►
From YouTube: TGI Kubernetes 112: Deep dive into Admission Controllers
Description
Episode notes at https://github.com/vmware-tanzu/tgik/blob/master/episodes/112/README.md
- 00:00:00 - Welcome to TGIK!
- 00:19:07 - Start digging into Admission Controllers
- 00:28:47 - Start looking at code
- 00:32:53 - Start trying to use ko for deploy
- 00:47:04 - Give up on ko and use a plain old Dockerfile
- 00:50:33 - Get deployment with TLS
- 01:10:46 - Configure webhook admission controller
- 01:19:35 - Start testing admission controller
- 01:21:51 - why isn't stuff logging?
- 01:29:12 - Working! Playing with admission controller
Come hang out with Joe Beda as he does a bit of hands on hacking of Kubernetes and related topics. Some of this will be Joe talking about the things he knows. Some of this will be Joe exploring something new with the audience. Come join the fun, ask questions, comment, and participate in the live chat!
This week we'll be digging into webhook admission controllers! We'll dive into the code and code up a new one (based on the upstream test image) install it and see how it works.
A
All
right,
everybody,
hello,
hello,
hello,
welcome
to
another
episode,
episode,
112
of
TGI
kubernetes
I'm,
your
host
Joe
Beda
I'm,
a
principal
engineer
at
VMware
and
for
those
not
in
the
know,
TGI
kubernetes
is
a
weekly
ish
me
or
one
of
the
other
folks
on
our
team
gets
together
and
does
a
deep
dive
into
something
kubernetes.
It
could
be
a
new
project,
it
could
be
a
piece
of
the
technology
and
we
just
spend
some
time
really
going
in-depth
and
exploring
this
stuff
a
lot
of
hands
on
keyboard.
A
For
me,
oftentimes
I
pick
things
that
I'm
not
expert
in,
so
we
get
to
actually
learn
together,
and
so
that's
what
we're
gonna
be
doing
today
around
admission
controllers,
but
I
like
to
start
off.
First
of
all
by
saying
hello
to
everybody.
First
of
all,
yes,
I
do
have
a
green
screen
now
and
I'm
not
afraid
to
use
it.
This
is
the
new
world
with
zoom
and
everything
else
going
on.
I
decided
to
get
fancy
and
I
can
change
my
background
and
stuff.
A
This
is
a
not
too
distracting,
hopefully,
but
but
having
a
lot
of
fun
with
that,
so
yeah.
So
hello
to
everybody,
I'm,
just
gonna,
read
through
the
comments
here.
A
little
bit
was
effor
Mizzou
fir
nice
to
see
Maddie
good,
to
see
you
Rory
from
luck.
Oil
ahead,
who's,
Chang
joy
well
lead
good
to
see
you
Robert
from
Dublin
Martin
from
the
Netherlands
Tim.
Also
in
devlin
Dublin
California
version
John
good
to
see
you
John
Mukilteo.
A
A
A
The
format
of
T
gik
is
I
like
to
start
off
with
we
pulled
together
some
interesting
links
of
what's
going
on
in
the
contributor
community
and
around
the
larger
community,
George
and
Duffy
oftentimes
contribute
to
that
go
through
that.
Try
not
to
spend
too
long
doing
that,
and
then
we
start
doing
a
deep
dive.
The
topic
today
is
going
to
be
admission,
controllers
and
I'm.
Actually
going
to
be
writing
some
code
and
deploying
these
to
a
cluster
home
in
and
I
forgot
to
actually
start
my
cluster
I
got
distracted
by
stuff.
A
A
A
A
So
let's
actually
start
digging
into
stuff.
So
the
first
one
here
is
that
there
is
a
kept
about
caps,
so
this
stuff
is
kind
of
inside
baseball
in
terms
of
how
the
kubernetes
community
works,
and
so
a
little
while
ago
we
started
this
thing
called
called
caps,
kubernetes
enhancement
proposals
and
one
of
the
exciting
things
on
that
I
didn't
know
this
was
going
on,
but
we're
actually
sort
of
modernizing
that
proposal.
A
We've
learned
from
some
stuff
and
getting
better
about
this,
and
so
this
is
how
we
try
and
make
changes
and
kubernetes
do
it
in
a
way
where
things
are
well
documented.
A
lot
of
folks
have
a
view
to
a
way
to
actually
review
it
and
we
can
track
these
things
over
time
and
so
a
lot
of
really
good
changes
here
in
terms
of
how
we're
doing
that
process.
A
So,
if
you're
involved
in
caps
worth
taking
a
look
at
that
good
lessons
to
be
learned
from
that,
so
I'm
really
excited
to
actually
see
this
moving
ahead
and
seeing
folks
fixing
some
of
the
bugs
of
that
process,
so
very,
very
cool.
So
the
next
thing-
and
this
one's
really
exciting
for
me,
is
when
we
publish
stuff
releases
from
kubernetes.
A
Traditionally,
a
lot
of
these
things
were
really
focused
on.
Only
Googlers
could
do
certain
steps
right
and
so
like
early
on,
like
the
the
container,
images
were
actually
intermixed
with
some
other
stuff,
and
it
had
this
Google
container
thing
on
it,
and
so
we
weren't
like
when
we
started
kubernetes,
we
weren't
super.
A
You
know
essentially
strict
about
sort
of
thinking
about
what
stuff
was
community-driven
and
what
stuff
was
Google
driven
and
so
I
opened
this
this
issue,
it's
number
20
to
70
and
the
release
repo
back
in
2017.
Saying
like
you
know,
we
need
to
actually
sort
of
get
more
separation
here,
so
that
community
folks
can
actually
do
releases,
and
this
is
making
some
huge
progress,
and
one
of
the
big
things
that
we're
doing
is
part
of
that
is
moving.
The
images
to.
A
Kate's
GCR
I/o
instead
of
GC
r,
io,
/,
google
containers
and
so
flipping
this
stuff
around
a
little
bit
so
that
it's
kubernetes,
optimized
and
folks
in
the
community
can
get
more
involved,
and
my
understanding
here
is
that
the
actual
flip
happened
during
a
zoom
call
on
one
of
the
meetings
which
is
actually
really
cool.
So
this
is
actually
really
good
progress
of
sort
of
moving
stuff
out
of
you
know
a
place
where
only
Googlers
can
drive
it
to
where
the
community
can
start
driving
this
stuff.
A
So
I'm
really
excited
about
that
and
then
then
Stephan
Augustus
also
pointed
he
has
a
here
talking
about
issue
triage
trying
to
get
a
handle
on
the
number
of
issues
we
have
in
kubernetes.
What
folks
are
looking
at
and
how
stale
they
are.
So
if
you're
interested
in
that
feel
free
to
take
a
look
again,
this
is
a
little
bit
of
inside
baseball
in
terms
of
the
way
that
we
run
stuff
inside
of
the
kubernetes
community.
A
But
I
think
you
know
we're
all
learning
and
it's
I
know
a
lot
of
folks
are
are
looking
to
get
involved
and
are
interested
in
it.
So
there
are
some
some
stuff
that
you
can
dig
into
all
right.
So
that's
the
sort
of
core
kubernetes
stuff
as
we
look
across
the
wider
ecosystem,
got
some
really
interesting
stuff
going
on
here.
A
I
think
is
really
really
cool,
and
so
it
looks
like
they've
included
videos
from
the
last
couple
of
cube
cons
and
it's
because
I
don't
know
if
you've
ever
tried
to
find
a
video
from
a
cube
con
on
the
CNC
F
YouTube
channel.
It's
like
there's
just
like
way
too
much
there.
So
it's
really
cool
to
actually
see
a
better
dashboard
for
finding
this
stuff.
So
I'm
really
excited
about
that
all
right
and
let's
see
oh
and
then
this
one
is
actually
really
cool.
A
You
have
a
list
of
clusters,
a
list
of
users
which
is
sort
of
like
credentials
and
then
a
set
of
context
which
is
sort
of
how
these
things
come
together
with
namespaces
and
from
a
sort
of
denormalized
or
no
lies
data
model.
I
think
this
makes
a
lot
of
sense,
but
the
reality
is
that
your
cube,
config
is
really
a
database
and
the
commands
for
actually
modifying
those
things
are
not
super
obvious,
and
so
we've
been
sort
of
patching
over
that
and
I.
A
A
A
It's
moved
a
long
ways
since
then,
but
K
native
had
a
really
hard
dependency
early
on
on
on
sto,
and
one
of
the
things
that
we're
seeing
is
that
the
the
K
native
folks
have
created
more
separation
there
in
terms
of
the
requirements
that
they
need
from
the
routing
layer
to
be
able
to
do
the
type
of
stuff.
Oh,
when
I
look
away
from
the
mic,
my
audio
gets
quieter.
Alright,
so
I'll
try
and
keep
the
keep
the
mic
right
here.
A
Thanks
for
the
thanks
for
the
the
reminder
you
so
yeah,
so
the
the
yeah
and
so
now
like
we're,
seeing
that
we
can
have
K
native
work
with
link
or
D
work
with
a
bunch
of
other
stuff
and
I'm
really
excited
to
see
more
sort
of
loose
coupling
between
that
stuff,
hi
Vivian
from
eunuch.
So
yes,
so
that
is
really
exciting,
and
so
here's
something
that
actually
goes
into
details
around
that
really
like
to
see.
You
know
again
more
loose
coupling
between
K
native
and
the
other
parts
of
the
ecosystem
that
it's
depending
upon.
A
Let's
see
so
the
other
thing,
so
this
is
really
cool.
This
is
the
manage
kubernetes
inspection
tool,
which
is
I
love.
You
know
all
the
tools
where
you
know
we're,
essentially
using
kubernetes
and
automation,
to
look
at
configuration
and
drive,
essentially
advice
on
how
to
run
things
in
a
conformant
or
secure,
or
you
know
you
know
all
these
sort
of
different
sort
of
linting
tools
that
you
can
do
on
your
environment.
Most
of
those
things
don't
have
any
knowledge
of
the
underlying
platform
and
stuff.
A
A
They're
check
that
out
all
right,
I'm
gonna,
keep
going
Alex
Ellis,
who
is
the
person
behind,
among
other
things,
open
faz
is
has
this
article
that
goes
into
a
little
bit
of
the
history
around
we
raspberry
pi
clusters
and
kubernetes,
and
how
these
things
work
together
and
I.
Think
it's
really
really
fascinating
to
see
how
folks
you
know.
Cuz,
you
can
you,
can
boot
up
a
raspberry
pi
cluster
for,
like
I,
don't
know
like
under
a
hundred
bucks.
A
You
can
get
going
with
this
stuff,
and
so
it's
really
cool
to
see
how
people
are
playing
around
with
kubernetes.
On
top
of
this,
you
know
he
goes
through
a
lot
of
the
history
here.
Also
a
shout
out
to
Lucas
whose
twitter
handle
is
kubernetes
on
arm.
You
know
to
actually
sort
of
doing
a
lot
of
the
work
along
the
way
to
actually
get
this
stuff
up
and
running.
So
if
you
want
to
play
around
with
kubernetes
on
raspberry,
PI's
looks
like
there's
a
lot
of
really
good
info
and
history
going
on
here.
A
Alright
keep
moving.
Ok,
so
Google
announced
this
project
called
kept.
Kpt
I'm
still
wrapping
my
head
around.
What's
going
on
here,
it's
sort
of
a
meta
tool
for
managing
kubernetes.
You
know
packaging
tools
with
the
idea
that
there's
ways
to
download
stuff
from
a
git
repo
apply
changes
to
that
update
it
again
and
and
then
processing.
You
know,
like
you
know
so,
essentially
workflow
about
how
you
want
to
actually
manage
checking
in
checking
out
modifying
dealing
with
sort
of
different
versions
of
your
config.
So
it's
kind
of
a
little
bit
of
a
meta
thing.
A
So
yeah
I
think
something
broke
on
the
YouTube
side.
I
had
to
actually
switch
to
the
back
upstream
destination
for
YouTube,
so
I
apologize
for
that.
Folks,
back
up
sorry
about
that,
yeah,
a
lot
of
folks
dropped,
hopefully
they'll
join
back
in
all
right.
So
we're
talking
about
kept
the
the
interesting
thing
that
I
think
with
kept.
Is
that
it's
it's
sort
of
this
meta
thing
where
you
can
essentially
tell
it
to
modify
some
file
in
some
way
and
it's
just
a
generic
way
to
essentially
patch
a
mole
in
some
way
of
patching
the
amyl.
A
B
A
All
right,
okay,
so
yeah
I,
think
that
was
I.
Think
there
was
a
hiccup
on
the
YouTube
site.
I
have
had
OBS
crashing
on
me,
but
let's
hope
in
that
with
that
we
don't
have
this
happen
again,
okay,
so
yeah.
So
the
other
thing
that
worries
me
about
about
kept-
and
you
know
it's
it's
it's
an
interesting
thing
where
you
know
I'm,
you
know
on
a
personal
level,
you
know,
as
Google
introduces
these
things.
A
A
Think
seeing
things
like
you
know
pushing
installing
this
through
G
cloud
I
mean
that's
good,
but
also
it
really
shows
that
there's
a
super
tight
coupling
between
Google
and
this
stuff,
and
it's
going
to
be
interesting
to
see
if
they
can
build
real
community
real
usage
around
this
or
whether
it's
something
that's
going
to
be
Google
only
I
think
that
you
know
it's
clear
that
Google's
recalibrating
their
relationship
to
open-source
projects
and
I
think
this
is
a.
This
is
one
of
the
first
things
that
they've
launched
after
that
now.
A
What's
interesting
is
that
you
know
this.
Is
you
know
the
week
when
cube
con
was
supposed
to
have
happened
in
Amsterdam,
and
so
maybe
they
were
probably
planning
on
launching
and
talking
about
this
there
and
and
just
decided
to
actually
drive
it
anyways.
Alright.
So
let's
see
here
we
are
it's.
The
other
stuff
that
got
launched,
cortex
1.0
is
out
so
cortex
is
a
CNC
F
sandbox
project
that
does
essentially
scale
out
of
Prometheus
highly
available
multi-tenant
stuff
that'd
be
a
fun
project.
A
I'd
love
to
actually
dig
into
that
at
some
point
and
let's
see
and
then
here's
the
link
to
our
go.
Cd
1.5,
really
cool
to
see
that
coming
out.
Also,
let's
see
better
performance
integration
with
helm,
3,
local
accounts
and
stuff
bunch
of
bug
fixes,
so
some
really
cool
stuff
coming
out
and
out
of
that
all
right.
A
A
The
Valero
team,
as
for
those
that
are
not
familiar
Valero,
is
a
backup
and
recovery
project
for
capturing
the
state
of
your
cluster
looking
for
feedback
from
the
community,
and
so,
if
you
use
Valero
or
if
you're
interested,
please
take
a
look
at
the
survey
that
we
have
posted
here
would
be
really
great
to
get
your
feedback
there
and
then
one
last
thing
again.
Steven
put
this
in
here.
A
We
now
have
a
contributor
strategy
sig
in
the
CN
CF,
and
so
the
the
CN
CF
is
a
you
know.
The
whole
goal
of
the
CN
CF
is
to
help
projects
be
successful,
and
so
this
is
essentially,
you
know,
sharing
tools.
You
know
techniques
strategies
on
how
to
actually
engage
with
your
contributors
as
a
way
to
sort
of
like
up
level
all
the
products
across
the
CN
CF.
So
it's
great
to
actually
see
that
happening
alright.
A
So
that
is
where
we're
at
with
notes
have
went
a
little
bit
longer,
I
think
because
we
lost
the
stream.
So
hopefully
we
won't
have
that
happen
again
and
now
I'm
going
to
actually
dig
in
to
admission
controllers.
Oh
the
first
thing
I'm
going
to
do
here
and
I
forgot
to
do
this
is
I
want
to
make
sure
that
I
have
a
cluster
up
and
ready.
A
I
usually
do
this
before
we
start,
but
let's
do
a
docker
I
think
I
have
my
cluster
from
last
week,
so
we
can
do
kind,
delete
cluster
we'll
do
that
and
then
we'll
actually
do
another
one
here
so
yeah
these
were
in
the
the
hack
MD
from
last
week
and
so
we'll
get
that
actually
going
in
the
background
there
all
right
cool.
So
let's
talk
about
admission
controllers.
A
So
the
first
thing
is:
there's
a
great
blog
post
that
was
posted
almost
a
year
ago.
Now
that
goes
into
the
detail
here
and-
and
the
the
really
interesting
thing
here
is
I
think
you
know
which
grate
is.
Is
this
this
diagram
here,
which
is
kind
of
a
a
sort
of
life
over
a
quest
into
the
API
server?
So
so,
first
of
all,
let
me
like
just
quick,
quick
review.
A
I
have
this
blog
post
that
I
wrote
a
long
time
ago,
where
I
have
a
diagram
also,
so
this
is
sort
of
like
roughly
you
know
what
a
kubernetes
cluster
looks
like,
and
the
interesting
thing
here
is
that
we
have
the
API
server
and
it
really
is
the
meet
me
point
for
everything
that
happens
in
kubernetes.
Everything
comes
in
through
the
API
server,
whether
it
be
from
end
users
or
whether
it
be
from
other
parts
of
the
cluster
or
the
control
plane.
A
And
so
what
happens
is
that
the
API
server
ends
up
being
a
critical
sort
of
policy
control
point
for
everything
in
the
system
behind
the
scenes
stuff
gets
stored
in
at
CD,
but
the
only
one
who
really
should
be
accessing
at
CD
directly
is
the
API
server
and
we've
actually
seen
folks
do
experimental
things
where
they
have.
You
know
replace
at
CD
with
other
types
of
databases
in
the
background
there.
A
There's
two
types:
we
have
mutating
admission
controllers
and
validating
admission
controllers,
and
so
these
things
essentially
are
you
know
things
that
are
sort
of
pluggable
parts
of
this
pipeline
where
the
mutating
ones
can
take.
The
requests
from
you
know
the
whoever's
calling
it
from
the
API
do
whatever
changes
they
need
to
do
then
pass
it
on
to
the
next
admission
controller,
and
then
it
goes
through
object,
schema
validation,
making
sure
that
everything
looks
good
and
then
there's
a
set
of
validating
animation
controllers,
and
these
things
essentially
say
yes
or
no.
A
Whether
they
want
to
allow
this.
So
this
ends
up
being
a
policy
breakpoint
and
if
they
disallow
it,
they
can
return
errors
for
why
they
disallowed
it
in
a
way
that
the
end
user,
from
cube
controller
from
the
API
actually
get
some
feedback
on
what's
going
on
there,
and
then
this
stuff
gets
persisted
to
@cd
along
the
way.
So
this
is
the
the
overall
flow
of
a
you
know:
sort
of
life
of
an
API
request
into
the
API
server
somewhere
in
here
and
I'm.
A
But
right
now
can
only
be
configured
with
a
changing
flag
to
the
API
server
I
believe
those
things
happen
for
every
request,
but
I'm
honestly,
not
sure
if
the
audit,
if
the
audit
logs
actually
happened
before
after
the
admission
controllers,
that's
something
that
I'd
have
to
actually
dig
into.
If
somebody
on
the
on
the
line
here
knows
I'd
love
to
hear
about
that
so
yeah.
So
what's
interesting
here
is
that
there's
a
bunch
of
like
when
we
first
started
doing
kubernetes.
A
A
I
did
an
episode
a
little
while
ago,
around
OPA,
which
is
the
the
open
policy
agent
and
the
primary
way
that
it
integrates
with
kubernetes
is
via
one
of
these
admission
controllers
and
so
so
yeah.
So
this
is
the
general
idea
of
how
this
stuff
works,
and
what
I
want
to
do
today
is
is
write
into
Mission,
Control
or
install
it
into
a
cluster
and
then
play
with
it
and
get
a
feel
for
sort
of
what's
happening
under
the
covers
here.
A
That's
my
plan,
let's
see
so
other
stuff,
so
here's
some
good
docs
on
the
dynamic
admission
controllers.
These
are
the
webhook
ones,
but
then
there's
also
admission
controllers
in
general,
and
here
you
can
see,
here's
all
the
built-in
ones
right.
So
what
does
each
of
these
things
do
and
then
there's
also
like
you
can
change
with
Flags.
A
You
can
turn
on
some
of
the
built-in
ones
and
turn
off
some
of
the
built-in
ones
and
yeah,
and
you
can
see
that
there's
things
that
do
certificate
approval
and
signing
you
know
like
I'll,
give
you
there
some
security,
sensitive
ones
that
have
some
performance
trade-offs,
and
so
this
is
essentially
a
tunable
here.
But
so
one
of
the
things
that
we
see
here
is
that
there's
an
admission
controller
for
always
pull
image
images,
and
what
this
will
do
is
that
it
will
modify.
A
So
it's
a
mutating
and
mission
controller
that
will
modify
every
new
pod
to
force
it
to
actually
pull
the
image
poll
policy.
To
always,
and
and
this
is
actually
interesting
from
a
security
point
of
view,
because
if
you
have,
if
you're
sharing
multiple
different
people
are
sharing
a
cluster
and
some
of
them
have
permission
to
run
some
images,
but
not
other
images,
and
it
happens
to
be
cached
on
the
node.
A
Let's
see,
and
so
there's
a
bunch
of
these
things.
I
believe-
and
you
can
all
correct
me
if
I'm
wrong-
that
the
mutating
admission
controller's
happen
based
on
alphabetical
order,
or
at
least
based
on
at
least
the
webhook
ones,
do
are
based
on
alphabetical
order
and
they
happen
one
at
a
time,
because
what
did
the
output
of
one
gets
passed
into
the
input
of
another
the
and
then
the
validating
ones
actually
happen
in
parallel
and
then
there's
also
like
there's
some
interesting
stuff
that
happened.
A
A
That
you
may
find
that
your
admission
controller
gets
called
multiple
times
for
something
because
you
may
have
one
mutating
admission
controller
and
then
it'll
actually
go
through
and
call
another
one,
and
so,
as
you're
registering
the
admission
controller,
there's
ways
to
register
to
say:
I
want
to
see
I
want
to
see
all
updated
versions,
and
so
it
sort
of
does
a
bunch
of
these
things
until
until
it
actually
hear
the
failure.
Well
failure
policy
and
Riaan
vocation
policy
right
and
then
there's
things
like
because
these
things
are
web
hooks.
Do
you
want
to
fail
open?
A
Yeah,
the
webhook
ones,
based
on
based
on
alphabetical
order,
at
least
it's
deterministic
right,
alright.
So
the
the
place
that
I'm
going
to
start
from-
and
this
is
interesting-
is
that
inside
the
kubernetes
codebase
there's
a
bunch
of
container
images
that
are
created
for
the
kubernetes
end
end
tests,
and
so
these
things
are
created
and
pushed
every
once
in
a
while
and
they're,
essentially
sort
of
test
fixtures
that
are
used
in
the
ete
test
and
and
then
there's
oops.
One
of
these
things
is
essentially
a
big
sort
of
combined
one.
A
What
the
heck,
what
the
heck
is
going
on
here,
I
think
YouTube's
having
problems
I'm,
gonna
blame
YouTube,
all
right:
where
did
I
left
off
so
I
took
the
stuff
out
of
the
end-to-end
test.
I
extracted
I
made
it
so
that
we
could
build
it
separately
and
I
got
to
the
point
where
I
can
build
it,
but
I
haven't
actually
dug
in
a
lot
there,
and
so
this
is
what
we're
gonna
be
using
as
a
start
and
okay,
so
you're
all
back.
A
I
can
boot
this
up
in
in
vs
code,
and
we
can
see
what
we
got
going
on
here
and
the
way
that
this
works
is.
We
have
a
main,
and
this
pulls
in
a
bunch
of
stuff
and
it's
just
a
simple
web
server
that
has
a
serving
certificate
kit
and
then
has
a
bunch
of
sort
of
test
endpoints
for
doing
admission
controllers.
So
that's
actually
cool
yeah,
so
yeah.
A
It
could
be
that
YouTube's
having
problems,
because
too
many
people
are
streaming
and
we're
all
at
home
and
all
that
so
that
that
might
be
what's
going
on
there.
This
is
the
first
time
I've
had
these
issues.
We've
had
problems
with
YouTube's
in
the
past,
but
with
YouTube
streaming
in
the
past,
but
this
is
the
first
time
I've
seen
this
alright.
So
we
got
this
stuff
up
and
running,
and
so
the
first
thing
that
we
want
to
do
is
I
want
to
package
this
in
a.
A
Alright,
alright
whew
I'm,
sorry
folks,
oh
wow,
you
know
it
looks
like
a
ton
of
people
dropped
off
they're
coming
back
now,
I'll
wait
for
for
folks
to
get
back
on
all
right,
so
I
switched
back
to
the
primary
YouTube
stream.
Hopefully
we
won't
see
this
happen
again.
That's
rough,
alright,
alright!
So
where
was
I?
Ok,
so
we
have
V
s
code.
We
can
build
this
thing.
A
A
A
A
A
Alright,
so
co
and
go
mod
and
stuff
like
that,
I
don't
know:
do
you
all
have
for
this
to
work?
You
don't
have
to
kind
load,
docker
image
from
the
kind
node
yeah.
That's
one
of
the
things
that
I'm
thinking
about.
So
that's
going
to
be
a
little
bit
tricky
and
this
thing
is
actually
giving
me
problems.
We
may
kind
doesn't
expose
the
docker
register.
You're,
like
mini
cube,
does
all
right.
We
could
start
a
mini
cube
yeah.
A
A
A
A
A
C
A
A
A
A
A
B
B
C
A
C
A
C
A
A
A
A
B
B
C
A
A
A
A
C
A
This
thing
will
be
a
little
bit
chunky,
but
that's
okay,
I
did
an
episode
on
Co
and
now
I
can't
get
the
damn
thing
to
work
all
right.
So
now
we're
pulling
to
hunt,
go,
hang
yeah.
What's
a
site
that
builds
docker
images
from
github
repos
yeah
I
could
do
that.
I'd
have
to
create
the
repo,
though
cuz
I
haven't
done
that
yet
I
was
gonna.
Do
that
after
the
episode
and
upload
it
for
y'all
all
right.
A
So
this
should
work
now
we're
actually
doing
the
work
dear,
we're
copying
everything
over
go
run,
install
it's
gonna,
download,
a
bunch
of
stuff,
there's
gonna
be
super
slow,
but
that's,
okay,
yeah
cloud
native,
build
packs
would
be
sweet
here
too.
This
is
one
of
those
things
where
it's
like.
You
know.
You
always
have
something
set
up
and
like
it
just
works.
Okay,
so
now
we're
actually
got
this
okay,
and
so
now
we
can
do
Kai
Oh
docker
build
ashtag
test
admission,
v1,
we're
gonna.
Do
that.
A
So
that
we
have
a
tag
for
this
thing,
docker
images
right
and
then
we
have
kind
and
hoodoos
kind
load
and
then
we'll
do
a
test
admission.
V1,
Oh,
docker
image,
all
right,
so
this
will
load
this
into
kind.
This
takes
a
takes
a
little
bit
all
right
so
now
yeah,
so
I
wasted
so
much
time
with
Coe.
I
could
have
just
done
this.
Oh.
A
So
we
have
to
actually
do
TLS
and
we
have
to
create
a
certificate
and
admission
control
or
TLS.
Now,
one
of
the
things
that
folks
have
actually
been
doing,
which
is
which
is
really
interesting,
is
that
they've
been
reusing.
Some
of
the
they've
been
reusing.
The
CA
stuff
that's
been
built
into
kubernetes
for
actually
doing
server
certificates
for
this.
So
here
we
have
a
shell
script.
In
an
example
here,
oh
look
at
this,
we
have
stack
rocks,
has
a
demo
one
but
generate
keys.
Alright,
let's
actually
copy
and
paste.
A
This
here
touch
gen
keys
and
then
we're
gonna
go
through
and
look
at
gen
keys,
shell,
we're
gonna
post
paste,
this
there's
a
bunch
of
stuff
here,
but
key
directory
schmod
the
key
directory
and
then
we're
gonna
actually
go
through
and
create
a
CA
here,
generate
a
private
key
and
then
go
through
and
generate
a
certificate
signing
request
for
the
private
key
and
then
sign
it
okay.
So
this
is
using
open,
SSL
there's
the
CF
SSL,
which
is
another
tool
kit
that
you
can
use
do
I
have
open
SSL,
yes,
I
do
so
now.
A
Alright,
so
yeah
now
we
have
a
private
key,
so
here
we
have
keys
where
we
have
both
the
let's
see
the
things
that
we're
gonna
want
is.
If
we
look
at
our
config
here,
what
we're
going
to
need
is
we
need
our
cert
file
and
our
key
file,
and
so
the
cert
file
is
going
to
be
this
thing
here,
and
this
is
the
key
file
and
then
here's
our
CA
certificate,
a
self
signed
certificate
that
we're
going
to
use
when
we
actually
configure
the
thing.
So
that
makes
sense.
This
is
all
voodoo.
A
This
is
actually
I
think
a
real
rough
spot
in
the
kubernetes
ecosystem.
Right
now
is
that
generating
these
certificates,
configuring
them
super
error-prone.
Super
pain
in
the
butt
rotating
them
is
not
as
easy
as
it
needs
to
be.
This
is
something
that
I
think
as
a
community.
We
need
to
go
ahead
and
get
better
at
alright.
So
what
we're
gonna
do
is
we're
gonna
put
the
keys
in
a
secret
and
so
make
tor
deploy.
A
A
A
B
A
A
A
A
C
A
A
A
Mount
and
we'll
just
go
TLS
like
that,
okay,
so
now
what
this
is
going
to
cause.
This
is
going
to
take
stuff
from
the
secret.
It's
going
to
put
it
on
the
filesystem
and
then
it's
going
to
make
it
available
mounted
in
slash
TLS
inside
of
the
inside
of
the
the
the
container,
and
now
we
need
to
actually
reference
those
things.
So
we
actually
have
a
parameter
here,
which
is
TLS
search
files
and
TLS
private
key
file,
okay,
and
so
we're
gonna
do
and
so
now
I
have
to
remember
sort
of
image.
A
A
A
A
A
A
Okay,
now
it's
running
sweet
all
right,
so
that
is
up
and
running
so
now:
okay,
woohoo,
we
actually
got
the
damn
thing
running,
I,
think
if
you
specify
yards
or
command
in
the
pods
Beckett
will
automatically
use
that
instead
of
yeah,
so
I
think
it
doesn't
combine
those
things
with
a
docker
image:
okay,
but
that
is
sort
of
like
so
this
is
like
the
hard
part
of
installing,
and
you
know,
admission
controller.
Is
that
actually
getting
this
stuff
up
and
running
so
now?
A
A
Curl
kay
is
it
K
should
be
iolo
page,
not
found
okay,
and
then,
let's
see
what
do
we
have?
What
other
routes
do
we
have
here?
We
have
read
easy,
ok,
all
right,
so
we
got
the
thing
up
and
running.
We
can
connect
to
it
with
TLS,
with
a
self-signed
cert
that
took
us
way
too
freaking
long,
but
there
we
go
now.
What
we
need
to
do
is
we
need
to
actually,
let's
see,
we
need
to
actually
set
up
a
service
for
this
thing,
so
we're
gonna
actually
go
through
and
do.
A
A
Because
this
is
what
the
the
API
server
is
going
to
use
to
talk
to
the
darn
thing,
good
enough
test
admission,
app
test,
ignition
and
renew
four
three
four,
four
four
three,
the
TL
asserts
were
for
the
wrong
entity,
yeah
yeah!
That's
why
I
did
it
is
that
I
forgot
to
actually
change
the
common
name
in
the
certificate,
and
so
that
was
likely
to
actually
cause
us
problems
in
the
future.
Cube
control,
get
services,
cube
control,
apply
all
right:
a
cube,
control,
port
forward
service
test
admission,
eight
four,
three:
three
four.
A
A
Okay,
so
now
we're
going
to
do
a
creator
update
of
API
versions
of
let's
do
config
Maps
config
map,
so
these
things
I
always
forget
the
these
are
v1,
we'll
just
do
the
API
version,
v1,
okay,
yeah,
we'll
need
to
reference
the
service
and
include
it
yeah,
and
so
one
of
the
things
here
is
that
I
see
these
are
lowercase
so
I'm,
assuming
that
they're
lowercase
here
to
scope,
namespace
create
update
API
groups.
Okay,
so
we
have
that
now
we
have
to
figure
out
the.
A
A
C
B
A
A
A
Can
you
do
what
are
the
events?
Can
you
also
do
get
I,
don't
think
it
actually
works.
Forget
I
think
it
actually
skips
past
it,
and
so
this
gives
this
is
gives
you
a
ton
of
data
and
sort
of
like
how
you
actually
specify
these
things
create,
update,
delete,
connect
or
a
star
to
match
all
okay.
So
we'll
do
that.
You
know
it
doesn't
support
yet
yeah.
That's
why
you
that's
the
different
one
of
the
big
difference
between
this
and
audit.
A
D
A
B
B
A
A
A
D
A
C
A
A
A
A
A
B
C
A
A
B
A
B
A
A
A
Yeah
I
want
I
want
Coe
with
some.
You
know,
integration
with
kind,
but
kind
load
is
really
freaking
slow.
My
guess
is
that
actually
is
grabbing
the
whole
thing.
If
I
had
actually
gone
through
and
done
a
multi-stage
build,
it
would
be
a
lot
smaller.
We
have
a
mad
now
Matt
I
wasn't
able
to
get
co-working.
I'm
gonna
have
to
like
we're
gonna
talk
about
this
later.
We're
gonna
have
words.
A
A
A
A
So
there's
a
whole
bunch
of
different
like
the
request
resource
and
the
request
kind,
and
it
sort
of
moves
you
know
is
able
to
sort
of
convert
between
different
schemas.
We
see
that
we
get
a
create
here
in
the
default
namespace
and
and
then
there's
information
about
who's
actually
doing
it.
So
this
is
really
interesting
and
this
is
where
admission
controllers
and
the
audit
log
actually
starts
to
overlap,
because
you
do
get
other
information
about
the
requests
coming
through,
including
who
it
is
that
act
that
is
actually
calling
which
is
interesting.
A
And
then
you
get
information
about
sort
of
like
here's,
the
data
and
so
here's
the
raw
data
that
is
actually
getting
posted
in
including
a
bunch
of
stuff
like
managed
fields
and
stuff
like
that
and
then
other
metadata
about
this.
So
if
you're
doing
a
change,
there's
the
old
object
here,
it's
null,
meaning
that
there
was
no
previous
old
object,
yeah,
so
docker
so
kind
load.
Pretty
much
does
a
docker
save
exec,
and
so
it's
big
that's
because
I
actually
did
a
full
image
at
full.
A
Galang
image,
I
didn't
actually
create
a
minimal
image
and
then
and
then
other
options
and
whether
it's
a
dry
run
or
not.
So
there's
a
lot
of
really
good
information
here,
but
I
think
one
of
the
fascinating
things
here
is
that
this
is
a
way
to
essentially
plug
in
to
the
request
flow
and
actually
see
stuff.
A
A
A
And
then
we
can
actually
go
through
and
we
can
make
the
thing
non
deletable.
So
if
we
go
through
and
let's
now
change
the
the
our
test
config
map
to
be
non
deletable,
so
now
we
can
actually
go
through
and
update
it.
But
now,
if
we
actually
go
through
and
try
and
do
a
delete,
oh
wait,
it
deleted
it.
Why
did
it
delete
it?
Is
that
because
on
my
admin,
is
that
did
ice?
So
let
me
look
at
the
code
again.
A
What
is
going
on
here
so,
let's
look
at
the
code
again:
did
I
apply
yeah,
so,
okay,
so
here's
what
we
got.
We
have
webhook
e2e
test,
webhook
non
deletable,
okay
and
we're
gonna.
Look
at
the
code
here,
webhook
EDD
test,
webhook
non
deletable
and
it's
a
delete
request
then
allowed
should
be
false
and
it
should
actually
tell
us
that
we're
not
allowed
to
do
it
and
then
it
returns.
The
response.
A
Did
you
add,
delete
no
I,
don't
think
I
did.
Let's
actually
look
at
my
register
here,
so
we
didn't
actually
get
called
for
it.
Okay,
so
now,
if
I
do
delete
and
now,
if
I
do,
cubed
control
apply
a
register
right
now,
if
I
actually
try
and
delete
it,
it's
going
to
tell
me
no
I'm
not
allowed
to
delete
it
and
then
Matt's
saying
that
if
I
actually
do
validate
equals
false,
where
do
I
actually
pass
that
in.
B
A
A
A
A
We're
gonna
actually
delete
the
service
octants
pissed
at
us
now,
because
we
no
longer
have
that
thing
going
and
so
now,
if
we
actually
try
and
do
the
delete,
it'll
actually
delete
it,
because
what
we
see
here
is
that
we
had
the
failure
policy
here
to
actually
fail
open
here,
but
now
what
we're
gonna
actually
go
through
is
if
I
go
through
and
change
that
failure
policy
on
my
register,
what
is
what
are
the
options
for
failure?
Policy.
A
A
A
A
A
But
the
fascinating
thing
is
that
once
you
have
this
window
into
this
world,
you
can
do
so
many
interesting
things,
whether
that
be
stuff
like
OPA
or
really
it's
like
one
of
these
things.
Where
you
get
sort
of
this,
you
know
main
line
into
the
request
stuff.
You
can
start
playing
around
with
it.
You
can
start
learning,
so
many
cool
things
happen
with
this.
A
A
I
think
I'm
going
to
be
either
me
or
Duffy
will
be
next
week
and
and
I'm
not
sure
what
we're
going
to
be
talking
about
yet,
but
send
me
suggestions
on
Twitter
and
we
can
dig
into
it
in
the
meantime
have
a
great
weekend
if
you
haven't
started
your
weekend
already
and
stay
healthy,
stay
safe,
let's
all
deal
with
being
at
home
and
do
our
best
and
I
will
see
you
all
next
time.
Bye.