►
From YouTube: Coffee and Cloud Native - S01E15
Description
## Today's Topics
0:00 - Introduction
1:53 - Microsoft announces Open Service Mesh - https://llb.io/b89dl
12:20 - Devspace v5.0 released - https://llb.io/vjvn2 / https://llb.io/ahn8p
14:57 - Architect introduces DevOps as a Service Platform - https://llb.io/qohi9
18:49 - How to monitor etcd - https://llb.io/6o4ja
20:16 - Simulator creates vulnerable K8s clusters for you to hack into or fix - https://llb.io/zl80d
21:04 - KubiScan helps identify K8s security vulnerabilities - https://llb.io/jvrmv / https://llb.io/zce4p
22:09 - 5 Reasons to run a Kubernetes Home Lab on RPi - https://llb.io/0ovx1
26:35 - Kubernetes on MacOS with Rancher and k3d - https://llb.io/wra2b
## Tool of the Day
27:38 - Node Policy Webhook 0.1.2 - https://llb.io/07tpk
Topics for all previous shows are at https://llb.io/h3owq.
## What Is CNCN?
Every night I scour the Internet for news and content about Kubernetes, cloud native, and open source, and every morning I share with you the interesting bits that I would use. This is a curated list of content that I think is helping elevate the community and move it forward. Grab a coffee and join me in the live stream!
=====
Got something for me to look at? Tweet with the hashtag #CNCN or hit me up at one of the sources below.
Want to support what I do?
Check out DigitalOcean's hosted Kubernetes service. Here's a link for $50 of credit for new users: https://llb.io/91go2
MY GEAR: https://llb.io/xxcim
Let's Connect!
TWITTER: @adriandotgoins
INSTAGRAM: @adriandotgoins
LINKEDIN: https://www.linkedin.com/in/adrian-goins/
===
Some of these links are affiliate links. If you buy something through them, I may receive a small commission. This doesn't change the price of what you purchase, but it helps me continue to make the content that you want to see. Thank you for your support!
A
Good
morning,
everybody
welcome
to
today
today
is
august.
The
7th-
and
I
want
to
welcome
you
to
episode
15
of
coffee
and
cloud
native
15..
That's
like
bigger
than
zero.
My
name
is
adrian
goins.
Every
night
I
scour
the
internet
for
news
and
content
related
to
kubernetes
and
cloud
native.
Then
every
day,
you'll
find
me
here
to
share
the
bits
that
I
find
interesting.
A
This
is
a
curated
list
of
content.
I
go
through
around
200
submissions
every
night
and
I
select
around
10
of
them
for
the
next
day's
show.
If
I
wouldn't
use
it,
I
won't
be
talking
about
it.
So,
if
you're
watching
now
or
in
the
future,
please
click
the
thumbs
up
button
on
the
video,
so
the
youtube
algorithm
shares
it
with
other
people.
I
love
putting
this
show
together
for
you,
because
it
helps
me
end
each
day
with
knowledge
that
I
didn't
have
when
the
day
began.
A
A
A
I
have
some
stuff
to
talk
about
and
you
all
know
exactly
what
it
is.
Oh,
what
microsoft
yeah
they
released
the
open
service
mesh,
but
you
already
knew
about
that.
So,
let's
just
talk
about
something
else.
What
do
you
say?
First
of
all,
let
me
pause
this
video
over
there,
where
it's
wasting
my
bandwidth.
A
First
of
all,
they
get
the
best
they
get.
The
award
for
the
best
reinvention
of
self,
since,
like
madonna,
like
microsoft,
has
done
a
fantastic
job
of
really
rounding.
The
corner
and
convincing
everybody
that
they're
really
just
a
really
good
guy,
but
remember
who
you're
talking
about
here
like?
Can
we
trust
them?
They
are
a
mega
corporation
and
there's
no
money
in
doing
things
for
free.
A
A
You
don't
actually
have
to
answer
whether
or
not
we
can
trust
them,
because
you
know
other
than
just
making
stuff
up.
You
know
we,
we
don't
really
know
their
behavior
speaks
for
itself,
and
the
nice
thing
about
this
is
that
this
is
open
source,
it's
being
donated
to
the
cncf,
it's
tied
to
the
service
mesh
interface,
which
solo
helped
launch
back
in
2019
and
has
actively
participated
in
and
we'll
talk
about
that
in
just
a
second.
So
it's
all
of
these
things,
but
is
it
actually
necessary?
A
A
It's
based
on
envoy.
It
adheres
to
the
service
mesh
interface
for
api
portability,
but
it's
not
the
only
one
and
we
can
scroll
through
this
article.
It's
basically
it's
a
service
mesh
hooray,
someone
in
azure
was
quoted
by
techcrunch,
or
somebody
else
saying
that
it's
a
lighter
weight
version
of
istio.
If
you
have
to
launch
your
product
and
compare
it
to
something
else,
so
that
people
understand
what
it
is,
then
that
says
that
you
well.
A
A
A
Vendors
are
participating
in
it
and-
and
that's
that's
good,
but
they
don't
have
to,
and
actually
I
shouldn't
have
switched
back
so
quickly
because
this
next
article
is
from
a
few
days
ago
and
it
talks
about
the
smi
project
and
it's
actually
written
by
containus.
Even
though
it's
up
on
the
smi
vendor
neutral
page
containus
has
their
own
service
mesh,
it's
called
mesh.
It
treats
things
differently.
It's
not
based
on
envoy,
like
everything
else.
A
So
they
talk
about.
You
know
various
other
things
like
weaveworks
flagger.
They
talk
about
the
service
mesh
hub
and
they
talk
about
rio,
which
serves
as
a
management
plan
for
linkery,
I'm
thinking
that
might
actually
be
rancher.
Rancher,
rancher,
rancher,
rancher,
rancher
rancher.
I'd
like
that.
I
looked
for
anything
called
rio
that
has
anything
to
do
with
linker
d
and
I
came
up
with
nothing
but
this
article
so
anyway,
I
just
thought
that
was
funny,
so
they
talk
about
mesh
all
right.
A
There
are
lots
of
service
meshes
out
there
and
I'll
revisit
what
I
said
yesterday
that
you
need
to
look.
You
need,
I'm
not
going
to
tell
you
what
to
do.
My
recommendation
is
that
people
look
at
what
they
do
need
in
their
environment
and
pick
the
tool,
that's
right
for
them,
with
the
criteria
of
making
sure
that,
whatever
tool
they
pick
gives
them
the
flexibility
to
move
in
the
future.
A
Maybe
osm
will
do
that,
but
right
now,
osm
is
brand
new.
If
you
want
to
install
it
well,
you
can
here's
the
repo
for
it.
It's
like
super
super
alpha
so
make
sure
you've
got
your
life
jacket
on
before
you
jump
into
the
pool,
and
if
you
don't
want
to
go
through
this,
you
can
actually
just
install
it
with
arcade,
alex,
released
or
merged
a
change
yesterday
that
allows
you
to
install
osm
and
an
update
for
linker
d,
along
with
an
update
for
cert
manager
and
something
else.
A
Honestly,
I
don't
think
this
is
news.
Not
this
alex's
stuff
is
news.
I
don't
think
the
service
mesh
open
service
mesh
thing
is
news
because
think
of
it,
this
way,
microsoft
did
it
and
everyone's
like
microsoft,
did
it
if
somebody
else
had
released
this,
would
anybody
care
so
much
is
microsoft
out
there
like
robin
hood?
Are
they
fighting
for
the
freedom
or
tron?
Maybe
is
a
better
example?
I
fight
for
the
users.
A
A
A
A
Yeah
yeah,
okay,
so
so
nuno
says
it's
already
been
given
to
the
cncf
yeah
that
they
say,
they're
gonna,
give
it
to
the
cncf,
and
it's
not
that
bad.
No,
I'm
not
saying
that.
It's
bad!
I'm
not
saying
that
like
it's,
it's
not
bad!
Is
it
necessary
if
they,
I
just
don't
think
it's
necessary.
It
doesn't
at
least
so
far.
It
doesn't
do
anything
that
isn't
already
done
by
something
else.
It's
a
service
mesh
based
on
envoy.
There
are
lots
of
service
meshes
based
on
envoy,
it
clutters
the
market.
A
A
A
If
somebody
started,
you
know,
if
I
have
a
little
open
source
or
take
alex
ellis,
alex,
has
a
bunch
of
really
cool
open
source
projects,
but
he's
a
guy
with
a
couple
people
working
for
him
and
and
doesn't
have
a
giant
legal
team.
If
somebody
started
taking
the
open,
fast
logo
and
slapping
it
on
what
they're
like
their
own
cloned
version
of
lambda
or
something
like
that,
he
may
not
have
the
resources
to
go
and
fight.
But
if
he
belongs
to
this
google
foundation,
they
will
fight
for
him.
A
A
A
A
It
let's
move
on,
I
knew
I
was
going
to
spend
a
bunch
of
time
on
that
today
and
I've
got
some
other
stuff
that
I
want
to
talk
about.
So
next
up
back
in
1996,
when
I
was
just
a
young
pup,
I
was
hanging
out
at
cafe
netherworld
in
denver,
colorado
anybody
who's
watching
this
from
colorado.
You
probably
remember
another
world.
You
probably
remember
me.
A
A
Eric
was
doing
real-time
web
development
where
he
had
a
terminal
window
open
and
a
browser
window
open,
and
he
would
like
do
html
in
the
terminal
and
he
would
save
and
he
would
refresh
the
browser,
but
it
was
like
saving
out
to
the
internet
and
then
coming
back
to
the
browser.
He
was
doing
real-time
development
and
it
was
like
I
was
watching
magic.
A
Devspace
is
kind
of
like
that,
but
for
kubernetes
and
containers,
there's
not
enough
time
in
this
show
to
go
into
the
depth
of
what
this
thing
can
do,
but
basically,
instead
of
going
through
the
whole
process
of
like
code
push,
there's
our
code
build
a
container
push
it
out
somewhere
test
it
bring
it
down,
update
it.
You
know
out
there
and
then
like
you're,
going
through
this
time,
suck
of
all
of
this
intermediary
stuff.
A
A
A
A
A
There's
a
company
called
architect
who
just
came
out
with
devops
as
a
service
platform.
No,
so
that
sounds
like
devops
as
a
service
platform.
They
came
out
with
a
platform
for
dev
for
dev,
for
depth
or
dev
for
deaf
or
deaf,
or
what
does
that
even
mean?
That's
where
I
was
last
night.
First
of
all,
it
doesn't
really
make
a
very
good
acronym,
d-o-a-a-s
doe
ass,
don't
no
devops
as
a
service.
A
They
aim
to
simplify
the
deployment
of
microservice
applications
by
treating
the
application
as
a
whole
unit,
and
it's
pretty
it's
pretty
cool
you
you
build,
they
have
a
word
for
it.
You
build
a
a
thing,
a
template,
looking
at
my
notes,
whatever
so
I'll,
just
scroll
down
to
where
they
have
it.
Oh,
my
god.
It's
the
cncf
landscape,
page,
the
most
scariest
infographic
to
ever
be
created.
A
Oh
it's!
Not
here!
It's
not
there!
No
all
right!
I
have
to
go
to
their
docs
to
find
it
anyway.
You
build
this
thing
and
you
you
give
it
to
them,
and
it
builds
this
graph
of
all
of
the
dependencies
of
the
microservices
in
your
application
and
then
it
figures
out
what
depends
on
what
and
and
it's
prepared
to
deploy
that,
but
it
pauses
there
and
it
provides
information.
I'm
gonna
go
to
their
docs
page,
because
it's
much
cooler
it
provides
information
on
nope.
Not
there
quick
start.
A
A
Yeah,
it
looks
like
it'll
do
some
cool
stuff,
they
have
a
free
tier
it
just
launched.
Yesterday
it's
multi-platform
it'll
work
with
kubernetes
and
ecs
for
sure
it'll
work
with
other
platforms
as
the
little
engines
get
written
for
them.
You
can
take
it
for
a
spin
without
having
to
worry
about.
You
know
what
it's
gonna.
Well,
actually,
that's
not
true.
You
kind
of
have
to
worry
a
little
bit
about
what
it's
gonna
cost,
because
they
basically
got
two
options
free
and
give
us
a
call.
A
The
idea
there
is
that
if
they
tell
you
what
it's
going
to
cost
you'll
just
freak
out
and
leave
out
of
context
to
make
an
appropriate
decision,
but
the
idea
that
I'm
going
to
call
them
and
be
like
this
is
amazing:
how
much
money
like
there's
a
joke
that
I
say
which
is,
if
you
have
to
ask
what
it
costs
you
can't
afford
it.
Well,
that's
what
they're
telling
me
they're
telling
me
that
if
I,
if
they
can't
tell
me
what
it
costs,
then
it's
just
too
expensive,
but
they
have
a
free
tier.
A
A
First
of
all,
they
explain
what
ncd
is.
Yes,
we
know
so
here's
how
to
configure
the
admin
interface
for
it,
followed
by
a
sample
of
pulling
metrics
out,
but
then
they
go
into
explaining
well,
okay,
how
you
get
prometheus
to
talk
to
it
and
then
what
do
you
look
for
in
etcd?
And
I
thought
this
was
great?
A
A
They
are
experts
in
a
particular
problem
space,
it's
possible
to
solve
problems
without
using
their
products,
and
I
like
that,
their
articles
say
hey.
You
could
take
all
of
this
information
and
go
solve
it
on
your
own.
But
if
you
want
to
do
it
faster
and
easier,
we've
got
something
that
can
help
you
do
that
they
probably
even
tell
you
the
price.
A
It
builds
an
aws
environment
for
you
and
it's
kind
of
like
a
shell,
so
once
you're
in
there
you
can
launch
scenarios
and
and
then
proceed
to
go
through
the
various
scenarios
and
when
you're
done
you
can
tear
down
the
environment.
That
graphic
is
impossible
to
read.
So
you
start
a
task.
It's
got
hints
it
kind
of
feels
a
little
bit
like
zork
or
something
like
that,
but
for
penetration
testing
of
kubernetes
clusters.
When
you're
done,
you
blow
it
away
very
neat
tool
which
leads
me
into
kubiscan,
which
this
article
just
talks
about.
A
It
uses
some
examples
of
what
people
were
able
to
find
when
using
kuby
scan,
and
some
people
apparently
got
some
bounties
from
azure
for
finding
vulnerable
kubernetes
clusters.
But
kubiscan
itself
is
over
here,
it's
made
by
cyberark
and
this
scans
clusters
for
risky
roles
and
permissions
that
can
be
used
for
privilege
escalation
inside
of
a
cluster.
A
And
if
you
scroll
down
to
the
bottom,
they've
got
this
little
two-minute
video
that
you
can
watch,
which
shows
how
somebody
was
able
to
find
a
pod
with
a
service
account
iterate
what
permissions
it
had
find
other
roles
and
just
climb
their
way
right
up
until
they
got
to
something
that
was
able
to
read
secrets
in
the
cluster.
And
it's
just
it's
like
a
minute
and
40
seconds
long.
It
is.
A
This
is
a
marketing
trick,
but
there's
probably
good
information
in
there.
Anyway,
if
you
go
and
get
the
free
ebook,
this
is
actually
sponsored
by
supported
by
red
hat.
So
it's
going
to
tell
you
how
to
install
red
hat
stuff
on
your
raspberry
pi,
particularly
okd
and
other
red
hat
tooling,
and
that's
fine.
It's
just
not
obvious
from
this
article.
A
A
When
I
talk
about
backups,
I
talk
about
the
easier.
Something
is
to
do
the
more
likely
we
are
to
do
it.
When
when
I
started
learning
kubernetes,
I
hated
kubernetes,
I
hated
the
idea
of
it,
but
mostly
I
hated
that
it
was
different
than
what
I
was
doing,
that
it
was
something
I
didn't
understand
and
that
it
was
going
to
require
work
to
get
back
to
where
I
felt
like.
A
I
already
had
been
the
day
before,
so
I
just
responded
by
hating
it,
and
then
I
looked
at
that,
and
I
said
well,
what's
the
best
way
to
get
through
this,
and
I
just
ripped
out
my
rancher
cattle
cluster
and
I
put
in
a
kubernetes
cluster,
and
I
said
there
you
go
if
you
want
to
learn
how
to
do
anything.
If
you
want
to
run
stuff
in
your
house
that
you
were
running
yesterday,
you're
going
to
have
to
figure
this
out,
immersion
is
the
best
way
to
overcome
resistance
to
new
things.
A
Having
a
kubernetes
cluster
in
your
house
will
give
you
a
path
to
spending
time
with
kubernetes,
forcing
yourself
to
do
things
in
that
cluster.
Like
run
plex
things
that
you'll
enjoy
run
next
cloud
run
a
web
server
run
whatever,
but
learning
how
to
do
it
in
kubernetes
results
in
you
learning
how
to
do
new
things
and
that
moves
you
forward
in
life,
and
you
can
make
more
money
and
all
the
other
things
that
go
along
with
it.
Buy
lambos.
A
The
thing
that
nobody
talks
about
with
raspberry
pies
is
well.
They
do
talk
about
it,
but
usually
people
find
out
about
it
after
it
happened
is
ssd
card
exhaustion.
Pies
use.
Sorry
did
I
say
ssd
sd
card.
We
need
more
letters
in
the
alphabet
sd
card
exhaustion.
They
use
the
little
sd
cards
these
things,
but
smaller
these
are
not
meant
to
be
written
to
like
discs,
so
you'll
be
just
cruising
along.
Your
pie
is
doing
great
and
then
one
day
it's
just
it
goes
away
and
it
doesn't
reboot
and
that's
because
this
is
dead.
A
There
are
ways
around
that.
So
there's
not
a
problem
with
the
pies
just
understand.
If
you're
going
to
build
out
a
pie,
cluster
expect
that
you're
going
to
need
to
rebuild
your
sd
cards
once
a
year
or
more
often,
depending
on
how
frequently
you're
writing
to
them,
or
you
need
to
make
sure
that
you
make
that
a
read-only
partition
and
you
plug
an
external
usb
hard
drive
in
that
can
actually
do
you
know
regular
media.
A
Raspberry
pi's
are
great
if
they're
they're,
not
very
powerful,
so
you
will
hit
a
boundary
of
what
you
can
do
with
it.
If
you
want
something,
that's
a
little
bit
more
badass,
I
run
my
cluster.
I
have
a
five
node
proxmox
cluster
here
in
the
house.
Four
nodes
are
made
by
a
company
called
protectly
and
if
you
look
in
the
video
description
for
any
of
the
videos,
you'll
see
a
link
to
you
know
my
gear
that
takes
you
to
kit.co
and
there
there's
a
it's
out
of
date.
A
I
have
way
more
gear
than
that
now
I
need
to
update
it,
but
there
there
are
links
for
the
protectly
servers,
they're
more
expensive,
but
they're,
full-fledged
fanless,
pcs,
that
that
are
great.
They
make
no
noise,
you
just
stick
them
in
the
closet
somewhere
and
they'll
be
fine,
but
if
you
don't
have
money
for
those
and
you
don't
have
money
for
raspberry
pi's
and
you
still
want
to
do
something.
A
Look
at
k3d.
I'm
sorry
that
this
is
like
a
rancher
promotion.
It's
not
a
rancher
promotion.
This
is
an
article
that
somebody
wrote
for
it
next,
but
k3d
lets
you
run
k3s
in
docker
on
your
local
machine
and
it's
pretty
cool
like
you
can
just
spin
up
clusters.
You
can
spin
up
multiple
clusters.
K3S
is
already
really
lightweight,
so
it's
great
for
machines
that
don't
have
a
lot
of
ram,
but
you
can
have
a
kubernetes
cluster
on
your
desktop,
whether
it's
a
mac
or
a
linux
box.
A
And
now
we're
on
to
the
tool
of
the
day
tool
of
the
day
tool
of
the
day,
node
policy
web
hook.
This
is
a
tool
that
helps
you
with
node
selector,
node
affinity
and
tolerations
for
your
workloads.
It
basically
moves
those
definitions
out
of
the
resources
themselves
and
creates
a
template.
So
if
you
have
multiple
things
that
would
end
up
with
the
same
toleration
or
node,
selector
or
node
affinity,
you
create
a
template,
called
a
node
policy
profile
there.
A
And
that's
it
it's
just
designed
to
make
things
a
little
bit
easier
so
that
you
can
drink
more
coffee
and
play
more
quick.
Did
anybody
get
quake
up
and
running
yesterday?
If
so,
tell
me
in
the
chat
it's
friday,
I'm
hoping
that
everybody
just
takes
a
couple
hours
today
and
goes
and
plays
a
quake
in
their.
A
A
Devin
says
running
k3
sha
master
blew
up
three
sd
cards.
Dq
light
is
not
happy
with
sd
cards.
Don't
use
dq
light
with
k3s.
It's
not
it's
coming
out
in
may
darren
darren
merged
something
to
actually
they're
starting
to
test
an
embedded
at
cd
instead,
because
dq
light
has
issues,
it
has
bizarre
issues.
I
built
a
cluster
with
dq
light,
not
on
our
pies
and
and
something
happened,
the
right
master
rebooted
and
then
it
just
segfaulted
it
would
never
come
up
again.
I
had
to
rebuild
the
entire
cluster
from
scratch.
A
A
A
If
there's
something
you'd
like
me
to
consider
for
the
show
hit
me
up-
and
let
me
know
my
contact
details
are
in
the
video
description
or
you
can
tweet
with
the
cncn,
and
I
will
pick
it
up
and
if
I
mention
the
tool
that
you
use
tell
me
in
the
comments,
if
you
liked
what
you
saw,
please
click
the
like
button
subscribe
to
the
channel
be
sure
to
click
the
little
bell
to
get
notifications
when
the
next
show
starts
I'll,
be
here
every
weekend.
Sorry,
that's
not
true.
A
I
will
be
here
every
weekday,
I'm
so
looking
forward
to
the
weekend
I'll
be
here
every
weekday
for
as
long
as
there's
something
to
talk
about,
and
I
am
a
chattermouth,
so
there's
always
going
to
be
something
to
talk
about
have
a
great
day.
Everyone
enjoy
your
weekend.
Keep
learning
and
I
will
see
you
in
the
next
show
stay.