➕ Add DMUC advanced exercises

slides/exercises/dmuc-auth-details.md

@@ -0,0 +1,32 @@
+# Exercise — enable auth
+
+- We want to enable authentication and authorization
+
+- Checklist:
+
+  - non-privileged user can deploy in their namespace
+    <br/>(and nowhere else)
+
+  - each controller uses its own key, certificate, and identity
+
+  - each node uses its own key, certificate, and identity
+
+  - Service Accounts work properly
+
+- See next slide for help / hints!
+
+---
+
+## Checklist
+
+- Generate keys, certs, and kubeconfig for everything that needs them
+
+  (cluster admin, cluster user, controller manager, scheduler, kubelet)
+
+- Reconfigure and restart each component to use its new identity
+
+- Turn on `RBAC` and `Node` authorizers on the API server
+
+- Check that everything works properly
+
+  (e.g. that you can create and scale a Deployment using the "cluster user" identity)

slides/exercises/dmuc-networking-details.md

@@ -0,0 +1,51 @@
+# Exercise — networking
+
+- We want to install extra networking components:
+
+  - a CNI configuration
+
+  - kube-proxy
+
+  - CoreDNS
+
+- After doing that, we should be able to deploy a "complex" app
+
+  (with multiple containers communicating together + service discovery)
+
+---
+
+## CNI
+
+- Easy option: Weave
+
+  https://github.com/weaveworks/weave/releases
+
+- Better option: Cilium
+
+  https://docs.cilium.io/en/stable/gettingstarted/k8s-install-default/#install-the-cilium-cli
+
+  or https://docs.cilium.io/en/stable/installation/k8s-install-helm/#installation-using-helm
+
+---
+
+## kube-proxy
+
+- Option 1: author a DaemonSet
+
+- Option 2: leverage the CNI (some CNIs like Cilium can replace kube-proxy)
+
+---
+
+## CoreDNS
+
+- Suggested method: Helm chart
+
+  (available on https://github.com/coredns/helm)
+
+---
+
+## Testing
+
+- Try to deploy DockerCoins and confirm that it works
+
+  (for instance with [this YAML file](https://raw.githubusercontent.com/jpetazzo/container.training/refs/heads/main/k8s/dockercoins.yaml))

slides/exercises/dmuc-staticpods-details.md

@@ -0,0 +1,22 @@
+# Exercise — static pods
+
+- We want to run the control plane in static pods
+
+  (etcd, API server, controller manager, scheduler)
+
+- For Kubernetes components, we can use [these images](https://kubernetes.io/releases/download/#container-images)
+
+- For etcd, we can use [this image](https://quay.io/repository/coreos/etcd?tab=tags)
+
+- If we're using keys, certificates... We can use [hostPath volumes](https://kubernetes.io/docs/concepts/storage/volumes/#hostpath)
+
+---
+
+## Testing
+
+After authoring our static pod manifests and placing them in the right directory,
+we should be able to start our cluster simply by starting kubelet.
+
+(Assuming that the container engine is already running.)
+
+For bonus points: write and enable a systemd unit for kubelet!