►
From YouTube: TGI Kubernetes 133: Hierarchical Namespaces
Description
Join Josh Rosso as he explores some cool stuff in the Kubernetes space! We'll start the episode out covering what's new in the cloud native space then get into some exploration! In this episode we'll be digging into hierarchical namespaces. A new controller available in the Kubernetes ecosystem to help further clusters abilities to support multi-tenancy.
episode directory: https://github.com/vmware-tanzu/tgik/tree/master/episodes/133
- 00:00:00 - Welcome to TGIK!
- 00:04:37 - Week in Review
- 00:15:11 - Hierarchical Namespace Overview
- 00:30:05 - Installing HNC and the Plugin
- 00:40:53 - Creating Namespaces
- 00:54:38 - Synchronizing Objects
- 01:15:32 - Experiments with NS Ownership and more!
- 01:31:53 - Advanced Resource Quota Propagation Ideas
- 01:37:05 - Wrap Up
A
A
So
for
those
who
might
be
joining
us
for
the
first
time,
tgik
is
a
weekly
show
that
we
do
on
fridays,
1
p.m.
Pacific
time
I
know
we
got
a
lot
of
regulars
in
the
room,
but
if
you're
new,
we
typically
go
over
some
of
the
stuff,
that's
happening
in
the
cloud
native
ecosystem
and
we
usually
dive
into
some
topic.
A
So
again,
my
name
is
josh
really
excited
to
be
with
you
all
today,
if
you're
joining
us
and
you
want
to
feel
free
to
say,
hey
in
chat,
it's
a
bit
of
a
tradition
to
also
say
where
you're
tuning
in
from.
If
you
feel
comfortable,
mentioning
that
the
notes
for
this
episode,
which
I'll
be
going
through,
you
can
find
on
tgik
dot.
Io
forward,
slash
live.
So
if
you
want
to
check
out
the
notes,
we've
got
feel
free
to
check
those
out
too
and
let's
see
who
we've
got
joining
us
today,
maddie.
A
As
always,
we
love
having
you
thanks
for
joining
us
haim
from
israel.
Welcome
riv
we've
got
riv
from
boston,
welcome,
adrian
also
from
the
eastern
side.
It
looks
like
in
toronto.
Adrian
is
one
of
the
maintainers
of
hnc
or
the
hierarchical
namespaces
controller
that
we'll
be
talking
about
today,
so
say,
hey
to
adrian
in
the
chat
we
will
we'll
be
leveraging
some
of
his
awesome
knowledge
as
we
try
to
learn
this
thing.
A
Beau
jonche,
hello,
hello,
welcome,
martin,
glad
to
have
you
back
as
always.
Martin
rico
welcome,
marico
glad
to
have
you
david,
hey
david
how's.
It
going
we
got
yuka
from
helsinki
awesome.
We've
got
no
coming
in
from
the
the
uk,
welcome
radha
from
scott
scotland
or
scottsdale.
Sorry
very
different
scott's
dale
jason
jason's
on
my
team
at
vmware
great
great
to
have
you
jason.
A
We've
got
phillip
from
bonn
rory
great
to
have
you
back
as
always
rory
from
scotland,
this
time,
not
scottsdale,
but
scotland,
mona
from
germany
we've
got
choco
glad
to
have.
You
welcome
back
tim
great
to
see
you
again
tim,
oh
wow,
we've
got
so
many
folks
joining
in
welcome
everybody.
We've
got
paul.
We've
got
josh
from
minnesota.
A
Moz
from
sudan.
Welcome
moz
alex
hey,
alex
great
to
have
you
alex
another
teammate,
the
very
familiar
duffy
under
the
under
the
moniker
mall
lion,
mullion
and
great
to
have
you
duffy
thanks
for
joining
us?
I
hope
everything's
going
going
well
with
your
time
off.
Hope,
you're,
really
decompressing
a
bit
pretty
from
new
jersey.
We
got
mccall
another
from
scottsdale
welcome!
Welcome.
We
got
vijay
from
bangalore,
vijay
aj
from
san
jose,
fully
geared
bear
from
portugal.
Martin
glad
to
have
you
back,
martin
jordy
from
boston
victor
from
new
york
city.
A
A
So
as
far
as
news
goes,
probably
the
most
prevalent
thing
to
the
core
is
that
for
120
there
is
a
call
for
enhancements
so,
depending
on
how
involved
you
are
with
kubernetes
upstream
there
is
this
thing
that
gets
worked
on
called
keps,
kubernetes
enhancement
proposals
and
there's
some
deadlines
for
getting
those
in
and
merged
if
you're,
not
that
involved
with
kubernetes
but
are
kind
of
curious
about
what's
going
on.
This
is
actually
a
really
cool
page
to
check
out.
A
A
I
know
we've
talked
about
on
tgik
a
couple
times:
the
kep
for
side,
car
containers
or
being
able
to
put
in
you
know
extra
containers
along
with
your
main
container,
but
having
them
actually
have
this
kind
of
specification
of
being
a
side
car
that
can
have
a
couple
implications
on
how
they
work.
So
you
can
read
the
design.
It's
got
a
bunch
of
cool
information.
Usually
these
go
really
deep
about
the
problems
that
are
trying
to
solve,
maybe
a
little
bit
around
some
implementation
considerations
so
again
in
120,
there's
some
deadlines
for
the
keps.
A
If
you're
someone
like
me
and
just
likes
to
browse
them,
keep
in
mind
this
kep
folder
exists,
it's
in
kubernetes
enhancements
keps
and
you
can
check
out
all
the
good
stuff
that
is
going
on
all
right
cool.
So
that's
it
for
the
core
this
week.
Oh,
actually,
you
know
what
there
is
there's
one
more
thing
I
should
mention
if
you're
eligible
to
vote
for
the
steering
committee,
please
be
sure
to
do
so.
So
the
steering
committee
we've
got
a
link
in
the
notes,
if
you're
not
familiar
with
what
the
steering
committee
does.
A
But
this
is
a
group
of,
I
believe
three
people
and
I
believe
the
the
residency
on
the
committee
is
is
two
years.
Hopefully
I
have
my
numbers
right.
There
feel
free
to
correct
me
if
I'm
wrong-
and
these
are
folks
that
are
in
charge
of
a
lot
of
the
direction
of
the
kubernetes
project,
a
lot
of
the
the
non-technical
items
around
how
the
project
proceeds,
its
governance,
lots
and
lots
of
good
stuff
and
the
folks
that
we
have
that
are
that
are
in
the
in
the
vote.
A
Let
me
see
if
I
can
pull
up
the
the
names
here
voting
process
candidate
list
is
here:
you'll
notice
a
lot
of
these
names.
These
are
a
bunch
of
pretty
freaking
awesome
people
right.
So,
if
you're
eligible
to
vote
do
make
sure
you
vote,
there's
a
there's,
a
link
in
the
the
in
the
hackmd
that
talks
a
bit
about
it.
The
eligibility,
I
believe,
is
50
contributions
over
the
past
year.
A
If
your
involvement
in
kubernetes
is
is
pretty
involved,
but
it
just
doesn't
translate
necessarily
to
like
contributions
in
the
more
conventional
get
sense.
There
is
also
a
voter
exemption
form
that
you
can
roll
with
too
so
so
do
keep
that
in
mind
if
you're
kind
of
more
involved
in
some
of
the
the
ancillary
things
that
don't
show
up
in
the
same
in
the
same
contribution
mechanism,
so
really
cool
good
luck
to
everybody
who
is
who
is
going
for?
A
Who
is
going
for
election
on
that
steering
committee,
I'm
sure,
based
on
the
names
we've
got,
whoever
lands,
it's
going
to
be
a
pretty
freaking
awesome
committee,
all
right
cool
cool,
so
in
the
ecosystem.
What
else
do
we
have
going
on
funny
enough?
I
actually
had.
I
got
to
attend
a
meetup
this
week
from
a
person
from
microsoft
on
the
open
service
osm.
A
A
So
the
data
plane
is
envoy
in
osm
and,
what's
probably
the
most
unique
to
osm
that
I'm
aware
of
today,
and
I'm
no
osm
expert
is
it
is
one
of
the
first
osms
to
be
or
sorry
it's
one
of
the
first
service
meshes
to
be
built
from
the
ground
up
to
comply
with
the
smi
or
the
service
mesh
interface.
So
those
in
cube.
A
A
All
right
and
we've
also
got
note
in
a
similar
vein-
that
cube
edge
was
accepted
as
an
incubating
project
in
the
cncf
landscape,
cube
edge
kind
of
like
k3s.
It
attacks
that
edge,
slash,
iot,
slash
resource
constrained,
use
case
for
kubernetes
that
more
and
more
folks
are
talking
about
and
trying
to
solve
so
congrats
to
the
cube
edge
group.
They
are
now
in
as
a
incubating
project.
A
All
right,
stackrocks
had
a
report
released
about
kubernetes
usage.
These
numbers
seemed
really
high
to
me.
I'm
not
gonna
lie.
I
haven't
looked
into
how
how
the
data
was
collected,
but
if
the
numbers
are
actually
this
high
awesome,
but
the
the
sentiment
from
the
quick
glance
I
gave
is
that
in
in
organizations
that
they
pulled
at
least
or
in
groups
of
users,
they
pulled
91
reported
having
kubernetes
to
orchestrate
containers
and
and
that's
awesome.
A
It
seems
way
higher
than
I
would
have
ever
guessed,
but
that's
that's
great
and
then
75
of
those
in
production,
which
again,
maybe
I'm
just
working
with
folks,
who
aren't
quite
as
far
along,
but
that
also
seems
high.
Nonetheless,
the
great
thing
here
is:
we
know
that
kubernetes
is
getting
an
insane
amount
of
adoption.
You
know
it
shows
with
tgik.
We
all
get
excited
to
come
together
and
check
out
the
new
tech.
So,
regardless
of
how
how
flawless
this
infographic
is,
kubernetes
is
popular
and
that's
a
good
thing
for
all
of
us.
A
I
think
what
was
also
interesting
about
this
is
that
they
kind
of
laid
out
what
are
some
of
the
common
ways
that
people
run
cube,
obviously
managed.
Services
are
sorry
managed.
Services
are
kind
of
taking
off
if
you
kind
of
put
them
cumulatively,
but
a
large
portion
of
folks
are
still
on
self-managed
kubernetes,
which
implies
they
are,
you
know,
managing
their
own
control
plane
and
all
that
good
stuff
and
not
using
a
managed
service
like
eks
or
aks.
A
So
that
was
that
was
pretty
interesting
to
me
how
some
of
these
numbers
fell
through
and
then
another
thing
that
I
I
saw,
which
totally
makes
sense,
is
that
security
is
one
of
those
top
concerns
around
container
strategies.
So,
if
you've
ever
seen
a
tgik
with
duffy
before
you've,
probably
seen
it
and
actually
the
one
he
did
with
ian
as
well.
A
Not
too
long
ago,
you've
seen
all
the
kind
of
sharp
edges
that
can
happen
in
a
vanilla,
kubernetes
cluster
and
how
kubernetes
gives
us
the
mechanisms
right
to
turn
the
knobs
and
make
it
secure
and
add
defense
and
depth
at
different
layers.
But
it
is
definitely
on
us
to
make
sure
those
knobs
are
turned
in
the
right
direction
and
actually
you
know
helping
facilitate
what
we
need
so
pretty
pretty
interesting
there
all
right.
A
So
just
taking
another
look
at
chat
to
see
who
else
we
have
joining
us,
hey,
walid
great,
to
have
you,
as
always,
very
cool,
ymo
yumo
ottawa
great
to
have
you
back
as
always:
shahik
hello,
yeah,
paul
infographics,
never
lie
yeah
100
of
people
run
kubernetes
in
production.
That
would
be.
That
would
be
a
cool
goal,
we'll
see
how
it
goes
all
right,
good
deal,
so
last
news
item
that
we've
got
is
the
cloud
foundry
summit
has
been
scheduled,
I'm
guessing
this
is
a
virtual
event.
Yeah,
it's
got
oh
virtual.
A
It
says
it
right
there,
but
for
those
who
maybe
aren't
as
familiar
with
cloud
foundry
cloud
foundry
is
a
project
that
has
kind
of,
I
think,
ridden
side
by
side
with
cube
over
the
years
and
and
perhaps
has
been
a
bit
confusing
for
folks
like
a
lot
of
people.
Think
of
these,
as
as
kind
of
competitors
and
in
some
ways
you
can
think
about
it.
That
way,
but
cloud
foundry
really
brings
like
a
kind
of
an
application
platform
where
something
like
kubernetes
is
a
bit
more
of
an
implementation
detail.
A
It's
not
necessarily
something
that
folks
are
interacting
with
directly
as
much
all
that
aside,
the
cloud
foundry
summit
has
some
talks
that
relate
to
the
cloud
native
landscape,
kubernetes
stuff,
there's
even
a
lot
of
work
with
cloud
foundry
going
on
around
re-platforming
it
on
top
of
kubernetes.
So
again,
since
cube
is
more
of
an
implementation
detail
for
the
project.
There's
talk
is
about
moving
it
on
to
that.
A
You
can
see
stuff
about
prometheus,
and
you
know,
as
this
project
deepens
and
cube
deepens,
I
think
we're
going
to
see
more
and
more
overlap
between
what
we
talk
about
on
on
cloud
foundry
and
what
we
talk
about
on
cube.
So,
if
you
want
to
check
out
these
talks
feel
free
to
to
take
a
look
at
the
this
cloud.
Foundry
europe
schedule
pretty
cool
stuff,
all
right
and
walid.
No,
no!
No
news
about
the
the
new
forester
wave,
multi-cloud
container
development
platform.
A
Infographic
that
I'm
sure
will
be
will
be
coming
soon.
Don't
don't
have
anything
in
this
episode
at
least
about
it,
all
right,
good
good,
so
that's
it
for
the
news.
I
think
we
had
a
bit
of
a
light
news
week
this
week
at
least
things
that
we
were
aware
of
so
with
that,
let's
go
ahead.
Yeah
if
it's
out
walid
feel
free
to
throw
a
link
in
the
hackmd
that'd,
be
awesome,
let's
the
more
infographics
the
better
right,
so
yeah
throw
it
throw
a
link
in
there
while
eat.
A
A
So
what
are
what
are
name
spaces
in
kubernetes
right,
so
this
is
one
of
the
biggest
things
that
I
think
a
lot
of
us
first
get
introduced
into
when
we
start
with
kubernetes,
and
that
is
just
the
concept
of
a
namespace
right.
So
we
have
a
namespace.
We
know
that
there's
a
couple
namespaces
by
default
that
we're
super
used
to
right.
One
of
those
namespaces
is
cubesystem
namespace,
cubesystem
right
where
we
expect
well.
A
So,
as
we
kind
of
think
about
this
evolution
and
as
our
clusters
gain
more
and
more
adoption
right,
we
end
up
with
all
these
namespaces
now
real,
quick.
Everyone
in
chat
help
help
me
out
here.
What
are
the
common
things
that
you
all
deploy
to
namespaces
right?
What
are
what
are
the
common
things
that
you'll
put
in
a
namespace
to
like
manage
access
or
set
up
how
network
traffic
could
work
and
all
that
kind
of
stuff?
What
are
some
of
the
common
apis
or
objects
in
kubernetes?
A
A
We
throw
these
into
namespaces
right
and
there's
a
ton
in
here,
yep,
okay,
app
per
namespace
right.
Everything
related
to
the
app
so
like
secrets
and
stuff
like
that
tim
said,
network
policy.
Exactly
so
we
do
network
policy
in
here,
yep
network
policy
services,
add-ons
ingress,
yep
ingress
is
another
super
common
one
that
we
throw
inside
of
here.
What
about
managing
what
people
can
access
like?
What
what
objects
they
can
access
and
whether
they
can
edit
those
objects?
A
Yeah,
our
back
exactly
our
back
is
a
huge
one
that
we're
constantly
putting
into
putting
into
these
names
and
specifically
with
our
back
right.
We've
got
things
like:
we've
got
things
like
roll
bindings,
all
right,
so
we've
got
actually.
Let
me
just
copy
these
it'll
be
a
little
bit
easier.
We've
got
roll
bindings
and
we've
got
rolls
that
we
put
in
here
as
well,
and
these
are
all
namespace
scoped
objects
that
we
oftentimes
put
in
here.
So
roll
bindings
and
we've
got
there's
even
yeah.
A
Exactly
there's
cluster
bindings
we
can
put
in
as
well
walid
said
there
might
be
service
accounts
that
we
put
in
that
are
specific
to
the
namespace.
So
you
get
the
point:
there's
a
bunch
of
objects
right
and
I've
missed
some
of
them
that
you
said,
but
those
are
all
great
examples.
There's
some
objects
that
we
commonly
put
inside
of
our
namespaces
in
cube
and
and
even
if
you
think
about
like
resource
quota
there's
resource
quota,
there's
limit
ranges,
there's
a
bunch
of
other
stuff.
There's
there's
all
these
things
now
what
ends
up
happening.
A
In
my
experience
when
folks
start
getting
deeper
and
deeper
into
kubernetes
and
stuff
gets
adopted,
they
suddenly
realize
that
they
have
these
name
spaces
right
like
they
have
the
team,
a
namespace.
If
you
will
okay
and
all
of
a
sudden,
they
realize
well
we're
not
just
gonna
give
a
team
a
single
namespace
or
for
various
reasons
it
makes
sense
for
team
a
to
maybe
have
many
many
namespaces
right.
So
we
think
about
team.
A
you
know
not
saying
that
this
is
how
you
should
lay
out
your
names,
your
namespaces.
A
Now,
when
you
think
about
these
things
right,
when
you
think
about
these
things,
you
have
a
lot
of
them
that
are
that
are
namespace
scoped
that
you're
going
to
actually
they're
going
to
actually
want
to
have
in
kind
of
the
sub
name
spaces
almost
as
like
a
rule
of
ownership.
If
you
will
so
think
about
some
of
these
common
ones,
I'll
get
rid
of
some
that
might
not
make
too
much
sense
initially
and
I'll.
Stick
to
only
namespace
scope,
stuff
here,
so
resource
quota
network
policy
role,
bindings,
maybe
roles
service
accounts
could
make
sense.
A
You
probably
don't
want
these
to
drift
significantly
right.
So
if
you
have
network
policy
that
is
kind
of
scoped
between
the
relationship
here,
you
probably
want
to
make
sure
that
you
don't
necessarily
have
that
kind
of
upper-level
network
policy
right
kind
of,
like
your
baseline
network
policy,
to
be
mutated
individually
in
some
of
these
team
name
spaces.
Now
you
might
want
to
add
more
network
policy.
Again,
you
might
want
t
specific
namespaces
to
be
able
to.
You
know
turn
some
knobs,
but
there's
a
decent
chance.
A
You're
gonna
want
to
have
you
know
some
kind
of
consistency
in
these
resources
that
we're
deploying
right
now,
historically,
because
the
notion
of
a
hierarchical
namespace,
which
I
think
adrian
said
higher
up,
he
loves
hearing
people
say
that
word
right.
It's
it's.
Definitely
not
the
easiest
for
me
to
say
that
without
these
hierarchical
name,
spaces
or
the
concept
of
them,
we've
done
a
lot
of
different
things
to
work
around
this
problem.
A
One
of
the
most
common
that
I
have
seen
is
the
idea
of
building
some
type
of
a
namespace
creator,
type
operator
or
controller.
So
let's
call
this
like
the
namespace
creator,
okay,
creator
yeah.
So
the
idea
with
this
pattern
of
something
like
a
namespace
creator,
is
that,
rather
than
rather
than
working
with
the
namespace
object
itself,
folks
will
come
in
here
and
they'll
interact
with
the
namespace
creator
right
so
they'll
give
some
type
of
you
know.
Crd,
let's
say
the
crd
says
something
like
type
namespace,
our
namespace
right.
A
A
This
will
then
oftentimes
do
all
the
things
to
kind
of
put
in
this
case,
it's
more
like
defaults,
if
that
makes
sense
to
basically
translate
this
under
the
hood
to
something
where
we're
actually
creating
of
type
namespace
and
along
with
the
namespace
that
we're
creating
we're,
also
injecting
some
type
of
default
right.
We're
injecting
things
like
the
resource
quota
resource
quota,
okay,
we're
injecting
things
like
a
a
set
of
default
network
policies,
perhaps
so
network
policy
right
and
then,
of
course,
our
r
back
and
all
that
good
stuff.
A
The
first
thing
is
that
we
still
don't
have
like
a
sense
of
ownership
per
se,
so
we're
not
necessarily
solving
that
exact
problem.
Yet
another
thing
is
that,
unless
the
namespace
creator
has
the
logic
implemented,
it
might
not
actually
help
us
with
our
skewing
of
things
over
time,
because
if
these
are
defaults
that
get
injected
at
the
time
when
a
new
namespace
is
created.
A
If
mutation
happens
at
the
network
policy
level,
when
it
shouldn't
there's
no
way
to
say
for
sure
that
it
will
stay
or
be
reconciled
to
be
back
in
line
with
the
default,
we
started
with
right,
so
they're
they're,
quite
different
paradigms
like
the
notion
of
hnc,
in
my
mind,
at
least
in
the
notion
of
a
namespace
creator,
but
this
is
just
one
of
those
patterns
that
we've
kind
of
used
to
solve
some
of
these
common
things,
but
in
short
and
then
we'll
get
into
hnc
and
check
it
out.
In
short,
what
we're?
A
A
We
can
have
team
a
data
okay
and
under
this
there
will
be
some
amount
of
hierarchy
and
will
actually
be
able
to
propagate
objects
between
these
different
things
based
on
the
relationship,
so
we'll
say,
front
end
here:
okay,
so
that's
what
I'm
really
hoping
to
explore
today
and
sort
of
see
how
this,
how
this
works,
all
right,
steve
wade,
glad
to
have
you
steve
thanks!
So
much
for
joining
all
right.
A
Cool!
Welcome!
Welcome,
okay,
just
checking
chat
out,
okay,
good
good,
all
right!
So
let's
get
a
little
bit
into
this
idea
of
this
idea
of
hierarchical
namespaces
and
see
if
we
can
get
it
deployed,
see
if
we
can
get
it
running
all
that
good
stuff.
So
what
do
we
have
to
start
off
with
today?
Well,
we
have
got
a
cluster
provisioned
by
the
lovely
cluster
api,
shout
out
cluster
api
team,
and
it
has
just
some
pretty
typical
stuff.
Let
me
make
sure
you
see
in
my
screen:
here's
the
cluster.
A
It's
got
the
vsphere
csi
in
it
because
this
one's
running
on
vsphere,
but
if
it
was
aws
same
story,
cube
proxy
calico,
core
dns,
pretty
vanilla
cluster.
I
haven't
deployed
much
in
it
and
in
this
exercise,
we're
going
to
try
to
make
some
amount
of
hierarchy
here
so
hoping
that
we
can
make
this
work
all
right.
Oh
I'm
glad
you
two
like
the
like
the
diagrams
and
after
the
episodes
I'll
be
sure
to
upload
the
diagrams
to
to
github
as
well.
A
I
know
I
know
they're,
not
the
most
professional
looking
diagrams,
but
at
least
we
can
kind
of
visualize
stuff
so
I'll,
be
sure
to
I'll
be
sure
to
upload
those,
no
problem.
Okay,
so
hnc
there
are
two
links
in
the
episode.
Show
notes
if
you
haven't
checked
them
out.
One
is
a
great
blog.
Is
this
blog
written
by
you
by
the
way,
adrian
yep
written
by
adrian
who's
in
chat
today
talking
a
bit
about
the
introduction
of
hierarchical
namespaces?
A
I'd
bet
adrian
talks
about
some
of
the
things
that
we
have
covered
as
far
as
concepts.
Here,
I've
done
a
quick
scan
of
some
of
it,
but
it
does
talk.
A
bit
about
the
idea
of
policy
inheritance
right,
the
notion
of
having
child
and
parent
name
spaces,
and
then
this
idea
of
delegation
that
we
can
set
up-
and
these
are
all
good
things
that
we'll
test
out
today
now
the
one
or-
I
guess,
the
two
things
that
hnc
comes
with
right.
A
The
two
things
we
know
about
is
that
to
facilitate
this
model,
hnc
is
going
to
come
with
two
things.
One
of
them
is
going
to
run
in
cluster,
which
going
forward
to
not
say
the
word
hierarchy,
I'm
probably
going
to
say,
hn
a
bunch
hnc
controller,
which
I
guess
c
is
part
of
the
controller,
so
hnc
controller
right.
So
this
is
the
thing
that's
going
to
run
in
cluster
to
hopefully
facilitate
this.
This
type
of
this
type
of
stuff-
we're
talking
about
here
now,
what's
really
cool
about
hnc
or
hierarchical
name,
spaces
hn!
A
Is
that
there's
also
the
the
cube
cuddle
plugin?
So
we
can
run
cube,
cuddle
hns
and
do
a
lot
of
the
things
to
make
these
hierarchical
namespaces
exist
and
get
the
output
and
see
their
relationships
and
all
that
good
stuff
hnc
is
pronounced.
Hunk.
I,
like
it
all
right,
hunk
going
forward,
we'll
see
if
adrian
approves
so
the
the
hns
plug-in
for
cube
cuddle
is
going
to
give
us
a
lot
of
the
conventions,
and
I'm
sure
I
mean
adrian
can
correct
me
if
I'm
wrong.
A
I
see
no
reason
why
we
couldn't
just
go
in
and
like
do
all
this
through
crds
and
and
manually
hook,
things
up
and
wire
them
up,
but
I
bet
that
the
plugin
is
going
to
make
a
lot
of
things
convenient
for
us
as
we
dive
right
in.
So
if
you
want
to
check
out
the
blog
post
by
adrian
be
sure
to
check
it
out,
the
github
link
is
also
here
and
that's
where
we're
going
to
start
today.
So
let's
get
right
into
the
github
page,
so
I'm
going
to
shoot
right
over
to
releases.
A
Let's
see
if
I
can
find
releases,
I
swear
since
github
changed
up
their
ui.
I
have
the
hardest
freaking
time,
finding
anything
inside
of
github.
Do
you
all
have
the
same
experience
or
is
it
just
me?
I
feel
like
every
single
time
I
go
to
github.
Let
me
see
I
have
the
releases
bookmarked
over
here.
I'll
see
if
I
can
bring
them
up
real,
quick
hnc.
Oh
you
know
why
I'm
not
saying
releases
it's
cause,
I'm
not
on
the
main
page,
come
on
josh
all
right.
A
Here's
the
releases
see
I'm
yelling
at
github
and
it's
user
error
all
right,
hnc,
so
hnc
has
the
cluster
installation
so
we'll
check
that
out
for
sure,
and
then
this
looks
like
the
cube,
cuddle,
plugin,
okay,
yeah,
it
looks
great,
let's
try
it
so
we'll
start
off
with
the
let's
start
off
with
the
controller
and
here's.
What
we'll
do
everyone
in
normal
tgik
fashion?
Let's
go
ahead,
I
downloaded
the
code
repo
for
hnc
before
this
and
I
made
a
repo
called
or
a
folder
called
manifest.
A
So
let's
go
ahead
and
grab
some
of
these
things
and
look
at
them
before
we
apply
just
to
get
a
sense
for
what
exactly
we're
grabbing
here.
So
hnc
version
manager
looking
good.
So,
let's
w
get
this
thing
there
we
go
all
right,
lovely,
so
we've
got
the
yaml
there
and
I'll.
Tell
you
what,
since
we're
still
here
and
I'll,
forget
and
throw
us
off
later,
let's
go
ahead
and
get
the
plug-in
started
too.
So
I
think
I've
still
got
the
version
environment
variable
set,
yeah
we're
good
there.
Hnc
platform
is
definitely
linux.
A
Amd64,
I'm
keeping
the
the
the
linux
on
tgik
train
alive.
Now
that
duffy
has
now
that
we've
lost
a
linux
user
with
with
duffy.
So,
let's
see
here,
linux
amd64
will
curl
in
that
hns,
real,
quick,
all
right
good
deal,
so
we've
got
that
this
will
put
it
there.
You
know,
let
me
switch
to
temp
real
quick
and
just
do
that
now.
A
A
A
All
right,
yeah,
wsl
2,
would
be
fair
too,
that
I
I'm
totally
with
you.
In
fact,
I
was
at
a
that
meetup
I
was
at.
I
guess
actually
was
probably
because
it
was
microsoft
people,
but
everyone
was
using
wsl2
to
give
their
demonstrations.
I
thought
it
was
pretty
freaking
cool.
It's
pretty
awesome
how
much
stuff
microsoft
is
doing
with
with
wsl.
A
A
All
right,
oh
and
adrian
said
the
crew
integration
for
the
plug-in
is
coming
soon.
That
will
be
very
cool
adrian
prevent
jokers
like
me,
from
messing
up
manually,
putting
it
in
our
path.
So
I
I
appreciate
that.
Oh
no
duff
you're
watching
this
on
a
mac
have
we
already
lost
you.
Have
we
already
lost
our
our
linux
user
duffy?
I
was
joking
with
duffy,
though
I
think
he
should
bring
a
tiling
window
manager
to
to
mac
operating
systems.
That'd
be
pretty
cool.
I3
is
already
branded
like
an
apple
product.
A
It's
got
the
I
in
front
of
it
so
that
could
work
out
right.
Okay,
so
soon
is
days.
Not
weeks
sounds
good.
All
right,
yeah
steve,
says
i3
for
mac.
Please
all
right!
We
have
got
the
plugin
installed,
let's
see
if
we
can
make
this
controller
thingy
work.
So,
like
I'd
mentioned,
I
have
a
manifest
directory.
I
put
some
resources
in
here
that
I
knew
were
namespace
scope.
That
we'd
probably
want
to
look
at.
Let's
look
at
hnc
manager
and
see
what
we
got
going
on
here.
So
get
rid
of
structure.
A
All
right
so
looks
like
we're
going
to
be
deploying
a
namespace.
That
would
make
sense
right
and
then
we've
got
a
couple
crds
here
we've
got
a
hierarchy,
configuration
crd,
okay,
we'll
explore
how
that
works.
I
could
read
the
description
to
you,
but
let's
just
let's
note
that
it's
there
we've
got
an
hnc
configuration
okay,
interesting,
so
we'll
have
to
check
these
two
out.
We've
got
a
hierarchy,
configuration
and
then
an
hnc
remember
the
c
should
or
sorry
sorry
paul,
hunk
controller.
This
is
this.
A
A
Okay,
anything
else,
interesting,
cluster
role,
role,
binding
cluster
role,
binding
cluster
binding
service,
all
normal
stuff.
Here's
a
deployment
okay.
So
this
will
be
our
hnc
con,
our
hnc
controller
manager.
The
c
stands
for
controller
right,
so
it's
the
hnc
controller,
the
controller
controller
manager.
Maybe-
or
am
I
getting
that
wrong?
Hnc
controller
manager-
looks
good,
starts
up.
Oh,
it's
got
a
web
server
port,
so
it
maybe
maybe
hnc
is
also
setting
up
a
mutating
or
validating
web
hook
of
sorts.
We'll
have
to
check
that
out.
A
So
perhaps
the
controller,
here's
here's
our
answer.
It
looks
like
it's
linking
into
a
validating
web
hook,
config.
So
something
on
the
api
server
level
is
going
to
call
out
to
hnc
to
do
some
type
of
validation,
we'll
see
if
we
can
figure
out
how
that
works
today
as
well
and
that's
it
so.
The
key
things
we've
got
here
are
like
most
controllers
or
operators.
A
All
right
and
yes,
cube
builder
whoo.
So
this
thing's
built
on
cue
builder,
pretty
freaking
cool.
We
love,
we
love
the
q
builder
project
and
controller
runtime
is
just
becoming
more
and
more
pop
powerful
with
all
of
the
stuff
that
the
operator
framework
has
been
bringing
into
cube
builder
and
controller
runtime.
So
that's
that's,
really
cool
controller
runtime
all
the
way,
oh
yeah,
good
stuff.
A
All
right,
mahmood!
Welcome,
thanks
for
saying,
hey,
welcome
to
tgik
all
right
all
right!
I'm
psyched
everyone!
Let's
get
this
thing
deployed
and
see
if
we
can
make
it
work,
so
we're
going
in
and
we're
going
to
get
back
to
the
the
folder
I
was
in.
Let's
see
if
we
can
find
that
real
quick.
It
looks
like
it's.
A
This
thing
right
here
we'll
get
that
we'll
cd
over
there
and
we're
back
in
business
I'll
actually
go
out
one
directory,
because
I
want
to
look
at
some
of
the
code
too,
as
we
dive
in
okay,
cube,
cuddle
apply
and
we
will
apply
as
always
what
the
heck
did.
I
name
the
thing
hncmanager.yaml,
which
might
have
been
what
it
was
already
called:
hnc,
oh
josh,
hnc,
manager.yaml
and
I'll.
Tell
you
what
we'll
also
just
open
up
a
quick
watch,
cube
cuddle,
get
pods
for
the
namespace
and
the
namespace
was
hnc
system.
A
A
A
Steve
is
a
get
oopser.
I
love
it
all
right
cool,
so
it's
deployed
pods
seems
to
be
up
and
running
now,
let's
see
what
exactly
we
got
going
on
the
first
thing
I
usually
like
to
do.
I
know
we
already
checked
it
out
in
the
yaml
file,
but
let's
go
ahead
and
just
check
out
the
crds.
We've
got
okay,
so
the
new
crds
that
I
can
see
from
here
we've
got
crds
for
hierarchy.
Configuration
seems
pretty
reasonable.
A
We've
got
a
crd
for
the
hnc
configurations,
which
I
think
is
the
controller
configuration
and
then
we've
got
those
sub
namespace
anchors.
We
talked
about
as
well,
so
I
think
we've
got
our
crds
in
place
and
I
think
we're
pretty
much
ready
to
make
a
namespace.
Now
I
guess
you
know
one
thing:
we
should
talk
about
real
quick
that,
maybe
maybe
wasn't
super
obvious,
but
I'm
sure
I'm
sure
you
all
grok
and
I'm
just
gonna
call
it
out.
You
saw
me
deploy
stuff
to
kubernetes
right.
A
So
one
of
the
key
things
to
note
with
this
project
is
that
it
is
what
I
would
refer
to
as
an
out
of
tree
project
with
core
kubernetes.
So
all
the
things
we're
about
to
do
don't
expect
yourself
to
go
into
a
vanilla,
kubernetes
cluster
tomorrow
and
start
doing
all
these
things
the
project
and
we
had
a
bit
of
a
twitter
convo
about
it.
The
project
is
something
that
is
able
to
be
deployed,
as,
as
we
saw
as
a
controller
and
a
plug-in,
and
over
time.
A
This
is
what's
great
about
these
kind
of
sigs
and
and
what
we
can
do
with
incubation
over
time.
We
can
use
this
as
something
that's,
not
in
the
core
code
base,
but
over
time,
based
on
usage
based
on
features
based
on
feedback,
we
can
make
a
more
informed
decision
as
to
whether
it
should
exist
in
core
kubernetes.
Now,
I'm
not
implying
it
will,
or
it
won't.
A
So,
let's
see
if
we
can
figure
this
thing
out,
all
right
so
and
adrian
said
they
work
back
to
115.
all
right
good
deal.
So
if
you
have
a
115
plus,
you
should
be
able
to
deploy
this
thing
all
right,
so
cube,
cuddle,
get
hns
or
sorry
not
get
h
and
s
cube,
cuddle
h
s
make
the
text
a
little
more
readable.
A
Let's,
let's
bring
up
the
logs
of
the
controller
down
here
just
so
we
can
watch
what
it's
got
going
on,
so
cube
cuddle
get
pods
for
the
name,
space,
hnc
system,
here's
the
hnc
controller
manager,
let's
let's
watch
the
logs
here
and
make
sure
cube
cuddle
logs
hnc
controller
for
the
namespace
hnc
system,
and
this
has
two
containers
in
it.
So
let's
specify
the
manager
okay.
So
what
do
we
got
going
on
here?
Updating
hnc
config
for
namespace
is
reconciled
count
four,
all
right.
So,
let's
see
actually,
then
so.
A
If
we
do
a
cube
cuddle
before
we
make
that
sub
name
space,
if
we
do
a
cube,
cuddle,
get
hnc
configurations
for
all
name
spaces
or
sorry.
This
is
a
global
object,
right,
yeah,
okay,
so
hnc
configuration
is
config.
Let's
see
what
it's
got
inside
of
it
right
now,
so
we've
got
a
config
thing,
called
hnc
configuration
okay,
we'll
go
ahead
and
put
this
into
into
vim
real,
quick,
okay
file
type
is
yellow
nope.
I
don't
remember
what
my
ft,
I
think
it's
set
file
type.
Isn't
it
set
file
type
yaml?
Is
that
it?
No?
A
I
can't
remember.
Okay,
anyways
hnc
configuration
spec
roll
binding
okay.
So
oh
this
is
good.
Okay,
cool
cool,
so
it
looks
like
the
controller's
got
a
setting
on
it
again.
This
is
the
hnc
controller
config.
That
is
letting
us
choose
which
objects
we're
going
to
want
to
propagate
based
on
the
mode
propagate
into
our
children
namespaces.
So
I'm
guessing
here
we'll
see
if
that's
actually
what
happens,
but
this
looks
like
what
this
configuration
is
doing.
As
far
as
I
can
tell
so,
my
expectation
is
once
we
create
our
child
name
space.
A
We
should
see
a
role
binding
propagate
if
we
have
any
role
bindings
in
it
and
we
should
also
see
roles
propagate
if
we've
got
any
roles
in
it.
Oh
there's
an
equal
sign:
there
set
file
type
equals
yaml
nice
thanks
walid.
That's
it
all
right,
so
cool
cool
and
adrian
says
you
can
also
say
cube
cuddle
hns
config
describe
let's
try
that
out
then,
because,
like
we
talked
about
with
that
plug-in,
we
might
not
need
to
necessarily
interact
directly
with
the
crds
unless
we
really
want
to
so
hns
config
describe.
A
Oh,
this
is
beautiful
fantastic,
so
we
can
see
our
synchronized
types
we
can
see.
What's
propagating
and
now
that
we've
looked
at
the
crd,
we
know
what
powers
this
under
the
hood
good
stuff
yeah.
This
is
pretty
cool
all
right.
So
what
do
you
say?
We
make
a
child
name
space
then
so
cube
cuddle,
hns
and
we'll
just
maximize
this
real
quick
cube,
cuddle
hns
create-
and
I'm
just
going
to
see
if
it
yells
at
me
and
gives
me
a
thing
h:
s
create
okay,
call
out
the
parent
name
space.
A
This
will
be
team
a
for
us
and
then
child
is
going
to
be
the
name
of
our
child,
see
if
there's
any
global
flags
that
are
really
important,
doesn't
look
like
it.
Okay,
so
let's
grab
this
okay
and
let's
go
ahead
and
do
that
does
cube
cuddle,
explain
hns
work.
That's
a
good
question
duff.
I
would
think
not
because
it's
a
plug-in
right
I'll,
try
it
in
a
second,
though,
I'm
not
sure.
Okay,
so
cube,
cuddle,
h
and
s
create
our
parent
is
team.
A
and
our
child
is
like.
A
We
talked
about
in
our
diagram
the
team,
a
data
layer
very,
very
important,
namespace.
Okay,
so
let's
create
this
and
we
have
successfully
created
the
child.
Let's
look
at
the
logs
real,
quick
and
see:
oh
no
josh.
What
did
you
do
you
killed
your
session?
No,
don't
worry!
I
can
save
us,
have
no
fear
everybody.
Okay,
so.
A
It's
a
downside
of
having
too
many
keyboard
shortcuts.
You
hit
the
wrong
key
and
something
really
bad
happens,
so
cube
cuddle
gets.
This
will
be
get
namespaces.
Okay.
Here
we
go
so
we've
got
the
hnc
namespace
we've
got
team
a
and
we've
got
team
a
data.
Now
I
guess
the
important
thing
to
note
here
is
that
the
controller
right
is
is
doing
a
lot
of
things
under
the
hood
to
make
this
notion
of
of
of
hierarchy
exist.
A
A
A
Okay,
nothing!
Yet!
But,
as
adrian
said,
we
can
put
some
issues
in
for
this
because
describing
how
this
thing
works
would
be
pretty
freaking
cool,
so
yeah,
I'm
guessing
it's
just
a
matter
of
either
some
metadata
that
we
need
to
put
in
via
cube
builder
or
we
got
to
go
in
and
modify
the
the
crd
definition
itself.
But
hopefully,
q
builder
supports
supports
this
description.
Stuff
for
explain.
I'm
sure
it
does
cool
all
right,
so
adrian
said
check
out,
cube
cuddle
hns
tree,
which
is
probably
going
to
show
us
that
relationship.
A
Let's
see
there,
it
is
okay,
so
while
kubernetes
shows
us
a
flat
name
space
layout,
obviously
the
plugin
can
determine
what
the
actual
relationship
itself
is.
Now.
I
would
think
adrian
that
you
probably
can
make
children
of
children,
and
I
wonder
if
there's
a
limit
to
that,
but
let's
just
let's
just
test
that
theory
super
quick
here.
So
if
we
did
a
quick
now,
of
course
I've
lost
all
my
all
of
my
good
reverse,
so
cube
cuddle
hns
create
there.
It
is
okay
and
we're
gonna.
A
A
Okay,
so
now
we've
got
a
tree
and
I
guess
the
the
trivia
question
of
the
day
is:
how
deep
can
we
go,
which
I
probably
won't
try
that
out
on
this
episode,
but
that
can
be
an
exercise
to
the
to
the
reader.
Adrian
says
I
think
we've
tested
about
100,
so
yeah
and
that's
a
behavior.
They
don't
normally
recommend.
A
I
think
if
you
end
up
with
a
hierarchy
that
has
a
depth
of
a
hundred
in
your
tree,
you
probably
want
to
take
a
second
look
at
what
you're
doing
just
a
hunch,
just
a
hunch,
and
I
would
do
that
recursion
paul.
I
would
do
that
recursion
bomb
paul
if
and
only
if
I
knew
my
cluster
wouldn't
blow
up,
which
I'm
a
little
bit
worried
about.
So
I'm
not
gonna
mess
with
that.
A
Okay,
cool
cool
cool,
all
right,
so
we've
got
this:
let's
go
ahead!
Actually,
let's
delete
a
child.
I
want
to
keep
it
just
one
child
deep
for
this
initial
thing.
So
that's
a
good
question:
do
I
just
delete
the
namespace
from
a
normal
level,
or
is
there
a
delete
command?
Let's
see
here
so
hns
config
create
describe
help
set
tree
okay,
so
I'm
guessing.
I
can
just
delete
it,
and
actually
you
know
what
here's
this
would
be
an
interesting
test.
Everyone!
Well,
let's!
A
Forbidden,
oh
okay,
we're
already
learning
about
how
and
why
the
validating
web
hook
exists.
So
we've
got
two
interaction
points
with
with
hierarchical
name,
spaces
right
and
one
of
those
interaction
points.
That's
not
in
cluster
with
the
controller
is
or
sorry
which
is
not
what
the
plug-in
is
with
just
cube
cuddle.
So
if
we
go
in
and
start
trying
to
screw
with
things
that
the
hierarchical
namespace
has
links
into
it
looks
like
the
validating
web
hook
is
warning
us
and
it
looks
like
it's
got
a
pretty
good
message
here.
A
It's
saying:
please
delete
the
anchor
from
the
parent
namespace
to
delete
the
sub
namespace.
So
I'm
guessing
what
this
is
saying
and
adrian.
If
there's
an
easier
way
to
do
this,
shout
out
for
us,
but
I'm
guessing,
we
need
to
remove
the
parent-child
relationship
and
then
we
need
to
go
in
as
an
extra
step,
perhaps
and
delete
the
namespace
outright.
A
That's
what
I'm
gathering
from
this
error
message.
So,
let's
see
so,
please
delete
the
anchor
from
the
parent,
the
parent
name,
space,
okay,
cube,
cuddle,
delete,
sub
name
space;
okay,
cuddle
delete
the
sub
name;
space
object;
okay,
let's,
let's
look
at
that.
Actually,
real
quick,
so
cube
cuddle
get
sub
name;
space
object;
okay,
so
I'm
guessing
sub
name.
Space
should
exist
in
team,
a
data
maybe
okay.
So
inside
of
team,
a
data
there
is
a
sub
name,
space
object
that
is
team,
a
data
two
all
right.
A
So,
let's,
let's
look
at
that
real,
quick
so
effectively,
just
to
make
sure
we're
all
following
here,
because
we're
like
three
layers
of
inception
deep
at
this
point
right,
we're
looking
inside
of
this
namespace
and
we're
basically
seeing
an
object
that
is
a
sub
namespace
object,
crd
and
that
sub
namespace
object
seems
to
have
I'm
guessing
a
pointer
to
team
a
data
2
right.
So
our
relationship
in
this
case
looks
a
little
something
like
this.
As
far
as
I
can
tell
okay,
so,
let's
see
here
cube
cuddle
get
sub,
namespace
namespace
looks
good.
A
We
will
delete
that
then.
So
if
we
delete
the
sub
namespace
and
that
is
named
team,
a
data2
okay,
so
sub
namespace
deleted
now
it's
it
looks
like
it's
blocking
here,
so
I
guess
what
adrian
was
perhaps
saying
and
what
I'm
observing
is.
I
betcha
that
once
the
ownership
of
the
sub
namespace
is
in
place
or
the
kind
of
the
parent
child,
whenever
you
delete
that
sub
name
space
anchor,
you
are
effectively
releasing,
and
thus
I'm
thinking
deleting
that
lower
level
sub
name
space.
So
to
validate
that
theory.
A
A
A
So
in
terms,
ymos
is
also
in
terms
of
resource
limits.
You
can
say
to
allocate
cpu
and
ram
to
one
namespace.
We
thought
about
hierarchical
resource
quota
yeah.
We
should
talk
about
that
today,
because
that
is
something
that
plagues
my
my
big
clients
a
lot:
the
notion
of
having
kind
of
this
ability
to
set
up
a
higher
level.
You
know
cpu
and
memory
and
then
have
sub
name
spaces
kind
of
borrow
from
that
which
is
a
bit
more
of
an
a
more
advanced
use
case
than
just
propagation
of
objects.
A
So
that
is,
that
is
a
really
really
interesting
thing
and
ibrahim.
You
said:
quota
management
in
hierarchy
is
inevitable.
Yeah
I
mean
it
seems
that
way
like
it
would
be
a
huge
win
if
we
had
mechanisms
to
do
that,
because
I
the
the
glue
and
sticks
that
I've
seen
put
together
in
order
to
in
order
to
achieve
that
type
of
functionality
is
not
usually
the
prettiest
thing,
cool
cool,
all
right.
A
Let's
do
this
thing,
so
we've
got
the
namespaces
in
place.
We
haven't
synced
objects,
though
right,
so
let's
go
ahead
and
do
that
next.
If
we
go
over
to
our
manifest
for
just
a
moment,
we
have
got
net
pal
roll
and
roll
binding.
So
I'm
going
to
start
I'm
going
to
start
at
the
r
back
level
because
remember
we
saw
from
the
hnc
config
that
we're
currently
looking
at
our
back
things
like
roll
bindings
and
rolls
so
the
roll
binding
I've
got.
I
just
pulled
these
before
tgik
off
the
kubernetes
docks.
A
What's
the
content
isn't
as
important
as
like
the
object
itself
propagating
right?
So,
let's
see
if
we
can
deploy
role
binding
in
the
parent
and
if
that
will
then
sink
down
so
again,
I
think
it
would
be
helpful
here
to
bring
up
the
logs
for
hnc
manager,
which
clearly
I've
got
an
old
name
here.
So,
let's
see
cube
cuddle
get
pods,
namespace,
hnc
system,
here's
our
controller
manager,
let's
go
ahead
and
grab
that
so
cube,
cuddle
logs
paste
it
in.
A
We
will
do
c
for
the
manager
container,
not
that
proxy
rbac
container
and,
let's
make
sure
we
know
we're
looking
in
the
hnc
system.
Namespace,
okay
and
let's
follow
it,
lovely,
okay,
so
I'll
bring
this
a
little
bit
smaller.
So
you
all
can
see
a
bit
better.
It
looks
like
we're
at
about
timestamp
1601,
probably
look
at
the
end
of
the
time
stamp,
so
147,
okay.
So
if
we
go
in
and
we
do
a
cube
cuddle
apply
of
the
object
manifold.
A
A
Did
I
have
a
role
binding
file?
Oh,
I
keep
forgetting
I'm
in
manifest
role
binding
there.
It
is
unsupported
version,
unsupported
version,
config,
updater,
okay,
josh,
you
messed
up
your
yaml.
You
had
one
job
you
just
had
to
copy
and
paste
how
the
heck
did
you
mess
that
up?
Okay
before
I
try
to
figure
out
where
I'm
just
going
to
say,
roll
binding,
kubernetes
and
see
what's
wrong
here,
let's
see
roll
binding
roll
binding.
A
There's
a
roll
binding
solve
the
problem
when
you
can
just
copy
and
paste
it
again,
so
we
will
do
that.
We
will
paste
it
in
and
we've
got
a
role,
binding
called
read,
pods.
So
back
here
roll
binding
there
we
go
okay,
so
we've
created
a
roll,
binding
roll,
binding
and
cueing
descendant
objects.
So
if
I
were
to
guess
this
is
probably
in
cueing
the
work
into
like
an
object,
reconciler
type
thing,
so
it
puts
it
in
the
queue
the
reconciler
should
pick
it
up
and
bring
it
downstream
into
the
other
objects.
A
That
seems
okay.
So,
let's
see
what
we
got
here,
if
we
go
in
and
we
do
a
cube,
cuddle
get
namespace
roll.
Oh
you
know
what
I
didn't
do
everyone.
I
didn't
point
it
at
a
namespace.
Did
I
let's
check
real
quick
look
at
that
default.
Probably
won't.
Do
us
a
whole
lot
of
good,
so
I
don't
know
what
the
object
and
cueing
thing
was.
Maybe
it
enqueues
all
objects
and
then
determines
if
it
needs
to
do
work
on
them
to
copy
them.
I
don't
really
know
what
that
log
statement
was.
A
But
let's
you
know
what
just
to
keep
this
dynamic.
Let's
take
namespace
out
and
we'll
go
back
and
do
cube.
Cuddle
apply
the
manifest
role
binding
and
we
need
to
put
this
in
team
a
because
that's
the
one
that
does
have
that
sub
name
space,
so
namespace
will
be
team.
A
okay,
that's
a
lot
more
stuff.
What
do
we
got
going
on
here?
A
Okay,
this
might
be
a
little
tiny
for
y'all,
but
I'm
just
trying
to
see.
What's
going
on,
I
do
have
a
reconciliation,
error
role,
binding
interesting.
The
role
is
not
found,
which
is
cool
because
the
role
doesn't
exist
yet
so
that
kind
of
makes
sense.
But
it's
curious
to
me.
Oh,
it's
actually
check
this
out.
It's
coming
from
controller
runtime.
A
I
wonder
if
there's
something
in
controller
runtime,
that's
checking
for
the
role,
because
I
mean
it
is.
It
is
misconfigured.
I
have
a
role
binding
without
a
role,
but
my
question
would
be:
should
the
controller
care
about
that
or
shouldn't
it
just
naively
copy
over
the
role
binding,
regardless
of
whether
the
role's
there
that's
super
interesting
yeah.
Oh,
it's
not
from
controller
runtime,
okay.
Where
is
it
coming
from
then
adrian
reconciliation
error?
A
Let's
just
we'll
test
this
out
and
we
can
always
put
the
role
in
to
fix
it,
but
I'd
be
curious
to
know
what
exactly
it's
coming
from,
so
cube,
cuddle
get
let's
get
roll
bindings,
real,
quick
from
the
namespace
team,
a
okay,
so
read
pods
the
role
binding,
even
though
the
read
pod
roll
is
not
there.
Yet.
We
know
that
we
know
that
it's
there
and
I'm
guessing
in
team
a
data.
It's
not
going
to
be
there
yet.
A
Okay,
so
adrian
says
that's
just
the
default
error
return
to
hnc
to
the
framework
that
error
is
coming
from
case
itself.
If
you
create
a
role
binding
without
a
roll
by
hand,
I'd
guess
you'd
get
the
same
error.
I
don't
think
so,
because
I
just
created
a
role
binding
by
hand
right
here.
I
kind
of
I
kind
of
wonder
if
it's
got
something
to
do
with
what
controller
runtime
does
when
it
like,
looks
things
up,
because
it
almost
I'm
not
a
controller
runtime
expert.
A
But
when
I
read
this
message
it
looks
like
in
the
reconciliation
project.
It
might
actually
be
trying
to
look
up
the
corresponding
role,
which
is
a
little
bit
curious
to
me.
Nonetheless,
let's
go
ahead
and
see
if
we
can
create
a
role
and
who
knows?
Maybe
this
will
be
a
issue
for
controller
run
time
or
maybe
I'm
just
misunderstanding
control
run
time.
So
let's
go
ahead
and
see
if
we
can
make
a
roll
now,
the
roll
probably
needs
to
line
up.
So
we
know
our
roll
binding
is
read
pods.
A
It's
got
a
roll
ref
to
pod
reader,
okay
to
pod
reader.
So
I
need
to
make
sure
that
this
is
named
pod
reader
and
ironically,
this
role
has
absolutely
nothing
to
do
with
reading
pods.
But
that's
not
the
point
right.
The
point
is
that
the
object
actually
read:
pods
good,
good
roll
looks
good.
Okay.
I
think
this
should
be
fine
and
again
just
ignore
that
our
rules
are
kind
of
silly
for
this.
So
let's
go
back
to
the
terminal
here
all
right,
so
we
will
try
this
again.
A
A
A
A
All
right,
let's
give
it
a
second
here
and
while
we're
doing
that,
let's
look
a
little
bit
at
the
the
project
itself
and
see
what
we
got
going
on.
So
I
downloaded
the
the
source
code
before
we
before
we
started
today
and
it
looked
like
there's
a
couple
reconcilers
that
we've
got
firing
off
in
here.
I'm
thinking
and
I
only
looked
at
the
names,
I'm
thinking
the
object.
Reconciler
is
probably
what
we're
waiting
on.
A
If
I
don't
have
anything
misconfigured-
and
my
guess
is
that
the
object
reconciler
is
probably
what's
going
to
help
us
actually
go
in
and
propagate
these
objects
to
the
sub
name
spaces.
So
object
reconciler,
reconciles
generic
objects.
You
must
create
one
for
each
group
kind.
Okay,
so
I
think
what
they're
doing
here
right
is,
rather
than
the
object
reconciler
being
specific
to
things
like
role,
bindings
or
namespaces,
and
so
on.
It
looks
like
it
takes
things
in
generically.
That's
why
it's
called
object.
A
So
the
notion
here
is
that
we
could
bring
a
network
policy
we
could
bring
in
you
know
any
arbitrary
object.
I
would
think,
unless
there's
ones
that
would
be
limited
to
adrian
and
we
could
configure
the
hnc
controller
so
that
these
objects
could
be
picked
up
and
then
eventually
have
some
type
of
synchronization
happen
when
that
needs
to
occur.
So
if
we
go
back
to
our
terminal,
not
found
stack,
trace.
A
Cube
cuddle,
get,
let's
see,
roll
for
the
namespace.
Oh,
you
know
what
I
think
we
did
everyone.
I
think
we
might
not
have
specified
the
namespace
for
roll.
That
sounds
about
right.
So,
if
I
go
back,
let
me
just
double
check
this
real
quick.
If
I
go
back
here,
I
apply
yeah,
that's
exactly
what
I
did
so
that
would
make
sense
why
we're
not
seeing
any
change.
So,
let's
go
back
to
manifest
and
let's
go
back
to
our
roll
yeah
check
it
out,
so
it
probably
went
right
into
the
default
namespace
all
right.
A
A
Okay,
this
looks
a
lot
better.
We've
got
a
newly
propagated
object.
I
don't
think
I
was
seeing
that
before
so
that
could
be
good.
Let's
see
if
I
come
back
here
and
I
look
for
roles
in
the
namespace
team,
a
data
check
it
out.
We
have
a
pod
reader
now
and
I'd
bet
you.
If
we
check
out
for
role
binding
here,
we've
probably
got
assuming
it's
spelled
right.
A
Findings.
We've
now
got
that
relationship
in
place
for
roll
and
roll
bindings,
pretty
cool.
So
what
do
you
all
think?
That's,
oh
wait
actually
is
role
bindings
in
here
am
I
losing
my
mind,
no
resources
in
the
team,
a
data
namespace.
So
oh
that
was
role
that
came
up
again.
Wasn't
it
so
roll
seemed
to
sink.
I
wonder
if
we're
in
some
type
of
weird
state,
because
the
role
binding
didn't
come
through
because
of
this
error.
A
So
perhaps
now
the
reconciler
is
not
actually
trying
to
redo
the
role
binding
or
when
you
write
controllers
in
kubernetes.
There's
this
this
parameter.
I
can
never
remember
the
name.
It's
like
sync
all
or
something
like
that
where
you
can
like
re-cue
all
the
stuff
and
do
and
do
work
on
it
again.
It
might
not
have
triggered
that.
Quite
yet.
A
This
is
great
okay,
so
we've
got
some
additional
stuff
could
not
write
roles
because
pod
reader
was
not
found.
Okay,
so
one
of
the
things
it
looks
like
we
can
do
here
is
actually
use
that
hns
plugin
to
more
easily
understand
what
conditions
fired
off
on
the
name
space
and
what
we've
got
going
on
here
affected
by
this
condition
is
team
a
read:
pods,
that's
some
pretty
good
output,
so
we
can
kind
of
understand.
What's
going
on
now,
I'm
thinking
this
condition
is
probably
what
is
causing
our
failure
to
not
see
a
roll
binding.
A
A
So
let's
delete
that
great
so
that
got
deleted.
That
was
the
one
that
again
might
still
not
get
re-cued,
because
there
was
some
type
of
error
and
let's
go
ahead
and
apply
this
now
so
we've
got
that
into
team.
A
we've
got
roll
binding,
yaml
looks
good
all
right.
So
now
the
role
binding
was
created.
Let's
see
if
we
blow
up
in
the
logs,
I'm
not
seeing
it
blow
up
in
the
logs.
A
A
What
do
you
think
everyone
seems
to
be
working,
so
it
seems
like-
and
I
don't
know
if
this
is
configurable
adrian
or
if
you
know
offhand,
but
I'm
guessing
if
an
object
fails
like
on
from
an
upstream
library
like,
even
if
it's
cube
core,
but
let's
say
it's
controller
runtime.
I
wonder
when
the
objects
get
re-cued
to
potentially
be
re-evaluated
for
whether
they
should
be
copied.
You
know,
or
if
it
like,
has
a
circuit,
breaker
or
something
where
it's
like
backed
off,
and
we
just
had
to
wait
longer.
A
A
A
So
network
policy
is
what
I
had
mentioned
earlier.
I
think
we're
gonna
roll
with
network
policy
network
policy.
This
is
a
really
common
one
right
where
you
know.
Maybe
in
your
organization,
you
do
like
a
a
deny
all
style
flow
where
by
default,
you
basically
deny
all
traffic
across
all
name
spaces
and
so
on.
A
Now,
perhaps
you
want
to
use
this
hnc
model
to
make
sure
the
rules
that
need
to
be
there
for,
for
the
child
name,
spaces
have
the
deny
all
set
up
in
place
which,
by
default
with
most
cni
plug-ins
how
this
works
is.
If
you
have
no
network
policy
in
place
at
all
everything's
open
to
the
world,
the
second,
you
apply
a
network
policy
that
behavior
sort
of
inverts.
In
that
only
things
you
explicitly
allow
in
your
network
policy
now
receive
and
send
traffic
everything
else
becomes
blocked
by
default.
A
So
that's
kind
of
one
of
the
key
things
or
maybe
again,
there's
just
a
set
of
default
network
rules
like
you
want
to
make
sure
everyone
can
egress
to
dns.
You
want
to
make
sure
folks
can
receive
traffic
on
port,
80
and
443,
but
if
they
need
to
go
in
and-
and
you
know,
set
up,
you
know
access
to
eight
four,
four:
three,
that's
an
extra
step
that
folks
need
to
go
through
and
be
able
to
put
together.
A
A
So
we'll
do
this
in
the
manifest
network
policy,
and
we
will
do
this
in
namespace
team
a
again
okay,
so
network
policy
got
added
to
team
a
and
if
we
come
over
and
get
netpal
from
the
namespace
team,
a
it's
there,
but
in
team
data
it's
not
there,
which
is
exactly
what
I
would
expect
based
on.
What
we
saw
about
that
configuration
and
also
what
adrian
had
mentioned
in
chat
this
idea,
that
by
default
we're
just
grabbing
role,
bindings
and
roles,
so
the
thought
process,
I
would
think
is
we
can
modify
that
crd.
A
There
might
even
be
a
way
to
do
it
in
the
controller.
But
let's
just
let's
look
at
the
crd
one
more
time,
so
we'll
do
cube
cuddle,
get
hnc
configurations
and,
I
think
was
just
called
config
right.
In
fact,
I'll
do
what
we
probably
should
never
do
I'll
edit
it
and
we'll
come
in
here
for
hnc,
and
we
know
that
this
has
the
role
and
mode
that
you
can
put
in
here
right,
so
we've
got
roll
binding
and
then
the
mode.
So
let's
go
ahead
and
set
this
up
real
fast.
A
A
Now,
what's
interesting
is
there's
also
this
idea
of
different
modes,
so
what
we
could
likely
do-
and
this
might
be
one
of
those
things
that
we
could
either
describe
or
explain
when
it
gets
added.
But
let's
let's
look
since
we
have
the
code
base
here.
Let's
look
at
the
api
api
v1
alpha,
2,
hnc,
config,
yep
and
inside
of
here
we've
got
it's
right
in
front
of
us
synchronization
mode,
so
we've
got
propagate,
which
is
going
to
propagate
ancestors
to
descendants
and
delete
obsolete
descendants.
Okay,
that's
probably
what
we're
going
to
want.
A
99
of
the
time
ignore,
looks
like
it's
a
no
op.
It
literally
does
nothing
and
then
remove
would
remove
all
propagated
copies
interesting!
Oh
I'm
using
v1
alpha
one!
Well,
let
me
know
if
let
me
know
if
these
things
are
different,
but
it
looks
like
based
on
your
your
chat
message.
They're
the
same
so
we've
got
propagate
we've
got
ignore.
We've
got
remove
cool
that
all
makes
sense
all
right,
they're,
lowercase,
constants.
Now,
okay,
big
change,
but
at
least
the
functionality
is
the
same
good
deal
all
right.
A
So
let's
go
ahead
and
keep
this
as
propagate.
That
seems
to
make
sense.
Now.
Here's
what'll
be
interesting.
Everyone
we're
gonna,
apply
this
in.
What
do
you
think
will
happen?
Will
the
controller
suddenly
realize
that
it
now
cares
about
network
policy
and
pick
up
the
existing
network
policy
objects
and
propagate
them
down
to
the
children?
A
A
This
could
be
like
a
bit
of
a
timed
thing
like
this
could
be
something
where
we
don't
see:
network
policy
propagate
immediately,
because
the
controller
run
time
is
waiting
for
some
amount
of
time
to
do,
and
I
think
it
actually
might
be
called
resync
a
resync
of
all
the
objects
we'll
see
so
mona.
You
think
it
won't.
That
didn't
happen
with
role
bindings
great
point
now:
the
one
delta.
Here,
though
right,
is
that
role
bindings
hit
an
error.
A
A
All
right
and
adrian
said:
if
it's
not
it's
a
bug,
okay!
Well,
good
news
is,
I
don't
think,
there's
a
bug,
because
network
policy
is
officially
propagating
down
to
this
pretty
cool
stuff.
All
right!
This
is
awesome.
These
are
some
of
the
key
stuff
that
I
really
wanted
to
test
out
with
y'all.
Here's.
Here's
actually
something
that's
interesting
and
I
saw
a
blog
post
about
this
somewhere
and
I
didn't,
I
unfortunately
didn't
read
it
a
ton,
but
I'm
kind
of
curious.
A
If
this
will
get
us
in
trouble
or
if
this
will
work
well,
one
one
last
little
science
experiment,
I
think,
could
be
really
interesting
to
check
out
so
now
we
know
that
we
can
set
up
a
relationship
of,
I
guess
I'll
call
it
a
parent
name
space,
and
then
we've
got
this
way
to
link
that
via
this
idea
of
a
sub
namespace.
Let's,
let's
make
sure
this
is
like
a
different
border,
so
it's
super
clear
what
we're
calling
out
here?
Let's,
let's
do
this
real,
quick,
okay
cool.
So
this
is
the
sub
name
space.
A
Now,
here's
actually
a
question
for
you
adrian
this
idea
of
a
sub
name
space.
The
the
actual
resource
is
this.
Is
this
what
the
anchor
is?
Is
it
the
same
concept
here
right
so
team
a
should
have
a
sub
namespace
that
points
to
team
team,
a
data
in
this
case?
So
let's
just
let's
just
verify
that
real
quick.
So
we
do
cube
cuddle.
We
do
get
we
get
sub.
Oh,
it's
sub
name,
space
anchor!
It's
right!
A
A
Now,
if
we
go
back
here,
the
the
idea
that
I'm
kind
of
interested
in
testing
out
with
y'all
is
what,
if
we
had
team
b-
and
you
know
this
probably
isn't
something
we
do
too
commonly,
but
I'm
just
mostly
curious
about
how
it
would
work.
So
if
we
did
team
b
and
we
wanted
to
move
team,
a
underneath
team
b,
what
would
happen
here
right?
I'm
curious
on
so
many
levels
like
what.
A
Could
we
do
that
and
would
all
the
objects
like
reconcile
and
de-propagate
and
re-propagate
accordingly?
So
that
would
be
a
really
interesting
test.
Choco,
you
said,
delete
the
synced
resource.
Oh
good
point:
we
should
definitely
delete
the
synced
resource.
That's
a
great
that's
a
great
idea!
So
I
come
in
because
I
have
more
access
than
I
than
I
than
I
had
before,
or
should
maybe
have
so
we
do
get
get
network
policy
right
on
the
namespace
team,
a
data
all
right.
We
know
that
that's
there.
A
So
let's
run
that
again
in
a
watch
format
up
here,
so
we'll
do
watch
boom
all
right
now.
What
happens
if
we
delete
this
thing?
How
quick
will
this
work,
because
again,
the
parent,
I
would
think,
should
still
be
able
to
come
into
play
and
be
like
no,
the
the
network
policy's
there
and,
and
frankly,
I
probably
shouldn't
even
have
access
to
delete
this
network
policy.
But,
let's
assume
I
do
for
for
just
science
cube,
cuddle,
delete,
okay,
we'll
delete
the
network
policy
and
we'll
delete
api.
Allow
in
the
namespace.
A
A
A
Okay,
so
there's
your
answer:
choco!
We
aren't
allowed
to
delete
it,
but,
of
course
we
can
delete
it
from
the
parent
right.
I
would
think
that
should
be
allowed,
assuming
we
have
access.
So
if
we
delete
if
we
delete
the
network
policy,
api,
allow
api
allow
from
the
parent,
which
is
team
a
there.
We
go
in
the
top
buffer
here
that
I
have
the
team.
A
data
namespace
network
policy
got
ripped
out
of
team
a
so
it
also
got.
What
should
I
call
it
d
propagated
unpropagated?
A
Maybe
I
should
just
call
it
deleted.
It
got
deleted
from
the
team,
a
data
namespace
just
like
that,
pretty
cool
stuff,
all
right.
So,
let's
see
if
we
can
cut
ties
and
chat.
If
there's,
if
there's
anything
else,
you
want
to
try
out
or
ideas
things
you
want
to
see,
feel
free
to
give
me
some
ideas.
If
you
got
it
yeah,
it's
been,
it's
been
hunked.
I
like
that,
all
right.
A
Let's
try
this
last
thing
unless
any
more
ideas
come
out
of
chat
for
things
to
test,
to
cut
ties
with
team,
a
cube
cuddle
edit
namespace
team,
a
data
oh
and
remove
subnet.
Oh,
this
is
interesting.
Okay.
This
will
be
an
interesting
avenue
for
us
to
check
out.
So
let's
go
ahead
and
look
at
namespace
team,
a
data
here
and
adrian
is
saying
we
should
have
an
annotation.
I'm
guessing.
Is
this
an
annotation
annotation,
no
sub
name
space
of
he
said
so
there
it
is
annotation
there.
A
It
is
sub
namespace
of
team,
a
interesting
okay.
So
now
what
do
we
know
now?
We
know
that
a
sub
namespace
exists,
okay
and
I'm
just
bringing
it
back
here.
We
know
that
at
least
at
least
in
our
current
state.
There
might
be
different
flows
that
exist
here,
but
let's
just
assume
a
sub
name
space
exists
and
then
a
ref
as
well
gets
put
in
the
annotation
of
the
namespace
right.
Let's
make
this
just
a
little
bit
bigger.
My
diagramming
foo
is
getting
getting
bad.
A
You
can
tell
it's
friday
that
says
sub
of
right
in
an
annotation,
and
this
will
say
team
a
essentially.
So
we've
got
these
two
kind
of
links
now
I
think
what
adrian
is
saying
here
is
that
we
can
go
in
and
change
this
annotation
and
then
some
amount
of
reconciliation
will
happen
to
put
us
under
team
b.
Now
I
want
to
make
this
experiment
a
little
bit
more
chaotic.
A
Let's
change
this
to
something
that
doesn't
exist.
So
let's
say
that
we
want
to
be
a
sub
namespace
of
team
z
and
see
what
that
does
so
we'll
go
off
the
rails
a
little
bit
here.
Here's
the
logs
of
the
controller
we'll
see
if
we,
if
we
get
anything
interesting
here
so
boom
boom,
edited
okay.
Now
in
my
massively
sized
text,
is
there
anything
that
works
here
or
or
gives
us
any
clues
here?
A
Let's
go
to
the
top
reconciling
trigger
team,
a
team,
a
data
message,
sub
namespace
annotation
of
namespace
does
not
match
its
parent
updating
okay
instance
on
namespace
server,
overwriting
parent
to
team
z.
So
it
looks
like
it
overwrote
it
there
right
hierarchy,
missing
parent,
okay
check
it
out,
so
we
can
see
here
that
there
is
a
catch,
that
the
parent
is
in
fact
missing.
You
can
see
that
it
wrote
the
condition
in
so
like
adrian,
had
told
us
before.
A
If
we
do
a
cube
cuddle,
what
was
it
it
was
describe
or
something
right
there.
It
is
yeah
team,
a
data.
We
can
see
the
conditions
that
came
in
here.
We
can
see
critical
parent
missing,
missing
parent
sub
name
space
anchor
missing
the
anchor
is
missing
in
the
parent
namespace.
So
what
happened
then?
If
we
go
in
and
we
do
cubecuttle
get
namespace
team.
A
data
is
still
there
if
we
edit
it
one
more
time.
A
Okay.
So
what
are
the
implications
of
this?
I'm
guessing
that?
Maybe
it's
just
floating
around
with
no
relationships
anymore.
Is
that
fair
to
say
adrian
so
cube
cuddle
get
roll
binding
for
the
namespace
team,
a
data
yeah,
okay,
cool
cool,
so
it's
kind
of
in
the
abyss
of
like
I'm
not
related
to
anybody.
I'm
a
I'm,
a
wandering
namespace!
A
That's
on
my
own
now
and
of
course
we
don't
go
in
and
just
start
ripping
stuff
out
of
the
name
space
because
it
lacks
ownership
so
and
specifically
adrian's,
saying
the
reason
it
won't
delete.
Anything
is
because
it
has
a
critical
condition
in
place:
got
it
got
it
which
I'm
guessing
hnc
when
you
say
just
hands
off,
it
means
that
it's
like.
Not
only
does
it
do
no
op,
it
doesn't
do
anything.
It's
like.
I
don't
own.
You
anymore.
A
I
don't
have
any
involvement
with
you
now,
let's
see
if
we
can
fix
this
right,
so
team
z
obviously
didn't
work,
but
if
we
go
ahead
and
say
cube,
cuddle
create
namespace
team
b.
Okay
and
again,
this
is
the
idea
that
in
here
we're
going
to
try
to
bring
team
a.
I
guess
now
team
a
looks
like
this
right,
so
I
think
team
a
it
still
has
the
annotation
here
of
team
z
and
I'm
expecting.
A
By
changing
this
annotation
to
b,
we
can
link
it
up
and
actually
see
something
from
b
propagate
into
team
a
so
let's,
let's
do
something
to
make
this
super
concrete.
We've
got
cube,
cuddle
get
name
space
here,
we've
got
team
b,
okay,
great!
So
let's
go
ahead
and
make
a
specific
network
policy
that
we're
going
to
just
call
team
b,
the
best
policy,
all
right,
we'll
save
that
up
and
we're
going
to
go
ahead
and
apply
the
to
the
namespace
team
b,
we're
going
to
apply
the
what's
it
called.
A
What's
it
called
the
net
paul
yep
net
paul
for
netpol.yaml,
okay,
which
is
in
unfortunately,
I
have
to
put
the
full
path
here:
tgik
episodes,
133
hnc,
manifests
network
policy
yaml,
and
this
will
go
into
team
b.
I
think
that
looks
okay,
oops
f
would
be
helpful
net
paul,
f,
okay,
unexpected
args
apply.
A
Oh
it's
a
file.
What
am
I
doing?
Network
policy
there?
We
go
lovely
okay,
network
policy
is
created
so
just
as
a
sanity
check,
cube
cuddle,
get
net
paul
for
the
namespace
team
b.
Looking
good
all
right,
so
this
this
task
that
we're
doing
and
as
adrian
put,
is
not
the
best
way
to
move
the
name
space.
So
you
know
just
know
that
this
is
an
experiment,
is
hopefully
going
to
be
moved
under
ownership
of
team
b,
and
then
we're
going
to
be
able
to
see
those
objects
propagate
again.
A
Just
to
kind
of
bring
to
light
how
these
relationships
are
set
up.
So
let's
do
exactly
that
in
the
edit
window
up
here
we
will
go
to
team
b,
all
right
and
my
hope,
let's,
let's
maybe
set
up
a
watch
before
we
before
we
get
too
crazy
here.
So
if
I
do
watch
cube,
cuddle
get
net
paul
for
namespace
team,
a
data
I'm
expecting
to
see-
and
actually
I'm
gonna
do
two
watches
here.
Everyone
check
this
out,
we're
gonna
watch
for
net
paul
and
then
what's
here's.
A
Here's
what's
really
interesting,
we're
also
going
to
watch
for
the
roll
binding.
So
what
do
you
think
is
going
to
happen
here?
Because
because
keep
this
in
mind
right,
the
roll
binding
came
from
a
but
we're
moving
ownership
over
to
b
and
remember
that
the
current
state
that
this
name
space
is
in
is
it
is
detached
from
any
parent.
A
So
my
guess
is:
I
think
that
the
role
binding
still
won't
be
touched,
but
we
will
see
the
network
policy
get
touched.
What
do
you
all
think?
That's
my
that's
my
guess
here
I
think
policy
comes
in
from
network
policy
perspective
and
then
perhaps
role
binding,
won't
even
get
touched.
Let's
see
what
happens
all
right,
we're
submitting
ourselves
into
team
b,
we're
saving
it
up,
we're
going
back
to
the
watch.
Oh
it
did
delete.
A
A
That's
pretty
cool,
though
yeah.
That's
really
awesome,
it
would
have
stayed
okay
cool,
so
it
knew
that
that
thing
came
from
hnc
at
one
point
and
was
propagated
down
and
now
it's
being
ripped
out.
I
don't
know
if
that's
if
you
got
an
annotation
on
the
object
or
what
the
deal
is,
I
guess
I
could
check
pretty
easily
if
I
do
cube
cuddle,
get
network
policy
for
team
for
namespace
team,
a
data
network
policy
and
we'll
just
oem
all
that
into
vim.
A
And
thanks
to
walid,
I
know
it's
set
file
type
equals
yaml,
lovely,
okay,
annotations
creation,
time
there.
It
is
labels.
So
I
wonder
if
I
wonder
if
that
label
is
what
it's
using
to
to
figure
out
kind
of
that
it
came
from
hnc
effectively.
You
know
what
I
mean
so
all
right,
pretty
cool,
now
yusuf,
you
said:
let's
try
removing
sync
resources
by
removing
policy.
From
the
I
see
what
you're
saying
I
see
what
you're
saying
yeah:
let's
try
that
as
a
little
last
experiment,
real
quick.
A
So
if
we
do
what's
so
cool
about
this
thing
is
like
there's
so
many
implications
of
like.
If
I
turn
this
knob
since
it's
responsible
for
all
these
other
things,
what
will
that
impact
be?
Will
it
be
a
no
op?
Will
it
change
something
right?
So,
let's
see,
let's
see
what
we
can
do
here
so
cube
cuddle
edit
hnc,
config,
config,
great
okay,
hnc
config,
and
I
think
what
you
were
saying
yusuf
is
to
pop
these
out.
A
A
Will
it
delete
that
network
policy
so
we'll
do
cube
cuddle,
get
network
policy
for
the
namespace
team,
a
data,
and
it
does
not
touch
it,
so
it
appears
if
my
theory
is
right
and
that
this
experiment
is
right,
that
removing
something
from
the
hnc
controller
is
saying,
as
adrian
put
it
hands
off,
it's
not
saying
rip
it
all
out
right.
It's
in!
Oh,
it's
in
ignore
mode
now,
okay,
so
just
like
we
saw
before
right.
A
This
is
now
in
ignore
mode
more
or
less
where
it
is,
and
it
probably
says
something
about
it
being
the
default.
I
bet
if
we
read
closely
default,
maybe
nonetheless
it's
in
ignore
mode
now,
and
that
is
a
hands-off
type
or
or
don't
change
anything,
and
this
includes
not
deleting
it
as
well.
So
pretty
freaking
cool
cues
can
be
propagated
for
different
name
spaces,
awesome
yeah!
So,
let's
you
know
one
thing
we
had
mentioned
well,
I
promise
we'll
wrap
up
on
this
today.
A
One
thing
we
had
mentioned
was
obviously
this
idea
of
of
resource
quotas.
Now
I'm
going
to
have
adrian
spot
check
me
here,
just
to
make
sure
I
don't
say
anything
horribly
wrong,
but
the
last
concept
I
want
to
kind
of
talk
about
that,
I
think
is,
is
pretty
interesting
is
it
seems
like
today,
please
let
me
know
if
I'm
off
here
that
hnc
does
a
pretty
cool
job
of
doing
object,
propagation,
setting
up
the
relationships,
propagating
objects,
we've
messed
with
a
bunch
of
knobs
we've
added
new
objects.
A
A
Now,
there's
there's
notions
and
kubernetes
of
these
things
called
limits
and
requests.
They
have
different
implications
at
the
runtime
or
scheduler
level.
So,
let's
just
abstract
that
too,
and
keep
it
super
simple
here
with
something
like
resource
quota.
We
can
say
this
isn't
perfectly
correct,
but
we
can
say
things
like
give
this
namespace
the
ability
to
wrath,
request,
10
tense
or
give
this
yeah
give
this
name
space
right.
It's
cumulative
yeah!
It's
cumulative
give
this
namespace
the
ability
to
request
this
amount
of
of
cpu,
so
we've
got
cpu
10v
cpu.
A
We
can
also
say
something
like
memory
right.
We've
got
the
ability
to
say:
okay,
well,
you've
got
you
know,
10
gigabytes
of
memory
and
cube
it's
denoted
differently,
but
this
is
an
easy
way
to
conceptualize
it
now.
I
would
think
today
what
we
can
do,
which
is
nice,
is
based
on
what
we
learned
about
object,
propagation.
A
A
So
this
is
what
will
be
super
interesting
and
I'm
I'm
really
really
curious
to
see
adrian
and
team,
how
you
all,
how
you
all
come
up
with
this
over
time-
and
it
looks
like
adrian
said-
would
love
help
implementing.
So,
if
you're
interested
and
passionate
about
the
shin,
this
could
be
a
really
good
opportunity
to
kind
of
get
involved,
voice.
Your
experience
and
really
really
interesting,
really
really
interesting
thing,
and
in
my
memory,
calculation
there
is
not
something
you
could
put
in
a
yaml
file
and
apply
because
I'm
not
using
correct
units.
A
A
If
you
hit
your
max,
you
set
to
a
limit
right,
and
that
is,
in
short,
far
more
of
a
runtime
concern
where
this
is
a
lot
more
of
not
like
on
a
host
level
or
runtime
concern.
This
is
a
lot
more
on
a.
How
do
we
provision
and
allocate
the
ability
to
request
that
run
time
resource?
Does
that
make
sense,
so
it's
kind
of
more
like
a
higher
level
kind
of
like
provisioning
standpoint,
not
so
much
like
a
lower
level
thing,
but
yeah
so
hope
that
helps
all
right.
A
All
this
was
a
freaking
awesome
session.
Thank
you
all
so
much
for
joining
us
today.
I
hope
you
learned
something
about
hierarchical
namespaces
if
you're
still
in
chat
be
sure
to
give
adrian
a
thank
you
for
sticking
around
and
and
and
helping
us
out
through
all
this
good
stuff
and
great
job
with
the
hnc
controller.
This
was
all
things
considered,
pretty
freaking
smooth
to
just
play
around
with
without
much
exposure
to
it.
So
really
really
cool
hope.
You
all
had
a
great
time
and
be
sure
to
enjoy
your
weekend.