►
From YouTube: OpenShift Commons Briefing #78: Application Delivery Services with OpenShift & Ansible Automation
Description
Avi Networks’ Ashish Shah, Senior Director, Product Management, was the guest speaker for this briefing covering key container networking concepts and introducing the capabilities in the Avi Networks’ Service Mesh for OpenShift/Kubernetes applications.
Application networking services needed for OpenShift/Kubernetes applications are very different from traditional three-tier applications. Services such as load balancing within and across clusters, service discovery, application performance monitoring, security, and visibility are needed to deliver robust container applications. Traditional hardware or virtual appliance-based load balancers are not built to handle the dynamic and distributed nature of microservices applications, while lightweight proxies don’t have the analytics, scale, security, nor enterprise class load balancing features that enterprises expect for production deployments.
A
Well,
hello,
everybody
and
welcome
again
to
another
openshift
Commons
briefing.
This
time
we
have
avi
networks,
his
a
shesh,
Shah
or
shisha,
and
there
are
new
members
to
the
open
ship.
Commons
and
I
ran
into
them
at
KU,
Khan
a
while
back,
and
they
had
a
different
approach
to
some
of
the
application
network
services
and
working
with
open
shifts.
A
So
I
thought
it
would
be
a
good
way
to
introduce
them
to
the
community
by
having
them
come
on
and
talk
a
little
bit
about
what
they're
doing
and
I'm
not
going
to
be
too
much
more
of
an
intro
because
I'm
pretty
new
to
it
so
she's.
If
you
could
introduce
yourself
and
your
colleague
who's,
going
to
be
doing
the
demos
we'll
get
started
and
there'll
be
QA
in
the
chat
and
after
the
demonstrations
is
done
that
we
plan
to
ask
questions
again
too.
So,
please
take
it
away.
Thank.
B
You
Diane.
Thank
you
very
much
for
giving
us
the
opportunity
to
present
at
the
open
shift.
Commons
webinar.
My
name
is
Ashish
I'm,
a
senior
director
of
product
management
at
Adi
networks
with
me
is
my
colleague,
Bhushan
PI
who's,
a
senior
Solutions
Architect
and
he
will
be
driving
the
demo
about
halfway
through
the
presentation
will
do
in
terms
of
the
agenda
today.
We'll
do
a
brief
introduction
to
avi
networks,
including
the
product
architecture,
and
then
we
will
deep
dive
into.
B
If
you
have
any
questions,
please
feel
free
to
ask
on
the
chat
window,
and
then
we
will
address
them
as
we
go
as
well
as
towards
the
end.
So,
let's
start
with
the
brief
introduction
to
avi
networks.
Avi
net
Brooks
is
about
four
and
a
half
five
years
old
company
based
a
headquarter
in
Santa
Clara
California,
but
with
offices
worldwide,
including
the
continental
US
Europe,
including
UK,
mainland
Europe,
Germany
France
and
the
Netherlands,
and
in
Asia,
including
India
and
Teesha,
and
so
we
have
a
global
footprint
with
R&D
and
customer
engineering
as
a
company.
B
What
we
do
is
Software
Defined
application
services,
layer,
4
layer,
7
services
that
starts
with
load,
balancing
or
service
proxy,
as
we
call
it
in
a
in
a
container
world,
but
also
application
security,
including
SSL
termination,
DDoS
detection
and
mitigation
of
Web,
Application
Firewall,
and
also
application,
visibility
and
monitoring.
So
all
of
these
layer
photo
layer,
7
application
services
are
built
into
the
same
product
and,
unlike
any
other
solutions
out
in
the
market.
B
We
have
customers
worldwide,
including
some
joint
common
customers.
So
we
have
customers
that
are
using
us
in
OpenStack
environment
with
Red
Hat.
We
have
customers
using
us
in
OpenShift
customers
such
as
Deutsche
Bank
and
Danske
Bank,
as
well
as
other
costs.
There
are
these
customers
running
in
production
today
with
Adi
and
Red
Hat
openshift,
and
also
we
have
customers
piloting
us,
customers
such
as
into
it
and
others
with
the
openshift
environment
and
all
of
these
customers
also
use
ansible
as
the
automation
tool.
B
So
what
is
the
problem
today?
Why
does
our
V
networks
exist?
Why
did
we
get
started
and
the
problem
that
exists
today
is
if
you
look
at
any
modern
data
center,
you
have
racks
and
racks
of
servers,
and
these
are
standard
x86
servers
on
which
to
deploy
applications.
There
is
no
snowflake
here
all
servers
at
x86
servers.
You
can
deploy
your
applications
on
any
servers.
You
can
start
with,
let's
say
10
servers
and
can
scale
out
to
15
or
20
or
scale
back
to
5
or
6,
as
the
load
increases
or
decreases.
B
Are
you
manage
them
as
a
pool
of
capacity?
Is
a
fluid
fluid
capacity
pool?
You
don't
have
any
specialized
hardware
for
applications
and
that
allows
you
to
do
automation
that
allows
you
to
have
a
telemetry,
that's
built-in
that
drives
their
animation
and
it
makes
the
entire
management
of
the
fabric
much
simpler
and
that's
how
all
the
modern
data
centers
are
built.
B
But
if
you
look
at
any
of
the
layer
for
the
layer,
7
services
and
especially
the
traditional
Hardware
load
balancers,
but
there
are
five
or
citrix
netscaler
or
eight
hands
they're
built
on
proprietary,
Hardware,
they're,
an
appliance
centric
model.
Even
if
you
look
at
the
virtual
appliances
that
are
appliances
which
means
you're
to
manage
them
as
individual
devices,
that
is
lack
of
automation,
skp
is
at
an
afterthought
and
you
can't
basically
automate
as
an
elastic
pool
of
capacity.
B
If
you
look
under
the
hood
of
a
traditional
appliance
based
load,
balancer
that
it's
a
monolithic
piece
of
software
running
on
a
proprietary
hardware,
in
that
software,
there
are
two
components:
a
management,
sash
control
plane
which
handles
the
configuration.
The
policy
etc
and
the
data
plane,
which
is
actually
doing
the
load,
balancing
or
other
security
services.
B
The
first
innovation
and
disruption
that
IV
Networks
did
was
applied,
software-defined
principles
where
they
separated
the
control
plane
from
data
plane,
and
so
we
have
a
concept
of
Adi
controller,
which
is
the
centralized
control
plane
that
manages
a
distributed
set
of
a
data
plane
entities.
We
call
them
service
engines
in
open
shift
paradigms.
You
can
just
set
this
your
OpenShift
master
and
then
your
individual
opens
open
ship
nodes,
but
same
concept
as
far
as
the
the
separation
of
control
and
data
plane
goes
there.
B
The
second
problem
we
want
to
solve
was
the
heterogeneous,
compute
environment.
Right,
you
might
have
applications
running
on
a
bare
metal
on
a
virtualized
environment.
Let's
save
it
KVM
on
OpenStack
or
you
running.
You
know
containers
with
docker
containers,
running
in
communities
or
an
open
shift
environment
or
joining
in
a
public
cloud
environment,
whether
it's
Google
public
cloud,
AWS,
Azure
or
anybody
else.
How
do
we
have
a
same
solution
with
operational
consistency,
feature
consistency
that
works
across
all
of
the
above
environment?
Well,
that's
a
problem
obvious
all
as
well.
How?
B
B
To
make
a
to
spin
up
these
darker
instances,
for
example,
or
VM
instances
automatically
based
on
demand
to
the
operational
flow,
is
that
you
communicate
to
the
other
controller
to
rest,
api
or
ansible
playbook,
that's
built
on
REST,
API
and
say:
I
want
to
have
load
balancing
services
for
these
applications
or
I'm.
Deploying
these
applications
do
everything
and
then
from
then
on.
The
other
controller
talks
to
appropriate
orchestration
engines
brings
up
the
appropriate
proxy
instances,
fill
them
out
as
the
traffic
grows
or
shrinks
them
as
a
traffic
shrinks.
B
So
these
service
engines,
which
are
your
proxies,
are
running,
are
sitting
in
line
with
your
traffic
right,
they're,
intercepting
the
TCP
HTTP
traffic
and
as
part
of
the
the
proxy
functionality
it's
collecting
hundreds
of
logs
and
metrics
every
minute,
pushing
it
up
to
the
RV
controller
and
the
avi
controller
runs
the
big
data
analytics
engine
and
not
only
to
present
a
nice
dashboard.
For
for
you
to
see.
What's
going
on
from
performance
invisibility
point
of
view,
but
the
controller
uses
that
information
in
a
closed-loop
fashion
to
make
automated
policy
based
changes
on
the
underlying
infrastructure.
B
So,
for
example,
if
it
sees
the
traffic
growing,
it
can
talk
to
the
OpenShift.
Api
is
and
and
auto
scale
your
infrastructure
or
auto
scale
out
or
scale
in
depending
on
the
policies,
but
the
fully
elastic
automated
services
fabric
and
it's
a
full
feature:
load
balancer,
a
full
feature
fabric.
So,
if
you
want
to,
if
you
with
the
questions
that
comes
to
your
mind
as
well,
does
it
have
the
the
features
that
my
f5,
the
Citrix?
Have?
B
Yes,
it's
not
an
open-source
H,
a
proxy
or
a
coop
proxy
like
basic
Lord
balance,
it's
a
full
enterprise-grade
with
l,
7,
l,
4,
l,
7,
caching,
compression
content,
switching
auto
scaling,
global
server
load,
balancing
SSL,
DDoS
bass,
you
name
it!
It's
an
enterprise-grade
solution,
think
of
avi
as
the
best
of
an
enterprise-grade
a
proxy,
a
load
balancing
solution,
married
with
the
elasticity
of
your
of
your
cope
proxy
or
rhe
proxy
or
nginx.
B
That's
built
in
with
integration
into
your
open,
shipped
environment,
plus
the
application
visibility,
the
log
analytics
of
security,
the
analytics
the
built-in
multi-tenancy
Bolton
service
discovery.
Centralized
management
are
in
addition
to
that.
The
features
that
we
talked
about
we'll
talk
more
about
this
as
we
go
to
the
demo,
but
a
common
question
that
gets
asked
is
well.
This
is
software.
What
about
performance
totally?
The
hardware
is
required
to
get
high
performance
well
that
submit
that
the
hardware
vendors
have
propagated.
That's
absolutely
not!
The
case.
Here
is
two
data
points.
B
First,
you
can
have
1
gig
of
encrypted
sustained
throughput
or
5
gig
of
total
unencrypted
throughput
2500
SSL
transactions
per
second
with
perfect
forward
secrecy
in
a
single
V
CPU
core
as
a
proxy,
and
then
this
Lego
block
of
your
proxy.
The
service
engine
can
be
one
core
to
core
or
a
full
bare
metal
server,
and
that
gives
you
more
than
what
your
hardware
appliances
give
you
in
that
form
factor.
The
second
part
it
horizonte'
scale
out
would
use
Lego
blocks.
B
You
can
build
lots
of
service
engines
in
a
scale
out
fashion,
centrally
managed
by
a
bit
controller.
It
can
reach
millions
of
SSL
TPS
terabytes
of
throughput
on
commodity
x86
hardware
and,
as
a
proof
point
one
of
our
customers
largest
one
of
the
largest
e-commerce
and
payment
companies,
did
an
experiment
where,
in
a
Google
public
cloud,
they
scaled
out
with
avi
a
single
application,
single
zip
to
1
million
SSL
TPS
0
to
1
million
in
8
minutes
running
on
commodity
Google,
x86
instances.
You
cannot
even
do
that
in
hybrid
appliance,
so
performance
is
a
non-issue.
B
Alright,
a
last
slide
on
the
use
cases,
and
then
we
switch
over
to
the
open
shift
specific
integration.
So
avi
works
across
your
traditional
load.
Balancer
deflesh
use
cases
where
we
work
on
a
bare
metal
or
a
VM,
taking
replacing
hardware
load,
balancers
saving
over
half
the
cost
to
our
customers.
Our
private
cloud
use
cases
at
OpenStack
with
ansible
automation
or
a
public
cloud
or
an
SDN
environment,
or
it
takes
in
point
today,
is
container
and
pass
solutions.
B
B
So,
let's
start
with
the
problem
statement.
First
right.
So
as
the
as
the
application
architectures
have
evolved
from
a
monolithic
application
to
distributed
micro
services
based
application,
you
have
a
problem
again
use
your
traditional
appliances
for
knots
out
or
as
open
ship
causes
out
the
layer
right
there
you
can
deploy.
Your
SSL
are
flowed
and
load
balancing
for
your
non-south
application.
But
what
about
east-west,
because
your
micro
services
base
architecture
there's
a
lot
of
East
flex
traffic
that
goes
on
and
your
traditional
appliances
don't
work,
because
it's
an
appliance,
even
it's
a
virtual
appliance.
B
So
the
common
solution
is
a
coup
proxy,
for
example
in
openshift
environment.
There
are
challenges
with
that
and
we'll
talk
about
that
in
a
minute.
What
Ivy
has
done
is,
if
you
look
at
the
infrastructure
stack
of
a
container
services
fabric,
you
have
your
server
layer
as
the
color
virtual
doesn't
matter.
You
have
your
network
layer
with
or
without
Sdn,
and
then
you
have
your
l4
to
l7
layer,
and
on
top
of
that
you
have
the
kubernetes
and
open
shift
for
the
scheduling
and
the
resource
management.
Rv
networks
Fitz
fills
in
the
gap.
B
That's
in
the
middle
when
you
are
running
on
Prem
or
on
public
cloud,
doesn't
matter,
but
from
service
discovery
to
service
proxy,
to
application,
visibility
and
performance
monitoring
to
micro
segmentation
at
the
application
level
and
security
at
l7
to
DDoS
to
SLA
based
auto
scaling
by
integrating
with
Reuben
and
user
OpenShift.
That's
the
gap
that
avi
provides
an
enterprise-grade
layer
for
the
layer,
7
services
solution
and
we'll
go
into
now
or
the
next
ten
minutes
before
the
demo
we'll
go
into
the
detail
architecture.
B
So
what
is
the
before
and
after
right?
So
if
you
look
at
the
before,
if
you
look
at
either
a
traditional
hardware
based
solutions
or
if
you
look
at
a
combination
with
an
open-source
solutions,
what
are
the
challenges?
First
of
all,
you
need
multiple
tools
for
your
router
for
the
knots
out
load,
balancer,
typically
using
a
chair
proxy
front-end
by
the
hardware
load
balancer
for
SSL
offload,
but
that's
a
common
example.
There
are
challenges
with
that
nature.
Proxy
itself
is
not
a
chip.
You
need
a
separate,
a
daemon
to
manage,
monitor
it's
it's
heart
beats.
B
It
doesn't
have
a
enterprise
with
features,
it's
a
very
basic
load
balancer
and
then,
when
you
combine
that
with
the
hardware
load,
balancer
is
too
expensive
and
complex,
and
then
you
receptor
tools
for
your
east-west
typically,
you
scoop
proxy
to
proxy
itself.
Is
a
probabilistic
load
balancer,
it's
not
delve
into
l7
doesn't
even
do
East
to
SSL
and
then,
if
you
combine
that
with
a
separate
service,
discovery
solution
for
DNS,
centralized
management,
hardware
load,
balancer,
global
server
load,
balancing
these
multiple
tools,
add
professional
complexity
and
higher
cost.
B
How
does
avi
solve
this
problem?
Avi
has
one
solution
that
does
all
of
the
above.
It
does
service
discovery,
service,
proxy,
so
local
and
global
load,
balancing
application,
Maps
application
performance,
monitoring,
security,
micro
segmentation,
auto
scaling
and
so
architecture
wise.
How
does
it
work
so?
B
We
saw
earlier
in
the
architecture
slide,
we
have
a
centralized
controller
and
a
distributed
data
plane
the
service
engine.
So
the
way
it
looks
like
is
the
that
is
the
Adi
controller
that
is
deployed
typically
as
a
container
typically
on
the
open
shift
master,
but
it
can
be
outside
and
are
these
service
engines,
one
pod
per
your
openshift
node,
so
be
service
engine
runs
as
a
container
in
a
pod
on
each
of
your
open
shift
nodes?
Okay!
B
So
let's
go
through
the
light
in
the
life
of
so
from
day,
0
to
day
1
to
ongoing,
and
then
we
go
into
the
demo
to
show
you
how
this
works
right.
So
I'm
going
to
walk
you
through
the
steps
of
how
the
integration
works
and
out
the
flow
works
and
show
you
that
exactly
in
the
live
demo
day,
0
the
way
it
works
is
on
step
1.
B
On
a
V
controller,
you
configure
the
openshift
credentials,
so
you
deploy
a
V
controller
and
you
as
a
container
and
you
you
give
it
access
to
the
OpenShift
master.
That's
it
that's
the
only
config
you
ever
have
to
do
another
from
then
on
avi
controller
talks
to
open
shift
master
figures
out
how
many
openshift
nodes
are
running
in
the
environment
and
automatically
brings
up
avi
service
engines
as
other
containers
or
pods
in
each
of
the
nodes.
B
Then,
what
we're
going
to
show
you
is
when
you
create
a
deployment.
Let's
app
one
in
openshift,
avi
automatically
listens
to
the
notifications
and
pulls
configuration
from
open
shipmasters
automatically
creates
these
corresponding
services.
Creates
a
whip,
creates
a
DNS
record
fully
automated,
ok,
so
on
day
zero
you
configured
them
at
a
controller
with
the
master
credentials
and
from
then
on,
as
you
do
deployments,
are
the
takes
care
of
everything.
B
If
your
GS
all
be
same
thing,
you
just
do
it
you
do
it
oops,
sorry
about
that
you
do
it
on
each
of
the
data
centers
and
then
you
do
GSLV
configuration.
So
again
you
do
the
deployment
app
one
in
data
center,
one
and
data
center.
Are
we
automatically
three,
the
corresponding
local
zips?
Are
the
automatically
creates
the
global
service
for
GSLV,
covering
both
the
VIPs
avi
automatically
thinks
that
all
the
followers
and
start
health
monitoring
the
local
lives,
so
even
for
GSLV
zero
touch.
B
So
how
does
the
traffic
flow
work
so
now
that
the
now
that
the
the
deployment
has
been
done
and
and
your
services
have
been
created,
let's
look
at
the
traffic
flow.
How
does
our
we
provide
these
set
of
service
discovery,
service,
proxy
capabilities?
So,
let's
say
an
external
user.
Let's
talk
about
not
self
traffic
management,
so
this
is
that
out
part
of
it.
B
Let's
talk
about
east-west
traffic
management.
So
what
happens
when
an
internal
service
is
trying
to
reach
another
service
for
a
froot
through
DNS,
so
similarly,
avi
is
going
to
perform
the
not
Yaffe
the
service
is
going
to
perform
a
DNS
query
for
that.
East-West
application,
recursively
fits
the
GSLV,
the
terms
of
F
and
these
rest
traffic
also
is
managed
same
way.
So
basically,
it's
a
client-side
proxy.
B
So
the
way
it
works
locally
is
that
the
the
part
that
is
doing
the
request
is
the
traffic
is
intercepted
by
the
local
proxy,
that's
running
on
avi
service
engine
and
the
service
engine
that
decides
who
the
corresponding
best
part
is
to
spawn
so
because
we
have
a
service
engine
running
on
every
part.
This
is
the
clime
side
proxy.
Just
like
cool
proxy.
Are
we
service
engine
basically
replaces
cool
proxy.
B
So,
every
time
the
request
is
sent
out
from
the
from
the
requesting
part
that's
intercepted
by
the
local
up
service
engine
proxy
and
then
it's
load
balance
in
a
stateful
fashion.
So,
unlike
cook
proxy,
which
is
a
probabilistic
packet
distributor
in
this
case
of
either
fully
stateful
proxy
and
it
it
does
the
health
checks
and
it
makes
sure
that
the
load
is
evenly
distributed.
It
can
handle
SSL
offload,
it
can
do
all
l7
policies
and
rules
like
URL,
rewriting
rate
limiting
URL
base.
Redirects
everything
you'd
expect
in
a
enterprise-grade
load.
B
This
also
allows
you
to
then
go
beyond
just
basic
a
proxy
services
and
any
great
with
your
CI
CD
and
all
your
Bluegreen
deployments.
Let's
say:
you're
deploying
applications
version
2
and
you
want
to
do
a
policy
based
switchover
from
a
blue
version
to
a
green
version
of
version,
one
to
version
two.
Well,
you
all
you
have
to
do.
Is
you
create
through
annotations?
B
You
create
policies
on
ABI
and,
as
what
I
can
do
is,
you
can
configure
say,
send
ten
percent
of
traffic
first
to
the
new
version
and
if
everything
looks
good,
then
automatically
start
sending
everything
to
the
new
version.
If
it
doesn't
look,
good
is
a
fallback
to
the
blue
version,
so
you
can
do
that
programmatically
based
on
policies
through
through
this
solution
and
not
disruptively,
so
existing
connections
allow
to
drain
the
new
connections
switch
over
to
the
new
version.
B
B
Only
certain
services,
only
certain
internal
applications
can
access
those
external
service,
and
you
want
to
you
want
you
want
to
force
that
policy
unless
you
have
a
firewall
in
the
middle,
that's
also
controlling
the
access
to
that
shared
resource,
but
what
you
can
do
with
avi
is
that
create
this
external
part
called
avi
pod
that
what
that
does
is
through
policies.
It
says
only
Blu
service
is
allowed
to
access.
The
external
resource-
and
we
also
do
an
app
source
netting
to
a
to
a
to
a
single
IP
address
or
in
the
firewall.
B
You
have
to
open
up
a
single
IP.
You
don't
have
to
open
up
multiple
IP
addresses,
and
so
it
does
two
things.
It
allows
you
to
simplify
a
firewall
configuration
at
the
same
time
it
allows
you
to
control
which
service,
in
this
case
a
blue
service,
can
access
the
external
resource
and
the
red
service
cannot
alright.
B
So
with
that,
let
me
pause
here
hand
the
control
over
to
Bhushan,
where
we
will
do
a
detailed
demo
about
everything
that
we
just
talked
about
step-by-step
starting
from
scratch,
where
you
have
an
open
ship,
cluster
and
avi
controller
deployed
and
will
spin
up
a
V
service
engines.
What
creates
the
deployments-
and
these
run
some
traffic
Bhushan
over
to
you.
B
A
A
C
Okay,
so
this
is
what
we
are
aiming
to
do
in
this
demo
today
or
we
are
going
to
deploy
services
on
OpenShift,
and
this
is
what
is
going
to
look
like.
We
have
a
virtual
service
which
corresponds
to
a
service
and
openshift,
which
has
the
vape
on
it,
which
is
placed
on
one
of
the
service
engines
running
on
on
one
of
the
cluster
nodes.
This
service
virtual
service
can
have
one
or
multiple
pool
members
and
each
pool
can
have
multiple
back-end
pots.
So,
let's
start
with
our
clean
set
up.
C
As
you
see
out
here,
we
have
a
OpenShift
system
with
multiple
projects
on
it
and
our
we
controller
Rich's
right
now.
We
don't
have
anything
on
it.
It's
completely
clean
set
up
applications,
no
witches.
So
this
is
nothing
and
I
also
have
a
dashboard
to
run
some
rest
api's
to
either
the
open
shift
master
or
the
controller
to
provision
some
services
quickly.
So,
let's
start
with
the
first
day,
zero
configuration
that
is
setting
up
the
openshift
cloud
and
let's
go
back
and
check
out
our
infrastructure.
C
So,
as
you
see
on
your
reagent
here,
this
was
none,
but
now
we
have
configured
the
openshift
cloud
out
here
so
behind
the
scenes,
what
it
does
is
configure
the
master,
node,
IP
and
authentication
token
set
the
SE
deployment
policies
are
telling
work
from
where
to
get
the
image,
how
to
deploy
a
vector
deploy
and
on
the
application
side.
It
also
considers
the
ipam
and
dns
profile.
So
for
this
demo
purpose
we
are
using
our
internal
item
and
our
dns
for
most
east-west
and
north-south
to
our
virtual
services.
C
C
If
you
go
to
infrastructure,
we
see
that
the
service
engines
are
also
up.
The
open,
shipped
cluster
has
four
nodes.
One
master
and
three
are
three
minions.
Our
node
and
avi
controller
goes
and
deploys
a
service
engine
on
each
node.
Our
controller
also
has
the
intelligence
to
disable
the
service
engine
on
nodes
which
are
are
not
scheduled
for
parts.
C
For
example,
the
master
node
out
here
is
disabled,
has
the
service
engine
disabled
and
if
you
go
back
to
the
DNS
virtual
service
use,
we
see
that
we
are
listening
on
one
of
the
for
the
north-south
are
in
the
north-south
network
and
it
will
start
our
serving
for
all
the
experience
of
different
services
on
on
the
OpenShift
right.
So
let's
go
to
admin
project
right
now.
As
you
see,
there
are
no
applications
running
so
let's
go
and
start
some
applications
on
openshift
side.
C
So
when
I
click
that
button
on
the
demo
controller
page,
what
it
did
was
that
it
ran
a
REST
API
to
openshift
master
on
deploying
the
applications
and
deployment
conflicts
which
in
turn
deployed
the
application
parts.
As
you
see,
and
as
these
applications
come
up,
we
automatically
syncs
those
and
provisions
corresponding
virtual
services
automatically,
and
this
is
them
on
all
of
those
service
engines
you
saw
earlier.
So
let's
wait
for
the
applications
to
come
up.
C
Or
it
looks
like
all
of
them
are
already
up
and
green,
as
you
see
out
here,
of
all
of
the
applications
are
have
IP
in
the
172,
submit
that
the
h2s
subnet,
except
for
photo,
which
is,
are
not
south
facing
service.
It
has
an
IP
in
the
north,
south
subnet
houses
are
or
happens
automatically
using
our
internal
I
Pam.
The
way
we
are
provisions,
this
virtual
services
is
through
annotations
on
the
service
of
which
we've
of
which
you
can
trigger
an
open
shipped.
C
So
if
you
go
to
one
of
the
services
and
see
the
annotations
for
for
that
service,
all
the
only
thing
that
app
developer
has
to
do
is
provide
a
label
called
a
V
proxy
and
in
the
value
of
the
playable,
specify
what
type
of
load
balancing
it
requires.
Is
it
a
regular,
HTTP
or
HTTPS
or
l4
service?
What
kind
of
load
balancing
our
algorithm
requires?
Is
it
round-robin
or
least
connections,
or
any
other
option
which
we
have
and
avi
automatically
reads
those
labels
or
annotations
and
provisions
corresponding
clips?
So
it's
zero
touch
on
avi
side.
C
So
since
we
take
in
line
with
the
traffic,
we
know
what
the
application
is
talking
to
whatever
application
and,
as
you
see
out
there
in
a
while,
we
monitor
the
traffic
coming
into
your
application
or
north-south
application,
and
we
also
trace
it
back
to
all
of
the
applications
as
it
flows
through
our
your
application
stack.
For
example,
the
client
is
accessing
photo
and
photo
intern
is
accessing.
Other
applications
are
already
stretched
with
that
like
stocking
card
inventory
and
check
out.
C
C
We
see
that
this
application
is
getting
traffic
from
three
other
virtual
services
and,
as
we
automatically
populate
those
virtual
services
into
the
whitelist
from
this
day
onwards,
if
you
just
save
this
configuration
and
secure
this
vs,
no
other
application
will
be
able
to
talk
to
this.
So
to
demonstrate
this
in
real
time.
Let's
just
move
one
of
the
application
out
of
the
whitelist,
and
in
some
times
we
will
see
that
the
application
which
removed
the
arrow
will
turn
dead,
which
indicating
that
all
the
traffic
from
that
application
is
has
been
blocked,
while
the
hook
is.
C
The
user
can
also
see
the
same
things
in
a
graphical
manner,
on
the
analytics
page
for
each
and
every
virtual
service,
we'll
give
some
antidote,
so
you
can
see
end
to
end
timing.
Throughput,
open
connections,
number
of
connections,
requests
on
all
other
metrics
out
here,
also
under
logs.
You
can
see
a
sum
of
each
and
every
request
coming
into
the
application
for
examples
out
here.
C
If
we
write
on
this,
one
is
just
a
simple
HTTP
EVs,
but
if
you
move
to
our
photo
calm
which
is
or
not,
South
I
have
configured
it
as
a
secure,
HTTP
or
HTTPS
vs.
So
on
this
we
can
also
see
the
security
of
analytics
for
this
virtual
service,
or
we
are
aware
we
can
see
how
much
percentage
of
graphic
is
RSA
or
PR
PC.
You
can
also
see
right
now.
We
don't
have
any
attacks
happening
on
this
service,
but
if
any
attacks
happened,
we
can
also
see
that
that
comes
out
here.
C
C
B
C
So,
moving
back
to
the
web
we
saw
initially
at
the
beginning
of
the
demo
part
is
this
demo
is
if
we
have
much
richer
traffic
to
show.
So,
as
you
can
see
on
the
end-to-end
timing
side,
we
can
show
you
a
summary
of
what
the
client
response
our
time
looks
like
while
the
server
response
time
looks
like
what
the
data
transfer
trying
was.
How
fast
is
the
application
responding
and
it's
not
just
for
a
given
current
time,
but
you
can
view
it
across
multiple
time
windows.
C
Like
you
see
out
here,
we
are
viewing
for
the
past
six
hours
and
you
see
between
8
a.m.
to
9
a.m.
we
saw
a
certain
search
and
the
end-to-end
timing.
We
saw
some
of
our
clients
must
have
in
the
application
slow
down
in
this
case,
or
usually
the
blame,
goes
to
the
networking
team,
our
but
using
August
UI.
You
can
clearly
see
that
there
is
no
change
relatively
no
change
on
the
client
ITT
site,
but
app
responds
change
drastically.
C
So
maybe
it's
the
actually
the
application
which
is
behaving
a
bit,
obviously
causing
the
application
to
slow
client
experience
to
slow
down.
In
addition
to
this,
because
we
can,
like
I
said
we
can
see
each
and
every
request
coming
in
and
out
of
your
application,
we
classify
those
requests
into
two
types:
significant
and
non
significant
blocks.
The
significant
ones
are
the
one
which
either
end
up
in
four
hundred
orders
in
some
kind
of
error
and
or
takes
a
really
long
time,
basically,
something
which
needs
a
which
can
help
debug
problems.
C
Non
significant
ones
are
the
one
which
breeze
through
a
really
easier,
with
no
errors
at
all,
like
regular
200
requests.
So
all
we
open
one
of
these
requests,
you
can
see
a
lot
more
data
about
what
about
the
actual
client
is
located.
What
kind
of
mess
is
it
using?
What
kind
of
device
is
reusing?
What
another
l7
security
power
metrics
like
what
TLS
version?
C
What
certificate
type
is
is
using
and
again
we
can
see
the
planner
for
from
what
client
IP
who,
which,
which
service
engine
handle
the
traffic
on
what
port,
and
also
on
the
backend
side,
which
web
server
handles
the
handle,
the
request
we
can
also,
if,
if
you
want,
you
can
also
dig
down
even
deeper
and
each
and
every
header
on
the
request.
All
these
logs
are
captured
real
time,
but
can
be
either
enabled
or
disabled
to
whenever
required.
C
Well,
you
see
that
if
you
go
to
end
to
end
timing,
you
see
that
most
of
the
clients
got
service
between
with
a
relatively
low
amount
of
latency,
but
some
of
them
are
seeing
about
a
second
of
delay
of
further
response.
If
we
just
click
on
this,
we
automatically
filter
out
all
the
requests
which
ended
up
getting
more
than
800
milliseconds
of
delay.
If
you
see
that
most
of
this
are
have
relatively
high
client
RTT
times.
C
So
if
we
sort
this
out
based
on
safety
stock
based
on
location,
we
see
that
99%
of
this
traffic
is
coming
from
India.
So
maybe
the
band
link
is
the
culprit
out
here,
so
this
in
seconds
we
are
able
to
quickly
pinpoint
where
the
problem
is.
This
was
from
the
networking
point
of
view,
but
even
for
the
application
administrator
you
can
just
if
he
sees
a
lot
404
error
scars
on
this
on
his
application.
C
You
can
just
click
on
404
and
see
all
the
all
the
logs
that
ended
up
in
404,
and
then
he
can
sit
this.
This
information
based
on
server
IP
addresses,
and
he
knows
which
server
is
the
application
editing
out
on.
So
even
our
even
debugging
the
application
problems
is
really
easy.
Using
when
you
use
avi
on
the
security
side
like
I
was
talking
to
earlier,
we
can
show
different
different
percentages
of
client
using
different
types
of
TLS
versions:
different
types
of
certificates.
We
also
give
you
a
real-time
score
of
how
your
application
is
performing.
C
B
Illusion,
thank
you
very
much
for
a
detailed
demo.
Hope
that
gives
you
a
glimpse
of
what
you
can
do
today
and
and-
and
it
has
more
things
that
we
can-
we
can
show
you
if
you
are
interested
in
a
one
on
one
one
on
one
environment,
including
doing
things
like
auto
scaling,
capabilities,
etc.
So
let
us
wrap
up
and
then
we
can
take
it
to
any.
B
B
It's
a
single
solution
that
takes
care
of
all
of
the
above
capabilities,
including
integrated
IPAM
and
dns,
or
service
discovery,
fully
automated
service
proxy
with
service
creation,
application
map
and
analytics
and
troubleshooting
capabilities
that
you
saw,
and
what
this
allows
you
to
do
is
to
have
a
full,
a
much
simpler
experience
with
the
very
few
moving
parts
of
the
same
avi
solution
that
does
all
of
the
above.
You
don't
need
a
separate
Hardware
load,
balancer
for
GSLV
or
SSL
in
a
software.
B
It's
a
proxy
or
koop
proxy
for
east-west,
which
again
doesn't
give
you
anywhere
close
to
what
are
the
offers
and
that
results
in
significant
capex
and
OPEX
reduction.
Given
the
simplification,
as
well
as
elimination
of
Hardware
load,
balancers
and
lower
resource
consumption,
there
was
a
question
on
the
chat
that
what's
the
footprint,
the
footprint
is
as
small
as
one
B
CPU
and
1
to
2
Giga
memory
and
the
beauty
is
that
works
in
any
environment.
It
weren't
on
Prem
works
in
public
cloud.
B
It
works
with
openshift,
it
works
with
kubernetes,
it
works
in
AWS
as
your
GCD
etc.
And,
finally,
the
thing
that
we
didn't
have
time
to
cover
today,
but
I'll
just
plug
in
here,
there's
a
ransom
automation.
So
if
you
were
to
go
to,
if
you
were
to
go
to
an
answerable
repo
in
github,
what
you'll
notice
is
that
that
is.
We
have
a
full
ansible
modules,
as
you
can
see
here
for
days.
You
know
deployment
for
software
avi,
controller
deployment
for
other
service
engine
deployment
for
VIP
provisioning
in
a
non
OpenShift
environment.
B
If
you
have
any
questions
reach
out
to
me
and
achieve
shared
avi
networks,
calm
or
edward
sharpe
who's
in
our
business
development
department,
and
then
let's
take
some
questions,
so
the
question
is:
is
it
possible
to
test
a
beyond
openshift
origin?
The
answer
is
yes
ambush
and
you
want
to
spend
any,
incidentally,
have
any
color
on
that
all.
C
A
A
Their
hope
in
using
this
in
the
background
unbeknownst
to
me
so
I'm
going
to
have
to
reach
out
to
them
and
that
team,
because
this
just
seems
like
something,
that's
very,
not
I,
wouldn't
say
completely
lightweight,
but
the
benefits
you
get
from
running.
It
are
just
mind-blowing
as
opposed
to
just
simple
load
balancing
then
I've
played
with
them,
but
yeah.
This
been
a
very
great
presentation.
So
folks,
if
you
have
questions,
please
do
reach
out
to
the
team
here
and
we
will
looking
to
see
if
there's
any
other
questions
online
in
the
chat.
A
I
think
everything
got
answered
in
the
chat
from
a
performance
standpoint.
It
looks
like
this
is
really
not
anything
that
any
serious
overhead
so
I
definitely
think
I'd
suggest
you
give
it
a
try
and
give
him
a
call
and
I
would
love
to
talk
further,
maybe
with
some
of
your
customers
to
get
them
to
tell
their
their
stories
as
well,
because
I
think
it's
great
with
the
demo
sets,
but
also
to
get
something
at
scale,
will
be
really
wonderful.
So
we
can
get
that
it'll.
A
This
is
this
was
great,
so
everybody
will
be
back
on
next
week.
Again
we
have
a
couple
of
events
coming
up
soon.
The
the
first
big
event
will
be
that
1.7
is
coming
out.
So
we'll
have
a
number
of
talks
coming
up
on
that
we're
going
to
continue
our
theme
this
month
with
monitoring
of
all
ilk,
so
there'll
be
more
monitoring,
talks
and
they'll
post
this
and
the
slide
deck.
A
So
if
you
guys
can
send
me
a
PDF
version
in
your
slide
deck,
we'll
post
this
video
and
this
slides
up
on
the
open
ship
blog
more
than
two
days,
it
should
be
up
there
and
running.
So
if
you're
listening
to
this
virtually
later
on,
please
do
reach
out
and
join
the
mailing
list
or
join
our
slack
channel,
find
us
on
Commons,
openshift,
org
and
really
a
great
presentation
from
avi.
Today
my
mind
is
a
little
blown
there's
a
lot
of
details
there
and
I
think
this
is.