's still working, um so we used tekton to that's a crazy looking cat.

A

Always I always like cats when they do that they always find find.

C

A

So now we know how to kick things off with with a pipeline run, pulling things off to do this now we can build a pipeline now. How would I trigger that pipeline? I'm not going to run my build every single time using gkn. That seems kind of dumb right like like the idea is that I push some code and something happens now. Would web perks and using github would hooks be the correct way or do we have this running on like a cron job like what? What is the next next natural step.

C

You could use the thing like tekton triggers. You could use the workbox extension. um You could use, there's a lot of community kind of projects that people are making kind of in an ad hoc way. I think kevin mcdermott demonstrated one recently and they tacked on working group calls and they're really useful as well about they're there every week, so we're looking for triggers, maybe a future stream, or we could look into enhancing this pipeline because you may want to be notified of when certain things happen.

C

This is a very static pipeline, so we've been going a few different ways. We can do you get a trigger. You do something or we can go into make this pipeline a little bit cooler or winter. The other idea we said earlier, which I can't remember at the moment, but it was a good idea of all.

A

Well, um if I were correctly, uh our goal for this stream was me being able to type.

A

C

A

Yeah right yeah agenda, 20 20 there we go so was to just to get cat out to work and show up. So it feels like we've accomplished our goal. We.

B

Need more than go and look.

A

Yeah, that's a good point. That's.

C

A very good point.

A

We offer actually 12 enough about it there you go awesome well um and we're coming right up at the hour, which is even perfect, even even better, even perfect time management. So we, yes exactly so it's almost like we practiced this or something.

A

uh Well, let's, let's wrap things up, um do you want any last thoughts or anything you wanna you wanna mention. I.

B

Really had a lot of fun with jj and adam, I'm really really looking forward to future streams, and thank you all for watching in future watching currently. uh Thank you.

A

uh Adam any last thoughts I have.

C

Already jake gets a very straight face while saying that it was just great just like really. It was good um got a lot done. I think we can definitely expand on this through feature streams and I look forward to any questions. Feedback ideas, suggestions, everything basically let us know and reach out to us, either on twitch or the cdf slack or linkedin or whatever you fancy really.

A

That that's such a really great question: um if we wanted to be an active member of the techton community, where, where do you, what do you do like where.

C

Do you go there's a tech on cd, slash community folder and that's basically got things like how to draw in the slack channels. The working group calls, um I think, that's it um so takedown cd community on github check it out and hopefully I'll see you all on either making great questions or great ideas.

B

I'm adding public slack channel on the twitch chat. uh It's super helpful channel like every time. I have a question when I ask the question I get answer in less than five minutes really really bunch of knowledgeable people there so yeah, that's there, but.

C

Because they're very easy questions.

A

C

Good didn't say no.

A

Excellent awesome. Well, uh I guess on that note uh we'll go ahead and say goodbye, um say bye, y'all, yeah, thanks everyone see you.

C