►
Description
In this briefing, DP Ayyadevara, Savithru Lokanath and Vinay Rao from Juniper Networks provide an update to the Juniper Contrail and OpenShift integration. In the previous gathering (session# 89), we demonstrated the value of Contrail as a multi-tenant SDN for OpenShift automating the full lifecycle of networking virtual domains, tenants, subnets, and security policies, all in sync with the lifecycle and workflow of OpenShift users and application builds, deployments and services.
In this demo, we will discuss an application build environment use case along with support for Network Policies leveraging Contrail Security integration. Contrail Security minimizes risk to the applications that run in multi-cloud environments. It discovers application traffic flows and drastically reduces policy proliferation across different environments. Contrail Security can also be used for easy monitoring and troubleshooting of inter- and intra-application traffic flows.
Guest Speakers:
- DP Ayyadevara (Director, Product Management for Contrail@Juniper)
- Savithru Lokanath (Solutions Engineer, Contrail@Juniper)
- Vinay Rao (Solutions Engineer, Contrail@Juniper)
A
B
So
what
we
will
do
today
is
talk
about.
You
know
we
had
a
session
early
last
I
mean
last
year
in
August,
where
we
them
kind
of
gave
an
introduction
to
contrail,
as
well
as
how
we
have
integrated
into
kubernetes
as
and
OpenShift
and
CNI,
and
we
kind
of
give
a
demo
right.
So
what
we
want
to
do
this
time
is
kind
of
follow
up
that
talk
about
what
advanced,
how
we
have
further
enhance
the
integration
and
what
kind
of
features
we
are
brought
into
it
right.
So
that's
what
we
will
focus
on.
B
There
might
be
some
folks
in
the
audience
who
did
not
listen
to
our
four
sessions.
So
I'll
spend
a
couple
of
minutes
just
introducing
the
topic
again.
Okay,
so
there'll
be
a
brief
instruction
of
two
contraire
networking
will
follow
it
up
with
the
openshift
integration
and
then
the
focus
is
going
to
be
on
network
policy
implementation.
How
we
have
implemented
that
the
country
and
security,
okay
and
then
we
follow
it
up
with
the
demo
and
I
know
most
folks
would
be
more
keen
to
get
to
the
demo
than
the
slide.
So
let's
get
the
started.
B
Okay,
so
first
thing
introduction
to
contra
networking,
so
business
fresh
of
the
press,
I,
don't
know
how
many
of
you
have
seen
this.
So
this
week
we
had
the
open
networking
summit
in
Los
Angeles,
and
one
of
the
announcements
that
came
out
two
days
back
is
real
thankful
to
the
Linux
Foundation
for
accepting
open
contrail
into
the
foundation,
and
you
know
when
you
join
an
open
foundation
like
the
Linux
Foundation,
one
of
the
things
we
have
to
do.
Is
we
let
go
up.
B
B
Software,
Defined,
Networking
solution
and
open
source
based
simply
and
we
have
an
open
source
community
and
when
we
started
off
our
focus
was
primarily
on
virtual
networking
with
overlays,
where
you
know
in
virtualized
compute,
you
extend
your
virtual
networks,
okay,
but
it
has
evolved
into
a
lot
more,
so
we
have
gone
beyond
I,
don't
want
to
call
it
an
SDN
anymore,
because
it's
beyond
networking
alone,
it's
also
about
intent,
based
policies
and
application
policies
and
security.
Okay,
and
through
this
presentation
and
the
demo
you'll
see
some
of
the
key
features
of
contrail.
B
So
what
I'm
showing
here
on
this
slide
is
contrary
architecture
components.
There
are
two
key
components:
there's
the
control
plane
and
the
data
plane.
What
you
see
on
the
top
here
at
the
blue
box
is
a
con
is
the
representation
of
a
controller,
and
the
controller
is
on
multiple
roles.
It
takes
a
control,
plane
role,
it
takes
the
configuration
role
and
it
also
takes
the
help
text
role
and
from
a
control
claim
perspective.
B
Contrary
the
bgp
based
solution,
bgp
as
a
control,
plane
supports
really
high
scale
and
very
efficiently,
and
so
bgp
stands
for
border
gateway
protocol
right.
So
it's
a
very
popular
routing
protocol
from
again
controller
perspective
for
high
availability.
You
can
have
you
know
multiple
controller
instances,
all
of
them
being
active
and
the
the
key
set
controller
and
unit
not
bound.
We
expose
REST
API
through
which
we
also
integrate
with
our
you
know
our
own
UI
using
the
same
rest,
APIs,
and
there
are
a
lot
of
other.
B
You
know
we
have
the
NCAP
eyes
and
so
on.
Okay,
so
that's
the
controller
aspect.
When
you
come
to
the
data
plane,
that's
where
our
secret
sources
or
the
token
sources,
it's
not
really
that
secret.
What
we
refer
to
as
V
doubter,
okay,
so
B
router
can
run.
We
call
it
V
doubter,
but
not
it's
not
doing
just
routing.
It's
also
doing
enforcement
of
policies
and
also
reporting
you
know
for
analytics
and
monitoring
okay.
B
So
we
doubter
on
bare
metal
compute
in
the
sends
in
a
non
which,
let's
compute,
we
don't
can
still
run
in
the
for
the
data
in
a
plane
functionality.
We
router
can
run
in
the
hypervisor
in
the
case
of
virtualized
compute.
We
support
kb
m
and
in
the
case
of
k,
vm
it
runs
in
kernel
mode
in
the
case
of
non
k,
vm
metrons
as
a
vm,
okay,
and
when
it
comes
to
workloads,
we
support
different
types
of
workloads,
including
virtual
machines
or
docker
containers,
and
so
on.
B
In
the
case
of
accelerated
data
path,
requirements
for
some,
let's
say,
lay
density,
latency-sensitive
applications
like
financial
services
or
even
some
other
telcos
telco
use
cases.
We
have
the
ability
to
run
our
forwarding
entity
called
without
or
even
on,
the
Nick
on
the
compute
right.
These
Nick's
are
called
smart
next.
Okay.
Now
this
is
delivered
to
you
through
contra
networking.
B
Today
you
also
have
the
ability
to
run
read
out
or
in
a
public
cloud
instance,
for
example,
that
you
take
AWS,
it's
an
easy
to
instance,
ok
and
the
same
with
measure
and
GCP,
and
there
are
two
ways
we
work,
but
we
can
integrate
with
public
cloud
environments.
You
can
either
run
our
forwarding
entity
on
each
of
the
virtual
instances
or
you
can
just
have
a
set
of
gateways
to
the
VPC
where
within
the
Instituto
instances
or
within
these
virtual
instances,
you
don't
have
to
run
without
you.
B
B
And
then
so
you
we
have
been
talking
about,
you
know
virtual
instances.
We
have
talked
about
public
cloud
instances
and
containers
and
bare
metal
servers
and
so
on.
At
the
same
time,
you
know
there
are
a
lot
of
use
cases
where
there
are
high
scale
data
centers,
where
there's
a
need
to
run
overlays
to
your
top
of
the
rack
switches
in
a
data
center.
Let's
say
you
have
a
rack
of
computers
and
you
have
these
top
of
the
rack
switches
and
you
may
want
to
have
overlays
between
these
couple
of
X,
witches
and
so
on.
B
This
request
has
a
need
to
be
able
to
dynamically
provision,
these
network
elements,
or
even
that's
a
physical,
firewalls,
etc
right,
and
we
have
the
ability
to
do
that
too,
and
that's
what
we
call
control
networking
fabric
okay,
so
this
is
a
will,
be
an
announcement
soon
and
a
couple
of
in
a
month
where
we
land
operate
a
lot
more
about
how
we
are
working
with
network
elements
directly
as
well.
Okay.
So
this
is
just
a
high
level
overview.
B
In
terms
of
there
are
a
lot
of
different
connectivity,
security
and
manageability
solutions
out
there.
What
is
it
that
contrail
provides?
Contrary-To
gives
you
a
seamless
ability
to
extend
your
connectivity
across
multiple
clouds
and
multiple
form
factors
of
your
clouds,
etcetera
right
so
be
the
telco
pop
me
to
manage
private
plug
or
beat
an
enterprise,
private
cloud
or
a
public
cloud.
We
should
be
able
to
provide
secure
security,
connectivity
and
manageability.
B
All
entire
compute
environment
spreads
across
all
these
footprints.
A
PST
has
a
single,
complete
fabrications,
etc.
You
really
don't
have
to
care
about
where
exactly
it's
your
computer
environment
right.
So
that's
the
key
message
out
here
and,
as
you
can
see,
we
support
a
lot
of
different
types
of
orchestrators
natural,
one
of
the
key
things
being
open
ship.
B
Okay.
So
let's
get
to
the
weight
of
this,
how
does
count
really
integrate
with
openshift?
As
you
can
see,
this
is
a
basic
kubernetes
or
architecture
right,
there's
an
API
server,
scheduler
and
then
there's
a
cubelet
on
the
compute
node
and
you
you
know
you
bring
up
these
pods
on
the
computer.
The
minions
and
the
objective
is
to
provide
connectivity
right.
So
what
we
have
in
our
integration
is
this
notion
of
a
cube
network
manager.
The
cube
network
manager
is
in
the
listener
for
the
API
server.
B
Then
there
are
pod
create
and
any
such
actions
take,
and
you
know,
cube.
Network
manager
listens
to
it
and
come
and
communicates
to
our
control
controller,
okay,
so
sort
of
the
sequence
of
steps
as
follows.
Right
so
when
a
part
is
being
brought
up
on
a
particular,
it
scheduled
and
being
brought
up
on
a
particular
minion
or
let's
take
the
example
of
pod
one
right.
B
All
right
so
getting
to
okay.
How
exactly
do
these
objects
map
right?
I
mean
we
wanted
to
be,
have
read
the
first
time
we
that
kubernetes
integration
was
actually
back
in
2015-2016
thing
more
towards
2016
and
what
we
did
at
that
time
as
we,
the
first
implementation
use
some
custom
label.
That's
it
recipe
for
the
CNI
era.
So
we
can
answer
implementation
last
year
early
last
year
and
with
control
photo
tell
what
we
did
is
we
used
all
the
native
kubernetes
native
and
OpenShift
native
constructs.
B
We
didn't
want
to
define
anything
custom
because,
obviously,
in
the
case
of
user
experience,
there's
a
disruption
in
the
workflow
and
there
are
a
lot
of
other
inefficiencies.
So
what
we
do
here
is
we
are
showing
direct
object.
Mapping
between
open
ships,
the
contrail
object
model,
just
to
kind
of
emphasize
that
we
would
be
basically
on
or
all
the
first
class
objects
that
are
present:
okay,
so
namespace
maps
to
something
to
the
notion
of
project
or
a
shared
project
in
contrail.
The
notion
of
a
pod
is
mapped
to
something
called.
B
A
virtual
machine
interface
object
within
contrail.
It's
called
the
BMI,
but
it's
not
restricted
to
virtual
machines,
which
is
representation
of
the
workload.
The
service
contract
in
kubernetes
maps
to
what
we
refer
to
as
an
equal
cost.
Multi
part
load
balancers,
those
are
familiar
with
routing
would
definitely
be
familiar
with
ecmp,
and
this
equal
cost.
Multi
pod
load
balancing,
happens
natively
through
our
data
pod.
You
don't
have
to
have
a
load
balancing
instance
or
anything
like
that,
and
it's
customizable
how
you
want
to
really
load
balance
and
so
on.
B
So
services
implementer
is
a
logical
construct
for
us
and
it's
implemented
in
the
data
path
ingress
in
the
case
of
kubernetes
master.
We
package
at
your
proxy
load
balancer,
but
we
can
work
with
any
other
ingress
back
in
as
well.
Okay,
we
support
open
share
out
there
too,
and
when
it
comes
to
network
policy,
translates
to
firewall
policy
and
B
will
go
a
little
bit
more
detail
into
network
policy
in
a
minute.
B
So
before
I
go
into
Combinator's
or
open
ship
net,
you
know
network
policy
integration
and
how
we
deliver
that
through
how
we
integrated
that
with
content
security.
The
couple
of
things
I
wanted
to
highlight
about
control
security
right.
So
when
you
one
out,
through
our
experiment,
experience
and
a
lot
of
SAS
providers
where
their
cloud
is
very
critical
to
their
business,
we
gain
valuable
experience
in
terms
of
policies
and
how
they
are
managed
and
how
they
scale
etc.
B
Right,
so
one
of
the
key
things
we
learnt
as
policies
need
to
be
portable,
they
should
be
consistent.
They
should
be
intent
based.
You
shouldn't,
have
to
have
networking
primitives
in
your
policies,
etc.
Right
I
mean
this
is
pretty
standard
these
days.
So
what
we
have
at
control
security
is
intent
based
policy
and
we'll
see
an
example
in
a
minute
and
whether
you
apply
that
policy
on
an
openstack
cluster
and
openshift
cluster
or
in
the
public
cloud.
B
You
don't
have
to
rewrite
the
policy
it's
defined
once,
but
then
it
is
M
force
on
the
computed
based
on
the
type
of
computer.
Ok.
Secondly,
visualization
is
very
critical
when
it
comes
to
monitoring
compliance
monitoring.
Any
kind
of
you
know
the
ability
to
identify
any
bag
flows
etc.
So
we
have
a
pretty
strong
visualization
tool
which
you'll
also
see
in
the
demo.
Ok,
and
when
it
comes
to
control
security,
we
can
not
own.
We
can
not
only
enforce
firewall
policies
on
in
virtual
environments,
but
we
can
also
enforce
them
on
physical
devices.
B
An
for
an
enforcement
of
the
B
router
as
a
level,
seven
layer,
seven
enforcement
of
the
firewall
okay,
so
host-based
firewall,
gives
you
the
advantage
of
running
a
containerized,
let's
say
firewall
appliance
on
your
compute
and
being
able
to
do
any
kind
of
policy
enforcement
for
communication
within
the
community
within
the
compute
engine
all
right.
So
let
me
move
on
to
an
example
of
policy.
Will
then
later
will
coup
the
demo?
What
we'll
be
seeing
is
how
this
policy
maps
to
and
kubernetes
network
policy.
B
Actually,
in
the
case
of
coordinated
network
policy,
you
go
through
your
typical
workflow,
creating
a
network
policy
ml
and
applying
it,
and
it
automatically
translates
translates
to
this
particular
construct
I'm
going
to
explain.
So
when
you
look
at
a
policy
to
the
frameworks
and
I,
and
let's
look
at
the
use
case
right
where
we
take
a
simple
policy
called
Mello
HTTP
traffic
between
web
instances
and
app
instances.
Ok,
the
tier
is
referring
to
a
classification
of
instances
into
web
type
or
app
type,
etc.
Ok!
So
now,
let's
take
a
look
at
these
different
environments.
B
If
you
look
at
them,
let's
assume,
there's
a
dev
environment,
development,
environment
and
it's
in
a
finance
application
based
on
this
policy,
but
instance,
can
talk
to
app
instance.
Now,
let's
say
your
production
environment
based
on
this
policy
definition,
nothing
stops.
I
mean
this.
The
intent
was
that
the
web
in
production
deployment
should
talk
to
app,
but
logically,
there's
nothing.
Stopping
web
from
dev
start
talking
to
app
from
production
right.
B
So
we
have
a
notion
called
match
deployment
right,
as
you
can
see
nowhere
in
here
are
we
specifying
any
IP
addresses
nope
or
groups,
none
of
that
right
and
there
are
a
lot
of,
and
and
so
this
is
completely
abstracted
and
that's
what
helped
us
make
it
helps
us
make
it
portable.
All
the
translation
happens
in
the
computers
coming
back
to
deployment,
there's
the
notion
of
a
match
deployment.
Ok,
so
what
that
does
is
ok,
you
want
to
enforce
the
policy
for
communication
as
long
as
they
are
restricted
to
the
same
deployment.
B
Well,
let's
assume
we
have
a
u.s.
site
and
an
mes
site
right.
You
said:
match
deployment,
there
could
be
a
dev
environment
in
your
mes
site.
We
have
real
customers
who
have
similar
kind
of
deployments.
Nothing
stops
the
instance
from
us
talking
to
app
instance
from
amia.
Logically
right,
so
we
have
a
notion
of
match
site.
So
there
are
different
ways:
you
can
actually
segment
your
and
apply
your
firewall
policies.
B
Okay,
so
because
of
my
site,
what
you're
you're,
basically
preventing
your
making
sure
that
the
intent
that
was
that
local
web
instances
talk
to
that
instances
continues
to
be
maintained
and
the
policy
is
also
at
the
same
time,
portable.
Let's
now,
let's
take
another
example
where
we
have,
let's
assume
within
a
particular
site,
there
is
a
shared
data
and
that's
legacy
data
right.
Let's
say
the
dev
and
production
environments
are
accessing
the
same
data
base
right.
There's
a
policy
saying
ello,
Mike
sequel
traffic
from
app
instance
to
DB,
but
match
site.
B
The
idea
is
that
we
should
give
enough
flexibility
to
you
know
not
just
restrict
within
a
deployment,
but
if
there
is
some
common
infrastructure
or
application
to
be
leveraged
in
a
site,
you're
able
to
do
that,
you're
able
to
do
it
effectively.
So
there's
our
two
simple
policy
examples
and
what
we
can
see
is
compared
to
some
of
the
competitors
in
the
market
and
in
real
world
deployments.
We
have
actually
reduced
the
number
of
policies
that
you
need
to
scale
to
by
almost
you
know
six
times.
B
For
example,
some
of
our
competitors
use
twelve
rules
to
achieve
the
same
outcome,
as
we
have
done
here
with
just
two
rooms:
okay,
so
it's
already
easily
scalable
and
easily
definable
policy
framework
all
right,
so
when
we
bring
it
back
into
the
kubernetes
or
openshift
world,
how
exactly
do
these
objects
map
right?
So
in
the
case
of
you
know,
the
mapping
is
very
simple:
there's
no
label
maps
to
something
called
a
custom
tag
again.
These
tags
are
a
lot
of
different
ways.
B
B
Namespaces
again
we
have
a
tag
associated
with
the
namespace
of
objectives.
You
have
different
granularities
at
which
you
can
apply
policies.
Okay,
natural
policy
directly
translates
the
firewall
policy
and
the
ingress
rule
to
firewall
rule
and
so
on.
Okay,
so
what
I'm
going
to
do
now
is
handoff
to
stop
it
through
for
the
demo
so
that
you
know
I
know
went
through
pretty
fast,
but
even
you
see
it
and
the
demo.
Hopefully
you
get
a
better
understanding
of
what
we're
talking
about
here.
Okay,.
C
Okay,
so
thank
GP
for
the
detail
explanation,
so
my
name
is
Safi
through
I
work.
In
the
contrary,
solution
steep
and
along
with
me,
is
Vinay.
Who
is
my
colleague
resolution
scope
as
well,
so
we'll
be
kind
of
tag
teaming
to
resist
about
today,
as
DP
mentioned,
you
know,
the
Cantrell
security
is
one
of
the
major
implementations
in
the
new
release
that
we
have
and
which
are
supporting
native
kubernetes
set
of
policies,
squadron
security
objects,
so
you'll
see
how
exactly
this
works
using
a
live
demo,
and
this
is
the
topology
that
we
have
so.
C
The
whole
pressure
is
built
on
AWS
and
it's
very
simple,
bare
minimum,
just
one
OpenShift
masters,
which
runs
the
contrail
control
components
and
there's
also
42
V
routers,
which
is
essentially
the
openshift
computes
one
bit
altar.
We
use
it
as
a
gateway
which
I
will
be
explaining
in
the
future
slides,
and
that
is
also
one
computer
it'll
actually
hold
the
workloads.
C
D
C
One
in
1010,
20.0,
subnet
and
the
other
one
intent
and
10.0
subnet.
So
what
essentially
you
would
like
to
show
here
is
the
overlay
clip
for
traffic,
which
will
be
in
these
two
subnets
will
be
notable
an
ec2
instance,
which
is
an
AWS
fabric
subnet.
So
this
opens
up
a
lot
of
opportunities
for
customers
to
connect
their
overlay
for
networks
to
AWS,
or
you
know,
other
Cloud
endpoints.
C
C
C
C
So
here
you
know
a
simple
to
tailor
app,
which
basically
has
database
parts
in
this
database
network
of
to-220
and
the
web
part
which
will
be
hosted
in
the
front-end
network
in
the
subnet
one
dot,
one
dot,
one
dot,
0
and
so
expose
this
to
the
outer
world
or
to
the
earliest
fabric.
I
will
be
using
another
virtual
network,
which
is
called
as
the
public
network,
and
this
has
the
subnet
range
of
180
to
168
1.0.
C
C
So
in
the
yeah
Mel
I
define
a
custom
annotation
which
will
launch
the
part
in
this
particular
virtual
network.
So,
as
you
can
see,
the
annotation
is
open.
Quarter.
Dog,
Network
and
I
give
the
domain
name
the
project,
which
is
demo
and
the
name
of
the
virtual
network.
So
this
particular
part
listens
on
port
80.
So
let's
go
ahead
and
create
this
time
on
project
double
of
the
create
yeah
first
pot
and
let's
also
see
the
definition
for
the
backend
part.
The
backend
part
is
similar,
except
that
the
labels
HDL
client
ID.
C
C
C
So,
as
you
can
see,
there
are
two
personal
recharge:
their
own
virtual
networks
undergoing
IP
address,
abduct
three
from
each
virtual
network
and
the
label
associated
with
them.
The
best
part,
which
is
a
HTTP
servers,
is
labeled
tier
servers
and
the
back
end
card
is
named
th
right.
So
once
you
create
these
labels
in
contrails,
you
know.
If
you
go
to
tags
section,
then
you
will
see
that
these
tables
are
automatically
generated.
So
we
have
the
TF
client
20s
over
in
the
controller
WI.
C
C
Okay,
so
the
thing
doesn't
go
through
because
we
these
two
virtual
tools
isolated
by
default.
So
these
two
entities
since
they're
part
of
four
different
virtual
network.
You
know
there
is
no
routing
between
these
two
logical
virtual
networks,
so
to
enable
is
routing
and
to
share
the
two
is
for
sea
routes.
We
have
to
create
a
contrail
Network
policy,
so
the
network
policy
comes
built-in
as
a
part
of
the
policies
tab
under
networking,
so
I've
already
created
a
policy
which
says
front
end
to
back
end
and
I
pass
all
traffic.
C
So
this
is
default.
Current
rate
concepts
of
defining
an
active
policy
and
leaking
garage
between
two
virtual
networks.
So
now
let's
go
ahead
and
create
our
kubernetes
Network
policy
and,
let's
see
what
happens
in
contrast,
so
my
policy
definition
for
kubernetes
set
of
policy
says
that
you
know
I
open
only
for
284
all
traffic
coming
from
PS
line
towards
th
server
and,
as
you
can
see,
this
is
the
port
that
I
am
allowing
every
other
traffic
is
denied
by
default.
So
let's
go
ahead
and
create
this
kubernetes
set
of
policy.
C
We
just
installed
of
the
policies
of
life.
So
let's
go
ahead
and
see
what
happened
when
we
apply
this
kubernetes
network
policy,
in
contrast,
so
contrails
has
a
component
called
as
the
queue
manager
which
actively
listens
to
kubernetes
or
openshift
events,
and
it
procs.
If
this
converts
those
into
relevant
content
objects
so
under
the
security
tab,
if
you
look
at
the
global
policies,
so
we
have
a
bunch
of
tabs
here's
the
application
policy
sets
which
are
associated
with
firewall
policies
are
similar
stuff.
C
So
if
you
go
look
at
the
firewall
policies
and
then
you
see
that
you
know
a
new
firewall
policy
has
been
created.
So
this
is
the
name
of
the
hub
another
set
of
policy
that
I
gave,
and
if
you
click
on
this,
then
it
has
a
rule
which
says
passed:
TCP
port
80
from
TL
client
and
namespace
demo.
Since
you
know,
I
have
launched
the
parts
in
this
particular
namespace
and
allow
this
traffic
only
towards
our
tier
servers
and
next
page
table
and
the
direction
is
also
unidirectional.
C
So
if
you
try
to
get
some
information
from
server
to
the
client,
then
that
won't
look.
So
let's
go
ahead
and
verify
that
the
network
policy
has
been
applied
in
a
right
manner,
so
I'm
going
to
repeat
the
same
step
which
I
did
before
so
I'm
going
to
go
into
the
combated
part
and
after
pain
or
three.
So
let
me
pin
1.1
1.3
hoping
one
go
through,
because
I
have
blocked
pain,
let's
issue
or
W
get
the
dublicate
should
work
since
I
our
own
import
ad.
So
now,
since
no
we
we.
C
C
Three
another:
the
traffic
groups,
if
you
select
the
our
demo,
which
is
our
namespace
of
interest,
so
there
is
a
number
of
you
know.
Cool
visualization
features
that
you
can
see
here,
but
the
one
which
we
are
interested
is
between
the
client
and
the
server.
So
if
you
click
on
that,
then
you
will
see
that
you
know
the
number
of
tools
that
are
tries
to
match.
So,
as
you
can
see,.
C
It
permits
this
particular
traffic
between
club,
dear
client
and
TS
server
on
port
80,
and
it
denies
every
other
traffic.
So
if
you,
if
you
you
know,
try
to
do
whatever
you
get
for
a
number
of
you
know
times,
then
this
session
is
initiated,
counters
will
increase,
since
I
did
obligate
forward
time.
The
count
is
one
right
now
and
similarly,
the
deny
router
also
very
increase
for
any.
You
know
non
non
constrained
traffic
that
has
been
initiated
from
client
toward
service.
C
So
this
is
the
cool
visualization
that
car
trade
offers,
and
you
can
also
there's
a
number
of
other
mobs
that
you
can
turn
on.
For
example,
if
you
want
to
filter
based
on
a
different
application
or
a
different
here,
then
it
can
select
those
tears
from
applications
and
filters,
and
you
can
also
get
this
for
the
last
hour,
the
last
day,
the
last
week
that
students
kind
of
stuff.
So
this
is
the
contrail
security
and
also
support
for
native
cover
and
a
set
of
policies.
So
are
there
any
questions
from
the
viewers
here.
C
D
So
this
is
when
a
and
I
was
just
responding
on
the
chat.
So
basically
we
allow
a
user
of
a
layer
of
abstraction
about
projects
wherein
you
could
create
multiple,
like
create
a
domain
for
your
infrastructure
and
then
create
projects
under
different
domains.
So
it
gives
you
a
layer,
one
layer,
more
of
an
abstraction
beyond
project.
C
B
B
Okay.
So
as
of
now,
we
are
using
3.7
for
all
our
validations
and
from
a
Content
perspective,
we
have
an
upcoming
release
made
April
when
network
policy
and
a
lot
of
these
features
will
be
giro.
Ok,
so
what
we
will
do
is
I
think
we
will
add
a
slide
with
that
information
and
Dan
will
share
that
with
you,
which
you
can
then
publish
as
part
of
this
yeah.
C
A
C
C
C
In
points
in
AWS,
so
the
parts
are
you
know:
natively
can
talk
to
these
endpoints
by
using
a
construct
called
as
petrol
clicking
and
also
open,
contrail
rotor
objects.
So
if
you
see
how
the
system
so
right
now,
I
have
like
two
Ubuntu
app
which
I'll
launch
in
the
rate
of
its
network
and
the
content
network.
C
C
C
C
A
C
A
And
around
the
versions
of
Cahoon
Eddie's,
an
open
ship
just
to
go
back
a
little
bit
to
defeats
just
clarifying
that
kubernetes
1.9
and
open
ship
3
7,
+,
3
9,
is
in
the
works.
So
again
you've
been
testing
on
3/7.
For
those
of
you
who
don't
know,
we
have
gone
from
3
7
right
over
to
3
9.
So
if
you're
wondering
why
the
3.8
isn't
there,
it's
just
was
the
migration
path
like
3
7,
2,
3
9,
it's
just
clarifying
that
a
little
bit.
So
if
that's
a
little
confusing,
it
is
confusing
any
questions.
C
If
the
last
demo
was
the
automated
build
process
and
openshift
and
how
we
support
it,
so
I
mean
open
chef,
mains
use,
main
use
cases.
You
know
apple
chips
build
and
let's
see
how
this
is
done
in
open
chef
plus
contraire,
so
I
have
let's
go
to
the
namespace
called
as
the
app
product
and
I
deploy
a
simple
Python
application.
C
C
So,
as
you
can
see
here,
a
build
is
currently
running
it's
the
source
from
you
know
this
particular
github
people
that
have
given,
and
this
in
turn
brings
up
a
build
and
the
build
also
brings
up
a
deployment
containers
which
essentially
tries
to
deploy
the
application,
and
once
the
deployment
is
complete,
there
is
another
part
it
should
be
launched
which
will
actually
hold
the
front
end
application
and
the
bill
container
goes
away.
So
this
is
the
tangler
example.
One
HT
v,
fi
r
is
the
part
which
actually
push
the
application
and
the
example.
C
One
builds
it
apart,
which
push
the
build
process,
and
this
also
exposes
service
called
at
the
jungle.
Examples
which
results
from
just
special
IP.
So
now,
if
I
go
to
the
build
configuration
under
the
consideration,
tab
I
have
this
github
WRL,
so
I
can
copy
this
URL
and
a
participant
hook
in
my
github
page.
C
So
if
I
go
see
errors
and
under
settings
in
my
github
page,
there's
all
the
books
in
chests
so
I
can
click
on.
Add
the
books
page
that
URL,
which
I
just
copied
from
openshift,
choose
the
content
type
of
application
Jason.
So
right
now,
I
want
to
disable
the
sell
verification
and
then
I
had
the
look
book.
So
if,
on
a
successful
thing,
you
know
the
web
hooks
got
officially
added.
So
now,
if
I
go
back
to
code-
and
let
me
just
edit
the
front-end.
D
C
Chef,
let
me
remove
hello
world
Hangul
name,
the
common
tab
for
removing
Hollywood,
and
let
me
commit
this
change
so
as
soon
as
I
commit
this
change.
Openshift
will
start
a
new
bill
for
me.
So,
as
you
can
see,
the
number
increased
to
2
and
it
was
triggered
by
a
github
webhook
by
this
commit
ID
which
essentially
I
named
it.
As
removing
hello,
hello
word
and
now,
if
I
look
at
the
torch,
then
you
will
see
that
you
know
the
strangle
example
1,
which
was
a
which
is
this,
is
actually
hosting.
C
My
existing
application
will
go
in
some
time
and
the
new
application
will
be
created
by
a
new
part.
So
if
you
have
a
load
balancer
or
if
you
have
a
front-end
IP
address,
then
you
can
actually
go
visit.
The
index
dot
HTML
and
you
will
notice
that
you
know
the
new
web
page
will
be
visible
for
all
your
endpoints
or
your
customers.
So
this
is
the
C
ICD
pipeline
in
openshift
and
contrail
support
ship.
B
B
B
B
This
is
basically
introducing
what
tungsten
dot
IO
is
about
and
who
all
are
using
it
as
well
as
wall
or
collaborating
in
this
open
source
project,
and
if
you
go
to
the
top,
there
are
blogs.
There
are
documentation.
We
are
already
quoting
from
open
country
to
tungsten
dot,
IO
and
all
our
documentation
will
be
available
here.
Ok,
so
later
some
open
chart,
integration,
etc
and
Salvatore
has
already
published
quite
a
few
blogs
as
well.
All
those
would
be
available
for
this
site
awesome.