►
From YouTube: Kubernetes Office Hours (West Coast Edition) 20180815
Description
This is our weekly community meeting, for more information check this page: https://github.com/kubernetes/community/blob/master/events/office-hours.md
Links from the episode:
https://kubernetes.io/docs/concepts/storage/persistent-volumes/#access-modes
https://kubernetes.io/docs/reference/setup-tools/kubeadm/kubeadm-init/
https://kubernetes.io/docs/tasks/configure-pod-container/configure-pod-initialization/#creating-a-pod-that-has-an-init-container
https://github.com/gmaliar/vault-k8s-dynamic-secrets/blob/995842ec6d4ac11561743c87f3e980ee21cb1000/k8s/app-deployment.yml
https://kubernetespodcast.com/episode/015-istio/
https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/#encrypting-your-data
http://brandon.dimcheff.com/2018/02/rainbow-deploys-with-kubernetes/
A
Alright,
everybody,
let's
get
started.
This
is
the
kubernetes
office
hours
third
Wednesday
of
every
month.
This
is
our
live
stream,
where
we
take
your
live
questions
from
slack
and
from
wherever
and
we
answer
them
live
on
the
air
with
our
panel
of
experts
with
you
should
see
above
here
on
the
video
so
before
we.
B
Start
experts
please
introduce
yourselves
hi.
My
name
is
Bob
Cohen.
I
with
advanced
research,
computing
and
Technology
Services
here
at
the
University
of
Michigan.
Sort
of
my
area
of
expertise
is
crew
days
on
bare
metal
and
all
the
crazy
stuff
that
comes
with
it
different
networking
and
all
that
other
fun
stuff,
along
with
crew,
Bay's
Federation.
E
F
A
And
I'm
Jorge
Castro
I
work
at
FTO
as
a
community
manager
and
I'll,
be
your
host
today,
basically
reading
all
your
questions
so
before
we
start
some
quick
ground
rules
for
everybody
for
those
of
you
who
are
joining
us
for
the
first
time.
Thank
you.
You
can
subscribe
and
we
do
these
every
one's
the
third
Wednesday
of
every
month
and
someone
will
toss
the
URL.
A
Actually,
the
URL,
with
everything
you
need
to
know
to
participate
in
this
show
is
always
in
the
topic
in
office
hours
and
into
kubernetes
users
on
slack,
so
the
ground
rules
judgment
free
zone.
If
somebody
asks
a
question
that
you
feel
is
like
easier,
whatever
we
all
net
stuff
somewhere.
So
let's
make
sure
that
we're
have
a
supportive
environment
for
new
users
and
remember
that
the
code
of
conduct
is
always
an
effect.
Well,
we
will
do
our
best
to
answer
your
questions.
A
We
also
don't
have
SSH
access
to
your
cluster,
nor
your
network
team
or
things
like
that.
So
there's
only
so
much.
We
could
do
with
that.
So,
if
you're,
having
like
a
really
specific
problem,
usually
we'll
try
to
help
by
trying
to
point
you
in
at
least
the
right
direction
or
where
to
look
to
get
the
help
that
you
need
panelists
you're
encouraged
to
expand
on
your
answers,
based
on
your
experience
and
your
pro
tips.
A
So
if
someone
says
where
do
I
find
the
logs
to
the
node
yeah
they're
located
here,
but
you
know,
add
some
tippet
or
something
like
that,
or
some
kind
of
insight
on
logging,
for
example.
So
we
could
usually
do
that
and
the
audience
helps
us
out
by
piecing
in
URLs
to
kubernetes,
documentation,
blog
post,
any
tips
or
tricks
that
you
see
on
the
Internet
feel
free
to
plop
in
the
hash
office
hours
suck
channel.
A
At
the
end,
we
take
all
these
cool
URLs
that
we
have
and
publish
them
in
the
show
notes,
so
that
people
have
them
for
reference
when
they're
watching
the
videos.
So
if,
at
any
time
you
feel
you
can
help
someone
and
you're
just
hanging
out
in
the
in
the
slack
channel
feel
free
to
just
start
dropping
your
ELLs
in
there
and
you
can
just
post
your
questions
in
the
Select
channel
if
we
get
to
them.
A
If
you
start
reading
questions-
and
it
looks
like
we
skipped
yours
feel,
free
to
repeat
it
usually
question
in
all
caps.
:
is
an
easier
way
for
me
to
find
it,
but
we,
generally
speaking,
we
take
all
the
questions
that
are
posted
in
the
channel
between
our
last
session
in
this
session
and
try
to
read
through
them
all.
So,
if
I
don't
get
to
you,
I
apologize
so
just
be
loud
and
squeaky
on
slack
and
we
will
get.
A
We
will
get
to
you
as
we
have
and
if
we
do
read,
live
on
the
air
and
address
it.
You'll
automatically
be
entered
in
the
kubernetes
t-shirt,
drawing
in
which
we
never
actually
wear
the
t-shirt
that
you
could
win,
but
these
are
official
kubernetes
t-shirts
and
put
images
of
them
in
the
slack
channel
there.
A
So
what
happens
is
at
the
end
we'll
toss
all
your
names
in
the
little
script
to
get
a
reign
of
winner
and
then
I
will
PM
you
after
this,
if
you've
won
and
then
I'll
get
you
the
t-shirt
code
that
you
need
for
the
CNCs
door,
but
you've
got
to
stick
by
to
the
end
to
win,
see,
that's
how
we
that's,
how
we
get
you
to
remain
sticky.
So
with
that,
are
we
ready
to
begin
panelist?
You
ready,
can
save.
D
A
Audience
you
can
help
us
out
by
posting
your
questions
in
the
Select
channel.
We
have
a
few
queued
up
already.
If
someone
in
has
office
hours
sees
people
struggling
in
kubernetes
users
by
all
means
bring
them
on
over
toss,
the
link
to
them,
so
they
can
listen
along
and
then
we
will
get
started.
So
this
first
one
here,
I'm
just
gonna,
look
at
the
notes
and
read
them
Gillan.
Is
that
we're
going
with
first
Ellen's
question?
A
Everyone
see
yeah
yeah,
let's
go
for
okay
question
in
a
to
continue
image
on
one
container
without
restarting
the
other
I
previously
manually,
reboot
on
one
container,
and
it
pulled
the
latest,
but
apparently
latest
is
frowned
upon.
Yes,
as
well
as
manual
reboots
I,
don't
want
to
read
with
the
other
container,
because
it
does
a
lot
of
API
calls
on
boot
and
keep
Kyle
apply.
Would
do
that?
A
D
Can
start
yeah,
usually
if
something
is,
if
you
have
a
multi
container
pod
with
different
times
that
they
would
be
updated
it
should
it's
going
to
be
easier
in
the
long
run,
to
separate
out
those
dependencies.
So
if
you
restart
an
application
and
an
application
dependency
at
the
same
time
for
a
new
version
of
that
application,
those
should
be
multi
container.
If
you
have
something
that
that
makes
it
so
that
they
have
different
times
that
you
do
restart
them,
it's
a
lot
easier
to
just
separate
them
out.
A
D
A
C
Yeah,
it
sounds
like
he
kind
of
lumped
them
together.
Maybe
instead
of
you
know
thinking
what
the
value
is
that
was
provided
out
of
that
pod.
You
belonged
them
together,
based
on
they
had
this
similar
function
and
that
my
question
is
like:
do
they
talk
to
each
other?
Do
they
depend
on
each
other?
What's
kind
of
the
relationship
between
these
two
things
and
I?
Think
there's
more
discussion
on
this?
No
George
has
something
to
say
on
it.
You
know,
but
like
how
do
we
think
what
a
pod
should
be
and
will
containers
exist?
C
Well,
the
containers
that
exist.
What
could
work
to
provide
the
application
that
provides
whatever
value
did
that
prove
upon
providing
whether
it's
some
web
application
or
some
database
or
whatever
it
is
right?
So
multiple
containers
might
be
need
to
provide
that
value,
and
it
could
be
some
web
app.
It
has
something
that's
checking
for
like
that
runs
backups
for
it
every
night
or
something
but
but
runs
alongside
it,
and
then
it
may
be
an
annex
contain
it
as
well.
C
A
B
It
really
depends
on
what
you're
persistent
volume
actually
supports.
There's
three
different
modes:
read-only
readwrite
and
let's
see
rewrite
once
and
rewrite
many
rewrite
once
usually
means
one
can
own
it
and
multiple
things
can
read
it.
It's
actually
a
possible
support
like
multiple
types.
At
the
same
time,
so
you
could
have
it
something
mount
mounted
as
read-only
and
other
mounted
is
read
right,
there's
a
whole
slew
of
different
things
you
can
do
with
in
that
space.
A
Okay
and
then
I
did
want
to
say
something
where
I
had
a
tip
from
a
co-worker
that
I
asked
where
the
line
was,
and
he
was
like.
Do
the
two
things
have
the
same
lifecycle,
then?
If,
yes,
you
know
there
they
can
be
in
the
same
pod,
if
not
split
them
out.
Can
we
talk
about
this
a
little
bit,
because
we
know
that
the
pod
is
the
smallest
unit
in
kubernetes
right,
so
can
one
of
you
kind
of
give
me
the
lay
of
the
land
as
far
as
that
goes.
C
Yeah
so
I
mean
just
kind
of
bit
going
on
what
I
said,
like
the
pot
is
the
smallest
unit
of
understanding
so
like
that
pod
has
to
provide
the
value
of
what
your
application
is
right,
and
so
you
know,
when
you
create
a
deployment.
Let's
say
you
create
your
the
effectively
your
application,
the
value
of
that
provides
whatever
that
is
supposed
to
be,
and
so
generally
that's
one
pot
with
one
or
more
containers,
and
so
that's
why
that's
that's
kind
of
a
a
a
don't
before
the
service
right.
C
What
are
all
the
things
that
that
service
needs
to
run
and
they
should
be
in
and
I
think
the
life
cycle
is
a
key
word
here,
because
you
know
what
is
life
life
cycle
mean
if
the
application
isn't
running,
then
it's
backups
are
irrelevant
right,
so
maybe
it's
backups
run.
You
know,
they'll
continue
to
manage.
Backups
would
run
in
that
same
container
right.
C
A
And
Dylan
ants
yeah,
one
of
them
really
only
one
right,
so
they
should
work
to
split
up
a
pod.
So
it
sounds
like
you
got
a
twofer
there.
You
got
a
best
practice
and
that
should
automatically
solve
your
previous
previous
problem.
So
thanks
Dylan
for
the
question
feel
free
to
stick
around
ask
follow-ups
if
you
have
any
other.
A
If
anybody
has
any
other
broken
stuff,
feel
free
to
start
queuing
up
your
questions
or
anything
that
we
could
clear
up
for
you
moving
on
our
Phillip
83s
hi
I'm,
fairly
new
to
kubernetes,
so
part
of
my
new
question
no
worries
is
there
a
way
to
run
multiple
containers
in
a
daemon
set?
If
not
I,
understand
I
can
run
multiple
containers
in
a
pod.
Well,
how
do
I
specify
that
the
pod
has
to
run
on
every
node
daemons
that
encapsulates
that
and
does
auto
scaling
and
spins
the
pods
in
the
cluster
scales,
etc,
etc?
B
A
F
A
B
I
guess
it
really
just
depends
on
your
application.
If
you
can
really,
you
know,
take
advantage
of
the
features
in
there
know,
there's
a
lot
of
stuff
that
you
can
do
with
rate
limiting
and
circuit
breaking.
But
if
you
like,
if
you
and
your
application
architecture
aren't
really
using
those
yet
I
would
say
there
isn't
really
a
good
reason
to
and
look
at
them
at
least
at
the
moment.
It's
it's
definitely
a
worthwhile
venture
like
long
term.
A
D
A
A
All
right
so
yeah,
if
you
have
any
follow-up
questions
to
that,
please
let
us
know
Joel
Davis
asks.
Is
there
any
sort
of
online
reference
for
implementing
particular
services
in
kubernetes?
Just
as
an
example,
I
can
set
up
a
Galera
cluster
host
on
time
kubernetes,
but
I'd
like
to
see
what
the
right
way
is
to
do.
It
might
be.
I
realize
little
vary
depending
on
what
they're
trying
to
do,
but
I'm
just
looking
for
something
to
look
to
base
my
stuff
on.
C
Is
this?
Is
this
a
helmet
arts,
possibly
Sonia's
problem?
Maybe
III,
don't
know
exactly
what
he
wants.
I
mean
for
me
when
I
look
at
I
wanted
to
play
gitlab
right,
a
BCS
system
that
can
do
18
other
things
by
now:
Auto
DevOps
and
its
own
container
industry.
It's
a
dense
system
right
like
it
has
its
own
storage.
It
has
a
database
and
all
these
think
I'm.
C
The
other
way
that
you
can
also
is-
and
this
is
a
little
bit
more-
not
sketchy
but
a
little
lower
level
as
the
doctor
hub,
depending
on
the
application.
It's
guaranteed
to
have
I
mean
I've,
run
like
traceroute
a
container
for
traceroute
before,
like
just
that,
one
utility
that
exists
on
the
doctor
hub,
but
but
other
utilities
as
well
exist
there,
and
you
can
kind
of
look
at
how
they're
structured
by
just
looking
at
their
doctor
pile.
C
A
Follow-Up
question
for
you
there
that
you
just
reminded
me
Mario
so,
let's
say
you're
basing
let's
say
you
do
find
a
Galera
chart
and
you
base
off
of
it.
How
do
you
then
maintain
your
version
with
the
changes,
because
obviously,
the
upstream
helm
charts
gonna
get
fixes
and
updates
and
stuff?
But
then
you
probably
have
your
own
stuff,
that's
local
to
you
that
only
you
care
about.
How
do
you
handle
that
kind
of
yeah.
C
But
I
know
it's
a
point
in
time.
Right,
I
know:
I've
cloned
it
I
know
it's
not
going
to
change.
Changes
upstream
are
a
little
hairy
in
the
home
world
because
when
a
new
version
comes
out,
it
requires
new
templating
and
then
new
templating
could
not
really
work
for
an
older
version
of
the
application
that
you're
running,
so
you
either
have
to
move
with
them
or
move
at
your
own
pace
and
almost
every
one's
going
to
need
to
move
at
their
own
pace.
So
there's
gonna
be
breakage,
and
so
this
is.
C
C
A
Okay,
Joe,
let
us
know
if
that
answers
your
question
and
feel
free
to
post
a
follow-up
thanks
for
showing
up.
Next
we
have
T
Becker
asks
I,
have
a
small
kubernetes,
1.7.5
cluster
running
on
bare
metal
set
up
by
cube
admin.
My
search,
expired
I
have
been
meaning
to
migrate
the
workload
to
a
first
cluster
anyway.
How
easy
is
it
to
the
freshest
shirts
should
I
just
move
of
my
upgrade
window.
This
is
a
great
question.
I
look.
A
D
C
B
A
D
A
Does
does
modern
to
admin
handle
certificate
expiration
a
lot
more
gracefully
than
this
right?
Basically,
it's
like
okay
it'll
suck
this
first
line,
but
from
then
on
I'll
have
a
new
enough
cube
admin
that,
when
this
happens
again,
I'm
not
stuck
in
this
position,
plus
one
is
what
I'm
guessing
but
I.
Don't
I
don't
know
offhand
how
cube
admin
is
doing
cert.
A
If
your
1.7.5
that's
kind
of
that's
kind
of
hairy
yeah,
that's
that
seems
like
auntie
Becker.
If
you
have
any
feedback
for
the
cube
admin
team,
they
are
pretty
responsive.
So
I
definitely
would
like
to
hear
how
how
this
kind
of
works
out
for
you
after
that
refreshing.
The
search
I
think
in
modern
cube,
I've
been
that
should
be
something
we
follow
up
on.
Sometimes
you
do
have
a
cube
a
min
person
on,
but
we
do
not
today,
Ralph
you're,
the
best
cube
and
in
person.
I
have
right
now
so.
A
Okay,
any
other
follow-up
looks
like
Marcelo
is
typing
something
done
any
follow
up.
Yep
Dylan
has
a
follow
up.
Dylan
asks
if
I
have
a
PI,
that's
only
running
it.
If
I
have
a
pod,
that
is
only
running
a
Redis
deployment.
Should
I
reboot
or
run
some
other
maintenance
on
it
occasionally
I'm
looking
at
you
Jeff.
F
So
I
mean
I
personally
run
into
instances
where
you
just
have
to
make
sure
you're
running
something
in
H
a
and
then
cycle
through
them,
gracefully
because
there
are
instances
where
the
content
instances
where
the
container
gets
into
a
just
a
bad
state,
and
you
have
to
literally
recreate
it.
And
then
everything
is
all
gravy
after
that.
But
that's.
B
A
D
A
So
Dylan
ass
h8
and
you
meant
H
a
as
in
high-availability,
so
let
me
just
an
expression
a
little
bit.
Let's
talk
about
applications
that
might
not
behave
correctly,
like
what
best
practices
do
we
have
here
as
far
as
spreading
this
load,
this
is
like.
Kubernetes
is
really
good
at
this
kind
of
thing,
so.
A
B
I
was
going
to
say
like
we're
a
stateful
set,
or
something
like
that
is
great.
When
you
have
to
have
a
cluster
of
items,
a
stateful
set
will
give
everything
an
ordinal
and
when
you
update
it
joining
main
ins
to
it,
it
will
cycle
through
them
one
by
one
and
handle
it.
The
other
thing
is
like
I,
believe
it's
a
reduce
operator
now
that
will
actually
handle
the
AJ
aspects
for
you,
so
that
we
and
will
deploy
more
than
one
Reedus
instance
and
handle
the
health
checking
and
life
cycle
of
them
all.
B
F
So,
in
short,
use
an
operator
if
you
can
and
there's
one
available
and
it's
stable,
otherwise,
yeah
like
I
was
thinking
skunkworks,
you're,
running
H,
a
Redis
on
your
own
and
it's
in
a
stateful
set,
and
you
have
a
cron
job
that,
like
every
three
days,
retakes
one
of
them
in
the
head,
you
know
chaos,
engineering,
it
is
chaos.
Engineering
for
for
making
things
better,
Oh
George
is
gone.
George
has
left
the
building.
D
A
Yeah,
okay,
I'm
gonna
go
ahead
and
I
see
some
more
follow-up.
Questions
on
the
channel
and
I'm
just
gonna
read
them
so
Marcello's
back
with
I
got
another
one
on
cue,
bad
man.
I've
got
a
cluster
with
some
bare
metal
installed,
with
cube
AB
in
the
boxes
have
to
nix
one
that
connects
in
my
public
network
and
the
other
connects
to
the
internal
cluster
Network
when
I've
installed.
It
I've
used
the
IP
from
the
internal
interface
as
the
administration
interface.
A
B
D
F
Specifically,
it's
multiple
pods
working
in
H,
a
as
a
service
together
like
no
just
making
sure
we're
clear
like
you
could
certainly
have
like
five
different
pods,
but
they
would
be
acting
independently.
Make
sure
that
it
is
running
in
a
an
H,
a
setup
yes
thumbs
up.
Yes,
I
think
you
and
I
are
thinking
the
same
thing.
Oh
all,.
A
A
Asked
how
kubernetes
uses
but
I
thought
I'd
just
ask
what
are
some
of
the
difference
between
manage
kubernetes
like
gke
and
deploying
clusters
via
cops?
What
are
some
of
the
things
you
can
do
with
cops
deploys
clusters
that
you'll
likely
be
locked
out
on
a
managed
kubernetes.
This
is
a
great
question,
so,
what's
the
difference,
basically
between
using
a
managed,
kubernetes
or
just
using
a
tool
to
set
up
my
own
cluster
manually
or
with
a
tool
like
cops
or
keep
spray
or
cuba
corn.
Oh
cube
a
bean.
D
A
And
I've
got
another
big
one
would
be
upgrades
right.
So
if
you
set
up
your
own
cluster
using
any
of
those
other
tools,
upgrades
or
kind
of
your
responsibility
at
that
point,
whereas
if
manage
ones
like
gke,
it's
pretty
much
transparent
to
you,
it's
what
a
few
weeks,
usually
after
an
upstream
release,
if
that
I
mean
depending
on
whether
it's
a
major
release
or
yeah.
C
Gke
is
about
like
a
week.
Yeah
they've
got
a
cushion
like
you,
don't
know
that
it's
pushed
cuz,
it's
just
magic
right,
like
yeah
I
mean
that's
cloud
semantics
and,
like
I,
think
everyone's
kind
of
an
in
agreement
like
the
cloud
is
doing
a
lot
for
you
behind
the
scenes
and
I
think
when
you
we
get
down
to
the
brass
tacks
with
like
cue,
a
DM
is
really
sitting
there.
Trying
to
have
you
label
all
those
features
in
terms
of
bootstrapping.
C
Your
bare
metal
cluster
then
perhaps,
and
other
things
are
doing
for
you
already
cloud
that
you
get
with
cloud
and
a
lot
of
is
feeling
less
with
the
host,
and
you
don't
care
as
much
about
that
that
operating
system
and
that
core,
like
host,
sent
up
its
back
address
that
stuff's,
just
all
abstracted
away
from
you.
It's
more
just
employee
set
up
my
certs
access,
etc
and
a
lot
of
that's
just
behind
the
scenes.
So
those
would
be
the
key
things.
C
A
I
think
you
definitely
get
a
lot
more
control
with
the
other
tools
for
sure.
I
have
to
run
this
version
of
this
OS
or
you
know
you
do
you
do
get
the
flexibility,
then
right.
You
know,
depending
on
on
what
you
want,
so
hopefully
Joel
that
will
get
to
you
some
some
tips.
There
feel
free
to
ask
some
follow-up
questions
on
that.
Okay,
moving
on,
let's
see,
Elan
for
kubernetes
users
asks
I'm
having
some
difficulty
doing
a
keep
cuddle
patch
for
node
selector
and
then
a
bunch
of
text.
Okay,
I'll.
A
C
Are
we
looking
at
a
command
and
checking
his
syntax
because
yeah
that's
yeah,
I'm,
not
really
sure
you
know
I'm
surprised,
you
don't
have
like
a
cube,
syntax,
dot,
IO
site
that,
like
it's
just
a
simple
page
with
like
a
text
box
that
you
can
put
your
thing
and
it's
like
nope
you're,
doing
your
JSON
wrong,
guys
yeah!
So.
B
A
No
idea
on
that
one
we're
gonna
move
on
on
that
one.
Sorry,
man,
Matthew
Peterson,
ass,
hello,
I'm
having
issues
following
kubernetes
the
hard
way,
but
using
Azure
I,
am
at
the
NSF
and
I'm
failing
I
am
getting
failed
to
list
star,
v1
dot,
service
unauthorized
and
fail
the
list
star,
v1,
dot,
endpoints
unauthorized
and
the
pod
logs
for
cube.
Dms
I
assume
there's
an
issue
with
our
back,
but
I
can't
seem
to
figure
out
how
to
troubleshoot
so
where's
where's
Matthew
going
to
look
here.
B
B
B
A
D
I
am
actually
a
CK
person.
Excellent.
The
big
one
is
the
test,
it's
kind
of
unnerving
to
have
a
person
staring
at
you.
So
that's
that's.
Definitely
a
weird
experience.
They're
staring
through
your
camera,
the
entire
time
asking
you
questions
and
some
interesting
things.
The
big
one
is
going
through
and
making
sure
you
understand
how
the
API
server
and
all
of
those
other
pieces
interact.
Kubernetes
the
hard
ways
are
good,
just
get
getting
started,
sort
of
item
and
then
walking
through.
What's
actually
in
the
publicly
provided
curriculum
to
see.
C
Okay,
yeah,
that's
that's
gonna,
be
your
best
way
or
you
write
some
big
map
or
something
like
that.
But
again
you
could
mount
a
config
map
that
is
just
updated
by
beginner
container.
Then
the
main
container
takes
it
and
when
it
launches
that
that
would
be
probably
your
best
way,
because
that
keeps
it
abstracted
away
from
just
specificness
inside
the
pod.
But
like
it
like
a
you,
know,
config
map,
which
is
kind
of
outside
and
managed
so
I
actually
was
just
loading.
C
B
Go
back
to
Mario's
suggestion.
Is
there
any
reason
that
the
environment
variables
would
be
like
different
for
all
pods
that
are
running
in
there
like?
Is
it
a
job?
That's
going
like
fetching
something,
and
it's
gonna
be
different
for
every
single
one.
If
not,
then
you
know
a
config
map
would
definitely
work
out.
Well,.
A
Okay,
we'll
give
Ollie
a
chance
to
respond
if
he
has,
if
he
has
any
more
information
to
add.
In
the
meantime,
let
me
kick
over
to
Brian
from
kubernetes
users
asks
our
framework
apparently
requires
mini,
cube
and
I've
installed
it,
but
it
seems
to
spawn
off
insecure
kubernetes
master
nodes
with
the
API
service
bound
to
a
public
IP
listening
on
part
10
to
50
that
allows
anyone
to
send
commands
to
it.
How
do
I
change,
maybe
cube
so
that
it
only
binds
to
local
host
instead?
A
A
A
Okay,
meanwhile,
Mario
is
giving
a
lease
some
examples
here,
and
he
says
the
use
case
for
sharing
environment
variables
between
the
containers
that
I'm
exploring
a
secrets
management
with
vault
I've,
seen
it
done
with
temp
storage.
But
it
was
curious
if
it
was
possible
to
directly
set
the
environment
well,.
C
So,
if
you're
using
vault,
then
what
would
happen
is
the
application
on
star
would
ping
vault
and
request
a
temporary
key
to
get
access
then
to
the
the
data
that
you're
letting
kicks
so
I?
Don't
remember
the
exact
semantics
of
how
that
works,
but
it's
very
application
starts
up
requests
what
it
needs
and
then
gets
what
it
needs
and
continues
on
with
its
startup
process
and
doing
what
it
is
meant
to
do.
So.
C
It
sounds
like
by
having
an
in
a
container
in
there,
you
just
kind
of
add
another
layer
of
complexity
and
another
stuff
there.
So
it's
not
like
the
core
application
itself,
startup
and
then
an
interface
with
vault.
However,
that's
going
to
work
instead
of
passing
it
instead
of
having
something
else
that
passes
yep
correct,
so.
A
C
To
the
I
want
it
to
an
inner
container
to
the
application,
yeah,
not
exactly
I,
think
it
more
just
adds
complexity
that
you
don't
exactly
need,
because
the
inner
container
is
going
to
die
faster
right.
So
it's
going
to
have
one
purpose:
give
that
variable
antacid
on
a
way
like
it's
in
the
pod
right
like
it's,
you
know
so,
okay,
so.
B
Here's
a
with
how
about
refreshing,
dynamic
sequence
was
short,
yells
I.
Think
for
that
sort
of
thing
what
you
want
to
do
is
have
the
cut
was
a
console
template
or
whatever
it
is.
That
can
act
as
like
kid
one,
and
essentially
it
can
listen
in
the
vault
for
the
changes
and
then
change
things
out
and
sound
like
a
signal
pop
or
something
like
that,
yeah
yep.
C
So
so
in
your
container
you
know
one
in
a
process.
Basically
can
it
can
manage
the
reload
call
to
the
application
when
there's
a
change
that
needs
to
be
applied
and
I?
Actually
you
guys
are
no
better
than
me.
I,
don't
know
what
the
latest
is
on
like
when
you
change
a
secret
in
a
volume.
Does
that
does
that
volume
actually
get
updated
in
the
pod
and
then
is
there
some
way
for
kubernetes
to
know
for
us
at
soak
overnight?
Send
us
a
copy
to
the
container
so
I,
don't.
B
C
And-
and
a
lot
of
this
might
be
like-
maybe
you
think
about
how
your
your
applications-
architected
and
possibly
like
is-
is
there
a
good
case
here
for
like
new
containers
just
to
be
spun
up
or
a
new
pod
to
be
spun
up
and
replace
the
old
one
kind
of
thing
right,
so
you're
not
trying
to
change
too
much
during
a
running?
You
know
run
time.
So
what.
B
Are
sort
of
usage
frame
we
see
on
this
is
like
with
the
sidecar
where
the
sidecar
is
the
thing
with
the
secrets,
and
you
know
it
can
refresh
it.
It
can
do
it,
it
can
change
it
as
much
as
we
want
and
then
the
no
container
that
you
have
that
you
care
about
is
talking
to
it
over.
You
know
like
localhost
and
essentially
talk
to
it.
You
know
unencrypted
and
then
the
other
thing
is
just
handling
the
rotation
and
all
that
yeah.
C
C
One
more
thing
on
that
point:
ie
need
to
talk
about
straight
card,
I
think
envoy
might
be
like
there
might
be:
I
just
listened
to
a
podcast
or
on
SDO
from
the
crew,
tonight's
podcast
or
just
fantastic.
Everyone
should
check
it
out
and
I
think
it.
People
are
asking
for
features
in
issue
where
it
can
also
help
manage
the
the
types
of
things
that
are
being
consumed
by
the
application
and
telling
the
application
wedge.
You
know,
say
cup
or
reload
or
do
something
right.
A
I
Lisa
plopped
an
example
on
how
it
could
be
done,
but
using
files
that
you
want
to
look
at
Mario.
Can
you
check
that
out
while
I
read
the
next
question
and
we'll
get
back
to
you
in
a
second
Simon
WS?
Okay,
so
here's
something
I've
done:
I
haven't
gotten
my
head
around.
Yet
how
do
people
keep
track
of
configs
of
tools
they've
deployed
to
their
clusters?
A
typical
workflow
might
be
get
cloned,
something
and
its
variables.
Q,
q,
cuddle,
apply
f.
Obviously,
then
I
guess
the
fluid.
A
However,
if
I
come
back
in
a
couple
of
months
and
once
I
upgrade
to
a
D
release,
I'll
need
to
add
the
same
checkout
available
to
update
and
then
apply.
Would
you
suggest
adding
another
remote
to
the
checkout,
maybe
a
private
repo,
depending
on
what
ours
you
configure
and
then
pushing
it?
There,
then
I
can
update
the
checkout
from
upstream
whenever
I
needed.
This
seems
related
to
the
previous
helm
style
thing.
We
were
talking
about
what
about
a
non
helm
use
case
when
people
just
have
the
ammo
files.
F
D
A
F
A
C
You
provide
value
depending
on
what
you're
trying
to
serve
yeah,
so
I
think
I
think
so
much
storage
now
is
a
very
HTTP
basters,
very
like
GUI
based
right
or
it's
like
download.
This
application,
your
computer,
but
like
there's,
some
people
like
media,
like
our
goal,
are
saying:
gargoyle,
SMTP,
whatever
it
is
and
like
I
think
cover
nice
even
still
like
provides
value
and
like
being
able
to
make
that
easy,
whether
it's
a
node
port
or
some
other
way
to
access
it.
C
You
can
still
just
run
a
container
that
doesn't
actually
have
a
anonymous
FTP
container.
It
made
a
long
time
ago,
and
my
name
is
based
on.
You
know
that
I
can
post
it
literally
just
amount,
miss
FTP,
you
like
mount
the
directory.
You
want
to
serve
and
you're
good
to
go
right,
like
just
the
classic
old
days
of
doom
doom.
B
B
C
C
C
Ftp
that
you
can
do
one
port
and
also
you
can
do
a
singular
port
for
for
that
today.
This
is
I
use
SFTP
or
at
some
Piett,
yes,
which
is
FTP
over.
So
SMTP
is
SSH,
File,
Transfer,
Protocol,
right
and
then
Tukey.
Yes,
is
f2p
over
ssl/tls
effectively
right
like
so.
You
don't
really
want
to
use
base
FTP
much
anymore,
but
SFTP
is
kind
of
my
go-to,
so
port.
C
A
We
sure
are
meant
to
be
serving
yes
all
right.
Moving
on
Ali's
got
another
question:
keep
them
coming.
These
are
great.
Is
it
possible
to
encrypt
all
data,
a
net
CD
by
using
wild
card
for
resources,
the
encrypt
data
docks,
which
is
kubernetes
at
I/o
/,
/
tasks,
/
administer
cluster
/
encrypt
data,
other
disadvantage
of
doing
this.
A
H
A
H
C
H
C
H
H
H
Some
people
use
Walt
instead
of
directly
relating
API
server
encrypt,
so
you
can
use
water
in
the
middle
and
let
Walt
manage
and
host
the
secret.
So
it
city
might
host
the
key
for
encryption.
Mm-Hmm
yeah
still,
but
there
is
various
performance,
but
I,
don't
think
it's
as
big
as
because
he
don't
actually
go
to
a
city
as
often
in
only
a
pace
over
goes
toward.
So
okay.
H
A
I
agree:
that's
the
only
reason
I
do
this
I,
don't
I,
don't
know
anything
so
I
just
hang
out
and
learn
all
right.
Next
question
comes
from
aravindh
from
kubernetes
users,
hi
everyone
I'm
implementing
spot
fleet
for
certain
time
every
day
to
meet
demands
once
the
spot
fleet
terminates
by
the
time
specified.
All
the
pods
on
these
misses
take
some
time
to
migrate
to
new
nodes.
Is
there
a
way
to
gracefully
drain
a
spot
fleet.
F
A
A
A
A
C
We
are
slowly
going
to
GK
we're
on.
You
know.
Yes,
right
now,
I'm
actually
using
static
point
cloud,
so
it's
like
all
abstract
it
away
and
kind
of
kind
of
good.
Some
stock
X
is
an
awesome
company,
that's
kind
of
risen
in
Detroit
euro,
where
I
can
have
a
startup
with
like
300
people,
but
it's
it's
I
was
hired
dislikes
near
demos
guy
to
come
in
and
say
no
developers,
don't
just
push
code
like
let's
see
ICD
this.
D
A
A
A
F
So
multiple
reasons
why
that
could
break
thing
one
is
they
might
not,
they
might
automatically
push
like
Knightley's
to
latest
and
they're,
using
like
app
in
certain
version.
Another
problem
is
say:
you
are,
you
know,
dealing
with
a
service
and
for
some
reason
the
container
hasn't
been,
you
know,
kicked
in
the
head
or
the
server
hasn't
been
rebooted,
so
you're
running,
say:
gitlab,
nine
five
and
it's
actually
pin
two
latest
six
months
later,
all
of
a
sudden
server
reboots
tries
to
pull
get
lab
11.
Well,
that's
not
gonna
go
well
yeah
yeah.
F
A
F
And
I
say
points
to
the
version,
still
wait.
Yeah
because
I
mean
the
way
you
look
at
it.
This
is
something
that
we
do.
If,
if
you
push
new
code
live,
it
builds
a
new
container.
The
container
is
tagged
with
the
git
commit
hash,
you're,
upgrading
your
infrastructure,
your
application
infrastructure,
yeah.
B
A
A
A
C
Maybe
your
app,
can
use
it
if
it
needs
to
or
if
you
eat
them
in
the
container
at
runtime,
you
can
easily
see
what
version
of
the
app
is
running,
because
not
a
lot
of
apps
are
smart
enough
to
have
a
hell
or
even
be
a
CLI
based
thing,
or
maybe
for
you
to
see
what
version
it
is.
So
that's
again
in
your
CI
process
and
that's
easy
in
the
docker
file
to
do
passing.
You
know
there.
Your
CI
process
would
pass
the
the
commit.
A
A
So
everyone
check
that
out
and
I
will
endeavor
to
not
:
latest
as
often
as
possible,
and
with
that
this
kind
of
wraps
up
our
second
session
of
the
day
and
that
wraps
up
our
August.
Is
it
August
yeah
we're
discussion
of
kubernetes
office
hours
thanks
to
the
following
companies
for
supporting
the
community
with
developer
volunteers,
giant
swarm
hefty
o
stock
X
packet
on
net
pusher,
comm
redhack,
we've
works
VMware
and
the
University
of
Michigan.
A
These
companies
do
donate
these
people's
engineering
time
here
for
one
hour
a
month,
and
we
appreciate
that
you're
able
to
share
your
expertise.
If
you
had
a
really
great
time,
please
leave
a
comment
or
a
thumbs
up
subscribe.
If
you're
listening
to
the
live,
YouTube
channel,
we
do
do
these
a
third
Wednesday
of
every
month
and
as
always,
we're
doing
questions
and
things
like
that.
Oh,
my
goodness,
almost
forgot
the
t-shirt,
who
won,
who
won
the
rally
ooh
give.