►
Description
In this week's episode, Kat Morgan will walk through Kong Gateway on #Redhat #OpenShift with special guest Casey Wylie, Principal Solutions Engineer from Red Hat!
Kong Builders is a livestream series that takes our developer-focused toolsets and puts them on display in the best venue possible – building applications and connecting workloads.
#KongBuilders #developer #livestream #livecoding
A
A
Not
completely
losing
my
mind
trying
to
work
a
new
tool
today,
so
that
said,
casey
I'd
like
to
welcome
you.
Thank
you
for
joining
us
from
red
hat
today.
I
know
you've
put
a
lot
of
work
into
really
kind
of
showing
off
the
best
integration
of
kong
on
openshift
lately,
and
I
thought
it
would
be
a
great
thing
to
be
able
to
share
with
our
mutual
customers
and
anyone
who's
kind
of
scoping
out
that
off
those
options
for
their
their
needs.
B
B
A
So
here
we
go
casey,
I'm
sorry.
I
know
that
everyone
can
hear
both
of
us,
but
I
can't
hear
you
right
now:
okay,
actually
casey.
I
will
work
on
that.
If
you
actually
want
to
go
ahead
and
just
kind
of
go
ahead
and
kick
it
off,
I
know
you
have
the
reigns
ready.
I
will
share
your
screen
and
let
you
take
it
away
until
I
can
get
audio
on
my
side
too.
Cool.
B
B
A
Here
we
go.
I
created
that
namespace
when
I
was
testing
the
the
binary
earlier
today.
Also
my
audio's
back,
I
switched
headsets
and
things
just
worked.
So
that's
good
great
thanks
for
carrying
the
show
how
I
was
working
that
out
for
everyone
following
along
I'm
gonna,
go
ahead
and
drop
a
link
that
actually
has
some
of
these
notes.
That
casey
is
basing
his
work
off
today.
B
And
one
talking
point
that
I
should
have
brought
up
is
I
keep
you're
seeing
this
k
command?
I
did
alias
k
equals
coupe
cuddle
before
we
started
so
chaos
all
right.
So
essentially,
what
what
have?
What
have
I
done
so
far
so
cat
made
the
name
space.
I
just
created
the
generic
secret
for
the
license
key
from
the
file,
so
basically,
this
is
essential.
This
is
important
for
using
kong
gateway
enterprise.
B
A
Yeah,
so
in
the
chat,
while
you're
going
through
some
of
those
steps,
I'm
going
to
cover
some
some
of
the
questions
in
the
chat.
We
have
a
question
about
what
is
kong
gateway
and
actually
that's
a
really
good
question,
because
I
know
that
we
have
a
lot
of
open
shift.
People
who
are
maybe
new
to
kong
or
haven't
come
across
kong
before
kong
offers
a
few
different
products.
A
So
we
have
a
an
api
gateway,
a
service
mesh
and
a
developer
tool
called
insomnia
today,
we're
focusing
on
the
api
gateway,
and
what
that
is
is
the
core
of
the
product
is
a
reverse
proxy.
So
it's
nginx
based.
It
includes
open
recipe
which
gives
us
dynamic
control
over
nginx
configuration
and
then
kong
layers
on
top
a
set
of
plugins
and
management
tools
and
fronts
it
with
an
api
that
can
controls
the
underlying
components
dynamically
to
provide
all
of
the
life
cycle
operations
that
you
might
need
to
support.
A
A
B
Yeah,
so
so
cat
was
talking
about
the
the
con
gateway
right,
and
one
thing
we
want
to
really
kind
of
call
into
attention
here
is
that
gateways
are
north
and
south
traffic
right
and
and
what
does
that
mean?
That
means
from
the
user
into
essentially
the
ingress
of
the
cluster
and
best
practice
nowadays
right.
This
is
100
best
practice
for
essentially
each
name
space,
each
application.
You
should
have
a
gateway
right
because
you
want
to
have
essentially
what's
called
failure,
domains
like
whether
that
be
physical
or
logical.
B
So
in
order
to
have
everything
kind
of
in
its
own
realm
and
decoupled,
each
kind
of
application
needs
its
own
gateway.
So
you
could
technically
have
10
gateways
right.
So,
let's
talk
really
quick.
What's
just
happened
because
now
we're
gonna
our
next
step
is
to
install
the
control
plane
and
we're
all
chatting.
So
here's
what's
transpired,
so
we've
created
the
private
key
in
the
in
the
cert
right
for
the
kong
gateway,
and
then
we
created
this
tls
secret,
which
the
gateway
will
use
called
the
con
cluster
cert.
B
Next,
we
created
a
password
for
the
kong
manager.
We
probably
or
you
know,
depending
on
what
cap
says,
we
may
or
may
not
go
into
the
con
manager
today.
If
we
don't
go
into
it
today,
I
highly
encourage
you
to
check
it
out.
It's
a
really
really
good
ui,
it's
very
helpful
too,
and
then
basically,
the
the
very
last
step
is
we're
preparing
ourselves
to
detroit,
deploy
the
control
plane.
So
we've
added
the
kong
repo
through
helm
and
then
we
just
updated
our
helm.
B
B
We
are
essentially
going
to
be
deploying
a
postgres
database,
so
this
is
what's
going
to
how
kong's
going
to
handle
the
configuration
and
you
can
configure
users.
You
have
a
lot
of
configuration
that
you
can
do
right,
because,
while
this
is
a
you
know,
it's
an
api
gateway,
that's
minimal
and
lightweight.
It
has
a
lot
of
functionality.
So
that's
essentially
the
reason
behind
this
postgres
database
behind
here.
A
Yeah,
if
I
can
actually
cover
some
of
the
postgres
and
why
that's
valid
here,
so
kong
has
the
ability
to
run
with
as
a
db-list
api
gateway
and
what
that
equates
to
is
running
purely
from
memory.
But
some
of
the
power
and
value
that
a
lot
of
companies
find
in
kong
gateway
is
the
rbac
control
so
being
able
to
separate
different
developer
teams
by
like
logical
groupings
of
roles.
B
B
I'm
going
to
give
you
a
very
oversimplified
version
of
what
this
is.
Let's
just
say
it's
it's
a
way
to
expose
the
service
to
so
that
you
can
hit
it
from
the
ingress.
So
essentially
what
we
have
here
so,
let's
say,
k,
get
sbc
and
com,
so
we're
going
to
look
at
our
control,
plane,
services,
essentially
right,
now
see
if
we
can
make
that
a
little
better.
B
Let's
see
all
right,
so
it's
a
little
small,
but
we
can
get
that
just
here.
So
currently
we
have
this.
This
kong
admin
service,
the
kong
cluster
service,
which
is
this,
is
very
useful
if
you're
going
to
go
multi-cluster
and
I'll
actually
point
out
how
to
do
that
as
soon
as
we
install
the
data
plane,
but
essentially
this
would
be
exposed
as
like
a
as
a
load.
Balancer
would
be.
You
know
my
choice,
but
I'm
sure
you
could
do
it
as
a
node
port
and
basically
just
hit
the
ip
of
the
node.
B
The
cluster
telemetry
url,
essentially
we're
going
to
make
these
accessible
from
the
outside
using
this
notion
of
the
openshift
route
and
that's
the
next
command
here,
exposing
services
as
routes,
so
those
are
exposed.
Now
we
can
get
the
routes
in
and
we're
going
to
see,
there's
actually
urls
pointed
to
them.
It
shows
which
service
they're
pointing
to,
and
it
actually
shows
the
port
on
which
these
services
are
exposed.
B
A
Actually
so
init
migrations
is
a
pod
that
the
control
plane
is
dependent
on
that
init,
migrations,
initializes,
the
postgres
database
and
then
you'll
also
see
some
other
postgres
maintenance
tasks.
So
if
you
do
a
helm,
update
or
take
some
other
update
step
in
in
the
life
cycle
of
your
kong
gateway,
you'll
see
some
of
those
pods
hitting
the
database
and
that's
just
making
sure
that
schemas
that
updated
are
converted
properly
in
the
database
and
handling
maintenance
of
the
life
cycle
of
the
database.
Over
time.
B
Thank
you
so
yeah,
essentially
we're
just
waiting
on
those
jobs.
To
finish
you,
you
don't
want
to
rush
it.
If
you
try
to
start
doing
steps
out
of
order
and
you're
surely
going
to
kind
of
fall
into
a
problem,
and
this
kind
of
really
goes
into
the
whole
get
ops
workflow.
So
we
noticed
when
we
were
actually
installing
the
control
plane.
There
is
a
ton
of
configuration
there
that
is
needed.
B
That's
like
that's
necessary
because
you
want
to
configure
every
single
thing
in
as
few
steps
as
possible
in
case
you're,
throwing
this
in
argo,
cd
or
some
kind
of
git
ops
engine.
You
want
it
to
be
almost
as
configured
as
possible
before
you
kind
of
move
on
to
the
next
step.
You
don't
want
to
be
patching
things,
for
instance,
if
you
don't
have
to.
A
Yeah,
absolutely
that
imperative
versus
declarative
model.
Actually,
while
we're
waiting
for
this
to
come
up
or
if,
before
we
move
on
to
the
next
step,
we
have
a
question
about
how
to
install
it
in
openshift.
If
it's
an
operator,
if
we're
using
helm
or
what
our
opera
options
are
there
and
that's
a
really
good
question,
because
there
are
a
few
different
ways
to
go
about
that,
you
can
forego
the
helm,
install
path
we
are
using
helm
today,
but
think
things
like
customize
are
fully
supported.
A
If
you're
looking
at
going
the
the
route
of
argo,
cd
or
advanced
cluster
manager,
you're
going
to
see
an
option
for
writing
out
all
of
your
manifests
directly
or
also
using
the
helm
chart
at
that
point
and
then,
as
far
as
a
a
peak
into
the
future,
there
is
an
operator
in
the
works.
It
is,
you
know,
pre-released
right
now.
A
I
think
it's
at
least
some
versions
of
it
are
in
the
operator
hub
now,
but
we're
looking
at
the
kong
3.0
or
later
release
for
actually
bringing
that
operator
to
production
ready
and
what
that
operator
is
going
to
do
is
actually
remove
a
lot
of
the
like
human
in
the
loop.
So
like
casey
you're
saying
you
know
you,
you
want
to
wait
until
a
task
is
completed
while
deploying
the
control
plane
before
we
move
on
to
data
plane
tasks
and
other
steps
like
that.
B
Right
so
now
we
are
going
to
actually
validate
that
our
control
plane
is
installed
by
curling
for
the
version
so
since
you're
here
and
how
are
we
doing
this
right
so
that
this
is
a
very
important
part.
So
the
khan
control
plane
has
this
kong
and
min
service
right,
and
this
kong
and
men
service
is
essentially
responsible
for
handling
the
control
plane
configuration
so
we're
going
to
actually
curl
this
to
see
which
version
we're
on
and
we
expect
to
see
2.8
point
something
enterprise.
B
B
B
B
Okay,
cool.
Thank
you
all
right,
so
essentially
we're
just
checking
against
this
kong
and
min
route
and
we're
essentially
looking
for
the
version,
as
you
all
saw
earlier.
This
is
now
protected
by
a
token,
so
we
want
to
just
make
sure
that
only
authenticated
users
are
essentially
talking
to
the
control
plane,
the
users
that
we
want
to
be
talking
to
the
control
plane.
B
So
essentially
earlier
I
said
we
were
hoping
to
get
that
2.8.0
enterprise
edition
back
and
that's
exactly
what
we
got
so
we're
moving
on
so
for
the
kong
manager.
Ui
actually
needs
to
be
patched
and
it
doesn't
always
need
to
be
patched.
It
needs
to
be
patched
kind
of
in
open
shifts
because
we
want
to
tell
we
want
to
tell
essentially
the
control
plane.
Where
is
this
route?
So
where
do
I
look
for
the
api
url
and
we're
saying
you
look
at
this
route,
and
this
is
where
it
is.
B
Now
you
know
every
time
I
do
anything:
it's
validation,
validation,
validation.
So
I'm
just
going
to
actually
look
at
that
deployment
and
I'm
going
to
look
at
the
containers
grabbing
for
that
environmental
variable
on
the
pod,
just
to
make
sure
that
routes
showing
right
here,
which
it
is
so
that's
good.
B
A
So
yeah
this
is
a
separate
home
release.
So
what
we?
What
we
deployed
earlier
was
just
that
control,
plane
piece
and
then
this
is
one
of.
However
many
diff
separate
data
planes
you
want
to
deploy.
You
can
actually
separate
it
out
by
different
name
spaces
and
isolate
those
data
planes
to
those
individual
namespaces.
A
B
B
Here
it
is
this
con
con
cluster
service,
so
here
when
we're
connecting
the
control
plane
of
the
data
plane,
we're
actually
going
to
reference.
This
url
right
here
through
this
environmental
variable,
this
just
as
easily
could
be
on
a
separate
cluster
and
this
url.
So
this
is
a
local
cluster
dns.
This
would
be
the
the
url,
for
instance,
of
a
load
balancer
and
likewise
with
the
telemetry
right.
B
It's
the
exact
same
host
just
once
port
8005
oneports8006,
so
essentially
what
you
do
to
go
multi-cluster
immediately
and
just
put
these
two
things
on
two
separate
concerns.
Essentially
now
you
have
two
different
failure:
domains
that
are
not
coupled
right.
So,
if
you
think
about
kind
of
resiliency,
that's
that's
the
way
you're
starting
to
go
when
you
do
things
like
this,
but
yeah
simply
just
expose
this
service.
A
Yeah,
just
kind
of
adding
to
the
idea
of
multi-cluster
with
a
centralized
control
plane,
one
of
the
really
fun
new
things
that
kong
just
released
last
week
actually
is
the
connect
cloud.
So
it
takes
that
paradigm
of
a
separate
global
control
plane
and
we
offer
that
control
plane
as
a
sas.
So
one
of
the
most
complex
parts
of
kong
is
actually
deploying
and
maintaining
that
control
plane
component
and
then
the
data
planes
from
there
that
you
deploy
out
are
relatively
simple
in
comparison
and
so
that
sas
connect
product
where
kong
hosts
the
control
plane.
A
B
B
We
then
curled
the
data
plane
proxy
directly,
and
it
said,
maybe
confusingly-
maybe
not
confusingly-
hey
no
route
match
with
those
values.
So
I
can't
go
to
forward
slash
on
the
data
plane
proxy
and
expected
to
do
something.
Why?
Well
because
we
don't,
we
haven't,
created
an
ingress
yet
and
there's
another
way
to
do
this,
like
you,
can
actually
essentially
configure
the
kong
control
plane
through
rest.
B
So
there's
a
lot
of
ways
to
configure
it
at
this
moment
we
just
haven't
configured
it
yet
and
that's
the
next
steps,
but
that's
why
we're
getting
that
no
route
match-
and
this
is
our
next
step-
we're
essentially
going
to
check
the
clustering
status.
So
this
is
kind
of
kong's
way
of
telling
you
hey
the
control
plane
and
the
data
plane
are
in
communication
and
they're
in
sync.
B
So
let's
go
ahead
and
check
this
just
to
make
sure
we're
in
sync,
as
as
we
expect
to
be
right
now,
and
we
are
so
we
can
see.
This
is
actually
our
data
plane
host
and
we're
good
and
we're
talking
and
and
that's
it
for
the
control,
plane
and
data
plane
installations.
Now
we're
going
to
start
with
the
app
scaffolding
and
then
start
doing
things
with
the
gateway.
B
So
there
is
this
really
genius
app
book
info
and
it-
and
I
say
that
not
as
a
joke,
because
I
love
book
info,
it's
a
great
app
and
you'll
see
why?
Because
it's
so
good
for
teaching
so
good
for
doing
multi-cluster,
you
can
do
canary
releases
with
it.
You
can
do
blue-green
deployments
with
it.
It's
just
a
tool,
it's
a
great
tool,
and
you
know
in
kubernetes,
kubernetes
and
cloud
native,
hybrid
cloud.
You
need
to
have
separation
of,
or
separation
of
concerns.
You
need
to
separate
failure,
domains.
B
B
One
thing
about
openshift
openshift
is
what
we
call
secure
by
defaults.
So
if
you're
familiar
with
validating
and
mission
controllers,
validating
and
mutating
admission
controllers,
the
admission
controller
is
essentially
what
sits
up
at
the
very
front
of
the
proxy
and
accepts
the
requests
as
they
come
in.
These
are.
Are
the
requests
basically
coming
in
from
like
your
coupe
cuddle
client?
B
It
wants
to
see
a
very,
very
secure,
manifest
right
and
if
it's
not
secure,
for
instance,
if
you're
running
as
roots
or
if
you're
running
with
like
an
fs
group
or
if
you're
running
as
user,
you
know
less
than
like.
You
know,
I
don't
know
the
exact
number,
but
if
you're
running
as
a
low
user,
with
a
lot
of
permissions
or
you're
running
as
a
group
that
needs
a
lot
of
permissions.
B
It's
not
going
to
like
that
right,
and
why
is
it
not
going
to
like
that
because
you
can
technically,
if
you
have
enough
permissions,
if
you
can
escalate
privileges,
you
can
reverse
out
of
your
shell
and
get
onto
the
host
machine,
and
you
could
really
do
some
damage
right.
You
could
do
a
ton
of
damage.
You
get
the
aws
creds.
A
B
Yeah
agree
completely
right
and
you
know
pods,
you
know
you.
You
need
a
very
powerful
kind
of
validating
controller
at
the
at
the
cluster
level,
whether
that's
like
oppa,
whether
that's
pod
security
policies,
whether
that's
exactly
how
openshift
does
it
doesn't
really
matter
what
it
is.
It
just
has
to
be
done
right.
You
have
to
have
security
and
you
also
need
network
policy
right.
You
need
to
fence
things
off,
you
need
to
say
a
can
talk
to
b,
but
there's
no
reason
for
a
to
talk
to
c
right.
They
shouldn't
even
communicate.
B
And
we
have
our
our
details:
application.
We
have
our
product
page,
our
ratings,
our
reviews
and
I'm
actually
going
to
show
everyone
a
picture
of
this
architecture,
because
this
pretty
much
means
nothing
just
looking
at
at
the
pods
in
a
name
space
right
now,
but
they
all
speak
with
each
other
in
a
microservices
way.
B
B
B
B
So
what's
gonna
happen
here,
this
is
the
request
path.
The
request
path,
lands
on
this
product
page
this
python
app.
It
doesn't
even
matter
what
it's
written
in
right,
it's
all
microservice
architecture,
so
it
doesn't
even
matter
what
it's
written
in
product
page
talks
to
reviews
right.
So
basically
it's
just
got.
It's
got
two
panels.
It's
got
this
book
reviews
that
says
like
hey.
This
book
was
great
and
then
reviews
talks
to
ratings
and
the
rating
shows
the
number
of
stars
the
book
has
and
then
also
in
that
product
page
on
the
left.
Pane.
B
A
A
B
B
B
I'm
sorry,
I'm
going
to
say
kong
in
the
control
plane.
So
essentially
we
do
have
our
our
proxy
right
here.
You
can
see
it.
It
is
a
load
balancer.
So
it's
it's
directly
connected
out
to
some
infrastructure
but
yeah,
all
right,
okay,
so
product
page
right,
I
keep
talking
about
it.
I'm
eating
around
the
bush,
because
I
don't
know
exactly
how
to
share
this,
because
I
want
to
show
you
the
internet,
when
I
port
forward
to
this.
B
But
here's
what
we're
gonna
do
I'm
going
to
go
ahead
and
make
an
ingress
here
right
so
in
kubernetes,
making
an
ingress
is
very,
very
actually
very
simple
right.
You
say:
okay,
create
and
name
of
the
ink.
Then
you
have
a
rule
and
then
you
say
basically
creating
ingress.
We
have
a
rule,
so
this
is
the
actual
host
name.
Do
I
do
I
want
my
host
name
to
be
google.com?
B
B
You
don't
know
what
is
and
is
not
namespace
scoped,
you
can
say
coupe
cuddle,
api
resources,
space
namespace
equals
true
or
false,
and
then
you
can
kind
of
grab
for
a
given
resource,
but
but
that's
why
ingressas
are
so
powerful
and
they
belong
in
their
own
namespaces
for
their
own
things
that
they're
concerned
about.
So
this
book
info
ingress
is
concerned
with
book
info
right
now
in
order
to
hit
book
info
you're
going
to
have
to
send
a
request
with
the
actual
host
name
being
asterisk
dot.
Co
we're
going
to
change
that.
B
Then
next
we're
going
to-
and
this
is
the
100
essential
right-
we
would
be
able
to
get
by
just
fine
without
stripping
the
path.
This
is
a
nice
to
have,
but
we
do
need
an
ingress
class
and
if
we
want
to
use
kong,
ingress
gateway
right,
so
we're
going
to
actually
patch
our
ingress
and
we're
going
to
do
basically
an
o.p
patch,
we're
going
to
add
the
ingress
class
name
as
as
kong,
we're
going
to
remove
that
host.
There's.
B
Just
simply
no
reason
I
mean
you
can
have
a
host
you,
don't
you
don't
need
a
host.
If
this
was
you
know,
in
production,
I'd
have
like
a
actual
tls
and
then
in
my
my
like
google
domains,
I
would
be
pointing
to
the
actual
ip
address
of
that
column,
proxy,
and
so
basically,
so
I
could
say
in
google
domains
hey
route
when
I
say
caseywiley.com
related
ip
address,
that's
kind
of
too
long.
Too
short,
it
didn't
read,
but
that's
what
we're
doing
here.
We
are
essentially
creating
an
ingress.
B
B
A
B
B
Is
our
application
right?
This
is
the
good
old,
reliable
trustee
book
info
application
where
we're.
Essentially,
we
have
the
details
application.
This
is
this
micro
service
details.
This
is
reviews
and
these
little
stars
are
ratings.
So
essentially
the
requests
are
propagated
through
the
the
cluster
and
all
the
kind
of
information
is
piped
back
and
eventually
product
page.
Has
this
information
right
somehow
product
page?
B
Has
it
and
really
interesting
piece
of
information
here,
so
the
amount
of
traffic-
that's
north
south,
so
from
the
user
into
your
cluster
versus
the
amount
of
traffic?
That's
east
west,
so
I
log
in
I
get
a
session
and
then
all
these
microservices
are
talking.
It's
like
you
know,
maybe
up
to
four
orders
of
magnitudes
greater
than
the
north-south
traffic.
So
essentially
the
user
sends
one
request,
but
then
these
microservices
architectures
have
to
do
a
lot
more
things
for
that
actually
happen
and
get
the
information
back
to
the
user
all
right.
B
A
So
so
that's
that's
actually
really
fun
to
stop
and
look
at
what
we're
looking
at.
If
you
look
at
those
first,
two
lines
of
the
cml
object
is
the
api
version,
and
you
can
see
that
that's
pointing
at
a
kong
api,
which
of
course,
is
this
one
of
the
crdd
that
defines
what
kong
can
do
and
the
kind
is
the
kong
plugin.
A
B
A
B
A
Hey
cat
cat,
I
need
this.
I
want
this
right
as
the
oldest.
It
often
fell
to
me
to
go
ahead
and
like
step
in
and
save
the
day
or
whatever
and
up
to
a
point
that
can
be
great,
but
when
it
happens
too
much
you,
you
want
to
give
each
consumer
right
each
each
person
coming
to
that
front
door
a
limit
of
how
many
times
they
can
knock
on
the
door.
A
B
B
Yeah
yeah,
what's
up
cut
siblings,
but
so
we're
actually
respectfully
rate
limiting.
So
essentially
you
know
rate
limiting
is
protecting
your
critical
infrastructure.
You
know,
maybe
your
base
can't
handle
quite
as
much
as
your
onboard
proxy
right.
It's
it's
different
things
have
different
throughputs
and
we're
respectfully
rate
limiting
by
ip
address,
so
punish
the
people
that
are
trying
to
attack
your
system
and
take
you
down.
Don't
punch
the
people
who
are
trying
to
use
your
system,
and
you
know.
A
A
Actually,
it
looks
like
we
have
a
question:
can
we
prioritize
requests
when
rate
limiting?
So
that's
a
bit
of
a
qos
like
quality
of
service
question?
And
yes,
there
are
ways
to
actually
identify
who
is
making
a
request
say
you
monetize
your
apis
and
you
have
different
billable
tiers
for
who
gets
more
bandwidth,
who
gets
more
a
higher
rate
limiting
ceiling,
and
things
like
that.
B
Good
explanation,
so
basically
we
are
are
leveraging
this,
this
kong
plugin
right
now
to
rate
limit
by
ip
address,
and
we've
said.
Essentially
we
only
want
this
is
a.
This
is
a
service
that
we
built
that's
terrible
right
that
we
know
can't
take
any
load,
so
we're
saying
like
after
three
requests
in
a
minute:
it's
probably
going
down
on
that.
First,
one.
B
So
I
essentially
just
curled
through
the
ingress
over
and
over
again
until
I
hit
this
429
and
obviously
429
means
whoa
back
off
too
many
requests.
So
basically
it's
gonna
wait
a
few
there's
like
a
back
off
period
and
probably
right
now.
I
could
probably
send
another
request
through
yeah
getting
200
back
at
the
top.
You
see
there,
but
you
know
you
do
it
too
many
times
you're
going
to
trigger
that
that
way
limit
and
there
we
are
429.
B
A
Okay,
so
this
is
where
we're
actually
not
just
saying
you
can
only
you
know,
knock
at
the
door
three
times
in
a
minute,
but
you
have
to
have
you
know
the
secret
password
and
or
the
secret
knock
right,
and
then
you
get
let
in,
and
this
is
we're
going
to
be
using,
looks
like
key
cloak
as
our
oidc
provider.
Yes,.
B
Exactly
yeah
and
if
you're
not
familiar
with
key
cloak,
it's
it's
a
red
hat
product.
It's
open
source,
it's
written
in
java,
it's
been
around
a
while,
but
it
has
a
ton
of
functionality
and
we
are
installing
key
cloak
from
the
operator
so
like
every
single
other
application
that
should
be
according
to
best
practices.
It's
in
this
other
name
space.
So
we're
going
to
create
the
namespace
kong
keeklook.
B
A
Know
it
all,
you
know
what
I
think,
you're
you're,
opening
a
can
of
worms,
because
there
are
so
many
ways.
I
mean
people
talk
about
pods
and
what
you
know,
how
how
big
should
a
pod
be?
What
all
should
live
in
a
pod,
for
example,
you
can
deploy
kong
in
with
the
control
plane,
the
data
plane,
the
developer
portal,
the
web
ui.
All
of
that
in
one
helm,
release
which
puts
it
all
in
one
pod
or
you
can
separate
it
out
into
tiny
micro
services
and
then
should
they
all
live
in
the
same
name
space.
A
B
So
you
know
first
step
since
we're
installing
this
by
an
operator
operators
for
installation
you,
they
use
something
called
olm
so
we're.
Essentially,
what
we're
doing
here
is
we're
installing
an
operator
group,
the
operator
groups,
job,
is
basically
to
say:
where
will
this
operator
live
and
the
subscription
is
basically
where
to
find
these
operator
manifests
these
assets
for
the
operator?
B
B
Had
this
really
awesome
analogy
right,
so
we're
knocking
out
the
door
now
you
have
to
actually
have
to
have
a
key
to
get
into
the
door
right,
and
we
already
know
just
because
you
knock
a
hundred
times
in
a
row.
Basically,
the
door
is
going
to
disappear.
If
you
keep
knocking
so
now
we're
giving
we're
handing
out
keys-
hey
you
want
to
get
in.
You
can
take
this
key.
B
So
first
thing
here
this
key
cloak.
This
is
an
instance
of
key
cloak,
so
this
is
an
instance
of
the
operator,
I'm
officially
now
launching
an
instance
of
key
click.
Next
I
have
a
realm.
A
realm
is
how
all
your
apps
are.
All
your
users,
it's
another
logical
separation
right.
It's
it's
not
a
physical
barrier.
It's
it's!
It's
what's
called
a
realm,
it's
how
you
do
your
logical
grouping
of
users
and
applications,
etc.
B
In
our
realm,
no
surprising
is
called
the
kong
realm.
It
could
have
been
book
info
ralph,
but
you
know
it
doesn't,
doesn't
really
matter
right,
apples,
tomatoes,
whatever
we
have
our
key
cloak
clients
and
we
have
a
redirect
url-
and
this
is
you
know,
oidc-
is
just
this
spec.
That's
this.
That
tells
you
how
to
do
things
on
on
oauth2
right,
so
you
have
to
have
this
redirect
url.
B
B
B
B
A
B
A
B
A
I
just
wanted
to
recognize.
We
are
coming
up
on
on
the
hour,
which
is
normally
where
we
end
I'd
like
to
go
ahead
and
stay
on
long
enough
to
go
ahead
and
show
the
oidc
in
combination
with
the
rate
limiting
that
we
already
showed
off
here.
So
I'm
going
to
keep
the
stream
running
for
a
little
bit
while
we
we
go
over
time,
but
I
just
wanted
to
thank
everyone
who's
stuck
with
us
so
far
and
who
has
who
have
participated
with
good
questions.
A
Of
course,
any
additional
questions
or
comments
that
you
have
I'll
try
to
respond
to
those
in
the
next
few
minutes
before
the
top
of
that
hour,
we'll
go
into
overtime,
and
if
you
have
additional
questions
or
things
like
that,
and
you
want
to
leave
comments
in
youtube,
we
will
do
our
best
to
try
and
answer
those
things.
We
do.
Of
course,
have
the
kong
channel
in
the
kubernetes
slack,
so
you
can
follow
up
with
us
there
and
and
then
casey.
Thank
you
for
everything
that
you
put
together
to
show
us
today.
A
B
A
B
That's
that's
cool,
that's
cool!
My
heart
was
just
skipping
a
beat
when
you
were
talking
to
me
because
I
was
like.
Why
is
this
thing
not
coming
up
but
hey
good
old
java?
We
made
it
yes,
three
minutes
later.
All
right,
no
java
is
actually
really
awesome.
I
don't
I'm
not
yeah,
I
mean
any
programming
language
you
want
to
use
is
perfectly
fine
with
me.
B
B
What
what
this
plugin
does
is
it's
going
to
actually
check?
For
a
token,
if
there's
not
a
token,
it's
going
to
redirect
you
to
the
oidc
like
login
page,
it's
this
key
club,
login
page
and
then
you'll
get
a
token
and
it'll
redirect
you
back
to
the
application,
but
essentially
from
here
on
out
or
after
we
make
this
annotation
on
the
ingress.
A
Actually,
I
wanted
to
add
to
that
because
the
the
question
earlier
about
prioritizing
request
traffic
based
on
different,
like
quality
of
service
rules,
and
things
like
that.
That
token
is
one
of
those
pieces
of
information
that
you
can
use
in
understanding
who
is
making
the
request
and
treating
them
based
on
specific
rules
that
you
have
established
for
either
that
user
or
that
group
that
you
can
understand
as
an
individual
consumer.
A
We're
skipping
past
insecure
certificate
errors
and
things
like
that
in
a
more
mature
deployment.
Of
course,
we
could
have
used
cert
manager
or,
as
sorry,
aws
certificate
tooling
and
things
like
that
to
automate
loading
ssl
certificates
into
the
kong
gateway
based
on
service
or
creating
one
that
is
a
fallback,
possibly
wild
card
certificate.
Things
like
that,
so
the
not
secure
is
what
we're
looking
at
right
now
for
demos,
but
of
course,
that
ssl
feature
is
built
into
the
gateway
itself
too.
B
B
For
all
intents
and
purposes
it
it
works,
it
works
just
quite
normally.
I
guess
yep
all
right,
so
we
are
done
with
key
cloak
now
we're
really
in
the
very
end
of
this
right,
we're
in
the
end
the
the
beauty
of
kong
gateway
or
or
any
powerful
gateway
in
fast
gateway
like
a
like
a
kong
or
you
know,
there's
plenty
of
gateways
out
there
that
are
also
really
good,
but
they.
B
B
Infrastructure,
the
book
info-
and
this
is
I'm-
going
to
do
this
fast-
I'm
sorry,
I'm
going
to
have
to
kind
of
switch
back
and
forth
to
the
browser,
because
I'm
going
to
make
a
policy
that
says
I'm
going
to
make
a
network
policy
that
says
deny
all
do
not
let
anything
into
the
mesh
and
I'm
not
going
to
show
it
to
you,
because
that's
going
to
that's
going
to
be
boring,
it's
going
to
be
a
blank
screen
just
going
to
like
keep
waiting.
It's
not
going
to
show
anything!
B
B
B
Yeah,
so
this
is
good
old,
vanilla,
kubernetes.
You
have
to
have
a
network
plug-in
installed.
So,
like
I
use
calico,
you
could
use
psyllium,
there's
there's
a
lot
of
them
that
support
network
policies,
but
basically
it's
more
like
on
a
on
a
very
lower
lower
level
than
like
the
kubernetes
level
and
when
you're
installing
kubernetes.
You
have
to
have
this
like
pod,
networking
solution
or
cni.
B
B
Totally
so
this
is
a
denial
network
policy
for
the
ingress,
so,
basically-
and
it's
in
the
book
info,
so
there's
nothing.
That's
going
to
happen
here
through
the
ingress.
Basically
what
it
says
right,
don't
let
anything
happen.
No
ingresses
and
I'll
skip
this
for
right.
Now,
I'm
not
gonna.
I
don't
want
to
switch
too
many
times,
because
I'm
really
at
the
end-
and
I
don't
want
to
lose
too
many
people
all
right.
So
here's
where
we're
going
to
actually
be
able
to
see
something.
We
want
product
page
that
front-end
seeming
application.
B
I
don't
know
if
it's
like
server-side
rendered
or
exactly
how
it
works
that
front-end
application
is
going
to
want
to
talk
to
now.
Oh
I'm,
sorry,
so
this
one
is
actually
ingress
to
product
page.
So
product
page
essentially
cannot
speak
to
any
other
microservices
after
this
network
policy
is
applied,
so
we
can
actually
hit
the
front
end,
but
we
can't
hit
any
other
microservice.
So
no
reviews
no
ratings
and
no
details.
B
Wasn't
super
late
in
just
a
couple
of
seconds,
but
but
so
that
network
policy
I
just
created,
I
said
basically
product
page-
can
receive
traffic
from
any
pod.
Any
pod,
just
open
and
close
curly
braces
right,
just
generic
any
anything
can
hit
product
page
but
product
page.
Basically,
the
other
micro
services
that
are
in
book
info
are
still
locked
down.
So
product
page
can't
talk
to
reviews.
Product
page
can't
talk
to
details.
Product
page
can't
talk
to
ratings.
A
B
Yeah
exactly
exactly
right.
So
the
way
the
front
end
is
written
like
it's
just
basically
going
to
say
like
can
I
query?
Can
I
not
if
I
can't
query
it's
going
to
say
sorry,
the
details
are
currently
unavailable
for
this
book.
Product
reviews
are
unavailable
because
we've
essentially
started
blocking
traffic
through
network
policy
and
product
page
isn't
allowed
to
talk
to
anyone
right
now.
B
B
So
basically,
in
this
next
network
policy,
we're
going
to
say
this
is
an
address
policy
and
it's
on
the
reviews.
Microservice
and
it's
going
to
say:
okay
I'll,
accept
ingress
traffic
from
product
page,
so
reviews
has
ingress
traffic
from
pod.
Selector
match
labels
app
product
page.
So
we
should
see
at
least
one
of
those
blocks
on
the
right
side
now
becoming
populated.
After
this
network
policy
is
applied.
B
Okay,
it
looks
like
we
are
showing
again,
okay
and
and
what
was
that
those
reviews
product
page
can
talk
to
reviews.
The
last
time
we
refreshed
we,
there
was
an
error,
fetching
the
product
reviews.
Now
we
should
be
able
to
talk
to
the
product
reviews,
but
we
shouldn't
have
any
stars.
So
we
shouldn't
have
any
ratings,
but
we
should
have
the
reviews.
B
B
All
right
so
review
ratings.
This
is
essentially
going
to
just
give
you
the
stars
right
because,
based
on
the
architecture,
it's
reviews
that
talks
directly
to
ratings
in
order
for
it
to
know
how
to
populate
those
stars.
We
are
applying
and
that's
going
to
just
give
you
the
stars.
But
let's
you
know
we're
running
over,
so
I'm
going
to
actually
give
you
that
left
side
as
well.
So
it's
saying
now
this
is
the
last
network
policy
we're
going
to
apply
and
it's
in
the
book
info
name
space.
B
It's
an
ingress
policy
type
and
it's
applied
on
the
details.
Microservice.
Basically,
the
details
can
accept
ingress
traffic
from
the
product
page.
So
now
the
product
page
is
going
to
be
able
to
reach
out
the
details
and
kind
of
see
those
details
for
a
given
book
and
after
I
apply
this
and
when
I
go
back,
we
are
going
to
be
all
done
and
that's
going
to
conclude
our
session.
So
let's
thank
you
so
much
everyone
for
bearing
with
me
and
thank
you
kat
for
bearing
with
me
and
inviting
me
it's
been.
B
B
A
B
A
Anyway,
so
it
was
really
fun
to
show
all
that
off.
I
know
we
covered
a
lot
of
details,
so
we
deployed
a
control
plane.
We
talked
about
different
ways
that
kong
itself
can
be
deployed
and
the
fact
that
we
were
separating
the
data
plane
and
the
control
plane.
Today
we
went
in,
we
deployed
the
data
plane,
we
added
a
rate
limiting
plug-in,
we
deployed
key
cloak
and
then
configured
key
cloak
to
authenticate
in
front
of
our
application.
A
We
deployed
book
info
to
demonstrate
all
of
that
and,
of
course,
that's
a
multi-service
application,
and
then
we
went
and
we
continued
to
tempt
fate
and
applied
a
bunch
of
networking
policies
to
show
how
you
could
control
and
make
sure
that
nothing
was
talking
to
anything
else
unless
it
was
very
specifically
supposed
to
designed
to
and
allowed
to.
Okay
see,
that
was
a
great
demo.