GitLab Community Relations, 14 Apr 2020

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: GitLab Virtual Meetup - Enhance Your Kubernetes CI/CD Pipelines with GitLab & Open Source

Description

This is a recording of the GitLab Virtual meetup from 2020/04/14 featuring GitLab Hero Nico Meisenzahl.

Talk Title: "Enhance Your Kubernetes CI/CD Pipelines with GitLab & Open Source " by Nico Meisenzahl

Description: Join Nico to learn how to enhance your Kubernetes CI/CD pipelines with GitLab FOSS/CE features as well as Open Source projects. Learn how GitLab can help you to better integrate your CI/CD pipelines with Kubernetes.

Nico will talk about newer GitLab FOSS/CE features like the Web Application Firewall for Kubernetes Ingress, Monitoring and Logging as well as Serverless with Knative. Besides this, you will also learn how Open Source projects like Kaniko and Kustomize can help you to streamline your pipelines.

Walk away with knowledge and best practices that will help you to enhance your own Kubernetes CI/CD Pipelines with Gitlab and Open Source!

---

We would love for you to contribute to our virtual meetups.

You can find upcoming virtual meetups and resources to plan your own here: https://about.gitlab.com/community/virtual-meetups/

We want to hear your ideas for topics. Remote? Security? Contributing to OS? Email suggestions to evangelists@gitlab.com.

We also love when community members present at GitLab meetups. Send an email to evangelists@gitlab.com if you’re interested in being the featured speaker at a future remote meetup.

A

Hi everyone thanks for joining us today. My name is John Coghlan I'm on the community relations team at gitlab, really excited for a great meetup. Today we have one of our gitlab heroes joining to present and I'll. Introduce him in just a minute.

A

One thing I wanted to do just before we get into they meet up too much is just remind everyone about our code of conduct. You know, I get led. We value diversity. Inclusion just want to make sure that everyone is, you know, feels comfortable and is treated with respect to as they're participating in these events, so I've shared a link to the code of conduct. You know in the zoom chat and if you, you know, encounter any issues during the event.

A

Please let me know you know you can send me a DM through zoom chat or you can email evangelist at gitlab, calm and we'll work to resolve any of your concerns. One other thing I want to ask is if folks are comfortable, would be great if you could turn on your camera, so we can see all your faces. It helps, you know, add a little bit of a personal touch to the event and I'm sure you know Nikko. Is the presenter wouldn't mind seeing who's out there? I'm joining for his talk and I want to?

A

Thank you all for joining. You know. I know times are tough right now and folks have lots of competing priorities and there's you know just a ton of events that are available to everybody seemingly every day and we're really grateful that you've opted to spend some time with the gateleg community today and I'm really excited to be here.

A

For this talk with you, so two quick quickly introduce get led for folks that are kind of new to get lab and maybe joined, because they saw someone retweeted something or you know, friend shared this with them get labs a complete CI, see the kind of tool chain in a single application, basically the entire DevOps lifecycle and a single application with one interface. One conversation, one permission model thousands of features, it's pretty amazing.

A

What we offer and get lab and we're just getting started, and you know, there's I can see some of the names and faces on the call today, and one thing that's cool about get lab is that we are an open core company and folks can contribute to the product. And so, if you have any questions about that, definitely let me know you know some of the other cool things about Caleb we're the largest all remote company in the world, so I joined.

A

You know about a year and a half ago and then working remotely the entire time, and so it folks, you know they're just starting to work remotely because of lockdowns or shelter-in-place requirements in their areas, and you need some help figuring out. You know whether it's you know how to interview remotely or what office share to get. We have all of that information in our handbook.

A

So definitely would love for you to take a look at that you can just google get label remote and you'll find lots of great resources for you, and your teams and yeah I just wanted to also point out. You know about our handbook: we don't just have all remote in from there. We actually run the entire company out of our handbook.

A

It's completely kind of open to everyone, so you can see our roadmaps our strategies, you know who's, you know who's on which teams which sales folks are covering, which territories we're completely transparent company and everything's in the handbook. So if you're just kind of curious to learn more about, you know Kate lab as a business, not just the product I'd encourage you to dig through the handbook. It's really interesting and one of the things that tends to attract a lot of new folks to our community and yeah.

A

It's a great resource for folks, as I mentioned earlier, so yeah. So just a little bit of a breakdown about what we'll be doing. Today we got Nikko Neeson's, aw who's, one of our gitlab heroes. He's going to be given us a great presentation on enhancing here, Fornetti CSUB pipelines with gitlab and open source, so really excited about that. I. Don't think we'll be doing breakout groups today, because he's asked for a little bit of extra time, but I encourage everybody.

B

A

Around afterwards, and just hang out like you, would a normal meetup and.

A

Following his talk, and certainly if folks have questions, he's allowed us to kind of interrupt him, so I'll be trying to find ways to do that during the talk. But if not, you can save your questions for afterwards and ask him then.

B

A

To stay muted, if you're not going to be asking questions in that way, we don't interrupt our presenter and, with that I'll be handing it over to Nico to kind of get into the talk that you all came to hear.

C

Okay, so let me share my screen.

C

So you should know see my screen, hopefully okay, perfect. So let me jump in to talk so John always mentioned it's about enhancing your kubernetes EAD Wizkid. Let endless of those tools, yeah, so shut, interrupt action of mine and become a dancer working is a senior clock, DevOps consultant at my tech. It's Charlie based Microsoft, Partner and doing consulting and duplication of work. Man, I am acquittal, appear Microsoft, MVP and took a community leader and doing stuff around kubernetes, DevOps and cloud.

C

So what I would like to talk about today? um So basically um I've prepared five small topics, all of them more and all fuels that are a deep dive, but I'll show how you nicely can integrate your kid. Let's see, ICT with kubernetes and enhancers.

C

So, first of all, first we have how you can move your pipeline workload into clusters of basically run your package shops in your kubernetes cluster. Then we will talk about container image builds on kubernetes because now you're running anything in container on a kubernetes lesson. You need somehow a nice solution to also build the container images in a kubernetes cluster, and then we talked a little bit about a secure application interest. So if you deploy application, I can secure it easily risk it like, and then we talk about service risk.

C

It looks or just about how you can focus on your code instead of deployment and building your application and at last point I will do a quick demo of some day two operations to us, which you can integrate and get lots of money trying matrix tracing its own okay. So, let's jump in first of all, yeah I'm. What to talk about or I can move your pipeline working into your cluster and with that I'm gonna talk about ticket like runner, coupon, it is executor.

C

So what is the get lab run? A coupon is executor, it's basically total brainer. As you know it. Let's we install it on a virtual machine to build and run our chops, but this time it's it's it's it's possible to run it personal kubernetes cluster at the container as a part, and so this you can contain the rest. Your whole pipeline, which basically means all of your pipeline steps, are running container. So all the Python States isolated.

C

You could put all your dependencies and versions into your pipeline steps because they are based on a container image and you can describe the container image, so every pipeline run is looking the same. Every time, which is pretty cool. Second thing is you can share your computer, so you could put different pipelines running next to each other on your cluster and you can also scale your cluster if you are able to scale your kubernetes cluster.

C

So it's pretty nice feature how it's working, it's basically just the container, which needs to deploy it and when it is less than first nicest option is to just click it install it just one click and the gillip UI in your project, but the more that's already deployment will be to use helm or any kind of deployment.

C

Automated and deploy it was a pipeline for anything else. So with it, the kubernetes executor is doing some things. Besides just running your container image, so thinking about container respect, then you could also run just a pipeline step with stock, a run your image and provide entry points 50. So the kubernetes executors doing some more things. It's completely yeah working with the whole lifecycle. So it's not only creating your container pod, which you defined for running your chops. It's creating some.

C

Let's call it service container mix to the main container within the pot and those service containers have then used to clone your repo files, restore caches or download artifacts, which I needed for a popular one. So it's just one line in your configuration and we did. You will get caching resource and artifacts where you need them. It's just pretty hard if you were building your pipeline to stop a run and you need to mount all the stuff manually and so on. So it's pretty nice.

C

So this is a previous step and then actually we have to build step a start one where the actual pipeline steps you define executed in your defined container, but it is actually saying which you described and then the last step we have to post build steps which same creates tensions and artifacts.

C

Yes, so let's have a look, how this looks in action, so, first of all, I've provided some some demo projects and all the projects within a group and within this group, I ended up on a test environment because kubernetes I've just integrated my project prove with it. It's basically providing your kubernetes details.

C

Then you get some some basic information about your health of your cluster, what meets one or two seconds with the CPU usage memory, usage and so on, but the most important page just applications page. We can install predefined applications in this case and we're talking about the get up runner you can install the get up runner just with one click into into your project or your troop, and this get like runner will now use in our project small project. It's not fancy especially consist sort of help chart which we used to deploy our application.

C

um It was more Ritchie file and CIC DiPaola, so we check out the ESET pipeline. It's easy one, just one stage with the deployment we have some variables where we define our Henry image was basically the docker image we will use to run our step.

C

We define some ink resource definition and the message which I will talk about in a second and then we run our our steps and all stages on stage and deploy our step is app deployment, be providing a tag on this tech is used to find the gate Lebrun or you would like to execute it so I guess we run, let's check those kubernetes and that's why this job will run a microbiologist environment and then it's just defining the image in providing the steps the pipeline should run.

C

In this case, it's just an easy hem upgrade and deploying an application with a setting called custom message which allows me to define a custom message in our deployment.

C

So let's have a quick look. This is application I'm talking about just basic web application with our logo was freed, and it says hello, world, I'm, free, so just easy, hello world. If you now jump to the pipelines and run a new pipeline and just providing the message variable, which will sell away, let's say I'll, give that and then click on run new pipeline would be triggered, which means the new part which would be created and our coupon. It was cluster, but then would run the Hammond store script.

C

So let's have a look from the company to side. Let's only look at all the pots running at the moment, so we've get dabrander itself. Ronna itself is a pot and listening for changes. Listening for change it and then the run I would schedule new pots, which then run the extra mile pipeline steps.

C

So for now, head back and run the pipeline the pipeline get started. We see it's logical to run off its technical 180s. Now the pipe is I say it's writing through our pot. If you change back to the combativeness environment, we see a new pot is being created. It's still pending. Now it's traded. Now it is running.

C

So have a look: okay, a was too slow. The pot is already already stopped again because the troubles already finished, but basically it's the same outlet. We would have got in the the pot itself historian, Cassius, Donnell and artifacts. We do not had one, so it's it's completely empty and then it's doing the hair up trade and the top succeeded. So ever since I there's extreme, if you now head over to our demo page with these update now it's hello Kaitlyn.

C

So it's basically the easy pipeline, which was completely yeah, run and build particulates in our kubernetes cluster, and this works this any kind of pipeline any kind of dependencies. You just need to provide the image which has all the dependencies, provide your steps and then you can build your pipeline in the cluster. No just an easy one. In this case.

C

Yeah, so next one now, we would like to build container images in ArcGIS, so we are running any kind of pipeline workloads in our containers, so we need to contain or Azure applications to deploy them kubernetes, but we also need to build our chopping edges, because now every chop is a container. We now meet some power, the ability to build container images for our chopped images. No, this is done by koneko koneko, one solution there, different others, but koneko is pretty nice and rich pretty nice.

C

um One really really nice thing of colliculus that it allows image filled container page without any privileges or dependencies. So can just fields your you container image without needing root access or any kind of volume mounts and so on. You might know about token token, or maybe already use it, which is basically running dhoka dhoka, which send both allow to build container images in a container, but it has some kind of disadvantages some security issues so which is only to mount your doctor sockets within your container, which is a security issue.

C

You would could mount the doctor directory within multiple containers if they're working from the same time, you might get any issues and running privilege mode is also not so nice because of security reasons. So koneko is some more nicer solution than token token.

C

Koneko itself also runs in the container, so it's basically binary sitting in a container which you can use to to build your image, and here on the right.

C

Just let me get the laser. You see a small example in this case, just a pot definition. So it's best if you simply docker, run just a kubernetes, be provided with them, be providing the container image over here and then providing on some arguments to build away image. So, basically, where the doctor file is located with the context of our directory and the destination destination would be our industry as well as the image and tech, we could add multiple destinations or remove the destination.

C

Take it all if you just want to build and just test it. So it's just easy. Its reliance of configuration then resetting containers in a container. You need to think about caching to speed up your pipeline on Kaneko. It's a pro. It's two different options. You can kiss your layers. This is done by pulling and pushing and pulling the layers itself into an external registry.

C

So then can you can check? Okay, it's a layer, I know and just pollute the layer instead of rebuilding it, which is much faster. That can can use our registry on our project. So we have container access routes get that we can just use a registry we have and on the other hand, we can catch our base images so basically the front tag. You know, identifier in case those images to get them faster instead of downloading them, don't link them all the time.

C

In this case it's basically a locking outward or something you need to mount it to your container, but this can be done with good luck, cashing feature, maybe ICD just provide it by the cluster okay, um so shot in from this one.

C

Another small project- it's even smaller- we just have a docker file in this case. It's a doctor file providing the henselae. So it's based on docker image of mine and just installs the hem CLI that we then can do the hem and stuff. But this is basically the image I used in the previous just providing mci to be able to install them some kind of applications.

C

So, let's look at the CIC department once again pretty easy just one stage we have one variable which is set to debug debug, it's pretty important at the moment. So you need to run the debug tech of the chemical container image at the moment, because the Kaneko image itself doesn't provide a shell and the debt you wouldn't be able to inject.

C

Your script set went on so you need to run the debugger image with a little bit bigger than normal one, but it allows you to to execute, share commands and then we have basically three lines of things to do: just create a directory and then putting in and the conflict chest file our credentials to access our.

C

Docker registry, which is part of our project, so it's basically a username which is get lepsy. I talked me and the password, which is the CIA talking which gets provided by the runner. So nothing you need to do just copy the line and it work. And then, once again we have a lesser steps. You know the context directory we have for doctor file and be here for destination in this case the destination once again, is our own registry and this project, though this one here and you provide an image name of the tag.

C

So let's run this one.

C

So once again we get a container created.

C

Let's see it for fast enough, this time.

C

C

If you towards any looks perfect, so let's have a look here: okay, it's still creating the container. Now we get some output. So it's it's looking bad leaks, basically, the same like a duck-billed, so we're treating some details or from image then running. All the installation. Steps.

C

Now touching some stuff to get a smaller, smaller image, if you find it the entry point Cindy line and the choppers already done, and now, if you're moving over to our package container industry, we're seeing the hell image and the latest tech we just created nearly 30 seconds ago. So pretty nice and easy way to build your container images within your kubernetes cluster.

C

So another one so let's say now deployed an application and you would like to secure it somehow and get let off of integration of a gitlab Application Firewall, which finds tricks any kind of security issues, so SQL and code injection process, scripting or finally condition and stuff like this. So it's just sitting a front of your application and make sure that no injections and scripting and so on, is this forwarded to your application says so, but that you will also get a nice read monitoring dashboard in our kubernetes in your github project.

C

You I may be short in a second. They have been. The assist feature is based on open source. So it's based on the company test. Nginx interest was enable not security rule, so it's just basic engine, it's nginx configuration and then what security is that you apply so web application security project rules it which has some best practices and different rules which secure your application, and then you can decide when you install it whether you would like to block your weakness or just run it. Take only detection.

C

Only will then not all these things into your dashboard or you can forward the locks and analyze them and barking. Listen. Look future will, of course, blocks the request. I do not forward it to your application.

C

So once again, let's settle shop demo of this one and.

A

You go yeah one thing: that's really cool I'm, seeing a lot of people kind of using the chat to ask questions, and some folks are sharing resources and stuff there. But where you get into the demo, I was thinking. Maybe you could take a quick look through some of the chat questions and see if there were any that you wanted to tackle before your demo sure.

C

Of course, just let me find my chat window so Chet.

A

Flow I know you're rolling right there, everything's.

C

Fine everything's fine. So, let's start from the beginning, it's connect free, yes, Kaneko's, open source project by Google, so it's totally free can just use it and also contribute trade. Okay shared. Can you send me the connect apart?

C

Yes, I can do afterwards if I don't miss it. Otherwise, all my my demo code shared so all the grapples are showing you published on get lab and I link to it on the last slide. So don't need to write all this stuff. You will get the details.

C

Can you contain itself must be run its route as per the documentation? I, don't think so. So at least our diploma at the moment didn't run this route exits and it worked so normally there should not be any kind of food dependencies.

C

So and yes, koneko runs without any Rolexes, okay perfectly. So any questions so far on the web application firewall thing.

C

Okay, so let's continue okay, once again, we are on the kubernetes cluster configuration page, and here we have option to install our increase cluster and seriously the mod security verification file. We can enable/disable it for me.

C

It's an aryl at the moment and then I can't level settings and define whether I would like to run it in locking mode and just look any kind of issues, while I would like to to run it and blocking mode, which basically means the request gets blocked, which is the setting which is the setting I defined in my in my environment, so, but that, oh one more thing, um so this is the red monitor on your show, true.

C

So in the project within security compliance, you have the thread monitoring dish for its amount B at the moment. For me, it's pretty empty because it's just a demo environment I will see the Total Request. The recurse was having a security issue, and normally we should see a nice line. In my case, it's just this one, which was I, think a certainty totally Tris, that's just just as the demo in front of position.

C

Yeah, a small demo application they can put in my name and then get a, but I also could it some kind of JavaScript, so some kind of process check so just putting in a script tag putting an alert message with any kind of of text here. So this is a person scripting or taking this case, and now when I put push the treating button, I would normally get a pop-up notification for my parcel in this case.

C

I shouldn't get it because I'm getting a forbidden, so the application Firefall fix them, sees the injection and cancels I stopped the whole redressed because we talked told him to to block all kind of officious.

C

So so pretty nice I will not see it on the threat monitoring dashboard, because the reakless was completely blocked, so normally, if I would put it on knocking only I would also now see the.

C

Okay, so let me check for Christians before heading to the next topic.

C

That increases like terrific yeah, so I'm, not sure so. The the second is reset is open, source and I think it's. Basically, it works with with every every HTTP browser and it might be some configuration. You need to do also for interest itself.

C

You might need to not deploy the default hand, chart or the different configuration and do some drinking, but normally if it should work, you're, so scared of losing in other interests, but then not with the nice integration of just enable it here when you need to deploy it on your own, but then using the same functionality should work. And yes, the firewall is also free from good website.

C

C

Next one I next one is about get up journalist, so basically a nice solution to allow you to focus on your card. Instead of thinking about how you can build your containers, applications are deployed, containers applications. So it's basically just writing your card committing your card and get that was doing the rest yeah.

C

Once again, you hardly need to care about your card, so basically functions the service provided by Hitler and obtuse the whole setting the whole function is based on connective, which is not service. So a mistake by Google also use was koneko because koneko is used and the stick to build the images and sto as a service mesh which is used to route the reference based on your own. You version it's so it's Johson dependency for for using creative and this together with a nice UI in get let the kid live so dysfunction.

C

So it works with go no chairs and ruby by default, but you can also use it with C sharp, PAP and person, but the fast integration which it has a slightly different configuration.

C

But the features are basically is the same it for any kind of other language you would like to use. You can't use the several is function, but you can run several applications. This basically means you just need to write it occupy, so you need to fry it. Let press the information, how to build your application, and then you can use nearly the same features so still need to. Let me to think about the deployment you just need to think about the build steps, because it's completely based on openness or not not to any cloud.

C

You can also use it for symmetric lot. Support so can deploy it on a Google. Is it obvious? It's also includes an outer scaling feature, so you can scale your functions as you need them. We can also scale them to zero, which is pretty nice. If you open some bad shots which only run tonight, the function will only run when cells chops are scheduled and not the whole 22 hours and the of the day, which also saves you money.

C

Yeah small demo on this one.

C

Once again, a small project with some files in it in this time it's just basic, no chest example, and it's not doing much more during a console log and providing a small response. So it's basically just providing a small response. This is a panel from pic lip service. This is what you see when you run that occasion, but this we once again have a good lip, CI city definition, and we have a service definition file and those are pretty small.

C

We just tell CSD to include a template which is provided by get lab, and then you just need to define two functions or build functions, a deployer function. We can provide an environment if you would like to everything else is completely handed by the by the template provided by gait lab and the sir yeah no fire. We just need to define some more definitions.

C

We need to turn hey. This is a function. We need to provide a trigger a provider, in this case it's trigger mesh, which is the default, so the whole kit tip CI stuff is also based on trigger mesh.

C

If you don't run one of those three supported languages, you would need to use up fast in this case and then it's just providing your handler, your sewers, which is basically the direct with the courtesan and the runtime in this case. Not yes, so ten lines it, but this get. Let knows what it needs to do.

C

We now run this application.

C

It's to it all that so I already already started. It takes a minute. So let's say if we look on the right ones, so just building your application, some internal tools here once again, it's building your docker images and the chapel Stan, and then it's deploying all the things.

C

I'm on to your kubernetes cluster, so from the kubernetes side.

C

We now have a new namespace and we get the namespace per applications in this case when this service sample namespace had received this dope ordinate at the moment, because I did not run this function for some hours but scare it down to zero. So let's do a curl. In this case it's just a post request providing some data and against our endpoint. If I now press ENTER, you should see on the left side here we see a new container schedule.

C

Of course it takes some time until we get our response, because the container is just starting and it's pretty slow at the moment.

C

Yeah here we go now it's running, and now we get our response. So other example is: if we just do some, no testing doing 100 requests and conference is also 100 for 30 seconds. We should see that the whole pipeline, the whole solar function, is scale out.

C

And it's creating some other newer containers, so we have different IDs all the time. So we now should have I, don't know five ten, some more containers running, so it's getting out it foot. Then, if we stop the whole thing, it was but wait some time and then scale down again.

C

So with this we also get two nice.

C

Nice you, how a UI in our good luck to all of you, so it's within operations, service.

C

And there we should see our application, all fractions, don't get a list of all of our fractions and if you access the function, we're seeing up now, 60 pots are running and you'll get a nice overview about the requests in this case with nearly 50 Salisbury crests in the structure at the moment. So it's scales out and if you wait I, don't know five minutes. We would basically see one pot and then, after another five minutes it will scale down to zero because it takes ten minutes at the default value.

C

You can customize it to scale down to zero.

C

So any questions on service so far I.

C

Don't see any okay perfect, so then I have one last thing before we can wrap up. It's about monitoring logging and tracing. So first of all, observability is key. So it's pretty important to know your application to know the matrix of applications have easy access to your to your locks and on so it's pretty important to have any kind of monitoring, logging tracing tools and with gitlab you get a nice and easy solution to integrate some of those tools.

C

You might know into your project, so we can use permissions to collect your application matrix and access it. Within your CAD lab repository, you can use Eric, so elasticsearch locks Shabana to access your looks and your applications that you're in a circular project, and then you can also integrate it with for Sega for the stupid tracing or sentry for ever tracing and so on. Some of this, the elastic search, locks Cabana as well as Prometheus, is fully integrated within your github, see I CD. So you can just once again go to the kubernetes page.

C

Donna gets up runner, burn, sticky tape, runner and select Prometheus and install it and select elastic stake and install it into your cluster, which some? What happen is that you will get closed this one.

C

We get some more apps and you'll get that match up space and we'll get the elasticsearch stick, um and you also will get a promise deployment running in your company this cluster, and this can then be used to run all your looks and matrix data so jump over back to the UI.

C

We're now getting some more options. First of all, with in operation and matrix, you will get a nice few, a nice dashboard and shouldn't take long about all of your company disasters or your memory usage of your deployment.

C

Cpu usage, if you would use canary features, I didn't ever. This is my example. You also would get those and those are matrix art of Prometheus deployment. You can duplicate and build your own dish box and add your own matrix into this. This will just use its default one. You can select environments if your deployments in two different environments, productions, tests and so on so can build your nice dashboards within your project, but you also will get its of operations locks the lot output of all your clusters. This is done by elasticsearch.

C

So once again you can select your environment, you can filter your pots and this gets all pots, but you can also just select one of the deployment and drill down into the locks. If such features, you can search for every message info messages cell, so pretty nice, what's: environment itself, you also get a nice overview about your deployment. So how many instances are running or failing, pending or evening canary deploy, if use it?

C

So it's also nice and that's all of you yeah and then two more things which are tracing and error tracking, which can be integrated. This would only provide and link to your existing Jaeger deployment or your existing AR tracking, but is also nice shot. Donny professor debugging options.

C

Yeah so, but this and the demo page I would like to wrap up um I think I'm pretty in time. So let's check for questions.

C

Does anyone use kids up in decoration risk when innocent productions so I think it's more questions for the audience, so anyone would like to talk about it. It's using it at the moment.

C

Nobody really I, don't think so. Okay, yeah.

B

Sorry yummy, yes, yes, oh yeah, I am currently using club owner in my kubernetes, but I would have to try the integration part, but the thing is I in main company. We only they only provide namespace of the service, not cristela studies, so I only only have access to namespace, but for what I saw in the club you, you can define a namespace. You have to define the cluster, that's right.

B

C

You need to define a cluster, but then you can deploy the runner into a specific.

C

You might need to work with their colleagues to get it running, but then you can knock it down to the namespace yawning.

B

Even further sorry, because when we go in the github interface.

B

You you are the active asking for cluster, not for cluster and a namespace. So yes, so.

C

You need to need to add the cluster teachers because the force education, but then you can decide if you add a new cluster, okay, everyone, so you could then decide so the basic informations are pretentious. You will need someone to provide them. Okay, then you can put everything but you install into one namespace, but I also do issue so.

B

Yeah, because there we are you, men come I, have Korean sure I have a service account by namespace, so I have I, am journey straight off my name space, but not as a crystal but I.

B

Don't in my new space, okay.

C

Then you can just just put in the choten and the credentials of the service account intruder, kubernetes cluster setup. I. Never did it, but I guess it should work. I.

B

Was going to try this, it's I was going to try it. I was just asking if, if I just put my service account credentials in the club, will we see that my service account is bound to namespace, not but I? Think there is some matrix. I will not affect me. I will not have access, because my service accounts, my namespace, doesn't have the right to let's say request as a nerd or stuff like that, but.

C

Not namespace based on the deployment will so for the running itself. Isn't I think it's not a big issue. If you don't know it.

A

C

Root access, but other deployments might need to to defy class. There were lots of our planning and so on. Yeah.

B

So I know is working. Fine now already have multiple pipelines on man in space. It was very easy integration, part monitoring, my deployment stuff, like that that I was looking if, if a good lab was able to monitor my mind in kubernetes namespace, not my humanity's crystal, because I don't have a crystal I have on namespace. So if integration in Motoring parts was able to focus on me on a namespace, not knowing that, as as as the names business well revered, you don't have access to stuff, like notes, informations or.

B

C

Maybe we can chat afterwards or can consent me. Some teachers and I can have a look on it. So I'm not write it, but maybe there's some of my kids back home.

B

Or maybe later because we just religious, we just started with kiddie clubs, but I was just looking for this information. If you don't know it's okay,.

C

So just thing, thank you. Okay,.

B

C

I think we've got some more questions. There was a discussion about every application firewall. You can get it free or not. I personally think it's on Sri. Maybe some of my little boys can jump in.

A

Yeah so I think what Adam was saying was that it's.

A

It was not in core, it looks like you know, Carsten pointed to the link that shows it is in court. Think.

C

Of it is to be honest, but.

B

Logan isn't cooler.

C

So it's perfect.

C

Yeah so looks a start in the elastic search. Stick so they're connected was which five beads and and starting to elastic search- and there is a lock retention, I'm, not sure, I. Think it's 30 days. You can customize this. So there's a job running every every day which is deleted or indexes I think it's 30 days, but I'm not on perceptual and you can customize it.

C

It's possible to set alerting on locks in get lip I. Don't think thought that you can do it within the get up UI, but you can of course, jump into cabana, building a dashboard and doing logging or also shopping in promises and waiting a touch buttons for father and son and doing them that's personal, not manager can copy paste the links thanks for doing it.

C

How do you scan for dependencies and embedded credentials yeah, so it depends so for my for my image scan so sometimes he was the truth from aqua and includes him in my build steps for embedded credentials, I did not use to anything so far. So it's it's. It's more policy thing at our side to not stock relations.

C

Okay, any further questions or discussions.

A

All right, I think that was oh I, see one more question just came in so let's you answer Kevin's question and then I'll wrap it up. It's.

C

Possible to get more than one remote cell in the warrants never tried this one. To be honest, I'm not sure.

A

All right, we stumped you on the last question so now, I just want to do something: we've been doing evolve our remote meetups, if everyone could just unmute first I, could turn the camera on. If you're cool with that and give Nico a round of applause, I know we can't all be in the same room but it'd be nice to show so appreciate you, and so just join me for that.

A

Thank you, amazing. That was that was one of my favorite meet up, so he had done virtually I love the interaction in the chat Thanks to everyone who was chiming in and asking questions answering questions. It was really cool to watch that kind of unfold as it was going through. This talk, so I appreciate the interaction there and yeah I hope you'll all join us for future meetups.

A

We plan to do these about weekly going forward. Sometimes if there's conflicts with other events that we have scheduled will will take a week off, but in general we're planning to get together every week and I hope that many of you will stay involved in the gitlab community. That way, you know, folks, you know, are interested in participating in future meetups. If you have ideas for topics you want to hear about, if you want to volunteer to a speaking event, you know we'd love to have more community members.

A

You know speak at our future meetups, so please reach out. You know if you're interested in becoming a speaker at one of our upcoming meetups or if you have topic suggestions and if you're interested in organizing your own remote meetup, we have a checklist that we put together. It's on the website just go check out Google for get wet virtual meetups and you'll find a link to our checklist there, and that can help you get started if you want to organize and meetup for your community.

A

So with that being said, I just want to thank everybody for participating today. Thank you again, Iko. That was really great, really great talk and yes, CBN's asking. If we, how do they request or suggest a topic thanks for pointing out that I neglected to explain that just send an email to evangelists so like the first word in my title, with an S at the end at gitlab, calm, and that will go to me and other folks on the community relations team that are involved in organizing these events and yeah.

A

If you have any further questions, you can also check into the get web get ur channel I live in there. So I'll be happy to to kind of answer your questions there in a more synchronous manner and sorry I'm, just putting the Evangelist at email in the chat for everyone and yeah. Thank you all for participating today and I hope to see you again at a meet up soon.

A

C

Nika, thank you. Thank you, Thanks. So Terry thanks.

A