►
Description
Using a LoadBalancer Service with on-premises deployments can be challenging, often relying on external and third-party vendors to create integrations for their specific hardware. With OpenShift 4.9, Red Hat added MetalLB, in L2 mode, as a fully supported option for adding LoadBalancer Services to your cluster. In this week's episode, we'll look in-depth at MetalLB, including the use cases, what types of workloads are appropriate, and the inner workings.
As a follow-up to last week’s deep dive, we’ll also look at how you can deploy OpenShift to AWS GovCloud regions. These special region types are different than normal, so tune in to discover and learn about some of the pain points, pitfalls, and limitations.
Learn more about MetalLB at https://metallb.universe.tf/
About Ask an OpenShift Admin:
Do you have questions? We want to answer them! Every Wednesday at 11am ET, hosts Andrew Sullivan and guests sit down to answer your questions about Red Hat OpenShift.
Follow us:
Andrew Sullivan , https://twitter.com/practicalandrew
Jonathan Rickard, https://twitter.com/jrocktx1
Subscribe to Red Hat's YouTube channel: https://www.youtube.com/redhat/?sub_c...
About OpenShift:
Red Hat OpenShift is an open source container application platform based on the Kubernetes container orchestrator for enterprise application development and deployment.
Openshift.com https://red.ht/33Fh6uV
OpenShift on github https://github.com/openshift/
OpenShift on redhat.com https://red.ht/2o4ccDk
#RedHat #OpenShift #ContainerPlatform
A
A
B
Well,
hello
and
welcome
to
this
week's
ask
an
open
shift.
Admin
office
hour
live
stream,
so
you
know
johnny
happy
wednesday,
it's
a
yet
another
great
day
at
red
hat
and
I
have
to
say
I
never
get
tired
of
that
intro.
I
think
that
might
have
been
created
by
interns.
I
think
I
say
that
probably
every
week,
but
it
really
is.
I
really
like
that.
Intro.
A
B
B
B
B
Please
don't
forget
that
next
week
we
will
be
off
air
during
this
time,
so
it
is
a
holiday
here
in
the
us.
I
will
be
celebrating
with
my
family
for
the
first
time
in
a
couple
of
years,
so
looking
forward
to
that
very
much,
I
hope
everybody
stays
safe
throughout
the
holidays
throughout
everything
else.
I
will
definitely
suggest,
however,
that
you
subscribe
to
the
channel
on
whatever
platform
you're
on,
because
in
december
we've
got
three
really
good
shows
lined
up.
B
So
I
know
for
a
fact:
we
have
sandbox
containers
coming
up
december
1st
december
8th,
I'm
looking
at
or
I'm
hoping
that
we'll
have
the
support.
Folks
on
as
we'll
be
able
to
really
go
in
depth
with
support
folks,
you
know
what
makes
them
tick,
what
makes
their
job
easier,
how
they
can
help
you
better
all
that
type
of
stuff
and
then
the
15th
we'll
have
a
special
guest
from
vmware
joining
us,
so
we'll
be
talking
about
lots
of
things
vmware.
B
B
If
you
go
there,
there
is
a
calendar
you
can
subscribe
to
that
calendar
and
then
you
have
access
you'll,
be
able
to
see
all
of
the
shows
that
are
going
on
so
anytime
we
sometimes
adjust
the
schedule.
Sometimes
we'll
cancel
shows
all
that
type
of
stuff
you'll
be
able
to
see
those
in
your
calendar
as
well
as
get
all
those
reminders,
all
right,
johnny.
Anything
from
you.
B
Yeah
yeah,
I
know
it's,
I'm
I'm.
What's
the
song
who
who's
saying
that
song
of
I
think
it
was
jesus,
take
the
wheel,
I
mean
it's
johnny
take
the
wheel
because
I
I
know
nothing
about
govcloud,
so
I'm
I'm,
I'm
just
gonna
have
to
hand
it
off
to
you
and
do
the
role
I
was
born
to
play,
which
is
dumb
guy.
So
that's.
A
B
All
right
so
before
we
get
started
with
today's
topic,
I
do
want
to
cover
a
couple
of
our
top
of
mind
things.
So,
first
of
all
hello
to
everybody
in
the
chat,
I
I
see
all
of
you.
There
appreciate
you
participating
in
the
chat
if
you
have
any
questions
kind
of
regardless
of
what
our
topic
is
today.
The
goal
of
these
office
hours
streams
is
to
answer
your
questions.
So
anything
and
everything.
That's
on
your
mind,
talk
about
it.
Ask
about
it
we'll
be
happy
to
address
those
questions.
B
If
we
can't
answer
them
here
on
the
stream,
we'll
follow
up
we'll,
get
those
answers
and
then
we'll
you
know
we'll
talk
about
them
in
a
future
stream
or
we'll
put
them
into
the
blog
post.
If
we
can
get
answers
fast
enough,
that
follows
up
each
one
of
these
streams
on
cloud.redhead.com,
so
some
of
the
top
of
mind
topics,
so
these
this
is
for
lack
of
a
better
term
a
reoccurring
segment.
B
If
you
will
here
on
the
ask
an
openshift
admin
live
stream,
where
we
talk
about
things
that
are
important,
relevant
timely,
that
have
happened
in
in
the
last
week
or
so
that
we
see
come
up.
So
the
first
thing
I
want
to
talk
about
is
something
that
is
a
little
bit
self-serving
and
that
is
red
hat
is
hiring
so
we
get
pinged,
you
know
johnny
and
I
and
stephanie
in
the
background
stephanie
high.
B
B
We
tend
to
just
generically
say:
hey,
go
check
out
the
red
hat
jobs
portal.
There
is
just
a
tremendous
number
of
openings
available
out
there,
ranging
from
you
know
being
in
the
sales
side
of
things
right,
essay
account
executives
so
on
and
so
forth
to
in
the
bu.
So
you
know
my
team
is:
is
hiring
we've
got,
I
think
six
or
seven
positions
open
on
my
team
product
management,
product
marketing,
engineering.
Folks,
you
know
johnny,
you
just
moved
over
onto
the
engineering
side,
so
kind
of
whatever
your
skill
set.
B
The
next
thing
I
wanted
to
talk
about-
and
this
is
one
that
you
reminded
me
of
johnny-
is
advanced
cluster
manager.
What
we
lovely
lovingly
referred
to
as
rackham
the
red
hat
advanced
cluster
manager
for
kubernetes
released
version
2.4
last
week,
so
a
number
of
things
happened
with
2.4
kind
of
the
ones
that
stick
out
to
me.
Let's
see
there
is
scalability,
so
they
added
the
ability
to
provision
single
node,
openshift,
they've,
also
tested
scalability
of
up
to
2000
clusters
with
single
node
openshift.
B
So
a
single
acm
cluster
can
scale
out
to
2000
or
manage
across
2
000
single
node
open
shifts.
That's
that's
pretty
impressive.
It's
a
lot
of
clusters,
there's
a
number
of
other
things
inside
of
there.
Let's
see,
let's
take
this
link
and
paste
it
into
twitch,
so
that
link
will
take
you
to
the
announcement
blog
that
around
that
see
what
were
some
other
things
that
were
inside
of
there.
A
B
Yeah
yeah,
that's
a
good
one!
Thank
you
so
yeah!
This
is
one
that
you
know
christian.
Who
is
the
host
of
the
get
ops
guide
to
the
galaxy?
I
think
he's
talked
about
it
before
with
acm
2.4.
It
is
now
get
ops
aware.
So,
if
you
deploy
an
application
literally,
the
crd
application
into
a
cluster
using
git
ops
acm
is
now
aware
of
that.
It
can
see
it
can
help
to
manage
those
objects
as
well.
B
Let's
see,
there's
some
other
things
in
the
blog
post.
I
see
some
better
integration
with
acs
and
acm
lots
of
other
stuff.
If
you're
an
acm
customer,
if
you're
interested
in
acm
definitely
check
it
out,
it's
not
something
that
or
I
think
there
is
a
little
bit
of
something
for
everyone.
Inside
of
there,
we
had
jimmy
alvarez
on
gosh,
it's
been
a
month
and
a
half
or
two
months
ago.
Now
so
I'll
see.
B
A
Yeah,
especially
if
you're,
if
any
of
you
are
considering
you
know,
hybrid
cloud
or
multi-cloud
type
of
openshift
deployments,
and
and
things
like
that,
where
you
want
to
have
like
a
you
know,
like
a
you,
know
the
single
pane
of
glass
to
manage
all
the
things.
You
know
that
that's
really
where
acm
comes
in,
and
you
know
just
the
the
tighter
integration
that
we
have
with
acm
and
all
of
our
other
products.
It's
just
getting
better
and
better
and
better,
and
so
it's
it's
making
that
deployment.
B
Yeah
I
was
recently
doing
some
experimentation
with
hive,
which
hive
is
the
engine
behind
acm
to
do
cluster
deployments
and
stuff
like
that.
So
hive
is
really
interesting,
because
it's
literally
programmatically
deploying
you
know
a
cluster
basically
you're
having
it
trigger
the
installation
process
behind
the
scenes.
B
I
don't
think
so
because
essentially
acm
from
what
I
understand
manages
those
basically
it's
an
application.
So
it's
not
storing
data
about
those
clusters,
necessarily
inside
of
scd
other
than
you
know.
If
it's
deploying
those
clusters
or
something
like
that,
there
are
some
crd
definition
or
crd
instances,
rather
that
are
in
there.
But
you
know:
two
thousand
objects
is
nothing
for
etcd,
so
I
would
suspect
that
it's
something
internal
to
acm
itself,
but
is
that
limitation?
Not
an
scd
limitation
per
se?
B
I'll
also
remind
you
that
acm
and
acs
and
quay,
and
all
that
other
stuff,
all
of
the
opp,
so
the
red
hat,
openshift
platform
plus
products
they
all
qualify
as
infrastructure
workload.
So
you
can,
you
know,
deploy
an
entire
openshift
cluster,
that
is,
you
know,
all
control,
plane
and
infranodes
host
all
of
those
services
in
kind
of
a
hub
type
of
scenario
to-
and
you
don't
have
to
you
know,
use
entitlements
for
that.
I
always
thought
that
was
a
cool
thing
that
we
did
yeah.
I
hope
not.
B
B
B
So
if
you've
been
here
before
right,
you
know
this
is
how
we
go
and
we
we
create
deploy
new
clusters
right.
I
go
into
the
create
cluster,
I'm
going
to
come
here
and
I'm
going
to
say
I
want
to
do
a
vsphere
cluster
with
ipi
and
if
you
download
this
installer,
this
is
always
going
to
be
the
current
ga
release
of
openshift.
B
B
So
what
if
I
want
to
download
494
or
480
something
or
4
7,
something
because
all
three
of
those
are
even
4.6
us
all
of
those
are
fully
supported
releases.
How
do
I
go
and
do
that?
And
the
answer
is
and
you've
all
probably
seen
me
browse
to
the
mirror
here
and
and
download
stuff
from
there
because
see
if
we
go
up
a
directory,
we
have
all
of
the
versions
that
are
listed
in
here
right.
B
B
We
have
the
download
button
and
you
know
if,
if
you've
been
an
or
a
red
hat
customer,
this
is
how
you
get
all
of
your
software,
so
it
makes
sense.
It
was
just
andrew,
never
put
two
and
two
together
so
yeah
from
here
we
can
go
and
we
can
download
kind
of
any
version
that
we
want,
and
you
can
see
that
these
are
all
the
stable
versions.
B
So
one
of
the
downsides
of
using
the
mirror
is
that
it.
You
know
in
that
listing.
You
just
saw
me
scroll
through
it's
every
version
that
gets
released,
including
versions
that
don't
get
promoted
too
fast
or
too
stable,
whereas
over
here
these
are
only
going
to
be.
You
know
the
versions
that
make
it
to
at
least
fast,
because
so
497
you
see
is
what
it's
calling
the
latest
and
if
we
go
back
to
the
console,
we
want
the
openshift
console.
B
If
we
go
to
releases
and
we
look
at
four
nine
you
see,
497
is
in
fast.
So
this
kind
of
brings
me
to
my
my
next
point
or
my
next
thing
here
in
the
top
of
mind,
topics,
and
that
is
a
fast
release,
is
considered
generally
available.
We've
talked
about
that
before
we
talked
about
it
with
rob
zumske
when
he
was
on
right,
we've
talked
about
it.
A
number
of
times
fast
is
generally
available.
Fast
is
fully
supported.
B
B
So
my
point
here
is:
if
you're
deploying
a
new
cluster,
it's
perfectly
fine
to
deploy
with
the
version.
That's
in
fast
again,
fully
supported.
You
can
pick
up
the
phone.
You
can
call
us,
it
is
considered
generally
available.
In
that
respect,
the
only
downside
if
you
choose
to
do
that
is
that
when
the
cluster
finishes
deploying
you
will
probably
see
an
alert
on
the
console
there
about.
B
B
It
defaults
to
having
the
update
channel
set
to
stable.
So
it's
going
to
say
my
release
doesn't
exist.
I
can't
I
you
know,
I
don't
know
what's
going
on,
you
just
need
to
switch
that
channel
over
to
stable
at
that
point,
but
otherwise
it's
exactly
the
same
and
there's
no
reason
you
couldn't
do
that.
I
will
point
out
and
kind
of
what
made
me
think
of
this.
Is
that
one
of
our
folks
internally,
we
had
a
conversation
this
morning
about
the
docs.
Let
me
see
if
I
can
find
the
right
page
in
the
docs
here.
B
B
B
B
B
B
So
if
you,
if
you're
curious
about
learning
from
product
management,
what's
going
to
be
happening
over
the
next,
you
know
one
two
three
releases,
basically
the
next
nine
to
12
months.
It's
a
great
presentation
to
listen
to
usually
it's.
I
think
we
schedule
it
for
an
hour
and
a
half
we
try
and
keep
within
that.
Sometimes
it
does
go
longer,
but
yeah
it's!
It's
always
an
interesting
one
I'll
be
here
on
the
stream.
B
So
we
do
stream
that
out
live
across
the
across
the
various
streaming
platforms
I'll
be
here
on
the
stream
helping
to
answer
questions
as
well
as
questions
that
I
can't
answer
or
any
of
the
other
folks.
Any
other
streaming
hosts
can't
answer
we'll
shuttle
those
over
to
the
product
management
team
and
get
them
answered
for
you.
So
I
do
encourage
you
to
watch
that
it's
always
a
good
indicator
of.
What's
going
on,
you
can
get
a
little
bit
of
a
preview.
B
They
basically
deep
dive
into
each
one
of
those
and
take
a
look
at
that
all
right,
I'm
done!
That's
all!
I
got
super
straightforward
today.
Nothing,
I
won't
say
nothing
terribly
exciting,
because
you
know
red
hat
job
openings,
acm
2.4
it
is.
It
is
exciting.
It's
just
not
maybe
not
glamorous
stuff
to
talk
about.
I
don't
know.
B
Fine
with
that
we're
gonna
we're
gonna
see
how
my
cluster
does
today.
So
let
me
share
my
window
here,
so
this
is
this.
Is
my
lab
cluster
I'm
running
495
here,
I
just
updated
it
from
4.8.,
something
or
other
not
too
long
ago.
So
inside
of
here
with.
So
let
me
first
start
by
saying
that
with
openshift
4.9
metal
lb
was
added
as
a
supported
option
for
exposing
services
directly
to
the
outside
world.
B
So
traditionally
or
historically,
we
don't
expose
services
right.
I,
if
you
need
to
access
an
application,
that's
running
inside
of
the
cluster.
You
create
a
route
and
that
route
then
runs
through
either
port
80
or
port
443,
and
you
can
access
whatever
application
is
on
the
other
side
and
that
it
identifies
the
pods
that
belong
to
that
application
via
a
service
definition
right.
So
if
I
come
down
here
to
networking
and
look
at
services-
and
let's
go
to
this
one-
I
thought
I
created
a.
B
B
B
So
very
simple.
You
know
my
creative
naming
scheme
here,
simple
service,
I'm
going
to
take
any
pod
that
has
a
and
a
label
of
app
equals
sise,
and
then
I'm
going
to
redirect
the
service
port
80
to
the
target
port.
8080.
super
straightforward,
super
simple
or
I
can
click
create
here.
What
that's
going
to
do
is
it's
going
to
identify
three
different
pods
running
inside
of
my
cluster.
Here
you
can
see
here's
my
deployment,
so
that's
when
I
browse
to
that
service
or
if
I
click
that
service
from
something
internally,
it'll
more
or
less.
B
You
know
round
robin
across
all
of
those
available
pods.
I
can
expose
this
externally
right.
I
can't
access
that
service
from
outside
of
the
cluster,
but
I
can
expose
it
externally
through
a
route
and
that
route.
When
I
select
this
simple
service
effectively,
what
that's
telling
the
ingress
controller
is
hey.
Look
at
this
definition.
Look
at
the
pods
it
identifies
and
use
those
to
create
the
the
nginx
or
no
proxy.
B
Sorry,
the
aha
proxy
rules
for
forwarding
traffic
over
to
those
pods,
so
it
is
important
if
you
didn't
know
this
already
so
routes,
don't
and
ingress
controllers
in
journal.
They
don't
send
traffic
through
the
service.
Rather,
they
use
the
service
as
the
identifier
for
the
pods
to
send
traffic
to
so
it
goes
directly
from
the
ingress
controller
to
the
pod,
not
via
the
service
mechanism,
and
then
we'll
do
this
target
port.
So,
basically
we're
saying
following
the
target
port
definition
from
the
service
I
hit
create
and
as
you'd
expect,
I
get
my
application.
B
This
is
a
super,
simple
application.
I
use
this
one
for
demos
regularly.
All
it
does
is
expose
who
is
requesting
my
ip
and
then
what
the
the
server
name
that
it's
using
and
then
the
internal
ip
address
so
kind
of
a
an
easy
way
to
just
show
that
hey
we've
got
an
application
running.
I
can
refresh
it
a
couple
of
times
and
theoretically
it'll
change
over
to
a
different
server
ip
at
some
point.
B
B
B
B
Excuse
me,
while
I
cough
we'll
hit
install
here
and
it'll,
deploy
the
operator
kind
of
as
you
would
expect
in
full
disclosure.
I
haven't
tried
this
since
4.9
g8,
I
tried
it
in
the
rc
and
there
was
an
error
with
the
operator.
So
if
this
fails,
if
something
goes
wrong
here,
I
do
have
the
instructions
on
how
to
do
it
manually.
So
we'll
we'll
see
what
happens.
B
Operators
being
installed
so
an
interesting
thing
here,
if
we
go
to
the
installed
operators,
I
can
click
on
this
guy
and
down
here
we
have
our.
There
should
be
a
I'm
looking
for
the
install
plane
and
operator
group.
Why
am
I
oh
here
we
go?
There
should
be
a
install
plan
that
we
can
look
at
and
view
in
order
to
see
precisely
what
it's
creating
on
the
back
end,
and
my
mind
is
completely
just
not
working
today
as
to
why
I
can't
find
the
install
plane
anyways
it
did.
It
did
succeed
there.
B
I
don't
know
if
you
saw
that
so
with
that
we
need
to
create
a
metal
lb
instance,
we'll
create
that
so
metal
will
be
good
enough.
For
now.
We
don't
need
to
change
the
name
here
to
anything
fancy
we're
going
to
click
create,
and
what
we
should
see
here
is,
if
I
switch
over
to
I'm
still
in
the
middle
lb
system
namespace,
I
switch
over
to
pods
you'll
notice.
A
couple
of
things
happening
so
one
here
is
our
operator
controller.
So
this
is
the
controller,
the
logic
behind
those
crds.
B
So
when
I
created
that
metal
lb
crd
instance
a
moment
ago,
it's
the
one
that
actually
turns
that
into
logic
from
there.
I
have
these
or
I
now
have
these
speaker
pods,
there's
one
of
these
running
on
each
node
in
the
cluster.
It's
a
daemon
set,
and
this
is
what
will
control,
what
will
manage
the
traffic
coming
into
the
system
and
then
up
here
is
my
controller
pod,
which
will
do
things
like
assign
an
ip
address
to
that
external
service.
B
B
According
this
diagram,
so
100.11
21
and
31,
and
then
we
have
these
speaker
pods
and
these
speaker
pods
are
effectively
when
I
create
a
service
that
is
using
metal
lb,
it
will
assign
the
controller
will
assign
it
a
load
balancer
ip.
So
we
see
100.200
so
that
speaker
will
assume
that's
ip
address
and
then
start
sending
arp
rate,
packets
or
arp
requests
for
that
ip
address.
B
So
now,
when
my
application,
you
know
when
something
needs
to
access
my
application,
it
says:
okay,
I
need
to
go
to
externally.
I
go
to
100.200
and
because
of
the
arp
cache
right,
the
arp
packets
that
it's
sending
out
it
says.
Okay,
I
need
to
come
over
to
this
speaker
now,
which
speaker
it
lands
on
is
actually
arbitrary
by
default.
It
will
use
kube
proxy
on
the
back
end
and
it
will
just
like
a
service.
B
It
will
send
that
traffic
across
all
of
the
different
application
pods
that
exist
in
the
cluster,
so
that's
kind
of
metal
lb
at
a
high
level.
It
will
traverse
so
coupe
proxy
does
traverse
the
pod
network
and
all
that
other
stuff.
So
you
can,
you
know,
there's
a
couple
of
things
to
be
aware
of
here,
not
the
least
of
which
is.
You
are
limited
to
one,
the
throughput
of
a
single
node
for
that
ingress
traffic,
but
two,
if
say,
you're,
using
a
25
gigabit
interface
here
and
a
10
gigabit
interface.
B
Here
you
would
be
then
further
limited
by
the
throughput
available
on
the
pod
network,
which
is
the
sdn.
So
this
docs
page
is
is
really
good.
They
go
through
a
lot
of
stuff.
First
and
foremost,
I
should
also
highlight
that
right
now,
metal
lb
only
works
or
is
only
supported
with
layer,
two
inside
of
openshift,
so
there
is
a
bgp
mode
for
upstream
metal
ob.
B
So
if
you're
not
familiar
with
that,
bgp
is
a
routing
protocol
so
effectively.
What
happens
in
that
instance
is
when
I
create
a
a
route
with
bgp
mode,
enabled
it
will
advertise
bgp
routes
upwards
to
the
router
to
any
node
that
has
an
application
pod
running
on
it,
and
then
it
will
use
bgp
to
do
that
load,
balancing
protocol
so
l2
mode.
It
is
just
simply,
I
have
an
ip
address
here.
I'm
going
to
use
arp
to
advertise
that
address
and
then
all
the
traffic
flows
in
and
then
goes
to
those
application.
B
The
other
thing
that
I'll
talk
about
on
here
is
that
you
know
here
infrastructure
considerations
and,
most
importantly,
limitations.
So,
as
I
already
mentioned,
single
node
bottleneck
slow,
failover
performance,
so
this
is
more
or
less
in
line
with
keep
a
live
d.
It
doesn't
use,
keep
a
live
d,
but
it
it
does
have
similar
sort
of
if
this
node
sorry
for
scrolling
on
y'all.
B
So
if
this
node,
which
has
the
100
that
200
ip
address,
were
to
go
down
for
some
reason,
you
know
whether
it's
a
cordon
and
drain,
because
I'm
rebooting
for
updates
whether
it
falls
through
the
floor.
It
will
take
a
few
seconds
for
one
of
the
other
nodes
to
pick
up
that
ip
address
and
resume
traffic
flow.
B
Okay,
I'm
done
rambling
about
the
documentation.
Everything
should
be
running
over
here.
It
looks
like
we've
got
all
of
our
speaker,
pods
up
and
running
across
the
cluster,
so
what
I
want
to
do
now
is
create
an
address
pool
so
effectively.
It
needs
to
know
like
what
I
p
addresses.
Am
I
allowed
to
use
for
a
load
balancer
service.
B
So
let
me
grab
the
appropriate
bits
that
I
need
here
and
just
like
that.
So
now
I
want
to
go
back
up
to
here
and
I'm
going
to
create.
So
it
is
a
metal
lb,
api,
endpoint
of
type
address,
pool
and
you'll
notice,
a
couple
of
things
so
one
this
is
metal
lb
system
namespace.
I'm
going
to
call
this
vlan
and
14
because
that's
the
vlan
in
my
lab,
so
importantly
with
4.9
and
metal
lb.
B
We
do
need
to
use
the
layer
2
protocol
here
and
then
we
just
create
a
set
of
addresses
here.
So
let's
talk
about
this
a
little
bit
so
first,
I
can
specify
multiple
address
pools
inside
of
here.
I'm
calling
this
vlan
14
just
to
help
me
keep
track
of
it,
but
I
don't
have
to
limit
it
to
just
this
pool
or
or
just
addresses
on
vlan
14..
B
In
reality,
I
can
configure
my
nodes
kind
of,
however,
they
need
from
a
networking
standpoint.
So
let's
say
it's
a
physical
deployment.
I've
got,
you
know
a
bond
running
that
has
my
sdn
running
across
it.
Where
my
machine,
you
know
the
ip
address
on
the
machine
network,
is
I've
got
another
bond
that
I'm
using
for
say,
dedicated
storage
traffic.
I've
got
a
third
one
with
like
four
network
adapters,
that
has
you
know
10,
vlans
or
50
vlans
or
whatever
chunked
into
it,
and
then
it
has
vlan
interfaces
for
each
one
of
those.
B
B
B
So
if
you
decide
disable
auto
assignment,
then
in
the
next
step,
which
is
actually
using
metal
lb,
you
would
just
have
to
request
a
specific
ip
and
again
documentation
walks.
Through
all
of
this,
you
can
request
specific
ips.
You
can
share
ips.
If
I
click
over
here,
you
know
I
can
have
multiple
services
using
the
same
ip,
hopefully
with
different
ports.
You
can
see
http
80,
https
443
here,
so
port
conflicts
might
be
an
issue,
but
you
can
absolutely
use
the
same
same
ip
address
all
right,
so
our
address
pool
is
created
now.
B
Load
balancer
service,
so
lb
service.
You
can
see
basically
the
exact
same
definition
that
I
used
before,
but
this
time
I
have
a
type
of
the
over
helpful
help
here
keeps
getting
in
the
way.
Thank
you
clippy.
So
the
type
here
is
set
to
load
balancer,
so,
let's
hit
create
here
and
let's
see
what
happens
so.
The
first
thing
that
we'll
notice
here
is
that
I
now
have,
in
my
service,
address
type
external
load
balancer
with
a
location
of
14.230..
B
So
this
time
without
creating
a
service,
you
see
I'm
just
going
to
copy
this
ip
address
and
we'll
open
a
new
tab
and
paste
that
in
and
what
we
should
see
is
our
service
endpoint.
This
is
the
same
application
that
was
running
from
the
route
externally
accessible.
It
just
so
happens
to
be
running
directly
from
our
load
balancer
service,
and
you
can
see.
I
can
continue
to
refresh
that
right.
It
keeps
coming
up.
Our
time
keeps
updating,
so
it
more
or
less
behaved
exactly
as
you'd
expect.
B
So
I'm
gonna
take
a
look
here
at
chat
just
to
see
if
I
missed
anything,
no
so
load
balancing
is
not
really
for
throughput,
not
with
l2
mode,
so
without
l2
mode
it
definitely
is
limited
to
a
single
node
when
bgp
mode
is
available,
which
tentatively
is
openshift.
4.10
watch
the
what's
next
presentation
on
on
november
30th,
so
when
bgp
mode
is
available,
it
will
be
more
we'll
say
more
robust
in
that
respect,
for
increasing
total
throughput
available.
B
All
right,
so
that's
that's
what
I
got
for
metal
lb,
pretty
straightforward!
You
know
kind
of
fills
a
an
important
gap
in
capabilities
makes
it
easy
to
access
those
those
pod
based
services
externally
and
importantly,
you
can
also
expose
ports
other
than
80
and
443.
I
happen
to
use
this
example,
which
runs
on
port
80,
but
you
don't
have
to.
A
B
A
Yeah,
that
is
awesome
all
right,
so
aws
gulf
cloud.
If,
if
anybody
has
deployed
in
gulf
cloud,
you
know
that
it's
not
as
straightforward
as
it
you
know
possibly
could
be
so
just
at
a
high
level.
What
we're
going
to
talk
about
really
is
the
the
kind
of
the
gotchas
really
you
know
like
when
you're
deploying
an
aws
gov
cloud.
A
The
the
big
gotches
are
that
you
need
to
create
endpoints
for
your
private
networks
because
out
of
the
box,
if
you
use
like
the
cloud
formation
templates
that
are
on
the
openshift
documentation
website,
which
I'll
post
a
link
or
then
what
all
it'll
do
is
it'll
create
the
s3
endpoint.
But
really
you
need
the
s3
endpoint,
the
ec2
endpoint
and
the
elastic
load,
balancing
private
endpoint
and
essentially,
what
that
does.
Is
it
allows
your
private
subnets
to
talk
to
that
public
api
over
a
private
link
service?
A
If
you're
trying
to
do
a
fully
air
gapped
installation,
then
you
will
need
a
like
some
type
of
proxy
server
or
you
know
firewall.
That's
allowed
listing.
You
know
the
amazon
aws
domains.
So
that
way
you
can
resolve
to
the
route53.
Otherwise
your
installation
is
going
to
fail
because
it
can't
create
the
dns
records
that
it
needs
to
create.
So
that's
just
one
of
the
that's
actually
like
the
probably
the
biggest
gotcha
when
we're
talking
about
like
completely
private
subnetting
or
completely
private
vpcs.
A
Is
that
you,
you
will
need
a
squid
proxy
or
you
know,
use
the
aws
network
firewall
service,
or
something
like
that.
I
do
have
a
link
that
I'll
post
to
the
to
the
chat
for
for
the
squid
proxy
reference
architecture
and
then
I'll
post.
Another
link
that
there's
a
team
internally
within
naps,
a
big
shout
out
to
north
american
public
sector.
By
the
way
you
know
we
we
do
it
and
we
do
restrict
it.
So
this
is
our
thing.
A
So
there
there's
a
a
group
of
there's
a
team
within
naps,
called
red
hat
for
gov.
That
is
doing.
You
know
a
bunch
of
documentation
for
the
different
environments.
You
know
what
be
it:
microsoft,
azure
government
or
aws,
govcloud,
restricted
or
vmware,
or
whatever
they've
gone
through
and
they've
documented
that
process
to
do
an
ipi
installation
in
those
different
environments.
So
I'll
share
the
link
to
that
as
well.
So
that
way
you
can
go
in
and
take
a
look
at
that
and
hopefully
get
a
lot
out
of
it.
A
B
B
A
Is
this
is
the
the
the
landing
page
for
for
installing
an
aws
gov
cloud?
So
essentially,
what
it
is
is
because
you're
already
creating
a
vpc,
you
don't
have
the
same
requirements
for
networking,
so
you
don't
have
to
create
a
network
or
you
don't
have
to
worry
about.
You
know
going
through
and
creating
network
permissions
with
iam.
My
account
that
I'm
using
it
has
it's
full
admin.
So
I'm
kind
of
cheating
a
little
bit,
but
you
can
narrow
the
permissions
down
and
scope
the
permissions
down
to
what
you
need.
A
The
the
big
thing
about
using
the
vpc
is
like.
I
was
telling
you
before.
You
don't
need
or
you
you
need
to
create
the
the
endpoints,
and
so
I
will
walk
through
that
really
quick,
but
just
to
kind
of
hone
in
on
some
of
the
things
that
you
don't
really
need
to
build
out.
Are
you
you
don't
need
to
build
an
internet
gateway?
You
don't
need
to
build
a
nat
gateway
or
subnets
or
routes
or
route
tables.
A
A
Yep,
exactly
exactly
and-
and
I
think
it
was
around
4-6
was
when
the
ipi
became
like
fully
available
within
govcloud
regions,
and
then
I
think
it
may
have
been
4,
6
or
late
46
for
for
azure
government,
but
yeah.
It's
really
awesome
once
you
provision
that
initial
vpc
and
aws
and
get
these
these
three
endpoints.
A
I
I
cannot
harp
on
these
enough
like
if,
if
anybody
takes
anything
away,
is
that
these
three
endpoints
are
absolutely
required
and
otherwise
what
will
happen
is
you'll
get
through
your
installation
and
then
you'll
realize
that
it
can't
talk,
and
so
the
install
will
will
try
and
update
like
the
machine.
Api
actually
will
try
and
update
things,
and
it
can't
actually
talk
to
anything
so
it'll
it'll,
just
bomb
out.
B
Also
point
out
that
this
type
of
install
is
useful.
If
you're
your
organization
has
policies
like
very
strict
policies
around
permissions.
You
know
that
was
one
of
the
early.
You
know
we.
We
need
the
ability
to
provide
an
existing
vpc
because
a
lot
of
organizations
permissions
wise.
They
lock
down
vpc
creation,
you
know
pretty
pretty
strictly
so
this
is
another
example
of
depending
on
the
permissions
available
you,
you
know,
work
with
the
appropriate
teams
in
your
organization
to
request
the
resources
and
then
provide
them
into
the
installer.
A
Yeah
that
that's
absolutely
correct
right,
like
we've,
I
can't
tell
you
the
number
of
customers
that
I've
gone
to
where
they've
already
got
a
v-net
in
azure
or
they've,
already
got
a
vpc
or
they've
already
got
a
resource
group
within
vmware
right
and
they
have
to
work
within
that
bubble
because
a
lot
of
times
what
happens
is
especially
on
the
dod
side.
There's
they're,
using
a
service
provider
that
service
providers
already
provisioned
this.
A
You
know
this
container
of
resources
for
them,
and
so
they
have
to
work
within
that
bubble,
and
so
this
is
where
this
comes
in,
and
it's
super
super
helpful
and
as
long
as
they
can
get
the
permissions
and
and
work
with
that
provider
to
get
the
permissions
kind
of
like
scaled
down,
then
it
just
it
works
really.
Well
and
we've
we've
done
this
type
of
deployment
in
you
know,
I
would
say
very
restrictive
environments.
A
You
know
so
definitely
like
that
that
you
know
I
don't
know
if
anybody
really
knows
like
aisle
four
but
like
at
the
il-2
il-4
level,
which
is
you
know
this
integrity
level
where
it's
really
just
like
these
really
restricted
environments.
You
know
so,
where
it's
really
it's
not
fun
to
work
in
but
like
once,
you've
got
everything
kind
of
like
laid
out
the
foundation
laid
out.
A
You
can
just
run
your
deploy
and
you
know,
keep
kicking
these
things
over
and
over
and
over
and
it's
it's
pretty
cool,
as
that
was
really
the
big
thing
about
the
the
documentation.
Is
that
you
know
just
creating
those
endpoints.
A
lot
of
people
overlook
that
it's
super
important
when
you
create
the
endpoints,
you
associate
your
private
subnets
to
them
and
that
allows
your
private
networks
to
talk
to
these
public
services
via
a
private
link
service
and
just
to
reiterate
back
on
the
route.
53
thing.
A
If,
if
you
want
a
completely
private
vpc-
and
you
want
to
do
ipi
installation
or
the
installer
provision
installation,
then
you
will
need
a
squid
proxy
or
some
type
of
external
access.
So
that
way
you
can
reach
out
to
the
rot,
53
api
and
make
that
call,
because
there
is
no
private
link
service
for
route
53
right
now
and
then
stop
sharing
this
screen.
B
It's
a
anybody.
Who's
watched
the
stream
for
any
amount
of
time
knows
that
I
can't
talk
and
type
at
the
same
time,
and
if,
if
I
try
my
fingers
either
start
typing
what
my
mouth
is
saying
or
my
mouth
is
saying
what
my
fingers
are
typing
one
of
the
product
managers.
I
work
with.
I
I've
done
presentations
with
him,
where
he
is,
you
know,
holding
a
microphone
and
typing
something
with
one
hand,
while
saying
something
completely
different,
and
it's
just
it
blows
my
mind
every
time
I
see
him,
do
it.
A
Oh,
I
ran
some
see
exactly
I'm
already
forgetting
how
to
use
linux.
So
I
I
ran
some
automation
that
essentially
what
it
does
is
it
provisions
the
vpc
and
it
goes
out
to
provisions
of
vpc
provisions,
the
public,
public
and
private
subnets.
It
creates
the
endpoints
and
associates
them
with
the
right
subnets
and
the
right
route
tables
and
everything,
and
essentially
just
gets
the
environment
ready
to
go
so
that
way,
I
can
try,
hopefully
to
show
you
how
this
works,
how
the
selection
works
and
then.
A
That's
correct
yeah,
so
yeah
so
like.
If
this
is
commercial,
I'd
be
able
to
run
the
open
shift
install
from
here
and
I'd
be
able
to
hit
the
the
you
know.
The
commercial
api
is
no
problem,
but
because
I
have
to
hit
that
that
bastion
node.
I
just
spun
everything
up
from
my
my
laptop
or
where
you
know
my
my
corporate
machine.
If
you
will
and
then
you
know
now,
I'm
gonna
ssh
out
into
the
cloud
and
actually
start
the
deployment
from
there.
B
A
Right
so
the
way
that
this
works
is
because
this
this
is
a
connected,
install
and
go
cloud.
It
will
reach
out
to
quay
and
pull
all
the
images
down
recently,
and
you
know
I
I
hate
to
give
jared
holdcut
any
credit
for
anything.
But
you
know
jared
jared
on
the
red
hat
for
gov
team
did
a
lot
of
work
to
get
the
core
os
images
out
in
you
know
to
get
them
published
out
in
aws.
A
So
that
way
you
didn't
have
to
pull
them
in
and
do
a
snapshot,
and
you
know
like
import
them
yourself,
but
yeah.
He
did
a
lot
of
work,
got
all
that
stuff
out
there
and
that's
another
link
that
I
have
that
I
will
share
out
with
everybody.
So
that
way
you
can.
Actually
you
know
if
you're
in
us
east
one
you
have
the
list
of
amis
for
each
version
and
if
you're
in
us
go
west,
one
then
same
thing.
B
A
A
A
All
right,
and
so
now
what
I'm
gonna
do
is
I'm
just
gonna
make
it
make
a
deployment
directory
and
then
copy
the
install
config
into
there
and
then
before
I
kick
it
off.
I
will
walk
through
this
with
vi.
Instead
of
them,
you
don't
need
colors,
all
right,
yeah,
I'm
just
and
I'm
so
tuned
to
use
them
that
it's
just
it's.
It
hurts
just.
A
A
Actually
this
these
entries,
the
stanza,
doesn't
actually
create
them,
and
then
the
other
thing
that
I
do
is
I
just
kind
of
go
through
and
I
say
which
availability
zones
so
generally
right,
you're,
you're
configuring,
a
highly
available
service,
so
you'd
want
your
subnets
to
be
spread
across
the
you
know.
You'd
want
your
services
to
be
highly
available
and
then
the
big
difference
here-
and
here
I
did
it.
A
I
did
it,
but
the
big
difference
is
that,
with
with
golf
call,
we
need
to
define
the
subnets
and
that
that's
how
the
installer
knows
which
vpc
to
use
and-
and
you
know
again,
the
ami
id
that
gets
published
and
then
your
public
key.
So
it's
all
pretty
similar
to
how
we
would
deploy
in
commercial,
which
is
pretty
awesome
right.
A
I
mean
there's
just
like
these
little
nuanced
things
that
we
have
to
do,
and
then
that
publish
internal
at
the
end
and
the
reason
why
we
have
to
do
publish
internal
is
because
of
route
53.
If
route53
and
govcloud
supported
publicly
hosted
zones,
then
it
we
could
do
a
publish
external
and
it
would
work.
The
like,
like
a
parity
feature
right
over
in
azure
government,
is
that
you
can
actually
do
publish
external
because
it
does
support
public,
hosted
zones
and
private
hosted
zones.
A
B
B
You
know
we'll
address
those
as
quickly
as
we
can.
You
can
also
reach
out
at
any
time.
You
can
contact
me
or
johnny
via
social
media,
so
both
of
our
twitter
handles.
So
I
am
at
practical,
andrew
just
like
you've
seen
in
the
the
chat
there.
Thank
you
stephanie
for
posting
that
up
for
andrew.sullivan,
redhat.com
and
then
johnny
is.
I
can
never
remember
your
twitter
twitter
handle
jrocktx1
there
we
go
and
then
johnny
with
no
h
and
two
ends
at
red
hat.
B
So
yeah,
please
don't
hesitate
to
reach
out
if
you
have
any
any
questions
and
it's
always
interesting
to
to
see
what
you
all
have
to
ask
about,
and
I
think
for
those
of
you
who
have
said
who
have
sent
me
questions
and
stuff
like
that,
we
do
tend
to
talk
about
them
on
the
on
the
stream.
Here
we
tend
to
follow
up
and
cover
what
those
you
know
once
we
find
the
answers
cover
what
you
asked
about.
B
Your
fingers
not
cooperating
I'm
trying
to
fly,
and
it's
just
not
going
well.
We
we,
we
don't
have
a
stream
that
immediately
bumps
up
against
the
back
end
of
this
one,
so
we
can't
go
over
by
by
a
little
bit
so
don't
rush
too
much.
But
okay,
let's
see
what
I
did
here
yeah.
Actually
I,
when
did
that
change?
I
don't
know
when
that
changed
it
used
to
be
that
there
was
a
an
open
shift.
Commons
briefing
that
was
immediately
after
the
ask
an
open
shift.
B
B
That's
fine!
So
on
with
metal
lb,
why
is
it
called
layer,
2
networking?
So
it's
referring
to
the
osi
model,
all
right
and
the
layers
one
through
seven,
so
layer,
one
is
your
physical
right.
So
essentially
it's
it's
talking,
two
things
at
the
and
johnny
help
me
out
here.
It's
talking
to
things
at
the
physical
layer
which
is
mac,
addresses
layer.
Two
is
going
to
be
at
the
or
no
maybe
it's
layer,
two
is
mac
addresses.
B
B
Layer
three
would
be.
I
have
different
ips,
you
know
so
or
ips
in
different
subnets,
I
should
say,
and
then
I'm
able
to
go
through
and
do
routes.
It's
been
a
solid
20
years.
So
since
I,
since
I
thought
about
you,
know
the
osi
model,
and
now
I'm
really
struggling
and
kind
of
embarrassed
that
I
can't
like
immediately
rattle
it
off
like
I
used
to
be
able
to
I'm
I'm
all
of
the
certifications
that
I
used
to
have
when
I
was
an
administrator,
I'm
I'm,
I'm
gonna
get
my
my
admin
card
revoked.
B
Yes,
next
stream
is
at
1400
eastern,
which
is
the
rel
present
stream.
I
believe
so
I
don't
know
what
they're
talking
about
today,
but
it's
always
interesting
to
see-
and
in
case
you
didn't
see-
I
think
that's
rel
9
is
now
available
in
beta,
so
lots
of
interesting
stuff
there,
so
metal
lb
doesn't
work
at
the
layer
of
tcp
udp.
B
So
yes,
so
what
it's
referring
to
there
is
it's
not
doing
like
a
lot
of
times,
we'll
hear
layer,
seven
load,
balancers
or
something
like
that,
where
it's
able
to
look
at
what's
happening
at
the
application
level.
You
know
hey.
Is
there
something
available?
Is
there
something
at
the
other
end
of
this
endpoint
that
I
can
check
and
verify
before
I
send
traffic
to
it,
so
a
layer
two
would
basically
be.
Is
there
something
there?
Yes,
I'm
sending
traffic
to
it,
that's
kind
of
the
thought
process
behind
it.
B
B
B
So
when
we're
talking
about
you
know
the
the
you
know:
fancy
l4,
l7
load,
balancers
from
partners
like
citrix
and
f5
and
so
on
and
so
forth,
there's
a
whole
bunch
of
them.
They
can
do
things
like
hey.
I
know
that
this
endpoint
I
sent
the
last
seven
sessions
there.
I
see
that
there's
you
know
40
megabits
or
gigabits
of
throughput,
whereas
you
know
this.
Other
endpoint
has
two
sessions
and
there's
only
10
gigabits
of
throughput
going
to
it
I'm
going
to
start
favoring.
B
You
know
new
sessions
collecting
over
to
that
or
connecting
over
to
that
endpoint
stuff.
I
don't
think
that
that's
available
with
metal
lb,
definitely
not
in
layer.
2
mode,
I
don't
believe
it's
available
in
bgp
mode,
but
I
would
I
would
have
to
talk
with
a
networking
expert
to
really
figure
that
out
wolfpack
microsoft
cluster.
I
don't
know
what
a
wolfpack
microsoft
cluster
is.
I'm
I'm
I'm
from
raleigh
wolfpack
to
me
means
nc
state.
B
Or
what
did
microsoft
did
have
a
have
a
load
balancing
mechanism
at
one
point
now
I
can't
remember
the
name
of
it.
I
I
that
might
be
which
I
I
think
that's
what
you're
probably
talking
about
our
hope,
none
and
I
can't
think
of
the
name
of
it.
It
was
a
special
networking
mode
that
was
supported
specifically
by
windows,
servers
yeah.
B
B
B
So
yeah
we
we
do
have
a
mechanism
to
reset
pull
secrets
because
it
happens
surprisingly
frequently
with
the
streams
and
everything
with
all
the
all
the
stuff
that
we
do.
So
there
is
a
way
that
you
that
we
can
reset
it
as
a
customer,
as
somebody
who's
a
user
of
openshift,
you
can
reset
your
pull
secret
by
creating
a
help
desk
ticket,
so
basically
open
a
support
case.
B
You
know
requesting
that
it
be
reset
for
whatever
reason
they'll
go
through
and
they
take
care
of
that
on
on
the
back
end,
so
it
is
possible.
I
I
wish-
and
I
don't
understand-
I've
actually
asked
and
have
not
gotten
what
I
would
consider
a
satisf
satisfactory
answer,
but
I
wish
I
understood
why
we
can't
make
that
mechanism
easier
to
do
you
know
why
can't
I
go
into
my
account
on
access,
reddit.com
or
console.redhat.com
and
say
you
know,
reset
pull
secret.
B
B
Important
thing
here
and
really
the
takeaway
is
what
you
showed
us
in
the
install
config
yammer,
which
is
providing
those
endpoints
and
all
of
that
other
config
for
the
the
pre-created
pre-configured.
You
know
vpcs
and
all
that
other
stuff
that
that's
the
magic
that
happens
here
of
you
know,
I'm
not
in
a
regular
cluster
or
a
regular
aws
region,
I'm
in
a
region
that
has
specific
restrictions
around
it,
which
also
applies.
If
my
account
is
severely,
you
know
restricted,
which
is
at
least
in
my
experience
fairly
normal
right.
It's
not
uncommon
for
organizations
to.
B
Yeah-
and
I
I
know
you
know
not
just
naps
but
there's
a
whole
sub
community,
if
you
will
inside
of
red
hat
of
folks
who
focus
on
disconnected
clusters.
So
if
you
have
any
questions
around
that,
if
you
have
any
issues,
be
sure
to
reach
out
to
us,
we're
happy
to
make
those
connections
and
get
those
answers,
get
those
questions
answered
for
you.
B
So
one
last
reminder
no
stream
next
week
next
week
is
a
holiday
here
in
the
us.
So
I
hope
everybody
has.
If
you're
going
anywhere
safe
travels,
if
you're
not
enjoy
your
time
with
family
for
the
rest
of
the
world,
we
will
see
you
in
two
weeks
where
we
will
be
talking
about.
Oh,
what
did
I
say
was
before
oh
sandbox
containers,
so
sandbox
containers,
which
is
the
the
better
known
name,
is
catacontainers
right.
It's
a
type
of
virtualization
for
pods.
B
You
know
for
containers
so
looking
forward
to
talking
with
adele
the
product
manager
for
that
to
find
out
the
details,
the
use
cases,
everything
that's
going
on
there
and,
of
course,
we'll
dig
into
some
demos
there
as
well,
so
have
a
great
week,
have
a
great
holiday
weekend
for
those
of
us
in
the
us.
Thank
you
so
much
to
everybody
who
joined
today
and
we'll
see
you
on
the
next
stream.