From 71ee3012fb9919e3d42df479ca68f4b47f15686c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=A9r=C3=B4me=20Petazzoni?= <jerome.petazzoni@gmail.com>
Date: Mon, 9 Jun 2025 12:36:23 +0200
Subject: [PATCH] =?UTF-8?q?=E2=9E=95=20Add=20DMUC=20advanced=20exercises?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 slides/exercises/dmuc-auth-details.md       | 32 +++++++++++++
 slides/exercises/dmuc-networking-details.md | 51 +++++++++++++++++++++
 slides/exercises/dmuc-staticpods-details.md | 22 +++++++++
 3 files changed, 105 insertions(+)
 create mode 100644 slides/exercises/dmuc-auth-details.md
 create mode 100644 slides/exercises/dmuc-networking-details.md
 create mode 100644 slides/exercises/dmuc-staticpods-details.md

diff --git a/slides/exercises/dmuc-auth-details.md b/slides/exercises/dmuc-auth-details.md
new file mode 100644
index 00000000..73d602c9
--- /dev/null
+++ b/slides/exercises/dmuc-auth-details.md
@@ -0,0 +1,32 @@
+# Exercise — enable auth
+
+- We want to enable authentication and authorization
+
+- Checklist:
+
+  - non-privileged user can deploy in their namespace
+    <br/>(and nowhere else)
+
+  - each controller uses its own key, certificate, and identity
+
+  - each node uses its own key, certificate, and identity
+
+  - Service Accounts work properly
+
+- See next slide for help / hints!
+
+---
+
+## Checklist
+
+- Generate keys, certs, and kubeconfig for everything that needs them
+
+  (cluster admin, cluster user, controller manager, scheduler, kubelet)
+
+- Reconfigure and restart each component to use its new identity
+
+- Turn on `RBAC` and `Node` authorizers on the API server
+
+- Check that everything works properly
+
+  (e.g. that you can create and scale a Deployment using the "cluster user" identity)
diff --git a/slides/exercises/dmuc-networking-details.md b/slides/exercises/dmuc-networking-details.md
new file mode 100644
index 00000000..0a429dff
--- /dev/null
+++ b/slides/exercises/dmuc-networking-details.md
@@ -0,0 +1,51 @@
+# Exercise — networking
+
+- We want to install extra networking components:
+
+  - a CNI configuration
+
+  - kube-proxy
+
+  - CoreDNS
+
+- After doing that, we should be able to deploy a "complex" app
+
+  (with multiple containers communicating together + service discovery)
+
+---
+
+## CNI
+
+- Easy option: Weave
+
+  https://github.com/weaveworks/weave/releases
+
+- Better option: Cilium
+
+  https://docs.cilium.io/en/stable/gettingstarted/k8s-install-default/#install-the-cilium-cli
+
+  or https://docs.cilium.io/en/stable/installation/k8s-install-helm/#installation-using-helm
+
+---
+
+## kube-proxy
+
+- Option 1: author a DaemonSet
+
+- Option 2: leverage the CNI (some CNIs like Cilium can replace kube-proxy)
+
+---
+
+## CoreDNS
+
+- Suggested method: Helm chart
+
+  (available on https://github.com/coredns/helm)
+
+---
+
+## Testing
+
+- Try to deploy DockerCoins and confirm that it works
+
+  (for instance with [this YAML file](https://raw.githubusercontent.com/jpetazzo/container.training/refs/heads/main/k8s/dockercoins.yaml))
diff --git a/slides/exercises/dmuc-staticpods-details.md b/slides/exercises/dmuc-staticpods-details.md
new file mode 100644
index 00000000..beb9a15a
--- /dev/null
+++ b/slides/exercises/dmuc-staticpods-details.md
@@ -0,0 +1,22 @@
+# Exercise — static pods
+
+- We want to run the control plane in static pods
+
+  (etcd, API server, controller manager, scheduler)
+
+- For Kubernetes components, we can use [these images](https://kubernetes.io/releases/download/#container-images)
+
+- For etcd, we can use [this image](https://quay.io/repository/coreos/etcd?tab=tags)
+
+- If we're using keys, certificates... We can use [hostPath volumes](https://kubernetes.io/docs/concepts/storage/volumes/#hostpath)
+
+---
+
+## Testing
+
+After authoring our static pod manifests and placing them in the right directory,
+we should be able to start our cluster simply by starting kubelet.
+
+(Assuming that the container engine is already running.)
+
+For bonus points: write and enable a systemd unit for kubelet!