Kubernetes Office Hours, 21 Nov 2018

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Kubernetes Office Hours 20181121

Description

Join our monthly live stream where Kubernetes experts answer user questions, join us on #office-hours on slack or post in our question thread (see below):

Info: https://github.com/kubernetes/community/blob/master/events/office-hours.md
Question thread: https://discuss.kubernetes.io/t/office-hours-for-21-november/3528

A

B

B

All right welcome. Everybody is the third Wednesday of the month. That means it's office hours, our monthly live stream where we go live on the air on YouTube, with an esteemed panel of experts that you see here and we answer as many kubernetes questions for you as possible. We are going to be in hash office hours on the kubernetes slack. If you go to slack dock kubernetes io just follow the forum there and go into the hash office hours Channel. If you're joining us from the kubernetes users channel welcome, feel free to just pop questions.

B

What we do is we queue them up and we go through them as quickly as possible. Let's do some quick, intros. First we're steam panel keep in mind. This panel is volunteer only so if you've done a really great project on kubernetes or you've amassed some expertise. Sitting on this panel is a great way to really contribute back to the community, and it's not a big commitment. It's one hour a month and we have enough people we can rotate around.

B

So if you feel like sitting on the panel and helping out people in this kind of format that we would love to, have you please p.m. me if you are watching the slack Channel, please let us know how the stream is sounding and looking with that, let's do some intros panel.

C

Hi, my name is Bob Dylan I am a research cloud administrator for the University of Michigan I've been working the with Cabernets for quite a while and sort of. My specialty is on Prem deployments and other things like Federation.

D

For pleasure, a company in London I work on their communities platform I've been building a lot of custom controllers recently spending a lot of time. The queue builder channel done a lot of stuff around off and stuff in the past. This way.

A

Hi I'm Priya basi from Giants forum I'm, mainly working in security and deployments on Azure AWS and on from lately I've, been designing lots of operators and architecture on that.

E

Hi I'm Matt Farina I work at Samsung, SDS I'm, one of the hell maintainer x' and I chair, say: gaps for kubernetes I spend most of my time working in the app space and things related to that.

B

Awesome great and I'm Jorge Castro I am a community manager at hefty Olson to be VMware and I will be your host coordinator for this evening, aka I will be reading the questions to the panel. Some quick rules before we get started. First of all, thanks for joining feel free to chat in the channel. We will be live-streaming the channel, along with the video, so feel free to talk amongst yourselves base links and so on. If we do address your question today, please just submit your question.

B

You will be automatically entered in a raffle to win this wonderful kubernetes t-shirt. So you too can look like Tim Hawking. We give away a t-shirt every time we do a session and it's a lot of fun with that. The quick ground rules there's a judgment-free zone, so people will be asking beginner questions. People will be asking complex questions so remember everyone had to start from somewhere. So please be supportive of everybody in your body. Remember that we do follow the code of conduct, as this is a kubernetes project event.

B

We will do our best to answer your questions, but the panel doesn't have access to your cluster so like if you're expecting mats are like SSH and your control plan and fix fix stuff. We can't really do that.

B

So live debugging is off topic, so we will concentrate on, is do our best to give you the next step on what you need to do next, to get the information that you would need to divide something panelists you're encouraged to expand on your answers with your experiences and pro tips and anything beyond the usual just answering a question. The reason we love you is because of your expertise with the stuff in production. So any insight that you have there's always welcome audience.

B

You can help us out by piecing in URLs to the official Docs blogs. Usually while one of the panelists is answering a question, they'll mention something and then people go out, though they'll go Google through. You know the problem that we're talking about and whack a whole bunch of URLs in the chat that is very useful, very recommend and we like to collect those up and stick them in the thread. Afterwards.

B

Bob is going to go ahead and post the question thread into chat right now, that's kind of where we're collecting the text. If, if you already have like a link to a stack overflow question or something and what we do, is we shove all the notes into that thread? So you have them there. You can also help us out by tweet spreading the word pay it forward. We do our best to try to help people as you can so thanks everyone for joining remember.

B

Each of these sessions is recorded and available on YouTube, and especially, if you're, using this as a work resource. As like a team thing, we had this vision that people at work during lunch or sitting down and watching off desires. If there's any information that you feel would help make this a better resource for your team, that's using kubernetes for for something useful. We would love to know about it and, as usual, if you want to sit in this panel, all these people are volunteers and they're taking the time and their employers.

B

Let them take the time to help users out. So the more you feedback you give us the better and when you do join, you do get a fabulous, fabulous, kubernetes water bottle, which I have yet to give these folks. But hey I, did remember to wear the red kubernetes shirt today. So with that audience are you ready feel free to type it's a chat, and then we will get started all right. The first one comes from cigar who actually PM. This question to me says: reg. Does the mini version?

B

3.30 support docker version, 1809 dot 0, but it says it doesn't support dr version 1809 dot 0. So this is, I'm gonna expand on it on this question here a little bit for the panel. What is the deal with docker versions and the stuff that I need to run kubernetes right, because the client-side tools and stuff is obviously revving at Dockers pace, but then again we use those tools in kubernetes.

B

So how do I I guess part of my general question to add to his is how to how do I keep how to how do I not cross the streams here and keep a same set up here, because kubernetes usually does not support the latest latest version of docker right.

C

Correct I think I, don't think they even support the latest stable one. Officially.

A

Yeah I think usually there is a few versions that are tested and stable. Usually newer versions should work, especially it's the most recent versions. I guess. If you switch to container D implementation, then that should be the best that set min EQ. You would I guess you're using no VM driver, because otherwise it comes with its own version of docker. So if you're, using a VM for mini cube like KVM or thing kind of in it's pretty much what you would use, then it would spawn its own docker in the VM and use that.

A

So you don't have dependency on your on your systems. Docker cut or demon.

D

So I just checked in a doc. They recommend 1806 at the moment, I'd no idea what the latest stable version is thing I think.

C

That's it actually, I know up until recently, I was like 1709 or 1706 yeah.

B

I fight I find myself I saved myself a lot of headache by using the docker that comes with kubernetes, so like using the even on my laptop I, don't install like cubelet and stuff I have the repo with docker in it so I'm, using the exact docker on my laptop. This is different, especially on abouttwo. This is different than the version of docker that you get from the docker repo, it's different from the version that ships in distro and different from the version the canonical supports on snaps.

B

So that's like five different versions of docker I find myself since I'm, mostly using it in a kubernetes context. I just use you know, like your, is usually not like a feature that I need very badly in the latest latest version of docker I'm happy with what kubernetes gives me, which is a little bit older, but yeah, there's version skew there I, don't really know a solution other than paying attention to that, and it's a thing you have to deal with all right. Any other comments on many cuban diversions.

C

Just one actually, the the mini cube default is 1806, currently 1806 dot one. If you want to do your own thing, you can, you know just the build file and sort of roll. Your own iso mm-hmm.

B

Would you want to use mini cube with a version newer than what kubernetes supports see? That's where it starts to get weird I think so something to think about. It's.

A

Always a risk involved kind of yeah.

B

A

Always worked yeah.

B

I've also seen where luck, it just works and everyone's like okay moving on, but like it. Even though Matt.

E

The one thing to think about is kubernetes goes through a lot of testing right and testing in certain situations, and so, if you try to go off the beaten path by changing docker versions and things like that, just be realize that what you're going at is really untested. At this point,.

C

E

That's that's. You know, that's the onus on you going that way. Saying: okay, I'm gonna go off the beaten path, I personally, just go with whatever. Is there because I'm relying on kubernetes more than I am on docker? It really is just just simple infrastructure: it just needs to run the basic things and then it's through the kubernetes interface, and maybe it's because I'm not doing anything too fancy because I like Portability and by not doing anything too fancy. It ensures portability, at least on that layer. Yep.

B

Okay, moving on Jim CMS hi I like to submit a question for office hours, I'm, a newbie, kubernetes user, welcome having a problem getting kubernetes up and running on my single node cluster problem description is here and I'm gonna go ahead and whack that URL in chat again just to have it there on the live stream. I. Follow that the bugging steps at the docs, which is the debug application, troubleshooting page, which I will also paste into the chat, but that didn't solve my problems.

B

My question is what are suggested next steps for debugging eg, how to turn in a dish turn on additional tracing, slash logging, how does some traffic on the pod network, etc?.

C

B

Very one, a minute.

C

Actually Stack Overflow Hey.

B

Lori's well, well, that's happening just a reminder. Those of you following along on the livestream in slack, there is about a 10 second delay, so we do our best to try to kind of deal with that.

B

These logos from the chat, because we don't need them.

B

And then Erin would like to remind everybody the lettuce, several Dockers 18:09, which is currently not supported in kubernetes, and that Dockers now moved to a six month release schedule. That is something I didn't know: I, don't know how it lines up with the kubernetes release schedule but sounds like they would start to line up at some point.

A

The core Dena's issue looks a bit like a networking issue because it's maze. Basically, it cannot connect to the to the master and that's where it needs to connect to get its its service discovery from mm-hm.

A

However, was it the single node cluster single node cluster, because then the single node cluster shouldn't have networking issues in see it is self hosted. So it's work. The.

C

One thing that I saw is like it looks like qdm was used, but they're they're, using a service to reference it and instead of just using the the hosts, IP cuz, isn't like the API server and all that just being directly exposed on the host.

D

You, wouldn't you well know you should run core DNS our on host networking as well, so they try and DNS itself. If that's not self to host networking, then it would try and use the internal service at which point yeah. It's not gonna work. So if it's on host networking needs to use that well, I guess local host at that point and trying to look the API so him to get that list.

A

There should be a service IP, which is the first one, usually 10960, one that points to the host name or the host IP of off the API server. Why that is not working now today, area is not here, otherwise might help as a reef and networking get there using mm-hmm I think.

D

We just noticed I've just noticed that the port that the service is exposing and the one that coordinates is trying to get to aren't actually the same I think corniness is trying to go to port for for three bit of service and it does have port for for threatening my story. Pilot port is six war for free yeah, not sure I would avoid using the service if possible,.

A

Strap accordion s to to talk to the API server directly and not using the service. That's.

C

What I would do like that? As far as I know? That's generally their fault because, like I'm looking at my own QP D and provision cluster and there's no like graze, API server service.

B

With that I'll take a note also to just pass along the stack overflow question to the folks at we've. Okay, that's always useful, just a reminder to everybody. If you do put your question on Stack Overflow, it's really useful because we can continue to improve it and then pass it along to somebody, as opposed to asking to someone to fast forward 15 minutes into this video and trying to answer it. So we will send some we've folks that way as we can.

B

Okay any other comments on this one before we move on those of you on the live stream, keep on asking them, we're just adding them to the queue and getting through them as fast as we can all right, Simon asks question format during office hours. We are using ansible for most of the things we do. We've been seeing some issues and read more when it comes to the hell module for ansible. Do you see that much recommend it for production, or is it located? If we shouldn't use a module?

B

How do you recommend using helm with ansible Thanks.

E

So this is I'm gonna, be terrible at answering this because.

C

E

Don't use ansible so helm. The home community doesn't officially support this, it's more supported by the ansible community. So this is not a helm project or something like this, and so it's not something that I'm all that familiar with since I'm, not an ansible user, and they don't do this working to the documentation. It's listed over, there's community maintained and so I'm actually don't know what state it's in. Maybe somebody else here: can it maybe production-ready it may not I, actually don't have a good answer. I'm, sorry, yeah, like I, wonder you can't just.

B

Pay Red, Hat and they'll support a hell, module.

E

B

Maintained, or is it like part of a suite well.

E

What I think is they're talking about is ansible has a hell module, that's not home, that's part of the ansible community that can then use home, and you can tell you know using your normal ansible scripts. Here's where your, where your charts are, here's, what you want to install here's, what you're gonna do and then ansible then call helm to do that stuff, and it knows what to do and it's over there, and so it may work. It may be production ready, I'm, actually just not sure.

C

Darren's, actually time up in chat, pi helm seems to have problems with Python 2:7. We don't use it because of this. Okay, so.

A

No I, don't suppose directly use the Hound client in ansible, so just use the CLI and bind that into your interval, like you would without the CLI, maybe yeah.

C

A

C

Ansible itself has been going through a big rework to essentially migrate and support Python 3 dot, X I see several people typing furiously, so we'll give them a second. While.

B

You're typing and when we do get your question feel free to post a follow-up or just keep on typing. With clarifications in the chat, we will constantly monitor it, for you, Darren asked says: I have a pattern for using how many instable just getting it now thanks a lot Darren and that is Darren Gruber. Thank you all right.

B

Looks like Darren's posting in a whole bunch of good stuff. Let's give them some time to develop.

C

Just a quick thing: if you're going to be pasting like a lot of code, if you could like start a thread, doesn't like completely clogged up the chat, yeah.

B

That's a nice small one though you that's, really great good, lookin out Darren Darren I'm gonna. Send you a spare shirt just because let me write that down cuz! That's that's what I like to see I love to see people helping each other see. Look at that! Matt! Someone helped you out! You didn't even know the answer to the question. That's really awesome! Alright, thanks for that, Darren moving on Brian asks question: have you managed clusters and local single node clusters? Not one a three node cluster, primarily targeted at cube flow, slash active.

B

What does this suggest a path of least resistance, CentOS 7 VMs with master mm size, 8192, V, CPUs, 8, slaves, half of that configure with cube spray, a good path thanks for having office hours, I kind of have a strong opinion on this one, but I'll. Let everyone else go. First,.

D

Personally, I would have said you need less than that for the Masters, so I just change our production instances and we're running 2 V CPUs of 4 gig of men, so they and we're not just running the kubernetes stuff on there like, we have got some custom controllers and stuff running on there as well, and we've not had any problems with that sort of size.

A

Recommendation for below 10 nodes is 2 plus 4, think above 10, or to 10 to 15 or 10 to 20 would be 10. Booth, CPUs and 8 gigs of ram I wouldn't go with 2 small memory on the workers, because, but that depends basically on what you're running, not sure I've, never used tubes spray, that I kind of default to recommending cube ADM. Recently, yeah.

B

Cubes freaking Sookie Bannon these days, so I think it's too much for saying yes, good, pretty, but I mean if you like, the convenience, dad I I really enjoy I I wish I had the time to kind of document. This better and say: cluster lifecycle is the single node experience for cube admin. It's like really good, all right now and then like. If you want to add stuff another node, it's just a like one man to add it. You know, after you kind of setup the single mode thing, oh because.

A

I'm I would like.

C

B

Bin is still experimental Inc you spray do.

C

You want to talk about the cluster, API, quick and so the evolution of that I do.

B

Not have the technical background to talk about cluster API, okay,.

A

And I think it's a bit early, although I guess cube spray will be one of the first projects are supported there or is already on the way kind of is.

B

Antoine still doing cubes gray, the cubes rain. Let me laughs.

C

I believe so yeah.

B

I know up the upstream authors really great: that's.

A

For those not in the inner circle of.

C

A

Maybe cluster API that the goal of it would be kind of being able to to say cube, Cydia or cluster CTL 78 with the Yama's file as the configuration and just get a cluster yes kind of the goal behind that. But I guess we're still not really far on that. Yet and.

C

It's a lot of the works being spoken to like this specific vendors. To like there's the like vSphere provider, the OpenStack provider. I actually think Samsung was the one that was working on the like bare metal, SSH provider and.

A

There is there's different solutions that are moving towards cluster API, I, think s AP Gardner, and also us as transform, be moving our own api's, which are basically already that way to be more conformed. This cluster API yep.

B

And that kind of tells me a reminder to I'll. Take him note. We should really have Chris Nova on for one of these to kind of talk about that. Yeah Oh, big orange cluster. There.

A

Is a demo I think she she recorded a demo yeah.

B

And she's on the west coast on, let me see if I can try to snag her for today, today's West Coast presentation was.

C

There, a TGI K on it I think.

B

It was just a community demo, yeah.

C

A

Yeah she did it and in the work group in the cluster API workgroup, okay, that means I think I have a link to it on you, yeah.

B

Yeah whack that in the channel, when you do and then we'll move on so but CentOS 7 VMs, that seems to be work. Fine, like but ok, moving on Benji asks. Could you guys describe why Federation version 1 has been stopped and how Federation version 2 is different? Better ah Bob, your favorite, you.

C

Know I'm just going to grab a link, quick and drop it in here cuz. So you get a nice reference.

C

Ok, so so the Tildy are on. This is that the federation v1 sort of tried to like fake the standard, kubernetes api and then actually wound up having a lot of limitations and was really hard to maintain because they had to Revit, essentially with every release of kubernetes, and you had to go through all sorts of crazy stuff with ensuring you know all your.

C

Your sort of federated members are at the same version, and now, with Federation v2 they've gone to a CRT based system where you have sort of like federated deployment or federated config map, and in that you have a template which essentially is the deployment or you know, config, member or whatever, and they don't necessarily have to have that.

C

Template like completely adhered to everything, and you can now like add other sort of information to it like how you actually want wait, how it's being deployed to specific clusters, they've added a lot more information to it, and it just makes it a lot easier to sort of sustain going forward.

C

And also like enables see like by there's a lot of demand for like a pull based reconciler instead of push based, which is what Federation v1 uses so now, instead of having to like expose all the clusters necessity out to the Internet, you could have an agent running in the cluster that would think with the federated API server instead, and the server just enables the that sort of deployment method.

B

All right Benji, if that answers your question and you're on the screen, feel free to ask a follow-up, we're watching the chat there and then just some more feedback here on the cube admin with cubes for a bit. Simon would like to say in version 2.7 dot, zero, it's experimental, but the experimental tag seems to be removed from master, so some homework on our part. It has. It sounds like it's gone production. Remember that cube admin is also going GA, this cycle in a few days ish. So that might be that might be related.

B

So we should definitely lift that up. Alright. Moving on an end, sync Kunwar asks anyone know a way to get a secret in environment variables and a stateful set where each secret / key pair corresponds to one of the ordinal indices of that pod.

E

Yeah, this is a tough one here, I haven't done this, but the the only thing that I can come up with is, if you expose everything via the secret and then there's actually a method and I think this has landed too and I'm gonna paste a link into true slack here. That tells you how you can get a how you can get in an environment variable within your pod. The number for your stateful set.

E

You can get your index and if you use this and then you have all of the information available from the secret available, such as in another environment variable as an array, you can go. Look it up. Then, because you have the two pieces of information. That's the the bit that I haven't done this, but that's the way that I would probably start approaching it. Mm-Hmm.

A

Yeah that would definitely work if you have a security issue of like not not wanting to to have all the secrets shared between your parts, then you might need to write an actual controller for this, but usually you shouldn't have that kind of issue. I, don't think I mean they should be talking to each other anyway,.

A

B

It's crypto kind of has a follow up so before we move before we change gears. I want to there speaking of environments. Is there a reason why some pods in the same namespace, see other pod environments? Are those coming from secrets.

B

Then anon has a follow-up.

E

Wow, that's a good question: can use it a NIC container to create an environment. Variable I, don't know the answer, but I'm guessing it to know, because it is a separate container, brick, shell and so to actually inject. That is it's different. Somebody may know some trick around it, but I don't think you can.

C

The ones sort of way that I know about doing that sort of thing is to you essentially have like a shared empty der, and it then dumps it to a file and you sort of load it as like not less to the entry point, but you load it when the other one starts. Yeah.

E

So, instead of an environment, variable you're using volume shared to pass the information yeah.

B

Mm-Hmm, it looks like people are responding. The kate script, those questions I just I just want to repeat this for the stream here speaking of environments. Is there a reason why some pods in the same names we see other pod environments? Are these coming from secrets and roth roughy? Sorry I, don't know how to pronounce. It says it's Auto generated by the cubelet. It's these neighboring service in the namespace, it's not their secrets or environment or see and I see nods from the panel ish. So thanks very you're.

A

Actually seeing environment variables that shouldn't be seen there I would file a buck, because that sounds pretty much talked about to me. Enders.

B

There's a link to the discovering services documentation there that he has plot. Thank you for that information always appreciated. Alright I see people typing some away from the follow up. We'll move on to the next one.

B

Jim angel asks welcome again: Jim, hey Matt, looking for an elevator pitch and what's coming in home, 3 ETA, any major roadblocks. How can we help.

E

So, what's coming in home, 3 the quick pitch here killer is going away, and so those of you who had to do things like multiple tillers and stuff, like that, all of that's gone, the home client, is able to handle everything. In fact, that's already there we have, let's see, charts, we'll, have a whole bunch of additions and changes to them. For example, you can have a library chart to share bits and reuse them, we're gonna have Lua in there.

E

It looks like, and the choice of Lua actually has to do when you get into security and embedding it and cross-platform and the ability to easily do that. It's the popular language that pops out for those things, and so we're looking at embedding Lua into this, and so you could have Lua in your church that do extensions, because we do have people who want to do quite crazy things. It may surprise some people, but you can uh-oh OpenStack into kubernetes with helm and there's crazy things in there for that.

E

So that's one of the big things we are focused on cross-platform because we do have a bunch of different platforms.

E

We're gonna be updating to use things such as CR, DS and secrets for helm, storing its own information, one of the neat things that we could probably use some help with is. We would like to do something like JSON schema ties, the values file and the possible things in there. That'll allow auto-generating forms for you know you eyes, that'll, allow validating stuff and the go ability to do that with JSON schema looks like it might be immature. So that's one of the risks I would say.

E

Is that particular one, because it's just that space endo of working with some of these things it looks like it could use some work, we're still poking around at it, but that's something we haven't done yet doc, but I'll share into chat here a couple of things there and on helm. We do have a project where we are keeping track of v3 and what's going on here, I'll drop that in yep.

B

And while he's pacing in links feel free, I see people typing in the chat feel free to just ask your helm. What's coming in home three questions now before we move on since we have map here, yeah.

E

Can you can see what has happened? Some things may change here. One of the conversations that has recently started is whether, instead of going to something like a repos v2 index, which was there for performance, do we migrate to is our way to use container repositories to store charts, and there are some folks now talking about. Is that a possibility that we could layer in and so that one is at risk just because we've become overcome by a different solution?

E

We're gonna have things like pushing login for server, so we can support more stuff there, but you can see what's what's up and what's being worked on, some of you may have seen the azure go lua project that hit hacker news and some of these other things in the last week that was actually released very early specifically to start embedding lua into health.

E

So that's some of the stuff, but you can poke over here and see. What's going on and what's been done in the project, yeah.

B

That's awesome. This seems like rewrite, probably the wrong word, but it seems like this is a very significant you.

E

Know helm, we take semantic versioning very seriously, because we know that people operate production workloads with it. We've got.

A

E

On downloads and stuff, just from stable charts in there mind-blowing right, like in a month over 40,000 unique IPS, will just pull from stable mm-hmm. That's that's a big number and that doesn't, you know, include all of the private stuff people, and so we take stability and api's really seriously so helm. 3 is an opportunity to update to a bunch of kubernetes things that have happened and, at the same time, it's an opportunity to say: we've learned a lot of lessons.

E

We've interviewed people, we've learned problems, we've seen things that when helm 2 is being created, they thought would be a good idea, like helm, serve and being able to serve an HTTP chart from your local system. If you have to find a person, who's ever really use this right.

A

E

And so we've learned a lot along the way, and this lets us finally break the API to make improvements. Now for most people, your helm, charts will still continue to work so you'll be able to bring forward your existing charts for I would say. 99% of people will have that unless.

A

E

Some of the really crazy features that you don't ever see anybody even using it up anywhere, so we do want to bring folks forward, but this is an opportunity to break things. Yeah.

B

And just just a quick follow up question there for people using the two days you know. Having that read all the links you said is: is there a support path going forward, for that is that what was the transition? Look like give me like that to sentence to go.

E

From helm to helm, 3 yeah I, don't know yeah for.

C

E

You can get rid of tiller and you can do install home, but beyond that we we haven't really figured that out. We want the charts for almost everybody to be able to continue to move forward. That's a big, strong thing anymore. You know the old repose just to be able to pull from and deploy things as far as migration path, and that kind of thing we haven't worked that out. Yet ok.

B

And we do have a follow up here. I'm just gonna, ask Darren's quick question here. While we're talking about home, we use chart museum for hosting our homes. Is there any way to force overwrite of a chart with the same version? We use the push plugin for Helmand I'm, not sure that this functionality exists. I.

E

Don't know the answer to this: one I haven't done that we tend to go for just like with our container originally like immutable, charts, mm-hm, and so that way, every version you know it's different and then you can trace it from environment to environment. So we don't tend to do that because we want that immutability and, if you're pushing same version up with different content, and it's not immutable, you're mutating it, and now you may not know what version of what thing you had running in different environments.

E

So, as a general rule, we recommend you not do that. I.

B

E

Tried this, which art museum so I, don't know yeah.

B

Dear NASA's, bad paths, test overwrite, totally agreed, there's, probably a situation there keep on typing there. Maybe maybe we can help out or or link you up with a chart museum person. Okay, keep on asking the questions in chat everybody. Those of you tuning in this is the kubernetes office hours join us at the little address below and ask your question about kubernetes, and then we will get to it moving on through the queue that variable yes, Simon.

B

Second question asked: question: can I use SEO as network policy between pods I want to limit what services a pod can access I'm able to do to do it using service entry for egress traffic, but not sure about inter pod communication.

A

You can do it for inter pot, but it won't be network policy on the layer. Three and four it will be on layer, seven or five to seven I would say somewhere, so it should be, should be used if back together with network policy and I know that people like Tai Guerra from kellyco, they've kind of advocated for using both together and I, think there's even some designs for application level policies that would kind of be a single level of policy that you define.

A

That then gets implemented by both the CNI and SEO and especially if you have a CNI like cilium that goes from level 3 to 7 and might even support Kafka policies. So who implements the policy and who defines like where you define it, are a bit complicated and not not always kind of very clear to to define in your setup, mm-hmm.

C

A

We're just running a steal: without network policies you you will be still able to to reach the pots for Network. If you, if you go around the mpls oficio yeah,.

B

And Rafi says most well, you see an Isaac, you broader and we've has full network policy support.

B

Thank you and then, let's see, oh I, actually miss a question for Darren, so I'm gonna get to that one. Next, any other comments on this network policy. Thanks for the paint, Darren and Matt's, also answering Darren's question of why why he needed a to redeploy the same version? That's recommending that you could just deploy your chart from the local file system if you're doing development so that you can just write quickly, all right, real quick. We have. We have a quick survey.

B

Question Darren wants to know what are some of the must-haves applications you have to use to help manage slash, interact with your clusters. Just to give you example: he likes stern for tailing logs for multiple containers and telepresence dot. Io for joining kubernetes network to your local machine seems, like everybody loves, telepresence I haven't had anybody complain, but it's like one of those things where everyone's like this is really great. So that's good any of any other tips. Questions I! Do we have a thread on this um Bob thought.

A

We had one yeah, it's like the tools, I mean there's some command-line tools like cube c TX q.

C

A

One cube and s22 like switch around network contacts.

C

That's a lifesaver for me.

C

Keep CTX uh okay, cuz, like I have like 20 clusters, or you know, 20 context, so just being able to quickly quickly switch between them, especially when you start working in a federation. When you have also of clusters that you're working with yeah.

B

Let's, let's do this um Bob after we move on from the next kubernetes question. I know we started a cube, cuddle tips and tricks thread.

A

I'll get the get back some stuff.

B

It would be great to have like associated cool tools that you can put on top of your cluster and try to get that from that, so we actually have on the forums. There's this great thread on cue, cuddle tips and tricks. We should definitely have one for tools like telepresence stern I do want to mention before we move on to the next Federation question that someone mentioned.

B

Polar ooh mentioned I work at booking.com on the topic of Federation they've got a tool called shipper, which I thought looked pretty cool, so we should definitely check that out yeah if.

E

You're listening I'd love.

B

To have I'd love to see this at the community demo I think yeah.

E

We had a demo at sig apps, a while.

A

E

I'd say: oh, it's! It's continued development, ok, yeah.

B

E

Did a while ago this would be a good one to have at the community yeah.

B

Polari ping me pay me and slack off, just the MB and then we'll get you scheduled sometime in January to do a demo. If you want for the community meeting, I think that'd be cool awesome. One of the tools that I like here by.

E

The way is draft from the Microsoft folks, and the thing that I like about it in particular, is uh work using it with a debugger right, because there are times where I'm running stuff locally, that ok, it works and then I stick it in a container and I. Stick it in a cluster and I use a Mac right. So.

A

E

Os different environment in being able to actually debug inside of kubernetes, that's kind of a neat thing and I know: there's a couple other tools that let you do something similar, but that's the one that comes to mind right now. If you needed a bugger for code.

B

E

You can actually step through the code awesome.

B

And those of you listening, if you have great quiet, great tools like this just start whacking them in will create that disgust thread and then.

A

B

A

Something a bit more simple than telepresence I think you FWD so tube forward, which basically forwards all services of a single name space to your localhost. You can just combine your local with that, and then boy just broke on your machine against that cluster.

B

Okay, kids Kripke asks, what's it called, can you repeat the debugger, so you were talking about draft which comes from the Microsoft folks? Is that come with the debugger? Is that a separate thing you.

E

Mean it comes with it at least last version that I have it's built into it, and.

A

And they actually.

E

Walk through, let's see here.

B

It is, has your slash draft like I got you yeah and.

E

It's part of it: it's actually a tool, it'll work with your helm, charge things like that, but it's designed to help you get moving on this stuff. That.

D

Is good to know also.

A

Vs code and today yes,.

C

Another handy tool that I actually start using recently a cube score, which sort of does Co analysis of your like object, definitions, make sure you're not using latest and sort of enforces, like other, well give you suggestions for other best.

B

Practices yep hue score, alright, you've.

A

Run that for four customers to give them like a first impression of what they should do. Yeah.

C

It's it's what we usually get like the people that have just started getting to like use, kubernetes and start writing stuff for they're going from docker to it's just like here. This is this sort of helps. Helps you over that a little bit of hump to start using best practices, yeah.

B

Yeah all right, so what we'll do is we'll move on to the next Federation question, because I want you to answer that one Bob and then I want to make sure we grab all these tools and start sticking sticking them in a thread because I don't even know about cubes score. That's why we do these. We can all learn something all right. Those of you listening, keep on sticking cool tools and stuff into thread and we'll just or in the in the chat we'll keep on mentioning them.

B

Okay, moving on Bengie asks follow-up about the federation version. Two question installed a federation with cube fed to, but unlike v1, there's no context for the Federation itself. Will this be implemented in the future? No.

C

There really isn't a plan for that, and it's really the namespace and the stuff that, where you deploy your you know the CRTs for everything all your work, at least in the current version of it, is going to be in that sort of you know not necessary game space but specific cluster, and then it will. You can sort define how things get propagated up from there when things as far as like the pull based reconcile and some of that stuff will just be. However, you know other people want to implement it.

B

All right, Benji I, hope that answers your question feel free to keep on typing. We have two questions in the queue, so we probably have room for two more questions keep on asking them. If not, usually people stick around after the show and answer them and of course we have a session in about six hours from now. So, if we don't get to you, we will definitely try to get to you. This afternoon, mark would like to ask question I'm, really wondering what the best course of action is to orchestrate global kubernetes clusters.

B

We have a goal of presence and managing cluster by cluster seems fine for a few clusters, but not for twenty-plus global clusters. Any ideas with global presence. We need multiple, isolated clusters in several AWS regions. This is the question. Isn't it say.

A

That that's exactly why people are going towards cluster API and similar tools. I mean there is a few tools out there that can manage more clusters. Think gardener Rancher transform all kinds of different tools. However, something upstream will hopefully be emerging this cluster API. Until then, basically, you need to write your own. If you don't want to go over any of the projects out there, you know open source or paid.

B

Matt Zoller Bob any opinions on this. We.

E

This is a space that I think is still open for a mature product and I think the kubernetes project to try to get there's a cluster API and it's I'm, not sure of its state I think it's still very alpha software.

E

It is not what at least in kubernetes what we would call beta, which is where many of us run beta as production. I. Don't know that it's ready for that yet, but it's probably the most likely thing to get there soon, but there are yeah like somebody's a rancher. There are a couple of things that are trying to do this now and.

A

I guess the chrome experience I can just recommend be very hard with your versioning version. Everything try to really like stick to two configurations and keep them in gates or somewhere. Stick to immutability. Don't do anything manual on your clusters. Keep it everything immutable reapply, don't don't kind of run scripting around just just be very strict in that sense, so you don't diverge from from your configurations in clusters and you don't get to pet clusters, but you have basically cattle clusters that you.

B

A

B

All right any other comments on this. Okay. Moving on to Edward T actually skip your question. Sorry about that. But thanks for letting me know Asshai what is your internet traffic into a bare-metal cluster, currently using keepalive d virtual IP, pointing to an ingress, Controller node point service? Is there a better way to do this?.

C

First I would opt for metal lb, it's sort of a better version of the keepalive d like load, balancer service, a service type load balancing provider, but in general you sort of have it right. The way we've done this in a couple ways is: we might have a set of ingress nodes and they sort of bridge between the like internal cluster and sort of the internet and I know a couple.

C

Others have actually like just put all our nodes sort of on the on the Internet and will like have it all be running all like on all the notes specifically or on all the nodes. Sorry.

A

C

Do have to be careful at your final rules and things like that with that, though, okay.

B

All right moving on because now we are talking Edward I, hope that answers your question feel free to follow up. Simon asks question: how are you handling ID tokens with token equals we're using PowerShell, where it's extracts a token manually, I'm, not gonna, read that, but I will do you guys see the question on the chat scroll up? Oh yeah,.

D

I've already replied to that one. It's a quick summary that yeah, so it looks like ad FS supports open, ID connect. So what I would suggest you? You should do like if you've got an open, ID connect set up already for your idea. First, there are tools out there that he's already using iidc great we've got an example of our authentication using IDC that basically configures cube conflict for you.

D

So if you've got an IDC setup and you're happy to use refreshing once you've got that set up in your cube, config it'll actually just continuously refresh, and you don't need to log in every time. So yeah check out the example. Okay, it's off example thing that I linked that might help you out exactly.

A

If your ad FS is new enough to support IDC, you should go with the Refresh token route.

A

Otherwise, if you have an azure ad sync set up for the ad FS, you could also use the azure auth provider in cube CTL, that is using device sauce measure which is even easier to set up, because it gives you a URL. You go to your all, to your device setup and then works talked a bit about how your idea fess is set up. Internally, we had issues where ad FS would only work on Windows browsers. For example, there is some some configuration stuff but gets your support.

A

Staff at myself can help you out there and.

B

Then Simon Says, our thanks. That's awesome! Thank you. If you have follow up and then joel is posted in a link to an article about your CL, is a so it pusher Joel. Can you actually post that in the main channel as well, not just a thread? That would be great. Thank you. Alright. Any other comments on this one sweetie. Thanks for your questions, Simon appreciate you participating. Snow Crash would like to ask I've been struggling with this problem.

B

It's a pod warning, failing scheduling default and then the link to a stack overflow question which we will pop into the chat. You guys read. These I had a this one. I had a time or do we need a second.

C

Gonna need a sec. Oh yeah,.

B

Actually, I've posted it twice. Snow Crash just give us a second here to digest this whew good amount of questions running out of time. This is great. I appreciate everyone participating. This is a lot of fun, looks like.

A

The cluster setup is quite booked, the couplet cannot authenticate to the to the Masters, so you basically have no notes at all mm-hmm.

A

And there is no CNI defined, so you, you have actually two problems. You have one problem where authentication or TLS between components is not working and another where you have no CNI setup in your cluster.

A

There is some terraform code, it's a very custom setup. It seems you.

C

Haven't looked at that stuff at all.

A

B

Yeah this one looks very closer I.

A

Think it ck it's an e KS set up. So maybe you yeah knows more. He writes eks CTL is basically a command-line tool that automates creation of eks clusters, so maybe beeping him and he can help.

B

Yeah, hey Bob. We had two questions. We had. We had a question on cops on one on Cates Lego. That I think I cut out was that you or me that was me: those are from Cooper days users I, don't.

C

Know: okay, okay,.

B

All right, no worries we'll continue with the live questions for people that are here, then all right, so it looks like this is. This is more of a problem. This is a more serious problem than with the initial error says.

B

So I don't know if we can help on this one. Let's, um let's finish up and then we can get back to this one maybe follow up on chat, see if we can link Snow Crash up with the right folks. Sorry, sorry about that, so guys this one looks pretty hairy.

B

But let's move on and then we just saw yeah I'll.

D

Just go just found in the dark some stuff about the authentication that it looks like shows you how to get the nodes. Authorize soldiers pay something for that, and that would that would.

B

Be great, thank you. Alright, nice fern asks, and we got time for maybe one or two more questions. If you, if you want to ask queue them up in the in the chat that we as for asks first, do you think that there's an issue in having replicas defined in the yeah mo use cases that we've seen is that we do redeploys by using the whole file?

B

This might be wrong or bad and in all replicas changes that are occurred will they'll be reset it to the default in the file if a replica set is defined. If yes or no, please explain how you would do it.

A

If you're, not using HPA, which is a horizontal path, autoscaler, then it's totally okay to and if you should actually, in my opinion, set replicas in the file, because you do it shouldn't do changes by just running cube cereal scale or something you should always do something immutable, keep it and get keep it in me, llamo and then apply to the cluster.

A

That is, if you're, not auto-scaling. If you auto scale, you should have the auto scaling, configuration and yama and reapply that and you change it. Yeah.

E

I think the big thing here is to don't do something that doesn't have a record and traceability to it. So if you had to you know if something broke and you had to come back to it, you know you want to have backups. You want to have this recorded somewhere and that's one of the things I can come up with like coupe control scale is oh I scaled it now. Somebody who works somewhere else in the org or somewhere else doesn't know that you scaled it. What happens?

E

There's no traceable record to this, and so it's a good idea to keep track of everything.

A

Yeah, you might be fighting against each other. We had that bits clusters, sometimes like someone in the organization, click scaled, a cluster and then the next morning, someone scaled it down again because they didn't know they thought it's a mistake and then fight so cure. That's.

B

Darrin has a follow-up to this question in relation to the immutability and scaling. If you were to use the node autoscaler, how do you reflect that in the git repo.

C

Usually your auto scaling stuff won't necessarily be reflected in the you know, get you put directly and you do set the step for like the horizontal patas autoscaler and some the other stuff. But as far as like the total replicas that won't necessarily be in there and.

A

For the node or a scaler like the cluster autoscaler is thinking I mean you would still have some configuration that you're keeping it. So you you don't have the the current number, but you have the desired range range.

B

E

So if you had to rebuild it, your your scaling configure, auto scaling config would be the same, and so it could then, in that environment scale to the right number mm-hmm.

C

B

And I see people typing so we'll give them a second for follow-up. Let me just check here: I got some examples from Snow Crash that he's pasting in that looks like Jill's doing with that and then Darren's replying great. Thank you. This answers. My question no worries Darren with that we're gonna wrap it up. Real quick we're gonna have another session in six hours. Sorry, those of you I accidentally skipped some questions. Normally we have.

B

We have Jeff doing the questions so Bob and I are confused and pacing over each other, but that's okay, we'll get over it with that. Thank you very much for joining us.

B

Let's just do a quick outro thanks to the following companies for the supporting the community wood developer Balin panel here, supported by giant swarm hefty o stock X packet net pusher com, Red, Hat, Samsung SDS, we've works, VMware, Xing Huawei and the University of Michigan good luck this weekend, special thanks to Google for sponsoring the t-shirt giveaway so give me that give me are, we all set for the I totally forgot about the t-shirt raffle. Oh.

C

I have not been managing that yep. Sorry I, give us a second and we'll do the B t-shirt raffle, so the number Bob is gonna be one yeah. This might take a minute because we got some repeat yeah.

B

Give it give us a second stick. Stand by. You can only win the shirt if you're listening, so you can't just bail on us and with this shirt with that, um we do certainly have some follow-up stuff that we will be posting another channel and we'll be posting the links and stuff into the discussed thread. We will what was it gonna say?

B

Oh, we will definitely start that new thread that I wanted on cool cool tools that people are using on their clusters because I feel like we could probably go on all day with a bunch of stuff. Once we get enough people into the room, we are waiting for the raffle here. Sorry about that we are totally unprepared I. Should this.

C

Might take a little bit longer right, we could follow up in slack if we have to to go out. Okay, all.

B

Right, let's do that so hang out and slack everybody, and we will just announce the winner in slack here in a few minutes it won't be longer than five minutes and then you will win your shirt thanks everybody for participating, as always third Wednesday of every month. Please pay it forward if this has been useful for you, please let us know and thank you everybody anything else. On the panel you guys final thoughts.

B

And I guess not all right thanks! Everybody was probably not next month right because that's going to be right, smack in the middle of holidays, I'll make sure that that is clear through all of our our communications channels and we'll see everybody in January. Thank you.