►
From YouTube: Distribution Team Demo - November 19 2020
Description
The team demos the upcoming addition of TLS certs support for praefect in the GitLab Helm Charts.
A
A
One
thing
that
I
want
to
show
you
this
week
is
the
I
want
to
stress
on
that,
and
it
was
pointed
out
by
robert
is
that
the
difficulty
of
setting
up
tls
for
italy
and
profit
so
without
further
ado.
Let's
start
with
going
through
this
this,
mr
I
link
the
mr
to
this.
Is
the
mr.
I
linked
it
to
the
distribution
demo
notes
as
well,
so
allow
me
to
just
go
through
it
and
there
is
a
documentation
here.
So,
let's
open
the
documentation.
A
A
A
A
A
Just
allow
me
to
cancel
that
I
didn't
want
to
use
the
existing
secrets.
I
just
wanted
to
make
sure
that
we
have
the
we
are
going
to
start
with
a
clean
slate
namespace,
so
I'm
gonna
remove
the
secrets
and
I'm
going
to
go
through
the
generation
of
secrets
as
well,
so
to
enable
tls
on
italy
and
profit
we
need
to
generate.
The
problem
is
that
we
need
to
generate
the
secrets
manually.
The
user
has
to
generate
the
secrets
manually
both
for
profit
and
the.
A
A
So
this
is
the
script
that
is
used,
I'm
going
to
show
you
here's
the
script.
This
could
actually
generate
certificates.
This
was
intended
to
generate
certificates
for
gita
lee
and
what
it
does
it
generates:
certificates
for
the
pods
of
kitaly
service,
star,
dot,
italy,
dot,
name
space
that
is
vc
and
using
the
same
script
for
profit
is
problematic
because
when
user,
when
we
are
connecting
to
italy
endpoints,
we
are
connecting
to
it
to
its
pods.
A
But
when
we
are
working
with
profit,
we
are
actually
working
with
its
headless
service.
So
the
problem
was
just
the
the
the
wildcard
certificate,
so
this
script
needed
to
be
fixed
like
this.
So
there
are
two
dns
entries
here:
one
is
for
the
pods
and
the
other
one
is
actually
for
the
service,
so
by
default.
This
script
generates
italy
for
tls
certificates.
A
A
A
A
Okay,
so
I
haven't
deployed
the
chart
yet,
and
these
are
all
the
preparations
that
I
had
I
had
to
do
before,
deploying
the
chart
before
installing
the
chart
to
enable
tls
for
profit
and
italy,
so
I
had
to
generate
the
certificates
with
this
script
that
is
now
fixed.
It
wasn't
fixed,
it
was.
It
was
problematic
up
until
yesterday
and
I
had
to
generate
the
certificates
manually
and
upload
them
and
generate
the
secrets,
and
now
now
I
can
go
ahead
and
use
the
names.
A
A
A
So
I
didn't
actually
break
this
demo.
I
used
a
fixed
script
to
run
the
demo,
but
if
it,
if
I
wasn't,
if
I
didn't
do
that,
if
I
do,
if
I
don't
do
that,
it
will
break
like
this,
it
will
show
you
it's.
It
starts
throwing
503
when
it
does.
It
wants
to
do
any
kind
of
communication
with
italy,
because
the
certificate,
the
the
name,
the
sand,
doesn't
match
the
host
name
of
the
optic
of
italy.
That's
why
the
grpc
client
fails
and
you
can
see
it
in
different
ways.
A
A
Needs
to
be
done
in
this
sequence.
Of
course
you
can
start
deploying
the
chart
first
and
then
add
the
secrets
and
then
fix
it.
But
then
I
tried
it
myself
and
what
happened
was
that
when
I
changed
the
secrets
for
some
reason,
I
couldn't
really
make
it
work.
I
had
to
delete
the
pods
manually
again
and
make
sure
they
are.
The
stickers
are
mounted
again,
at
least
at
the
web
service.
Italy
and
profit
pods
needs
to
be
removed
manually
for
to
to
for
them
to
pick
up
the
new
secret.
A
B
B
A
B
A
A
A
A
D
A
A
D
A
A
A
A
A
C
A
A
A
B
C
A
B
A
A
A
A
A
A
A
B
D
A
D
No,
I
was
just
more
thinking
that
for
internal
services,
because
this
is
a
thing
that
we
ran
into
with
another
project
that
no
longer
exists,
that
we
generate
that
per
service
for
tls,
and
so
I
think,
having
the
shared
services
job.
You
know
the
share
the
shared
secrets
job
be
aware
and
be
able
to
generate
those
if
tls
is
enabled
and
just
generate
them
on
the
fly,
and
we
can
start
with
italy
as
a
first
but
like
make
it
more
generic
where
it
just
says.
D
A
A
A
D
A
D
This
sorry
one
one
other
possibility.
I
guess
this
doesn't
have
multiple
storages
in
the
back.
I
was
just
wondering
if
you
go
into
like
the
the
the
top
level
admin
and
tell
it
to
push
it
100
to
the
to
the
side
to
the
non-default
storage.
Do
we
have
multiple
storages
or
we
can
test
that
just
to
see
if
tls
works?
I.
A
A
C
A
A
C
Create
the
desired
number
of
nodes,
and
then
you
know
the
pod
name
based
on
the
index
number
from
the
stateful
set.
But
after
this,
mr
I'm
working
on,
we
can
have
multiple
virtual
storages
and
each
virtual
storage
will
generate
a
stateful
set
of
its
own.
And
so
I
think
we
can
just
kind
of
loop
through
the
logic
of
generating
a
certificate
per
stateful
set
per
pod.