►
From YouTube: TGI Kubernetes 034: Elasticsearch Operator
Description
Come hang out with Joe Beda as he does a bit of hands on exploration of Kubernetes and related topics. Some of this will be Joe talking about the things he knows well. Some of this will be Joe exploring something new with the audience. Ask questions, comment and help decide where things go.
This week we'll be exploring the Elasticsearch Operator. This was by popular demand via an ad hoc twitter poll: https://twitter.com/jbeda/status/989222662516891648
0:00:00 - Welcome
0:03:00 - Intro Ryan Schneider! Woo!
0:04:16 - Ashley t-shirts and shout out to Ashley McNamara! Woo!
0:07:48 - Kubernetes as a Platform Platform
0:09:10 - Cilium
0:09:40 - Announcing Heptio Gimbal
0:15:00 - New Golang Branding
0:16:21 - Kubecon and Heptio Presentations
0:21:16 - Diet Coke and Starting the Operator
0:21:35 - ElasticSearch overview
0:31:10 - Deploy the operator
0:33:07 - Inspecting the static manifest
0:37:18 - Installing the operator
0:41:21 - Bringing up a cluster (Kibana and Cerebro)
0:50:30 - Inspecting the underlying storage classes
0:54:30 - Elastic Search Cluster CRDs
0:55:10 - The importance of status
0:56:00 - Inspecting the ES cluster resources
0:59:20 - Accessing the ES cluster
1:01:27 - ES dashboard
1:03:46 - Cerebro dashboard
1:09:32 - Loading sample data
1:14:17 - Kris.
1:15:20 - Breaking up data sets
1:20:00 - Kibana with Silicon Valley
1:24:00 - Uploading Shakespeare
1:32:49 - Cat API with ES
1:35:54 - Get Shakespeare search
1:43:22 - Get cluster health
1:48:45 - Thanks and Goodbyes!
Links:
* Get well Ashley! Buy tshirts to benefit WomenWhoGo: https://medium.com/@ashleymcnamara/gophercon-2018-b9a97387b954
* TGIK8s voting! https://twitter.com/jbeda/status/989222662516891648
* Presentation: Kubernetes is a Platform Platform: http://slides.eightypercent.net/platform-platform/index.html#p1
* Cilium hits 1.0: https://cilium.io/blog/2018/04/24/cilium-10/
* Introducing Heptio Gimbal: https://blog.heptio.com/introducing-heptio-gimbal-bridging-cloud-native-and-traditional-infrastructure-9d6224bece5a
* Contour ingressroute design: https://github.com/heptio/contour/blob/master/design/ingressroute-design.md
* Go (re)branding: https://blog.golang.org/go-brand
* Kubecon EU 2018: https://events.linuxfoundation.org/events/kubecon-cloudnativecon-europe-2018/
* Heptio at KubeCon EU 2018: https://gist.github.com/jbeda/a0193c15c26a855b5d84eea25b8852a9
* Kubernetes Contributor Summit: https://github.com/kubernetes/community/tree/master/events/2018/05-contributor-summit
* Elasticsearch Operator: https://github.com/upmc-enterprises/elasticsearch-operator
* API definition structs: https://github.com/upmc-enterprises/elasticsearch-operator/blob/master/pkg/apis/elasticsearchoperator/v1/cluster.go
* Sample data docs: https://www.elastic.co/guide/en/kibana/current/tutorial-load-dataset.html
* William Shakespeare subtweets on twitter: https://twitter.com/wwm_shakespeare
A
Hello
and
welcome
to
another
edition
of
t
GI
kubernetes,
my
name
is
Joe
Beda
and
I
am
your
host
for
today.
T
GI
kubernetes
is
a
weekly
ish
livestream,
where
I
go
through
some
of
what's
going
on
in
the
kubernetes
world
and
do
a
deep
dive
into
some
type
of
topic.
I
vary
it
up
every
time.
A
lot
of
times.
Recently
it's
been
covering
some
interesting
projects
in
the
community
stuff
building
on
top
of
on
top
of
kubernetes,
so
I'm
the
CTO
of
hefty.
Oh
one
of
the
co-founders.
A
We
are
a
company
helping
bring
kubernetes
to
the
enterprise
and
beyond
before
that,
I
was
at
Google
and
helped
start
the
kubernetes
project.
So
I
like
to
start
out
by
first
of
all
doing
a
sound
check,
making
sure
that
I
look
fine,
I,
sound
fine,
because
you
never
know
with
these
things.
If
everything's
going
to
be
great,
but
hopefully
things
sound,
good
and
I
want
to
say
hi
to
everybody
on
the
the
live
chat
over
on
the
right
there.
A
But
then
recently
I
saw
that
that
YouTube
will
actually
sort
of
you
know
replay
the
live
chat
in
time
right
next
to
the
video
when
you're
watching
it
after
the
fact,
when
you're
watching
a
recording
but
I
still
like
having
the
chat
there,
because
for
folks
who
are
watching
this,
perhaps
on
a
TV
or
what
have
you,
you
don't
always
see
the
chat
along
with
it.
So
it
is
part
of
the
part
of
the
interactive
nature
of
stuff,
so
yeah.
A
So
let
me
say
hi
to
everybody,
so,
starting
from
the
top
enrique
from
Spain
and
I.
Just
love
that
everybody's
joining
me
from
all
over
the
world.
It's
1:00
p.m.
here
on
the
west
coast
of
the
US,
but
a
lot
of
folks,
it's
their
Friday
evening.
So
thank
you
for
joining
me
on
your
Friday
evening
and
and
for
some
folks
like
they'd
like
to
say
they're
living
in
the
future
and
it's
already
Saturday
morning.
So
thanks
for
for
spending
some
of
your
off
hours
with
me.
A
Let's
see
Philip
good
to
see
you
Steve
who's,
a
hefty
employee,
who's,
gonna
he's
actually
one
of
the
the
main
author
of
the
project
that
we're
gonna
be
looking
at
today.
So
thanks
for
joining
us
Steve
and
helping
us
out
is
Chris
so
yeah,
let's
see
all
right.
It's
the
sounding
video
sent
looking
good,
that's
good
and
yeah.
So
let
me
go
through
oh
and
Ryan's
able
to
join
us
too.
So
Ryan
is
our
hourly
trainer
here
at
hefty
Oh.
A
But
before
that
he
was
at
elastic,
and
so
he
has
a
lot
of
very
cheap
knowledge
on
elastic
in
the
stat.
The
elastic
stack
there
so
I'm
glad
that
Sean
was
not
gonna,
be
on
I'm
Ryan
was
gonna,
be
on
a
plane,
I'm
glad
he
was
able
to
join
us
and
I
use
it's
1:30
a.m.
oh,
my
goodness,
man
I,
you
know
that's
a
and
then
Robby
from
India
all
right.
Well,
let's
go
ahead
and
get
started.
Thank
you.
Everybody.
A
I'm
kind
of
an
elastic
search
noob,
but
I
did
spend
a
lot
of
time
at
Google,
so
the
whole
search
space
is
something
that
I
actually
have
a
decent
handle
on
and
then
and
then
also
go
talk
about
what
an
operator
is
and
how
that
fits
in
with
kubernetes
and
we'll
go
through
some
of
the
nitty-gritty
details
of
using
the
the
elastic
search
operator.
I.
Think
it's
a
it's
a
good
example
to
sort
of
view.
This
the
you
know
this
lends,
but
a
lot
of
times
I'd
like
to
start
TGI.
A
A
There's
a
ton
of
designs
there.
She
originally
went
with
one
vendor
and
then
switched
it
up.
So
now
there's
a
Threadless
store
here
and
if
I
click
on
this
you
can
see
like
there's
like
you
can
just
do
like
load
more
load
more,
it's
like
so
many
cool
shirts
and
so
I
got
this
one
and
then
my
son.
We
got
him
like
the
video
game
playing
one
I,
don't
know
if
we
can
find
it
here,
it's
in
here
somewhere,
so
yeah
there's
the
there's
the
this
is
fine.
A
There's
the
gophers
hugging,
which
how
do
they
hug
I,
don't
know
they
bump
eyeballs,
but
go
for
Mike
drop
is
awesome,
yeah,
the
the
Gopher
pride
and,
let's
see
if
I
can
find
I,
don't
see
the
the
video
game
playing
one
that
my
son
there's
like
a
sailor,
one,
maybe
that's
I,
don't
know
if
that's
a
kubernetes
specific
sailor
or
not
so
yeah,
so
a
lot
of
great
things
there,
and
so
you
know
shout
out
to
Ashley
now
Ashley
yeah
was
recently
there's
a
kubernetes
Gover
shirt.
I
should
get
that
at
some
point.
A
So
Ashley
was
recently
in
the
hospital
and
had
some
surgery
and
yeah
gay
for
him.
No,
but
the
thing
said
go
for
it
Chris.
So
you
know
I
go
for
pride,
but
Ashley
was
in
the
hospital
she's
out
now
she
had
some
surgery
and
so
I
just
want
to
send
positive
thoughts,
her
way
on
a
speedy
recovery,
so
yeah-
and
thank
you
for
for
doing
these
for
for
for
the
the
women
who
go
diversity,
scholarship,
that's
a
really
cool
thing
that
you
did
there
Ashley
alright,
so
let
me
go
through
so
other
stuff.
A
I
wanted
to
pull
out
so
like
40,
gik
I,
you
know
sometimes
I'll
pick
a
topic
and
I'll
go
through
a
series.
That's
what
we
were
doing
before.
Sometimes
it's
more
sort
of
you
know.
Ad-Hoc
a
little
while
ago,
I
sent
out
a
survey
and
like
top
of
the
list
here
was
the
elasticsearch
stuff.
So
that's
that's
what
we're
doing
right
now,
but
the
whole
idea
of
we
flux
in
this.
A
You
know
the
whole
idea
of
get
ops
and
sort
of
weave
flux
is
one
implementation
or
one
tool
for
that
was
also
very,
very
popular,
so
I'm
hoping
to
do
that
soon.
Also
and
then,
a
little
while
ago,
I
did
a
live
coding
of
a
controller
I'd
like
to
do
something
like
that
again
and
something
that
I've
been
kicking
around
for
a
long
time
is
building
a
minecraft
server
operator
where
we
can
build
an
operator,
it
launches
minecraft
servers,
and
then
we
can
look
at
what
does
it
take
to
actually
manage
full
lifecycle,
those
services?
A
How
do
we
deal
with
the
networking
issues
for
these
things?
How
do
we
go
through
and
and
then
also
manage,
like
maybe
like
doing
a
GUI
on
top
of
it?
That
type
of
thing
so
I
think
that
might
be
fun
as
a
sort
of
multi-part
project
that
you
know
has
the
potential
of
being
a
huge
amount
of
time
that
I'm
signing
up
for,
but
I
think
that
one
would
be
fun
too.
So
keep
your
eyes
out
for
future
topics
there,
let's
see
other
stuff
that
I
did
is,
is
on
Wednesday.
A
I
did
a
talk
at
DevOps
days
here
in
Seattle
and
talking
a
lot
about
sort
of
extensibility
of
kubernetes,
and
so
the
talk
was
kubernetes
is
a
platform
platform.
I
went
ahead
and
posted
my
notes.
My
slides
with
speaker
notes
and
so
I
tend
to
write
relatively
complete
speaker
notes
when
I
do
these
things
and
so
I'll
go
ahead
and
click.
This
link
in
the
show
notes
afterwards
that
you
all
can
see
that
so
the
mady's
asking
is
there
any
plans
to
dive
into
the
sea
liam
in
the
future.
A
A
One
of
the
things
that
I
did
want
to
call
out
and
I
forgot
to
put
a
note
in
here
is
that
these
folks
hit
1.0
recently
if
you
go
and
look
at
the
blog
and
so
I'll
go
ahead,
and
this
is
look
super
exciting.
So
it
is
on
my
list
in
terms
of
things
that
I
want
to
are
really
understanding
and
digging
into
so
I'm
gonna
I'm
gonna
make
sure
that
I
include
that
link
in
the
show
notes,
also
because
that
was
something
interesting
that
that
happened
this
last
week.
A
I
know
Jesse
Frisell
is
also
a
huge
fan
of
them
and
it
starts
looking
at
using
something:
that's
more
efficient
and
sort
of
more
purpose-built
for
doing
some
of
the
stuff
that
kubernetes
does
versus
iptables
like
if
you
look
at
something
like
iptables,
in
the
way
that
we
do
cluster
IPS
it's
it's
kind
of
it's
kind
of
strange
and
so
I'm
really
interested
to
understand
more
about
about
what
these
folks
are
doing.
Alright.
So
the
other
big
news
for
us
at
least
this
week
is
that
we
introduced
this
project
called
hep
tol
gimble.
A
Oh,
they
used
to
be
known
as
Yahoo
Japan
America,
so
they
are
essentially
an
American
subsidiary
of
Yahoo
Japan
Yahoo
Japan,
even
though
they
share
a
name
with
the
the
US
Yahoo,
which
is
now
o'the.
This
is
very
confusing.
You
had
to
draw
a
map
here,
it's
really
a
very
different
company
and
they
really
have
a
very
different
position
in
the
market
in
Japan
than
than
Yahoo
in
the
US.
A
So
it's
still
very
much
focused
on
solving
what
what
we
call
the
north-south,
the
incoming
load,
balancing
thing
versus
east-west,
which
is
sort
of
service
to
service
so
still
focused
on
the
north
south,
but
instead
of
thinking
of
the
load,
balancing
infrastructure
is
being
part
of
a
cluster
we're
thinking
about
extracting
that
to
be
a
separate
component.
A
separate
control
plane
now
under
the
covers
that
uses
kubernetes
and
it
uses
the
extensibility
points.
But
but
the
goal
there
is
to
provide.
You
know
a
scalable
software
based
load,
balancing
control
plane
now
along
the
way.
A
One
of
the
things
that
we're
doing
is
we're
we're
proposing
and
going
to
be
implementing
in
contour
some
new
alternatives
to
the
ingress
data
schemas
that
are
more
attuned
towards
multi
team
scenarios,
because
right
now,
when
you're
running
ingress
in
a
cluster,
if
somebody
writes
an
ingress
rule,
they
can
pretty
much
squat
on
anything.
Any
part
of
the
URL
space
that
you'd,
like
one
of
the
things
that
we're
looking
at,
is
a
way
that
you
can
have
a
permission.
A
Delegation
model
where
you
can
say:
hey
I
want
this
particular
namespace
to
be
able
to
handle
this
hostname
or
this
hostname.
You
know
anything
under
this
particular
path.
So
if
you
go
and
I'm
gonna
include
this
blog
post
again
in
the
show
notes,
but
if
you
go
and
you
look
down
here,
there's
we
also
have
so
we're
gonna.
Look
at
overlay
networks.
Where
was
this
I
think
that
there's
a
proposal
new
design
for
the
policy
stuff
here?
A
A
Did
you
see
it
one
day,
working
across
clusters
at
different
cloud
providers?
Yes,
yes,
and
no
I!
Think
anytime,
where
you
move
from
being
to
a
single
node
to
a
cluster
or
from
one
cluster
to
multiple
clusters
or
from
a
set
of
co-located
clusters
to
a
set
of
geographically
located
clusters.
There's
really
new
considerations
you
have
to
take
into
account.
I
could
see
over
time
us
adding
capabilities
that
work
to
distribute
traffic
across
different
geo
locations.
To
really
do
that.
Well,
though,
you
need
a
deep
level
of
networking
support,
that's
difficult
to
do
with
clouds.
A
Google.
You
know,
GCP
Google
cloud
platform
does
have
some
really
interesting
capabilities
for
doing
cross
region,
load,
balancing
in
a
super,
smart
way
and
and
I
think
they're
relatively
unique
there.
They
use
this
technology
called
anycast
IPs
so
that
you
essentially
get
one
global
IP
address
that
that
smartly
routes
to
to
the
the
regions,
the
cluster
is
where
you
have
where
you
have
capability
and
capacity.
So
it's
a
really
complicated
thing.
A
We
want
to
start
doing
something
in
that
direction,
but
you
know
baby
steps
one
thing
at
a
time
and
then,
let's
see
before
that's
how
you'd
said
voted
for
flux,
bummed
that
it
didn't
you
yeah,
maybe
well
next
week,
is
gonna,
be
cube
con,
so
I'm
not
going
to
be
be
doing
a
TGI
K
because
I'll
be
it's
it's
hard
enough
to
do
it
I'm
doing
it.
You
know
when
it
when
traveling,
but
definitely
gonna,
be
looking
at
and
maybe
doing
flux
the
the
week
after
alright.
So
let
me
keep
moving
here
so
there's
also.
A
This
is
fascinating.
There's
a
new
branding
for
go
the
language
which
is
I,
think
everybody's
kind
of
scratching
their
head
on
this.
It's
I'm
not
quite
sure
what
to
think
so.
There's
a
ton
of
hot
hot
takes.
So
you
know
with
Steve
that
that
essentially
at
least
wrote
the
blog
post
enormous
amount
of
respect
for
Steve
Steve
did
such
things.
You
might
know
him
from
Hugo.
He
wrote
to
Hugo
the
the
Hugo
static
site
generator.
He
also
did
Cobra,
which
is
the
command-line
framework.
He
did
the
P
Flags.
A
So
he's
done
a
whole
bunch
of
interesting.
Go
projects
he's
now
at
doing
this
stuff
and
I
assumed.
Maybe
he
real
ed,
the
he
led
the
the
rebranding
effort,
but
it's
fascinating,
but
everybody
is
really
worried,
but,
like
this
line
here,
the
beloved
gopher
mascot
remains
a
central
part
of
the
brand.
But
when
you
download
the
brand
book,
it's
not
clear
that
that's
the
case,
so
we're
still
figuring
that
out.
My
favorite
thing
about
corporate
Christmas
like
I
love
Cobra.
A
My
favorite
thing
about
Cobra
is
that
it's
actually
Cobra
Commander,
which
is
a
total
like
old-school,
GI,
Joe
reference,
which
you
know
harkens
back
to
my
youth,
so
hey
Bob
from
Bellevue.
Thanks
for
joining
us
all
right
and
then
let's
see
and
then
next
week
is
cue.
Connie
you
it's
in
Copenhagen,
I'm
gonna
be
leaving
on
Sunday
traveling.
There
gonna
be
all
week.
A
The
lot
of
interesting
talks
going
on
a
lot
of
interesting
stuff-
I'm,
not
speaking
this
time
around,
but
but
we
do
have
a
lot
of
hep
tio
folks
that
are
going
to
be
there
we're
doing
a
paid
training
if
most
of
the
folks
that
are
dialing,
as
he
gik
already
pretty
far
down
the
kubernetes
path.
But
if
you're
new,
you
know,
there's
still
some
slots
available.
There
ryan
is
leading
that
up
and
he's
on
the
he's
on
the
line
here
for
TGI
key
and
then
we're
talking
about
contour
craig
tracy.
A
One
of
our
field,
engineers
is
talking
about
sort
of
day.
Two
things:
Chris
was
gonna,
be
doing
a
talk
with
Jessie
Frisell,
but
Jessie
had
a
conflict.
It
can't
be
there
and
so
that
session
might
change.
They
were
gonna,
do
like
like
Jessie
and
Chris
hack,
each
other
and
I'm
super
disappointed
that
they
won't
do
that
so
I'm
hoping
that
maybe
maybe
some
other
time
they
can
do
Jessie
and
Chris
hack
each
other.
A
So
we
have
a
pretty
full
schedule
here,
oh
and
then
the
other
thing
is
that
there
is
a
diversity
luncheon
panel
I
should
we're
gonna.
Have
we
have
to
put
that
on
this?
Just
here
get
Chris,
but
we
there's
a
diversity.
Luncheon
panel,
with
with
Shanna's
who's,
our
vp
of
operations
and
finance
who's,
going
to
be
going
to
be
going
to
cube
con,
also
and
chris
will
be
talking
and
and
hefty
o
is
co-sponsoring
the
the
lunch
in
there.
So
that
should
be
super
interesting.
A
Let's
see
if
shawn
says,
uses
hugo
and
can't
not
use
Cobra
and
viper
yeah
exactly
so
so
Steve's
pretty
prolific
there
so
yeah.
So
if
you're
at
Q
Khan
and
we're
also
gonna,
have
a
booth
so
come
by
and
see
us
so
ok
end
of
pitch
there
and
then
cube
Khan
is
going
to
be
Wednesday.
Thursday
Friday,
the
Tuesday
before
cube
con
is
going
to
be
the
kubernetes
contributor
summit,
which
George's
fence
and
and
Paris
who's.
A
Another
community
manager,
working
at
Google
on
kubernetes
project
have
been
spending
a
ton
of
time
planning
this
the
morning
is
focused
on
there's
a
lot
of
work
on
sort
of
new
contributor
workshop
and
sort
of
like
there's
some
tracks
around
doc,
sprints
and
stuff,
like
that.
Getting
some
work
done,
but
also
providing
an
on-ramp
for
folks
who
want
to
contribute
who
need
some
help
to
be
able
to
get
going
and
then
there's
going
to
be
some
sig
updates
and
some
stuff
going
on
after
the
after
that
particular
day.
A
So
this
is
going
to
be
the
day
before
the
conference
is
probably
my
fullest
day
because
we're
doing
our
training.
Then
we
have
this
this
this
contributor
summit
and
then
there's
a
bunch
of
sea
and
CF
activities.
Also,
so
you
know
everything's
going
to
be
a
letdown
after
that,
alright,
so
that
is
holy
moly,
so
I
covered
a
lot
of
sort
of
pre
things.
A
I
think
you
know,
there's
a
lot
of
announcements,
oftentimes
going
into
Q
cons,
so
so
I
think
we
see
that
there,
but
I
want
to
get
down
to
the
meat
of
this
and
start
looking
at
the
elasticsearch
operator.
Any
last
questions
before
we
start
digging
into
stuff
now
I'm
watching
the
chat
here,
I'm
open
my
diet,
coke
I'll
do
like
the
Frog
thing.
A
Let's
see
so
Enrique
says
this
week
started
the
beta
testing
of
the
new
CK,
a
decertification
I
completed
the
exam
just
a
couple
of
hours
ago,
and
it
looked
pretty
ready
and
definitively
worthwhile
for
developers
and
kids
yeah,
so
so
yeah
thanks
for
mentioning
that
Eureka.
This
is
interesting.
There's
the
new!
A
So,
let's
get
down
to
brass
tacks
here,
so
the
elastic
search
operator.
So
this
is
something
that
Steve
did
at
his
previous
employer
and
so
and
they
actually
had
to
use
the
thing
which
means
that
it
probably
works.
Cuz
you're
right
software
differently
when
you're
actually
using
it
yourself,
which
I
find
incredibly
encouraging
and
basically
the
idea
is
that
it
provides
an
API
driven
way
to
launch
and
manage
elasticsearch
on
top
of
kubernetes
and
so
for
those
who
are
not
sort
of
like
don't
have
the
decoder
ring.
A
A
an
operator
is
a
special
type
of
program
that
runs
on
top
of
kubernetes
that
listens
to
an
API
using
some
of
the
kubernetes
extension
points
and
we'll
see
how
that
works
as
we
go
through
this
and
then
turns
around
and
talks
back
to
kubernetes,
to
launch
lower-level,
more
primitive
objects
to
actually
accomplish
a
task,
and
so
it's
a
domain-specific
capability.
The
domain
in
this
case
being
elasticsearch
that
reuses
it
sort
of
feels
natural
on
top
of
kubernetes
along
the
way,
because
it's
using
the
kubernetes
extension
points.
A
You
get
a
lot
of
the
benefits
around
on
occasion:
authorization
auditing,
all
the
other
stuff.
That
sort
of
you
know
that
ecosystem
of
stuff
being
built
on
top
of
kubernetes.
So
that's
the
operator
pattern.
Elasticsearch
itself
is
a
horizontally
scalable,
full-text
search
engine,
the
idea
being
that
you
take
documents.
Everything
in
elasticsearch
is
a
document.
You
submit
a
document
to
to
elasticsearch.
It
has
a
bunch
of
of
pluggable
extensible.
A
A
One
of
the
common
places
in
the
kubernetes
world
that
we
see
elasticsearch
used
is
with
log
data,
so
you'll
take
log
data.
If
there's
some
structure
to
it,
you
can
use
a
specialized
parser
to
tokenize
that
structure,
and
then
you
can
search
through
your
logs
and
then
view
them
either
in
a
time-based
way
or
by
searching
so
Ryan
who
has
taught
on
this
stuff.
So
he
is
the
expert
he
says.
Elastic
search
is
a
software
layer.
Data
replications
is
terrific,
distributed
system
and
falls
into
the
category
of
Cassandra,
MongoDB,
etc.
A
There
are
special
considerations
when
you
start
shut
down
instances
from
one
machine
to
another,
so
you
have
so
long
and
Steve
says
it
is
hipaa-compliant.
That's
the
reason
why
they
built
so
that
AWS
version
wasn't
so
that's
good
to
know,
and
then
Rika
is
saying
is
that
even
youtuber
uses
elasticsearch
as
a
real-time
database.
A
So
a
lot
of
times
when
people
think
about
elasticsearch
in
kubernetes
they're
thinking
about
it
from
that
infrastructure,
point
of
view
of
ingesting
and
managing
logs,
but
I
think
it's
also
interesting
to
recognize
that
this
oftentimes
becomes
a
key
part
of
building
a
key
part
of
building
an
application.
It
becomes
a
service
that
you
depend
upon
in
an
application
or
architecture.
So
Steve
says
that
they
index
patient
documents
for
a
big
data
platform.
So
yeah
now
under
the
covers
that
uses
a
indexing
engine,
that's
been
around
for
a
while
indexing.
A
The
there's
a
demo
that
Steve
recorded
here
but
I
think
it's
a
little
bit
old.
So
we're
not
gonna
I
started
watching
it
before
this.
One
of
the
things
to
keep
in
mind
is
that
the
elastic
search
operator
makes
some
assumptions
in
terms
of
the
cluster
that
you're
running
on.
So
the
first
assumption
is
that
you
can
use
stateful
sets
and
stove's
date
full
sets.
You
know
I
believe
we
did
I,
don't
know
if
we
did
an
episode
on
stateful
sets,
but
we
definitely
saw
stateful
sets
in
the
context
of
cockroach
DB.
A
A
couple
of
episodes
again
but
stateful
sets
are
a
way
to
to
manage
kubernetes
pods
that
get
paired
off
one-to-one
with
persistent
volumes.
Typically
folks
will
use
these
things
with
a
with
Cloud
volume.
So
it's
essentially
hey.
You
know,
let's
you
know,
for
each
of
the
data
nodes
in
a
in
the
elastic
search
clause,
you'll
create
and
have
help
kubernetes
help
manage
a
EBS
volume
on
AWS
with
you.
So
you
know
over
time
there's
going
to
be-
and
this
is
something
that's
still
relatively
new
in
1:9
and
1:10.
A
There's
this
idea
of
a
local
persistent
volume
and
it
doesn't
have
an
auto
provision
or
yet
but
but
I,
think
that's
going
to
be
an
interesting
choice
with
systems
like
this,
especially
since
elasticsearch
has
its
own
idea
around
rap
and
replication,
and
one
of
the
things
that
Steve
built
in
here
was
some
relatively
up-to-date
and
relatively
sophisticated
automatic
backup.
So
yeah.
A
A
Even
you
know
someplace
like
Google,
where
they
really
have
some
of
the
fastest
networks
that
sort
of
large
scale.
They
have
a
huge
investment
in
terms
of
building
some
fundamental
technology
around
SSDs
and
flash
even
for
them
you're,
just
not
going
to
see
the
latency
and
the
throughput
in
the
IEEE
ops
when
you're
trying
to
access
flash
across
the
network,
and
so
so.
What
you'll
see
is
that,
folks,
that
are
running
big
databases,
whether
it
be
something
like
elasticsearch
or
or
Cassandra
or
whatever
you
know,
they'll
a
lot
of
times.
A
You
know,
will
use
the
local
disk
running
on
a
node
at
the
local
SSD
running
on
a
node
all
right.
So
the
other
thing
that
that
Steve
built
into
here
was
automatic
snapshotting
to
to
s3.
The
way
that
the
operator
authenticates
to
s3
is
is
some
an
interesting
thing
that
we'll
we'll
go
into
some
detail
about
when
we
first
roll
this
out.
A
A
So,
let's
see
if
we
can
get
this
stuff
going,
it
does
a
bunch
of
stuff
around
managing
search
for
you.
There's
ways
that
you
can
put
stuff
in
there.
There's
it
uses
the
you
know:
images
by
default,
the
there's
the
the
UPMC
enterprises
images
that
I
guess
the
one
that
we're
going
to
be
using
by
default
here
and
then
there's
instructions
on
how
to
go
ahead
and
deploy
this
and
get
going.
A
Let's
see
in
another
window,
I'm
going
to
do
this
a
lot
of
times
whenever
you
see
these
CR
DS
and
we
don't
have
a
great
track
record
in
the
kubernetes
world
of
getting
great
documentation
around
to
schema
VMO
files.
Most
of
the
time,
what
we
find
is
that
you'll
see
something
like
this,
which
is
great,
but
it's
easy
for
readme,
like
this
to
get
out
of
date
of
what's
really
going
on.
A
What
I
usually
do
is
I,
usually
try
and
find
the
ground
truth
in
the
code
here,
and
so
if
we
go
through
and
if
we
find
this
this
document
here,
this
is
the
the
actual
go
data
structures
that
store
the
stuff
that
that
we're
going
to
be
using
for
the
CR
D,
so
I
just
want
to
have
oh
I
lost
mine.
I
just
want
to
have
that
up
here
as
we
go
ahead
and
start
in
case.
A
I'm,
not
a
huge
fan
of
just
sort
of
like
doing
a
cube.
Control
create
directly
like
this
I
always
want
to
look
under
the
covers
to
see.
What's
going
on,
I
feel
the
same
way
about
helm.
Charts
I
want
to
understand
what
the
helmet
Art's
gonna
be
actually
doing
before
I
go
ahead
and
and
execute
it
so
to
get
started
yeah
so
Steve
saying
can
deploy
from
the
examples
folder.
So
that's
what
I'm
gonna
do
is
I'm
gonna.
Do
a
git
clone
of
this
I
missed
I
thought
I
grabbed
it
clone
or
download
copy
boom.
A
A
It
expects
that
it
has
the
sort
of
overarching
sort
of
project
model,
and
so,
if
you're
doing
sort
of
ad
hoc
exploit,
because
you
bring
up
vs
code,
you
pointed
into
directory-
and
it's
kind
of
like
a
combination
of
code,
editor
plus
sort
of
like
Mac
finder,
and
it's
very
lightweight
that
way,
whereas
goal
and
just
doesn't
have
that
same
type
of
feel
to
it
all
right.
So
if
we
look
at
the
examples
directory,
what
we
have
here
is
here's
the
controller
itself
and
we'll
look
to
see
what
we're
doing
so.
A
Yeah
so
yeah,
so
amethyst
is
saying
he's
using
goal
in
encode
the
same
way:
yeah
okay,
so
we
have
a
service
account
so
I.
Some
of
this
is
our
back
eNOS
and
and
then
there's
a
cluster
role
for
this,
and
what
we're
seeing
here
is
that
we're
allowing
the
the
service
account
to
manage
deployments.
Replica
sets
and
daemon
sets
to
manage
custom
resource
definitions
to
manage
storage
classes,
which
seems
like
I,
don't
know
why
you'd
need
to
create
storage
clothes
to
create
or
delete
them.
A
It's
going
to
be
interesting
and,
let's
see,
and
then
you
know
manage
secrets
and
everything
else
across
everything.
So
at
this
point
this
is
pretty
much
bad.
This
is
pretty
much
route
on
the
cluster
that
we're
giving
this
thing,
I
think
it's
it's!
You
know
there
might
be
some
ways
to
slim
this
down
the
the
place
where
things
usually
get
hairy
with
these
things
and
and
I
think
it's
something
that
we
need
to
find
better
ways
to
to
work
with.
A
A
A
A
So
if
you
wanted
to
change
which
namespace
you
were,
you
were
deploying
this
to
you'd
have
to
go
through
and
actually
change.
This
namespace
here
than
the
are
back
rule-
and
this
is
this-
is
stuff
like
this
ends
up
being
one
of
the
main
drivers
for
some
solution
around
templating
for
for
kubernetes
resources
and
then
there's
a
deployment.
There's
the
the
version.
0.0
12,
that's
a
pretty
early
version,
man
don't
commit
yourself,
Steve
and
then
and
then
passing
in
the
namespace.
So
this
is
the
downward
api
and
and
then
there's
a
liveness
and
readiness
probe.
A
So
it's
all
pretty
pretty
plain
jane
from
there
and
then
cute
well,
I'm
glad
that
you're
getting
something
out
of
it
all
right.
So
let's
go
ahead
and
make
this
thing
happen.
So
I
have
cube.
Let
me
go
ahead:
cube
control,
get
nodes,
I
have
a
three
node
one
control,
plane,
node
cluster
and
then
I
can
do
cute
control,
get
version
maybe
and
I'm
running
version
there.
A
A
All
right
so
that
created
the
surface,
account
the
cluster
role,
the
role
binding
and
the
the
extension
I
mean
the
deployment
for
the
operator.
And
now,
if
we
go
cute
control,
if
we
get
the
pods,
we
can
see.
This
thing
is
up
and
running
or
no
it's
not
running,
it's
not
ready.
Yet
it's
still
sort
of
coming
up
but
get
pods.
A
Do
logs
for
this,
it
says
it's
creating
the
missing
series,
so
one
of
the
things
that
that
this
thing
does,
as
it
starts
up
is
it
creates
the
CRT.
It
registers
that
new
type
with
the
kubernetes
control,
plane
and
and
in
my
mind,
there's
this
question
and
and
I
I
there's
two
patterns
for
how
people
do
this.
So
one
thing
is
to
have
the
operator
self
register
like
what
happened
here.
A
The
other
way
to
go
ahead
and
think
about
this
is
to
say
well
registering
and
managing
CR
DS
is
an
admin
thing,
and
that
requires
extended
permissions
above
and
beyond
the
permissions
that
we
give
to
a
particular
operator,
and
so,
with
that
in
mind,
maybe
there
should
be
a
separate
step
as
part
of
that
sort
of
installing
the
operator.
Maybe
we
should
also
be
be
creating
this.
A
The
the
CRD
definitions
then
registering
the
CR
DS,
but
it
looks
like
you
probably
do
either
way
with
this
and
say,
like
you
know,
only
registers
to
see
our
DS
when
they're
when
they're
missing
I
wonder
if
it
bursts,
if
you
don't
give
it
that
permission
so
so
this
is
up
and
running.
So
I
can
do
cube,
control,
get
CR,
DS,
Oh,
custom,
resource
definitions,
there
we
go
and
that's
the
custom
resource
definition
that
it
that
I
registered.
A
This
thing
all
you
get
is
it's:
it's
essentially
identifying
the
names.
For
this
thing,
it's
an
elastic,
search
cluster,
there's
the
name
of
the
kind,
the
list
you
call
it
elastic
search
clusters,
that's
the
plural,
and
then
the
idea
is
that
this
is
a
namespace,
so
it
sits
under
a
namespace.
First,
it
being
global.
You
know
cluster
wide,
which
were
would
sit
at
the
cluster
level
in
newer
versions
of
kubernetes,
and
this
is
something
that
I
haven't
explored
to
the
fullest
extent.
A
So
not
the
version
stuff
is
not
fully
supported
in
the
same
way
that
native
native
resources
are
okay,
so
we
got
that
running
now.
Let's
create
us
a
cluster
and
the
example
that
we're
using
here
is
the
example
es
cluster.
So
we
have
a
whole
bunch
here,
so
we
have
one
with
Azure
one
with
rook
one
with
host
pads
and
then
there's
a
there's
the
the
example
cluster
itself.
So
let's
just
go
ahead
and
do
the
simple
example:
cluster
I
can't
see.
What's
going
on
here
there
we
go.
A
A
It's
the
admin
interface
for
this
thing
for
elasticsearch,
it's
using
the
what
looks
like
the
some
level
of
okay.
This
is
fascinating.
It's
using
an
upstream
or
a
a
cabana
image
provided
by
elastic
and
they're,
apparently
hosting
their
own
docker
image
registry
white
labeling
that
are
probably
running
their
own
infrastructure
I'd,
be
interested
to
know
what
they're
using
to
do
that
and
then
the
elasticsearch
image
that
we're
using
is
here
and
then
three
client
nodes,
two
master
nodes
and
three
data
nodes.
So
this
is
a
fairly
beefy
cluster.
A
As
far
as
these
things
go,
so
I
did
a
little
bit
of
reading
and
you
know
Ryan
and
Steve
correct
me
if
I'm
wrong.
These
are
all
going
to
be
running
the
the
same
image,
but
there's
some
options
that
you
can
turn
on
and
off
with
these
things.
So
the
if
a
node
is
plain
as
a
master
in
the
in
elasticsearch,
then
that
means
it's
essentially
a
cluster
coordinator.
It
is
distributed
state
in
terms
of
which
of
the
data
nodes
are
taking
on
which
parts
of
the
index
an
index
base.
A
You
can
collapse
these
things
together,
but
my
understanding
is
that
for
for
production
cluster,
if
you
really
want
to
you
really
want
to
make
sure
that
you
that
you
separate
these
things
a
little
bit.
So,
let's
see
so
Enrique
says
the
big
challenge
with
es
is
as
a
stateful
setting
kubernetes
is
about
storage.
What's
your
take
on
this
Joe
yeah
I
mean
so
like
yeah.
You
have
to
have
some
persistent
storage
for
these
things.
As
my
understanding,
it
would
be
interesting,
I
think,
to
come
up
with
a
solution
here
and
I.
A
Don't
know
how
possible
this
is
that
that
does
the
whole
sort
of
you
know
doing
replicas
juggling
re
replicating
when
bringing
things
up
going
and
looking
at
the
backups
and
grabbing
the
most
recent
backup
doing
a
graceful
shutdown
when
you're
bringing
down
to
actually
write
to
the
backup,
so
that
I
could
be
totally
run
off
of
empty,
and
you
know
scratch
volumes
I.
Don't
think
that
that's
supported
with
with
this
operator
and
I,
don't
know
how
practical
that
is
with
to
automate
with
with
elasticsearch
in
general,
so
yeah
using
empty
tour.
A
So
if
you
use
host
path,
then
then
you
essentially
pin
your
nodes
to
specific
your
your
worker,
your
data
notes
to
specific
kubernetes
nodes,
and
that
gives
you
you
know
a
certain
level
of
you
know
both
performance
and
reliability,
our
performance,
but
from
a
reliability
point
of
view.
If
one
of
those
those
notes
goes
down
your
your
your
kind
of
you've
lost
that
data,
so
you
have
to
then
go
through
and
and
pull
it
back
up
from
from
some
sort
of
backup,
yeah.
A
A
There
are
solutions
in
the
storage
space
that
actually
play
at
different
levels
here.
The
way
that
this
type
of
thing
tends
to
work
at
Google
is
that
the
the
the
difference
between
sort
of
a
backup
and
the
running
state
ends
up
being
much
more
mixed
at
Google,
and
so
Google
has
something
that's
analogous
to
an
object
store
these
days
called
Colossus.
A
A
Okay,
yes,
Steve
says
same
image
of
a
different
environment
variables
for
the
role
Steve
says
that
the
data
in
the
master
are
also
backed
by
the
persistent
volumes
by
stateful
sets,
but
the
but
the
clients
aren't
so
yeah
and
then
Ryan,
says.
Client
nodes
have
two
advantages:
a
smaller
subset
of
nodes
that
get
the
public
app
traffic
can
so
the
day
notes
will
can
be
increased
and
decreased.
It
will
okay,
so
it's
essentially
become
sort
of
an
interface
layer
and
then
number
two
is
the
search.
A
A
Does
that
mean
it's
compatible,
starting
with
1.8
I?
Don't
know
how
it
uses
cron
jobs,
we'll
have
to
see
that
and
then
arica
says
looking
forward
to
CSI
as
well
in
110
for
shared
local
storage.
So
CSI
is
the
common
storage
infrastructure.
It's
an
evolution
of
this
things
called
flex
volumes,
I
believe,
which
is
this
idea
that
we
want
to
be
able
to
provide
pluggable
volume,
implementations
for
kubernetes
and
I
think
that
that,
once
those
things
get
nailed
down,
there's
going
to
be
a
ton
of
people
doing
interesting
stuff.
A
A
Ok,
so
one
of
the
things
that
that
that
this
thing
is
is
it's
multi
zone
aware
from
the
get-go,
and
so
you
tell
it
the
zones
that
you
want
it
to
spreading
across
and
then
it
makes
sure
is
that
it
creates
the
the
TVs
and
those
zones
and
then
schedules
the
the
stateful
sets
on
a
personal
basis.
Also
now
the
cluster
that
we're
using
has
a
single
zone.
A
So
there's
that
question
I
looked
at
the
code
and
there's
you
can
leave
this
blank
when
you
leave
this
blank,
it
uses
default
provision
or
stuff
which
should
work,
I,
think
but
I
I'm
I'm
not
sure
how
off
the
rails.
We
want
to
go
so
what
I'm
gonna
do
is
I'm
gonna
just
go
through
it.
I
forget
which
zone
I
actually
launched
this
thing
on
we're
gonna
we're
not
going
to
tempt
fate
here
and
if
I
look
at
my
cluster
here,
the.
A
A
The
data
volume
size
is
10,
10,
gig,
Java
options,
Yolo
512
megs,
so
these
are
going
to
be
relatively
small
nodes
and
then
we're
going
to
turn
off
the
the
snapshot
scheduler
by
default
and
then
there's
this
elasticsearch
cron
that
I
guess
drives
the
snapshots.
So
what
this
is
off
by
default
because
of
the
authentication
issues
to
ask
three
that
will
try
and
dig
into
if
we
have
time.
This
is
the
storage
class
and
the
provisioner
that
we
have
going
on
here,
and
so
what
you
have
here
is
if
we
do
cube
control.
A
A
So
what
we
have
is
we
have
a
storage
class
called
gp2
and
the
provisioner.
This
is
the
piece
of
code
that
knows
how
to
do
that
if
we
go
through-
and
this
is
by
default
with
with
the
kubernetes
QuickStart
cluster
and
pretty
much
anytime
when
you're
create
a
cluster
that
has
integration
with
a
cloud
provider.
This
is
essentially
describing
some
sort
of
like
the
parameters
for
how
you
create
a
PV
and
and
some
of
the
parameters
that
go
into
that.
If
we
look
at
this.
A
A
So
what
Steve
was
saying
it
happens
is
that
the
elasticsearch
operator
will
then
actually
expand
the
set
of
storage
classes
here
to
include
a
storage
class
and
also
specify
the
zone
that
this
thing
should
be
should
be
launched
in
so
you
can
have
a
storage
class
per
zone
and
so
the
parameter
there
was
this
type
here
and
I
assume
that
it
will
not
set
it
to
default
in
any
way.
Some
of
this,
these
shenanigans
are
necessary
to
deal
with
with
multi
zonal
issues,
yeah.
A
Yeah
so
Steve
says,
will
create
its
own
storage
classes.
You
could
turn
off
zones
and
pass
the
storage
class
in
and
it
would
work
also
okay,
but
we're
not
going
to
do
that
because
I
don't
want
to
I,
don't
want
to
get
into
the
weeds,
but
I.
Just
I
brought
this
up
as
an
example
of
what
a
storage
class
looks
like
so
that
we
can
figure
out.
A
So
this
type
here
is
what
it's
going
to
use
for
here
when
it
goes
through
and
creates
those
storage
classes,
and
similarly
the
provisioner
here
is
what
it's
going
to
use
here.
So
these
things
are
going
to
look
a
lot
like
the
default
ones
that
we
have
all
right
and
then
each
of
these
things
is
going
to
be
is
using
half
a
CPU
and
a
gig
of
ram,
and
then
it's
going
to
have
a
limit
of
one
gig
of
ram
and
one
CPU
I
did
a
whole
episode
on.
You
know,
requests
and
limits.
A
If
you
don't
want
something,
if
you
want
something
to
be
as
stable
as
possible,
especially
when
you
start
moving
towards
a
a
highly
loaded
cluster,
you
generally
want
to
make
sure
that
at
least
for
memory,
the
amount
of
memory,
your
request
and
your
limit
actually
maintained
the
same.
Because
then
you
won't
end
up
in
a
situation
where
memory
is
over
committed,
and
you
start
you
know
drifting
up
above
your
requests
and
then
you
get
killed
because
there's
not
enough
RAM
on
that
box,
and
so
and-
and
this
starts
looking
at
the
quality
service
classes.
A
Also
sookie
says
the
job
options
weren't
working
for
me
out
of
the
elasticsearch
base.
I
had
it
as
an
environment
for
able
to
get
it
to
pick
up
interesting
to
see.
Have
that
working.
So
I
don't.
We
can
look
at
the
deployments
that
end
up
getting
created
and
see
what
happens.
Ok,
so
I
think
this
thing
out.
The
gate
looks
good,
let's
go
ahead
and
create
it
cube,
control
applied
chef.
A
This
is
example,
yes,
cluster,
yeah
mole
and
we'll
just
do
this
into
the
default,
the
default
namespace
and
you
can
see
that
the
type
this
is
the
type-
and
this
is
the
name
of
the
object-
has
created
and
now
I
can
do
cube,
controlled
gets
and
I
can
do
I.
Think
I
can
do
the
whole
thing,
but
I
can
also
just
do
elasticsearch
clusters
and
there
we
can
see
our
cluster,
and
if
we
do
oh
yeah
mole,
we
can
see
that
there's.
You
know
that
spec
is
there
I,
don't
know
I,
don't
see
any
status?
A
Does
the
operator
write
status
in?
Do
you
know
that
if
that's
the
case
teeth
so
Steve
says
need
to
go?
Also
give
a
shout-out
to
Paulo.
For
us
who
did
much
of
the
work
for
elastic
gun,
grenades
to
start
with
yeah?
He
is
mesosphere
now
working
on
some
of
the
kubernetes
on
the
mesosphere
stuff.
I
think
ok,
so
no
status,
so
it's
not
writing
status
up
it's
another
thing
that
operators
can
do
is
then
get
feedback
to
you.
A
Just
like
kubernetes
dust
by
writing
status
into
into
these
and
there's
some
subtleties
in
terms
of
when
you
have
multiple
actors
in
terms
of
writing
status,
but
but
yeah.
So
that's
not
something,
though,
that
that
this
does
yet
okay,
so
I
can
do
acute
control,
get
pods
I'll
look
at.
We
got
a
whole
bunch
of
stuff
coming
up
here.
It
says
container
creating
so
I
things
are
coming
up.
It
looks
like
everything
got
scheduled,
so
we
had
enough
space
on
our
cluster
for
sure,
and
then
we
can
get
deployed.
A
A
We
can
see
that
these
things
are
all
one
two,
three
four
five
they're
all
created
and
bound.
That
means
that
our
cloud
provider
is
working
correctly.
So
one
thing
that
I
think
I
want
folks
to
be
aware
of:
is
that
if
you're
bringing
up
a
cluster
to
test
stuff
out,
like
I,
do
for
the
for
the
TGI
Ches
here
and
then
it
goes
ahead
and
it
creates
cloud
resources
whether
it
be
EBS
volumes
or
or
you
know,
ELB
instances
or
the
the
equivalent
and
in
whatever
cloud
you're
running
in
typically.
A
Otherwise,
you're
stuck
start
trying
to
clean
these
things
out
manually
from
your
from
your
cloud
account
I
think
the
one.
This
is
one
thing
that
is
nice
about
sure
is
it
has
this
idea
called
Rees
for
resource
sets
and
so
by
default?
You
know
if
you,
if
you're
running
a
cluster
in
a
resource
that
I
believe
any
sort
of
other
objects
that
you
create,
that
are
part
of
that
cluster
are
also
created
in
the
same
resource
group.
Sorry,
a
resource
proof
and
then,
if
you
read
the
resource
group,
it
just
sort
of
cleans
everything
up.
A
So
it
ends
up
being
a
more
nimble
version
of
like
the
the
GCP
project
in
some
ways,
and-
and
there
really
is
nothing
similar
I
mean
there's
tags
in
AWS,
but
it's
not
quite
the
same
type
of
same
type
of
thing
in
queue
says:
cleanup
is
tricky,
yeah
and
and
even
with
helm.
Sometimes
things
don't
get
caught.
Okay,
let's
see
and
then
Bismark
saying
some
of
the
short
names
are
not
working
with
a
new
version
of
cube
control:
I,
don't
I
I
just
try
stuff
and
see
if
it
works,
but
it's
staple
selves.
A
A
A
Okay,
so
theoretically
we
have
an
elastic
search
cluster.
Now,
let's
try
and
confirm
that
so
here's
a
bunch
so
there's
a
helmet
art
for
two.
We
did
launch
cabana
and
and
cerebro
there's
resize
blah
blah
blah
AWS
setup
accessing
the
cluster.
So
we
can
go
ahead
and
do
that
and
the
cluster
can
be
accessed
internally
with
elasticsearch.
So
we
have
a
service.
A
Let's
see
is
it
it's
not
called
elastic,
search
service
host
by
elasticsearch
plus
as
defined
elasticsearch
of
cluster,
so
this
will
be
the
so.
This
is
the
service
that
we're
talking
about
here.
Okay-
and
you
can
see
that
it's
using
poor
9200,
which
I
believe
is
the
what
the
client
port
for
elasticsearch.
So
we
can
go
through
and
I
think
we
can
do
a
cube
control
port
forward,
and
this
is
the.
A
Ttl
forward
this
is
the
cool
stuff
I'm
talking
about.
We
can
do
service
and,
and
then
the
name
of
this
thing
and
then
ninety
two
hundred
ninety
two
hundred-
if
we
do
that,
then
it
forward
it
would
what
this
does
now.
This
is
a
cute
control.
One
ten
feature
is
it
looks
at
service
from
out
from
service.
It
digs
the
selector.
It
uses
that
to
find
a
pod
and
then
it
picks
one
of
those
pods
and
actually
goes
ahead
and
forwards
to
it.
So
it
doesn't
actually
do
like
the
load
balancing
stuff
across
the
service.
A
It's
still
gonna
pick
one
and
only
one
pod
and
stick
to
that,
but
instead
of
having
to
actually
go
through-
and
you
know,
find
the
right
pod
and
copy
and
paste
and
do
all
that
brigham
a
role
with
the
one
ten
version
of
cube
control.
You
can
do
this
directly
yeah
freakin
finally
I'm
on
the
same-
and
this
is
something
that,
like,
like
you,
know
perfect
as
the
enemy,
a
good
because
I
had
these,
like
you
know,
plans
of
like
wow.
A
If
I
get
time,
I
can
write
a
bunch
of
code
and
I
can
do
this
really
cool
proxying
thing
and
and
and
a
couple
episodes
I
found
that
you
know
the
PR
I,
don't
remember
the
name
of
the
person
who
created
who
did
that
PR,
but
this
is
very
much
like
hey.
Let's
actually
make
this
this
scenario
a
lot
easier.
So
I'm
super
happy
about
this.
But
now,
if
I
do
localhost
9200
what
happens
when
you
actually
hit
this?
Oh
and
it
says,
I
have
to
do
HTTP.
A
Let's
try
that
and
it's
gonna
tell
me
it's
unsafe
and
we
say
Yolo
and
there
we
go
boom.
We
have
an
elastic
search
of
cluster
and
there's
a
cluster
unique
ID,
there's
a
cluster
name.
We
get
all
sorts
of
versions
and
stuff
Oh
tagline.
You
know
for
search
I,
think
that
is
a
reference
to
the
hudsucker
proxy,
which
was
this
movie
from
God
knows
when,
where
it
was
Tim
Robbins
right,
it
was
like
you
know,
for
kids,
I
love.
A
A
Cou
Bearnaise
secrets
are
not
as
secret
as
I
think
anybody
would
like
them
to
be
the
the
are
back
model,
especially
with
things
like
operators
is,
is,
is
it's
not
as
sophisticated
I'm
gonna
be
interested
to
see
systems
like
this
as
we
get
container
identity
as
we
get
things
like
spiffy
ins,
fire
up
and
running
how
this
type
of
thing
actually
evolves,
because
then
you
won't
even
have
to
create
search.
You
can
reuse
certs
that
are
already
built
into
the
system.
Maybe
I,
don't
know
we'll
see.
So
that
thinks
it's
a
good
scenario
all
right.
A
A
A
A
A
So
so
a
sense
says
tell
us
the
IP
and
you
guys
can
index
some
stuff.
I
know
this
is
not
exposed
to
the
Internet.
First
off
I
learned
my
lessson
back
in
the
day,
so
Nicolas.
So
that's
a
really
interesting
question.
So
I
think
there's
a
when
we
look
at
vault
in
context
like
this
there's
there's
a
couple
you
know:
vault
does
a
bunch
of
different
things.
A
Instead
of
having
the
secrets
be
stored
in
in
at
CD
for
the
kubernetes
cluster,
there
was
work
ongoing
to
actually
lock
down
where
and
how
you
can
view
those
secrets,
so
I
believe
there's
some
thinking
in
terms
of
like
you
know
you
can
say
hey
this
pod
can
use
this
secret,
but
what
you
can't
do
is
actually
read
the
value
of
the
secret
out
from
kubernetes
that
ends
up
getting
stored
in
vault.
Vault
can
also
play
the
role
of
a
API
driven
certificate
authority.
A
The
amount
of
flexibility
at
least
last
I,
looked
with
respect
to
to
the
options
for
the
vault
bay.
Ca
is
relatively
limited,
and
so
and
so
a
lot
most
of
the
time
when
folks
are
creating
and
issuing
stuff
in
an
API
driven
stuff
they'll
end
up
using
the
the
CF
SSL
stuff
to
be
able
to
do
that,
which
is
the
the
CloudFlare
stuff.
One
of
the
projects
that
I've
been
involved
in
for
a
long
time
is
this
thing
called
and
then
there's
the
question
of
like
okay.
Let's
say
that
you
use
vault
to
generate
certificates.
A
How
do
you
distribute
those
certificates
to
the
workloads
right?
Because
you
need
to
communicate
that
stuff
over
or
have
those
workloads
generate
their
own
key
pairs
and
have
a
certificate
signed
that
distribution
problem
of
I
have
an
identity
that
I
want
to
give
to
somebody.
How
do
I
establish
that
bi-directional
trust
and
get
them
some
cryptographically,
strong
proof
of
identity?
That's
a
problem
that
a
vault
doesn't
actually
solve
and
kubernetes
doesn't
solve
it
outside
of
secrets
in
a
great
way
right
now
either,
and
that's
the
purpose
of
this.
A
This
project
that
I've
been
involved
with
a
for
a
while
called
spitty,
which
is
it's
not
about
creating
the
certificates.
It's
about.
How
do
you
distribute
those
things
and
a
trusted
and
and
secure
way-
and
that's
really
the
hard
part
of
that
problem,
and
so
at
the
end
of
the
day,
even
if
you
did
use
vault
these
days
to
actually
generate
your
certificates
and
your
key
pairs
you'd
still
be
in
a
position
where
you
had
to
use.
A
You
had
to
distribute
those
with
secrets
or
you'd
have
to
like
rely
on
something
like
Network
IPS,
to
authenticate
things
so
that
you
could
actually
then
approve
automatically
approve
the
certificate
request.
It's
kind
of
a
mess
right
now,
but
there
is
there
are
some
longer-term
project
to
try
and
prove
how
this
stuff
works
all
right,
so
you
can
load
some
sample
data
from
elasticsearch
website
and
then
do
a
search
on
it.
A
Yeah,
let's
try
and
do
that
and
then
what
are
the
advantages
of
using
the
operator
so
I
think
one
of
the
advantages
is
that
we
can
scale
this
cluster
up
and
down
very
easily
by
just
you
know,
mucking
with
that
that
CRD
it
can
bind
in
extra
capabilities
like
the
backups
that
we
haven't
gotten
to
yet
yeah
and
self-healing.
That
type
of
thing
and
then
Ryan,
says
it's
also
important
to
consider
whether
you
really
need
or
require
TLS
between
the
es
nodes
for
most
people.
A
It's
not
needed
or
required
yeah,
so
Ryan,
I,
guess
this
is
a
question.
It's
like
I!
Think
for
for
reading.
It's
one
thing,
but
I
mean
you
know.
There's
like
I
would
still
be
worried
as
a
far
as
the
defense
in
depth
in
terms
of
giving
things
right
access
to
my
elasticsearch
cluster,
even
if
I'm
doing
something
as
simple
as
a
sort
of
a
product
index
database
for
for
a
product
catalog.
A
There
may
be
a
case
where
people
store
HTML
directly
in
those
documents
they
get
rendered
out,
and
so
there
might
be
room
if
somebody
gets
bright
access
to
your
elasticsearch
cluster
for
them
to
go
ahead,
and
you
know
use
that
as
an
attack
vector
to
do
script.
Injection
that
doesn't
goes
ahead
and
steals
cookies
and
then
all
of
a
sudden
you're.
You
know
your
admin
interface
ends
up
getting
getting
compromised,
and
so
that's
the
type
of
thing
that
I
would
worry
about.
A
A
A
A
Alright.
So
so
we
Ryan
says
and
wants
to
make
sure
that
clear
that
the
TLS
and
the
SSL
of
the
elasticsearch
API
is
separate
from
the
TLS.
An
encryption
between
the
nodes
and
then
paid
feature
is
mainly
the
plug-in
xpac
around
spot
security.
So
you've
gone
way
past
my
knowledge
of
how
elastic
search
works,
but
let's
go
ahead
and
actually
pull
some
stuff
down.
So
we
have.
A
A
Not
that
copy
link,
AB,
dress,
girl,
hello,
alright
and
then
I
have
problems
with
x-pac's,
because
with
things
like
logs
x-pac
security,
does
a
DNS
check
once
and
holds
the
IP
address,
which
causes
problems.
For
me
with
the
service
address.
Okay,
yeah,
just
reroute
not
really
resolve
in
DNS
is
a
classic
Java
Java,
gotcha
I,
don't
know
if
it's,
if
it's
a
java
thing
or
not,
but
by
default,
the
dns
client
of
of
java
does
not
really
resolve,
does
not
respect
TTLs.
A
A
A
A
A
A
Shakespeare
is
something
similar
where
each
of
these
things
is
so
we
have
this
index
and
then
there's
a
type.
So
I
don't
quite
understand
everything.
That's
going
to
those
like
the
line.
8
all
right.
We're
gonna
have
to
look
as
we
go
through
this
stuff
and
then
so
and
then
the
logs
again
we
have
the
index
thing
so
that
I
believe
that
these
are
probably
working
pairs
where
this
is
metadata
and
then
this
is
the
data
itself
and
then
we
have
accounts
and
accounts
is
also
Jason
L,
but
it
doesn't
call
itself
Jason
L.
A
A
One
of
the
things
that
you
could
do
is
you
could
go
through
and
just
randomly
break
it
based
on
byte
boundaries,
but
now
you're
going
to
have
records
that
are
split
across
these
chunks
and
that's
no
good,
because
that
means
that
those
records
will
be
viewed
as
corruption
when
they're
dealt
with
by
the
individual
processors
and
so
and
so
there's
there's
these
binary
formats,
and
so
there's
one.
That's
inside
of
google
called
called
record
I/o
and
some
some
usage
of
that,
but
I
believe
in
the
Hadoop
world.
A
There's
like
Avro
is
the
is
the
format
here
where
it's
essentially
a
way
of
like
how
do
we
actually
take
something
break
it
up
and
know
that
we
can
actually
sort
of
move
it
around
the
boundaries
as
we
break
this
thing
up,
so
that
we
land
on
on
record
boundaries
and
it's
a
relatively
subtle
encoding
problem
going
on
there.
If
you
do
something
relatively
naive,
like
say:
hey,
I'm,
doing
JSON
I'm
going
to
break
it
on
on
on
new
lines.
A
Well,
what
happens
when
you
have
that
thing
quoted
right,
because
you
might
have
that
the
new
line
is?
Is
you
know
you
have
a
you,
have
a
string
and
the
new
line
is
quoted
inside
the
string,
depending
on
how
you
do
your
encoding
and
that
can
cause
you
problems
in
this
particular
case,
I'm,
suspecting
that
these
are
actually
paired
records
right.
So
we
can't
just
do
it
based
on
new
lines.
We
have
to
do
it
on
like
even
new
lines
as
we're
doing
stuff
so
yeah.
A
So
there's
there's
a
lot
of
subtle
issues
in
terms
of
how
you
encode
these
big
data
sets
when
you
want
to
process
them
in
a
in
a
in
parallel
yeah,
so
Q
says,
haven't
using
ever,
but
a
project
just
started
towards
it
yeah
and
then
and
then
Xavier
saying
that
there's
the
network
address
cache
TTL,
that's
the
tunable
four
actually
sort
of
saying
hey:
you
should
you
know:
Java
should
expire.
It's
it's
all
right,
so
I'm
done
with
that
digression
here,
all
right.
So
here
we
have.
This
is
the
schema
that
we're
dealing
with.
A
So,
let's,
let's
do
Shakespeare
Shakespeare
and
in
searching
Shakespeare,
is
the
canonical
new
employee
orientation
at
Google.
So
this
is
what
we're
going
to
be
looking
at.
So
there's
the
line.
Id,
there's
the
play
name.
There's
the
speech
number
the
line,
number
the
speaker
and
then
the
text
that's
actually
being
done
so
and
then
and
then
the
logs
has
a
bunch
of
sort
of
random
geo
coordinates
all
right.
So
before
we
load
the
Shakespeare
and
logs
data
sets,
we
need
to
set
up
a
mappings
for
the
fields.
A
Mappings
provide
divides
the
documents
in
the
index
into
logical
groups
and
specifies
the
fields
characteristics
such
as
the
field
search
ability
of
whether
or
not
it's
tokenized
or
broken
up.
So
this
is
a
way.
This
is
essentially
teaching
elasticsearch
about
the
about
the
the
schema
for
Shakespeare
and
so
I
have
okay.
So
so
it
said
copy
as
curl
I,
don't
know
what
is
the
console?
I
don't
know.
Oh
wow
install
Caban
I
have
no
idea
what's
going
on
here.
A
A
A
A
He
was
saying
that
there
was
a
point
where
they
wanted
to
actually
show
a
Cabana
screenshot,
but
they
wanted
to
make
sure
it
was
highly
accurate,
so
they
went
talked
to
elastic
and
they
wanted
to
make
sure
that
not
only
they
get
Cabana,
but
it
was
like
diversion
that
was
probably
going
to
be
currents
when
that
particular
episode
of
Silicon
Valley
was
actually
aired.
So
every
time
now
I
see
Cabana,
I.
Think
of
of
that
story
from
from
Ryan
okay.
So
where
were
we
here?
A
A
Let's
see
what
happens
if
I
do
this
save
and
now
I'm
not
quite
sure,
go
to
dev
tools
or
it
was
mr.
robot,
not
not
Silicon
Valley
yeah,
the
Silicon
Valley
people
are
not
worried
about
accuracy
at
all.
Okay,
so
I
go
to
dev
tools
and
there's
a
console
here
and
I.
Just
okay
do
I
copy
and
paste.
This
then.
A
Used
so
it
says
you
put
this
in
the
terminal:
that's
not
right!
I
don't
put
that
in
the
terminal,
and
this
thing
is:
let's
see.
Why
is
this?
Okay,
it's
mad
because
I
had
it
all
zoomed
in
okay,
get
to
work
alright,
so
we're
gonna.
Do
that
and
then
I
hit
play
and
boom.
Okay,
we
have
that
thing
up
and
running.
Okay
boom.
A
That
is
the
terminal,
the
console
terminal.
I'm.
Sorry,
if
you
say
console
I,
think
Bash
well,
it
says:
bash
use
the
following
command
in
a
terminal,
I'm,
pretty
sure.
If
I
put
this
into
bash,
the
bad
things
would
happen,
but
if
I
do
copy
is
curl.
What
does
that
actually
do?
Then?
Oh
there's
the
curl
version
of
it.
That's
doing
localhost,
9200,
okay,
so
that's
hitting
elasticsearch
directly,
which
would
also
work
for
us.
Okay,
so
don't
say
all
right:
the
mapping
specifies
the
following
qualities
because
speaker
and
play
named
fields.
A
A
Alright-
and
this
says
this-
this
will
work.
This
will
be
awesome.
Okay,
so
geez
I'm
gonna
see
that
the
Cabana
thing
I'm
gonna
run
up
here.
Also
in
the
background,
so
we
got
both
of
those
port
forwards
running
and
then
this
line
this
is
going
to
load,
oh
says
empty
reply
from
server.
What
does
that
mean.
A
A
And
then
I
need
to
do
then
we
need
to
Yolo
it
okay
seriously.
If
I
had
a
program
like
curl
and
I
said
insecure,
I
would
have
Yolo.
There
would
be
a
combination
of
say
yes
to
everything
and
turn
off
all
the
security
and
yeah
and
would
probably
have
a
really
cool
banner
that
it
showed
when
you
used
it
all
right.
So
this
thing
is
uploading.
Now
how
big.
A
A
A
So
do
we
create
the
index?
That's
all
that
you
have
to
specify
our,
or
does
it
just
you
just
assume
that
you're
getting
when
you
map
these
things
you
is.
It
automatically
creates
the
right
indices.
I
assume
because
we're
putting
a
mapping
in
here
can
we
go
through
and
actually,
if
I
look
can
I
look
at
what
are
my
mapping
so
I
don't
see
anything
in
cabana
called
mappings,
which
kind
of
confuses
me.
A
Yeah,
so
this
is
me
being
a
total
noob
when
it
comes
to
this
stuff.
So
if
I
do
that,
the
index
pattern
just
match
any
indecision,
you
can
match
one
of
your.
So
this
is
what
I
want
to
do.
Shakespeare
there
we
go
boom
next
step
time,
filter
I,
don't
want
it
time,
go
to
existing
okay,
and
so
you
can
go
through
it
and
work
on
these
and
we
have
type
type
entry
and
all
that
and
then
I
can
just
do.
A
A
A
So
I
don't
want
to
out
who
this
is,
but
this
particular
Twitter
account
is
somebody
in
my
family
and
so
so
so
William
Shakespeare
follows
me
on
Twitter,
which
I'm
very
proud
of,
and
it
definitely
has
more
okay,
so
the
tables
full,
let's
see
if
we
can
figure
out.
So
this
is
the
William
Shakespeare
thing
and
we're
gonna
search
for
the
tables
full
of
no
results
found.
Maybe
there's
no
period
there.
We
go
no,
but
that
the
tables
full.
A
Alright,
so
apparently
maybe
a
filter,
I
would
probably,
as
part
of
the
pre-processing
of
this
thing,
it
probably
filters
out
the
it
probably
filters
out:
punctuation
I'm
guessing
so
yeah
okay,
so
that
is
from
Macbeth
speech.
19
line,
number
three
dot:
4.54
I,
don't
know
what
that
means,
but
that's
probably
like
different
and
from
in
its
megabeth,
make
a
pass
a
in
that
boom
all
right,
very
appropriate
when
you're
searching
a
database
to
use
a
quote
of
the
tables
full.
Let's
see
if
Shakespeare
has
any
other
good
database
quotes
for
us,
I.
A
Yeah,
so
my
my
family
member,
that
runs
this
Twitter
account
he
he
likes
being
snarky
and
coming
up
with
with
Shakespeare
quotes
for
every
every
occasion.
So
there
you
go
yeah
I,
wonder
what
he's
subtweeting
about
all
right,
so
all
right
so
I
think
you
know
this
is
at
least
enough
to
get
started
with
I
think
you
know
the
next
step
would
be
like.
What
are
you
going
to
use
elastic
search
for
right?
Are
you
gonna
use
it
for
a
product?
Are
you
gonna
use
it
for
log
ingestion?
A
I
think
you
know,
there's
probably
plenty
plenty
plenty
of
documentation
on
the
elastic
site
going
into
those
details,
and
that's
definitely
not
what
I'm
looking
at
here.
I
think
one
of
the
interesting
things
I
learned
is
that
the
TLS
stuff
is
something
that's
built
on
the
outside.
On
top
of
this
stuff,
I
I
think
it's
a
little
bit
weird.
That
TLS
is
a
pay-for
feature.
I
think
security
should
be
something
that's
built-in
by
default.
A
It
is
interesting
also
to
me
that
there's
TLS,
but
there's
no,
which
secures
the
channel,
but
there's
no
authentication
right.
So
how
do
you
authenticate
yourself
to
this
thing?
There's
no
authorization
model,
so
that's
something
that
if
I
were
going
to
start
using
this,
you
know
in
depth,
I'd
be
looking
at.
Oh,
let's
kill
some
pods
and
see
some
recovery
action,
okay,
so,
okay,
so
the
first
thing
is
so
the
view
single
die.
So
the
first
thing.
This
is
my
question
for
you.
So
a
couple
things
I
want
to
do.
Let's
do
that?
A
Let's
try
and
like
beat
this
thing
up
a
little
bit
and
then
Ryan.
Is
there
a
way
to
know
so?
The
way
that
that
elasticsearch
works
is
that
it
takes
each
document.
It
assigns
it
to
a
shard
that
shard
gets
assigned
to
a
data
node
and
there
may
be
replicas,
so
you
may
have
the
same.
Shard
be
replicated
okay
across
multiple
data
nodes.
Is
there
a
way
to
Enrique
says
that
authentication
authorization
is
built-in
to
the
xpac
stuff
and
it's
something
that
can
be
layered
on?
Okay,
so
that's
good
to
know.
Also.
A
Is
there
a
way
for
me
to
say
hey
for
this
document
ID,
you
know
I,
which
I
guess
is
this
thing
here
for
this
document
ID.
Is
there
a
way
to
figure
out
which
particular
node
this
thing
landed
on
top
of,
because
then
I
want
to
make
sure
that
I
take
out
the
node
that
that
actually
contains
something
that
we're
looking
at.
A
Okay,
so
the
default
number
of
replicas
is
one
okay.
So
if
we
take
out
that
node,
then
we
should
be
able
to
do
a
query
and
it'll-it'll
over
partial
results.
I
assume
that
don't
include
the
stuff.
That's
on
that
node
and
then,
as
that
note
spins
back
up
and
EBS
magic
happens,
that
I
mean
as
that
data
node
spins
back
up.
A
We
should
see
that
the
results
start
to
populate
with
that
thing,
so
I'm
wondering
how
can
I
figure
out,
which
node
this
thing
actually
gets,
which
which
data
node
this
thing
actually
gets
assigned
to
saved
objects,
no
advanced
settings.
Maybe
this
is
something
that
cerebro
can
do.
The
cat
API
are
you're.
Gonna
have
to
help
me
out
man,
many
more
than
that.
A
A
A
A
A
Alright,
so
shard
primary
replica
was
a
primary
and
read
replicas.
Okay,
so
this
is
actually
replicated.
The
number
of
replicas
is,
is
higher
than
one
here,
the
number
of
docs
the
size
of
it,
the
IP
that
it
landed
on.
But
this
still
doesn't
tell
me
ya
know
the
delay
socks
here.
I
mean
this
is
one
of
the
bad
things
about
YouTube.
It
still
doesn't
tell
me
what
what
document
this
thing
like
if
I
go
through.
A
A
A
A
A
A
All
right
so
I
feel
like
we
are.
We
are
totally
in
the
weeds
here,
so
elasticsearch
uses
get
with
a
body
okay,
so
this
says
okay,
so
the
ID
but
okay.
So
this
got
it.
But
the
explain
thing
didn't
work.
What's
going
on,
it
said
it
should
do
message
match
oh
and
then
I
just
don't
want
any
match.
I!
Guess
there,
no,
no
text!
So
that's
not
it
either.
Alright!
So
I'm,
not
gonna
I'm,
not
gonna,
try
and
chase
this
down.
This
is
this.
Is
me
not
being
an
expert
here?
Remove
the
match?
A
A
A
Let's
see
so,
okay,
so
we'll
do
this
search
if
I
was
if
I
was
smarter,
I
would
know
how
to
actually
sort
of
do
this
in
a
loop
so
that
we
could
actually
see
things
sort
of
failing
and
stuff,
but
let's
go
through
and
Q
control
get
nodes
in
or
get
pods
and
let's
take
out
one
of
the
data
cube
control
delete
pod.
This
cute
control
get
pods
the
watch,
so
it's
still
working
its
terminating
that
pod.
So
it's
trying
to
do
a
smart,
toke.
A
A
A
A
A
A
A
And
we'll
wait,
and
so
now
it's
yellow,
because
it's
actually
under
underscore
cluster
health,
yeah
YouTube's,
not
our
friend
here,
like
the
YouTube
comments,
all
right,
so
we're
like
way
over
here
so
I
wanted
to
go
into
some
detail:
real,
quick
about
the
snapshotting
stuff.
So
the
way
that
Steve
wrote
the
snapshotting
stuff
originally
is
that
uses
the
native
API
for
ewr
for
AWS,
where
it
gets
credentials
to
talk
to
s3
by
talking
to
the
AWS
metadata
server
and
a
lot
of
folks
run.
A
Kubernetes
cluster
is
on
AWS
and
they
allow
access
from
pods
to
that
metadata
server,
which
is
not
an
insane
thing
to
do.
If
you
are
running
sort
of
a
single
application
cluster,
but
most
people,
and
if
you
read
guides
on
sort
of
like
how
to
secure
a
kubernetes
cluster.
What
you
want
to
do
is
you
don't
want
to
give
every
pod
access
to
that
metadata
server
and
therefore
access
to
whichever
their
AWS
services
that
are
available
via
that
metadata
server
and
so,
and
so
the
the
AWS
QuickStart
that
we
are?
A
Oh,
it's
back
to
green
here,
so
the
AWS
QuickStart
that
helped
do.
Did
we
actually
install
some
IP
table
rules
to
actually
prevent
pods
from
getting
to
the
API
to
the
metadata
API,
and
hence
the
ability
to
then
call
through
and
talk
to
AWS
services
and
authenticate
to
those
things
in
a
native
way?
Actually
gets
gets
a
gets
a
kneecapped
right,
so
it
gets,
gets
broken
a
popular
way
to
work
around.
This
is
a
project
called
cube.
A
I
am
which
essentially
creates
a
replacement
metadata
server
on
a
pod
by
pod
basis,
and-
and
that
is
it's
a
it's
a
workable
solution,
but
I
haven't
used
it
a
lot
personally
I,
you
know
the
the
security
model.
There,
though,
is
that
any
any
permissions
you'd
want
to
give
any
pod
you'd
have
to
give
to
every
node
and
then
there's
a
local
agent
that
actually
gives
out
those
roles
on
an
as
necessary
basis,
so
it's
not
quite
as
as
lockdown
as
I
would
prefer
there.
A
My
understanding
also
is
that
there's
some
sort
of
race
conditions
there
that
leads
to
some
holes
around
sort
of
you
know
being
insecure.
So
again,
this
is
one
of
those
issues
where
it
really
comes
down
to
container
identity
very
similar
to
the
issue
of
how
do
we
actually
have
multiple
containers
talking
to
each
other
in
a
secure
way?
These
TLS
issues
it's
another
sort
of
side
of
that
coin.
Now
there
are
there's
a
working
group
here
called
the
container
identity
working
group
to
start
approaching.
A
Problems
like
this
and
the
solution
that
we're
coming
up
with
is
to
be
able
to
map
a
one-to-one
between,
say,
kubernetes
service
accounts
and
some
role
in
the
cloud
and
so
and
part
of
doing
that
is
that
there's
new
API
is
that
I
believe
made
it
into
1:10
so
that
you
can
on-demand,
create
a
JWT
a
token
for
your
service
account
with
a
custom
audience
on
it
and
then
give
that
to
some
other
sort
of
arbiter.
That
knows
how
to
map
that
particular
thing.
A
So
you
can
prove
who
you
are
to
that
particular
person,
and
then
they
can
go
ahead
and
map
that
to
some
other
identity,
whether
it
be
in
AWS
identity
or
not.
The
problem
there
is
that
that
doesn't
get
automatic
support
from
all
the
AWS
client
libraries
that
are
out
there
and
nobody's
connected
the
dots
to
use
that
transparently
with
something
like
like
a
cube,
a
cube,
kam
type
of
experience.
So
so
there's
a
lot.
A
There's
some
holes
here
yet
and
it's
been
on
Steve's
list
to
actually
add
the
ability
to
say
put
your
your
s3
credentials
in
a
secret
so
that
the
operator
can
use
that.
That's
just
not
something
that
supported
yet.
So
the
only
way
to
talk
to
a3
is
via
that
metadata
API,
which,
like
I
said,
is
disabled
by
default
on
the
on
the
hefty
of
QuickStart
and
probably
should
be
disabled
on
most
clusters
running
on
AWS
all
right
and
then
queue
so
I'm
going
to
sign
off
here
soon.
It
says.
A
Is
there
a
decent
slide,
channel
or
group
to
discuss
these
topics
elasticsearch
with
kubernetes
I'm,
not
sure
Steve
might
have
an
answer
there
and
then
finds
the
rather
in
each
topic
hard
to
find
anybody
else.
That's
interested
in
discussing
it!
Well,
you
know
right
well,
hi
did
Steve
have
some
experience
there.
So
there
you
go
all
right,
so
I've
gone
way
over
I
feel,
like
I've,
been
a
little
bit
a
little
bit
less
driven
this
time
here.
A
So
I
haven't
sort
of
been
on
the
on
the
ball
here,
but
I
want
to
I
want
to
thank
everybody
for
joining
me
here.
Hopefully,
we
learned
some
new
stuff
did
some
interesting
digressions.
Thank
you
to
Steve
and
Ryan
big
time
for
for
staying
on
the
line
and
giving
us
some
advice
here.
It's
always
I
always
learned
stuff
and
I
love
learning
stuff
from
from
the
experts.
So
that's
really
really
great,
and
so
it
looks
like
Julien
and
Juan
also
would
love
to
learn
more
about
Ronnie
and
elasticsearch
on
top
of
on
top
of
kubernetes.
A
So
hopefully,
y'all
can
can
get
yourself
hooked
up.
You
can
reach
out
to
Steve
on
Twitter
he's
Steve
sloka
everywhere.
That's
probably
a
great
way
to
start
seeing
if
there's,
if
there's
a
format,
someplace
to
actually
start
talking
about
this
stuff
and
I.
Also
in
my
tweets,
you
know
for
this
particular
episode:
I
tagged
him
too,
so
you
should
be
able
to
find
him
that
way.
A
All
right
and
thank
you,
everybody
for
joining
me-
have
a
great
weekend
if
your
weekend
hasn't
already
started
and
if
you're
going
to
be
around
in
at
cube
con
next
week,
definitely
come
by
the
booth
and
say
hi
and
we're
trying
to
have
some
good
swag,
some
good
stickers
and
stuff
there.
So
so,
hopefully,
I'll
see
you
there.
Alright,
everybody
have
a
have
a
good
weekend.