Hi, welcome to Visual Studio Toolbox. I'm your host, Robert Green, and today we're going to talk about containers, and joining me to do that is Aditi Dugar. Hey, everyone. How are you? Good. Thanks for coming on. Thank you. We've done containers a few times in the show. We've had episodes on Docker. We just did as part of the Smart Hotel 360 Series dive on the back-end services, which are all containerized microservices. But what I wanted to do is start from scratch. I'd go back to the beginning, if you will, and talk about what containers are and what some of the tooling is in Visual Studio to help, because there is quite a bit of tooling that helps, and then approach it from a different angle. Not so much the fancy modern microservices, where some are in .NET Core and others are in Java and they're orchestrated in Kubernetes and all that, which is good stuff to know. But what if I'm just somebody who's building and maintaining, has built and is maintaining, right? Classic.NET applications, ASP.NET, web forms or MVC or a WinForms or WPF app that talks to WCF, that talks to a SQL Server, right? Exactly. What do containers have to do with me? Because it turns out the answer is a lot. Yeah, for sure. Yeah, that's a great point. Let's take a look here at what the term modernization actually means and where containers really fits into that. So really, we're talking about here existing apps and services as you were talking about. So applications built with .NET Framework, usually on-prem and we want to make sure that we can move those to the Cloud. Right. Without necessarily having to rewrite it as a .NET Core app. Exactly. Which you can do if you want. But it's not a requirement. No, and there's much easier ways to move it to the Cloud. If you don't want to spend the time rewriting it in .NET Core. So the first option you could do would be to migrate it. So this really means making it Cloud infrastructure ready, which is really just re-hosting in VMs. So here you have, don't code changes, really easy but you use VMs, which is the more traditional route. Right. When we're talking about modernizing, you can do this in a couple of different ways. One is making it Cloud DevOps ready and this is where containers come in. So containers really make it more portable, lightweight, easy to deploy, and more DevOps ready. Here again, minimal, very minimal code changes. So you don't really have to re-architect your app at all. It's really just adding some extra few lines for container support, which is pretty easy to do and I'll go through that in a little bit. Or you could Cloud Optimize your app and that's what you were talking about before with re-writing your app, re-architecting your app into .NET Core, maybe utilizing microservices, but obviously that will require a lot more work. So containers can be more of an easy step in between that. Okay. It's the first step, it may be the only step you need to take. Yeah, exactly. You don't have to go fully to microservices if you don't want to. Okay. Let's take a second and talk a little bit about VMs versus containers, just so people can get a sense of what the differences are between the two. So in a container, what's different is that you're sharing an operating system kernel, and you're really deploying the containers with the binaries, the libraries, and the application, and that's what makes it so lightweight and so portable. Versus a VM, you actually have the operating system for each one. Right. It's called a virtual machine for a reason. It's an entire machine virtualized. So it's everything from the base operating system on up. So they're huge, they require huge amounts of disk space. There's certainly scenarios where that's good, but not exactly portable, not exactly lightweight. The container is, you take the application and all of its dependencies, and that's what's in the container, and then it runs on the operating system which already exists. Exactly. Windows Server or of course, sitting in Windows Server in the Cloud. Yeah. So you could have Linux and Windows. So today we're focusing on Windows just because we're talking about.NET Framework applications. So you'll have to use Windows containers, but you can also have- Get to use Windows containers. Get to use Windows containers, exactly. But if you wrote a.NET Core application and wanted to containerize that you could pick if you want to choose. Windows containers, Linux containers, whatever you actually want to use. Yeah. Linux containers are a little bit more lightweight. They can be faster at the moment. A little bit, they work a little bit better with Kubernetes, although great Windows support is coming. On the other hand, I don't know nothing about Linux. I know a lot about Windows. So there's a benefit to choosing the container that's the operating system you know about. Very true. Very true. So let's go into talking a little bit about Docker, just so people are familiar with Docker. So Docker is basically a container platform provider, and it helps you automate your containerization, so you can easily deploy your apps to some containers. So Microsoft actually has a set of images hosted on Docker that makes this really easy for you. So if you go to Docker Hub here, you can see that Microsoft has published all sorts of images.  So here's where you can find all of the images. And these are starting points. Exactly. Take that image and then you add things to it, like your application or additional functionality that you want to add it. You can start out with a stripped down container and then add more things to it. You could just choose the ASP.NET or the ASP Core image, which already has ASP.NET Core running, and then you can just do nothing more and then put your app into it. And then of course you can make any of the changes you need to it to add functionality or restrict functionality. Right. But you don't have to start from scratch. No, you don't have to start from scratch, which is great. And all of these have documentation associated with them, which is even better because it makes it even easier to get up and run quickly. And they're updated on a fairly regular basis. Correct, definitely. So let's talk first before we go into the demos about why you want to containerize your app. Because it's the cool thing. Everybody is doing it. Exactly. That's the only reason you should do it. So modernization in general can be useful for improving agility, growing your applications, lowering your IT costs. Say you have an on-prem database that you want to move to the cloud. Really, modernization in general is about lowering your total cost of ownership. Containers in particular are useful because, as I mentioned before, you don't have to re-architect your code. So that makes things a little bit easier for you. There's less of a learning curve, less code required. Lower deployment costs improve productivity, improved DevOps agility, and portability, which is what we talked about with containers versus VMs. They also give you some act as kind of a firewall between you and the rest of the machine. So you could have a web app running on a machine that you wrote on .NET 3.5, and you're leaving it there because it works fine. But then people keep making changes to that machine, and new versions come on, or new libraries come in, and now your app is subject to whatever is going on on that machine. So how many times is your app broken because somebody fiddled with the server? Exactly. You stick it in a container, it's fixed. That container runs on that machine, and people can do whatever they want to that machine as long as they don't take away the ability to run a container, and your app will never be affected by that. And if you need to make changes to your app in the container, then you go ahead and do that, whether it's update to a new version of the framework, or apply different patches or whatever, but you get this isolation. That's the word I was looking for. You get an isolation, and the ability to move it around, right? Oh, this machine's going down for three weeks. We're going to replace it with a new machine. Can you get your app up and running on this new machine? Yeah. If you have to then go and install on that machine, I mean, that could be a bit of a nightmare, or you say, yeah, here's the container, run it, done. Easy. Yeah, I mean, another point there is really dev test environments as well. So you hear a lot of people who are like, ah, it worked in testing, worked on my machine, but somehow this just doesn't work in production. Right. That's great. So that probably is also solved. We use this app twice a year, right? Because we have our annual poll, or we have our annual raffle twice a year. So you just want to, you don't necessarily want that app having to run all year. You spin it up when you need it, and you take it down. Containers make it really easy to do that as well. But there's a lot of benefits. Agreed. So let's get into some demos, so I can actually show how this works in Visual Studio. So let's take a look at this first scenario here. So a common scenario might be to have a web application, and this could be an MVC app. This could be a web forms app. And you could containerize this. You could have it talk to a SQL server, also in a container. For the purposes of the first demo, we're just going to stick with containerizing just the MVC portion of the app. You have to put in some additional dependencies in to talk to the SQL server, which I'll show you in the second demo, which is a little bit more complex. But let's start with the basics. All right. So if we go to our legacy MVC app. I love the word legacy. Legacy means existing apps that are running the business today. Exactly, existing line of business applications. Yeah. So I've started this up already, and this is basically an eShop, which has a bunch of different catalog items, and you can manage the catalog from this web app here. So you could create new items, you could edit, delete, do whatever you need to the catalog. Frameworks 3, 5, 4, 4, you know? Probably 4 something, probably 4, 7, I think. Oh, is that recent? It's okay. Yeah, we just made these recently. I think we update them pretty regularly, but it could be older if it needed to be. Doesn't matter what framework version, per se. So as you can see, this is running locally, just on my machine here. So if we go back to the application in Visual Studio, and I wanna add Docker support, all I need to do is right click here and say add. Now before you click that, not that this hasn't happened to me like every day. First of all, you need Docker installed on your local machine, and you need it running. Yes, that's a great point, yeah. So if I had a dollar for every time I either built this project or tried to add Docker support before I had actually started Docker, I could retire. Yeah, that's a really good point. I automatically have it up and running all the time, so I forget that that's a critical step in the process. You can see by this little icon down here, it's up and running. Another point there is that you see here, it says switch to Linux containers, so right now I'm running Windows containers and you have to make sure you're running Windows or Linux containers, whichever one you wanna choose. Okay. So if we go into here and say add Docker support, it's gonna auto generate a few files for us and we can walk through each of them and talk a little bit about what they're doing. So this first is the Docker file and this is basically describing the environment that your app is running in. So the important point here is that it's using this Microsoft ASP net image. Yeah, so this is basically the recipe for how you build this container. Exactly. It says if you haven't already downloaded it to your computer, which can take a while, go to Docker Hub and get this particular image. Windows Server Core version 1709 with ASP.net, 4.7.1, that's pretty new. So go get that file, which is large. It is pretty large. So the first time you run this, it actually takes a little bit of time to download that image and make sure it's on your machine. Once it's already there, unless you delete it, then it's pretty quick to start up. But yeah, the first time it'll be a little bit lengthy. You also have this Docker compose node that was created and this really has all of the assets to build and configure your containers when you actually run it. So you have this Docker compose file here and this is really just saying get that image, that eShop legacy MVC image, and it uses that Docker file that I just showed you for context. And you also have an override file and this is just defining some additional environmental variables to help it run. So for example, exposing port B. So the cool thing, which is why we love Visual Studio, is it wraps all the plumbing for me. You can do this from the command prompt and many, many people do. Or you can right click and have Visual Studio do it for you. Yeah, and the other cool thing is these are all text files. So instead of having to install a bunch of things on your VM, you can just go and make some changes in these text files and it's pretty easy to add dependencies, add new things or configure how you need to. Which is very cool. And you haven't touched the app? Nope, haven't touched the app. The app is exactly the same. All I did was add Docker support. So now if I start up with adding Docker. Oops. I want it to start without debugging. So you can debug into your container if you need to. But for a faster startup, I just started without debugging here. And you can see down here, it's getting these images. It's making sure all the containers are ready. And it'll start up the same web app now at an IP address. So this is the IP address of the container itself. And if that's something that you want to find out later, you can even go to your command prompt say and say first you'd have to find out what the name of the container is. So Docker PS is a good way to do that. So that'll give you all the containers that are currently running on your machine. So once you have that container ID, you can say Docker inspect. And this is gonna give you all that information about the container, including what that IP address is. So you now have this app running in a Docker container locally on your Windows 10 machine. Correct, exactly. Very cool. And it's running at this IP. As you can see, it's the same exact catalog as I showed before. Yep. Talking to SQL server. Not yet. Not yet. For this one, we didn't implement. So if you see the Docker PS, only brings up your one container for this eShop legacy MVC. But if this app was talking to a SQL server, then the container can talk to that machine too. Exactly. Since it's essentially, it's equivalent of a Windows machine running on your network. Yeah. Right. Exactly. And we'll show that in the next example too. So you don't have to do anything with the SQL server. No. No. It'll be in its own container. It'll come down. It doesn't have to be in a container though. You could containerize it. You could just leave it where it is. You could. Exactly. It could be either way. Right. Okay. Cool. That's pretty easy. Yeah. And then another thing you can do is type Docker images. And this is gonna show you that you have that image on your machine. So we have that ASP.NET Core image right here. Mm-hmm. And we also have that eShop legacy MVC. Okay. Right. Which is so the basic image, ASP.NET running on Core, seven and a half gigs. This ASP.NET one is, they take a bit of space. They do take a bit of space. The Windows containers take a bit of space. So if you are sitting there with like 12 gig left on your hard drive, then you're gonna have a hard time running on that machine. If you wanted to delete these images though, you could also do that. And you wouldn't affect things on your machine. So it's pretty simple. There's also a way to, there's a Docker command to take the image and put it in a tar file. Which you could then move to a different computer, wipe all the images off if you needed the disk space. Right. Because you were just playing around with it. And then take the tar file and rehydrate it as images. So I discovered that one a while ago. Yeah. It's pretty cool. That's a good one too. Yeah, I have quite a few images on here just because I play around with this a lot. But I'll probably have to clean them out at some point. Cool. So let's get into the second scenario. Which is a little bit more complex, but pretty similar. So in this one, so you have a three tier scenario. And for this you have a windforms front end. You have a WCF middle tier and a SQL server back end. Okay. So this might be a little bit more traditional, three tier and end tier app that you might have in your line of business application. So this is based on the same eShop example. Again, we go back to Visual Studio. I have this up and running, just so we can show you. It is gorgeous, right? And in 4.7.1, you got the high DPI support, so it doesn't get all crazy. It doesn't get all crazy, yes. So this is a high DPI monitor itself, which is why it looks a little funky here. But if you had a high DPI monitor, it would automatically adjust. Exactly. So we can do the same thing here and right click on this WCF service and say add Docker support. And again, it's gonna auto-generate some files here, but we're gonna have to make some modifications this time. And that's because this is only generating files just for the WCF service, since that's what I right clicked on and added Docker support for. So now I wanna put that SQL server in a container too and say, okay, now we have two containers and I wanna make the service actually talk to the SQL server. So if you're gonna leave it that the WCF service talks to the same SQL server sitting somewhere else, then you wouldn't need to make these additional changes, right? There's a few changes in this base file that you need to make, which is documented on the site for the WCF. The question is, what WCF services does this have? Does it have all of them, right? You need WS transport, WS this, that, the other thing. Exactly. You might need to add some additional things. Yep, so first we're gonna add those additional things just for the WCF portion. And all we're doing here is adding some additional things to make the environment full and this is all documented online and something you have to do when you add the WCF. And you're exposing port 83, that's what that exposes. Yes, it exposes port 83. Got it. And then if we go to the compose file, here's where we're gonna add the dependency on the SQL server. So we'll take this and this now depends on SQL.data and this here is referring to the SQL server image. So now it's gonna pull both that WCF image and the SQL image onto your machine. So again, the first time you run this it's gonna take quite a bit of time because you have to pull both of these images. And on that container, you've got SQL server but you'd have to put your database on and then set up your users and your security the same way you do any SQL server because again, it is a SQL server. Exactly, yeah. The last step is to actually put that connection string info. Oh, you get to do all that in your override file. Oh, that's cool. Yes. So. I thought you'd haul out SQL management studio. No. But it's easier this way. Actually, I can just put it in the text file. So I have my connection string. I have my password here. I have all the credentials here and I'm talking to that port 83 that I exposed. Okay. And that's really just these and additional environmental variables right here. And that's actually it. So even to add support and dependency for the SQL server container, there was a little bit of work but it wasn't re-architecting my code. Yeah, definitely. So I went to my app and changed it all. Now it's all set up to run in Docker. Okay. So let's start Docker. And this one will take a little bit more time just based on the facts that you have these two containers that need to start up. So you started without the debugging which is faster but if you start with the debugging then you actually can set the break points and debug the app while it's running in the container. Yes, yeah, you can do that as well. If that's something that you need to look into. Right. I mean, presumably the app's been tested locally and works just fine but. Hopefully. You never know. You never know. Yeah. It's always useful to have that option. Right. Exactly. And so you can see here we created, what's creating the SQL container now and now it's moving on to the WCF container. You can see in the output here. So if I go back here and I type in Docker PS you'll see that I have, I still have that container from before because I didn't do anything with it but now I have this new SQL container and when the WCF container is done that will show up here as well. Now in the WinForms app you need to point it to the WCF service running somewhere else? No, so I didn't have to make any changes to the WinForms front end. So the WinForms was already talking to the WCF service just locally and you just had to containerize the WCF service and it can still talk to you. But isn't it running on a different host? Yeah. Oh, yes, yes. Okay, that's what you're saying. Yeah, to reset the service reference. Yes, exactly. Point in the web, not the web here, the app config is pointed to a different server. Yes, exactly. Which you can again get by the IP address, right? Exactly. So now we have this starting up here and we have the service. So this is the service itself and exactly we're gonna take this IP address and we're gonna put this into the app config file here. And so right now it had the endpoint as local host because that's what we were talking to before. So this is what you'll replace with the IP address. And... Do you get to assign names or do you always have to use IP address? You have to use IP address, unfortunately. I don't know if there's a way to do it with the ID of the container or not. I haven't looked into that at all, but IP is definitely the easiest way to go. So now if we start... Yep. It's so sterile. It's so not impersonal. It's true. You can't name your container something. Something interesting. So now I've started up an instance of the WinForms front end again and that's gonna be talking to the IP address here. A few seconds. This is so cool because you didn't have to change any of the app. You just had to basically change where the pointer to the service. Exactly. And you... Visual Studio... Obviously you need to learn more about Docker, right? But it's not that hard to learn how to do things. Yeah, exactly. Where the image is. What does it mean? How do you start and stop a container? This is really good documentation on the Docker site. There's inexpensive books you can get. But you've taken this application and containerized it in 20... Well, we talked about 16 minutes, right? That was easy. Yeah. Not counting the time it takes to download the images. Right, yeah. So that would take a little bit more time, sure. Now, so a question I had, we talked about some of the benefits of containers. There's to modernize, to cloud enable these things, you could have taken that NBC app and published it to an Azure web app. You could take this WCF service and publish it to an Azure web app. So talk about when you might do one versus the other. Yeah, I think there's a couple of key points. So the first is about deployment. So as we were talking about before, you don't know what framework version this is running in. And say you publish this to app service and this is running in the latest framework version, but app service doesn't yet support the latest.net framework version. So there's sometimes a gap there. So with containers, that's not an issue because your framework's gonna come with your container and all those dependencies are kind of baked in. In addition to framework, it could be another third party dependency. So a lot of existing line of business applications have things like ComPlus components or other dependencies. And so all of those dependencies are really packaged in for you and you don't have to worry about installing them separately or worrying about them. The second is really to improve DevOps and improve DevTest environments. So you can start up a DevTest environment really easily, like we talked about before. So you can set up your DevTest environment using the container. In this case, you don't have to even install SQL Server on your machine, right?  So- Which would really help if this app was using SQL Server 2010, for example, and we weren't going to touch it, but I've got 2017 on my machine, right? Exactly. And in addition, you could test it into your DevTest environment and you could be a lot more certain that it's actually gonna work in production. So I think those are kind of the key things I would point out. And I guess also, you can run containers locally. You don't need- You don't have to. If they run on a Windows Server, just fine. Yep, you can run them locally. You can deploy them to the cloud if you want to. We obviously, when we talk about containers, we're typically deploying them into Azure for a couple reasons. One, because we also want to talk about Azure. But two, none of us are lugging around Windows Server machines, so it's just a heck of a lot easier to put it in Azure, right? Right, exactly. Yeah, that's actually what we can talk about the next time that we chat. So I think in the next session, we can talk a little bit more about, okay, now we have them running in containers locally, but how do we get this to the cloud? What are all the different ways you can get there? How do you scale out your application? We can talk about orchestrators, which you may have talked about in your microservices episode as well. A little bit, yeah. Yeah, so I think those are kind of the next steps in this scenario. But this is really the basics in the first part of getting towards there. Cool, so this is a good stopping point. And we will pick this up again in the next one. Sounds great. On Visual Studio Toolbox. Bye.


Enjoy and join us, the Soda Brown and Martin de Spang again, on our search for humanity and humility on our Hawaiian islands, especially the one of Oahu, which is our modern, mid-century, modern metropolis, here in the middle of nowhere because we're the most remote from all landmass, but also we can proudly say in the middle of everywhere, especially when it comes to mid-century architecture because we've just been honored by the national symposium of Doco Momo, that movement and initiative that documents and conserves the modern movement. But how do you find this place and how do you find out about this place? And can we bring the first picture up here? This is my personal access to the place because my family business had been published for some very profane, proletarian projects here in both the Wallpaper magazine and the Faden Atlas, both from the UK. And they teamed up, next picture please, to make a travel guide. And as you can see down there in the bottom right, whatever city in the world they think is worth it, they make one. And guess what? We got one. So we were considered to be worth while it. So next picture is a project that is in there. And there's actually a project within that project. And without that project, I wouldn't sit here because that's the place where I first met we amongst the architectural community know as Mr. Easy Breezy. And within Think Tech Hawaii, we know him as the host of one of the longest standing shows, Cold Green. And that's Howard Wick. And our today's guest, Dennis Soioka, thank you Dennis for being here. You will tell us actually about the project within the project, which is your place. So welcome, first of all, to the show. Thank you. And tell us a little bit what that place is. Well, I started the coffee shop in November of 1993. I used to work at a coffee shop in Boyard Warehouse called Coffee Tior back in the 70s. I always wanted to have a coffee shop ever since then. And I first proposed putting a coffee shop in this building when it was a YWCA in 1980. But I didn't get any traction with the YWCA. But ironically, the YWCA invited me back in 1993 to take it over as a turnkey operation. So all the money that I didn't save between my first desire to open a coffee shop and then I didn't really need because it was a turnkey operation. I just had to buy the espresso machine and my coffee machines and my grinders. So I just took it over from 1993 and changed the menu. It was previously vegetarian or vegan on the look of war.  I opened it up to be omnivore and at 27 years in business, that's 27 times longer than anyone's ever managed to keep the coffee line open. And the picture you see up here is actually how you would approach the project. And besides that lady there who might be actually these days, you made a funny comment about how we are more disoriented using these devices in our hands here than the hell. But some people don't quite even know because you talked about the right color competitors in the market where their big signs tell you exactly where the front door is. But in your case, you've got to be a little bit explorative. I don't see bright yellows or reds or orange at my shop. In fact, some people, I get a lot of nice reviews from Google and Yelp. But you'll find the average review of one star. I think they're basically complaining that I'm not a McDonald's. And I'm glad that they don't like me because I don't want to see them again. But the people who do get what I'm doing really appreciate what I do. And they happen to be some of the smartest people at the University of Hawaii. Yeah. And let's go to the next slide. If you come from the right side here, you try to get in from this end, which doesn't really work that well. But the next picture is when you come in from the other side. And you might run into Dennis here, which I did last week, and see you watering your plants there. Yeah. This is the back entry. It's between my building and the pink building, the pink Adirton White. They call it A House for Adirton House. My building is called the Mary Adirton Richard House. And my building was originally a YWCA, but the YMCA bought it in 1995. Yeah. And by the way, preparing for when the show is over, please don't turn off before you saw all the underwriters being mentioned. The Adirton Family Foundation was actually the first one mentioned in that one. So that's a proud supporter of the program. And it's also a proud history of your building here in Ryan. Because there were the clients. Yeah. And your building has a very subtle frontage because it's gray and it's got a lot of plants around it. So it doesn't really, like you said, doesn't have red and yellow and orange to catch your attention. But that's the way you want it. Well, I'm limited because when the building was bought by the YMCA before, in the process of the changeover, all the people from the Department of Planning and Permitting came. And I could tell who they were because they all came up to my counter and they had the same question. And they goes, oh, you have a restaurant over here. And then before they left, they all dropped a bow on me. They said that you can't have a restaurant over here. It's not zone food commercial. And I said, well, if you guys were doing your job, you probably would have known about that. But I think I pissed them off. Yeah, very good. So the YMCA got me a variance to continue to operate my restaurant. But they said, you operate your restaurant, but you can't have a sign and you can't advertise. There is a sign here on the door. But there's a sign. It's a very subtle sign. Yeah. It's more a word of mouth, too. Yeah, the only sign you can see are the directional signs that tell you that there's an entrance here. And in the best tradition of modern buildings, which in contrast to the Victorian ones, which are like you have the big front, which tries to impress you. Once you get through that, you're rather disappointed. Here, I mean, for architectural experts, I mean, the previous slide where they sort of extruded ground reminds of very much of the Alfred Price entrance of the zoo, which has that as well. I think the IWIL building on Atkinson has that same thing. That's a very prominent and it's very hard to do. There's almost no one who can do that anymore these days. And that would work. Try to tell a maze and to do that with luck. But I mean, for the general public, who needs to unfortunately be more than ever educated about what these buildings really are, but once you go through this door, a next picture, please, you are wowed because that's the core, that's the heart of your place. Then it's fine. Yeah, I used to have a lot of plants inside, but all those plants got so big, I had to take them outside. But fortunately during that period, the neighbors palm trees had dropped so many seeds that there were some volunteer palm trees that grow in between their properties. So now it's, I've got more space because I took out all the plants that were occupying the floor space, but I still have the same effect of these plants in between. And this is really indoor-outdoor because you've got an open wall, but you've got walls on the other three sides, as well as a roof. And that's what we call easy breezy. That's what we call easy breezy. When you say most of your customers, guests or fellow Europeans, I mean, that's how we want to live if we come here. If we want to all be hermetic, we can stay home where we come from. It's a nice environment. If people want to listen to music, the foyer, which is just beyond this in this picture, it's got a nice acoustics. And I know how to lay out the speakers so they don't cross each other. So you have a really nice sound in there. Yeah, that would be slide 18 if we can bring this up pretty quick here. Yeah, and there's a ceiling fan up there. So if you go to the next slide, number nine here, we can see this is a superb, prudent place, concrete ceiling, which, you know, trying to do this these days.  And, you know, you can only do this prefab these days. And then the very nice, you know, wooden framework underneath and the most biochromatic device to get the heat out in this very tall ceiling space, right? I mean, this is like environmental systems, 101 demonstrator. Right. Just move it with a fan. Yeah, Hardwick told me that these are the most efficient ways to circulate air because he said that I think they only consume about 10 watts of energy. Oh yeah, it's composed of a whole built-in system. Or even just a floor fan. Oh yeah, really? Those consume a lot of energy. Yeah, yeah, yeah. Absolutely. But besides that, slide number 11, a highlight, if you get one, the next slide after this one here, Wednesday nights are really special at your place. Oh yeah, we have a lamb dinner at the shop every Wednesday night at 7.30. And it actually turns into a salon. This last week we had an actor, two architects, a building superintendent. What else was there? Howard was there. Yeah, Howard was there. Howard was there. Were you there? Yeah, he was there too. Well, he was there. Yeah, there, there's one of the two architects. But it turns into a salon actually. And there's a guy that comes frequently calling more. He always jokes that the kind of gatherings that I have are what a lot of expensive restaurants are trying to do. But we just do it naturally over here. For a lot of things just happen naturally over here. Yeah, well this whole place is grown naturally too. That's one thing we were talking about beforehand. Yeah, and to pour some little bit of water into that wine that we're like to drink there, go to the next slide. There's actually other rooms in the building that are unfortunately not in use anymore, Brian. The YMC is the only other tenant in the building right now. The university bought the building and took over, took possession of the building in August of 2017. However, they didn't get around to telling me who to pay my rent to until about six months ago. And walk us upstairs, Dennis, please. Next slide here. Again, this reminds us to sort of off when we did the U8 shows about these really nice pristine car rails, plain and simple, but perfectly crafted. Couldn't do it these days anymore. The craft is gone. It's also expensive, right? So really you have this. Fine inexpensive building, you wouldn't do it. Absolutely, yeah. So let's walk next slide here. See some very nice detailing here. Simple, but elegant. Let's do this a screen at the top of the stairs. Yeah. And then the next slide is the sort of as Ronald Lindgren calls it, the structural expressionism, right? So there's no ornation, but the structure itself, right? So these nicely tailored concrete beams there. Again, try to do it these days. You can't do it the way this was done. Port in place concrete. There's no way you can pay for that. You got to go prefab out there. And this is a 1959 building. Exactly. So it's a 60-year-old building at this point. Exactly. And go to the next slide, which is also a space you loved and said you wish it would be more in use, right? Yeah, I think this would be a great space for yoga, yoga studio. I mean, I've seen documentaries about yoga in India, and they've had studios like this where you can hear all, I mean, there's a lot of street noise in this space, but it reminds me of the spaces I've seen in documentaries about yoga in India. Because not to misread what might look like windows, there is actually openings with just bug screens in there. Yeah. And you've been telling, everyone talks about resilience and stuff like that, and this building has been riding out several storms. Oh, yeah. Yeah, since the building was built, there's been several hurricanes getting close to the islands, and never has this place ever been flooded. Never in my experience have I seen this place flooded or that dying area that you showed previously. So our feeling is next slide, although there are some indications here where there's a tree growing out of this Paris that's just outside of this space here, where we can say it seems like a demolition by neglection, how you call that.  And you don't get these to be rotting away or so, right? So the substance of this building is really solid.  So I think what we hear, unfortunately, just last week that the university plans to basically bulldoze this building, the next one basically reminds me of my dental experiences with when you have a bad tooth and they try to save it and do a root canal and carve out the core of it and infill it with some stuff. They want to keep the facade and basically, what's the other hall? We say Gartley Hall, right? They did that with Gartley Hall, right? And that's part of the original plot. Which makes our historic colleagues of Don Hibbert and Bill Chapman say, oh my God, you did this in post-modernism. Please don't do it these days, right? So we actually say this building is absolutely a keeper because it's a prime example of tropical modernism, but not as sort of a dead body. But let's go to the next picture. And again, it's alive and kept alive for you. This is, by the way, the space you were talking about before, right? Where you can have good acoustics, right? You can study really well. You said many people have written their dissertations in there. Yeah, there have been books written there and dissertations. And I've been acknowledged in the preface of many of these writings also. There you go for providing the tranquil space, right? And one of the things that we just saw is, unfortunately, it's underutilized. This building is not utilized to the extent that it could be and it deserves to be. It's designed, the current design is a community center. So that's how I mowed my business. I have the only current bolt-in board that you can learn about events around town. There's pencil sharpeners and pens and clocks everywhere because for some reason faculty and students don't seem to carry pencils or pens or clock. So people that get the architecture use it for what it's supposed to be used for. It's basically office space. Dean Sakhamoil, before he moved back from Yale, he was basically using my space as his office space. Yeah, absolutely. Live work, how we call it. Yeah, that's right. Let's go to the next slide and that gets us to the heart of your establishment where the things happen. And this lady here happened to be there and told us this interesting story that, as it's often on the island, that you've got to get off island to really re-appreciate what you had. So she said she grew up in this area, re-closed, but the place wasn't on her radar. It took her to go to Seattle, become a fan of these kind of owner-owned operated coffee shops to come back and say, wow, I actually always had one. And here it is. And now she is a customer, right? I mean, that shows how nondescript, right? That happens a lot.  They've matriculated and moving on, they threw a little party for them. And they bring them to their coffee line. And they say, well, I never knew about this place. And I don't want to tell them that maybe they didn't want to be here because they didn't want to see you here. But for a party, it's a good place. But it's also been, I've also met some famous people here. I met, they brought Stokely Carmichael here to show them that we have a Berkeley S-type coffee shop at the University of Hawaii. And he was impressed with it. And I've also met the Carl Baryshakoff because when the YWCA owned it, they used to have a sprung floor in that multi-purpose room. And that's where he rehearsed before his performance. Oh, very cool. And peeking a little bit closer into your wizard chamber here next slide here, we can see what else delicious you serve. Yeah, that's some chili that I made for the graduate students that, I guess to sober up the graduate students after the TGs that occurs every Friday in front of Marine Science. And I figured that they get so intoxicated, that maybe it's hard for them to find dinner. So I started providing dinner for them after I reopened the shop at seven o'clock so that these people can straggle in and have a real meal. I'm the only place that's open on weekends and at night. On holidays and on Wednesday night, I'm the only place that's open in the area within walking distance of the University of Hawaii. And we have to mention at this point, you're running this pretty much as a non-profit pro bono business, pretty much getting by but not being able to be profitable, right? So when we discussed that you might be pushed out, you always surprised me in that case with saying, well, as sad as it might be, maybe it's good because maybe I finally start all over and make money, right? Yeah, I just do it because I like it. Yeah. And it pays expenses. And it's been some of my retirement plans since I was 35. So I've been basically doing this because I enjoy it. And I considered myself retired after I stopped working for other people. So you think of yourself as retired now, even though you're really not? Yeah, because I can't imagine not working or not doing something. We can't imagine that either, but I'm thinking about how one would translocate, I guess it's a term, if you would move this over to another place. And next slide, myself having had a chance to design with my family business coffee shops, it makes me aware if you couldn't do that with your place because the design, the gestalt is organic. And next slide, we had an interesting discussion because you said to me that people kind of over romanticize or kind of make this sort of nostalgia that each object is scripted and is there for. People adopt me and then they kind of come up with their own narrative of some of the things that I have, of the setting. And a lot of it is fiction, but it's okay. And this one I asked you, and he told me what the author meant with this one, but it also, you told me what it meant for you is keeping the kitchen cool because this is where the sun comes in in the afternoon and you just block the sun with it. The artist is a guy named Bill Feene and he since moved to North Carolina. But I met him one day when I was, I used to meet my girlfriend every Monday in Guamernalo. And he used to live on one of the right of ways to Guamernalo Beach. And that's the first time I met him. And then I met him again when he was selling his Greenbrier which is basically a valiant that's been converted into a van. A van, yeah. Yeah, it's had the same type of motor, similar to a Volkswagen motor. Like it was a copy of the Volkswagen van. Yeah, yeah, yeah. But we became pretty good friends and he had done several shows at my place and this is a picture of his ex-wife before, his ex-wife when she was pregnant with their first child who miscarried. But between the time that the show went up and the time that the show went down, his wife had run off with his kid because they were estranged. And he found himself a girlfriend and there was a retaliation for it. So I said, you probably don't want to take this back with you. Can you please give it to me and put it up here? So to keep the son out of my kitchen. Exactly. And next slide here, awesome story. What's, why were you insisting of having a picture taken of this? Well, the free store is Gay Chan at the art department. That's her idea.  Muse? Yeah, muse. And I don't know if she was referring to the free store idea because my shop is basically furnished with castoffs that I find on the street. And being in the university area, there's a lot of people that move into apartments and houses in the neighborhood and then they leave things when they don't need them anymore. Yeah. And talking off the street, maybe we can get the next slide up here because even in the university area, even as famous people as Bruno Mars, who was living in abandoned homes with his dad, way back there in Manoa, right? And we still have these sort of urban slash suburban nomads here as there's one. And you running a very inclusive management can get the next slide up here. Tell us how you basically constructed your front yard in regard to that. Well, the building has all these possibilities for people to congregate. And what's fun about being practically the sole occupant of the building is that if no one's going to use the space, then I'll take some of the castoffs that I find and create little spaces. The coffee shop is actually the biggest coffee shop you'll find in Honolulu. It has a front. This is a picture of the front entrance.  And it's nice to sit there in the evening and in the evenings. And it's nice to sit there after the sun gets a little higher in the morning. But I don't see very many people taking advantage of that space. So I like to sit there. And do it here that you offer and provide. I like to try to create all these little niches of little spaces that people can occupy. And this is one that's definitely underutilized. I'll have to go sit there. Yeah, you have to go sit there. Okay, I will spot you there. Okay. So let's go to the next slide and we're getting to the end of the show. But we want to make a pitch here. This is us coming Saturday, starting at two o'clock. There is what's a national initiative of Doko Momo. It's called Walking Tourist. So every chapter has that in the United States. Everyone is walking along with Mitzutri Modern Marbles. And we started, which is a sad start because just like we were doing it with the Wart Plaza way back, which soon after that was demolished. And that's maybe why you're hiding this time in your office and not joining. No, you have a better reason. No, I can't come by. I would like to come, but I can't. But we have to, I have to on our behalf talk about the Varsity Building, which is also doomed for demolition. But we don't give up. We walk up the hill and we end pretty much. This is the busher. This is online. It shows only three buildings out of eight or so and yours is part of it. So once again, it's up to this day, a very prominent building. And next slide, this is a little composition, a little potpourri of other pieces of work of the architects who were called Johnson and Perkins. There is this beautiful decade of design publication from the heydays of tropical modernism here from the 60s published by the AIA.  Above you see a very recent one that has been gentrified and remodeled and goes for several millions. And very interesting on the very bottom right is actually a very affordable unit's tower that they designed very early in the 60s. And that gets us to the next slide. These are folks from, you see from the license plate, your license plate collector. So is this a Hawaiian? Is the H for Hawaiian? No, it is not the H. This is a German license plate on the motorcycle on the left and the H stands for Hanover, which is your hometown. That's it. So these, this couple here, Kristin and Stefan Klein-Schmidt, with their Americano, that's why they have Harleys. They have actually turned out to be a blue book, not a yellow book, but this is the original. On the Lulu City Guide. So people like them, culturally interested tourists, have these and they come with the expectation that this very special place is around and stays around. So last slide here. I think if we would get rid of this place, it would make us look, us as UH, which I'm an employee of, would make us look very bad. And we've been talking a lot about if we want to resist progression, you know, and we can't win, right? No, no, no, you can't. There is obviously a demand for other things like student housing, but we have solutions for that, right? Well, the other possibility is too. This is what's come up in the classes that you teach at UH, the Primitivist Projects, which are just theoretical now, but they can be built. They're tall, skinny columns and they're cylindrical. They have a lot of interesting aspects to them. And you're saying, wait a minute, why don't we leave this 1959 building and put in some Primitiva structure there instead of wiping everything out? Yeah, yeah, yeah. Well, there is one on campus. There is a round dormitory. Yeah, there are. Oh, absolutely, yeah. They're like the ancestors of that. They are the evolution of that. So we, why don't you, at the end, please share with the audience what the wallpaper paid and was classified.  Coffee line, the mix of office furniture, saggy 1960s chairs, formica top tables, musical instruments, kitchen appliances, and house plants. A Dennis Sueyoka snack bar is part shabby flat, part campus cool. Think of it more as an extrusion of Sueyoka's mind, the cafe equivalent of the film Being John Malkovich. In addition to excellent coffee, Sueyoka serves up a range of hardy, no-friil sandwiches and vegetarian dishes for which you may have to wait. A fascinating selection of reading material and an interesting crowd will make you want to linger. There we are. That being said, we're at the show with that.  It is. So thank you, Dennis, for having been here and encouraged us for that. And thank you to Soto. It's just very coincidental. They just had that faculty sit-out meeting last week. Exactly. Discussing plans for the movie. So that being said, thank you for watching and look forward to seeing you again for one of our next shows. And until then, please stay very tropical mid-century and also beginning of the next century modern. Bye-bye.


Well, let's get started. So welcome. This is the Art of Kubernetes add-on validation, secure strategies for the modern developer platform. My name is Joaquin Rodriguez. I'm a software engineer at Microsoft. I'm based in Austin, Texas. Welcome. So for today's agenda, we're going to be talking about cluster add-ons. I'll be introducing what they are in case you're not familiar with them. Why validation is important. Some of the validation strategies that you can take and implement. Also, I'll be talking about secure rollouts. And I will conclude today's presentation with a demo. So cluster add-ons, what are they and why do we care? So cluster add-ons are tools, their applications, or services that enhance the functionality of a Kubernetes cluster. They provide essential capabilities that are not included in the core Kubernetes components. So if you think about Kubernetes, we know Kubernetes is great. And if you implement the vanilla cluster, it can just do so much. You need to enhance it. You need to expand it. So that's what cluster add-ons are here for. Customer stations, just like I was saying, they allow you to customize your Kubernetes cluster according to the specific requirement of that cluster. So no, all clusters are the same. Some clusters might have different requirements. So it just really depends on what you're trying to do. Resource management. So add-ons help us manage resources to make sure that everything is running smoothly. And as you were expecting it to be. And also, you're making sure that your resources are not being wasted. So basically, also, you have an add-on ecosystem. So these add-ons are meant to interact. Well, in some cases, they're meant to interact with one another. So when we are validating, we need to check that when you're having these integrations between add-ons, they're working as they're expected. So these are some examples of cluster add-ons. You can group them in different categories, such as monitoring and logging, networking and communication, security and authorization, and storage. I'm kind of curious, by show of hands, who has used any of these? Yeah, pretty much everybody. So that's great. So OK, then why do we need to validate these add-ons? So the first thing is we want them to be compatible, right? So when you deploy these add-ons, you need to make sure that they're compatible with, for example, the Kubernetes version. As Kubernetes progresses, things might change. APIs might change. Things can get just different, right? So you need to make sure that they're compatible. You want to improve security. For example, you want to identify possible vulnerabilities, just to make sure that you're not putting things at risk. Performance, you want to make sure that you're not doing something that is going to exhaust your resources and make the cluster go crazy. Like, for example, if you deploy something with no limits, like CPU or memory limits, that could be an issue. So when we validate, we want to check those type of things. Facilitate upgrades. So sometimes when we want to provision from one cluster to another, let's say going from dev to test, before we do that upgrade, we want to make sure that it's working as expected. So when we validate and we try to upgrade, then we don't have that issue, right? Well, in some cases, we do have issues. But for the best case scenario, we expect it not to have any issues. And of course, each cluster might have its own configuration. And we want to make sure that we're validating against that. So today, I'll be presenting a few strategies to do validation. I just want to see a disclaimer. These are not inclusive. So basically, you can implement them as needed. You don't have to do them all. In some scenarios, you might need one or two. In some, you might need all. So it's really up to you what you're doing and what you're trying to validate. So the first thing is a static code analysis. And then we're going to be checking for HelmChart validation, image validation, validating using policies and rules. And then at the end, we're going to be doing some integration testing using secure rollouts. So let's start with the first one, which is linter validation strategy or static code analysis. So even before we deploy our add-ons into the cluster, we want to make sure that they are correct. And that's why linting helps for this. There's some open source tools that can help you. For example, one of them is KubeLinter. So KubeLinter is awesome. You can run this tool against a YAML. And then it will tell you, for the most part, what's wrong with it, if there's anything wrong with it. So as you can see here with this example, I'm just validating a simple deploy file. And it found some issues. Basically, I'm trying to run as non-rude. I forgot to put my CPU and my memory limits. And it will tell me about that. Other one that is pretty good, KubeConform. It works very similar to KubeLinter. KubeConform validates against the Kubernetes API. And then the other one is KubeScore. When you run KubeScore, it will tell you like a little score on how compliant your YAML is. In terms of which one is better, I don't have the answer to that. It's really up to you to test them out and compare them, depending on whatever needs you have. But the cool thing about these tools is that you can run them as part of your CI flow. So whenever you're doing something with YAMLs or you're trying to validate something, you can integrate these tools in your CI workflow. And then you can basically abort the CI flow if there's an issue. Next thing is HelmChart validation. So this is very useful, especially if you're creating your own add-on. Or if you're importing an add-on from somebody else and you want to make sure that they're working correctly. The first thing is HelmLint. So a lot of people don't know about this, but Helm has a built-in Lint tool that you can run against HelmCharts. And basically, it will tell you if you did a typo or things are not looking as you expected. So it will just tell you, and it's pretty neat. You can also install different plugins. So the first one is Helm unit tests. So just like as if you're writing code, you can write unit tests for your HelmChart. And basically, you can put different checks that you can run against. And then if something fails, it will tell you. And also, just like I was mentioning in the previous slide, KubeConform, you can actually integrate KubeConform as a Helm plugin. And by doing that, what it does, actually, it cannot use its Helm template to transform your Helm chart into a plain YAML. And then it will apply validation towards it. So it's pretty cool. It's pretty, pretty useful. Next thing is container image validation strategy. So again, if you're making your own add-on, or if you're trying to deploy an add-on that already exists, you want to check for vulnerabilities before they make it into the cluster. So there are some pretty cool tools that you can use, such as GRIP or Trivi. They're open source. And basically, what it does is also as part of your CI flow, you can run your images. You can scan your images. And it will report for any vulnerabilities. These tools have different databases that you can really checks for issues. And then it will report you for those issues. And then they're integration-friendly. These tools also can be incorporated into your CI workflow. And they're open source, and they're free. So that's pretty cool. OK, something that is very important to keep in mind. So let's say you already deploy your image into the cluster. And then a few weeks later, your image was known to be vulnerable to some flaw that was discovered somewhere, right? How can you continuously be checking for new issues if this database gets upgraded? You can use Harbor.  And then inside Harbor, you can have plugins that integrate with GRIP or Trivi. And then so if in the future there's a new issue, you can be alerted that, hey, there's a new issue detected in this image. Do something about it. The next strategy is using policies and rules. One of my favorite tools is Kyberno. So basically, Kyberno is a Kubernetes native policy engine that automates validation, or you can do things like mutation, generation of Kubernetes resources, and also you can define policies. You can automate security and compliance. You can enforce pre-defined security standards for clusters add-ons automatically. Real-time validation, the cool thing about this is even before you try to deploy something into a cluster, if that thing that you're trying to deploy invalidates some of your policy, it will basically stop that deployment from happening. So it will say, no, you cannot come in. You cannot deploy that because you're violating this. So don't do it. And just like that also, you can prevent misconfigurations. Again, if you're trying to deploy something that is not compliant to your standards, it will block it. And again, enforce best practices. This is an example that I got from the Kyberno docs. It's pretty useful, and it explains to you how basically Kyberno works, putting in simple terms. So you have a policy, and that policy might have one or more rules. Each rule will match some sort of object. You can think of a namespace, or a deployment, or a label, or something. And either you're going to match that, or you're going to exclude that. And if you do that, then you can do a validation, or you can mutate something, or you can generate something, or you can verify an image. I have an example here of a policy. So basically what this policy is doing is checking for resources of the kind pod. So if you have a pod that is mounting secrets using environment variables, basically it's going to say, no, you cannot do that. You need to mount them as volumes. So therefore, this pod cannot exist. So just providing some context on how Kyberno works, you can do a lot of crazy stuff with it. I have another example in the demo that basically it checks for vcluster secrets. And every time there's a new secret of vcluster in my Kubernetes cluster, it will automatically pick it up and register it in Argo. Yeah, it sounds kind of wicked, but it works really well. My next strategy is validating using rings and secure rollout. So just to explain how this works, so with a ring deployment, you can think about it as faces. So you have a face deployment strategy that breaks down the rollout into different stages from a small control group outwards towards the entire infrastructure. This method reduces risks and allows for thorough check of the site each setup. At each step, sorry. Why reuse ring deployments for Kubernetes add-ons? So first of all, it's safe. It allows for the incremental validation and monitoring to identify and mitigate potential issues early. It reduces the impact of updates or new deployments on production workloads. And also, you can use actually GitOps for using ring deployments. So if you haven't used GitOps, you can use Git as a single source of truth for declarative infrastructure. So basically, your Git repo is the source of truth. And whatever you deploy in there, a GitOps agent, such as Argo or Flux, will pick it up and it will deploy it into your cluster. So how does this work? So the first thing is you have, for example, like a Dev cluster. And you're going to do the initial validation ring. So you're going to do your deployment into this Dev environment. And then once it passes, and make sure that things or the cluster add-on is validated in your Dev cluster, then you're going to move to the next cluster, which is the pre-prod environment. And here, basically, you want your pre-prod to match as close as possible to your production cluster. That way you can do the next phase of deployment. And then you can validate at this level. And if everything is looking good in pre-prod, then you can move into production. And then you can do the testing. Well, you cannot do testing production, but you can make sure that things are working less expected. Now, as a bonus, once you move into pre-prod or production, and then you can use a progressive delivery tool, such as Argo rollouts or Flagger, just to make sure that things are rolling out smoothly. And then you can do rollbacks if needed. And also, instead of just unplugging one thing and playing another thing, you can do it smoothly and doing progressively in these environments. OK, so next, yeah. So today, I'll be doing a demo for progressive delivery of these add-ons across different phases, Dev, test, and production. So let's start with a basic cluster. In this cluster, we can call it a management cluster. And what we're doing here is we're installing Argo. Argo is listening to a configuration repo for my management cluster. And as soon as it does that, it will install a few add-ons. And these add-ons are Grafana, basically so I can see some dashboards that I can check for the integration. Danos for storing my metrics long-term and then Prometheus. Also have an nginx ingress controller for accessing Grafana. And then Argo is going to manage a fleet of clusters. This is a hub-spoke model. You can go many ways around this. I chose this way just for demo purposes, and it's a lot easier to explain. So basically, this Argo instance is managing my dev fleet, my production fleet, and my pre-prod fleet. Of course, when you do this in production, you might do this differently. You might have one Argo instance for dev, one Argo instance for pre-prod, and then another one for production. Or maybe you can have Argo running at each cluster separately. It really up to you. But again, for demo purposes, I'm using this. Then on my dev fleet, I have a few virtual clusters running with different versions of Kubernetes. As you can see here, I have two clusters running version 1.28 and then have another two running 1.27. And then for my pre-prod fleet, I have two virtual clusters, and then I have two AKS clusters. And then my production fleet, it's basically a mirror of my pre-production fleet. And then I have Kiberno with a policy that will enable or disable add-ons across this fleet and I'll show that in a second how that works. And then each cluster will have a version of Prometheus and a version of Pod Info running. And then basically what we're going to do is we're going to be increasing the version of Prometheus and Pod Info across these fleets, dev pre-production and production, just to make sure that they're working as expected. Also something to notice, since I'm using Prometheus and Pod Info as my add-ons, each add-on has its own Git repo. And each Git repo has a branch for each environment. That way I can have a little more control as far as what is that I'm deploying to what cluster. So you might have, I don't know, in my dev clusters running version of Prometheus, I don't know, version 2. And then on pre-production, I have version 1, for example. So by having this type of setup, then I can be taking a look at how things are moving across each environment. And it'll make more sense when I show this during the demo.  So each cluster has Prometheus and is writing back to Thanos. That way I can aggregate all my data and then I can just have a nice dashboard on Grafana that will show me how things are integrating. OK, so for my demo, the first thing I would like to show, I have this Grafana dashboard in which I have my environments already defined. So you can see here dev, pre-prod, and production. And you can see here in dev, I have my four clusters. All of them are running Prometheus version 2.44, and also they're running Pod Info version 6.6.  Well, three of them are version 1.28, and one of them is 1.27. And as you can see here, things are running smoothly. You can see that I have some metrics coming from my app for each cluster. You can track the average request per cluster. So things are working fine. Then if I move into my pre-prod environment, I have two clusters that are already upgraded to version 2.44 for Prometheus and the other two are running the older version, which is 2.42. They're running the same version of Pod Info. And again, there are also different versions of Kubernetes. The ones that have the K3S are virtual clusters, and the ones that don't, they are my AKS clusters. So for my demo, I actually prerecorded it because doing the progressive delivery takes some time, and I didn't want to waste your time, so I just recorded it and cut the waiting periods. OK. So here, again, like I was explaining, we have our pre-prod, and right now, my Prometheus version for all of them are 2.42. And then I'm going to go into my repo that manages the Prometheus add-on, and I am in my pre-prod branch. I have a base customization, and then I have some overlays. So for my East cluster, I'm going to bump the help chart for that Prometheus instance. So I'm replacing it with version 46.0, and then I'm doing the same thing for West, OK?  So now, if you see I have an article instance running, it's going to pick up that change. So it's saying, hey, I found something in my West US2 cluster. Let's sync it up. So it's syncing, and then, oh, the same thing for East. I am going to use the cluster to connect to my East US cluster. And then you can see here that I have my old instance from Prometheus running that was deployed like two days ago. And then you can see the new instance starting to be deployed, OK? And then if I go back to my Grafana chart, now you can see on pre-prod that I have version 2.44 deployed. And now, OK, well, that was the prerecorded part. So I'm going to go back to the live Grafana. So now you can see that they're deployed. I can filter by them. So I'm going to just use the East US and West US2. And you can see now, just by looking at my metrics, that this application is working as I expected. Every 30 seconds, I'm getting a request as I'm expected. And my request duration is very, very low as I'm expected. So I can make sure, oh, sorry. I can validate that this integration between Prometheus and Podinfo is working. The last thing I wanted to show you, if I go into Argo and if I go into Settings, you can see that I have my fleet of clusters defined. And each fleet of clusters have its own labels. These labels, I'm controlling them via Kiberno. But here you can see as an example that I have Prometheus enabled. So if I were to go back to my Kiberno policy and say this is too false, then basically I'm shutting down that add-on, which is pretty powerful if you want to do things across large numbers of fleets. It looks like this. Let me go back. So this is my add-on validation repo. So in this repo, I have everything that controls the management cluster and also the fleet of clusters. So I have my Kiberno policies, one for AKS, one for B cluster. If I open the one on B cluster, then I have one policy per environment, so one for dev, one for pre-production. And then right here, you have the cluster labels. So you can see that I have some add-ons that I have disabled, such as OPA or CERT manager. But I have my PUD info and Prometheus to be enabled. So by doing that, then these labels will be injected into my cluster, into my Argo instance of clusters. And then if I go into workload and I open an app set. So this application set in Argo is the one that is installing the add-ons across all my dev clusters. So I have this rule here. Let me see if I can find it. Basically it's saying, OK, from all the labels that you have in those clusters, let's pick up the ones that are true and are also as part of PUD info and Prometheus. And then I want you to deploy that into my fleet of clusters. And by doing that, basically I have more control if I want to deploy these across my fleet of clusters. And then so once I do that, then you can check at each stage, at each environment, between dev, test, and prod, that if it works on dev, then you can progressively test in the pre-production environment. And if that works, then you can move on to the production environment. OK, so let's go back to my slides. OK, so just to recap, so cluster add-ons are super important and they need to be validated to prevent issues. There are so many strategies to validate these add-ons. The ones that I just presented, there are just a few of them, but there are a lot more out there that you can implement. Also, open source is awesome because you can get a lot of free tools that you can integrate in your workloads. And if you use the right tools, then you can secure your environments. And that will be it. Thank you so much.


In my last video I showed you how I made this mini cyclone dust collector from an old shop bag. And in this video I'm going to show you how I'm going to use it to supercharge my main big dust collector by hooking this one up to that one. Let me show you what I mean. On my table saw I've got it hooked up to my main dust collector through a 4 inch line which hooks to the bottom of the cabinet. And that goes up the wall and across the ceiling and then back down the wall behind the bandsaw and then it hooks up to the main dust collector. And that does a pretty good job at collecting the dust that goes from the blade into the cabinet. There's still some dust though that gets shot off from the top of the blade when making cuts and thrown into the air and in the front. And to capture that dust I designed and built this. This overarm dust collector does a really good job at collecting the rest of the dust that's thrown above the blade and otherwise into the air. With the design of this overarm dust collector it's got a very small dust chamber and it's hooked up to a pretty small dust hose. And that paired with a shot vac makes for a really good dust collection. The only downside with this setup is that I've always got to have my shot vac hooked up to the overarm dust collector. And that means it's always out, always on the floor, the hose is out and the cord is out and they're always just getting in the way. The next logical thing to do is to connect the overarm dust collector right into the main line through a T and another blast gate up there. And just have the main dust collector collect the dust and that way I don't have to have the extra shot vac hooked up. The problem with this setup though is there really just isn't that much suction right where I need it. My big dust collector is what you would call a high volume low pressure dust collector. And by the time the air goes through that 4 inch pipe gets reduced down to the smaller pipe there really isn't a whole lot of air flow left and the pressure was low to begin with. And that just doesn't leave a whole lot of suction right here at the blade. And that's why I made this, a dedicated high pressure high suction machine just for my overarm dust collector. It's nice and small. It's got a mount on the back so that I can screw it to the wall so it's up and out of the way. It's pretty easy to empty the collection bucket. It's got a cyclone chamber to help separate the big chips and the fine dust goes out through the top and since it's made from an old shop vac it's got a ton of suction. Now I could have just added a filter box to the exhaust of this cyclone and then mounted it to the wall and I would have a pretty sweet dust collector for the overarm. But then I got to thinking I've already got a pretty nice filter on my main dust collector.  Then I wouldn't have to deal with a separate filter box for this unit and my main one could do all of the work. So I've got the dust hood hooked up to the mini cyclone and the exhaust on the mini cyclone is now plumbed in through a blast gate into the main line to the main dust collector which is behind the camera. And so what do you think is going to happen?  Or is the mini cyclone going to pump so much air into the big dust collector that the big dust collector is going to run away or its suction somehow is going to be diminished? Let's test it out. The first thing I'm going to do is just turn both systems on and see what happens. So open the blast gate for the main dust collector and open the blast gate for the mini dust collector. And then I've got a remote for each one. So I'll turn on the main dust collector first. So both dust collectors sounded just fine. It didn't sound like one was outrunning the other. The suction at the overarm was really good. Much improved over just running it through the main dust collector line. The four inch hose down here still felt pretty good. It was maybe slightly less than before. Kind of hard to tell but seemed adequate. I've got two tools to help measure the actual performance to see if there is a difference. I've got this anemometer to measure airflow or CFMs of each dust collector and a couple of adapter plates to adapt to each hose size. And then I've got a homemade anemometer which will measure inches of water lift or the static pressure of each system. So I'm going to start by measuring each dust collector individually. And so I will shut the blast gate for the mini dust collector and test just the main dust collector first. And I'll test it at the joint down here. To take measurements for the mini dust collector I've got its blast gate open to the main line. And so it will be exhausting through that main filter. The table saw port is taped off and that just allows the exhaust from the mini dust collector to go through the filter instead of escaping out there. And then the intake hose for the mini dust collector I have upsized it to the same 4 inch line so that the readings will be comparable. For the last set of measurements I've taken the tape off of the table saw port and both blast gates are open. And I'm going to turn on both the main dust collector and the mini dust collector. And I'll take readings at both ports and see if the values have changed. So what did we learn from that testing? Well we confirmed that the main big dust collector is a high volume but pretty low pressure dust collector. And we also confirmed that the mini dust collector is a very high pressure but pretty low volume dust collector. We also learned that the mini dust collector when it's hooked up to the big dust collector maintains essentially the same airflow at the nozzle. But the pressure went up slightly I guess due to the additive pressure from the big dust collector as it's sucking on the little dust collector. What was interesting is that the airflow to the table saw underneath actually went down a little when the mini dust collector was hooked up. And if you think about it that makes a lot of sense. Essentially the main dust collector has an impeller on it that's designed to move a certain amount of air.  And so that means the other input here can't suck as much air as it used to now that there's more air being dumped into the line up here. And that value was essentially subtractive. The amount of airflow at the bottom of the table saw decreased by the amount of airflow that was being generated by the mini dust collector. But since the mini dust collector is a high pressure but low volume system I'm gaining a ton of pressure or supercharging my main dust collector without sacrificing too much airflow from the rest of the system. I'm really happy how this experiment turned out. I can't wait to put it to some more use and see how it performs long term. If you're interested you can watch how I built the mini dust collector in my previous video. Or if you want to build one of these over armed table saw dust collectors for your saw there's a very detailed set of plans available on my website which you can use to follow along and build one for yourself. Thanks for watching, see you in the next one.