From 360f74f55580a6c783cbba691e447f519b8920be Mon Sep 17 00:00:00 2001
From: Julien Girardin <julien.girardin@enix.fr>
Date: Tue, 4 Feb 2020 22:47:05 +0100
Subject: [PATCH] Something like last push for day 3

---
 slides/3.yml                         | 24 ++++++-----
 slides/k8s/exercise-opentelemetry.md |  2 +-
 slides/k8s/on-desktop.md             |  4 +-
 slides/k8s/rollout.md                | 59 +++++++++++++++++-----------
 slides/k8s/sealed-secrets.md         | 40 ++++++++++++++++++-
 5 files changed, 90 insertions(+), 39 deletions(-)

diff --git a/slides/3.yml b/slides/3.yml
index 0fc1aa40..49d67773 100644
--- a/slides/3.yml
+++ b/slides/3.yml
@@ -11,6 +11,7 @@ slides: http://2020-02-enix.container.training/
 
 exclude:
 - self-paced
+- hide-exercise
 
 chapters:
 - shared/title.md
@@ -19,29 +20,26 @@ chapters:
 - shared/about-slides.md
 - shared/toc.md
 -
-    # Bien démarrer en local (minikube, kind)
-  # - k8s/kube-coin-intro.md
-   - k8s/software-dev-banalities.md
-   - k8s/on-desktop.md
-   - k8s/namespaces.md
-   - k8s/accessinternal.md
-   - k8s/localkubeconfig.md
-   - k8s/kubectlproxy.md
-   - k8s/testing.md
+  # Bien démarrer en local (minikube, kind)
+  - shared/sampleapp.md
+  - k8s/software-dev-banalities.md
+  - k8s/on-desktop.md
+  - k8s/volumes.md
+  - k8s/namespaces.md
+  - k8s/localkubeconfig.md
+  - k8s/accessinternal.md
+  - k8s/testing.md
 
 -
   - k8s/configuration.md
   - k8s/sealed-secrets.md
-  #- k8s/volumes.md
   - k8s/kustomize.md
   - k8s/helm-intro.md
   - k8s/helm-chart-format.md
-  - k8s/helm-create-basic-chart.md
-  - k8s/helm-create-better-chart.md
   - k8s/helm-secrets.md
 
 -
-  # - k8s/shippingimages.md  # some overlap
+  - k8s/shippingimages.md
   - k8s/registries.md
   - k8s/stop-manual.md
   - k8s/ci-cd.md
diff --git a/slides/k8s/exercise-opentelemetry.md b/slides/k8s/exercise-opentelemetry.md
index dcffaab5..c87bf372 100644
--- a/slides/k8s/exercise-opentelemetry.md
+++ b/slides/k8s/exercise-opentelemetry.md
@@ -1,4 +1,4 @@
-## Exercice - monitor with prometheus
+## Exercice - monitor with opentelemetry
 
 Complete exercise #5, (again code at: https://github.com/enix/kubecoin )
 
diff --git a/slides/k8s/on-desktop.md b/slides/k8s/on-desktop.md
index 649d1830..00289509 100644
--- a/slides/k8s/on-desktop.md
+++ b/slides/k8s/on-desktop.md
@@ -170,9 +170,9 @@ Can we do better?
     - install with pure yaml manifests, kustomize, helm
 
 - Tilt (https://tilt.dev/)
-    - Titfile is programmatic format (python ?)
+    - Tiltfile is programmatic format (python ?)
     - Primitive for building with docker
-    - Primitive for deploying with pure yaml manifestsn kustomize, helm
+    - Primitive for deploying with pure yaml manifests, kustomize, helm
 
 - Garden (https://garden.io/)
 
diff --git a/slides/k8s/rollout.md b/slides/k8s/rollout.md
index 634e5c52..ff67ca2a 100644
--- a/slides/k8s/rollout.md
+++ b/slides/k8s/rollout.md
@@ -79,8 +79,8 @@
 
 - Rolling updates can be monitored with the `kubectl rollout` subcommand
 
-<!--
-/---
+---
+class: hide-exercise
 
 ## Rolling out the new `worker` service
 
@@ -109,7 +109,8 @@
 
 That rollout should be pretty quick. What shows in the web UI?
 
-/---
+---
+class: hide-exercise
 
 ## Give it some time
 
@@ -131,7 +132,8 @@ That rollout should be pretty quick. What shows in the web UI?
 
   (The grace period is 30 seconds, but [can be changed](https://kubernetes.io/docs/concepts/workloads/pods/pod/#termination-of-pods) if needed)
 
-/---
+---
+class: hide-exercise
 
 ## Rolling out something invalid
 
@@ -162,7 +164,8 @@ Our rollout is stuck. However, the app is not dead.
 
 (After a minute, it will stabilize to be 20-25% slower.)
 
-/---
+---
+class: hide-exercise
 
 ## What's going on with our rollout?
 
@@ -182,7 +185,7 @@ Our rollout is stuck. However, the app is not dead.
   <br/>
   but the total number of pods being rolled out is allowed to be 25+25=50%
 
-/---
+---
 
 class: extra-details
 
@@ -202,7 +205,8 @@ class: extra-details
 
 - Our rollout is stuck at this point!
 
-/---
+---
+class: hide-exercise
 
 ## Checking the dashboard during the bad rollout
 
@@ -218,7 +222,8 @@ If you didn't deploy the Kubernetes dashboard earlier, just skip this slide.
 
 ]
 
-/---
+---
+class: hide-exercise
 
 ## Recovering from a bad rollout
 
@@ -240,7 +245,8 @@ If you didn't deploy the Kubernetes dashboard earlier, just skip this slide.
 
 ]
 
-/---
+---
+class: hide-exercise
 
 ## Rolling back to an older version
 
@@ -250,7 +256,8 @@ If you didn't deploy the Kubernetes dashboard earlier, just skip this slide.
 
 - How can we get back to the previous version?
 
-/---
+---
+class: hide-exercise
 
 ## Multiple "undos"
 
@@ -269,7 +276,8 @@ If you didn't deploy the Kubernetes dashboard earlier, just skip this slide.
 
 🤔 That didn't work.
 
-/---
+---
+class: hide-exercise
 
 ## Multiple "undos" don't work
 
@@ -290,7 +298,9 @@ If you didn't deploy the Kubernetes dashboard earlier, just skip this slide.
 
 ]
 
-/---
+---
+
+class: hide-exercise
 
 ## In this specific scenario
 
@@ -300,7 +310,9 @@ If you didn't deploy the Kubernetes dashboard earlier, just skip this slide.
 
 - What if we had changed other parameters in the Pod spec?
 
-/---
+---
+
+class: hide-exercise
 
 ## Listing versions
 
@@ -321,7 +333,8 @@ We might see something like 1, 4, 5.
 
 (Depending on how many "undos" we did before.)
 
-/---
+---
+class: hide-exercise
 
 ## Explaining deployment revisions
 
@@ -338,9 +351,10 @@ We might see something like 1, 4, 5.
 
 ]
 
-/---
+---
 
 class: extra-details
+class: hide-exercise
 
 ## What about the missing revisions?
 
@@ -354,7 +368,8 @@ class: extra-details
 
   (if we wanted to!)
 
-/---
+---
+class: hide-exercise
 
 ## Rolling back to an older version
 
@@ -371,9 +386,10 @@ class: extra-details
 
 ]
 
-/---
+---
 
 class: extra-details
+class: hide-exercise
 
 ## Changing rollout parameters
 
@@ -381,7 +397,7 @@ class: extra-details
 
   - revert to `v0.1`
   - be conservative on availability (always have desired number of available workers)
-  - go slow on rollout speed (update only one pod at a time) 
+  - go slow on rollout speed (update only one pod at a time)
   - give some time to our workers to "warm up" before starting more
 
 The corresponding changes can be expressed in the following YAML snippet:
@@ -402,9 +418,10 @@ spec:
 ```
 ]
 
-/---
+---
 
 class: extra-details
+class: hide-exercise
 
 ## Applying changes through a YAML patch
 
@@ -435,8 +452,6 @@ class: extra-details
   kubectl get deploy -o json worker |
           jq "{name:.metadata.name} + .spec.strategy.rollingUpdate"
   ```
-  ] 
+  ]
 
 ]
-
--->
diff --git a/slides/k8s/sealed-secrets.md b/slides/k8s/sealed-secrets.md
index 7ffd3750..36db8ea0 100644
--- a/slides/k8s/sealed-secrets.md
+++ b/slides/k8s/sealed-secrets.md
@@ -23,12 +23,50 @@
 - since version 0.9 key rotation are enable by default, so remember to backup private keys regularly.
   </br> (or you won't be able to decrypt all you keys, in a case of *disaster recovery*)
 
+
 ---
 
-# Alternative: sops / git crypt
+## First "sealed-secret"
+
+
+.exercise[
+- Install *kubeseal*
+  ```bash
+  wget https://github.com/bitnami-labs/sealed-secrets/releases/download/v0.9.7/kubeseal-linux-amd64 -O kubeseal
+  sudo install -m 755 kubeseal /usr/local/bin/kubeseal
+  ```
+
+- Install controller
+  ```bash
+  helm install -n kube-system stable/sealed-secrets sealed-secrets-controller
+  ```
+
+- Create a secret you don't want to leak
+  ```bash
+  kubectl create secret generic --from-literal=foo=bar my-secret -o yaml --dry-run \
+    | kubeseal > mysecret.yaml
+  kubectl apply -f mysecret.yaml
+  ```
+]
+
+---
+
+## Alternative: sops / git crypt
 
 - You can work a VCS level (ie totally abstracted from kubernetess)
 
 - sops (https://github.com/mozilla/sops), VCS agnostic, encrypt portion of files
 
 - git-crypt that work with git to transparently encrypt (some) files in git
+
+---
+
+## Other alternative
+
+- You can delegate secret management to another component like *hashicorp vault*
+
+- Can work in multiple ways:
+
+   - encrypt secret from API-server (instead of the much secure *base64*)
+   - encrypt secret before sending it in kubernetes (avoid git in plain text)
+   - manager secret entirely in vault and expose to the container via volume