►
From YouTube: Kuma Community Call - August 10, 2022
Description
In this call, we discussed the following:
- Upcoming release Kuma 1.8.0
- Kuma + NSM integration
A
I
think
you
see
the
document.
Please
add
your
name
to
the
attend
list
and
also
feel
free
to
submit
any
agenda
topics
you
would
like
to
discuss
today.
Yeah.
We
will
start
with
the
shortly
mentioning
of
the
upcoming
release.
It's
going
to
be
1.8
next
week.
We
want
to
release
this.
Full
list
of
changes
will
be
available.
I
guess
next
week
so
yeah
not
much
to
say
about
that.
A
B
So
at
the
moment
we
want
to
implement
this
scenario
that
is
provided
by
the
link.
It
should
be
a
diagram,
so
it
will
be
a
little
bit
clear
for
everyone
else
what
it
is
and
we'd
like
to
get
bootstrapped
with
kumar
authorization,
and
could
we
ask
someone
who
can
help
us
offline
with
our
questions
related
to
authenticification
and
authorization.
A
B
A
B
A
Okay,
so
use
case
you're
trying
to
support
is
to
connect
instance,
site
car
from
cluster
2
to
the
control
plane,
control
plane
from
cluster
one.
Is
it
correct?
Yeah,
okay
and
you
don't
imply
that
there
is
like
flat
network.
It
could
be,
I
mean,
oh,
no,
I
think
are
they
in
the
same
network.
I
mean
this
workload,
one
and
workload.
Two.
B
A
C
Yeah
sure
thing,
let
me
see
so
as
a
little
bit
of
preface
we
kind
of
are
gonna,
so
me
and
nick.
So
I
have
nick
jackson
as
well
from
hashicorp
on
the
on
the
call
and
nick
and
I
have
been
working
on
this,
this
concept
for
one
of
the
sessions
for
the
the
kong
summit
and
and
so
what
we
we
were
in
some
discussions,
and
we
were
talking
about
kuma
and
and
and
deploying
it
out
and
I've
been
working
with,
and
I
was
like
you
know.
C
I
think
that
managing
the
secrets
of
the
vault
plug-in
would
be
a
really
cool
cool
topic
and
also
just
a
thing
for
groups
that
already
have
vault
in
place
and
are
looking
to
to
to
do
that.
So
I
have
been
kind
of
talking
with
jacob
as
well
and
and
and
we've
pushed
in
some
different
features
to
make
sure
that
that
this
will
will
work
well,
but
we
kind
of
are
we're
in
the
process
of
working
on
it
and
dimming
it.
C
C
So
all.
On
top
of
this,
what
we
do
is
we
we're
building
this
on
top
of
that,
this
specific
plug-ins
testing
and
stuff?
On
top
of
shipyard,
which
is
a
demoing
tool
that
nick
and
eric
bell
also
actually
court
built
in
order
during
their
time
of
doing
a
lot
of
demos
and
kind
of
building
out
things
like
this.
So
it's
a
way
to
manage
document,
docker,
spin-up
environments
and
stuff,
like
that.
C
So
that's
kind
of
we
built
that
on
top,
but
as
we
so,
let's
go
into
some
rambling,
so
we
dug
into
the
core
of
the
plug-in.
Is
we
are
leveraging
this
kuma
the
secret
engine
in
the
back
and
we're
storing
the
kuma
token,
revocation
renewals
and
what
we're
doing
is.
We
are
balancing
all
of
these
different
pieces
that
you
would
use
for
requesting
a
token
and
we're
having
hashicorp
vault
handle
that
for
us,
so
you
can
use
any
off
method.
C
You
want
in
order
to
authenticate
against
vault
and
then
vault
will
handle
all
of
the
interactions
to
and
from
the
api.
So
you
would
create
an
admin
token.
Take
that
admin
token
set
it
into
the
config
of
vault
and
then
it
could
then
broker
all
the
tokens
for
you
based
off
of
the
roles
that
you've
set
up
involved.
C
D
D
D
So,
in
order
to
control
who
has
the
ability
to
request
those
secrets
or
generate
those
secrets,
you
have
policy
so,
for
example,
here's
a
simple
policy,
so
I'm
saying
that
I'm
going
to
create
this
policy
sorry
create
this.
This
role,
which
would
be
title
policy
and
the
the
roles
called
kumar
roll
that
is
going
to
allow
me
to
generate
tokens,
data,
plane,
tokens
and
kuma
with
the
name
of
back
end
one
for
the
mesh
default
with
these
given
tags
now.
D
So
this
would
obviously
be
with
a
was
part
of
the
automated
process
of
when
you
deploy
your
your
data
plane.
So
you
don't
need
to
worry
about
putting
the
data
plane
token
onto
your
virtual
machine
or
whatever
it
is.
You
basically
can
then
just
use
cloud
metadata
like
aws,
swap
that
for
vault
token
vault
gives
you
the
data
plane.
Token
and
importantly,
the
data
plane
token
has
a
time
to
live
so
in
the
instance
that
you
you
want
to
run
like
short-lived
tokens.
D
B
D
D
Any
vault
instance
for
this.
It
just
uses
a
plug-in,
so
I
enable
that
engine
then
what
I
can
do
is
I
create
a
configuration
now.
Let's
have
a
have
a
quick,
a
quick
look
at
the
configuration
here,
but
the
the
configuration
basically
is
that
I'm
going
to
write
the
configuration
I'm
specifying
the
rules
that
can
be
used
by
this
configuration,
the
url
of
kuma's
data
plane
and
an
administration
token
that
we
can
use.
D
D
D
Then
you
ask
vault
to
give
you
a
cooma
token,
so
I'm
just
going
to
use
the
vault
read
command
and
this
can
be
also
api.
You
can
use
volt
agent,
I'm
saying
kuma
cred
the
name
of
my
role,
which
is
my
kuma
role
and
the
token
name
which
is
backend
one
and
there's
my
my
token.
So
what
bolt
has
done
is
it's
hit
the
kuma
api.
D
D
The
cool
thing
is
that
this
data
plane
token
is
short-lived,
so
vault
when
the
the,
when
the
kind
of
the,
if
you
don't
keep
renewing
the
token,
which
is
an
automated
process,
vault's
going
to
delete
it
for
you
and
it'll
it'll
revoke
the
token
for
you
and
the
ttl
on
this
was
30
seconds.
So
you
can
see
that
vault
has
actually
revoked
this.
D
So
just
in
the
logs
here
there's
I
mean
it's
logs,
so
there's
nothing
exciting
to
see,
but
you
can
see
that
the
token
hasn't
expired,
but
I
I've
asked
vault
to
revoke
it.
For
me,
it's
revoked
it.
So
again
it
has
hit
the
the
kuma
api
yeah
and
it's
added
the
jti
to
the
data
plane,
revocation
secret.
So
now
that
token
has
been
being
deleted.
C
When
he
called
when
he
called
that
original
read,
it
gave
you
a
lease.
It
gives
you
a
lease
id
that
lease
id
is
tied
to
that
token.
So,
with
that
lease
yeah
there
you
go,
you
could
manually
revoke
it
with
that
lease,
but
also
as
an
admin.
You
could
revoke
all
the
leases
for
a
specific
role.
So
if,
for
some
reason,
assert
there's
you
know,
there's
a
bad
actor
or
you
think,
there's
a
bad
actor.
C
You
can
completely
wipe
all
the
leases
and
they'll
have
to
re-authenticate,
and
that
would
then
add
all
those
to
the
replication
lists
at
that
point
in
time.
So
with
this
all
right,
so
with
this
one
of
the
things
that
we
are
continuing
to
build
out
on
and
we
were
kind
of
working
before
this,
his
call
is
the
next
step.
D
Yeah
and
just
as
a
kind
of
a
another
example
there,
what
I've
I've
just
done
is
I've
just
generated
a
user
token
yeah.
So
you
can
see
the
the
user
token
here,
I'm
an
admin
token.
But
again
I
can
specify
what
groups
in
exactly
the
same
way
as
I
did
with
the
the
role
yeah,
but
for
nick
and
then
I
can
use
that
to
interact
with
the
akuma
api.
So
I'm
gonna,
I'm
just
gonna,
use
my
token
that
I've
just
minted
there
to
actually
just
delete
a
secret
in
kumar.
D
D
C
And
also,
we
added
some
validation
in
there,
as
we
were
digging
through
it,
that
data
plane
tokens
use,
tags
and
user
tokens
use
groups.
So
when
you
create
a
role
you
can
you
have
to
you,
you
can't
specify
both
you
can
specify
a
role,
can
either
have
tags
and
be
for
a
service,
or
it
can
have
groups
and
be
for
a
user.
If
you
try
to
do
both
it'll
throw
out
throughout
an
era
there.
So.
B
C
You
would
tie
that
policy,
so
you
would
create
policies
that
you
could
add
users
to
or
groups
of
users
through
your
authentication
method,
and
then
those
policies
would
allow
you
to
read
the
specific
roles
that
you've
created.
So
you
could
create
a
plethora
of
roles
that
are
mapped
to
a
specific
set
of
groups
and
then
based
on
their
authentication
method.
They
would
be
able
to
read
those
tokens
when
they
read
that
it
issues
it.
C
It
would
then
go
and
request
it
through
the
kuma
api
and
issue
it
so
yeah,
and
all
that
you
know
it's
very
configurable
with
ttls
and
max
lifetime.
All
of
that
you
can
configure
right
in
your
when
you
create
the
role,
how
long
you
want
those
to
be
and
that
gets
translated
over
to
when
it
you
know,
get
or
request
the
token
from
kuma.
D
And
the
vault's
internal
role
and
security
policy
will
stop
you
from
doing
things
like
generating
tokens
that
you
don't
have
access
to.
So
if
I
try
and
generate
a
user
token
for
greg,
it's
like
you
know,
you
can't,
because
you
only
have
the
capability
to
generate
user
tokens
for
called
dick
and,
and
that
goes
for
for
all
of
the
other,
the
other
elements
in
there
as
well.
D
C
And
we've,
like
a
few
things
on
our
list,
to
add
on
to
that
which
are
the
the
garbage
collection
and
then
the
next
thing
that
we
want
to
add
in
there
is
the
ability
for
the
the
engine
to
rotate
its
own
admin
secret.
So
you
would
create
a
short-lived
admin
secret
to
actually
create
the
plugin,
and
then
we
could
trigger
a
request
in
there
to
have
vault
rotate
its
own
secret.
C
So
it
is
the
only
one
who
knows
that
root
admin
secret
so
that
even
there
that
takes
that
layer
that
you
know
prevents
that
from
being,
you
know,
leaked
as
well.
So
you
can
use
that
in
like
a
cicd
process,
and
then
you
could
tell
it
to
rotate
its
own
secret
and
then
that
initial
secret
is
no
longer
valid
because
we
added
to
the
revocation
list
and
and
handle
it
just
like
that
with
a
new
add-on
security.
Yeah.
D
B
B
D
D
Yeah,
I
mean
we're,
not
sorry,
go
ahead.
Yeah,
we
can't
solve
solve
all
of
those
things
that
has
to
be.
You
have
to
define
your
own,
your
own
perimeter,
but
what
it
means
is
you
don't
have
to
hand
around
admin
tokens
to
to
absolutely
everybody
you
can
you
can
use
group
scoped
tokens
and
then
somebody
has
to
have
trust,
but
you
know
that's
generally,
just
the
the
cluster
operator
as
opposed
to
the
cluster
user.
C
The
evolution
of
this
is,
and
we'll
do
this-
maybe
tackle
this
after
the
kong
summit.
The
evolutionist
is
completely
abstracting
the
the
authentication
and
token
minting
out
of
kuma,
and
only
getting
kuma
the
the
the
public
key
for
verification
process
and
then
have
something
like
vault
pki
or
something
like
that.
Completely
mint
handle
everything
so
yeah.
D
B
D
We
not,
we
will
okay,
so
not
not
in
this
demo,
but
we
will.
We
will,
because
what
we
need
to
be
able
to
do
in
the
config
as
well
is
to
be
able
to
store
the
the
ca
oh
yeah,
when
I
originally
set
this
up.
I
was
just
bootstrapping
kuma
with
the
default
setup,
I'm
actually
bootstrapping
kumar
in
my
dev
set
up
here
with
with
a
certificate.
So
I
could
add
that
in
oh.
C
A
C
Yes,
yeah
yeah
yeah,
you
can
go.
Take
a
look
it's
at
here,
I'll
link
it
in
yeah
feel
free
to
you
know.
Do
issues
make
comments
guys
as
much
as
you
want.
One
thing
we
did
do
actually
not
on
the
secret
side,
but
on
the
the
token
side
is
we
actually
incorporated
the
the
kumo
ctl
library,
because
the
the
go
the
vault
plugin
is
also
just
a
go:
a
go
execu.
You
know
execution
of
that.
C
D
So
when
you,
when
you're
looking
at
the
repo,
we
do
have
a
full
set
of
functional
tests.
Well,
apart
from
the
revocation
which
we
just
finished
off
this
morning,
there's
not
many
unit
tests
yet,
but
we've
because
we've
been
kind
of
like
basically
poking
the
bear
to
try
and
work
out
how
it
it
needs
to
growl.