►
From YouTube: TGI Kubernetes 056: Heptio Contour and IngressRoute
Description
Come hang out with Joe Beda as he does a bit of hands on exploration of Kubernetes and related topics. Some of this will be Joe talking about the things he knows well. Some of this will be Joe exploring something new with the audience. Ask questions, comment and help decide where things go.
Heptio Contour is an "ingress controller" that uses Kubernetes objects to configure Envoy. With Contour v0.6 and v0.7, it has introduced a new CRD called the "IngressRoute". We are going to dig into what this is, how it works and why Contour went this direction.
Show notes: https://github.com/heptio/tgik/tree/master/episodes/056
Partial index:
- 00:22 Load Balancers and Ingress
- Network traffic comes the user, goes to a software load balancer, say ELB.
- ELB routes into a software load balancer in your cluster, say nginx.
- 00:34 Question from the audience: Is there a performance hit? In AWS the NLB is transparent to the network.
- nginx picks a service in a cluster to route traffic to. If you say foo.com, go to service 1. That service is considered the _upstream_. It's very confusing. "Down is upstream"
- 00:29 Limitations in Ingress protecting namespaces from stepping on each other
- 00:31 Clarifying what we mean by upstream
- 00:34 Installing Contour
- [Deploying on AWS with NLB](https://github.com/heptio/contour/blob/master/docs/deploy-aws-nlb.md)
- [Documentation](https://github.com/heptio/contour/tree/master/docs)
- 00:37 Investigating the yaml we use to install Contour
- Pro tip to new listeners: Joe will typically spend time going through yaml files before deployment to see exactly what something does on your cluster before applying. Good habit to get in to!
- 00:50 We're up and running!
A
All
right
welcome,
welcome,
welcome
everybody
to
another
episode
of
tea,
GI
kubernetes
I'm,
your
host
Joe
Beda
I'm,
the
CTO
of
a
small
start-up
called
hefty.
Oh
our
job.
Our
mission
is
to
bring
kubernetes
to
a
wider
audience.
Enterprises
beyond
and
t
GI
kubernetes
is
a
weekly
live
broadcast
that
myself,
sometimes
chris
nova.
More
and
more
lately
do
where
we
explore
a
new
topic
in
kubernetes,
a
new
complementary
technology
get
hands
on
keyboard,
play
with
it
and
see
what's
going
on
so
the
notes
there.
So
that's,
oh,
no
I
pasted
the
wrong
thing
there.
A
If
you
go
to
that
URL
Jeff
diode,
while
you're
watching
this,
you
can
help
take
notes,
live
we're
gonna,
post
these
things
and
check
them
into
our
repo
later
and-
and
so
it's
a
good
way
for
us
all
to
take
notes.
You
can
also
see
a
little
bit
of
a
preview
of
some
of
the
stuff
that
we're
going
to
be
covering
today.
So
first
of
all,
I
want
to
give
a
shout
out
to
everybody.
I
got
my
sidebar
here
fixed
from
last
time,
so
hopefully
folks
can
see
all
the
things
scrolling
there.
A
We
have
a
Adee
as
he
any
decent
from
Russia
welcome,
l'm
adi
good
to
see
here
a
age
while
lid
from
libyan
good
to
see
you
hola
from
copenhagen.
Hell
a
jelly
hello!
Think
nice
to
see
you
steve
one
is
the
hep
tony
ins,
that's
working
on
the
project
that
we're
gonna
be
covering
today.
Thanks
for
joining
us,
Steve
Julien
from
Stockholm
Roy
from
Toronto,
an
idea
from
London
H
is
from
Virginia
Roy
from
Norway
I
love.
You
guys
are
spending
your
Friday
night
with
me.
I
really.
A
On
on
from,
let's
see
so,
keto
diet
seems
to
be
working,
I've
been
I'm
on
the
keto
diet,
so
I
diet,
coke
and
like
meat
and
cheese
and
I'm
losing
weight.
It's
kind
of
crazy
Leonardo
from
Brazil,
which
I
think
that
diet
would
work
well
in
Brazil.
All
I
know
is
they.
They
eat
a
lot
of
steak,
their
mark
from
Australia
from
Melbourne
Michael
from
Jay
Berg
and
then
Mike
from
New
Jersey
good
to
see
you
all
alright.
A
So
what
we're
going
to
be
covering
today
is
this
project
that
we
started
at
hefty
owe
called
hefty
Oh
contour,
which
is
an
ingress
controller
for
kubernetes,
and
we've
had
a
couple
of
releases
since
last.
We
did
this
and
really
introduced
some
exciting
features,
and
so
I'm
going
to
dig
into
some
of
those
features,
but
I'm
also
going
to
cover
sort
of
what
an
ingress
controller
is
why
it
works
and
we're
going
to
install
this
from
scratch.
So,
hopefully,
if
you
didn't
catch
that
earlier
episode
that
we
did
on
on
contour
I
can
catch.
A
You
up
I
think
I
probably
went
deeper
in
terms
of
how
load
balancing
works
at
scale
there,
but
hopefully
we're
going
to
go
a
little
bit
deeper
into
why
I'm
so
excited
about.
What's
going
on
with
the
latest
versions
of
contour,
and
so
let's
see
so,
we
have
a.
Let's
see
we
have
Travis
from
Buffalo
Carlos
from
Havana.
Awesome
awesome,
alright!
So,
but
one
of
the
things
we
like
to
do
is
we
start.
This
out
is
to
sort
of
cover
the
news
of
the
week,
and
so
the
big
news.
A
Obviously
this
week
is
that
IBM
is
acquiring
Red
Hat.
So
right
hat
was
one
of
the
original
early
partners
with
us,
as
we
launched
kubernetes.
So
I
was
at
Google
on
the
founding
team
for
kubernetes
and
Red.
Hat
has
been
an
amazing
partner
the
whole
way
through
along
the
way
they
purchased.
This
company
core
OS
core
OS,
has
also
been
heavily
involved
or
was
heavily
involved
in
the
kubernetes
world,
and
so
a
lot
of
kubernetes
expertise
and
community
members
ended
up
getting
rolled
up
through
Red
Hat
and
now
they're
all
moving
to
IBM.
A
A
Things
but
you
can't
help
but
think
that
that
kubernetes
actually
played
a
big
part
of
this
deal
in
terms
of
creating
a
lot
of
value
here.
So
here's
hoping
that
that
whole
integration
goes
well
and
everything
goes
smoothly
there,
because
obviously,
these
things
can
be
a
little
bit
stressful
for
folks
and
we're
really
hoping
that
you
know,
and
every
indication
is,
is
that
the
commitment
to
open-source
will
will
continue
all
right,
so
Mattie
says
I'm
scared
for
the
acquisition
think
there
will
be
a
mass
exodus
curious.
A
What
this
does
to
fedora
and
CentOS
yeah
I,
don't
know
what
it
means
for
fedora
and
sent
us
I.
Cannot
you
know,
I
I
haven't
heard
anything
specific
there
with
respect
to
to
kubernetes,
even
if
we
do
see
folks
leave-
and
we
did
see
that
you
know
there
was
definitely
some
turn
as
core
OS
joined
Red
Hat.
A
lot
of
those
folks
found
you
know
places
and
other
companies
that
continue
to
work
in
kubernetes
I.
A
Well,
I
think
IBM
just
spent
a
lot
of
money,
so
you
know
I'm
not
sure
whether
whether
they're
looking
to
buy
more
so
I
have
no
comm
on
that.
And
then
sin
is
a
blue
idea.
Mixed
with
red
hat
is
purple
yeah
change
the
logo
to
purple
something
like
that.
I,
don't
know
it's
pretty
clear
that,
like
you
know,
IBM
is
the
one
buying
Red
Hat,
but
the
promises
are.
Is
that
they'll
continue
to
operate
relatively
independently
for
a
while,
and
so
we
can
hope
that
that's
definitely
going
to
be
true.
So.
A
A
A
Alright?
So
so
that's
great!
Let's
see
oh
wait.
I
have
to
switch
to
the
screen
there.
So
we
had
lets
me
close
some
stuff
here,
because
I'm
gonna
be
talking
about
this,
but
we
have
oh
there's
a
full
interview
there.
Okay,
awesome
with
so
there's
there's
the
the
press
release
and
here
apparently
I
can
play
a
YouTube
video.
Well
watching
you,
oh
I
get
an
ad,
but
there
you
go
alright.
So
moving
on
to
more
news,
kubernetes
1.13
code
slush
is
happening.
A
So
the
idea
here
is
that,
as
we
go
through
releases
with
kubernetes
and
we
try
and
get
quarterly
releases
out,
there's
a
schedule
and
we
try
and
keep
to
that
schedule
and
it's
important
because
that
means
that
if
a
feature
doesn't
miss
a
release
like
there's
some
stuff
that
hefty
o
folks
wanted
to
get
into
112,
we
missed
the
boat.
We're
spending
the
time
to
get
those
things
into
113
and
what
happens?
A
Is
that
there's
a
it's
sort
of
like
a
last
call
for
changes
before
we
go
into
code
freeze
to
be
able
to
lock
this
stuff
down
the
the
fourth
corridor
release
of
kubernetes,
which
is
what
113
is
going
to
be
tends
to
be
a
shorter
schedule
because
of
the
holidays,
and
so
so
that
that
whole
time
gets
gets
compressed.
So
that's
happening
now
so,
and
then
this
is
also
around
now
is
when
folks
start
pulling
together
the
release
notes.
A
A
Let's
see
related
is
that
there
is
this
discussion
starting
around
creating
an
LTS
version
of
kubernetes
how's.
It
going
Carlos
from
Raleigh
good
to
see
you,
and
so
so
we
should
like
I,
said:
kubernetes
shifts
quarterly
support
in
terms
of
of
patches
and
security
updates
goes
back
to
versions,
so
once
one
thirteen
really
is
released,
it'll
be
one
twelve
and
one
eleven
it'll
actually
be
in
scope
for
a
young,
very
dynamic
project.
That
whole
thing
you
know
makes
a
ton
of
sense,
because
you
want
things
to
move
fast.
A
You
don't
want
to
be
supporting
a
lot
of
old
code.
Kubernetes
is
getting
to
a
maturity
level
where
it
really
starts
to
make
sense
to
like.
Let's
have
something:
that'll
be
relatively
static,
a
fixed
target
over
a
longer
period
of
time,
and
so
there's
a
lot
of
discussions
going
on
here.
You
can
start
looking
at
some
of
the
stuff
going
on
in
terms
of
what
an
LTS
would
mean
how
long
it
would
be
supported.
How
often
we
would
cut
a
new
LTS,
and
so
some
interesting
stuff
going
on
there
yeah.
A
So
so
just
be
aware
of
that
and
I
think
this
is
definitely
a
pain
point
for
folks
that
did
more
traditional
IT
roles.
They
don't
want
to
be
upgrading
a
kubernetes
cluster
every
every
three
months,
all
right,
Robert
from
New
York
good
to
see
ya.
So
that's
exciting,
so
cube
con
is
coming
up
in
December,
which
is
very
exciting,
so
we're
going
to
have
a
booth
there.
We
have
a
bunch
of
exciting
things
planned
I'm,
not
going
to
spill
the
beans.
A
Yet
if
you
can
make
it
to
Seattle
for
cube
con,
that
would
be
that'd
be
great.
One
of
the
things
that's
happening
in
association
with
cube
con
is
a
contributor
summit,
and-
and
this
is
a
way
for
folks
who
are
heavily
involved
in
the
community-
it's
not
a
user
summit.
So
this
is
really
about
folks
who
are
interested
in
the
future
of
kubernetes,
contributing
to
that
and
really
moving
things
forward
now.
What
I
will
say
is
that
it's
full-up
now
there
you
know
the
there's
a
wait
list.
A
George
who's
who's
on
the
line
here
works
for
hefty
Oh
is
involved
with
contributes,
has
helped
to
organize
some
of
this
stuff,
but
we
will
be.
We
will
be
going
through
and
making
sure
that
we
record
a
bunch
of
this
stuff,
especially
the
stuff
around
new
contributors
and
getting
new
people
into
the
into
the
into
the
community.
A
That
I
think
will
be
good,
and
you
know,
and
in
terms
of
getting
new
folks
in
if
folks,
who
are
watching,
want
to
start
getting
more
involved
in
terms
of
contributing
to
kubernetes.
That's
definitely
something
that
you
know
the
contributes
cig
the
contributor
experience
they
would
be
really
interested
in
hearing
about.
So
is
the
contributor
summit
free
I
believe
that
it
is
I
mean
it's
associated
with
cube
con,
but
I,
don't
think
you
necessarily
need
a
cube
con
ticket
to
be
there,
assuming
that
you,
you
were
able
to
get
in
on
the
registration
there.
A
Alright,
so
Carlos,
st.
K
native,
you
know
talking
about
LTS
cutting
releases.
How
often
that's
really
interesting
stuff?
It's
a
tough
thing
to
do
because
you
want
to
move
fast,
but
you
also
want
to
give
some
level
of
certainty
Christopher
from
Germany
good
to
see
you
Bo,
hunch,
I'm,
sure,
I'm
butchering
your
name,
hello,
Rodrigo
from
Montreal.
That's
great!
Is
there
going
to
be
a
TGI
K
night
at
coupon
we
have
some
stuff
planned
around
TGI,
K
I.
A
Okay,
so
there's
a
couple
of
projects
that
I
keep
my
eye
on
that
are
new.
Some
of
these
are
me
they're,
not
necessarily
new.
The
first
one
is
this
project
called
gravitational
gravity.
This
is,
and
I
haven't,
had
a
chance
to
dig
into
this,
but
the
gravitational
folks
have
been
working
with
kubernetes
for
a
while.
The
original
theory
behind
their
company
is
to
create
sort
of
a
way
to
take
SAS
like
offerings
deploy.
Those
on-prem
gravitational
does
that
there's
other
company
who
another
text
project,
then
every
talking
about
called
replicated.
A
That
does
something
similar,
but
they
have
this
thing
called
called
gravity,
which
is
a
packaging
solution
for
on-prem,
deploys
of
and
takes
a
snapshot
of
a
kubernetes
cluster.
So
I
think,
instead
of
looking
at
an
app,
it's
looking
at
the
cluster
in
general,
I
haven't
had
a
chance
to
really
dig
into
it,
but
look
super
interesting.
A
One
of
the
interesting
thing
is
that
when
people
say
on-premise
these
days,
they
don't
actually
mean
something
that's
sitting
in
a
corporate
datacenter
or
in
a
Colo,
sometimes
on-premise
might
mean
running
in
somebody's
private
VPC
on
AWS,
for
example,
so
I
think
a
lot
of
times
I.
You
know
when
I
say
on-premise
I,
try
and
differentiate
between
saying
behind
the
firewall,
which
means
that
you
don't
have
access
to
it.
It's
being
self-managed
versus
truly
on-premise.
In
terms
of
some
sort
of
non
non.
A
Non
managed
data
center
so
similar
to
rancher
I,
don't
think
similar
to
rancher
rancher.
The
whole
idea
of
rancher
is
to
is
to
be
able
to
deploy
a
kubernetes
cluster
that
you
can
use,
such
as
a
general
purpose.
Thing
I
believe
that
gravity
is
about
application
deployment
where
you
want
to
deploy
an
application.
That's
the
thing
and
kubernetes
is
really
sort
of
block-and-tackle
part
of
deploying
that
application,
it's
sort
of
the
the
you
know,
embedded
kubernetes
to
some
degree.
A
You
know
when
you
think
about
a
distributed
application,
yeah,
so
I'll
leave
from
Sweden,
hello,
all
right
and
then
the
next
thing
that
I
wanted
to
talk
about
and
I
found
about
about
this
and
then
I
want
to
play
with
this.
At
some
point,
too,
is
replicated,
which
is
another
company
that
does
this
sort
of
help
you
deploy.
Sas
type
of
stuff
I
was
on
a
panel
with
those
folks
a
little
while
ago.
A
Thank
this
thing
called
ship,
and
this
is
a
it's
an
experience
and
by
experience
I
mean
it's
like
a
toolset,
that's
built
around
sort
of
taking
a
helm
charge
filling
out
the
things,
creating
the
template,
rendering
that
and
then
being
able
to
do
custom
eight
customizations
on
top
of
that
with
with
customize,
and
this
applies
both
for
kubernetes
manifest
but
also
Kay
native,
because
it's
built
on
top
of
kubernetes.
So
that's
actually
really
interesting
and
there's
a
couple
of
things
that
they
do
here,
which
is
interesting,
which
is
that
they
have
a
I.
Don't.
A
Have
actually
a
here's
their
flow
when
you
run
it,
they
actually
run
a
local
web
server.
So
you
actually
get
like
a
UI
that
you
could
use
to
actually
configure
this
stuff
pre
ship
and
then
this
thing
is
all
compatible
with
like
a
get-ups
flow,
so
there's
no
tiller
involved.
They
use
helm
template
without
using
tiller
and
I.
Think
we're
starting
to
see
more
and
more
folks
are
like
hey.
A
You
know
and
get
99%
of
the
value
that
I
need
out
of
hell
and
by
using
helm
template
using
the
charts
evaluating
them,
generating
the
yeah
Mille
without
having
to
use
tiller
to
actually
submit
that
stuff
bojong's
say:
can
you
recommend
something
for
testing
kubernetes,
something
like
unit
test
during
testing
in
general,
so
I'm?
What
do
you
mean
by
testing
kubernetes,
making
sure
that
your
cluster
is
working
well,
because
then
I
think
you
know
what
Carlos
said:
there's
Sona
boy,
which
is
a
good
thing
there.
A
If
you're
talking
about
testing
an
application
that
runs
on
top
of
kubernetes,
you
can
keep
up
cluster
up
if
it's
something
that
really
gets
invasive
with
the
cluster
I
mean
we'll
do
things
where
we
have
CI
CD,
where
we
use
something
like
AWS
to
dynamically
spin
clusters
up
and
down,
so
that
we
can
test
against
him.
So
yeah,
some
more
detail
on
what
you're
thinking
around
testing
there
would
be
would
be
helpful
all
right.
So
those
are
the
projects
that
and
sort
of
news
and
that
I
wanted
to
call
out
all
right.
A
A
You
got
to
stick
with
me
for
a
little
bit
and
then
and
then
what
we'll
do
is
for
I
think
we
said
48
hours,
but
I'm
gonna
actually
change
this
to,
let's
add
another
24
hours,
therefore
72
hours,
so
we'll
do
3
days.
So
if
you
watch
TGI
K
within
three
days
of
broadcast
and
you
submit
it,
then
you'll
be
entered
in
to
be
able
to
get
some
swag
and
we're
going
to
send
out
7
sets
of
swag.
A
What
you'll
do
here
is
you
can
you
can
put
the
code
in
here?
If
you
don't
put
the
code
you're
not
eligible
and
we'll
get
your
email
address
here,
you
can
decide
whether
or
not
you
want
to
opt
into
our
mailing
list
feel
free
to
say
no,
but
if
you
want
to
get
some
good
stuff,
that
would
be
great
one.
One
submission
per
person:
please
come
on,
don't
game
it
other
words.
We
can't
do
this
stuff.
If
you
give
us
a
valid
email
address,
then
well
number
one.
B
A
Tuned
and
we'll
talk
about
that,
we'll
do
that
we'll
do
the
code
in
a
little
bit
alright.
So
let's
talk
about
contour
and
ingress
any
last
questions
before
I
start
start
digging
in
here,
alright,
so
I'm
going
to
start
with
defining
what
ingress
is
in
the
in
the
kubernetes
con
next,
it's
kind
of
it's
one
of
these
things
where
it's
a
weird
name
for
kubernetes
kubernetes
has
its
own
terminology
on
stuff.
A
A
In
the
the
book,
I
wrote,
kubernetes
up
and
running,
there's
a
lot
of
good
background
material
there
around
services,
we
don't
have
ingress
in
kubernetes
up
and
running,
but
it's
something
that
we're
looking
at
for
the
second
edition
of
the
book,
but
so
so
services
operate
at
the
sort
of
raw
TCP
level.
So
it
says:
hey
if
you
get
a
TCP
connection
coming
in
forwarded
over
there
and
that
can
work
pretty
well,
but
plumbing
in
a
new
TCP
incoming
socket
into
your
cluster
can
be
expensive
and
difficult.
A
Balancers
you'd
want
to
be
able
to
create
that
once
and
then
leverage
it
across
a
whole
bunch
of
different
applications.
So
well,
it
says
ingress
was
the
difficult
task
in
the
cka
exam.
Ok,
that's
interesting
yeah!
So
ingress
is
also
kind
of
honestly
half-baked.
It's
still
early
on,
and
one
of
the
things
that
we're
going
to
be
talking
about
today
is
the
stuff
that
we
did
with
contour
to
be
able
to
to
to
evolve
ingress,
to
be
able
to
take
it
into
into
a
next
step.
A
Alright,
so
you
want
to
do
one
cloud
load
balancer,
but
you
want
to
use
it
across
a
whole
bunch
of
different
applications
now
the
way
that
you
would
typically
do
this
is
that
you
would
get
a
software
load,
balancer
or
reverse
proxy.
These
things
are
kind
of
mean
the
same
thing,
a
software
load
balancer,
and
you
would
configure
that
so
that
it
actually
knows
about
all
your
applications,
and
so
common
things
would
be
something
like
Engine,
X
or
H
a
proxy.
A
These
things
all
can-can
play
this
role,
where
they
essentially
know
how
to
listen
on
a
single
port
except
HTTP
requests
decode.
What
that
HTTP
request
is
in
terms
in
terms
of
the
hostname
and
the
path
and
then
based
on
that
information,
redirect
it
to
different
servers.
Those
are
called
upstream
servers
and
I
always
get
confused
upstream
versus
downstream,
but
upstream
means
that
things
come
from
outside
into
the
load.
Balancer
to
an
upstream
service
and
I
can
switch
to
my
dock
camera,
and
this
thing
gets
a
little
wobbly.
But
hopefully
you
all
can
see
this.
B
A
B
A
There's
a
way
with
a
service
of
type
equals
load
balancer.
You
can
go
through
and
expose
this.
So
there's
a
you
know:
go
watch
the
other
load
balancing
talk
if
you
want
to.
If
you
want
to
learn
about
that,
and
then
this
thing
goes
to
your
your
software
load
balancer
and
then
this
could
go
through
and
talk
to
other
various
services.
A
And
so
you
could
set
it
up
so
that
hey
if
I
come
into
food,
calm
I
want
to
go
to
this
service.
You
know:
do
this
1,
2
3
and
if
I
come
in
at
bar,
calm
I
want
to
go
to
this
service
and
I
come
in
like
like
I,
don't
know
mood,
calm,
I
want
to
go
to
this
service,
so
you
can
actually
set
it
up
such
that
this
thing
knows
how
to
dispatch
to
the
upstream
service
based
on
qualities
of
the
incoming
HTTP
requests.
A
The
problem
here
is
that
let's
say
that
you're
doing
this
with
nginx
or
H
a
proxy,
this
thing
has
a
config
file
in
their
own
funky
language.
That
tells
it
how
to
actually
configure
this
and
this
config
file
when
you're
just
doing
across
like
two
or
three
different
upstream
services,
not
a
big
deal,
but
what
you
don't
want
to
do
is
sort
of.
As
you
mean
the
kubernetes
way,
you
don't
want
to
have
one
file
that
everybody
has
to
touch
because
then
what
happens?
It's
like?
A
The
idea
for
ingress,
though,
is
that
what
you
do
is
that,
instead
of
having
a
single
configuration
file,
you
actually
have
lots
of
configuration
files,
and
these
things
we
wouldn't
you
see.
Our
ingress
was
was
introduced
in
kubernetes
1.1
before
we
had
custom
resource
definitions,
the
way
to
extend
kubernetes,
and
so
it
was
built
in
as
a
first-class
object.
But
it's
essentially
a
CRD.
It's
a
it's
a
it's
a
document
with
a
schema
that
ends
up
not
being
a
whole
configuration
file,
but
it
ends
up
being
a
fragment
of
a
configuration
file.
A
Reads
all
these
fragments
of
configuration
all
the
ingress
objects
and
then
compiled
those
things
together
for
configuring,
the
software
load,
balancer
and
so
along
the
way.
What
you
have
here
is
a
common
schema,
so
there's
actually
ingress
--is
that
are
backed
by
cloud
resources,
their
ingress
--is
that
are
backed
by
and
genetics
by
H,
a
proxy
all
sorts
of
different
ways,
there's
ones
that
are
purpose-built,
something
like
traffic,
you
know
or
ambassador,
which
does
an
API
stuff
along
with
it,
and
then
there's
a
there's,
one
that
we
did.
A
Hedid
hep
do
called
contour,
which
is
uses
envoy
under
the
covers,
which
is
the
same
c++
based
load,
balancer
that
that
sto
uses
all
right
so
where
we're
at
ingress
provides
a
whole
bunch
of
little
snippets
of
load,
balancing
config
these
things
get
integrated
in
and
that
configures
the
load
balancer.
Now
there's
two
or
three
problems
with
current
implementations
of
this.
So
the
first
problem
here
is
that
the
schema
for
ingress,
so
these
are
ingress
objects,
is
not
great.
A
There's
a
lot
of
undefined
behavior
there's
a
lot
of
capabilities
that
people
want
to
do
that
are
not
that
are
not
exposed
through
them
and,
and
so
what
this
means
is
that,
because
there's
undefined
behavior
there's
a
it's
not
as
portable
as
you'd
like
you
can
take
one
ingress
and
you
can
use
it
on
one
ingress,
controller
and
it'll.
Do
one
thing
you
can
use
it
on
a
different
one.
It'll
do
something
else.
So
that's
not
great.
A
The
second
problem
here
is
that
there's
capabilities
that
people
want
to
do
that
are
not
well
defined
here,
and
so
what's
happened
is
that
you
know
there's
a
set
of
annotations
that
modify
the
ingress
on
the
ingress
object.
There's
the
set
of
annotations
or
key
value
pairs
with
with
essentially
like
magic
junk
set
into
the
the
values
that
changed
the
behavior
of
the
ingress.
We
use
annotations
to
do
similar
things
and
a
bunch
of
places
around
kubernetes,
but
I
think
they.
A
They
really
are
out
of
control
with
the
ingress
world,
and
sometimes
these
annotations
are
actually
shared
across
controllers,
sometimes
different
controller
types,
sometimes
they're
very
specific
to
that
controller
and
there's
no
central
registry
of
these
things.
So
it's
very
easy
to
to
get
confused
in
terms
of
what's
doing
what
there
and
then.
The
second
problem
is
that
the
ingress
object
it
just.
A
The
ingress
controller
just
generally
looks
across
all
namespaces
and
takes
any
ingress
that
anybody
has,
and
so
let's
say
that
we
want
this
one
to
be
at
food
comm,
and
so
we
have
an
ingress
in
this
namespace
for
service,
one
at
phu,
kham
and
then-
and
so
you
know,
and
then
this
is
namespace
one.
This
is
namespace.
This
is
a
namespace
three
and
then
namespace.
That
says
you
know
what
I
want
to
be
food
comm,
and
so
somebody
inside
of
namespace
two
creates
an
ingress
document
that
sort
of
squats
on
phu
kham.
A
Well,
now,
all
of
a
sudden
us
in
dressed
controllers,
like
I,
don't
know
what
to
do.
I
got
two
things
that
are
saying
their
food
comm
should
I
just
pick
one,
and
so
what
that
means
is
that
somebody
in
namespace
to
either
intentionally
or
unintentionally,
can
go
through
and
actually
impact
the
ingress
for
what's
happening
in
namespace
one,
and
so
there's
no
affordance
in
the
current
ingress
scheme
to
be
able
to
to
be
able
to
protect
one
namespace
from
another,
and
so
that's
a
real
problem.
A
And
then
the
other
thing
here
is
that
you
know
the
ingress.
You
know
because
of
all
of
this,
these
things
can
be
pretty
error-prone,
and
so
it's
easy
to
push.
A
new
version
of
ingress
then
break
things
because
there's
no
way
to
really
test
it
out
in
an
easy
way,
because
things
are
not
as
they're
not
as
validated
as
I
think
we
might
want
them
to
be
all
right.
So
does
that
make
sense,
so
that's
kind
of
like
the
state
of
the
art
with
ingress
right
now.
A
A
Okay,
so
he'll
a
gelée
says
+1
unifying
and
validation,
yeah,
all
right.
So
all
right.
So
so,
first
off
there's
a
couple
of
things
path:
priority
in
terms
of
Oh
Julian
says:
could
you
explain
one
more
time
about
upstream
sure?
So
the
idea
is
that
network
traffic
comes
in
from
the
user.
It
goes
to
a
software
load
balancer
now,
so
this
would
be
generally.
Let's
say
if
you're
running
an
AWS.
A
This
would
be
nginx
with
some
configuration
goo
around
it
and
then
nginx
then
takes
that
request
on
a
request
by
a
request
basis
and
actually
picks
a
service
to
send
it
to
and
it'll
pick
the
service
based
on
configuration,
that's
sitting
in
that
in
the
configuration
for
that
load,
balancer,
and
so
that
configuration
might
say,
hey
if
you
see
a
request
where
the
hostname
of
that
request
is
foo.com,
go
ahead
and
send
it
to
service
one
so
service.
One
then
ends
up
being
the
upstream
service.
A
For
this
load
balancer
and
that
terminology
is
that,
like
this
is
considered
upstream
I,
don't
know
why
that's
up,
because
I
always
draw
the
diagrams
this
way,
so
I
would
think
that
this
is
downstream,
but
this
is
just
the
way
that
people
talk
about
this.
Where,
like
that
direction,
is
upstream,
it's
very
confusing
to
me.
A
Okay,
so
did
that
clear
things
up
for
y'all
down
is
upstream
that's
clear,
yeah,
it's
I,
don't
understand
why
it's
just
weird
I
mean
you
could
draw
it
sideways.
I
could
go
like
this
and
then
up
streams
to
the
right,
but
I
don't
think
it
works.
Well,
drawing
it
this
way,
because
you
generally
think
about
the
requests
flow
and
there
were
a
couple
requests
flow
generally.
You
would
draw
from
sort
of
top
to
bottom
on
your
on
your
page,
alright,
so
paths.
Okay,
push
me
evaluate,
reduce
routes,
making
updates
for
all
the
other
ingress.
A
It's
always
fun
yeah.
So
that's
that's!
Definitely
a
man
path,
path,
King
collided,
sometimes
actually
hide
another
ingress
on
the
same
host,
and
this
is
one
of
those
things
where
it's
it's,
where
the
behavior
for
how
the
ingress
deals
with
colliding
ingress
is,
is
under
defined,
and
so
different
ingress
controllers
will
actually
deal
with
this
in
different
ways.
A
Maybe
have
the
ingress
controller,
look
at
a
text
record
and
DNS
for
a
pre-emptive
ride.
The
namespace
owns
the
record,
but
like
I
like
what
contour
does
better
yeah.
So
that
would
be
one
thing
to
actually
do
that
map
and
I'll
talk
about.
Why
one
of
the
things
as
we
develop
contours,
we
want
to
look
beyond
just
restricting
based
on
a
host
name,
but
also
look
across
the
entire
aural
space.
So
we
can
talk
about
that.
A
So
well,
it's
it.
I
got
disconnected
for
a
bit,
so
each
namespace
is
a
different
tenant
project,
and
here
exactly
the
idea
is
that
namespace
would
be
a
different
service,
different
project
and
you
want
to
really
protect
those
from
from
each
other,
and
so
you
could
have
a
ingress
objects
being
being
belonging
in
different
projects.
A
How
concerned
should
people
be
about
the
double
hop
the
load,
balancer
and
diagram,
the
software-based
ingress?
Is
there
a
significant
performance
impact
due
to
that
there
can
be
one
of
the
things
that
you'll
see
is
there's
other
some
other
bouncing
around
that
can
go
here
if
you're
working
in
the
cloud
and
you
get
the
right
magic,
then,
instead
of
using
a
classic
ELB
we're
going
to
set
this
thing
up
with
an
NLB
which
is
a
TCP
based
thing
and
it
actually
I
believe
even
with
the
NLB
you,
it
doesn't
terminate
the
TCP
connection.
A
So
this
reduces
latency
because
with
the
tradition
alb,
the
request
comes
in
it
terminates
it,
it
can
do
its
own
HDD
base
stuff
and
then
in
forwards
it
on
and
so
having
those
back-to-back.
Tcp
connections
can
definitely
add.
Latency,
whereas
NLB
is,
is
transparent
to
the
network.
Right
it'll
modify
the
packets,
but
it
won't
actually
terminate
the
TCP
connection,
and
so
the
the
AWS
NLB
definitely
helps
to
reduce
that
that
that
latency
hit
all
right.
So
hopefully,
hopefully
most
of
you
are
sticking
with
me
here.
A
So
what
we're
gonna
do
now
is
we're
gonna
just
go
ahead
and
we're
gonna
in
Store
install
contour.
So
there's
a
bunch
of
reference
links
here
that
talk
about
what
we're
doing.
But
if
we
go
to
contour
and
you
go
to
deployment,
there's
a
whole
bunch
of
different
ways
that
we
can
deploy
contour
the
one
that
we're
going
to
be
doing,
is
this
called
hostnet
and,
and
actually-
and
this
is
this-
is
how
we're
going
to
do
NLB
here,
which
is
the
the
newer
sort
of
more
network
transparent
raw.
A
A
How
you
do
it
so
there's
other
ways
of
installing
contour,
and
so
we've
tried
to
find
that
the
common
ways
and
actually
make
those
work,
and
so
you
start
by
cloning,
the
contour
repository
and
then
we're
just
going
to
do
a
cube
control
apply
here
and
so
and
let's
see,
there's
a
slack
messages
come
on
my
way.
Okay,
let's
see
people
are
chattering,
I
assumed
George
will.
B
A
A
Let
me
make
sure
that
I,
sync
I
think
I
there
we
go.
Okay,
like
I
said
we
have
four
llamo
files
here.
So
the
first
one
is
a
creates.
A
namespace
for
hefty
au
contraire
creates
a
service
account
and
to
make
ingress
work.
You
generally
need
some
fairly
invasive
permissions,
which
I
consider
kind
of
a
design
flaw.
Oh
and
then
we
have
our
custom
resource
definition
for
ingress
route,
and
so
one
of
the
things
that
you'll
see
here
is
that
it
defines
the
printer
column.
A
So
when
you
actually
go
through
an
ingress
route,
is
the
sort
of
ingress
v2
that
we
created
for
for
contour
and
you
can
identify
which
columns
you
want
to
show
when
you
do
this
stuff
and
then
there's
also,
you
can
put
in
open
API
v3
schema
here,
so
that
there
can
be
some
validation
of
this
stuff.
So
this
is
the
common
stuff
that
is
common
across
all
contour
setups.
A
A
So
if
you
want
to
do
it
on
Prem,
what
you
can
do
here
is
is
you
can
do
something
very
similar
to
this,
but
when
you
come
down
here
and
when
we
get
to
our
service
instead
of
doing
type
equals
load
balancer,
you
do
type
equals
node
port
and
then
what
that
will
and
you
can
actually
specify
with
the
right
yeah
mole
which
node
you
want
it
to
be.
It
means
any
note
on
your
cluster.
If
you
hit
it
on
that
port,
it
will
actually
hit
this
service.
A
So
then
it's
up
to
you
to
figure
out,
you
know.
Do
you
want
that
to
be
port
80?
Do
you
want
that
to
be
443
and
to
get
that's
the
yeah,
and
then
you
do
the
the
node
port
and
then
anything
that
actually
hits
that
will
actually
go
through
and
be
forwarded
on
to
the
ingress,
and
so
then
it's
up
to
you
to
figure
out.
How
do
you
get
traffic
to
to
some
notes?
A
Now
you
can
do
that
across
all
the
nodes
in
your
cluster,
or
you
can
pick
up
a
couple
of
nodes,
maybe
use
canes
and
Toleration
to
separate
them
from
the
rest
of
the
cluster,
so
that
your
contour
is
only
running
on
those
things.
So
there's
some
things
that
you
can
do
to
actually
sort
of
set
up
a
software
load,
balancing
tear
managed
by
kubernetes
when
you
don't
have
something
like
AWS,
alright,
hopefully
that
answers
that
okay.
A
So
the
next
thing
here
is
that
we're
gonna
install
contour
as
a
daemon
set,
which
means
that
it's
gonna
be
running
on
every
node
and
then
Gabriel
says
you
can
use
something
like
metal
lb
also
and
it
works
with
type
equals
load.
Balancer
I
haven't
actually
played
with
metal
at
metal
lb,
so
I'd
love
to
actually
play
with
that.
At
some
point,.
A
There
are
some
like
annotations
to
help
from
atheist
know
what
to
do
with
it,
if
you're
using
Prometheus
to
monitor
it
and
we're
running
it
runs
host
network
equals
true,
which
means
that
this
thing
runs
outside
of
your
container
network
and
in
doing
so,
and
so
it's
running
directly
on
point
8080
and
eight
four,
four
three,
so
you
can
also
because
this
is
running
with
host
networking.
You
can
hit
this
directly
and
you
actually
don't
need
a
service
at
all.
If
you're
doing
that,
so
that'll
actually
go
ahead
and
work
host.
A
Networking
is
a
privileged
thing,
but
you'll
also
find
that
this
will
generally
be
less
hops
and
lower
latency.
When
you
do
this
stuff
also,
and
then
what
we
run
is
we
were
on
contour,
which
is
all
the
configuration
goo.
It
essentially
is
the
adapter
from
kubernetes
to
envoy
and
then
we're
running
on
voi
here
also,
and
then
there's
an
it
container
that
bootstraps
the
configuration
for
Envoy
and
so
on
voice
c++
thing
that
actually
does
sort
of.
A
Like
all
the
package
you
know,
schlepping
around
we're
contour
is
the
thing
that
talks
to
kubernetes
and
then
configures
envoy,
alright,
and
this
stuff
is
all
pretty
standard
and
then
it's
running
under
a
service
count,
and
then
we
have
our
back,
and
so
we
have
a
role
where
you
essentially
get
access
to
config,
Maps,
endpoints,
nodes,
pods
and
secrets
to
be
able
to
list
and
watch
and
secrets
is
the
big
one.
Here,
that's
a
little
bit
scary.
A
It
does
the
same
thing
for
ingress
and
then
it
also
deal
with
deals
with
ingress
routes
and
it'll
actually
go
through
and
do
an
update
so
essentially
right,
staying
restaurateur
that
it
can
actually
write
status
into
those
things,
and
you
can
see
what's
going
on
alright
and
then.
Finally,
the
service,
so
this
is
actually,
how
do
you,
plumb
things
into
into
into
contour
all.
C
A
B
A
C
A
A
A
A
So
I
don't
know,
I'll,
take
a
note
here
and
I'll
ask
Dave
about
about
21
we're
putting
together
the
roadmap
for
the
rest
of
the
year
of
what
we
want
to
do
with
with
contour.
So
I'll
see
what
see
what
the
problem
there
is
and
then
would
it
be
possible
to
make
contour
work
with
traffic
or
H
a
proxy
instead
of
envoy
not
really
and
I.
Think
what's
what's
interesting
about
contour
is
an
envoy
essentially,
is
that
envoy
is
the
data
plane?
A
So
it's
a
thing
that
processes,
packets
and
the
thing
that
knows
how
to
actually
talk
to
kubernetes
is
separated
out
as
a
as
a
control
plane
and
so
one
of
the
the
deployment
examples
here,
and
this
is
more
of
an
advanced
deployment
example.
If
we
look
at
this
host
net
split,
this
is
for
a
really
scalable
deployment.
What
you
do
is
you
actually
run
one
deployment
of
envoy,
which
maybe
you
run
as
a
you-
can
run
this,
maybe
as
a
daemon
set.
A
But
then
you
can
run
like
a
deployment
with
two
replicas
of
contour,
and
so
you
can
essentially
amortize
that
cost
of
actually
running
those
controllers,
such
that
you
set
such
that
the
individual
load
balancers
are
separated,
and
so
the
way
that
that
works
is
that
envoy
essentially
has
a
whole
API
surface
area
where
it
then
read
and
talks
to
contour
the
contour
process.
To
be
able
to
say,
give
me
my
configuration
and
that
API
is
not
supported
by
either
of
traffic
or
h8
proxy.
A
One
of
the
things
that
we
are
looking
at
doing
is
is
taking
the
libraries
and
the
ideas
around
ingress
route
and
working
with
cig
network.
To
maybe
make
this
be
an
evolution
of
ingress
so
that
other
ingress
controllers
can
implement
the
same
ingress
route.
So
they
could
go
through
and
reuse.
Some
of
the
code
in
the
libraries
and
contour
to
be
able
to
do
that
if
they
so
choose.
I
know
that
there's
been
some
interests
from
from
different
quarters
than
that.
All.
A
We're
about
halfway
through
the
swag
code
is
ingress
route.
So,
if
you
go
to,
let
me
go
ahead
and
I'll
type
it
here
here,
I'm
going
to
put
myself
in
there,
so
J
dot,
roll
call
and
so
go
here,
ingress
route.
There
you
go!
That's
where
you
stick
that,
so,
if
you
could
go
ahead
and
do
that,
that
would
be
awesome
and
we'll
definitely
we'll
pick
some
winners
and
we'll
send
you
some
swag
alright.
A
So
that
is
the
working
contour
proposes
of
e
to
the
ingress
API
incur
béarnaise
I
mean
yes
and
no
I
think
we
have
a
bunch
of
ideas
here.
We
want
to
prove
it
out,
get
some
experience,
we're
not
going
to
say
that
hey!
This
should
be.
You
know,
ingress
v2,
but
I
think
there's
some
good
ideas
here
that
we
want
to
use
to
inform
that
discussion.
A
A
A
That
says:
well,
here's
the
original
source
IP
address
of
this
thing,
and
so
that's
called
the
proxy
protocol.
If
ELB
is
operating
in
HTTP
mode
instead
of
tcp
mode,
then
what
it'll
do
is
it'll
actually
start
adding
some
headers.
On
top
of
it,
an
envoy
will
add
those
headers
also
and
what
you'll
see
is
with
using
NLB
with
envoy.
We
actually
don't
will
actually
see
the
true
incoming
requests.
A
Julie
says:
can
we
reference
TLS
secrets
from
another
namespace?
No,
you
cannot
do
that
I,
don't
believe,
and
then
I'd
love
to
see
509
closer.
We
get
cert
manager,
support
for
us
routes,
I
think
the
ideas
that
put
that
on
the
roadmap
for
q1.
So
that's
definitely
something
that
we've
been
looking
at.
Alright,
let's
go
through
and
let's
test
to
see
if
things
have
come
up,
so
I
have
a
sample
application
here
in
deployment
example,
and
so.
A
A
And
so
with
NLB
you,
you
reduce
the
number
of
hops,
but
then
I'll
be
in
host
networking.
You
reduce
the
number
of
hops
so
that
you
actually
sort
of
really
optimize
that
path
here.
Alright,
so
there
we
go.
We
got
that
up
and
running.
Let's
look
at
that:
yeah
mo
real,
quick
just
so
that
we
know
where
we're
starting
from
what
we
have
here
is
we
have
a
deployment
of
my
little
daemon
for
that
road
for
kubernetes
up
and
running
called
cardi.
We
have
a
simple
service
running
to
that.
A
The
service
is
on
port
80,
retargeting
port
8080,
and
then
we
have
an
ingress.
That
is
essentially
a
catch-all
ingress
that
says
anything
coming
in,
doesn't
matter
where
send
it
to
quark
D
on
port
80,
and
so
the
ingress
sends
to
port
80
the
service
maps
from
eighty
to
eighty
eighty
and
then
quark
e
is
listening
on
a
DAT,
and
here
we
go.
We
are
up
and
running
okay,
so
that's
kind
of
cool.
A
Similar,
but
instead
of
an
ingress,
we
have
an
ingress
route,
oh
and
I.
Actually
this
has
already
got
local,
we're
gonna,
go
gordita,
ki,
ji,
K,
dot,
IO
and
then
we're
gonna
apply
that
there
we
go-
and
this
says
okay,
anything
coming
to
this
host
match
the
route
and
forward
that
on
to
QWERTY
port
80.
So
this
is
essentially
the
equivalent
here
and
if
we,
if
this
all
worked
fine,
then
we
can
do
our
deed,
T,
GI,
k,
dot,
IO
and
boom
there.
It
works.
That's
awesome.
A
A
And
so
we
can
sort
of
you
know,
do
a
little
bit
of
comparing
trash
here
to
actually
see
how
these
things
are
different.
One
of
the
things
that
you'll
see
here
is
that
we
have
virtual
hosts,
and
then
we
have
the
routes
that
this
thing
goes
ahead
and
matches
on,
and
then
one
of
the
thing
we
do
cube
control
get
ingress
route.
A
We
can
see,
look
there,
it
is
and
as
here's
the
the
the
fully
qualified
domain
name
and
the
fur,
this
is
the
first
route
that
you
see
there
might
be
more
there
and
we
see
that
the
thing
is
valid
because
will
actually
update
status.
Dave
spent
a
lot
of
time
adding
status
updates
to
ingress
routes,
so
that,
if
you
see
things
go
wrong,
you
can
actually
try
and
debug
it.
A
A
A
So
what
this
says
is
that
hey,
you
didn't
specify
a
virtual
host,
and
so
this
is
a
free-floating
snippet
of
of
ingress
configuration,
and
so
it
says
its
current
status
is
orphaned,
says
this
ingress
route
is
not
part
of
a
delegation
chain
from
a
root
ingress
route.
Alright,
so
I,
probably
just
confused
the
you
there
a
little
bit
so
we'll
get
to
that,
but
that's
the
sort
of
like
where
you'll
actually
start
seeing
some
some
errors
pop
up
here.
A
Alright,
so
we're
gonna
go
ahead
and
put
that
back
apply
it
again
get
the
status,
and
we
see
that
it's
now
back
to
being
valid
again,
and
so
this
stuff
reconfigures
really
really
really
fast.
One
of
the
nice
things
about
envoy,
based
on
the
way
that
Envoy
is
written,
is
that
it's
built
to
be
dynamically
reconfigured,
and
so,
with
these
api's
they
get
configured
right
away,
whereas
I
think
something
like
the
nginx
ingress
controller.
A
It
actually
takes
your
snippet,
actually
literally,
writes
it
to
a
file,
and
then
it
goes
through
and
until
enginex
to
reconfigure
itself.
It
does
that
by
spawning
and
then
leaving
the
previous
version
around
to
handle
any
connections
that
are
incoming,
and
so
the
result
is
that
if
you
end
up
with
a
high
turn
rate
of
your
ingress
Azure
services-
and
you
have
longer
lived
connections,
you
can
end
up
with
with
quite
a
few
of
the
of
the
nginx
processes
still
around
and
that
can
become
a
resource
hog
and
become
problems.
A
So,
while
it's
saying
Mike
Merrill
is
a
code
available.
Oh
forgot,
so
so
Mike
was
saying
that
he
wrote
a
controller
to
copy
around
their
wild
card
certs
so
that
they
can
be
available
across
a
lot
of
different,
a
lot
of
different
namespaces.
And
while
it's
asking
hey,
is
code
available
on
that
one
of
the
things
that
I
think
we
can
do
here
and
this
might
be,
and
I'd
love
for
Dave
or
maybe
Steve
if
he's
on,
is
that
with
ingress
route?
A
Alright,
so
we're
starting
off
slow
here.
So
that's
pretty
simple
stuff
and
I'll
go
through
and
take
this
back
down
alright.
So
now
what
we're
gonna
do
here
is
if
we
go
into
deployment
and
we
go
into
example,
workload
ingress
route,
there's
a
whole
bunch
of
really
interesting
scenarios
here
and
if
you
go
into
some
of
the
blog
posts
that
were
linked
off
the
hack
MD,
so
Steve
says
you
can
limit
where
TLS
certs
live
and
delegate
routes
to
different
namespaces.
So,
yes,.
A
Terminate
with
TLS
in
one
namespace
and
then
you
can
have
the
rest
of
the
configuration
be
done
elsewhere,
so
that
might
be
a
solution
to
not
copying
these
these
wild
card
sorts
around
and-
and
probably
you
know,
in
addition,
you
could
probably
limit
the
our
vac
scope.
That
contour
needs
to
just
reading
secrets
in
that
one
root
namespace,
but
we'll
talk
about
that
in
a
second
as
we
get
get
to
this
dome,
alright,
so
there's
a
bunch
of
common
stuff
which
which
creates
a
namespace,
because
we
have
the
default
namespace.
A
Then
we
have
another
namespace
for
your
marketing
department,
say
and
then
it
creates
a
whole
boatload
of
services
that
that
talk
across
these
things.
Now
I
haven't
gone
through
this
stuff
before
so
I'm
coming
at
this
kind
of
cold
I
ran
out
of
time
to
to
actually
prep,
so,
hopefully,
I
won't
get
myself
stuck
and
then
and
then
and
then
we
have
a
couple
of
deployments,
one
into
the
marketing
namespace
and
one
into
the
default
namespace
of
quar
D,
so
we'll
go
into
ingress
route.
Keep
control
apply
this,
which
up.
A
A
And
it's
okay
yeah,
so
there's
an
it
okay,
so,
but
we
haven't
created
an
ingress
yet,
and
so
the
first
thing
we
can
do
here
is
that
here's
just
a
simple
basic
ingress
route,
and
so
we
already
did
this
with
the
way.
I
already
did
this
with
the
previous
example
with
Cordy,
so
I'm
not
going
to
do
that
one
again.
A
A
So
we
can
go
ahead
and
do
this,
but
this
is
pretty
straightforward,
so
I'm
not
going
to
bother
doing
this
and
then
similarly
and
I
don't
have
sort
manager
set
up
here,
you
can
do
the
same
thing
with
TLS,
where
you
can
actually
specify
the
secret
name
to
use
and
there's
this
assumption
that,
like
hey
you're,
just
using
the
same,
so
reduces
some
of
the
copy
and
paste
that
you
generally
need
with
ingress
for
TLS.
So
this
is
a
TLS
example.
A
A
It
ie
route,
specific
requests
based
on
specific
request,
headers
I
know
envoy,
can
do
a
lot,
but
what
is
exposed
with
the
ingress
routes?
I,
don't
believe
that
we
do
things
based
on
specific
headers
I.
Think
that
that's
something
that
might
make
sense.
The
idea
here
is
that
there's
a
bunch
of
different
sort
of
selectors
that
we
can
do
here
having
a
header
selector
here
as
part
of
the
route
totally
seems
like
it
would
be
a
reasonable
extension
to
add
to
this
one
of
the
other
things
I
mean
we're.
A
A
B
A
Matches
slash
service
to
its
daily
delegate
to
another
ingress
route
called
service,
and
so
in
this
way
one
ingress
route
is
referencing
another
ingress
round.
Now
this
one
is
called
a
route
ingress
route
because
it
actually
has
a
virtual
host
on
there,
whereas
service.
When
we
look
at
this
there's
no
virtual
host,
and
so
this
thing
will
only
be
used
if
it's
explicitly
linked
into
the
delegation
chain.
B
A
C
A
A
A
So
let
me
go
ahead
and
I'll
draw
the
picture
for
you,
but
I
really
want
to
get
to
the
point
where
we
can
visualize
this
now.
It
turns
out
that
there's
an
internal
model
that
contour
keeps-
and
we
have
some
visualization
around-
that
but
we'd
really
like
to
have
some
visualization
over
what
what
users
actually
see.
So
we
have
one
ingress
route
that
has
fqdn
of
poor
d:
dot,
t
GI,
k,
dot,
IO
excuse
my
handwriting,
but
you
know
what
I'm
saying
there,
and
then
we
have
two
routes.
We
have.
A
A
A
A
A
A
A
A
A
A
B
C
B
A
A
A
B
C
A
A
A
A
A
The
typical
rewrite
problem
with
Apps,
not
ready
for
being
behind
us,
slash
whatever.
That's
exactly
what
happened
here
so
Julian
says
how
to
hire
people
for
kubernetes,
give
them
a
yema
with
a
typo
and
watch
how
they
react
yeah.
Unfortunately,
that's
that's
sort
of
the
world
that
we're
in
so
how
do
I
configure
HTV
Ben
to
do
fancier
stuff
I
want
to
do
that.
I'm,
I.
A
A
There
we
go
so
we
can
start
seeing
all
the
stuff
that's
coming
in
and
here
you
can
actually
see
that
we
see
the
VAX
envoy
external
address
coming
through.
It
looks
like
it
actually
maybe
scrapes
or
removes
the
other
address,
I'm,
not
sure
you
know.
We
have
also
have
original
path
here.
So
here
we
can
see
the
original
path
that
this
thing
is
seeing.
A
A
A
That's
what's
happening
there
yeah,
so
it
got
upset
about
it.
We're
too
fancier.
So
generally,
if
you're
gonna
host
things
under
a
path
like
this,
they
got
to
be
ready
to
do
that
stuff
yeah.
So
now
this
is
like
now
a
single
page
app,
so
it
actually
goes
through.
It
actually
gets
all
these
things,
and
so
that's
what
we're
seeing
going
on
here,
whereas
like
what
I
can
do
here
now
is
I
have
another
ingress
route:
let's
go
through
and
cube
control.
A
A
So
we
just
created
another
route
there.
Now,
if
I
go
to
HTTP
bend,
TGI
K
dot
IO
there
now
we
got
the
whole
deal
coming
yeah,
so
path
rewriting
can
sometimes
be
really
problematic.
You
really
need
to
have
everything
sort
of
be
ready
to
be
hosted
on
something
like
a
lot
of
time.
Servers
assume
that
they
have
the
route,
but
you
know
if
your
backends,
if
you're,
if
your
upstream
servers,
are
ready
for
it,
it
can
be
a
really
useful
technique.
A
What
is
the
best
way
to
make
multiple
react?
Applications
work
on
subfolders
assigned
to
each
application,
I
think
with
react
and
I'm.
Not
the
expert
here,
there's
a
way
to
say:
hey,
you're
being
hosted
under
this
particular
path
and
have
it
react
you
know:
have
it
sort
of
configure
itself
automatically?
There's
got
to
be
a
way
to
be
able
to
do
that
so
yeah,
so
cool
all
right.
So
so
now
we
got
HTTP
bin
hosted
there,
but
we
also
have
chordee
hosted
and
we
can
go
through
and
we
can
service
to.
A
This
also
goes
to
h-2b
bin,
but
this
HTTP
bin
is
all
confused,
because
if
I
bet
a
if
I
look
here,
we
have
a
bunch
of
errors
here,
because
it's
like
sorry
I
can't
find
all
the
stuff
that
I'm
looking
for,
because
it's
not
expecting
it's
looking
for
it
on
slash
its
assumes
that
it's
at
the
root
all
right.
So
all
right.
A
So
now
one
of
the
interesting
things
so
the
next
thing
that
we're
going
to
go
ahead
and
do
here
is
we
can
do
Bluegreen
deployments
of
your
ingress
routes,
because
you'll
have
a
tree
of
these
things
and
sometimes
you
may
want
to
be
able
to
switch
between
them,
which
actually
ends
up
getting
super
super
interesting.
And
so
let
me
go
through
and
let
me
take
this
stuff
down.
A
A
We
have
one
we're
gonna,
do
Bluegreen,
TGI,
K,
dot
IO,
and
it's
now
delegating
to
the
thing
called
blue
and
so
blue
is
gonna,
go
to
s2,
which
is
gonna,
be
HDD,
B
bin
and
then
and
then
green
is
going
to
be
s
1,
which
is
QWERTY.
So
we
can
actually
see
both
of
these
things.
Let
me
go
ahead
and
save
this.
I
can
go
through
and
do.
A
Apply
these
now,
if
I
do
a
cube,
control
get
ingress
route.
What
we'll
see
is
that
the
blue
green
route,
that's
working,
fine
and
then
blue
is
totally
valid,
but
green.
We're
getting
this
thing
saying:
hey
its
orphaned,
this
thing's
not
hooked
in
anywhere,
so
it's
essentially
free-floating,
and
so
so
now
I
can
go
to
blue
green
dot,
T
gik
dot.
Io!
Look
at
that
everything's
working!
Fine
I!
A
A
Okay,
Jeremy's
can
headers
be
added
in
an
ingress
right,
I,
don't
believe
so
yet.
I
think
that
that's
a
great
feature
request
are
no
envoy
supports
that
and
that's
something
that
we
might
want
to
be
able
to
do.
It
can
get
a
little
dangerous
doing
that
stuff,
especially
as
you're
delegating
across
stuff
I.
Think
there's
some
security
implications
that
we
want
to
think
about,
but
but
yeah
I
think
that's
super
interesting
all
right,
so
so
now
what
we
have
is
this
is
blue
green,
but
if
I
go
to
blue
dot
e
GI
K
dot,
IO.
A
Yeah,
okay,
so
now
we're
at
blue
everything's
good.
So
here
you
can
see
everything
is
valid
and
everything
has
a
route
in
this.
Visualization,
unfortunately,
is
not
that
I
drew.
We
should
be
able
to
auto
generate
that
at
some
point,
but
now
I
can
go
to
Green
Dot
tgia,
k,
dot,
IO
and
all
right.
Don't
fail
me
here.
A
C
A
That
same
URL
is
going
to
the
new
version,
and
so
what
you
can
imagine
here
is,
if
you're
doing
a
Bluegreen
deployment
like
this.
You
can
have
URLs
that
are
headed
one
way
and
you
can
have
URLs
head
another
way.
You
can
canary
stuff,
you
can
test
it
out
and
when
you're
feeling
comfortable
with
it,
you
can
switch
things
over.
Bob
says
lots
of
good
stuff.
A
Have
you
considered
ASCII
cinema?
You
know
what
every
time
I
read
that
I
read:
ASCII
enema,
I'm,
sorry
I,
like
ASCII
cinema,
but
like
you
can't
host
it
on
like
I,
want
to
create
gifs
that
I
can
post
on
Twitter
and
stuff
like
that,
and
so
ASCII
cinema
asks
cinema
or
whatever
it
is,
is,
is
a
little
bit
tricky
from
a
sort
of
being
able
to
share
it
point
of
view?
Okay,
so
alright,
so
that's
pretty
cool.
A
A
A
A
A
B
A
All
right,
so
we
have
services,
and
then
we
have
delegate
delegate
is
a
name
and
a
namespace
I.
Don't
think
you
can
do
multiple
there
I
think
we
probably
want
delegates
and
you
can
actually
do
you-
can
do
a
weight
across
that
okay,
so
we'll
cheat
here,
we'll
go
services
and
then
I'm
going
to
go
through
and
actually
steal.
B
A
B
A
Delegates
to
ABA
then
contains
the
route
to
folder.
A
well
B
contains
a
route
to
folder
B.
How
can
we
determine
which
delegate
should
be
so
when
you
delegate
to
something
there's
essentially
a
decision
path
there
in
terms
of
which
one
do
you
want
to
go
to
and
contour
makes
sure
that
only
one
path
or
that
that
that,
at
each
level
it's
deterministic-
or
at
least
you
know,
statistically
viable
in
terms
of
which
path
you
actually
go
ahead
and
take.
If
you
try
and
do
a
cycle,
then
it'll
definitely
catch
that
stuff.
A
So
now
what
we
can
do
is
we
can
go
through
and
we
can
do
wait
and
I
can
go
through
and
I
want
to
do
so
now.
This
is
one
hundred
to
one.
The
the
idea
is
that
well
we'll
do
what
that
will
do
50
to
one
right,
so
this
weight
is
50.
This
weight
is
one
you
sort
of
do
those
things
proportional,
it
doesn't
have
to
add
up
to
100.
A
We
go
do
that
now
we
should
mostly
get
to
here,
will
hardly
ever
get
one,
but
once
in
a
while
we'll
get
one
if
you
get
to
see
a
lot
of
traffic
once
in
a
while
you'll
go
ahead
and
get
one
and
let's
see
so
I
think
I'm
running
out
of
time
here,
but
there's
all
sorts
of
other
features
here,
but
I
think
it's
really
interesting
and
then
oh
and
then
the
next
thing
that
you
can
do
and
I
think
I
think.
Oh,
why
is
this
getting
timeout.
A
Is
that
these
delegations
can
actually
work
across
namespace
and
so
I?
Don't
think
we're
gonna
have
time
to
go
into
this,
but
let
me
draw
that
out
for
you
so
that
you
all
can
see
sort
of
what
things
look
like.
This
is
the
idea-
and
this
is
what
we
actually
built
for
our
customer,
who
wanted
to
be
able
to
essentially
have
a
safe
way
to
do
this
stuff.
Oh,
you
need
to
specify
a
wait.
Okay,
no
way
means
zero.
Okay,
so
the
default
is
zero.
Four
wait,
sorry,
my
mistake.
A
A
You
guys
didn't
see
that
sorry,
so
I
went
through
and
I
changed
it
to
this,
where
I'd
put
a
weight
of
25
here
and
I,
put
away
250
there
and
then
I
applied
that
and
then,
when
I
reload
I'll
get
version
two
which
you'll
see
up
here
a
lot
more
then
I'll
get
version
one
there.
We
go
if
no
weights,
it's
an
even
distribution,
otherwise
the
weights
matter,
and
if
you
don't
put
a
weight
on
something
that
means
no
traffic.
Okay,
cool.
So
let
me
draw
out
what
let
me
draw
out.
A
Is
that
you'll
have
a
special
namespace?
So
imagine
this
is
all
one
big
cluster
you
know
of
a
special
namespace
that'll,
be
my
contour
root
namespace
and
then
for
each
of
your
top-level
domains.
You'll
have
something
like
you'll:
have
an
ingress
route
for
food,
calm,
okay
and
then
namespace,
and
then
this
will
then
delegate
over
to
maybe
here's
my
namespace
foo.
A
And
I
have
AI
now
I
actually
have
an
ingress
route
called,
say,
foo
route,
and
so
you
have
to
coordinate
the
naming
across
these
things,
but
the
way
that
this
works
now
is
now
you
can
actually
sort
of
you
know
send
this
to
services.
You
can
like
delegate
to
you,
know
foo,
blue
or
whatever.
Here
that
goes
to
service,
you
can
do
whatever
you
want
in
terms
of
this
particular
thing,
but
essentially
this
particular
route.
This
defines
all
your
routes,
and
this
is
where
TLS
can
happen.
A
Also,
if
you
don't
want
to
share
all
this
and
then
you
can
go
ahead
and
send
this
stuff
off
to
off
to
the
other
ingress
over
here
across
the
namespace
now
by
default
with
contour
anybody
all
right,
Steve
have
a
good
time
and
see
you
later
have
a
good
weekend.
Anybody
can
go
through
and
and
establish
a
root
name
space
with
fqdn.
Well,
there's
an
option
when
you
launch
contour
and
that's
documented,
where
you
can
say:
hey
contour
I
want
you
only
to
look
for
roots
in
this
one
single
namespace.
A
So
that
way,
if
somebody
actually
tries
and
creates
a
root
namespace
inside
of
here,
it'll,
either
get
ignored
or
you'll
get
an
error
out
of
it,
and
so
that
way,
what
you
can
lock
down
is
that
only
people
who
have
write
access
to
contour
root
can
establish
new
new
roots
in
this
thing.
Furthermore,
like
this
thing,
foo
can
actually
go
through
and
you
can
have
a
namespace,
it
called
say:
foo
v2
right
and
you
could
have
an
ingress
route
here,
and
this
could
delegate.
A
You
know
you
know,
or
this
this
can
delegate
its
own
thing,
but
we
can
actually
have
here.
We
can
have
this,
be
the
/v
to
route
that
actually
goes
here
or
maybe
this
is
API,
and
this
is
foo
API
or
something
like
that,
so
you
can
then
go
through
and
then
sub
delegate
this
even
further
across
more
namespaces.
A
So
it's
really
moving
the
control
around
configuration
to
different
folks,
and
so
it's
kind
of
inspired
by
the
way
that
DNS
works
in
terms
of
its
delegation
and
so
I
think,
that's
mostly
what
I
wanted
to
cover
there's
some
more
stuff
going
on
there.
We
talked
about
multiple
routes,
so
you
can
do
canary
like
stuff,
and
so
the
question
here
was
rate
limiting
I
think
that
would
be
great
rate.
Limiting
is
another
feature
that
would
be
great
to
add
here.
A
But
overall,
if
you
go
through
these
blog
posts,
they
actually
go
through
describe
some
of
what
I
actually
talked
about.
Third-Party
auth
is
high
on
our
list,
so
one
of
the
things
that
we
see
in
common
quite
a
bit
is
that
folks
will
want
to
do
something
like.
Oh,
you
know,
create
a
portal
where
any
any
application
developer
can
come
up
and
say:
hey
I
want
to
write
an
app.
They
then
get
a
kubernetes
namespace
as
part
of
that
they
get
an
ingress
route
configured
for
them.
A
That
ingress
route
is
configured
with
like
app
name
dot
like
internal
fubar,
comm
type
of
thing
and
then
by
default.
You
want
to
make
sure
that,
like
you,
don't
accidentally
expose,
you
know
internal
company
information
to
the
rest
of
the
world,
so
you
want
to
put
something
like
an
oauth2
proxy
in
front
of
it,
and
so
that's
scenario
where
you
want
to
run
an
ingress
controller
where
every
access
to
that
ingress
controller
has
to
go
through
some
sort
of
auth.
A
That's
definitely
something
that's
on
our
radar,
because
we
think
that
that's
a
really
important
situation,
so
Jeremy's
is
asking
how
does
contour
fit
in
with
Sto.
That's
a
really
good
question
sto.
It
does
do
things
that
look
a
little
bit
like
ingress
with
these
things
called
gateways,
but
but
the
bulk
of
what
sto
concentrates
on
is
what
we
call
east-west
traffic
traffic
between
different
services
between
micro
services.
A
That's
really
the
the
sort
of
the
genesis
of
where
the
mesh
comes
from
the
idea
of
a
service
mesh
comes
from
where,
as
with
contour,
we
really
wanted
to
solve
the
problem
around
Northwest
traffic
right.
How
do
you
actually
get
traffic
into
and
out
of
your
cluster,
which
is
a
different
problem
from
dealing
with
that
east-west
traffic?
A
Is
it
crazy
to
want
to
use
this
do
for
that
Northwest
traffic
or
north-south
traffic?
Assuming
we
are
trying
that
for
hybrid
multi-cloud
I
mean
you
know,
I'm,
not
an
SEO
expert,
so
I'm
not
going
to
try
and
claim
that
I
have
all
the
latest
knowledge
of
what's
going
on
yeah.
So
one
of
the
things
that
we
looked
at
is
do
in
this
whole
idea
of
delegating
across
namespaces,
across
the
uro
space
being
able
to
actually
control
who
has
access
to
what
ingress
routes.
A
That's
something
that
was
really
really
important
for
our
customers
and
that's
not
something
that
his
tio
can
do,
and
so
the
configuration
for
SDO
is
not
it's
not
written
in
a
way
such
that
it's
it's
compatible
with.
Kubernetes
are
back.
You
know
in
that
type
of
way,
so
you
can't
restrict
that
ingress
stuff
based
on
our
back
rules
with
with
kubernetes
looking
at
the
sto
API.
A
Is
they
have
this
idea
of
a
virtual
service
which
is
in
some
ways
similar
to
an
ingress
route,
but
there's
no
way
to
actually
delegate
or
have
one
virtual
service
talk
to
another
virtual
service,
and
so
it's
really
sort
of
like
a
one
tier
type
of
thing
where,
as
we
really
looked
at
ingress
route
as
being
a
logical
construct
versus
something
that
you
know
without
any
sort
of
decision
making
gets
rendered
directly
into
into
envoy.
So
hopefully
that
answers
that
question
I
have
high
hopes
that
we'll
find
a
way
to
bring
this
stuff
together.
A
I
mean
my
ideal
world
is
that
we
take
something
either
ingress
route
or
something
like
ingress
route.
We
use
that
define
ingress,
v2
there's
the
ingress.
V2
is
good
enough.
Such
that
sto
can
actually
play
along
with
that
I'd
love
to
see
is,
do
actually
get
get
the
right.
Extensibility
hooks
such
that
contour
can
actually
play
a
path
with
this
to
you
also-
and
it's
not
sort
of
one
you
know,
cuz
right
now
is
do
is,
is
a
pretty
you
know.
A
A
Thank
you,
everybody
for
watching,
and
definitely
you
know,
hit
the
like
button
and
subscribe
and
all
that
again
the
if
you
want
some
swag,
the
there's
TGI
K
roll
call
here
and
the
code
there
is
ingress
routes.
Please
go
ahead
and
put
your
name
there
and
put
an
email
address
in
there
and
thank
you
so
much
for
joining
me
and
we're
not
quite
sure
what
we're
doing
next
week,
but
I
guarantee
it
will
be
exciting
and
so
I
will
sign
off
and
see
you
all
then.
Have
a
great
weekend.