Two minutes. All right Welcome again. Yes, it's difficult. See If you've never given a talk before when you when you stand over here, you're very nervous and you try to I don't know Invent a way to not be nervous, right? So and this is what I'm doing right now. I'm just making stuff up. So now it's really difficult. It's really hard Doesn't go away No, no Yeah Was saying my friend this yesterday and he told me messy the football player I'm not into football, but he told me messy apparently messy up to this day. He throws up every time before a match Which is very strange. I mean the best player of all time. He still does it.  I'm not saying I'm messy, but I Do throw up before every talk Yes I will try I will try. Yeah, I don't think the microphone is connected to anything So I will try I will try and if I forgot just wait, whatever Can people in the back? All right, I think there's kind of a seat over here I'm not sure if it's We have a free seat over here. I know we don't want to sit over but I don't blame you I don't blame you Oh, that's I guess start I will wait for this gentleman. Yes All right So Yeah, okay. Welcome. I guess again My name is more about that any which none of you will be able to pronounce but but still And I will try to convince you find people that Java is an interesting language to develop games in And if nothing else I will change your mind about some things But but like I said before I didn't expect so many of you to do Java, right? So that's really for me personally, it's a little bit disappointing, but But fine for you guys, right? You do enterprise Java most of you, right? All right, I do enterprise Java as well and as you can I will be able to sell I'm a big fan So let's see Alright, so I'm also like I just mentioned This is for the benefit of people who are not watching at home, right? But like I just mentioned I really have a Difficult time starting a talk, right? How do you start right and I used to make fun of people, you know And when you always have those talks in the first couple of slides are about your hobbies and whatever and how many cats you Have and that kind of stuff But till you give a talk and when you give a talk you can understand because How do you start a talk, right? This is room full of people. You don't know the people. You don't know their interests So how do you start so? so introduction, right, so Yeah, all right, so so so my The okay again so background of course like I said in the description which I think nobody read the description, right? the reason I'm doing this is because I I'm porting doom 3 to Java, right and I learned a lot of stuff so this is Okay, I don't know. I'll just go through this right Most of my slides are like this actually so it's kind of boring, but we'll see All right, so June 3, right? So that's the name of my project, right? Because we are excellent at naming stuff, right? I don't know and like I said like I say here. It's a temporary name I honestly I just you know, I need to create a new project. So what do you call it? Yeah, June 3 right at first I thought I would call it doom 3j right like 4j like everything in Java like log 4j whatever 4j, but 3j But then I named it this and whatever, right? It's up on github. You can check the codes and I don't know why So this is the question Everybody seems to ask me. So why are you doing this right and the honest answer and most people find this answer very amusing But it's not meant to be amusing is that I don't remember Thank you. Yes, but it's honestly not meant to be amusing like I said, it's just I honestly to remember I started it as five years ago kind of right Sorry But I don't remember why I started to be honest, right? I have some ideas about why I started it, but I don't remember the exact reason I started right But as far as I can remember right so five years ago, I had the doom 3 source code on my hard drive And it was just there That's it. I started reading it and I thought I think this is how it went. It probably didn't go like this, but you know, I thought hey This is a cool project And what I've just mentioned five years ago, right at the time This I do remember at the time. I thought I would be done in six months. I thought no seriously I thought six months. I would be able I was I would be done one thing and the other thing is I would be The Java version would outperform C++ version, right? So, yes, planning, right? So anyways So five years, right So what what what's what what do I use? I only use core Java and I only use open gel and open gel Rapper and the open-air wrapper. That's the same effort actually, but whatever and if you have any questions remarks So I close whatever just send me over there, right? Let's see so my Yeah, so I'm not an expert obviously, right? One time. This is very interesting actually because in description. Usually I say this is a hobby project, right? One time after somebody came starting talking to me That this is an official port of Doom 3 to Java, right? And I'm officially affiliated with his software, which is not true Fully, I don't with anybody so myself, but I'm like not an expert not expert game developer I don't actually see myself as a game developer my expert in Java, which is very important Not next to C++. I'm not expert in a lot of things. I tend to offend a lot of people when I talk about this stuff, so I'm sorry if I find you and I hope somebody learns something Least of all over to come to any of my talks again, right? So yeah, this is just my disclaimer, right? So, yeah Like I said, I expected less people here to know what Java is But but this is kind of important to the context of the rest of us up, right? So what is Java, right? So some people says interpret language some other people say it's a compiled language Some other people say it's something else. It's actually something else. It's not really interpreted. It's not really compiled, right? Who doesn't know Actually, I'm just gonna explain it Okay, this will come back later. Just ignore this for now, right? So yeah, open source Java's open source, which isn't actually 100% true, right? So if you go to the Java room here at Pustum, it's called free Java and If you ever thought why it's called free Java, it's because not everything in Java is actually open source which is a very complicated story and I think most of you know this better than me because I don't know the exact details of why, right? Some people blame Oracle for this, but this is a problem that exists since Java was some actually so but Mostly, you know the great the biggest part of it is open source, which is also important for the rest, right? Java chose to do sign math, right? So signed and unsigned, right? So unsigned is numbers that don't have a negative Component there are basically positive. So if you have 32 bits, it's 32 bits positive Joy and whatever, right? and Java chose not to do this and the background story behind this which is a kind of funny story is James Gosling back in the day. He couldn't decide whether to put unsigned math in Java or not So what he did at Sun, he wrote a lot of equations unsigned math in the hallways, right? And he just asked all the engineers at Sun to solve it, to solve them and Surprising enough, not the single one was solved correctly. So we decided it was a bad idea I disagree with him, but He's him and I'm me, right? So that's something else Java We use references for everything, which is strange. That's not strange. It is what it is, right? It just is. What is strange is that you have no point to exceptions when you don't have pointers And the reason this is strange if you don't know why this is strange actually is because Technically speaking a reference could never be null But the way we use references in Java, they can be null because we use a kind of a hybrid reference It's something in between a reference and pointer something weird That's why it's a reference by values actually more accurate Right Yeah, we don't support operator overloading So yeah, if you've ever tried to write a game engine a 3d game engine, especially right without operator overloading It's very very annoying It's very difficult. I Remember talking about them I think last year or something and somebody mentioned the same thing and he had this comments, which I love It's like doing math was talking about go I think but doing like this kind of math without operating overloading makes your eyes bleed, right? It's just it's just terrible. It's just terrible And there's also a lot of stories about why they didn't do that But we're not getting into this because I stuck with time and My timer isn't working. How much time do I have? How much time do I have? People in blue. I've been talking 10 minutes. Seriously Okay, I've been talking 10 minutes on slide one or slide two to whatever, right? And in Java we have final which is kind of like comes but it's not really right So Yeah, so I'm gonna give you this slide. I'm gonna skip this one actually but Right, so I love this comment on stack overflow No, it's from Hacker news about why Java kind of sucks, right? I'm not sure if people can read it in the back, but if you can't it's amazing Just trust me and when other people start to laugh left with them. It's just amazing, right? But this is absolutely true right, there's a lot of like A lot of the hate that comes with Java is just like, you know, it's It's what people are used to doing in Java right the way people are used to writing code in Java like getters and setters Right, everybody here writes getters and setters.  Right, because yes, thank you because it is right. You actually don't need it There is a historical reason for why you needed it's Like 10 15 years ago, but people forgot that reason are still doing it But we actually don't need them, right? I'm not talking about something like project long buck or whatever. No, you don't actually need them And when you write getters and setters you force the jvm to To do like an extra Extra optimization stuff for it, right? Which shouldn't be there anyway because you're creating like an interaction, right? That's whatever right, but that's that's like I just love this anyways So I'm kind of like so how many people don't know these terms Be honest You're not appearing on the camera anyway, right?  This is actually so what is java, right? So java because you can call a lot of things java, but it's it's kind of inaccurate in times And it's kind of incomplete all the time. So you have the jls java Something something it's a language language specification actually, right? So some people call that java, right because the language specification is completely open source And if you implement it to the sorry you can implement it in your own way as long as you produce produce these results And we will recognize you as java, right? So that can be java You have the jdk or the language itself, right? So the actual code you write which is based on the specifications some people call that java Maybe it is other people and most people actually or most purists, right? They tend to call this java actually, right? So the jvm the java virtual machine which does garbage collection for you Which does just an uncle compilation for you Which has the java the java memory model for you, right? So it's kind of strange what's called java, right? But we'll get to that So to you right because no, no, no, it's just something so No Just No, no, no, it's just Because it's why I saw closing your eyes, right and one time I was giving him talk Right and I saw a gentleman the first time he was just like snoring, right? Obviously, right it was after lunch and people say you have a soothing voice or boring Which is code for boring voice, right, right? And it just but at the end I gave a demo and he was just clapping like like crazy Like like he was awake the whole talk but whatever doesn't mean so I don't blame you. That's that's my thing, right? A friend of mine gave a talk once, you know, he did it It was a lightning talking. He did it like like a boxing match, right? So at first I wanted to structure this talk like a boxing match the same way because I like that really, right? Which I didn't in the end, right, but I had made this slide already. I love this slide. So I just kept this slide, right? But this is the idea, right? So c++ is the reigning king of the game development world, right? Whether you liked it or not whether you admit it or not, right? And I see java as kind of like a contender, right? It has a lot of good stuff that it can offer. I think it can offer, right? I'm gonna kind of like like show it, right? Which again doesn't work very well because most of you do java, but I'm gonna do it anyway, right? um Yeah Yeah, I was listening to this song while does anyone know what song this is? Excellent So I was listening to this song, uh And just wrote it here. So yeah right So like I said, this is based on the project I did, right? So the first thing you come across is setting up your environment, right? And I cannot stress enough How much hell it is to set up an environment c++, right? The reason I'm still using this laptop with 70 or 70 a year old laptop will have a like a couple of months Old laptop at home Is because I have set my c++ environment on this laptop and I don't want to do it again on my other laptop And I know it sounds stupid, but really I hate it.  Um But I'm not a full-time c++ developer. So it's probably easier for them But still there's so much that can go wrong, right? You have to like You have the have the right dll's the right version the 32 bits or 64 bits Set up the linkers You have a lot of like macro and pre processor bullshit. You have to deal with it's like it's really hell, right? And in this one, right? So this one is actually this comment here, right? So at one point I upgraded to a different I had I have a different laptop with a different version of visual studio We just didn't work right because the project was written in that visual studio And you have to have like the professional version and I was using the expressive version because I'm cheap, right? And it didn't work, right? So it was just hell, right? And these are two guides And we're written I wanted for this for windows and this for macOS, right? It's kind of more detailed only to get the project running in your IDE. That's the only thing in this guide. That's a very long guide, right? And it's a lot of work And yeah so Yeah money Does anybody know what sconce is? Yes, thank you You can come sit over here as well No, but so sconce is kind of like If you know what make is it's like a supermake let's go with that, right? And this is one of the things it was also included in the project So it's a visual studio project, but they also had like a sconce file which you can see as a supermake file, right? For the linux build of of the game, right? And I want to do some benchmarks for gcc So I just thought it would be easy to do this right to just load the sconce file and and compile it And it wasn't Right. It was really a lot of work I can I won't describe it here because I've already rented about this enough, right? Um, a chromium. Yeah, let's not talk about chromium Suffice it to say it takes like a day to compile it, but that's that's a different story But yeah, so this is this this is c++, right? This is this is very difficult It takes a lot of time, right? You have a new developer you want to set up your environment You literally you're literally doing before a day or whatever, right? And it works sometimes it doesn't you upgrade it doesn't whatever it's difficult, right? But this is kind of actually what what we want, right?  But in the purest sense you can make it this easy, right? You download an id it has a jdk sometimes it has maven sometimes and that's it You load in your project and it works Right most of the time But like I said, you can make anything difficult for everybody, but yeah Right, so this is kind of like how I see it in Java, right? You have a lot of wizardry Stuff right nowadays in intelligent you can just point it to a folder and tell it Okay load some stuff and it will figure out how many projects you have how many dependencies you might have and not have and that kind of stuff They're getting good at it, right? And it's mostly open source Right in the c++ world everything is closed source and everything you have to pay for And sometimes you have to pay a lot of money if I don't mind want to use like three plugins from a company It was like one plugin is five thousand dollars But if you buy all three you get them for ten thousand dollars, right? And we were very simple algorithmic plugins, right? He could only implement them himself, which he did Right because it was cheaper Right, so, uh, but that's the world of c++ is a different world, right? But not everything is fine, of course in the world of Java. I mean paths, right? You have to set up so many paths if you want to run it from command line just can be shitty And sometimes 32 bit verse 64 bit can be very annoying, right? Especially if you native code sit stuff like what I do with open gonsu and such So it's not perfect, of course, but I think it's it's better than than c++ Right, how many of you do c++? I didn't ask that actually Wow I feel betrayed, right? It's like it's like the same people also also do Java actually, right? So But okay, so All right. Oh, I thought I removed this slide, but okay So another thing, right? Like I just mentioned make files, right? How many of you? Okay, let's let's not keep doing that, right? I actually find it annoying when speakers do that But I sincerely want to know which is weird Um But if you've never used a make file or any make so I use I use the word x make because there are a lot of variants He make q make or whatever But they're essentially mostly the same And if you've never used them, they're basically just meant for building like you can do some testing sometimes You can have some profiles in there sometimes depending on like sconce can do a lot of cool stuff Right But it's not maven, right? And if you've never used maven Which is Some of you right you can do a lot of cool stuff in there, right? So a lot of this stuff you can do also in make files, right? But this one, right? This is the most important one. I think this really makes maven the best thing ever, right? And and and that's yeah How to how to explain this? I don't know how to explain this does anyone know how to explain this Does anyone want to explain this? So transitive dependencies especially right so when you have a dependency it has a different dependency, right? Usually if you have a palm file if you have a maven file or or a make file One of those cool make files that have dependencies because most of them don't you just know what the dependency is But you don't know what the dependency depends on, right? Maybe sometimes you do maybe sometimes you don't Maven deals with this right maven is excellent in this right? It will get the transitive dependency for you right the right version as long as you adhere to the maven Like like strategy, right? I think this is really really really amazing, right? and Java cool, right c++ doesn't have this When I talk to a lot of friends of mine who do full-time c++ They're they're also amazed that c++ doesn't have this because it's actually kind of a very simple problem to solve The problem is c++ everybody is very protective about their own things, right? And nobody wants to communicate or lie like say, okay, we're gonna have one standard or whatever so But it's it's kind of timble so but yeah Yeah, this was tweeted a couple of days ago. Did anybody see this so when you see something like this right And you've never done c++ you're kind of amazed by it, right something takes 48 hours to compile and With one small optimization it goes to four hours, which is still a lot of time actually, right? I know 10 tensorflow is huge, but still right? um So this is something so this is this is the part where I talk about where I Needed to do some scone stuff to do some benchmarks, right? so at the beginning, right? Compiling doom 3 in java and c++, right? It took me really like 25 minutes But the reason I have a question mark is because I don't have windows 7 anymore So I can't really reproduce it. So you're just gonna have to trust me, right? So is it so yeah, but yeah now it takes like 10 minutes, right? You like a multiprocessor up to my switch, right? It takes three and a half minutes with 100 cpu and this thing has like eight logical cores I think which is a lot even if it is like a six seven year old machine, right? Gcc Okay, kind of the same I'm not sure. So when I got an error and you're doing it with o2 optimization And there's a reason why I did it with o2 optimization, which I'm gonna tell you about But when I got the error, it was like 30 minutes But then I fixed the error and took only 20 12.7 minutes I'm not sure why And I'm not good enough in gcc to know why actually. So let's just leave it at that an o3 optimization My code currently it compiles in like 25 seconds And like like six seven seconds of those are like like maven just starting up and doing stuff doing nothing actually, right? I don't think this is amazing. I think before game development, this is amazing Right, you want to prototype the whole time. I know so none of these are incremental builds, right? So all these are like clean and builds, right? What it says there from scratch, right? Oh, yeah, and if anybody has any questions or remarks anytime just shout, right? I prefer that actually so not shouting, but I prefer questions like in the middle, right? So any any questions? No Really? You You have a question You want to say something You don't believe this It's true Sorry You want you're trying one? Oh, you're gonna trying to think of a question. Okay Next slide. I'm gonna come back to you but But but this right so and and I tried like so incremental builds are very fast, of course, right? So and but incremental job also has incremental builds, right? So that's why I'm kind of like like trying to to to to compare apples to other strange apples, right? This is amazing. I think this is amazing, right? And granted this doesn't give you an executable, right? So you still the way Java works, of course, this is like a meta something in between bytecode really, right? But this is the reason I did the O2 optimization Here for the benchmark, right? Because a lot of people they they they they they talk about this So like like if you talk to a jvm architect or jvm compiler engineer or whatever, right? They say actually you shouldn't compare What the jvm does for you was like pure GCC, right? So like O2 optimization O0 optimization You should compare it to O2 and the reason for this is because At the end of the day the jvm still jips code for you, right? It does like like hotspot optimizations for you when it runs, right? And it's kind of the only way you can compare it to something is with optimization So that's why it should be O2 I was kind of disappointed that the difference in time between O0 or O2 was so small but That's something else. It doesn't matter So yeah, so in the boxing match thing that I didn't do that I should have done, right? I think java wings here, right? For me at least, right? You have a question? Still You have to you have to have a question, right? So start-up times, right? And this is also kind of surprised me but Okay, so not this slide but the slide after this kind of surprised me So, yeah, I'm trying to compare them, right? So the game runs maybe I'll show you the game if enough people want to see it but At the end and if we have time because How long how much time do I have? Okay, all right, so So yeah, so I kind of expected this, right? So this is the java version the c++ version Which I should have maybe like labeled or whatever, right? But you're starting up the game, right? So java should take longer, right? It's per definition java cannot start Faster than something that is optimized c++ because java itself has to start the jvm itself jm f warm-up time, right? so yeah, so This is actually not what jvm warm-up means, but you know that and you're going to pretend you do so But yeah, right? So java version of the game takes like approximately like nine seconds longer for the jvm itself to start up and do stuff, right? So I expected this so I'm not kind of I'm not really that disappointed to be honest If it is a huge code base so So yeah, it doesn't matter, right?  I mean it doesn't matter. It's nine seconds. Who cares, right? So So yeah, um, but this one did surprise me, right? So these are actually loading times. So this is kind of like loading the first level This is the loading time of the first level And the java version was faster And unfortunately, I don't know why because I kind of like just made these slides like a couple of days ago And I was very at deadlines and stuff. You enterprise developers know how that goes, right? So I didn't really have enough time to to to like like dig into this and see why actually the java version was faster Right, it's not much faster, but I expected it to be much slower actually at least Exactly the reverse, right? Because always when I'm starting the game, right at the end result is always right the c++ version runs runs first, right? So I honestly thought this would be slower, but it's faster. I'm not sure why So don't ask me that. Oh, you have a question. Yes In what sense who's they in this conversation? Sorry See if they're not here. They're not allowed to hear the questions, right? It's it's it's your right now. I'll repeat the question. Sorry, but but but I'm still trying to to understand the exact question. Sorry Hi Version, yeah, yeah, oh that way Okay, so the question is so So first the clarification the original game is c++, right? So it's not really a port So the question is so so the people that that did the c++ port of the game Did they compare to Java? Right? That's that's basically question. So, yeah, so it was originally developed in c++ Unfortunately or fortunately, I don't know, right? And actually funny thing about that actually so so people would do c++ a little but if you look into the code of doing three A lot of it looks like c Right, and I know a lot of people don't Like to admit that there's a difference between c and c++, but it's like a shitload of structs for example They also have classes, but they have like Amazing amazing amount of structs, right and a lot of c paradigms in the game, right? and There is a story that says because this was like the phase that they were starting to learn c++, which is interesting because this was I think late 90s till like 2005 the game took like five six years to develop And this was the phase they were learning c++ and they didn't like a lot of stuff. So they didn't see Right another thing which yes, sir Okay, so you're curious about my opinions about c versus java, right? So that's an interesting question. I like c more than a like c++, but that's something personal, right? It's not really about i'm not talking about this For you mean from a game development point of view, I assume, right? Yeah, I'm gonna touch touch on this a little bit later, but but right now at least For For the purpose of this you can see and c++ are kind of the same They're not the same. I know right and i'm looking at you the one who knows what scones is because Excellent, right? They're not the same, but for the purposes of this you can you can claim that they are the same And the reason for that is Yeah, I'm gonna skip this for now, right, but I'll come back to it later. Sorry Um Answer your question, sorry You have to have another question. Yeah, so begin preparing for now and All right, so I don't know why like I said, why this is faster, but And this part as well, which is strange, but I will do you But yeah, I was mostly interested in the in the in the warm up time actually not not the loading time itself, right? I wanted in this slide actually I wanted to like demonstrate that c++ was better, but the backfire so Doesn't matter Yeah Actually when I found this picture online The first thought that came to my mind is actually isn't this kind of like child abuse, right? Because if you put your child in this position and you photograph him for like or her For like your own profit and fame and whatever likes on youtube or or some kind of stuff It's kind of bad actually, but it's a nice picture that aside, right? um, so yeah So multitasking is really difficult, right? um, so this is something else. I want to really talk about is is like CPU utilization in in java or what you can do with CPU is utilization in java Which can do with it in in c++, right? Basically can do exactly the same things, right? But c++ java it's it's it like facilitates a lot of this stuff for you, right? And I think the the next slide Or the one after that at least or something like that touches on the thing that everybody hates garbage collection, right? um, but actually garbage collection is kind of like like I Married to uh to to to to to multi-threading, right? So yeah, threading bonanza threading is hard third safety is very expensive I think I hope everybody knows why does anybody not know so threat safety So the idea of threat safety is that when you make a structure for example, uh, whatever like a list Threat safety means that when I access something or I change something in the list Not a different thread is not allowed to do something else in that in salamu finish. That's basically right It's actually not that at all, but that's that's like the like the hello world example of that, right? Uh, so yeah java does that very well, right? It facilitates a lot of stuff It has a lot of like safe and unsafe for flavors of structures, right? Like Um, yeah, what I just explained is kind of like at an at a missus. I don't know where to put the missus in Your your native speaker. How do you pronounce this? Yeah What he said right at a missus Thanks, man, uh Right, so so basically the idea here is is what I actually want to touch on Because there was there was a podcast a couple of days ago Jonathan blow right and he he mentioned. Yeah, you listen to it for three hour thing You're laughing so you have must have listened to sir Oh, you've heard about okay, so Jonathan blow is a developer of braid and the witness, right? It's a pretty cool guy not a lot of nice ideas. There was a podcast a couple of days ago. It was three hours And and he got asked the same question right like multi-threading and whatever and his answer and the answer of a lot of game developers Especially the the engine developers is there's actually not a lot of Things in a game you can do that requires multi-threading and parallelism and concurrency of that kind of stuff, right? Which might be true, right? Because he if he says that he probably knows that it's this better than me I have no idea But my problem with this idea at least right whether it's true or not is this this this kind of thing, right? So you have morse law That that you don't require multi-threading in Yeah, okay, but but but their comments or mostly those guys are in like engine developers, right? So they mean like in graphics engines that kind of stuff, right? But give me just like one minute to explain this, right? Um So you have morse law you have amdahl's law, right morse law says something like every like 16 17 months I don't remember somebody will know the correct number number of transistors on a cpu thing will double, right? But there's an end of life to that because we can't get any smaller or whatever, right? So at at some phase, right? We cannot expand the cpu more than that and technically speaking We've actually reached that a long time ago, right? But we changed how we view morse law, right? So first we looked like okay, so what's the maximum speed you can gain from the cpu? And now we turned it into something like oh, how many cores can you get on the cpu? Which is kind of different because how many cores comes back to this story, right? And how much how how fast something gets is is Is this story actually and amdahl's law which i'm gonna screw up But if somebody can correct me then please, right? Amdahl's law it says something like There are certain not all problems can be paralyzed. That's that's kind of like the So it's actually what the law says as far as i remember, but it's kind of like the takeaway that i need here actually for this proof my point Let's let's go keep it up, right? hello so Sorry So that's that's my problem, right? So true not all problems can be paralyzed, right? That's what a lot of the engine developers say, right? Let's assume that's true But if you like don't think this generation don't think the next generation but like six seven generations of graphic engines later, right? You're you're gonna hit the roof of like, I don't know a single core of I don't know What's the fastest now three and a half gigahertz or something you're gonna hit that Okay, so you can't paralyze the problem. What done, right? I don't know right and yeah like this thing says, okay So maybe we'll we'll be better get better programming again, right? Because we've kind of like unlearned how to optimize stuff. So maybe we'll learn it again But still there's only so much you can do because it's not gonna expand anymore, right? You're gonna hit the roof and that's it, right? So that's why I think this is interesting, right? I'm not saying you need it. I have no idea if you need it in doom 3 I don't really need it. I have like two threads for the whole game, right? And the second thread actually I don't need it, but it was in there in the C++ version So I did it also in a Java version, but technically I think they were experimenting with threads as well Actually, so that's why they put it in there But yeah, do you need it? I have no idea, right? But it's just a question and if you need it then Java is actually pretty interesting for you, right? And why? Again a cool tweet this one was from like a couple of years ago Does anybody not know who this is? All right, so I assume none of you know who this is So this is Tim Sweeney. He's like the the guru developer of unreal and all the unreal engines or whatever, right? He doesn't do it by himself, but he started once upon a time by himself, right? And there was a discussion something about the garbage collection and he said this, right? Lately the last couple years he's been doing a lot of research. I think about Dude dude Dude Dude Dude That's like okay, so It was doing like research about program languages and that kind of stuff And he tweeted this right and it's like the first tweet. I think I liked or Or like saved or something like that, right? And I found it very interesting argument actually And I dare say this tweet is actually kind of like what made me do this talk So if you need somebody to blame blame him But it's correct, right? So usually when you have like a big game engine you have like Scripts, right? Because you don't want to hard code everything So you want AI to be scripted. You want your enemies to be scripted. You have everything to be scripted, right? And when the scripting language gets so complicated or complex, right? You kind of like Like interpreting your own interpreting your own parser for that and that's what he's talking about, right? So none of the developers that keep keep keep crying about garbage collection, right? They actually You know, they they mind this right that you have a large overhead of parsing and interpreting these things during runtime Right and they can be huge and doom.  So, uh, that's interesting It has nothing. Yeah, it's kind of had something to do with my point, right? So this is actually the part where I wanted to play this video um Which we will try in a minute and if everybody everybody stays quiet you will hear it I think But um We will play it now actually because I'm running out of time. Uh, let's see. Where's my pointer? no woman Let's see if it works Can anybody hear that? Not even the people all right excellent, okay, so Okay, sorry But anyways, so that's actually it's related to this thing, right? Embracing gc a lot of people don't understand how the gc works actually, right? And this guy, I don't remember his name brian something This is actually talk about rust right and he was using as example the gc in javascript And I didn't know the javascript script was actually garbage collected. That's my fault, but But he was using as an example, right? Is is and this example it just shows that you can have memory You can have memory leaks in java in in javascript, right? And that completely screws up your gc, right? and that's kind of like The reason that's important is is kind of like this slide again, right? The spiky one percent for garbage collection, right? Because the whole time I have 15 minutes left. Thank you very much The whole time people only talk about stop the world garbage collection, right? Which shouldn't happen anyway, right?  It's not the norm. It shouldn't happen, right? But that's the only thing the outside world sees Right and I did some digging and I didn't know this either actually, but unity is garbage collected, right?  And the reason and that's actually the reason I put this thing here Because one of the things garbage collection can solve and you cannot solve or very difficult for you as a person doing pure C++ Solve is memory fragmentation, right? So let's say you you allocate a these are 30 bytes, right? A and B are both 10 bytes, right? You free a now you have a gap of 10 bytes and gap of 10 bytes and you have new object of 15 bytes How do you allocate it?  But it's a very difficult problem to solve, right? I'm gonna skip the rest kind of because I'm running out of time Um But yeah, not everything is great, of course in Java, right? Memory footprint bad, uh, I don't What anybody no you have question No, you sir. You sir. Yes I have not so the question is yes, sorry The question is have you tried compiling it with growl to native code ahead of time compilation of that kind of stuff, right? I haven't tried it to be honest Currently, so these are problems. I'm just trying to like If I show you the demo at the end you will see that I have much bigger problems than this, right? This these are just kind of like because I'm like I'm seeing a lot of bad stuff about c++ Which isn't fair, right job also has a lot of bad stuff, right? So this is kind of like that, uh, but I haven't tried it, uh, although a lot of people have asked me that and I'm very curious myself to be honest Yes, any other questions? Oh, yes, sir I'm sorry, I really can't hear you Collections, yeah So the question is thank you I haven't encountered the same problem. So the question is to repeat. Do you use Java util collections in your in the game, right? Because I mentioned that earlier Because his experience is they're very bad for performance. This is also my experience. They're very bad for performance Um, this is also the experience of the developers on the c++ version of the game Because they created their own collections Um, and arrays are much faster, of course arrays are much faster Um, unfortunately, I could not use an array for everything But but I try to use arrays where I can And if if anybody wants to know more about this Raise your hand now or stay silent forever or something like that Because because this is a Java question. He knows what he really sucks I'm not everybody might know this does anybody want more information about this part We can talk more about this. No, no we can Trust me we can but We can we cannot No, we cannot But but but anyways, uh, so yeah, so the memory footprint is just horrible in Java, right? But yeah, if you didn't expect this then you're kind of deluding yourself, right? Java and it's kind of so I think I have another slide on this Yeah, so cpu over is negligible. We don't care about that memory over But kind of also depends on which kind of GC you use, right? So I don't remember which GC does what right?  Because double the amount of memory you actually need because you do something and then you copy the whole thing to the other thing And you copy it back and whatever, right? So kind of depends And don't look at me like that. I think I know what I'm not talking about, but But yeah, so uh, uh, but yeah, so it's terrible and to give you an example I didn't put it in here actually because I don't want anybody to like like put a screenshot of my slides somewhere and say Java's terrible But like the c++ version runs this is like it's again for 2005, right? And it was highly optimized it runs. I think Average like 128 megs of RAM and if you like like like put the settings to ultra super duper or whatever I think it runs like 256 megabytes of RAM The Java version runs. I think an average of like one gigabyte of RAM, right? Hey, hey, hey don't this is Java, but uh, yeah But again, this is not optimized none of my Java code is optimized So actually most of the code is is the opposite of optimized Because the way I developed it I tried to stay true to the c++ code Because at certain points actually at most points I want to debug it, right? So if I optimize it and no longer looks like this like c++ version it's kind of difficult to debug, right But yeah, it's it even if it's optimized. Let's put it this way. It will never reach what c++ reach, right? It will never happen, right But so what people say memory is cheap which it isn't but whatever, right? How much time do I have? Excellent gonna skip this because Um Yeah, so these are things that okay, so very quickly. So these are things you don't have pointers You don't have macros. I hate macros, but you don't have they can be very useful They are very useful in the gaming world. No, I mean every c++ world actually And you don't have operator overloading which I really really miss, right? I even wrote something for operator overloading, but that's a different story But you have type safety, which I really love, right and Like I said, I'm gonna skip this. I'm just mentioning it because I don't know why So yeah, so this is the thing I think one of you two guys asked about this before it's kind of related to what you were talking about, right? So why use so you use arrays instead of of collections, right? Especially, right? Um stl is kind of like the java util collection thing It has much more, but it's kind of like that, right? And stl is like it's an extension on c++ which has a lot of cool libraries, right? Am I saying this right? I'm looking at you because you know a lot of stuff. I miss am I saying this right about stl It's a lot was there? Yeah, but c++ doesn't care. Yeah, I mean stl is I don't know is stl actually part of the standard. I don't know It is okay. So it is right So, uh, yeah, I honestly didn't know that because back in the day Okay, so I have no idea. I always thought it wasn't part of the standard, right? I think I thought that because effective c++ has a separate book for stl So I thought it was something separate, right? But uh, if you don't know what effective c++ is, you know effective java That was actually stolen from something called effective c++. It's a different book and they whatever doesn't matter doesn't matter, right? But stl has a lot of stuff, right? But java has like a lot of better stuff. I think right java has put a lot of thought into that, right? So it's cool Intrinsic for the win, right? So you have a lot of java functions c++ if you have a function gets gets compiled like it is, right? And the compiler does some optimization for you in java. It's kind of different if you open something and I assume most of you know this actually but but if you open something you You see a piece of code and you copy that piece of code and you run a benchmark It will be much slower than if you don't run it, right? If you if you run the actual call, right? Something in the Yeah Okay So to repeat the question because you're my friend, yeah, so Because we're running out of time. He wanted to ask a question that's unrelated to this but Is how did I approach the inverse square roots? Yeah, I don't know if it's an algorithm but that part right and if you don't know the inverse square roots It was something they nobody knows for sure who came up with it, but it speeds Sorry, yeah, he himself says he didn't come up with it, right? So From the MIT book It's possible. I have no idea but That's just assume. We don't know. It's just some aliens, right? We don't care But but it's it's a very known algorithm and it was written c++ And it only works in c++ because in c or c++ actually because you kind of like directly talked to the registers, right? If you do it without that Yeah, then you're talked to a vm which talks to the registers, which is what I do to answer your question Like I said debuggability is very important to me at this point, right? Uh optimization performance only if it kills me then right if something takes like seven minutes to load or whatever I don't see you. I don't see you. So Only if it takes like a very long time So I had a problem with file i o for example, right because I ported it the way f read does it and that kind of stuff Which was like the shittiest thing ever, right? Uh and something was was like loading in like Three minutes, right? And in c++ version took like two seconds, right? So that part I rewrote in java. I wrote you rewrote in a completely different way, right? But mostly I don't do optimization yet Approx what's approximation For the you mean for the infrasquare root Yes Yeah, but the way the way java implemented all that stuff is kind of still it still holds kind of true Right. Um, and yeah, it's not 100 so yeah, it is kind of approximation what you say But the the funny thing about this if you approximate it everywhere It's it's it still holds true, right because you're off by the same error everywhere Right, let's not talk about this anymore Any other questions because yes sir Do I have time to show them the demo? Is that including questions or excluding questions? Because I haven't had any questions yet And I need time for that so Okay, so I have five minutes yet. So I'm gonna sorry Yeah, okay, okay. I'm gonna show you the demo. Uh, I'm gonna skip this cool stuff. Just look at it cool stuff This isn't true, but cool stuff Uh, this is true, right? So you don't have console support For java, which is I think the biggest problem with game development, right? Because you don't have any native jvms for For most of the game consoles, we know But And this is about I don't say you should do this, but it's just cool. So I want to show you guys Apparently, uh, the blu-ray Specification, uh has a part of java in it. I did not know this I just discovered it like a week ago, right? And this is somebody who made a video He created like a small game in java and he ran it on xbox one and then on the playstation 4 Through the blu-ray the part of java that is in the blu-ray specification So unfortunately this is a six minute video. So I'm not gonna show maybe I'll like show you like the part where it says it's java Okay, this didn't work Okay, just trust me it's uh, it's cool. I don't know how to get this No, okay, that's I should have thought about that Anyways, it works. It's just amazing. Just just search it on youtube. You will find it, right? This is some cool stuff. I wanted to mention but Yeah, because because of the demo there were the one thing Just gonna start up inside the j in the meantime But the one thing I really want to mention is just there's a lot of untapped potential in java, right? So a lot of things a lot of problems that we might face in game development A lot of problems we do face in game development are kind of easy to solve And I'm not I don't mean easier in the sense. So that's why I said we're cheekier, right? Because he has a whole talk who explains the difference between easy and simple apparently I don't mean easy in the sense that It's you can solve it in five minutes, but we already know what the solution is, right? But nobody does it. Nobody takes the time to actually do it, right? So, yeah There's a lot of stuff like that. Um, I'm gonna show you the demo And I mean literally the demo Um, I hope this works The number works with the two screens in the meantime questions Just ask Sorry, this is the demo This is literally the demo It took me some time actually to get the demo itself working because apparently the demo was In the olden days that reached the demo like months in advance, right? Nowadays. I don't do that anymore You can kind of hear the music But the demo was made with different build of everything different build of the script different build of of like code whatever So I had to like do a lot of like exceptions in the demo Um Shit Yeah, don't comment about the mouse. I haven't captured it because it's easier this way Questions remarks Does anybody still like java? Sorry Sorry It runs pretty good. Yeah. Yeah. So the question is yes. Yes. My friend my friend So how does it run right? So I mentioned because I mentioned a lot about loading times and that kind of stuff So how does it actually run? So my answer is you will kind of see it right now, but but you know, it runs pretty good, right? and One of the lighting talks he mentioned something I think was about No, I don't remember which talk but he mentioned something about something was ported and they had to port it with errors Right because the same errors, right? This is actually funny because I had a similar thing I have a specific level that I load and it's just very slow at the beginning I thought oh shit, man I broke the game whatever right, but then I load the c++ version of the game the same level It's also very slow at the beginning. So I mimic the inefficiency, which is very important right I'm just skipping this stuff because we don't have time I think Yeah, so this is the problem doom is a very dark game, right? and Oh, no, no, no I want to console Yes, and I have to turn off shadows because that part is still broken Yeah, so it's a very dark game We don't have a light switch here. Do we have a light switch? In the olden days I used to show them wireframe, but I thought we were beyond that point So yeah, we can do this. I think no We can do this we can cheat we can always cheat right and the reason we're cheating is you get the flashlight Okay, you don't get the flashlight I don't know. I don't know why I didn't get a flashlight But yeah, this is really tiring. I must say it actually looks better from here. So if you want to see it, you can Where am I I'm probably over time so If anybody has any questions All remarks you can just Tweet them at me Don't tweet them at me send me a dark private message. Oh, just tweet them at me. It doesn't matter How much time do I have? Minus two Excellent Yeah, okay, so so yeah, thank you very much


All right, welcome everybody. I appreciate y'all coming through to everybody on the live stream, welcome as well. Today we're gonna be talking about Kubernetes and Vault. We're gonna really take it more so from the application perspective, and we're gonna talk about how we manage our secrets, how those secrets change, and how our application consumes them. Let's go ahead and jump into it, but we're gonna spend a lot more time because I don't like slides just in the code and walking through that stuff. There's not a ton of folks here, so if y'all have questions, I feel free to raise your hand and ask. I like a more interactive situation if possible. All right, so our main objectives of this talk are to write an application that A, gets a secret from secrets management, and the second part reloads when a secret changes. We're gonna be utilizing Vault to do this. Let's talk about some initial setup and we'll look through kind of what we got going. So if you all wanted to, you could follow along. First, let's outline our application architecture. In the middle there, we have our payments app. That's the app that we're writing. That's the Golang application using Gen. That's going to interact with two main pieces. We have an external payment processor. So when we submit a payment, it goes to this external payment processor. The payment processor returns me some data saying, hey, you're good, the payment went through. And then we go from there to recording that successful payment in our Postgres database. The demo uses Kubernetes. So specifically, we're gonna be using Minicube and the Vault CLI we'll need. And if you want to, you can go to that repo and clone it as well. Everything Kubernetes related is in the Kubernetes folder. So we're gonna jump into that and actually see what we got going on. And when you run make setup, it'll go through and set up everything. So let's go ahead and take a look at that real quick. I have my code here. All right, so I'm gonna go to my Kubernetes folder. You see, once you go in there, you'll see a basic make file here. And at the top, I have a setup here, which goes through configures Minicube, does all the things it needs to do. And then at the end, we have this bash script setup here. Let's go ahead and take a look at that. Look at the setup script. In the setup script, the first thing we do is we set up Vault. So Vault will be deployed in Kubernetes with the agent injector option configured. So we're gonna roll out Vault and the agent injector. The agent injector handles when I deploy my pod, automatically deploying the agent as a sidecar to that pod to manage the writing of secrets. We're gonna get more into what the Vault agent is and how it works later on. After that, we handle the port forward so I can actually interact with Vault and we'll show you kinda how that stuff works. We handle the Vault address and Vault token situation, do status check, and then we enable two secrets engines. And this is gonna be critical as we go throughout this. So we have a static secrets engine called payment slash secrets, which is just using KV. And we have the database secrets engine we configured which is going to be our dynamic credentials use case and really be the root of why we need this reload. So go down a little bit. Now we're gonna go into configuring Vault. This way when you all, if you wanna spin it up, Vault's already preconfigured with all this stuff. So we have payments, username and password we put into KV. Then we write that config for the database. We give it a connection URL and we tell it what role here. So you should be able to see that, yeah. We tell it what role, which in this case is the payments app that gives it the right to actually utilize the secrets engine. And the nice thing about this dynamic secrets setup in Vault is that with that role, if you access Vault and you access the database secrets engine, it'll execute this creation statement on your behalf. It'll go in, it'll create that user and it'll provide back those credentials in real time with whatever time to live you define. It could be, I've tested it down to like 10 seconds. It gets kinda crazy. But we have, it might be about two to three minutes with this demo. Now when it's done, Vault will go in and actually delete those credentials for you and manage all that behind the scenes. Sweet, so we're also doing transit engine. We're not gonna mess with that too much. That's with Vault encryption stuff. And then we write our Vault policy, which I did wanna show you all. So the Vault policy on our Vault folder just gives access to this payment role and to every token that we assign this policy to to read from our database credentials and from our payments secrets KV. So we have all those there. You can check that out as well. Go back in the setup. Now we go down, we configure Kubernetes auth here, which we're using. And we're also writing a payments app role and binding it to our Kubernetes service account. We handle the right of our policy and then the last step here is we handle that Kubernetes role as well. For the CSI. So that's the basic setup. All that stuff has been set up. I wrote and did all that beforehand just because the Wi-Fi here isn't great. So it handled all that downloads and all that fun stuff. Let's jump back. So that's the make setup portion. Now the first step that we're gonna talk about here is getting our secret from secrets management. There are two types of secrets. You mentioned it before, we'll clarify here. We have our static secrets, which usually is mapped to KV, right? Where you store, you kinda have to manually rotate them. But Vault has some nice controls around the KV secrets engine. Then we have our dynamic secrets, which Vault will handle the refresh and rotation for you. Vault secrets engines handle both of those. The secrets engine is the concept you can configure and we have different secrets engines that handle both static and dynamic credentials. So first, let's look at one way we can interact with Vault, which is via the API. We have some, we have a root token assigned here and I'm actually using Postman over here, and I have my Vault, this is also linked in the repo as well. So I have Vault here and I'm gonna just use the Vault API to grab these static credentials. I can see I have my password and I have my username. This is static, so these are gonna be the same every time. Now, with my database credentials that we set up in our setup script, we'll go ahead and run this. Creates a username. The last bit there is 4885. And once I call again, it should change that. Yep. So now I call it again and it's 4893. And behind the scenes, that was changed as well in the database, right? And each of these have a specific time to live. So after three minutes, if you actually log into your database, you'll see those users, you'll see them existing. And then Vault, after that time to live is done, we'll go in and clean that up for you. Right. So now, we got our static secret. We did example of the Vault API. Behind the scenes in your organizations, your Vault team will have configured these authentication methods for you. All right, so you have various authentication methods, everything from simple username and password to Kubernetes specific authentication methods, app role for like machine and apps automation. We're not gonna go deep into the authentication method. All of those steps that you would follow all end up kind of resolving down to this token, right? That then you will use to interact with Vault from the perspective of your application. So thinking about the API, and we now kind of mentioned this SDK, in order to interact with Vault, do I need to refactor my app? Do I need to write code that utilizes the SDK heavily? That's the question. Not necessarily, but we're actually gonna show both approaches in this talk. I'm gonna show you how you would do it with the SDK. And then we're gonna show you how that would look to outsource that and use Vault agent as well. So first let's look at the Vault SDK. And we're going to get the dynamic credentials we saw with our Postgres database using this SDK. So I have this code here, which we're gonna jump into the actual code, but this is the portion of the code that matters the most. With the SDK, we get our Vault address. I'm pulling in my Vault address for the environment variable. Then we go ahead and configure our client. Once we have our client, we get this token, right? Now here, for the sake of this demonstration, I'm getting the token from a file, but you don't have to, I was pulling, when I was just using the SDK, I was pulling this MV environment variable, but you just have to get this token initially through one of your authentication methods beforehand. Then I go ahead and set my token, so that the client uses the appropriate token. And then we have this get database credentials function here, which returns our database creds. So let's jump into that function and talk about that. As you can see at the top, and then get database credentials, and actually for this portion, I'm just gonna jump into the code, so we can do that. So here, can you all see that? Let's go down a little bit, yeah, it looks big enough. Let me know if you all can't see it. So as you can see, I take in two things here. I take in the client itself that we configured with the Vault token, and I take in our role name. The role name is key here because the role is what has the policy associated with it to actually give me access to what I need access to. So I have my role name, I have my client token. My token authentication method is also linked via my policy to give me the access I need to read these secrets. Now, if I go down, I'm just simply using this line here to go about reading my secret at a particular path. You'll see this trend within Vault that we track everything by path. So we can define multiple paths like we did with our payment processor, and we did with our database credentials, and have different policies associated to who can access what path. So Vault needs that path to understand location, and then it validates if you actually have access via your authentication to that path. At the end here, because that's the location, we just grab our username and password as well as our lease duration, and then I print this back. Now, for the sake of this demo, this is what I do in the beginning of my app. I actually go out, I grab this, let's look at the main.go, the main.go here. So you can see in the beginning of my main.go I have some environment variables which you'll see also those being configured in our Kubernetes config. And then I assign and create my Vault client here in the beginning. I get the token from this token file. Then I set that token, I do all that stuff here in the beginning of my main function. And then I do the get database credentials here. Now we'll get into why I'm doing this, but I'm doing this just to show, hey, you can do this with SDK, you can do this programmatically, that's all great. But then you run into a couple of challenges. Specifically here, now I also have to do it via some type of interval or monitoring for signal interruption, et cetera, to then refresh or rerun my application at certain intervals because of that expiring of the database credentials. But we're gonna get into that and show you how we handle that later on. At this point, just since we're here, we'll go through and tell you I then use those credentials to create my connection string to my database. And go ahead and use the, I think the SQL, it's the Postgres SQL driver here, to then open it up, open up a connection. I do a simple test and I'm using this config object, which you'll see as currently to kind of track state within my application. So that as I get updates and as we in the future we'll show the live reload that we end up doing using this config to keep track of all that stuff. So to further close, we do go ahead and test the DB with a ping and then we're into using JIN. Now JIN is a basic kind of go-lang web framework, has some benefits. I mean, it's pretty cool. I was messing with it just because I knew I needed to write this app and it actually has been pretty nice. So with JIN, we can define these endpoints. I have a basic health check endpoint. I have this reload endpoint, which I'm not going to show you right now because I'll show you that later. The main thing you need to know is we have our payments get and our payments post. That's the interaction with our database. The get just gets me a list of the payments from a payments table in our database and then I have a post here that actually allows me to submit a payment. Handling that workflow of what we talked about before of submitting to the payments processor and then recording a successful payment. Sweet. So that's kind of the vault SDK approach. I have to write code. I have to write a lot of manual code to handle the refresh of my credentials. If I am using dynamic credentials, I have to handle all those things in my application. That's a lot for a lot of development teams to do. It can become challenging to just maintain all the code that's around your vault situation. Now, some teams want to do that. Some teams like it. Some teams want to take that on and that's why we enable all that functionality. But there are another group of devs that really don't want to have to worry about writing all this code that isn't related to features. They would like to focus more on writing features and outsource the credential management part and rotation part and sync part to something else. This is where Vault Agent comes into play. So now we're going to talk about Vault Agent. Vault Agent runs as a separate process and it gets those secrets, writes it to a file that you've templatized, right? So you write a template, then Vault Agent will go ahead and handle writing that initial token that your app can use so that you can just pull it in. That's why I'm pulling it in as a file if you remember that from earlier. And it also handles at that least duration time or that time to live that we defined every few minutes updating that file. So we talk about this a little bit, but running another process gives a few advantages. We avoid having to add a lot more code around managing our interactions with Vault. It automatically handles all the retries and secret refreshes and it kind of separates the concerns of, hey, this is my application. I would like to focus on writing features too. I need to focus on managing secrets and writing all the code that does that, right? It allows you to more so just focus on things maybe you're more concerned about. The Vault Agent itself comes with the Vault binary. So if you installed Vault via the instructions, you'll already have access to Vault Agent. So what the Agent is doing in this case, let's get more specific to our use case now, is I have the payment processor, which needs a username and password, and I have my database, which needs a username and password. The payment processor, I'm using KV, a static secret. So in this case, it's taking those static secrets and it's writing them to a file so that I have access and can just read in that file in my code. It's using that template we defined and we're gonna go ahead and look at that template when we look at our Kubernetes deployment here in a few minutes. The result of this is nice. Instead of all that code I had to write, which I try to simplify so it wasn't taking too much, that git database credentials function, now all I have to do is read these from a file and it's pretty easy. I don't have to think about as much the Vault logic that I'm writing. So now we're actually gonna get into our Kubernetes config and show how you would configure the Vault agent to handle some of these things. Because outside of Kubernetes, there's actually a vault-agent.htl that you would configure, but inside Kubernetes, you gotta configure Vault agent with annotations. So we're gonna go ahead and discuss some of those annotations and jump into all that fun stuff. Oh, make sure, all right. So let's go ahead and look at that. We're gonna jump into our Kubernetes folder where we're at now and we're gonna look at our applications. Here in our applications folder, we have our payments database and the payment processor and we have our payments app. This is what's linked to the code that I've been showing you, right? Now, hopefully we can have some fun and break some stuff. We'll see, but I wanna show you all some of these annotations and what they mean, right? The first annotation, which is key, is the vault.hashgroup.com slash agent inject, which says I want you to put the agent as a sidecar for my application. Great. Then there's a defined role, which we configured earlier, that we need to give our config so that it makes sure that it's requesting with the right role. Next, we have the agent inject token, which also handles how I'm getting the client token from my app, because it's writing that to a file as well. And then we have the next one, which is the inject secret processor properties. All right. This is where I get to find, and I'll show you the part of the annotation here because it's all in the annotation docs, but let's go through it. So this agent inject secret, everything after that kind of defines what I'm actually going to be injecting. In this case, I'm gonna be injecting the processor dot properties. I supply this annotation with the definition with where it's at in vault, which is our path, the payment secrets data processor. So that's how that kind of breaks down. The next thing I supply is a template. This template is the core annotation and then everything I put after that is what's actually gonna be written. Here we have our template where we're simply, this is a kind of go templating syntax. So the main thing to pay attention to is my username and password here. That's what we're actually gonna be pulling into our application. Now, let's have some fun and break this through. I don't want to tell you about this part yet. This part is where it gets interesting later in the live reload. But I'm actually, just to show you that it is working. I'm gonna delete this. Everything that I just told you for that, the payment processor information is the same for our database properties. So I'll define the same thing. I define the template, I define the path of where to get those database credentials here. And then I have this special annotation that we're gonna save later for our reload. Everything else in here is pretty vanilla, Kubernetes stuff. I also have those environment variables that you see at the bottom, kind of telling my app where those locations of those files are, postgres stuff, all that fun stuff. All right. Now let me handle this rebuild. Let me do this. I'm gonna go ahead and delete my payments app itself. Oh, you guys can see that? Sweet. And now I'm going to run make debug, and I'll show you what that does here in a second to redeploy that bad boy. And hopefully that goes faster than the first time, which it should. All right, so if I show you my make file, all I have in debug is just the building of my Docker container, which is just my go app Docker container. And then I apply that app, wait for the deployment to roll out and handle the port forwarding at the end. So that's already done. Now, before my time runs out here. Oh, see the angle is the challenge here. I plugged it back in. Let's go out and then something's happening. All right, thank you all for that. So now if I go into postman here and I go into my payments app, I should be able to hit my payments application running on port 8081 and get some back, but I didn't get anything back. See, I told you I wanted to break stuff and we successfully broke it. So I feel like this is a win. Now, what I want to do is look at the why to that. So let's look at our pods. kubectl, get pods. All right, we got our app deployment here. No errors. So let's look at these logs. kubectl, logs, boom. Whoa, we got red. Okay, here we go. Got a panic here. This is fun. Now what I'm curious about because I deleted the annotation which I will admit is not something I did before this talk. I was just being brave, but we're gonna go ahead and add that back and see if it does it'll be interesting. But we're gonna see here in a second. All right, so clear out of that. Stop the port forward, handle that delete again. There we go. Do my make debug situation. Debug, all right. That's rebuilding. Now will it happen again? Oh, this is gonna be interesting. It didn't happen again. Okay, I have some ideas as to why that's a thing. And it's because if I look at my logs again, let's look at our logs, kubectl. This will actually probably be a good segue into our live reload. Get pods. Sorry, you guys can hear me breathing on this thing. Looking down at this angle. All right, so I'm gonna do kubectl, logs, boom. Yeah, all right, make this bigger. So a couple things interesting here. And this is gonna lead us into our live reload. But you see I have an endpoint configured to reload. And this is actually what's being called by the vault agent. So that's why we did it, because it tried to trigger a reload, but it didn't work. That's the high level of it. Because I didn't have that command, so I was wondering what the heck it was supposed to do. That leads us into this live reload. So we're airing out before. I handled that, we added the annotation back, that's fine.  We talk about those two types, static and dynamic. This example, we're gonna be talking heavily about the dynamic side. And the vault agent we kind of reviewed is doing the same thing as it was for the parent processor. All it's doing is saying, hey, I have these dynamic credentials I just generated them for you, here they are. Let me write them to that file. And the path to these files, this is just a fun fact and useful if you're doing vault stuff, is slash vault, slash secrets, and then whatever your secret is there. If you want to actually exact into your container as it was going on. So then it handles the rendering of that new file with those credentials.  Your team behind the scenes is probably the one setting up dynamic credentials for you. In reality, they're probably working with the DBA team to make sure the creation statements are right or whatever it is, depending upon the level responsibility that team has, to make sure that the user that's being created has the appropriate permissions. So now let's talk about the application. This is where it is on. So I have my secret, my secret changes because I'm using dynamic credentials. I initially load my app, boom, I have database credentials, fantastic. Then vault agent, because vault agent's awesome, goes out and creates this new file. It creates a new file with my new credentials after they expired in like the few minutes. Cool. Now my application though, has no idea what's going on, is still using that old secret. And this is what we have to address because there was no reload type of operation. And this again, is where you had to handle this a couple different ways, a couple options. One of those options is via interrupt signals. Like you can have an interrupt signal sent to your application, sig in or something like that and have it reloaded, and then you'll get it back, right? Not ideal, I didn't love it. That's why I didn't put in this demo. So I actually have the code for it and I tested it.  The code for that interrupt was handled here. So just you know, spun up a go routine, had a signal channel listening. As soon as I got a control C in this case, I handled a reload of my application. So that's cool, that's fun, that's an option, right? But what I wanna talk about is live reload. Oh, scroll down on my code. This is that endpoint I wasn't telling you all about, okay? So I set up the endpoint instead that is just slash reload, which handles reading those files again and refreshing our application state, which is that higher level config object in this case. And I think I added, no, I said just catconfig.go, but I'll bring it up here. It's pretty simplistic. It was appconfig.go.  And I have a couple scan functions for that file. All right, now this was just me throwing some of the data, don't make fun of my code not being good, because I was getting this done and wrapping this up probably a couple days ago. So great, now if we go back, right? I can see my reload function here. The first thing that you wanna do and kind of any, whether you're getting an interrupt signal or you're handling it via this live reload method, is you want to handle the closing down of those previous connections to your database, kind of like handle all that type of stuff.  Same with handling the sig in. Close those connections here. Like handle all that stuff in this space so that when your app exits or refreshes, you're good. Cause that, oh, there's VIM key bindings. We revealed, I'm sorry, I just had like a very happy nerd moment. There's VIM key bindings. Use the reveal.js, sorry, we're in. So now I'm looking, right? I closed that old connection, which I'm handling in my kind of global config object here. Then I'm refreshing the database properties, which again is at that path slash vault slash secrets database.properties. All right, I read that in. I defer that file close. I scan that file and read it for my username and password. Then I configure my new connection string and handle all that logic I did in my initial main using the SDK here again as well. And then I assign that and refresh my global config with that database connection to be used. So I do that with the processor. I do that with the database. And I also read back in my client token file and set that token here as well. At the end of it, I get this token successfully refreshed. Great. When I got this working, I was really excited. I was very happy about this. Cause now it gives us the ability to do some other fun stuff. But first, we have to configure our vault agent to actually reload our application on our behalf. This is part of the benefit of having an external process managing these things. Cause now I can do interesting stuff like this. So the command I use, which you saw is this, just W get, I'm doing a simple W get. You can do whatever you want here. Everyone can kind of do whatever. One way or another, you can use curl, whatever. You have to call this reload endpoint. Now, a little context on this talk. I'm covering for a colleague of mine and she was using Java Spring, okay? And I refuse to use Java Spring. So we wrote it in Golang and that was part of why this took some time. No hate on Java Spring folks, okay? It's just not me. It's not me. So now I'm here, I'm doing this. But one of the things it had, the real reason I chose, oh, come on. Don't do this. The real reason why I chose this live reload functionality is cause in Java Spring, they have a actuator dash refresh endpoint that literally does the same thing. So like, if you want to handle that in Java Spring, you have to edit a bunch of config files and do all that stuff and enable the actuator and then you don't even know what's going on. That's the thing I don't love about Java Spring is I don't know what's going on half the time. They're just doing magic stuff. So this is what pretty much is doing. It has this endpoint that then live reloads these configuration files, right? Little fun fact for you. Now this is the portion of our annotations. I try to condense it a little bit for us. That is affected by this, okay? So I have my database properties here. That's the same one we saw and this last line, the magic line I was telling you about, is using this agent dash inject command. Let's just open it up in the code because reveal.js is annoying me a little bit. All right, so if I do my, oh, no, that's not right. Open up my payments apps, payment apps, boom. So this here, we have agent dash inject dash command. That part there is the actual base annotation and then we're doing the definition of that which is database.properties. Now I can pass it any command that I want it to run to handle whatever. This is external process awesomeness. Now you can do this with the SDK. You can handle the global refresh of your state. You just have to write all the code to handle that and figure it out on what interval, which again, I would probably recommend if you're gonna do that. Don't like set a time interval, like handle it via the interrupt or whatever. So here we have database properties and I'm passing this wget which calls my reload function and handles all of that stuff. So now we've given enough time and tried to talk long enough for this to actually show now. So now if I look at my kubectl logs again, I wanted to add colors here for you all but it just didn't work out. So you see the username at the beginning which was kind of the username and password for our database. After a few minutes, we got a new username and password because the Vault agent refreshed that file, it automatically called the reload endpoint and now I have as part of my global state this new username and password. And I don't even have to think about it anymore. The live reloads automatically happening behind the scenes while agents taking care of it and I can just focus on writing my application code the way that I want it to be, all right? Sweet, so that worked out. Now beforehand, before I added the annotation I added a bunch of other code being brave, right? Because I have my payments and then I'll submit a payment. I just want to submit a payment just to show you all that it actually works and myself that it actually works. There we go, it's at the bottom there, nice. So here, I submit that payment. I can also manually call the reload if I want to. Let's look back here. It's not what I want to be. All right, anyway, the live reload functionality is kind of I think the direction that you want to go if you have an application team that isn't interested in maintaining their own vault abstractions. That's kind of like the main decision point I'm seeing on teams where they go full SDK or they go vault agent. How much capacity does that particular development team have to manage vault? Because when I was writing vault SDK stuff I ended up adding a lot of abstractions on top of vault. We ended up having this whole company specific vault library that we kind of did some fun stuff with. It's just an organizational decision point that you got to think about. But the vault agent we see in large organizations removes a ton of that friction. All right, so I don't think that was near my hour and a half. I went through pretty quick, so sorry about that. But that's the general synopsis and end. We went through static and dynamic credentials. We went through handling that in our go application. We went through facilitating the refresh of dynamic credentials because that's really where it matters the most. And also being able to handle the static ones as well using an external process. In this case, vault agent. And yeah, we have time. Anyone have any questions? Or thoughts or anything like that? What's up? Yeah, it lives, so there's two pieces of it, right? So I have, I'll show you them here. Specifically within Kubernetes, when you're doing this in Kubernetes, you have the, let's just get pods, vault typing and speaking, difficult. So I have a vault namespace that's here. And when I enter that, I see a vault running, right? And then the second one there, I have the vault agent injector. So this isn't the vault agent directly, but the vault agent injector handles injecting this directly into your pods. Now, to answer your question, but I just want to give you that context, when I do a kubectl, get pods, I see there's two containers here running. So this is where the actual vault agent is running. And if I do kubectl logs here, now scroll up, it's just choosing to give me the payment app because it's kind of seeing that's your app, right? It's not official, like a sidecar, but you can see here that I have payments app running and the vault agent running. And vault agent in it, which just handles some knit stuff. So the vault agent is literally just running as a sidecar to your application. Anyone else got any questions? Capacity in what sense? So I don't have a hard number for you as far as like how much compute it takes up, but I've seen this, the vault agent and vault agent injector workflow running across thousands and thousands of services. So that we haven't had an issue with scale directly, but yeah, I don't know exactly how much compute it would take up. The nice thing is it's pretty low management. That's more so what I think about it from because the compute hasn't been a problem, is whenever I have a sidecar that I bring into my app, I'm like, how much work I gotta do with this sidecar? This is how much maintenance is this thing gonna be? And that with the annotations, once you figure out the vault annotations and just that initial configuration, companies end up usually just kind of templatizing almost that piece of it and giving their app teams different options of how they can consume the vault agent secrets from different application perspectives. So in this case, like with go is like, oh, our go convention is slash secret slash vault, whatever at this folder, this is where it's stored so you know where to go and blah, blah, blah. But yeah, I would say the maintenance is low. Once you figure out that initial config part and then think about the nuances of how you wanna handle that in your apps. That makes sense. Any other questions, thoughts, concerns, feedback? Sweet. All right, I'm good. My name is Gerald. I don't even think I told you all my name, but my name is Gerald. I work at Hashicorp and this was a lot of fun. So I appreciate you all coming through and hopefully see you all around after the talk.