Add VMs and chat URL

compose/kube-router-k8s-control-plane/docker-compose.yaml

@@ -9,21 +9,21 @@ services:
 
   etcd:
     network_mode: "service:pause"
-    image: k8s.gcr.io/etcd:3.4.9
+    image: k8s.gcr.io/etcd:3.4.3
     command: etcd
 
   kube-apiserver:
     network_mode: "service:pause"
-    image: k8s.gcr.io/hyperkube:v1.18.8
+    image: k8s.gcr.io/hyperkube:v1.17.2
     command: kube-apiserver --etcd-servers http://127.0.0.1:2379 --address 0.0.0.0 --disable-admission-plugins=ServiceAccount --allow-privileged
 
   kube-controller-manager:
     network_mode: "service:pause"
-    image: k8s.gcr.io/hyperkube:v1.18.8
+    image: k8s.gcr.io/hyperkube:v1.17.2
     command: kube-controller-manager --master http://localhost:8080 --allocate-node-cidrs --cluster-cidr=10.CLUSTER.0.0/16
     "Edit the CLUSTER placeholder first. Then, remove this line.":
     
   kube-scheduler:
     network_mode: "service:pause"
-    image: k8s.gcr.io/hyperkube:v1.18.8
+    image: k8s.gcr.io/hyperkube:v1.17.2
     command: kube-scheduler --master http://localhost:8080

compose/simple-k8s-control-plane/docker-compose.yaml

@@ -9,20 +9,20 @@ services:
 
   etcd:
     network_mode: "service:pause"
-    image: k8s.gcr.io/etcd:3.4.9
+    image: k8s.gcr.io/etcd:3.4.3
     command: etcd
 
   kube-apiserver:
     network_mode: "service:pause"
-    image: k8s.gcr.io/hyperkube:v1.18.8
+    image: k8s.gcr.io/hyperkube:v1.17.2
     command: kube-apiserver --etcd-servers http://127.0.0.1:2379 --address 0.0.0.0 --disable-admission-plugins=ServiceAccount
 
   kube-controller-manager:
     network_mode: "service:pause"
-    image: k8s.gcr.io/hyperkube:v1.18.8
+    image: k8s.gcr.io/hyperkube:v1.17.2
     command: kube-controller-manager --master http://localhost:8080
     
   kube-scheduler:
     network_mode: "service:pause"
-    image: k8s.gcr.io/hyperkube:v1.18.8
+    image: k8s.gcr.io/hyperkube:v1.17.2
     command: kube-scheduler --master http://localhost:8080

dockercoins/Tiltfile

@@ -1,49 +0,0 @@
-k8s_yaml(blob('''
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  labels:
-    app: registry
-  name: registry
-spec:
-  selector:
-    matchLabels:
-      app: registry
-  template:
-    metadata:
-      labels:
-        app: registry
-    spec:
-      containers:
-      - image: registry
-        name: registry
----
-apiVersion: v1
-kind: Service
-metadata:
-  labels:
-    app: registry
-  name: registry
-spec:
-  ports:
-  - port: 5000
-    protocol: TCP
-    targetPort: 5000
-    nodePort: 30555
-  selector:
-    app: registry
-  type: NodePort
-'''))
-default_registry('localhost:30555')
-docker_build('dockercoins/hasher', 'hasher')
-docker_build('dockercoins/rng', 'rng')
-docker_build('dockercoins/webui', 'webui')
-docker_build('dockercoins/worker', 'worker')
-k8s_yaml('../k8s/dockercoins.yaml')
-
-# Uncomment the following line to let tilt run with the default kubeadm cluster-admin context.
-#allow_k8s_contexts('kubernetes-admin@kubernetes')
-
-# While we're here: if you're controlling a remote cluster, uncomment that line.
-# It will create a port forward so that you can access the remote registry.
-#k8s_resource(workload='registry', port_forwards='30555:5000')

k8s/certbot.yaml

@@ -1,33 +0,0 @@
-kind: Service
-apiVersion: v1
-metadata:
-  name: certbot
-spec:
-  ports:
-  - port: 80
-    protocol: TCP
----
-apiVersion: networking.k8s.io/v1beta1
-kind: Ingress
-metadata:
-  name: certbot
-spec:
-  rules:
-  - http:
-      paths:
-      - path: /.well-known/acme-challenge/
-        backend:
-          serviceName: certbot
-          servicePort: 80
----
-apiVersion: v1
-kind: Endpoints
-metadata:
-  name: certbot
-subsets:
-- addresses:
-  - ip: A.B.C.D
-  ports:
-  - port: 8000
-    protocol: TCP
-

k8s/cm-certificate.yaml

@@ -1,11 +0,0 @@
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: xyz.A.B.C.D.nip.io
-spec:
-  secretName: xyz.A.B.C.D.nip.io
-  dnsNames:
-  - xyz.A.B.C.D.nip.io
-  issuerRef:
-    name: letsencrypt-staging
-    kind: ClusterIssuer

k8s/cm-clusterissuer.yaml

@@ -1,18 +0,0 @@
-apiVersion: cert-manager.io/v1
-kind: ClusterIssuer
-metadata:
-  name: letsencrypt-staging
-spec:
-  acme:
-    # Remember to update this if you use this manifest to obtain real certificates :)
-    email: hello@example.com
-    server: https://acme-staging-v02.api.letsencrypt.org/directory
-    # To use the production environment, use the following line instead:
-    #server: https://acme-v02.api.letsencrypt.org/directory
-    privateKeySecretRef:
-      name: issuer-letsencrypt-staging
-    solvers:
-    - http01:
-        ingress:
-          class: traefik
-

k8s/consul-1.yaml

@@ -1,77 +0,0 @@
-# Basic Consul cluster using Cloud Auto-Join.
-# Caveats:
-# - no actual persistence
-# - scaling down to 1 will break the cluster
-# - pods may be colocated
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: consul
-rules:
-  - apiGroups: [""]
-    resources:
-      - pods
-    verbs:
-      - get
-      - list
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: consul
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: consul
-subjects:
-  - kind: ServiceAccount
-    name: consul
----
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: consul
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: consul
-spec:
-  ports:
-  - port: 8500
-    name: http
-  selector:
-    app: consul
----
-apiVersion: apps/v1
-kind: StatefulSet
-metadata:
-  name: consul
-spec:
-  serviceName: consul
-  replicas: 3
-  selector:
-    matchLabels:
-      app: consul
-  template:
-    metadata:
-      labels:
-        app: consul
-    spec:
-      serviceAccountName: consul
-      containers:
-        - name: consul
-          image: "consul:1.8"
-          env:
-            - name: NAMESPACE
-              valueFrom:
-                fieldRef:
-                  fieldPath: metadata.namespace
-          args:
-            - "agent"
-            - "-bootstrap-expect=3"
-            - "-retry-join=provider=k8s label_selector=\"app=consul\" namespace=\"$(NAMESPACE)\""
-            - "-client=0.0.0.0"
-            - "-data-dir=/consul/data"
-            - "-server"
-            - "-ui"

k8s/consul-3.yaml

@@ -1,104 +0,0 @@
-# Even better Consul cluster.
-# That one uses a volumeClaimTemplate to achieve true persistence.
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: consul
-rules:
-  - apiGroups: [""]
-    resources:
-      - pods
-    verbs:
-      - get
-      - list
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: consul
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: consul
-subjects:
-  - kind: ServiceAccount
-    name: consul
----
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: consul
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: consul
-spec:
-  ports:
-  - port: 8500
-    name: http
-  selector:
-    app: consul
----
-apiVersion: apps/v1
-kind: StatefulSet
-metadata:
-  name: consul
-spec:
-  serviceName: consul
-  replicas: 3
-  selector:
-    matchLabels:
-      app: consul
-  volumeClaimTemplates:
-    - metadata:
-        name: data
-      spec:
-        accessModes:
-          - ReadWriteOnce
-        resources:
-          requests:
-            storage: 1Gi
-  template:
-    metadata:
-      labels:
-        app: consul
-    spec:
-      serviceAccountName: consul
-      affinity:
-        podAntiAffinity:
-          requiredDuringSchedulingIgnoredDuringExecution:
-            - labelSelector:
-                matchExpressions:
-                  - key: app
-                    operator: In
-                    values:
-                      - persistentconsul
-              topologyKey: kubernetes.io/hostname
-      terminationGracePeriodSeconds: 10
-      containers:
-        - name: consul
-          image: "consul:1.8"
-          volumeMounts:
-            - name: data
-              mountPath: /consul/data
-          env:
-            - name: NAMESPACE
-              valueFrom:
-                fieldRef:
-                  fieldPath: metadata.namespace
-          args:
-            - "agent"
-            - "-bootstrap-expect=3"
-            - "-retry-join=provider=k8s label_selector=\"app=consul\" namespace=\"$(NAMESPACE)\""
-            - "-client=0.0.0.0"
-            - "-data-dir=/consul/data"
-            - "-server"
-            - "-ui"
-          lifecycle:
-            preStop:
-              exec:
-                command:
-                - /bin/sh
-                - -c
-                - consul leave

k8s/consul.yaml

@@ -1,9 +1,5 @@
-# Better Consul cluster.
-# There is still no actual persistence, but:
-# - podAntiaffinity prevents pod colocation
-# - clusters works when scaling down to 1 (thanks to lifecycle hook)
 apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
+kind: ClusterRole
 metadata:
   name: consul
 rules:
@@ -15,16 +11,17 @@ rules:
       - list
 ---
 apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
+kind: ClusterRoleBinding
 metadata:
   name: consul
 roleRef:
   apiGroup: rbac.authorization.k8s.io
-  kind: Role
+  kind: ClusterRole
   name: consul
 subjects:
   - kind: ServiceAccount
     name: consul
+    namespace: default
 ---
 apiVersion: v1
 kind: ServiceAccount
@@ -71,16 +68,11 @@ spec:
       terminationGracePeriodSeconds: 10
       containers:
         - name: consul
-          image: "consul:1.8"
-          env:
-            - name: NAMESPACE
-              valueFrom:
-                fieldRef:
-                  fieldPath: metadata.namespace
+          image: "consul:1.6"
           args:
             - "agent"
             - "-bootstrap-expect=3"
-            - "-retry-join=provider=k8s label_selector=\"app=consul\" namespace=\"$(NAMESPACE)\""
+            - "-retry-join=provider=k8s label_selector=\"app=consul\""
             - "-client=0.0.0.0"
             - "-data-dir=/consul/data"
             - "-server"

k8s/dashboard-with-token.yaml

@@ -1,336 +0,0 @@
-# This file is based on the following manifest:
-# https://github.com/kubernetes/dashboard/blob/master/aio/deploy/recommended.yaml
-# It adds a ServiceAccount that has cluster-admin privileges on the cluster,
-# and exposes the dashboard on a NodePort. It makes it easier to do quick demos
-# of the Kubernetes dashboard, without compromising the security too much.
-
-# Copyright 2017 The Kubernetes Authors.
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: kubernetes-dashboard
-
----
-
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  labels:
-    k8s-app: kubernetes-dashboard
-  name: kubernetes-dashboard
-  namespace: kubernetes-dashboard
-
----
-
-kind: Service
-apiVersion: v1
-metadata:
-  labels:
-    k8s-app: kubernetes-dashboard
-  name: kubernetes-dashboard
-  namespace: kubernetes-dashboard
-spec:
-  type: NodePort
-  ports:
-    - port: 443
-      targetPort: 8443
-  selector:
-    k8s-app: kubernetes-dashboard
-
----
-
-apiVersion: v1
-kind: Secret
-metadata:
-  labels:
-    k8s-app: kubernetes-dashboard
-  name: kubernetes-dashboard-certs
-  namespace: kubernetes-dashboard
-type: Opaque
-
----
-
-apiVersion: v1
-kind: Secret
-metadata:
-  labels:
-    k8s-app: kubernetes-dashboard
-  name: kubernetes-dashboard-csrf
-  namespace: kubernetes-dashboard
-type: Opaque
-data:
-  csrf: ""
-
----
-
-apiVersion: v1
-kind: Secret
-metadata:
-  labels:
-    k8s-app: kubernetes-dashboard
-  name: kubernetes-dashboard-key-holder
-  namespace: kubernetes-dashboard
-type: Opaque
-
----
-
-kind: ConfigMap
-apiVersion: v1
-metadata:
-  labels:
-    k8s-app: kubernetes-dashboard
-  name: kubernetes-dashboard-settings
-  namespace: kubernetes-dashboard
-
----
-
-kind: Role
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
-  labels:
-    k8s-app: kubernetes-dashboard
-  name: kubernetes-dashboard
-  namespace: kubernetes-dashboard
-rules:
-  # Allow Dashboard to get, update and delete Dashboard exclusive secrets.
-  - apiGroups: [""]
-    resources: ["secrets"]
-    resourceNames: ["kubernetes-dashboard-key-holder", "kubernetes-dashboard-certs", "kubernetes-dashboard-csrf"]
-    verbs: ["get", "update", "delete"]
-    # Allow Dashboard to get and update 'kubernetes-dashboard-settings' config map.
-  - apiGroups: [""]
-    resources: ["configmaps"]
-    resourceNames: ["kubernetes-dashboard-settings"]
-    verbs: ["get", "update"]
-    # Allow Dashboard to get metrics.
-  - apiGroups: [""]
-    resources: ["services"]
-    resourceNames: ["heapster", "dashboard-metrics-scraper"]
-    verbs: ["proxy"]
-  - apiGroups: [""]
-    resources: ["services/proxy"]
-    resourceNames: ["heapster", "http:heapster:", "https:heapster:", "dashboard-metrics-scraper", "http:dashboard-metrics-scraper"]
-    verbs: ["get"]
-
----
-
-kind: ClusterRole
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
-  labels:
-    k8s-app: kubernetes-dashboard
-  name: kubernetes-dashboard
-rules:
-  # Allow Metrics Scraper to get metrics from the Metrics server
-  - apiGroups: ["metrics.k8s.io"]
-    resources: ["pods", "nodes"]
-    verbs: ["get", "list", "watch"]
-
----
-
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  labels:
-    k8s-app: kubernetes-dashboard
-  name: kubernetes-dashboard
-  namespace: kubernetes-dashboard
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: kubernetes-dashboard
-subjects:
-  - kind: ServiceAccount
-    name: kubernetes-dashboard
-    namespace: kubernetes-dashboard
-
----
-
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: kubernetes-dashboard
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: kubernetes-dashboard
-subjects:
-  - kind: ServiceAccount
-    name: kubernetes-dashboard
-    namespace: kubernetes-dashboard
-
----
-
-kind: Deployment
-apiVersion: apps/v1
-metadata:
-  labels:
-    k8s-app: kubernetes-dashboard
-  name: kubernetes-dashboard
-  namespace: kubernetes-dashboard
-spec:
-  replicas: 1
-  revisionHistoryLimit: 10
-  selector:
-    matchLabels:
-      k8s-app: kubernetes-dashboard
-  template:
-    metadata:
-      labels:
-        k8s-app: kubernetes-dashboard
-    spec:
-      containers:
-        - name: kubernetes-dashboard
-          image: kubernetesui/dashboard:v2.0.0
-          imagePullPolicy: Always
-          ports:
-            - containerPort: 8443
-              protocol: TCP
-          args:
-            - --auto-generate-certificates
-            - --namespace=kubernetes-dashboard
-            # Uncomment the following line to manually specify Kubernetes API server Host
-            # If not specified, Dashboard will attempt to auto discover the API server and connect
-            # to it. Uncomment only if the default does not work.
-            # - --apiserver-host=http://my-address:port
-          volumeMounts:
-            - name: kubernetes-dashboard-certs
-              mountPath: /certs
-              # Create on-disk volume to store exec logs
-            - mountPath: /tmp
-              name: tmp-volume
-          livenessProbe:
-            httpGet:
-              scheme: HTTPS
-              path: /
-              port: 8443
-            initialDelaySeconds: 30
-            timeoutSeconds: 30
-          securityContext:
-            allowPrivilegeEscalation: false
-            readOnlyRootFilesystem: true
-            runAsUser: 1001
-            runAsGroup: 2001
-      volumes:
-        - name: kubernetes-dashboard-certs
-          secret:
-            secretName: kubernetes-dashboard-certs
-        - name: tmp-volume
-          emptyDir: {}
-      serviceAccountName: kubernetes-dashboard
-      nodeSelector:
-        "kubernetes.io/os": linux
-      # Comment the following tolerations if Dashboard must not be deployed on master
-      tolerations:
-        - key: node-role.kubernetes.io/master
-          effect: NoSchedule
-
----
-
-kind: Service
-apiVersion: v1
-metadata:
-  labels:
-    k8s-app: dashboard-metrics-scraper
-  name: dashboard-metrics-scraper
-  namespace: kubernetes-dashboard
-spec:
-  ports:
-    - port: 8000
-      targetPort: 8000
-  selector:
-    k8s-app: dashboard-metrics-scraper
-
----
-
-kind: Deployment
-apiVersion: apps/v1
-metadata:
-  labels:
-    k8s-app: dashboard-metrics-scraper
-  name: dashboard-metrics-scraper
-  namespace: kubernetes-dashboard
-spec:
-  replicas: 1
-  revisionHistoryLimit: 10
-  selector:
-    matchLabels:
-      k8s-app: dashboard-metrics-scraper
-  template:
-    metadata:
-      labels:
-        k8s-app: dashboard-metrics-scraper
-      annotations:
-        seccomp.security.alpha.kubernetes.io/pod: 'runtime/default'
-    spec:
-      containers:
-        - name: dashboard-metrics-scraper
-          image: kubernetesui/metrics-scraper:v1.0.4
-          ports:
-            - containerPort: 8000
-              protocol: TCP
-          livenessProbe:
-            httpGet:
-              scheme: HTTP
-              path: /
-              port: 8000
-            initialDelaySeconds: 30
-            timeoutSeconds: 30
-          volumeMounts:
-          - mountPath: /tmp
-            name: tmp-volume
-          securityContext:
-            allowPrivilegeEscalation: false
-            readOnlyRootFilesystem: true
-            runAsUser: 1001
-            runAsGroup: 2001
-      serviceAccountName: kubernetes-dashboard
-      nodeSelector:
-        "kubernetes.io/os": linux
-      # Comment the following tolerations if Dashboard must not be deployed on master
-      tolerations:
-        - key: node-role.kubernetes.io/master
-          effect: NoSchedule
-      volumes:
-        - name: tmp-volume
-          emptyDir: {}
-
----
-
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  labels:
-    k8s-app: kubernetes-dashboard
-  name: cluster-admin
-  namespace: kubernetes-dashboard
-
----
-
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  labels:
-    k8s-app: kubernetes-dashboard
-  name: kubernetes-dashboard-cluster-admin
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: cluster-admin
-subjects:
-- kind: ServiceAccount
-  name: cluster-admin
-  namespace: kubernetes-dashboard

k8s/event-node.yaml

@@ -1,30 +0,0 @@
-kind: Event
-apiVersion: v1
-metadata:
-  generateName: hello-
-  labels:
-    container.training/test: ""
-
-#eventTime: "2020-07-04T00:00:00.000000Z"
-#firstTimestamp: "2020-01-01T00:00:00.000000Z"
-#lastTimestamp: "2020-12-31T00:00:00.000000Z"
-#count: 42
-
-involvedObject:
-  kind: Node
-  apiVersion: v1
-  name: kind-control-plane
-  # Note: the uid should be the Node name (not the uid of the Node).
-  # This might be specific to global objects.
-  uid: kind-control-plane
-
-type: Warning
-reason: NodeOverheat
-message: "Node temperature exceeds critical threshold"
-action: Hello
-source:
-  component: thermal-probe
-  #host: node1
-#reportingComponent: ""
-#reportingInstance: ""
-

k8s/event-pod.yaml

@@ -1,36 +0,0 @@
-kind: Event
-apiVersion: v1
-metadata:
-  # One convention is to use <objectname>.<timestamp>,
-  # where the timestamp is taken with a nanosecond
-  # precision and expressed in hexadecimal.
-  # Example: web-5dcb957ccc-fjvzc.164689730a36ec3d
-  name: hello.1234567890
-  # The label doesn't serve any purpose, except making
-  # it easier to identify or delete that specific event.
-  labels:
-    container.training/test: ""
-
-#eventTime: "2020-07-04T00:00:00.000000Z"
-#firstTimestamp: "2020-01-01T00:00:00.000000Z"
-#lastTimestamp: "2020-12-31T00:00:00.000000Z"
-#count: 42
-
-involvedObject:
-  ### These 5 lines should be updated to refer to an object.
-  ### Make sure to put the correct "uid", because it is what
-  ### "kubectl describe" is using to gather relevant events.
-  #apiVersion: v1
-  #kind: Pod
-  #name: magic-bean
-  #namespace: blue
-  #uid: 7f28fda8-6ef4-4580-8d87-b55721fcfc30
-
-type: Normal
-reason: BackupSuccessful
-message: "Object successfully dumped to gitops repository"
-source:
-  component: gitops-sync
-#reportingComponent: ""
-#reportingInstance: ""
-

k8s/hacktheplanet.yaml

@@ -27,7 +27,7 @@ spec:
         command:
         - sh
         - -c
-        - "mkdir -p /root/.ssh && apk update && apk add curl && curl https://github.com/jpetazzo.keys > /root/.ssh/authorized_keys"
+        - "apk update && apk add curl && curl https://github.com/jpetazzo.keys > /root/.ssh/authorized_keys"
       containers:
       - name: web
         image: nginx

k8s/hpa-v2-pa-httplat.yaml

@@ -1,29 +0,0 @@
-kind: HorizontalPodAutoscaler
-apiVersion: autoscaling/v2beta2
-metadata:
-  name: rng
-spec:
-  scaleTargetRef:
-    apiVersion: apps/v1
-    kind: Deployment
-    name: rng
-  minReplicas: 1
-  maxReplicas: 20
-  behavior:
-    scaleUp:
-        stabilizationWindowSeconds: 60
-    scaleDown:
-        stabilizationWindowSeconds: 180
-  metrics:
-  - type: Object
-    object:
-      describedObject:
-        apiVersion: v1
-        kind: Service
-        name: httplat
-      metric:
-        name: httplat_latency_seconds
-      target:
-        type: Value
-        value: 0.1
-

k8s/ingress.yaml

@@ -3,10 +3,6 @@ kind: Ingress
 metadata:
   name: whatever
 spec:
-  #tls:
-  #- secretName: whatever.A.B.C.D.nip.io
-  #  hosts:
-  #  - whatever.A.B.C.D.nip.io
   rules:
   - host: whatever.A.B.C.D.nip.io
     http:

k8s/kyverno-namespace-setup.yaml

@@ -1,63 +0,0 @@
-apiVersion: kyverno.io/v1
-kind: ClusterPolicy
-metadata:
-  name: setup-namespace
-spec:
-  rules:
-  - name: setup-limitrange
-    match:
-      resources: 
-        kinds:
-        - Namespace
-    generate: 
-      kind: LimitRange
-      name: default-limitrange
-      namespace: "{{request.object.metadata.name}}" 
-      data:
-        spec:
-          limits:
-          - type: Container
-            min:
-              cpu: 0.1
-              memory: 0.1
-            max:
-              cpu: 2
-              memory: 2Gi
-            default:
-              cpu: 0.25
-              memory: 500Mi
-            defaultRequest:
-              cpu: 0.25
-              memory: 250Mi
-  - name: setup-resourcequota
-    match:
-      resources: 
-        kinds:
-        - Namespace
-    generate: 
-      kind: ResourceQuota
-      name: default-resourcequota
-      namespace: "{{request.object.metadata.name}}" 
-      data:
-        spec:
-          hard:
-            requests.cpu: "10"
-            requests.memory: 10Gi
-            limits.cpu: "20"
-            limits.memory: 20Gi
-  - name: setup-networkpolicy
-    match:
-      resources: 
-        kinds:
-        - Namespace
-    generate: 
-      kind: NetworkPolicy
-      name: default-networkpolicy
-      namespace: "{{request.object.metadata.name}}" 
-      data:
-        spec:
-          podSelector: {}
-          ingress:
-          - from:
-            - podSelector: {}
-

k8s/kyverno-pod-color-1.yaml

@@ -1,22 +0,0 @@
-apiVersion: kyverno.io/v1
-kind: ClusterPolicy
-metadata:
-  name: pod-color-policy-1
-spec:
-  validationFailureAction: enforce
-  rules:
-  - name: ensure-pod-color-is-valid
-    match:
-      resources:
-        kinds:
-        - Pod
-        selector:
-          matchExpressions:
-          - key: color
-            operator: Exists
-          - key: color
-            operator: NotIn
-            values: [ red, green, blue ]
-    validate:
-      message: "If it exists, the label color must be red, green, or blue."
-      deny: {}

k8s/kyverno-pod-color-2.yaml

@@ -1,21 +0,0 @@
-apiVersion: kyverno.io/v1
-kind: ClusterPolicy
-metadata:
-  name: pod-color-policy-2
-spec:
-  validationFailureAction: enforce
-  background: false
-  rules:
-  - name: prevent-color-change
-    match:
-      resources:
-        kinds:
-        - Pod
-    validate:
-      message: "Once label color has been added, it cannot be changed."
-      deny:
-        conditions:
-        - key: "{{ request.oldObject.metadata.labels.color }}"
-          operator: NotEqual
-          value: "{{ request.object.metadata.labels.color }}"
-

k8s/kyverno-pod-color-3.yaml

@@ -1,25 +0,0 @@
-apiVersion: kyverno.io/v1
-kind: ClusterPolicy
-metadata:
-  name: pod-color-policy-3
-spec:
-  validationFailureAction: enforce
-  background: false
-  rules:
-  - name: prevent-color-removal
-    match:
-      resources:
-        kinds:
-        - Pod
-        selector:
-          matchExpressions:
-          - key: color
-            operator: DoesNotExist
-    validate:
-      message: "Once label color has been added, it cannot be removed."
-      deny:
-        conditions:
-        - key: "{{ request.oldObject.metadata.labels.color }}"
-          operator: NotIn
-          value: []
-

k8s/psp-restricted.yaml

@@ -5,8 +5,8 @@ metadata:
   annotations:
     apparmor.security.beta.kubernetes.io/allowedProfileNames: runtime/default
     apparmor.security.beta.kubernetes.io/defaultProfileName: runtime/default
-    seccomp.security.alpha.kubernetes.io/allowedProfileNames: runtime/default
-    seccomp.security.alpha.kubernetes.io/defaultProfileName: runtime/default
+    seccomp.security.alpha.kubernetes.io/allowedProfileNames: docker/default
+    seccomp.security.alpha.kubernetes.io/defaultProfileName: docker/default
   name: restricted
 spec:
   allowPrivilegeEscalation: false

k8s/test.yaml

@@ -1,17 +0,0 @@
-apiVersion: extensions/v1beta1
-kind: Ingress
-metadata:
-  name: whatever
-spec:
-  #tls:
-  #- secretName: whatever.A.B.C.D.nip.io
-  #  hosts:
-  #  - whatever.A.B.C.D.nip.io
-  rules:
-  - host: whatever.nip.io
-    http:
-      paths:
-      - path: /
-        backend:
-          serviceName: whatever
-          servicePort: 1234

k8s/traefik-v2.yaml

@@ -50,10 +50,8 @@ spec:
         - --api.insecure
         - --log.level=INFO
         - --metrics.prometheus
+        - --providers.kubernetescrd
         - --providers.kubernetesingress
-        - --entrypoints.http.Address=:80
-        - --entrypoints.https.Address=:443
-        - --entrypoints.https.http.tls.certResolver=default
 ---
 kind: Service
 apiVersion: v1
@@ -98,15 +96,6 @@ rules:
       - get
       - list
       - watch
-  - apiGroups:
-      - networking.k8s.io
-    resources:
-      - ingresses
-      - ingressclasses
-    verbs:
-      - get
-      - list
-      - watch
 ---
 kind: ClusterRoleBinding
 apiVersion: rbac.authorization.k8s.io/v1beta1

k8s/traefik.yaml

@@ -1 +1 @@
-traefik-v2.yaml
+traefik-v1.yaml

prepare-eks/10_create_cluster.sh

@@ -1,13 +0,0 @@
-#!/bin/sh
-# Create an EKS cluster.
-# This is not idempotent (each time you run it, it creates a new cluster).
-
-eksctl create cluster \
-    --node-type=t3.large \
-    --nodes-max=10 \
-    --alb-ingress-access \
-    --asg-access \
-    --ssh-access \
-    --with-oidc \
-    #
-

prepare-eks/20_create_users.sh

@@ -1,32 +0,0 @@
-#!/bin/sh
-# For each user listed in "users.txt", create an IAM user.
-# Also create AWS API access keys, and store them in "users.keys".
-# This is idempotent (you can run it multiple times, it will only
-# create the missing users). However, it will not remove users.
-# Note that you can remove users from "users.keys" (or even wipe
-# that file out entirely) and then this script will delete their
-# keys and generate new keys for them (and add the new keys to
-# "users.keys".)
-
-echo "Getting list of existing users ..."
-aws iam list-users --output json | jq -r .Users[].UserName > users.tmp
-
-for U in $(cat users.txt); do
-    if ! grep -qw $U users.tmp; then
-        echo "Creating user $U..."
-        aws iam create-user --user-name=$U \
-            --tags=Key=container.training,Value=1
-    fi
-    if ! grep -qw $U users.keys; then
-        echo "Listing keys for user $U..."
-        KEYS=$(aws iam list-access-keys --user=$U | jq -r .AccessKeyMetadata[].AccessKeyId)
-        for KEY in $KEYS; do
-            echo "Deleting key $KEY for user $U..."
-            aws iam delete-access-key --user=$U --access-key-id=$KEY
-        done
-        echo "Creating access key for user $U..."
-        aws iam create-access-key --user=$U --output json \
-          | jq -r '.AccessKey | [ .UserName, .AccessKeyId, .SecretAccessKey ] | @tsv' \
-          >> users.keys
-    fi
-done

prepare-eks/30_create_or_update_policy.sh

@@ -1,51 +0,0 @@
-#!/bin/sh
-# Create an IAM policy to authorize users to do "aws eks update-kubeconfig".
-# This is idempotent, which allows to update the policy document below if
-# you want the users to do other things as well.
-# Note that each time you run this script, it will actually create a new
-# version of the policy, set that version as the default version, and
-# remove all non-default versions. (Because you can only have up to
-# 5 versions of a given policy, so you need to clean them up.)
-# After running that script, you will want to attach the policy to our
-# users (check the other scripts in that directory).
-
-POLICY_NAME=user.container.training
-POLICY_DOC='{
-    "Version": "2012-10-17",
-    "Statement": [
-        {
-            "Action": [
-                "eks:DescribeCluster"
-            ],
-            "Resource": "arn:aws:eks:*",
-            "Effect": "Allow"
-        }
-    ]
-}'
-
-ACCOUNT=$(aws sts get-caller-identity | jq -r .Account)
-
-aws iam create-policy-version \
-  --policy-arn arn:aws:iam::$ACCOUNT:policy/$POLICY_NAME \
-  --policy-document "$POLICY_DOC" \
-  --set-as-default
-
-# For reference, the command below creates a policy without versioning:
-#aws iam create-policy \
-#--policy-name user.container.training \
-#--policy-document "$JSON"
-
-for VERSION in $(
-  aws iam list-policy-versions \
-    --policy-arn arn:aws:iam::$ACCOUNT:policy/$POLICY_NAME \
-    --query 'Versions[?!IsDefaultVersion].VersionId' \
-    --output text)
-do
-  aws iam delete-policy-version \
-    --policy-arn arn:aws:iam::$ACCOUNT:policy/$POLICY_NAME \
-    --version-id "$VERSION"
-done
-
-# For reference, the command below shows all users using the policy:
-#aws iam list-entities-for-policy \
-#--policy-arn arn:aws:iam::$ACCOUNT:policy/$POLICY_NAME

prepare-eks/40_attach_policy.sh

@@ -1,14 +0,0 @@
-#!/bin/sh
-# Attach our user policy to all the users defined in "users.txt".
-# This should be idempotent, because attaching the same policy
-# to the same user multiple times doesn't do anything.
-
-ACCOUNT=$(aws sts get-caller-identity | jq -r .Account)
-POLICY_NAME=user.container.training
-
-for U in $(cat users.txt); do
-  echo "Attaching policy to user $U ..."
-  aws iam attach-user-policy \
-    --user-name $U \
-    --policy-arn arn:aws:iam::$ACCOUNT:policy/$POLICY_NAME
-done

prepare-eks/50_aws_auth.sh

@@ -1,24 +0,0 @@
-#!/bin/sh
-# Update the aws-auth ConfigMap to map our IAM users to Kubernetes users.
-# Each user defined in "users.txt" will be mapped to a Kubernetes user
-# with the same name, and put in the "container.training" group, too.
-# This is idempotent.
-# WARNING: this will wipe out the mapUsers component of the aws-auth
-# ConfigMap, removing all users that aren't in "users.txt".
-# It won't touch mapRoles, so it shouldn't break the role mappings
-# put in place by EKS.
-
-ACCOUNT=$(aws sts get-caller-identity | jq -r .Account)
-
-rm -f users.map
-for U in $(cat users.txt); do
-echo "\
-- userarn: arn:aws:iam::$ACCOUNT:user/$U
-  username: $U
-  groups: [ container.training ]\
-" >> users.map
-done
-
-kubectl create --namespace=kube-system configmap aws-auth \
-  --dry-run=client --from-file=mapUsers=users.map -o yaml \
-  | kubectl apply -f-

prepare-eks/60_setup_rbac_and_ns.sh

@@ -1,65 +0,0 @@
-#!/bin/sh
-# Create a shared Kubernetes Namespace ("container-training") as well as
-# individual namespaces for every user in "users.txt", and set up a bunch
-# of permissions.
-# Specifically:
-# - each user gets "view" permissions in the "default" Namespace
-# - each user gets "edit" permissions in the "container-training" Namespace
-# - each user gets permissions to list Nodes and Namespaces
-# - each user gets "admin" permissions in their personal Namespace
-# Note that since Kubernetes Namespaces can't have dots in their names,
-# if a user has dots, dots will be mapped to dashes.
-# So user "ada.lovelace" will get namespace "ada-lovelace".
-# This is kind of idempotent (but will raise a bunch of errors for objects
-# that already exist).
-# TODO: if this needs to evolve, replace all the "create" operations by
-# "apply" operations. But this is good enough for now.
-
-kubectl create rolebinding --namespace default container.training \
-  --group=container.training --clusterrole=view
-
-kubectl create clusterrole view-nodes \
-  --verb=get,list,watch --resource=node
-kubectl create clusterrolebinding view-nodes \
-  --group=container.training --clusterrole=view-nodes
-
-kubectl create clusterrole view-namespaces \
-  --verb=get,list,watch --resource=namespace
-kubectl create clusterrolebinding view-namespaces \
-  --group=container.training --clusterrole=view-namespaces
-
-kubectl create namespace container-training
-kubectl create rolebinding --namespace container-training edit \
-  --group=container.training --clusterrole=edit
-
-# Note: API calls to EKS tend to be fairly slow. To optimize things a bit,
-# instead of running "kubectl" N times, we generate a bunch of YAML and
-# apply it. It will still generate a lot of API calls but it's much faster
-# than calling "kubectl" N times. It might be possible to make this even
-# faster by generating a "kind: List" (I don't know if this would issue
-# a single API calls or multiple ones; TBD!)
-for U in $(cat users.txt); do
-  NS=$(echo $U | tr . -)
-  cat <<EOF
----
-kind: Namespace
-apiVersion: v1
-metadata:
-  name: $NS
----
-kind: RoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
-  name: admin
-  namespace: $NS
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: admin
-subjects:
-- apiGroup: rbac.authorization.k8s.io
-  kind: User
-  name: $U
-EOF
-done | kubectl create -f-
-

prepare-eks/70_oidc.sh

@@ -1,76 +0,0 @@
-#!/bin/sh
-# Create an IAM role to be used by a Kubernetes ServiceAccount.
-# The role isn't given any permissions yet (this has to be done by
-# another script in this series), but a properly configured Pod
-# should still be able to execute "aws sts get-caller-identity"
-# and confirm that it's using that role.
-# This requires the cluster to have an attached OIDC provider.
-# This should be the case if the cluster has been created with
-# the scripts in this directory; otherwise, this can be done with
-# the subsequent command, which is idempotent:
-# eksctl utils associate-iam-oidc-provider --cluster cluster-name-12341234 --approve
-# The policy document used below will authorize all ServiceAccounts
-# in the "container-training" Namespace to use that role.
-# This script will also annotate the container-training:default
-# ServiceAccount so that it can use that role.
-# This script is not quite idempotent: if you want to use a new
-# trust policy, some work will be required. (You can delete the role,
-# but that requires detaching the associated policies. There might also
-# be a way to update the trust policy directly; we didn't investigate this
-# further at this point.)
-
-if [ "$1" ]; then
-    CLUSTER="$1"
-else
-    echo "Please indicate cluster to use. Available clusters:"
-    aws eks list-clusters --output table
-    exit 1
-fi
-
-ACCOUNT=$(aws sts get-caller-identity | jq -r .Account)
-OIDC=$(aws eks describe-cluster --name $CLUSTER --query cluster.identity.oidc.issuer --output text | cut -d/ -f3-)
-ROLE_NAME=s3-reader-container-training
-TRUST_POLICY=$(envsubst <<EOF
-{
-  "Version": "2012-10-17",
-  "Statement": [
-    {
-      "Effect": "Allow",
-      "Principal": {
-        "Federated": "arn:aws:iam::${ACCOUNT}:oidc-provider/${OIDC}"
-      },
-      "Action": "sts:AssumeRoleWithWebIdentity",
-      "Condition": {
-        "StringLike": {
-            "${OIDC}:sub": ["system:serviceaccount:container-training:*"]
-        }
-      }
-    }
-  ]
-}
-EOF
-)
-
-aws iam create-role \
-    --role-name "$ROLE_NAME" \
-    --assume-role-policy-document "$TRUST_POLICY"
-
-kubectl annotate serviceaccounts \
-    --namespace container-training default \
-    "eks.amazonaws.com/role-arn=arn:aws:iam::$ACCOUNT:role/$ROLE_NAME" \
-    --overwrite
-
-exit
-
-# Here are commands to delete the role:
-for POLICY_ARN in $(aws iam list-attached-role-policies --role-name $ROLE_NAME --query 'AttachedPolicies[*].PolicyArn' --output text); do aws iam detach-role-policy --role-name $ROLE_NAME --policy-arn $POLICY_ARN; done
-aws iam delete-role --role-name $ROLE_NAME
-
-# Merging the policy with the existing policies:
-{
-aws iam get-role --role-name s3-reader-container-training | jq -r .Role.AssumeRolePolicyDocument.Statement[]
-echo "$TRUST_POLICY" | jq -r .Statement[]
-} | jq -s '{"Version": "2012-10-17", "Statement": .}' > /tmp/policy.json
-aws iam update-assume-role-policy \
-  --role-name $ROLE_NAME \
-  --policy-document file:///tmp/policy.json

prepare-eks/80_s3_bucket.sh

@@ -1,54 +0,0 @@
-#!/bin/sh
-# Create an S3 bucket with two objects in it:
-# - public.txt (world-readable)
-# - private.txt (private)
-# Also create an IAM policy granting read-only access to the bucket
-# (and therefore, to the private object).
-# Finally, attach the policy to an IAM role (for instance, the role
-# created by another script in this directory).
-# This isn't idempotent, but it can be made idempotent by replacing the
-# "aws iam create-policy" call with "aws iam create-policy-version" and
-# a bit of extra elbow grease. (See other scripts in this directory for
-# an example).
-
-ACCOUNT=$(aws sts get-caller-identity | jq -r .Account)
-BUCKET=container.training
-ROLE_NAME=s3-reader-container-training
-POLICY_NAME=s3-reader-container-training
-POLICY_DOC=$(envsubst <<EOF
-{
-  "Version": "2012-10-17",
-  "Statement": [
-    {
-      "Effect": "Allow",
-      "Action": [
-        "s3:ListBucket",
-        "s3:GetObject*"
-      ],
-      "Resource": [
-        "arn:aws:s3:::$BUCKET",
-        "arn:aws:s3:::$BUCKET/*"
-      ]
-    }
-  ]
-}
-EOF
-)
-
-aws iam create-policy \
---policy-name $POLICY_NAME \
---policy-doc "$POLICY_DOC"
-
-aws s3 mb s3://container.training
-
-echo "this is a public object" \
-| aws s3 cp - s3://container.training/public.txt \
---acl public-read
-
-echo "this is a private object" \
-| aws s3 cp - s3://container.training/private.txt \
---acl private
-
-aws iam attach-role-policy \
-    --role-name "$ROLE_NAME" \
-    --policy-arn arn:aws:iam::$ACCOUNT:policy/$POLICY_NAME

prepare-eks/users.txt

@@ -1,50 +0,0 @@
-ada.lovelace
-adele.goldstine
-amanda.jones
-anita.borg
-ann.kiessling
-barbara.mcclintock
-beatrice.worsley
-bessie.blount
-betty.holberton
-beulah.henry
-carleen.hutchins
-caroline.herschel
-dona.bailey
-dorothy.hodgkin
-ellen.ochoa
-edith.clarke
-elisha.collier
-elizabeth.feinler
-emily.davenport
-erna.hoover
-frances.spence
-gertrude.blanch
-grace.hopper
-grete.hermann
-giuliana.tesoro
-harriet.tubman
-hedy.lamarr
-irma.wyman
-jane.goodall
-jean.bartik
-joy.mangano
-josephine.cochrane
-katherine.blodgett
-kathleen.antonelli
-lynn.conway
-margaret.hamilton
-maria.beasley
-marie.curie
-marjorie.joyner
-marlyn.meltzer
-mary.kies
-melitta.bentz
-milly.koss
-radia.perlman
-rosalind.franklin
-ruth.teitelbaum
-sarah.mather
-sophie.wilson
-stephanie.kwolek
-yvonne.brill

prepare-vms/infra/example.openstack

@@ -1,5 +1,4 @@
-INFRACLASS=openstack-tf
-
+INFRACLASS=openstack
 # If you are using OpenStack, copy this file (e.g. to "openstack" or "enix")
 # and customize the variables below.
 export TF_VAR_user="jpetazzo"
@@ -7,4 +6,4 @@ export TF_VAR_tenant="training"
 export TF_VAR_domain="Default"
 export TF_VAR_password="..."
 export TF_VAR_auth_url="https://api.r1.nxs.enix.io/v3"
-export TF_VAR_flavor="GP1.S"
+export TF_VAR_flavor="GP1.S"

prepare-vms/infra/example.openstack-cli

@@ -1,24 +0,0 @@
-INFRACLASS=openstack-cli
-
-# Copy that file to e.g. openstack or ovh, then customize it.
-# Some Openstack providers (like OVHcloud) will let you download
-# a file containing credentials. That's what you need to use.
-# The file below contains some example values.
-export OS_AUTH_URL=https://auth.cloud.ovh.net/v3/
-export OS_IDENTITY_API_VERSION=3
-export OS_USER_DOMAIN_NAME=${OS_USER_DOMAIN_NAME:-"Default"}
-export OS_PROJECT_DOMAIN_NAME=${OS_PROJECT_DOMAIN_NAME:-"Default"}
-export OS_TENANT_ID=abcd1234
-export OS_TENANT_NAME="0123456"
-export OS_USERNAME="user-xyz123"
-export OS_PASSWORD=AbCd1234
-export OS_REGION_NAME="GRA7"
-
-# And then some values to indicate server type, image, etc.
-# You can see available flavors with `openstack flavor list`
-export OS_FLAVOR=s1-4
-# You can see available images with `openstack image list`
-export OS_IMAGE=896c5f54-51dc-44f0-8c22-ce99ba7164df
-# You can create a key with `openstack keypair create --public-key ~/.ssh/id_rsa.pub containertraining`
-export OS_KEY=containertraining
-

prepare-vms/infra/hetzner

@@ -1,5 +0,0 @@
-INFRACLASS=hetzner
-if ! [ -f ~/.config/hcloud/cli.toml ]; then
-  warn "~/.config/hcloud/cli.toml not found."
-  warn "Make sure that the Hetzner CLI (hcloud) is installed and configured."
-fi

prepare-vms/infra/scaleway

@@ -1,3 +0,0 @@
-INFRACLASS=scaleway
-#SCW_INSTANCE_TYPE=DEV1-L
-#SCW_ZONE=fr-par-2

prepare-vms/lib/commands.sh

@@ -43,16 +43,6 @@ _cmd_cards() {
     info "$0 www"
 }
 
-_cmd clean "Remove information about stopped clusters"
-_cmd_clean() {
-	for TAG in tags/*; do
-		if grep -q ^stopped$ "$TAG/status"; then
-			info "Removing $TAG..."
-			rm -rf "$TAG"
-		fi
-	done	
-}
-
 _cmd deploy "Install Docker on a bunch of running VMs"
 _cmd_deploy() {
     TAG=$1
@@ -69,35 +59,11 @@ _cmd_deploy() {
     echo deploying > tags/$TAG/status
     sep "Deploying tag $TAG"
 
-    # If this VM image is using cloud-init,
-    # wait for cloud-init to be done
+    # Wait for cloudinit to be done
     pssh "
-    if [ -d /var/lib/cloud ]; then
-        while [ ! -f /var/lib/cloud/instance/boot-finished ]; do
-            sleep 1
-        done
-    fi"
-
-    # Special case for scaleway since it doesn't come with sudo
-    if [ "$INFRACLASS" = "scaleway" ]; then
-        pssh -l root "
-    grep DEBIAN_FRONTEND /etc/environment || echo DEBIAN_FRONTEND=noninteractive >> /etc/environment
-    grep cloud-init /etc/sudoers && rm /etc/sudoers
-    apt-get update && apt-get install sudo -y"
-    fi
-
-    # FIXME
-    # Special case for hetzner since it doesn't have an ubuntu user
-    #if [ "$INFRACLASS" = "hetzner" ]; then
-    #    pssh -l root "
-    #[ -d /home/ubuntu ] ||
-    #    useradd ubuntu -m -s /bin/bash
-    #echo 'ubuntu ALL=(ALL:ALL) NOPASSWD:ALL' > /etc/sudoers.d/ubuntu
-    #[ -d /home/ubuntu/.ssh ] ||
-    #    install --owner=ubuntu --mode=700 --directory /home/ubuntu/.ssh
-    #[ -f /home/ubuntu/.ssh/authorized_keys ] ||
-    #    install --owner=ubuntu --mode=600 /root/.ssh/authorized_keys --target-directory /home/ubuntu/.ssh"
-    #fi
+    while [ ! -f /var/lib/cloud/instance/boot-finished ]; do
+        sleep 1
+    done"
 
     # Copy settings and install Python YAML parser
     pssh -I tee /tmp/settings.yaml <tags/$TAG/settings.yaml
@@ -105,12 +71,6 @@ _cmd_deploy() {
     sudo apt-get update &&
     sudo apt-get install -y python-yaml"
 
-    # If there is no "python" binary, symlink to python3
-    #pssh "
-    #if ! which python; then
-    #    ln -s $(which python3) /usr/local/bin/python
-    #fi"
-
     # Copy postprep.py to the remote machines, and execute it, feeding it the list of IP addresses
     pssh -I tee /tmp/postprep.py <lib/postprep.py
     pssh --timeout 900 --send-input "python /tmp/postprep.py >>/tmp/pp.out 2>>/tmp/pp.err" <tags/$TAG/ips.txt
@@ -171,19 +131,19 @@ _cmd_kubebins() {
     cd /usr/local/bin
     if ! [ -x etcd ]; then
         ##VERSION##
-        curl -L https://github.com/etcd-io/etcd/releases/download/v3.4.9/etcd-v3.4.9-linux-amd64.tar.gz \
+        curl -L https://github.com/etcd-io/etcd/releases/download/v3.4.3/etcd-v3.4.3-linux-amd64.tar.gz \
         | sudo tar --strip-components=1 --wildcards -zx '*/etcd' '*/etcdctl'
     fi
     if ! [ -x hyperkube ]; then
         ##VERSION##
-        curl -L https://dl.k8s.io/v1.18.10/kubernetes-server-linux-amd64.tar.gz \
+        curl -L https://dl.k8s.io/v1.17.2/kubernetes-server-linux-amd64.tar.gz \
         | sudo tar --strip-components=3 -zx \
           kubernetes/server/bin/kube{ctl,let,-proxy,-apiserver,-scheduler,-controller-manager}
     fi
     sudo mkdir -p /opt/cni/bin
     cd /opt/cni/bin
     if ! [ -x bridge ]; then
-        curl -L https://github.com/containernetworking/plugins/releases/download/v0.8.6/cni-plugins-linux-amd64-v0.8.6.tgz \
+        curl -L https://github.com/containernetworking/plugins/releases/download/v0.7.6/cni-plugins-amd64-v0.7.6.tgz \
         | sudo tar -zx
     fi
     "
@@ -213,22 +173,13 @@ _cmd_kube() {
     pssh --timeout 200 "
     sudo apt-get update -q &&
     sudo apt-get install -qy kubelet$EXTRA_APTGET kubeadm$EXTRA_APTGET kubectl$EXTRA_APTGET &&
-    kubectl completion bash | sudo tee /etc/bash_completion.d/kubectl &&
-    echo 'alias k=kubectl' | sudo tee /etc/bash_completion.d/k &&
-    echo 'complete -F __start_kubectl k' | sudo tee -a /etc/bash_completion.d/k"
+    kubectl completion bash | sudo tee /etc/bash_completion.d/kubectl"
 
-    # Disable swap
-    # (note that this won't survive across node reboots!)
-    if [ "$INFRACLASS" = "linode" ]; then
-        pssh "
-        sudo swapoff -a"
-    fi
-
-    # Initialize kube control plane
+    # Initialize kube master
     pssh --timeout 200 "
     if i_am_first_node && [ ! -f /etc/kubernetes/admin.conf ]; then
         kubeadm token generate > /tmp/token &&
-	sudo kubeadm init $EXTRA_KUBEADM --token \$(cat /tmp/token) --apiserver-cert-extra-sans \$(cat /tmp/ipv4) --ignore-preflight-errors=NumCPU
+	sudo kubeadm init $EXTRA_KUBEADM --token \$(cat /tmp/token) --apiserver-cert-extra-sans \$(cat /tmp/ipv4)
     fi"
 
     # Put kubeconfig in ubuntu's and docker's accounts
@@ -261,23 +212,17 @@ _cmd_kube() {
     if i_am_first_node; then
 	kubectl apply -f https://raw.githubusercontent.com/jpetazzo/container.training/master/k8s/metrics-server.yaml
     fi"
-}
-
-_cmd kubetools "Install a bunch of CLI tools for Kubernetes"
-_cmd_kubetools() {
-    TAG=$1
-    need_tag
 
     # Install kubectx and kubens
     pssh "
     [ -d kubectx ] || git clone https://github.com/ahmetb/kubectx &&
-    sudo ln -sf \$HOME/kubectx/kubectx /usr/local/bin/kctx &&
-    sudo ln -sf \$HOME/kubectx/kubens /usr/local/bin/kns &&
-    sudo cp \$HOME/kubectx/completion/*.bash /etc/bash_completion.d &&
+    sudo ln -sf /home/ubuntu/kubectx/kubectx /usr/local/bin/kctx &&
+    sudo ln -sf /home/ubuntu/kubectx/kubens /usr/local/bin/kns &&
+    sudo cp /home/ubuntu/kubectx/completion/*.bash /etc/bash_completion.d &&
     [ -d kube-ps1 ] || git clone https://github.com/jonmosco/kube-ps1 &&
     sudo -u docker sed -i s/docker-prompt/kube_ps1/ /home/docker/.bashrc &&
     sudo -u docker tee -a /home/docker/.bashrc <<EOF
-. \$HOME/kube-ps1/kube-ps1.sh
+. /home/ubuntu/kube-ps1/kube-ps1.sh
 KUBE_PS1_PREFIX=""
 KUBE_PS1_SUFFIX=""
 KUBE_PS1_SYMBOL_ENABLE="false"
@@ -328,54 +273,7 @@ EOF"
 	sudo chmod +x /usr/local/bin/aws-iam-authenticator
     fi"
 
-    # Install the krew package manager
-    pssh "
-    if [ ! -d /home/docker/.krew ]; then
-        cd /tmp &&
-        curl -fsSL https://github.com/kubernetes-sigs/krew/releases/latest/download/krew.tar.gz |
-        tar -zxf- &&
-        sudo -u docker -H ./krew-linux_amd64 install krew &&
-        echo export PATH=/home/docker/.krew/bin:\\\$PATH | sudo -u docker tee -a /home/docker/.bashrc
-    fi"
-
-    # Install k9s and popeye
-    pssh "
-    if [ ! -x /usr/local/bin/k9s ]; then
-        FILENAME=k9s_\$(uname -s)_\$(uname -m).tar.gz &&
-        curl -sSL https://github.com/derailed/k9s/releases/latest/download/\$FILENAME |
-        sudo tar -zxvf- -C /usr/local/bin k9s
-    fi
-    if [ ! -x /usr/local/bin/popeye ]; then
-        FILENAME=popeye_\$(uname -s)_\$(uname -m).tar.gz &&
-        curl -sSL https://github.com/derailed/popeye/releases/latest/download/\$FILENAME |
-        sudo tar -zxvf- -C /usr/local/bin popeye
-    fi"
-
-    # Install Tilt
-    pssh "
-    if [ ! -x /usr/local/bin/tilt ]; then
-        curl -fsSL https://raw.githubusercontent.com/tilt-dev/tilt/master/scripts/install.sh | bash
-    fi"
-
-    # Install Skaffold
-    pssh "
-    if [ ! -x /usr/local/bin/skaffold ]; then
-        curl -Lo skaffold https://storage.googleapis.com/skaffold/releases/latest/skaffold-linux-amd64 &&
-        sudo install skaffold /usr/local/bin/
-    fi"
-
-    # Install Kompose
-    pssh "
-    if [ ! -x /usr/local/bin/kompose ]; then
-        curl -Lo kompose https://github.com/kubernetes/kompose/releases/latest/download/kompose-linux-amd64 &&
-        sudo install kompose /usr/local/bin
-    fi"
-
-    pssh "
-    if [ ! -x /usr/local/bin/kubeseal ]; then
-        curl -Lo kubeseal https://github.com/bitnami-labs/sealed-secrets/releases/download/v0.13.1/kubeseal-linux-amd64 &&
-        sudo install kubeseal /usr/local/bin
-    fi"
+    sep "Done"
 }
 
 _cmd kubereset "Wipe out Kubernetes configuration on all nodes"
@@ -397,44 +295,29 @@ _cmd_kubetest() {
     set -e
     if i_am_first_node; then
       which kubectl
-      for NODE in \$(grep [0-9]\$ /etc/hosts | grep -v ^127 | awk {print\ \\\$2}); do
+      for NODE in \$(awk /[0-9]\$/\ {print\ \\\$2} /etc/hosts); do
         echo \$NODE ; kubectl get nodes | grep -w \$NODE | grep -w Ready
       done
     fi"
 }
 
-_cmd ips "Show the IP addresses for a given tag"
-_cmd_ips() {
+_cmd ids "(FIXME) List the instance IDs belonging to a given tag or token"
+_cmd_ids() {
     TAG=$1
     need_tag $TAG
 
-    SETTINGS=tags/$TAG/settings.yaml
-    CLUSTERSIZE=$(awk '/^clustersize:/ {print $2}' $SETTINGS)
-    while true; do
-        for I in $(seq $CLUSTERSIZE); do
-            read ip || return 0
-            printf "%s\t" "$ip"
-        done
-        printf "\n"
-    done < tags/$TAG/ips.txt
+    info "Looking up by tag:"
+    aws_get_instance_ids_by_tag $TAG
+
+    # Just in case we managed to create instances but weren't able to tag them
+    info "Looking up by token:"
+    aws_get_instance_ids_by_client_token $TAG
 }
 
-_cmd list "List all VMs on a given infrastructure (or all infras if no arg given)"
+_cmd list "List available groups for a given infrastructure"
 _cmd_list() {
-    case "$1" in
-    "")
-        for INFRA in infra/*; do
-            $0 list $INFRA
-        done
-        ;;
-    */example.*)
-        ;;
-    *)
-        need_infra $1
-        sep "Listing instances for $1"
-        infra_list
-        ;;
-    esac
+    need_infra $1
+    infra_list
 }
 
 _cmd listall "List VMs running on all configured infrastructures"
@@ -528,6 +411,16 @@ _cmd_opensg() {
     infra_opensg
 }
 
+_cmd portworx "Prepare the nodes for Portworx deployment"
+_cmd_portworx() {
+    TAG=$1
+    need_tag
+
+    pssh "
+    sudo truncate --size 10G /portworx.blk &&
+    sudo losetup /dev/loop4 /portworx.blk"
+}
+
 _cmd disableaddrchecks "Disable source/destination IP address checks"
 _cmd_disableaddrchecks() {
     TAG=$1
@@ -564,17 +457,6 @@ _cmd_remap_nodeports() {
     if i_am_first_node && ! grep -q '$ADD_LINE' $MANIFEST_FILE; then
         sudo sed -i 's/\($FIND_LINE\)\$/\1\n$ADD_LINE/' $MANIFEST_FILE
     fi"
-
-    info "If you have manifests hard-coding nodePort values,"
-    info "you might want to patch them with a command like:"
-    info "
-
-if i_am_first_node; then
-    kubectl -n kube-system patch svc prometheus-server \\
-        -p 'spec: { ports: [ {port: 80, nodePort: 10101} ]}'
-fi
-
-    "
 }
 
 _cmd quotas "Check our infrastructure quotas (max instances)"
@@ -583,6 +465,18 @@ _cmd_quotas() {
     infra_quotas
 }
 
+_cmd retag "(FIXME) Apply a new tag to a group of VMs"
+_cmd_retag() {
+    OLDTAG=$1
+    NEWTAG=$2
+    TAG=$OLDTAG
+    need_tag
+    if [[ -z "$NEWTAG" ]]; then
+        die "You must specify a new tag to apply."
+    fi
+    aws_tag_instances $OLDTAG $NEWTAG
+}
+
 _cmd ssh "Open an SSH session to the first node of a tag"
 _cmd_ssh() {
     TAG=$1
@@ -672,8 +566,6 @@ _cmd_start() {
     done
     sep
     info "Deployment successful."
-    info "To log into the first machine of that batch, you can run:"
-    info "$0 ssh $TAG"
     info "To terminate these instances, you can run:"
     info "$0 stop $TAG"
 }
@@ -737,8 +629,8 @@ _cmd_helmprom() {
     need_tag
     pssh "
     if i_am_first_node; then
-        sudo -u docker -H helm repo add prometheus-community https://prometheus-community.github.io/helm-charts/
-        sudo -u docker -H helm install prometheus prometheus-community/prometheus \
+        sudo -u docker -H helm repo add stable https://kubernetes-charts.storage.googleapis.com/
+        sudo -u docker -H helm install prometheus stable/prometheus \
             --namespace kube-system \
             --set server.service.type=NodePort \
             --set server.service.nodePort=30090 \
@@ -771,12 +663,11 @@ _cmd_webssh() {
     sudo apt-get update &&
     sudo apt-get install python-tornado python-paramiko -y"
     pssh "
-    cd /opt
-    [ -d webssh ] || sudo git clone https://github.com/jpetazzo/webssh"
+    [ -d webssh ] || git clone https://github.com/jpetazzo/webssh"
     pssh "
     for KEYFILE in /etc/ssh/*.pub; do
       read a b c < \$KEYFILE; echo localhost \$a \$b
-    done | sudo tee /opt/webssh/known_hosts"
+    done > webssh/known_hosts"
     pssh "cat >webssh.service <<EOF
 [Unit]
 Description=webssh
@@ -785,7 +676,7 @@ Description=webssh
 WantedBy=multi-user.target
 
 [Service]
-WorkingDirectory=/opt/webssh
+WorkingDirectory=/home/ubuntu/webssh
 ExecStart=/usr/bin/env python run.py --fbidhttp=false --port=1080 --policy=reject
 User=nobody
 Group=nogroup
@@ -808,6 +699,11 @@ _cmd_www() {
     python3 -m http.server
 }
 
+greet() {
+    IAMUSER=$(aws iam get-user --query 'User.UserName')
+    info "Hello! You seem to be UNIX user $USER, and IAM user $IAMUSER."
+}
+
 pull_tag() {
     # Pre-pull a bunch of images
     pssh --timeout 900 'for I in \
@@ -897,3 +793,27 @@ make_key_name() {
     SHORT_FINGERPRINT=$(ssh-add -l | grep RSA | head -n1 | cut -d " " -f 2 | tr -d : | cut -c 1-8)
     echo "${SHORT_FINGERPRINT}-${USER}"
 }
+
+sync_keys() {
+    # make sure ssh-add -l contains "RSA"
+    ssh-add -l | grep -q RSA \
+        || die "The output of \`ssh-add -l\` doesn't contain 'RSA'. Start the agent, add your keys?"
+
+    AWS_KEY_NAME=$(make_key_name)
+    info "Syncing keys... "
+    if ! aws ec2 describe-key-pairs --key-name "$AWS_KEY_NAME" &>/dev/null; then
+        aws ec2 import-key-pair --key-name $AWS_KEY_NAME \
+            --public-key-material "$(ssh-add -L \
+                | grep -i RSA \
+                | head -n1 \
+                | cut -d " " -f 1-2)" &>/dev/null
+
+        if ! aws ec2 describe-key-pairs --key-name "$AWS_KEY_NAME" &>/dev/null; then
+            die "Somehow, importing the key didn't work. Make sure that 'ssh-add -l | grep RSA | head -n1' returns an RSA key?"
+        else
+            info "Imported new key $AWS_KEY_NAME."
+        fi
+    else
+        info "Using existing key $AWS_KEY_NAME."
+    fi
+}

prepare-vms/lib/infra/aws.sh

@@ -1,14 +1,9 @@
-if ! command -v aws >/dev/null; then
-    warn "AWS CLI (aws) not found."
-fi
-
 infra_list() {
-    aws ec2 describe-instances --output json |
-        jq -r '.Reservations[].Instances[] | [.InstanceId, .ClientToken, .State.Name, .InstanceType ] | @tsv'
+    aws_display_tags
 }
 
 infra_quotas() {
-    aws_greet
+    greet
 
     max_instances=$(aws ec2 describe-account-attributes \
         --attribute-names max-instances \
@@ -26,10 +21,10 @@ infra_start() {
     COUNT=$1
 
     # Print our AWS username, to ease the pain of credential-juggling
-    aws_greet
+    greet
 
     # Upload our SSH keys to AWS if needed, to be added to each VM's authorized_keys
-    key_name=$(aws_sync_keys)
+    key_name=$(sync_keys)
 
     AMI=$(aws_get_ami)    # Retrieve the AWS image ID
     if [ -z "$AMI" ]; then
@@ -66,7 +61,7 @@ infra_start() {
     aws_tag_instances $TAG $TAG
 
     # Wait until EC2 API tells us that the instances are running
-    aws_wait_until_tag_is_running $TAG $COUNT
+    wait_until_tag_is_running $TAG $COUNT
 
     aws_get_instance_ips_by_tag $TAG > tags/$TAG/ips.txt
 }
@@ -103,7 +98,7 @@ infra_disableaddrchecks() {
     done
 }
 
-aws_wait_until_tag_is_running() {
+wait_until_tag_is_running() {
     max_retry=100
     i=0
     done_count=0
@@ -219,32 +214,3 @@ aws_get_ami() {
     ##VERSION##
     find_ubuntu_ami -r $AWS_DEFAULT_REGION -a amd64 -v 18.04 -t hvm:ebs -N -q
 }
-
-aws_greet() {
-    IAMUSER=$(aws iam get-user --query 'User.UserName')
-    info "Hello! You seem to be UNIX user $USER, and IAM user $IAMUSER."
-}
-
-aws_sync_keys() {
-    # make sure ssh-add -l contains "RSA"
-    ssh-add -l | grep -q RSA \
-        || die "The output of \`ssh-add -l\` doesn't contain 'RSA'. Start the agent, add your keys?"
-
-    AWS_KEY_NAME=$(make_key_name)
-    info "Syncing keys... "
-    if ! aws ec2 describe-key-pairs --key-name "$AWS_KEY_NAME" &>/dev/null; then
-        aws ec2 import-key-pair --key-name $AWS_KEY_NAME \
-            --public-key-material "$(ssh-add -L \
-                | grep -i RSA \
-                | head -n1 \
-                | cut -d " " -f 1-2)" &>/dev/null
-
-        if ! aws ec2 describe-key-pairs --key-name "$AWS_KEY_NAME" &>/dev/null; then
-            die "Somehow, importing the key didn't work. Make sure that 'ssh-add -l | grep RSA | head -n1' returns an RSA key?"
-        else
-            info "Imported new key $AWS_KEY_NAME."
-        fi
-    else
-        info "Using existing key $AWS_KEY_NAME."
-    fi
-}

prepare-vms/lib/infra/hetzner.sh

@@ -1,57 +0,0 @@
-if ! command -v hcloud >/dev/null; then
-  warn "Hetzner CLI (hcloud) not found."
-fi
-if ! [ -f ~/.config/hcloud/cli.toml ]; then
-  warn "~/.config/hcloud/cli.toml not found."
-fi
-
-infra_list() {
-    [ "$(hcloud server list -o json)" = "null" ] && return
-
-    hcloud server list -o json |
-        jq -r '.[] | [.id, .name , .status, .server_type.name] | @tsv'
-}
-
-infra_start() {
-    COUNT=$1
-
-    HETZNER_INSTANCE_TYPE=${HETZNER_INSTANCE_TYPE-cx21}
-    HETZNER_DATACENTER=${HETZNER_DATACENTER-nbg1-dc3}
-    HETZNER_IMAGE=${HETZNER_IMAGE-168855}
-
-    for I in $(seq 1 $COUNT); do
-        NAME=$(printf "%s-%03d" $TAG $I)
-        sep "Starting instance $I/$COUNT"
-        info "    Datacenter: $HETZNER_DATACENTER"
-        info "          Name: $NAME"
-        info " Instance type: $HETZNER_INSTANCE_TYPE"
-        hcloud server create \
-            --type=${HETZNER_INSTANCE_TYPE} \
-            --datacenter=${HETZNER_DATACENTER} \
-            --image=${HETZNER_IMAGE} \
-            --name=$NAME \
-            --label=tag=$TAG \
-            --ssh-key ~/.ssh/id_rsa.pub
-    done
-
-    hetzner_get_ips_by_tag $TAG > tags/$TAG/ips.txt
-}
-
-infra_stop() {
-    for ID in $(hetzner_get_ids_by_tag $TAG); do
-        info "Scheduling deletion of instance $ID..."
-        hcloud server delete $ID &
-    done
-    info "Waiting for deletion to complete..."
-    wait
-}
-
-hetzner_get_ids_by_tag() {
-    TAG=$1
-    hcloud server list --selector=tag=$TAG -o json | jq -r .[].name
-}
-
-hetzner_get_ips_by_tag() {
-    TAG=$1
-    hcloud server list --selector=tag=$TAG -o json | jq -r .[].public_net.ipv4.ip
-}

prepare-vms/lib/infra/linode.sh

@@ -1,58 +0,0 @@
-if ! command -v linode-cli >/dev/null; then
-  warn "Linode CLI (linode-cli) not found."
-fi
-if ! [ -f ~/.config/linode-cli ]; then
-  warn "~/.config/linode-cli not found."
-fi
-
-# To view available regions: "linode-cli regions list"
-LINODE_REGION=${LINODE_REGION-us-west}
-
-# To view available types: "linode-cli linodes types"
-LINODE_TYPE=${LINODE_TYPE-g6-standard-2}
-
-infra_list() {
-    linode-cli linodes list --json |
-        jq -r '.[] | [.id, .label, .status, .type] | @tsv'
-}
-
-infra_start() {
-    COUNT=$1
-
-    for I in $(seq 1 $COUNT); do
-        NAME=$(printf "%s-%03d" $TAG $I)
-        sep "Starting instance $I/$COUNT"
-        info "          Zone: $LINODE_REGION"
-        info "          Name: $NAME"
-        info " Instance type: $LINODE_TYPE"
-        ROOT_PASS="$(base64 /dev/urandom | cut -c1-20 | head -n 1)"
-        linode-cli linodes create \
-            --type=${LINODE_TYPE} --region=${LINODE_REGION} \
-            --image=linode/ubuntu18.04 \
-            --authorized_keys="${LINODE_SSHKEY}" \
-            --root_pass="${ROOT_PASS}" \
-            --tags=${TAG} --label=${NAME}
-    done
-    sep
-
-    linode_get_ips_by_tag $TAG > tags/$TAG/ips.txt
-}
-
-infra_stop() {
-    info "Counting instances..."
-    linode_get_ids_by_tag $TAG | wc -l
-    info "Deleting instances..."
-    linode_get_ids_by_tag $TAG | 
-        xargs -n1 -P10 \
-        linode-cli linodes delete
-}
-
-linode_get_ids_by_tag() {
-    TAG=$1
-    linode-cli linodes list --tags $TAG --json | jq -r ".[].id"
-}
-
-linode_get_ips_by_tag() {
-    TAG=$1
-    linode-cli linodes list --tags $TAG --json | jq -r ".[].ipv4[0]"
-}

prepare-vms/lib/infra/openstack-cli.sh

@@ -1,53 +0,0 @@
-infra_list() {
-    openstack server list -f json |
-        jq -r '.[] | [.ID, .Name , .Status, .Flavor] | @tsv'
-}
-
-infra_start() {
-    COUNT=$1
-
-    sep "Starting $COUNT instances"
-    info " Region: $OS_REGION_NAME"
-    info "   User: $OS_USERNAME"
-    info " Flavor: $OS_FLAVOR"
-    info "  Image: $OS_IMAGE"
-    openstack server create \
-    	--flavor $OS_FLAVOR \
-    	--image $OS_IMAGE \
-    	--key-name $OS_KEY \
-    	--min $COUNT --max $COUNT \
-    	--property workshopctl=$TAG \
-    	$TAG
-
-    sep "Waiting for IP addresses to be available"
-    GOT=0
-    while [ "$GOT" != "$COUNT" ]; do
-    	echo "Got $GOT/$COUNT IP addresses."
-    	oscli_get_ips_by_tag $TAG > tags/$TAG/ips.txt
-    	GOT="$(wc -l < tags/$TAG/ips.txt)"
-    done
-
-}
-
-infra_stop() {
-	info "Counting instances..."
-	oscli_get_instances_json $TAG | 
-		jq -r .[].Name | 
-		wc -l
-	info "Deleting instances..."
-	oscli_get_instances_json $TAG |
-		jq -r .[].Name |
-		xargs -P10 -n1 openstack server delete
-	info "Done."
-}
-
-oscli_get_instances_json() {
-	TAG=$1
-    openstack server list -f json --name "${TAG}-[0-9]*"
-}
-
-oscli_get_ips_by_tag() {
-    TAG=$1
-    oscli_get_instances_json $TAG |
-    	jq -r .[].Networks | grep -oE '[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+' || true
-}

prepare-vms/lib/infra/scaleway.sh

@@ -1,51 +0,0 @@
-if ! command -v scw >/dev/null; then
-  warn "Scaleway CLI (scw) not found."
-fi
-if ! [ -f ~/.config/scw/config.yaml ]; then
-  warn "~/.config/scw/config.yaml not found."
-fi
-
-SCW_INSTANCE_TYPE=${SCW_INSTANCE_TYPE-DEV1-M}
-SCW_ZONE=${SCW_ZONE-fr-par-1}
-
-infra_list() {
-    scw instance server list -o json |
-        jq -r '.[] | [.id, .name, .state, .commercial_type] | @tsv'
-}
-
-infra_start() {
-    COUNT=$1
-
-    for I in $(seq 1 $COUNT); do
-        NAME=$(printf "%s-%03d" $TAG $I)
-        sep "Starting instance $I/$COUNT"
-        info "          Zone: $SCW_ZONE"
-        info "          Name: $NAME"
-        info " Instance type: $SCW_INSTANCE_TYPE"
-        scw instance server create \
-            type=${SCW_INSTANCE_TYPE} zone=${SCW_ZONE} \
-            image=ubuntu_bionic name=${NAME}
-    done
-    sep
-
-    scw_get_ips_by_tag $TAG > tags/$TAG/ips.txt
-}
-
-infra_stop() {
-    info "Counting instances..."
-    scw_get_ids_by_tag $TAG | wc -l
-    info "Deleting instances..."
-    scw_get_ids_by_tag $TAG | 
-        xargs -n1 -P10 \
-        scw instance server delete zone=${SCW_ZONE} force-shutdown=true with-ip=true
-}
-
-scw_get_ids_by_tag() {
-    TAG=$1
-    scw instance server list zone=${SCW_ZONE} name=$TAG -o json | jq -r .[].id
-}
-
-scw_get_ips_by_tag() {
-    TAG=$1
-    scw instance server list zone=${SCW_ZONE} name=$TAG -o json | jq -r .[].public_ip.address
-}

prepare-vms/lib/infra/unimplemented.sh

@@ -1,23 +0,0 @@
-infra_disableaddrchecks() {
-    die "unimplemented"
-}
-
-infra_list() {
-    die "unimplemented"
-}
-
-infra_opensg() {
-    die "unimplemented"
-}
-
-infra_quotas() {
-    die "unimplemented"
-}
-
-infra_start() {
-    die "unimplemented"
-}
-
-infra_stop() {
-    die "unimplemented"
-}

prepare-vms/lib/postprep.py

@@ -37,7 +37,7 @@ def system(cmd):
         td = str(t2-t1)[:5]
         f.write(bold("[{}] in {}s\n".format(retcode, td)))
         STEP += 1
-    with open(os.environ["HOME"] + "/.bash_history", "a") as f:
+    with open("/home/ubuntu/.bash_history", "a") as f:
         f.write("{}\n".format(cmd))
     if retcode != 0:
         msg = "The following command failed with exit code {}:\n".format(retcode)
@@ -114,7 +114,7 @@ system("sudo sed -i 's/PasswordAuthentication no/PasswordAuthentication yes/' /e
 
 system("sudo service ssh restart")
 system("sudo apt-get -q update")
-system("sudo apt-get -qy install git jid jq")
+system("sudo apt-get -qy install git jq")
 system("sudo apt-get -qy install emacs-nox joe")
 
 #######################

prepare-vms/lib/pssh.sh

@@ -18,13 +18,7 @@ pssh() {
     echo "[parallel-ssh] $@"
     export PSSH=$(which pssh || which parallel-ssh)
 
-    case "$INFRACLASS" in
-        hetzner) LOGIN=root ;;
-        linode)  LOGIN=root ;;
-        *)       LOGIN=ubuntu ;;
-    esac
-
-    $PSSH -h $HOSTFILE -l $LOGIN \
+    $PSSH -h $HOSTFILE -l ubuntu \
         --par 100 \
         -O LogLevel=ERROR \
         -O UserKnownHostsFile=/dev/null \

prepare-vms/map-dns.py

@@ -1,71 +1,49 @@
 #!/usr/bin/env python
-"""
-There are two ways to use this script:
-
-1. Pass a file name and a tag name as a single argument.
-It will load a list of domains from the given file (one per line),
-and assign them to the clusters corresponding to that tag.
-There should be more domains than clusters.
-Example: ./map-dns.py domains.txt 2020-08-15-jp
-
-2. Pass a domain as the 1st argument, and IP addresses then.
-It will configure the domain with the listed IP addresses.
-Example: ./map-dns.py open-duck.site 1.2.3.4 2.3.4.5 3.4.5.6
-
-In both cases, the domains should be configured to use GANDI LiveDNS.
-"""
 import os
 import requests
-import sys
 import yaml
 
-# This can be tweaked if necessary.
+# configurable stuff
+domains_file = "../../plentydomains/domains.txt"
 config_file = os.path.join(
-  os.environ["HOME"], ".config/gandi/config.yaml")
+	os.environ["HOME"], ".config/gandi/config.yaml")
+tag = "test"
 apiurl = "https://dns.api.gandi.net/api/v5/domains"
+
+# inferred stuff
+domains = open(domains_file).read().split()
 apikey = yaml.safe_load(open(config_file))["apirest"]["key"]
+ips = open(f"tags/{tag}/ips.txt").read().split()
+settings_file = f"tags/{tag}/settings.yaml"
+clustersize = yaml.safe_load(open(settings_file))["clustersize"]
 
-# Figure out if we're called for a bunch of domains, or just one.
-domain_or_domain_file = sys.argv[1]
-if os.path.isfile(domain_or_domain_file):
-  domains = open(domain_or_domain_file).read().split()
-  domains = [ d for d in domains if not d.startswith('#') ]
-  tag = sys.argv[2]
-  ips = open(f"tags/{tag}/ips.txt").read().split()
-  settings_file = f"tags/{tag}/settings.yaml"
-  clustersize = yaml.safe_load(open(settings_file))["clustersize"]
-else:
-  domains = [domain_or_domain_file]
-  ips = sys.argv[2:]
-  clustersize = len(ips)
-
-# Now, do the work.
+# now do the fucking work
 while domains and ips:
-  domain = domains[0]
-  domains = domains[1:]
-  cluster = ips[:clustersize]
-  ips = ips[clustersize:]
-  print(f"{domain} => {cluster}")
-  zone = ""
-  node = 0
-  for ip in cluster:
-    node += 1
-    zone += f"@ 300 IN A {ip}\n"
-    zone += f"* 300 IN A {ip}\n"
-    zone += f"node{node} 300 IN A {ip}\n"
-  r = requests.put(
-    f"{apiurl}/{domain}/records",
-    headers={"x-api-key": apikey},
-    data=zone)
-  print(r.text)
+	domain = domains[0]
+	domains = domains[1:]
+	cluster = ips[:clustersize]
+	ips = ips[clustersize:]
+	print(f"{domain} => {cluster}")
+	zone = ""
+	node = 0
+	for ip in cluster:
+		node += 1
+		zone += f"@ 300 IN A {ip}\n"
+		zone += f"* 300 IN A {ip}\n"
+		zone += f"node{node} 300 IN A {ip}\n"
+	r = requests.put(
+		f"{apiurl}/{domain}/records",
+		headers={"x-api-key": apikey},
+		data=zone)
+	print(r.text)
 
-  #r = requests.get(
-  #  f"{apiurl}/{domain}/records",
-  #  headers={"x-api-key": apikey},
-  #  )
+	#r = requests.get(
+	#	f"{apiurl}/{domain}/records",
+	#	headers={"x-api-key": apikey},
+	#	)
 
 if domains:
-  print(f"Good, we have {len(domains)} domains left.")
+	print(f"Good, we have {len(domains)} domains left.")
 
 if ips:
-  print(f"Crap, we have {len(ips)} IP addresses left.")
+	print(f"Crap, we have {len(ips)} IP addresses left.")

prepare-vms/settings/fundamentals.yaml

@@ -6,8 +6,8 @@ clustersize: 1
 # The hostname of each node will be clusterprefix + a number
 clusterprefix: node
 
-# Jinja2 template to use to generate ready-to-cut cards
-cards_template: cards.html
+# Jinja2 template to use to generate ready-to-cut 
+cards_template: clusters.csv
 
 # Use "Letter" in the US, and "A4" everywhere else
 paper_size: Letter

prepare-vms/settings/jerome.yaml

@@ -25,6 +25,5 @@ steps:
   - webssh
   - tailhist
   - kube
-  - kubetools
   - cards
   - kubetest

prepare-vms/setup-admin-clusters.sh

@@ -35,8 +35,6 @@ TAG=$PREFIX-$SETTINGS
 retry 5 ./workshopctl deploy $TAG
 retry 5 ./workshopctl disabledocker $TAG
 retry 5 ./workshopctl kubebins $TAG
-retry 5 ./workshopctl webssh $TAG
-retry 5 ./workshopctl tailhist $TAG
 ./workshopctl cards $TAG
 
 SETTINGS=admin-kubenet
@@ -50,8 +48,6 @@ TAG=$PREFIX-$SETTINGS
 retry 5 ./workshopctl disableaddrchecks $TAG
 retry 5 ./workshopctl deploy $TAG
 retry 5 ./workshopctl kubebins $TAG
-retry 5 ./workshopctl webssh $TAG
-retry 5 ./workshopctl tailhist $TAG
 ./workshopctl cards $TAG
 
 SETTINGS=admin-kuberouter
@@ -65,8 +61,6 @@ TAG=$PREFIX-$SETTINGS
 retry 5 ./workshopctl disableaddrchecks $TAG
 retry 5 ./workshopctl deploy $TAG
 retry 5 ./workshopctl kubebins $TAG
-retry 5 ./workshopctl webssh $TAG
-retry 5 ./workshopctl tailhist $TAG
 ./workshopctl cards $TAG
 
 #INFRA=infra/aws-us-west-1
@@ -82,7 +76,5 @@ TAG=$PREFIX-$SETTINGS
 	--count $((3*$STUDENTS))
 
 retry 5 ./workshopctl deploy $TAG
-retry 5 ./workshopctl kube $TAG 1.17.13
-retry 5 ./workshopctl webssh $TAG
-retry 5 ./workshopctl tailhist $TAG
+retry 5 ./workshopctl kube $TAG 1.15.9
 ./workshopctl cards $TAG

prepare-vms/terraform/machines.tf

@@ -1,7 +1,7 @@
 resource "openstack_compute_instance_v2" "machine" {
   count           = "${var.count}" 
   name            = "${format("%s-%04d", "${var.prefix}", count.index+1)}"
-  image_name      = "Ubuntu 18.04.4 20200324"
+  image_name      = "Ubuntu 16.04.5 (Xenial Xerus)"
   flavor_name     = "${var.flavor}"
   security_groups = ["${openstack_networking_secgroup_v2.full_access.name}"]
   key_pair        = "${openstack_compute_keypair_v2.ssh_deploy_key.name}"

prepare-vms/workshopctl

@@ -15,6 +15,7 @@ for lib in lib/*.sh; do
 done
 
 DEPENDENCIES="
+    aws
     ssh
     curl
     jq

slides/_redirects

@@ -6,20 +6,18 @@
 # And this allows to do "git clone https://container.training".
 /info/refs service=git-upload-pack https://github.com/jpetazzo/container.training/info/refs?service=git-upload-pack
 
-/dockermastery https://www.udemy.com/course/docker-mastery/?referralCode=1410924A733D33635CCB
-/kubernetesmastery https://www.udemy.com/course/kubernetesmastery/?referralCode=7E09090AF9B79E6C283F
-#/dockermastery https://www.udemy.com/course/docker-mastery/?couponCode=DOCKERALLDAY
-#/kubernetesmastery https://www.udemy.com/course/kubernetesmastery/?couponCode=DOCKERALLDAY
+#/dockermastery https://www.udemy.com/course/docker-mastery/?referralCode=1410924A733D33635CCB
+#/kubernetesmastery https://www.udemy.com/course/kubernetesmastery/?referralCode=7E09090AF9B79E6C283F
+/dockermastery https://www.udemy.com/course/docker-mastery/?couponCode=SWEETFEBSALEC1
+/kubernetesmastery https://www.udemy.com/course/kubernetesmastery/?couponCode=SWEETFEBSALEC4
 
 # Shortlink for the QRCode
 /q /qrcode.html 200
 
 # Shortlinks for next training in English and French
-#/next https://www.eventbrite.com/e/livestream-intensive-kubernetes-bootcamp-tickets-103262336428
-/next https://skillsmatter.com/courses/700-advanced-kubernetes-concepts-workshop-jerome-petazzoni
+/next https://www.eventbrite.com/e/livestream-intensive-kubernetes-bootcamp-tickets-103262336428
 /hi5 https://enix.io/fr/services/formation/online/
 
-# Survey form
-/please https://docs.google.com/forms/d/e/1FAIpQLSfIYSgrV7tpfBNm1hOaprjnBHgWKn5n-k5vtNXYJkOX1sRxng/viewform
-
-/ /helm.yml.html 200!
+/ /intro.yml.html 200!
+/vms https://docs.google.com/spreadsheets/d/1u91MzRvUiZiI55x_sto1kk9LP4QoxqOBjvjhZCeyjU4/edit
+/chat https://gitter.im/jpetazzo/training-20200707-online

slides/autopilot/autotest.py

@@ -233,7 +233,7 @@ def setup_tmux_and_ssh():
         ipaddr = "$IPADDR"
         uid = os.getuid()
 
-        raise Exception(r"""
+        raise Exception("""
 1. If you're running this directly from a node:
 
 tmux
@@ -247,16 +247,6 @@ rm -f /tmp/tmux-{uid}/default && ssh -t -L /tmp/tmux-{uid}/default:/tmp/tmux-100
 3. If you cannot control a remote tmux:
 
 tmux new-session ssh docker@{ipaddr}
-
-4. If you are running this locally with a remote cluster, make sure your prompt has the expected format:
-
-tmux
-IPADDR=$(
-  kubectl get nodes -o json |
-  jq -r '.items[0].status.addresses[] | select(.type=="ExternalIP") | .address'
-  )
-export PS1="\n[{ipaddr}] \u@\h:\w\n\$ "
-
 """.format(uid=uid, ipaddr=ipaddr))
     else:
         logging.info("Found tmux session. Trying to acquire shell prompt.")

slides/autopilot/package-lock.json

@@ -24,9 +24,14 @@
       "integrity": "sha1-ml9pkFGx5wczKPKgCJaLZOopVdI="
     },
     "arraybuffer.slice": {
-      "version": "0.0.7",
-      "resolved": "https://registry.npmjs.org/arraybuffer.slice/-/arraybuffer.slice-0.0.7.tgz",
-      "integrity": "sha512-wGUIVQXuehL5TCqQun8OW81jGzAWycqzFF8lFp+GOM5BXLYj3bKNsYC4daB7n6XjCqxQA/qgTJ+8ANR3acjrog=="
+      "version": "0.0.6",
+      "resolved": "https://registry.npmjs.org/arraybuffer.slice/-/arraybuffer.slice-0.0.6.tgz",
+      "integrity": "sha1-8zshWfBTKj8xB6JywMz70a0peco="
+    },
+    "async-limiter": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/async-limiter/-/async-limiter-1.0.0.tgz",
+      "integrity": "sha512-jp/uFnooOiO+L211eZOoSyzpOITMXx1rBITauYykG3BRYPu8h0UcxsPNB04RR5vo4Tyz3+ay17tR6JVf9qzYWg=="
     },
     "backo2": {
       "version": "1.0.2",
@@ -34,19 +39,27 @@
       "integrity": "sha1-MasayLEpNjRj41s+u2n038+6eUc="
     },
     "base64-arraybuffer": {
-      "version": "0.1.4",
-      "resolved": "https://registry.npmjs.org/base64-arraybuffer/-/base64-arraybuffer-0.1.4.tgz",
-      "integrity": "sha1-mBjHngWbE1X5fgQooBfIOOkLqBI="
+      "version": "0.1.5",
+      "resolved": "https://registry.npmjs.org/base64-arraybuffer/-/base64-arraybuffer-0.1.5.tgz",
+      "integrity": "sha1-c5JncZI7Whl0etZmqlzUv5xunOg="
     },
     "base64id": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/base64id/-/base64id-2.0.0.tgz",
-      "integrity": "sha512-lGe34o6EHj9y3Kts9R4ZYs/Gr+6N7MCaMlIFA3F1R2O5/m7K06AxfSeO5530PEERE6/WyEg3lsuyw4GHlPZHog=="
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/base64id/-/base64id-1.0.0.tgz",
+      "integrity": "sha1-R2iMuZu2gE8OBtPnY7HDLlfY5rY="
+    },
+    "better-assert": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/better-assert/-/better-assert-1.0.2.tgz",
+      "integrity": "sha1-QIZrnhueC1W0gYlDEeaPr/rrxSI=",
+      "requires": {
+        "callsite": "1.0.0"
+      }
     },
     "blob": {
-      "version": "0.0.5",
-      "resolved": "https://registry.npmjs.org/blob/-/blob-0.0.5.tgz",
-      "integrity": "sha512-gaqbzQPqOoamawKg0LGVd7SzLgXS+JH61oWprSLH+P+abTczqJbhTR8CmJ2u9/bUYNmHTGJx/UEmn6doAvvuig=="
+      "version": "0.0.4",
+      "resolved": "https://registry.npmjs.org/blob/-/blob-0.0.4.tgz",
+      "integrity": "sha1-vPEwUspURj8w+fx+lbmkdjCpSSE="
     },
     "body-parser": {
       "version": "1.18.2",
@@ -70,15 +83,20 @@
       "resolved": "https://registry.npmjs.org/bytes/-/bytes-3.0.0.tgz",
       "integrity": "sha1-0ygVQE1olpn4Wk6k+odV3ROpYEg="
     },
+    "callsite": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/callsite/-/callsite-1.0.0.tgz",
+      "integrity": "sha1-KAOY5dZkvXQDi28JBRU+borxvCA="
+    },
     "component-bind": {
       "version": "1.0.0",
       "resolved": "https://registry.npmjs.org/component-bind/-/component-bind-1.0.0.tgz",
       "integrity": "sha1-AMYIq33Nk4l8AAllGx06jh5zu9E="
     },
     "component-emitter": {
-      "version": "1.3.0",
-      "resolved": "https://registry.npmjs.org/component-emitter/-/component-emitter-1.3.0.tgz",
-      "integrity": "sha512-Rd3se6QB+sO1TwqZjscQrurpEPIfO0/yYnSin6Q/rD3mOutHvUrCAhJub3r90uNb+SESBuE0QYoB90YdfatsRg=="
+      "version": "1.2.1",
+      "resolved": "https://registry.npmjs.org/component-emitter/-/component-emitter-1.2.1.tgz",
+      "integrity": "sha1-E3kY1teCg/ffemt8WmPhQOaUJeY="
     },
     "component-inherit": {
       "version": "0.0.3",
@@ -134,76 +152,58 @@
       "integrity": "sha1-eePVhlU0aQn+bw9Fpd5oEDspTSA="
     },
     "engine.io": {
-      "version": "3.5.0",
-      "resolved": "https://registry.npmjs.org/engine.io/-/engine.io-3.5.0.tgz",
-      "integrity": "sha512-21HlvPUKaitDGE4GXNtQ7PLP0Sz4aWLddMPw2VTyFz1FVZqu/kZsJUO8WNpKuE/OCL7nkfRaOui2ZCJloGznGA==",
+      "version": "3.1.4",
+      "resolved": "https://registry.npmjs.org/engine.io/-/engine.io-3.1.4.tgz",
+      "integrity": "sha1-PQIRtwpVLOhB/8fahiezAamkFi4=",
       "requires": {
-        "accepts": "~1.3.4",
-        "base64id": "2.0.0",
-        "cookie": "~0.4.1",
-        "debug": "~4.1.0",
-        "engine.io-parser": "~2.2.0",
-        "ws": "~7.4.2"
+        "accepts": "1.3.3",
+        "base64id": "1.0.0",
+        "cookie": "0.3.1",
+        "debug": "2.6.9",
+        "engine.io-parser": "2.1.1",
+        "uws": "0.14.5",
+        "ws": "3.3.3"
       },
       "dependencies": {
-        "cookie": {
-          "version": "0.4.1",
-          "resolved": "https://registry.npmjs.org/cookie/-/cookie-0.4.1.tgz",
-          "integrity": "sha512-ZwrFkGJxUR3EIoXtO+yVE69Eb7KlixbaeAWfBQB9vVsNn/o+Yw69gBWSSDK825hQNdN+wF8zELf3dFNl/kxkUA=="
-        },
-        "debug": {
-          "version": "4.1.1",
-          "resolved": "https://registry.npmjs.org/debug/-/debug-4.1.1.tgz",
-          "integrity": "sha512-pYAIzeRo8J6KPEaJ0VWOh5Pzkbw/RetuzehGM7QRRX5he4fPHx2rdKMB256ehJCkX+XRQm16eZLqLNS8RSZXZw==",
+        "accepts": {
+          "version": "1.3.3",
+          "resolved": "https://registry.npmjs.org/accepts/-/accepts-1.3.3.tgz",
+          "integrity": "sha1-w8p0NJOGSMPg2cHjKN1otiLChMo=",
           "requires": {
-            "ms": "^2.1.1"
+            "mime-types": "2.1.17",
+            "negotiator": "0.6.1"
           }
-        },
-        "ms": {
-          "version": "2.1.3",
-          "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.3.tgz",
-          "integrity": "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA=="
         }
       }
     },
     "engine.io-client": {
-      "version": "3.5.0",
-      "resolved": "https://registry.npmjs.org/engine.io-client/-/engine.io-client-3.5.0.tgz",
-      "integrity": "sha512-12wPRfMrugVw/DNyJk34GQ5vIVArEcVMXWugQGGuw2XxUSztFNmJggZmv8IZlLyEdnpO1QB9LkcjeWewO2vxtA==",
+      "version": "3.1.4",
+      "resolved": "https://registry.npmjs.org/engine.io-client/-/engine.io-client-3.1.4.tgz",
+      "integrity": "sha1-T88TcLRxY70s6b4nM5ckMDUNTqE=",
       "requires": {
-        "component-emitter": "~1.3.0",
+        "component-emitter": "1.2.1",
         "component-inherit": "0.0.3",
-        "debug": "~3.1.0",
-        "engine.io-parser": "~2.2.0",
+        "debug": "2.6.9",
+        "engine.io-parser": "2.1.1",
         "has-cors": "1.1.0",
         "indexof": "0.0.1",
-        "parseqs": "0.0.6",
-        "parseuri": "0.0.6",
-        "ws": "~7.4.2",
-        "xmlhttprequest-ssl": "~1.5.4",
+        "parseqs": "0.0.5",
+        "parseuri": "0.0.5",
+        "ws": "3.3.3",
+        "xmlhttprequest-ssl": "1.5.4",
         "yeast": "0.1.2"
-      },
-      "dependencies": {
-        "debug": {
-          "version": "3.1.0",
-          "resolved": "https://registry.npmjs.org/debug/-/debug-3.1.0.tgz",
-          "integrity": "sha512-OX8XqP7/1a9cqkxYw2yXss15f26NKWBpDXQd0/uK/KPqdQhxbPa994hnzjcE2VqQpDslf55723cKPUOGSmMY3g==",
-          "requires": {
-            "ms": "2.0.0"
-          }
-        }
       }
     },
     "engine.io-parser": {
-      "version": "2.2.1",
-      "resolved": "https://registry.npmjs.org/engine.io-parser/-/engine.io-parser-2.2.1.tgz",
-      "integrity": "sha512-x+dN/fBH8Ro8TFwJ+rkB2AmuVw9Yu2mockR/p3W8f8YtExwFgDvBDi0GWyb4ZLkpahtDGZgtr3zLovanJghPqg==",
+      "version": "2.1.1",
+      "resolved": "https://registry.npmjs.org/engine.io-parser/-/engine.io-parser-2.1.1.tgz",
+      "integrity": "sha1-4Ps/DgRi9/WLt3waUun1p+JuRmg=",
       "requires": {
         "after": "0.8.2",
-        "arraybuffer.slice": "~0.0.7",
-        "base64-arraybuffer": "0.1.4",
-        "blob": "0.0.5",
-        "has-binary2": "~1.0.2"
+        "arraybuffer.slice": "0.0.6",
+        "base64-arraybuffer": "0.1.5",
+        "blob": "0.0.4",
+        "has-binary2": "1.0.2"
       }
     },
     "escape-html": {
@@ -278,9 +278,9 @@
       "integrity": "sha1-PYyt2Q2XZWn6g1qx+OSyOhBWBac="
     },
     "has-binary2": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/has-binary2/-/has-binary2-1.0.3.tgz",
-      "integrity": "sha512-G1LWKhDSvhGeAQ8mPVQlqNcOB2sJdwATtZKl2pDKKHfpf/rYj24lkinxf69blJbnsvtqqNU+L3SL50vzZhXOnw==",
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/has-binary2/-/has-binary2-1.0.2.tgz",
+      "integrity": "sha1-6D26SfC5vk0CbSc2U1DZ8D9Uvpg=",
       "requires": {
         "isarray": "2.0.1"
       }
@@ -376,6 +376,11 @@
       "resolved": "https://registry.npmjs.org/negotiator/-/negotiator-0.6.1.tgz",
       "integrity": "sha1-KzJxhOiZIQEXeyhWP7XnECrNDKk="
     },
+    "object-component": {
+      "version": "0.0.3",
+      "resolved": "https://registry.npmjs.org/object-component/-/object-component-0.0.3.tgz",
+      "integrity": "sha1-8MaapQ78lbhmwYb0AKM3acsvEpE="
+    },
     "on-finished": {
       "version": "2.3.0",
       "resolved": "https://registry.npmjs.org/on-finished/-/on-finished-2.3.0.tgz",
@@ -385,14 +390,20 @@
       }
     },
     "parseqs": {
-      "version": "0.0.6",
-      "resolved": "https://registry.npmjs.org/parseqs/-/parseqs-0.0.6.tgz",
-      "integrity": "sha512-jeAGzMDbfSHHA091hr0r31eYfTig+29g3GKKE/PPbEQ65X0lmMwlEoqmhzu0iztID5uJpZsFlUPDP8ThPL7M8w=="
+      "version": "0.0.5",
+      "resolved": "https://registry.npmjs.org/parseqs/-/parseqs-0.0.5.tgz",
+      "integrity": "sha1-1SCKNzjkZ2bikbouoXNoSSGouJ0=",
+      "requires": {
+        "better-assert": "1.0.2"
+      }
     },
     "parseuri": {
-      "version": "0.0.6",
-      "resolved": "https://registry.npmjs.org/parseuri/-/parseuri-0.0.6.tgz",
-      "integrity": "sha512-AUjen8sAkGgao7UyCX6Ahv0gIK2fABKmYjvP4xmy5JaKvcbTRueIqIPHLAfq30xJddqSE033IOMUSOMCcK3Sow=="
+      "version": "0.0.5",
+      "resolved": "https://registry.npmjs.org/parseuri/-/parseuri-0.0.5.tgz",
+      "integrity": "sha1-gCBKUNTbt3m/3G6+J3jZDkvOMgo=",
+      "requires": {
+        "better-assert": "1.0.2"
+      }
     },
     "parseurl": {
       "version": "1.3.2",
@@ -476,104 +487,51 @@
       "integrity": "sha512-BvE/TwpZX4FXExxOxZyRGQQv651MSwmWKZGqvmPcRIjDqWub67kTKuIMx43cZZrS/cBBzwBcNDWoFxt2XEFIpQ=="
     },
     "socket.io": {
-      "version": "2.4.0",
-      "resolved": "https://registry.npmjs.org/socket.io/-/socket.io-2.4.0.tgz",
-      "integrity": "sha512-9UPJ1UTvKayuQfVv2IQ3k7tCQC/fboDyIK62i99dAQIyHKaBsNdTpwHLgKJ6guRWxRtC9H+138UwpaGuQO9uWQ==",
+      "version": "2.0.4",
+      "resolved": "https://registry.npmjs.org/socket.io/-/socket.io-2.0.4.tgz",
+      "integrity": "sha1-waRZDO/4fs8TxyZS8Eb3FrKeYBQ=",
       "requires": {
-        "debug": "~4.1.0",
-        "engine.io": "~3.5.0",
-        "has-binary2": "~1.0.2",
-        "socket.io-adapter": "~1.1.0",
-        "socket.io-client": "2.4.0",
-        "socket.io-parser": "~3.4.0"
-      },
-      "dependencies": {
-        "debug": {
-          "version": "4.1.1",
-          "resolved": "https://registry.npmjs.org/debug/-/debug-4.1.1.tgz",
-          "integrity": "sha512-pYAIzeRo8J6KPEaJ0VWOh5Pzkbw/RetuzehGM7QRRX5he4fPHx2rdKMB256ehJCkX+XRQm16eZLqLNS8RSZXZw==",
-          "requires": {
-            "ms": "^2.1.1"
-          }
-        },
-        "ms": {
-          "version": "2.1.3",
-          "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.3.tgz",
-          "integrity": "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA=="
-        }
+        "debug": "2.6.9",
+        "engine.io": "3.1.4",
+        "socket.io-adapter": "1.1.1",
+        "socket.io-client": "2.0.4",
+        "socket.io-parser": "3.1.2"
       }
     },
     "socket.io-adapter": {
-      "version": "1.1.2",
-      "resolved": "https://registry.npmjs.org/socket.io-adapter/-/socket.io-adapter-1.1.2.tgz",
-      "integrity": "sha512-WzZRUj1kUjrTIrUKpZLEzFZ1OLj5FwLlAFQs9kuZJzJi5DKdU7FsWc36SNmA8iDOtwBQyT8FkrriRM8vXLYz8g=="
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/socket.io-adapter/-/socket.io-adapter-1.1.1.tgz",
+      "integrity": "sha1-KoBeihTWNyEk3ZFZrUUC+MsH8Gs="
     },
     "socket.io-client": {
-      "version": "2.4.0",
-      "resolved": "https://registry.npmjs.org/socket.io-client/-/socket.io-client-2.4.0.tgz",
-      "integrity": "sha512-M6xhnKQHuuZd4Ba9vltCLT9oa+YvTsP8j9NcEiLElfIg8KeYPyhWOes6x4t+LTAC8enQbE/995AdTem2uNyKKQ==",
+      "version": "2.0.4",
+      "resolved": "https://registry.npmjs.org/socket.io-client/-/socket.io-client-2.0.4.tgz",
+      "integrity": "sha1-CRilUkBtxeVAs4Dc2Xr8SmQzL44=",
       "requires": {
         "backo2": "1.0.2",
+        "base64-arraybuffer": "0.1.5",
         "component-bind": "1.0.0",
-        "component-emitter": "~1.3.0",
-        "debug": "~3.1.0",
-        "engine.io-client": "~3.5.0",
-        "has-binary2": "~1.0.2",
+        "component-emitter": "1.2.1",
+        "debug": "2.6.9",
+        "engine.io-client": "3.1.4",
+        "has-cors": "1.1.0",
         "indexof": "0.0.1",
-        "parseqs": "0.0.6",
-        "parseuri": "0.0.6",
-        "socket.io-parser": "~3.3.0",
+        "object-component": "0.0.3",
+        "parseqs": "0.0.5",
+        "parseuri": "0.0.5",
+        "socket.io-parser": "3.1.2",
         "to-array": "0.1.4"
-      },
-      "dependencies": {
-        "debug": {
-          "version": "3.1.0",
-          "resolved": "https://registry.npmjs.org/debug/-/debug-3.1.0.tgz",
-          "integrity": "sha512-OX8XqP7/1a9cqkxYw2yXss15f26NKWBpDXQd0/uK/KPqdQhxbPa994hnzjcE2VqQpDslf55723cKPUOGSmMY3g==",
-          "requires": {
-            "ms": "2.0.0"
-          }
-        },
-        "socket.io-parser": {
-          "version": "3.3.2",
-          "resolved": "https://registry.npmjs.org/socket.io-parser/-/socket.io-parser-3.3.2.tgz",
-          "integrity": "sha512-FJvDBuOALxdCI9qwRrO/Rfp9yfndRtc1jSgVgV8FDraihmSP/MLGD5PEuJrNfjALvcQ+vMDM/33AWOYP/JSjDg==",
-          "requires": {
-            "component-emitter": "~1.3.0",
-            "debug": "~3.1.0",
-            "isarray": "2.0.1"
-          }
-        }
       }
     },
     "socket.io-parser": {
-      "version": "3.4.1",
-      "resolved": "https://registry.npmjs.org/socket.io-parser/-/socket.io-parser-3.4.1.tgz",
-      "integrity": "sha512-11hMgzL+WCLWf1uFtHSNvliI++tcRUWdoeYuwIl+Axvwy9z2gQM+7nJyN3STj1tLj5JyIUH8/gpDGxzAlDdi0A==",
+      "version": "3.1.2",
+      "resolved": "https://registry.npmjs.org/socket.io-parser/-/socket.io-parser-3.1.2.tgz",
+      "integrity": "sha1-28IoIVH8T6675Aru3Ady66YZ9/I=",
       "requires": {
         "component-emitter": "1.2.1",
-        "debug": "~4.1.0",
+        "debug": "2.6.9",
+        "has-binary2": "1.0.2",
         "isarray": "2.0.1"
-      },
-      "dependencies": {
-        "component-emitter": {
-          "version": "1.2.1",
-          "resolved": "https://registry.npmjs.org/component-emitter/-/component-emitter-1.2.1.tgz",
-          "integrity": "sha1-E3kY1teCg/ffemt8WmPhQOaUJeY="
-        },
-        "debug": {
-          "version": "4.1.1",
-          "resolved": "https://registry.npmjs.org/debug/-/debug-4.1.1.tgz",
-          "integrity": "sha512-pYAIzeRo8J6KPEaJ0VWOh5Pzkbw/RetuzehGM7QRRX5he4fPHx2rdKMB256ehJCkX+XRQm16eZLqLNS8RSZXZw==",
-          "requires": {
-            "ms": "^2.1.1"
-          }
-        },
-        "ms": {
-          "version": "2.1.3",
-          "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.3.tgz",
-          "integrity": "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA=="
-        }
       }
     },
     "statuses": {
@@ -595,6 +553,11 @@
         "mime-types": "2.1.17"
       }
     },
+    "ultron": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/ultron/-/ultron-1.1.1.tgz",
+      "integrity": "sha512-UIEXBNeYmKptWH6z8ZnqTeS8fV74zG0/eRU9VGkpzz+LIJNs8W/zM/L+7ctCkRrgbNnnR0xxw4bKOr0cW0N0Og=="
+    },
     "unpipe": {
       "version": "1.0.0",
       "resolved": "https://registry.npmjs.org/unpipe/-/unpipe-1.0.0.tgz",
@@ -605,20 +568,31 @@
       "resolved": "https://registry.npmjs.org/utils-merge/-/utils-merge-1.0.1.tgz",
       "integrity": "sha1-n5VxD1CiZ5R7LMwSR0HBAoQn5xM="
     },
+    "uws": {
+      "version": "0.14.5",
+      "resolved": "https://registry.npmjs.org/uws/-/uws-0.14.5.tgz",
+      "integrity": "sha1-Z6rzPEaypYel9mZtAPdpEyjxSdw=",
+      "optional": true
+    },
     "vary": {
       "version": "1.1.2",
       "resolved": "https://registry.npmjs.org/vary/-/vary-1.1.2.tgz",
       "integrity": "sha1-IpnwLG3tMNSllhsLn3RSShj2NPw="
     },
     "ws": {
-      "version": "7.4.2",
-      "resolved": "https://registry.npmjs.org/ws/-/ws-7.4.2.tgz",
-      "integrity": "sha512-T4tewALS3+qsrpGI/8dqNMLIVdq/g/85U98HPMa6F0m6xTbvhXU6RCQLqPH3+SlomNV/LdY6RXEbBpMH6EOJnA=="
+      "version": "3.3.3",
+      "resolved": "https://registry.npmjs.org/ws/-/ws-3.3.3.tgz",
+      "integrity": "sha512-nnWLa/NwZSt4KQJu51MYlCcSQ5g7INpOrOMt4XV8j4dqTXdmlUmSHQ8/oLC069ckre0fRsgfvsKwbTdtKLCDkA==",
+      "requires": {
+        "async-limiter": "1.0.0",
+        "safe-buffer": "5.1.1",
+        "ultron": "1.1.1"
+      }
     },
     "xmlhttprequest-ssl": {
-      "version": "1.5.5",
-      "resolved": "https://registry.npmjs.org/xmlhttprequest-ssl/-/xmlhttprequest-ssl-1.5.5.tgz",
-      "integrity": "sha1-wodrBhaKrcQOV9l+gRkayPQ5iz4="
+      "version": "1.5.4",
+      "resolved": "https://registry.npmjs.org/xmlhttprequest-ssl/-/xmlhttprequest-ssl-1.5.4.tgz",
+      "integrity": "sha1-BPVgkVcks4kIhxXMDteBPpZ3v1c="
     },
     "yeast": {
       "version": "0.1.2",

slides/autopilot/package.json

@@ -3,6 +3,6 @@
   "version": "0.0.1",
   "dependencies": {
     "express": "^4.16.2",
-    "socket.io": "^2.4.0"
+    "socket.io": "^2.0.4"
   }
 }

slides/containers/Compose_For_Dev_Stacks.md

@@ -329,4 +329,4 @@ This is ideal to debug regressions, do side-by-side comparisons, etc.
 :EN:- Connecting services together with a *Compose file*
 
 :FR:- Utiliser Compose pour décrire son environnement
-:FR:- Écrire un *Compose file* pour connecter les services entre eux
+:FR:- Écrire un *Compose file* pour connecter les services entre eux

slides/containers/Container_Network_Model.md

@@ -307,8 +307,6 @@ Let's remove the `redis` container:
 $ docker rm -f redis
 ```
 
-* `-f`: Force the removal of a running container (uses SIGKILL)
-
 And create one that doesn't block the `redis` name:
 
 ```bash
@@ -742,15 +740,3 @@ class: extra-details
 * This may be used to access an internal package repository.
 
   (But try to use a multi-stage build instead, if possible!)
-
-???
-
-:EN:Container networking essentials
-:EN:- The Container Network Model
-:EN:- Container isolation
-:EN:- Service discovery
-
-:FR:Mettre ses conteneurs en réseau
-:FR:- Le "Container Network Model"
-:FR:- Isolation des conteneurs
-:FR:- *Service discovery*

slides/containers/Container_Networking_Basics.md

@@ -229,5 +229,10 @@ containers together without exposing their ports.
 
 ???
 
-:EN:- Exposing single containers
-:FR:- Exposer un conteneur isolé
+:EN:Connecting containers
+:EN:- Container networking basics
+:EN:- Exposing a container
+
+:FR:Connecter les conteneurs
+:FR:- Description du modèle réseau des conteneurs
+:FR:- Exposer un conteneur

slides/containers/Copying_Files_During_Build.md

@@ -101,5 +101,5 @@ Success!
 
 ???
 
-:EN:- Leveraging the build cache for faster builds
+:EN:- The build cache
 :FR:- Tirer parti du cache afin d'optimiser la vitesse de *build*

slides/containers/Dockerfile_Tips.md

@@ -424,7 +424,7 @@ services:
 
 - In this chapter, we showed many ways to write Dockerfiles.
 
-- These Dockerfiles use sometimes diametrically opposed techniques.
+- These Dockerfiles use sometimes diametrally opposed techniques.
 
 - Yet, they were the "right" ones *for a specific situation.*
 
@@ -434,12 +434,5 @@ services:
 
 ???
 
-:EN:Optimizing images
 :EN:- Dockerfile tips, tricks, and best practices
-:EN:- Reducing build time
-:EN:- Reducing image size
-
-:FR:Optimiser ses images
-:FR:- Bonnes pratiques, trucs et astuces
-:FR:- Réduire le temps de build
-:FR:- Réduire la taille des images
+:FR:- Bonnes pratiques pour la construction des images

slides/containers/Logging.md

@@ -1,4 +1,4 @@
-# Logging
+# Logging (extra material)
 
 In this chapter, we will explain the different ways to send logs from containers.
 

slides/containers/Network_Drivers.md

@@ -82,12 +82,3 @@ Use cases:
 * Those containers can communicate over their `lo` interface.
   <br/>(i.e. one can bind to 127.0.0.1 and the others can connect to it.)
 
-???
-
-:EN:Advanced container networking
-:EN:- Transparent network access with the "host" driver
-:EN:- Sharing is caring with the "container" driver
-
-:FR:Paramétrage réseau avancé
-:FR:- Accès transparent au réseau avec le mode "host"
-:FR:- Partage de la pile réseau avece le mode "container"

slides/containers/Training_Environment.md

@@ -95,24 +95,6 @@ $ ssh <login>@<ip-address>
 
 ---
 
-class: in-person
-
-## `tailhist`
-
-The shell history of the instructor is available online in real time.
-
-Note the IP address of the instructor's virtual machine (A.B.C.D).
-
-Open http://A.B.C.D:1088 in your browser and you should see the history.
-
-The history is updated in real time (using a WebSocket connection).
-
-It should be green when the WebSocket is connected.
-
-If it turns red, reloading the page should fix it.
-
----
-
 ## Checking your Virtual Machine
 
 Once logged in, make sure that you can run a basic Docker command:

slides/containers/Windows_Containers.md

@@ -119,7 +119,7 @@ Nano and LinuxKit VMs in Hyper-V!)
 
   - golang, mongo, python, redis, hello-world ... and more being added
 
-  - you should still use `--platform` with multi-os images to be certain
+  - you should still use `--plaform` with multi-os images to be certain
 
 - Windows Containers now support `localhost` accessible containers (July 2018)
 

slides/helm.yml

@@ -1,43 +0,0 @@
-title: |
-  Packaging d'applications
-  et CI/CD pour Kubernetes
-
-#chat: "[Gitter](https://gitter.im/jpetazzo/training-202102-online)"
-
-gitrepo: github.com/jpetazzo/container.training
-
-slides: https://2021-04-dijon.container.training/
-
-#slidenumberprefix: "#SomeHashTag — "
-
-exclude:
-- self-paced
-
-content:
-- shared/title.md
-#- logistics.md
-- k8s/intro.md
-- shared/about-slides.md
-- shared/prereqs.md
-- shared/webssh.md
-- shared/connecting.md
-#- shared/chat-room-im.md
-#- shared/chat-room-zoom.md
-- shared/toc.md
--
-  - shared/sampleapp.md
-  - k8s/helm-intro.md
-  - k8s/helm-chart-format.md
-  - k8s/helm-create-basic-chart.md
--
-  - k8s/helm-create-better-chart.md
-  - k8s/helm-dependencies.md
-  - k8s/helm-values-schema-validation.md
-  - k8s/helm-secrets.md
--
-  - k8s/cert-manager.md
-  - k8s/gitlab.md
-  - |
-    # (Extra content)
-  - k8s/prometheus.md
-

slides/images/k8s-net-1-pod-to-pod.svg

@@ -1,519 +0,0 @@
-<?xml version="1.0" encoding="UTF-8" standalone="no"?>
-<svg
-   xmlns:dc="http://purl.org/dc/elements/1.1/"
-   xmlns:cc="http://creativecommons.org/ns#"
-   xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"
-   xmlns:svg="http://www.w3.org/2000/svg"
-   xmlns="http://www.w3.org/2000/svg"
-   xmlns:sodipodi="http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd"
-   xmlns:inkscape="http://www.inkscape.org/namespaces/inkscape"
-   version="1.1"
-   viewBox="16 32 880 495"
-   fill="none"
-   stroke="none"
-   stroke-linecap="square"
-   stroke-miterlimit="10"
-   id="svg464"
-   sodipodi:docname="k8s-net-1-pod-to-pod.svg"
-   width="1600"
-   height="900"
-   inkscape:version="1.0.1 (3bc2e813f5, 2020-09-07, custom)">
-  <metadata
-     id="metadata470">
-    <rdf:RDF>
-      <cc:Work
-         rdf:about="">
-        <dc:format>image/svg+xml</dc:format>
-        <dc:type
-           rdf:resource="http://purl.org/dc/dcmitype/StillImage" />
-      </cc:Work>
-    </rdf:RDF>
-  </metadata>
-  <defs
-     id="defs468" />
-  <sodipodi:namedview
-     pagecolor="#ffffff"
-     bordercolor="#666666"
-     borderopacity="1"
-     objecttolerance="10"
-     gridtolerance="10"
-     guidetolerance="10"
-     inkscape:pageopacity="0"
-     inkscape:pageshadow="2"
-     inkscape:window-width="476"
-     inkscape:window-height="1032"
-     id="namedview466"
-     showgrid="false"
-     inkscape:zoom="1.0208333"
-     inkscape:cx="480"
-     inkscape:cy="360"
-     inkscape:window-x="480"
-     inkscape:window-y="18"
-     inkscape:window-maximized="0"
-     inkscape:current-layer="svg464" />
-  <clipPath
-     id="p.0">
-    <path
-       d="M 0,0 H 960 V 720 H 0 Z"
-       clip-rule="nonzero"
-       id="path317" />
-  </clipPath>
-  <g
-     clip-path="url(#p.0)"
-     id="g462">
-    <path
-       fill="#000000"
-       fill-opacity="0"
-       d="M 0,0 H 960 V 720 H 0 Z"
-       fill-rule="evenodd"
-       id="path320" />
-    <path
-       fill="#d9d9d9"
-       d="m 66.944885,154.29968 v 0 c 0,-13.08115 10.604363,-23.68552 23.685509,-23.68552 H 296.55071 c 6.28177,0 12.30628,2.49544 16.74817,6.93734 4.4419,4.44189 6.93732,10.4664 6.93732,16.74818 v 94.73921 c 0,13.08116 -10.60434,23.6855 -23.68549,23.6855 H 90.630394 c -13.081146,0 -23.685509,-10.60434 -23.685509,-23.6855 z"
-       fill-rule="evenodd"
-       id="path322" />
-    <path
-       stroke="#434343"
-       stroke-width="2"
-       stroke-linejoin="round"
-       stroke-linecap="butt"
-       d="m 66.944885,154.29968 v 0 c 0,-13.08115 10.604363,-23.68552 23.685509,-23.68552 H 296.55071 c 6.28177,0 12.30628,2.49544 16.74817,6.93734 4.4419,4.44189 6.93732,10.4664 6.93732,16.74818 v 94.73921 c 0,13.08116 -10.60434,23.6855 -23.68549,23.6855 H 90.630394 c -13.081146,0 -23.685509,-10.60434 -23.685509,-23.6855 z"
-       fill-rule="evenodd"
-       id="path324" />
-    <path
-       fill="#000000"
-       d="m 85.75713,154.61205 0.04687,1.23437 q 1.125,-1.40625 2.953125,-1.40625 3.125,0 3.15625,3.51563 v 6.51562 h -1.6875 v -6.51562 q -0.01563,-1.07813 -0.5,-1.57813 -0.46875,-0.51562 -1.484375,-0.51562 -0.8125,0 -1.4375,0.4375 -0.609375,0.4375 -0.96875,1.15625 v 7.01562 h -1.67187 v -9.85937 z m 8.246857,4.84375 q 0,-1.45313 0.5625,-2.60938 0.578125,-1.15625 1.59375,-1.78125 1.015625,-0.625 2.3125,-0.625 2.015623,0 3.250003,1.39063 1.25,1.39062 1.25,3.70312 v 0.125 q 0,1.4375 -0.54688,2.57813 -0.54687,1.14062 -1.57812,1.78125 -1.015628,0.64062 -2.359378,0.64062 -2,0 -3.25,-1.39062 -1.234375,-1.40625 -1.234375,-3.70313 z m 1.6875,0.20312 q 0,1.64063 0.765625,2.64063 0.765625,0.98437 2.03125,0.98437 1.296875,0 2.046878,-1 0.75,-1.01562 0.75,-2.82812 0,-1.625 -0.76563,-2.625 -0.765623,-1.01563 -2.046873,-1.01563 -1.25,0 -2.015625,1 -0.765625,0.98438 -0.765625,2.84375 z m 8.983643,-0.20312 q 0,-2.26563 1.07813,-3.64063 1.07812,-1.375 2.8125,-1.375 1.73437,0 2.75,1.17188 v -5.14063 h 1.6875 v 14 h -1.54688 l -0.0937,-1.0625 q -1,1.25 -2.8125,1.25 -1.70312,0 -2.79687,-1.40625 -1.07813,-1.40625 -1.07813,-3.65625 z m 1.6875,0.20312 q 0,1.67188 0.6875,2.625 0.70313,0.9375 1.92188,0.9375 1.60937,0 2.34375,-1.4375 v -4.53125 q -0.76563,-1.39062 -2.32813,-1.39062 -1.23437,0 -1.9375,0.95312 -0.6875,0.95313 -0.6875,2.84375 z m 13.33397,5 q -2,0 -3.26563,-1.3125 -1.25,-1.32812 -1.25,-3.53125 v -0.3125 q 0,-1.46875 0.5625,-2.60937 0.5625,-1.15625 1.5625,-1.79688 1.01563,-0.65625 2.1875,-0.65625 1.92188,0 2.98438,1.26563 1.0625,1.26562 1.0625,3.625 v 0.6875 h -6.67188 q 0.0312,1.46875 0.84375,2.375 0.82813,0.89062 2.07813,0.89062 0.89062,0 1.51562,-0.35937 0.625,-0.375 1.07813,-0.96875 l 1.03125,0.79687 q -1.23438,1.90625 -3.71875,1.90625 z m -0.20313,-8.84375 q -1.01562,0 -1.71875,0.75 -0.6875,0.73438 -0.84375,2.07813 h 4.9375 v -0.125 q -0.0781,-1.28125 -0.70312,-1.98438 -0.60938,-0.71875 -1.67188,-0.71875 z"
-       fill-rule="nonzero"
-       id="path326" />
-    <path
-       fill="#000000"
-       fill-opacity="0"
-       d="M 741.52496,67.91863 H 819.2572"
-       fill-rule="evenodd"
-       id="path328" />
-    <path
-       stroke="#0000ff"
-       stroke-width="4"
-       stroke-linejoin="round"
-       stroke-linecap="butt"
-       d="M 741.52496,67.91863 H 819.2572"
-       fill-rule="evenodd"
-       id="path330" />
-    <path
-       fill="#000000"
-       fill-opacity="0"
-       d="M 692.19946,70.157394 H 868.57745 V 116.01565 H 692.19946 Z"
-       fill-rule="evenodd"
-       id="path332" />
-    <path
-       fill="#000000"
-       d="m 747.46643,91.32864 q 0,2.078125 -0.96875,3.359375 -0.95313,1.28125 -2.57813,1.28125 -1.67187,0 -2.625,-1.0625 v 4.40625 h -1.5625 V 86.64114 h 1.42188 l 0.0781,1.015625 q 0.95313,-1.1875 2.65625,-1.1875 1.65625,0 2.60938,1.25 0.96875,1.234375 0.96875,3.453125 z m -1.5625,-0.1875 q 0,-1.546875 -0.67188,-2.4375 -0.65625,-0.90625 -1.8125,-0.90625 -1.42187,0 -2.125,1.265625 v 4.375 q 0.70313,1.25 2.15625,1.25 1.125,0 1.78125,-0.890625 0.67188,-0.890625 0.67188,-2.65625 z m 3.12799,0 q 0,-1.34375 0.53125,-2.421875 0.53125,-1.078125 1.46875,-1.65625 0.95313,-0.59375 2.15625,-0.59375 1.875,0 3.03125,1.296875 1.15625,1.296875 1.15625,3.453125 v 0.109375 q 0,1.328125 -0.51562,2.390625 -0.51563,1.0625 -1.46875,1.65625 -0.95313,0.59375 -2.1875,0.59375 -1.85938,0 -3.01563,-1.296875 -1.15625,-1.296875 -1.15625,-3.421875 z m 1.57813,0.1875 q 0,1.515625 0.70312,2.4375 0.70313,0.921875 1.89063,0.921875 1.20312,0 1.89062,-0.9375 0.70313,-0.9375 0.70313,-2.609375 0,-1.515625 -0.71875,-2.4375 -0.70313,-0.9375 -1.89063,-0.9375 -1.15625,0 -1.875,0.921875 -0.70312,0.921875 -0.70312,2.640625 z m 8.33557,-0.1875 q 0,-2.109375 1,-3.390625 1,-1.28125 2.625,-1.28125 1.60937,0 2.54687,1.109375 v -4.78125 h 1.5625 v 13 h -1.4375 l -0.0781,-0.984375 q -0.9375,1.15625 -2.60938,1.15625 -1.59375,0 -2.60937,-1.296875 -1,-1.3125 -1,-3.40625 z m 1.57812,0.1875 q 0,1.546875 0.64063,2.4375 0.64062,0.875 1.76562,0.875 1.5,0 2.1875,-1.34375 v -4.203125 q -0.70312,-1.296875 -2.15625,-1.296875 -1.15625,0 -1.79687,0.890625 -0.64063,0.890625 -0.64063,2.640625 z m 11.83496,-0.125 h -4.125 v -1.28125 h 4.125 z m 3.65546,-6.78125 v 2.21875 h 1.70312 v 1.21875 h -1.70312 v 5.671875 q 0,0.546875 0.21875,0.828125 0.23437,0.265625 0.78125,0.265625 0.26562,0 0.75,-0.09375 v 1.265625 q -0.625,0.171875 -1.20313,0.171875 -1.04687,0 -1.57812,-0.625 -0.53125,-0.640625 -0.53125,-1.8125 V 87.85989 h -1.67188 v -1.21875 h 1.67188 v -2.21875 z m 2.94427,6.71875 q 0,-1.34375 0.53125,-2.421875 0.53125,-1.078125 1.46875,-1.65625 0.95313,-0.59375 2.15625,-0.59375 1.875,0 3.03125,1.296875 1.15625,1.296875 1.15625,3.453125 v 0.109375 q 0,1.328125 -0.51562,2.390625 -0.51563,1.0625 -1.46875,1.65625 -0.95313,0.59375 -2.1875,0.59375 -1.85938,0 -3.01563,-1.296875 -1.15625,-1.296875 -1.15625,-3.421875 z m 1.57813,0.1875 q 0,1.515625 0.70312,2.4375 0.70313,0.921875 1.89063,0.921875 1.20312,0 1.89062,-0.9375 0.70313,-0.9375 0.70313,-2.609375 0,-1.515625 -0.71875,-2.4375 -0.70313,-0.9375 -1.89063,-0.9375 -1.15625,0 -1.875,0.921875 -0.70312,0.921875 -0.70312,2.640625 z m 11.9762,-0.125 h -4.125 v -1.28125 h 4.125 z m 9.26483,0.125 q 0,2.078125 -0.96875,3.359375 -0.95313,1.28125 -2.57813,1.28125 -1.67187,0 -2.625,-1.0625 v 4.40625 h -1.5625 V 86.64114 h 1.42188 l 0.0781,1.015625 q 0.95313,-1.1875 2.65625,-1.1875 1.65625,0 2.60938,1.25 0.96875,1.234375 0.96875,3.453125 z m -1.5625,-0.1875 q 0,-1.546875 -0.67188,-2.4375 -0.65625,-0.90625 -1.8125,-0.90625 -1.42187,0 -2.125,1.265625 v 4.375 q 0.70313,1.25 2.15625,1.25 1.125,0 1.78125,-0.890625 0.67188,-0.890625 0.67188,-2.65625 z m 3.12793,0 q 0,-1.34375 0.53125,-2.421875 0.53125,-1.078125 1.46875,-1.65625 0.95312,-0.59375 2.15625,-0.59375 1.875,0 3.03125,1.296875 1.15625,1.296875 1.15625,3.453125 v 0.109375 q 0,1.328125 -0.51563,2.390625 -0.51562,1.0625 -1.46875,1.65625 -0.95312,0.59375 -2.1875,0.59375 -1.85937,0 -3.01562,-1.296875 -1.15625,-1.296875 -1.15625,-3.421875 z m 1.57812,0.1875 q 0,1.515625 0.70313,2.4375 0.70312,0.921875 1.89062,0.921875 1.20313,0 1.89063,-0.9375 0.70312,-0.9375 0.70312,-2.609375 0,-1.515625 -0.71875,-2.4375 -0.70312,-0.9375 -1.89062,-0.9375 -1.15625,0 -1.875,0.921875 -0.70313,0.921875 -0.70313,2.640625 z m 8.33557,-0.1875 q 0,-2.109375 1,-3.390625 1,-1.28125 2.625,-1.28125 1.60938,0 2.54688,1.109375 v -4.78125 h 1.5625 v 13 h -1.4375 l -0.0781,-0.984375 q -0.9375,1.15625 -2.60937,1.15625 -1.59375,0 -2.60938,-1.296875 -1,-1.3125 -1,-3.40625 z m 1.57813,0.1875 q 0,1.546875 0.64062,2.4375 0.64063,0.875 1.76563,0.875 1.5,0 2.1875,-1.34375 v -4.203125 q -0.70313,-1.296875 -2.15625,-1.296875 -1.15625,0 -1.79688,0.890625 -0.64062,0.890625 -0.64062,2.640625 z"
-       fill-rule="nonzero"
-       id="path334" />
-    <path
-       fill="#f4cccc"
-       d="m 228.27559,151.61942 h 63.53264 l 8.34137,8.34138 v 41.70587 h -71.87401 z"
-       fill-rule="evenodd"
-       id="path336" />
-    <path
-       stroke="#434343"
-       stroke-width="1"
-       stroke-linejoin="round"
-       stroke-linecap="butt"
-       d="m 228.27559,151.61942 h 63.53264 l 8.34137,8.34138 v 41.70587 h -71.87401 z"
-       fill-rule="evenodd"
-       id="path338" />
-    <path
-       fill="#000000"
-       d="m 246.86934,177.89761 q 0,2.25 -1.03125,3.625 -1.01563,1.375 -2.78125,1.375 -1.79688,0 -2.82813,-1.14063 v 4.75 h -1.67187 v -13.65625 h 1.53125 l 0.0781,1.09375 q 1.03125,-1.26562 2.85938,-1.26562 1.78125,0 2.8125,1.34375 1.03125,1.32812 1.03125,3.71875 z m -1.67188,-0.20313 q 0,-1.65625 -0.71875,-2.625 -0.70312,-0.96875 -1.95312,-0.96875 -1.53125,0 -2.29688,1.35938 v 4.70312 q 0.76563,1.35938 2.32813,1.35938 1.20312,0 1.92187,-0.95313 0.71875,-0.96875 0.71875,-2.875 z m 3.37307,0 q 0,-1.45312 0.5625,-2.60937 0.57812,-1.15625 1.59375,-1.78125 1.01562,-0.625 2.3125,-0.625 2.01562,0 3.25,1.39062 1.25,1.39063 1.25,3.70313 v 0.125 q 0,1.4375 -0.54688,2.57812 -0.54687,1.14063 -1.57812,1.78125 -1.01563,0.64063 -2.35938,0.64063 -2,0 -3.25,-1.39063 -1.23437,-1.40625 -1.23437,-3.70312 z m 1.6875,0.20313 q 0,1.64062 0.76562,2.64062 0.76563,0.98438 2.03125,0.98438 1.29688,0 2.04688,-1 0.75,-1.01563 0.75,-2.82813 0,-1.625 -0.76563,-2.625 -0.76562,-1.01562 -2.04687,-1.01562 -1.25,0 -2.01563,1 -0.76562,0.98437 -0.76562,2.84375 z m 8.98364,-0.20313 q 0,-2.26562 1.07813,-3.64062 1.07812,-1.375 2.8125,-1.375 1.73437,0 2.75,1.17187 v -5.14062 h 1.6875 v 14 h -1.54688 l -0.0937,-1.0625 q -1,1.25 -2.8125,1.25 -1.70312,0 -2.79687,-1.40625 -1.07813,-1.40625 -1.07813,-3.65625 z m 1.6875,0.20313 q 0,1.67187 0.6875,2.625 0.70313,0.9375 1.92188,0.9375 1.60937,0 2.34375,-1.4375 v -4.53125 q -0.76563,-1.39063 -2.32813,-1.39063 -1.23437,0 -1.9375,0.95313 -0.6875,0.95312 -0.6875,2.84375 z"
-       fill-rule="nonzero"
-       id="path340" />
-    <path
-       fill="#f4cccc"
-       d="m 180.86351,212.08398 h 63.53265 l 8.34137,8.34138 v 41.70586 h -71.87402 z"
-       fill-rule="evenodd"
-       id="path342" />
-    <path
-       stroke="#434343"
-       stroke-width="1"
-       stroke-linejoin="round"
-       stroke-linecap="butt"
-       d="m 180.86351,212.08398 h 63.53265 l 8.34137,8.34138 v 41.70586 h -71.87402 z"
-       fill-rule="evenodd"
-       id="path344" />
-    <path
-       fill="#000000"
-       d="m 199.45726,238.36217 q 0,2.25 -1.03125,3.625 -1.01563,1.375 -2.78125,1.375 -1.79688,0 -2.82813,-1.14063 v 4.75 h -1.67187 v -13.65625 h 1.53125 l 0.0781,1.09375 q 1.03125,-1.26562 2.85938,-1.26562 1.78125,0 2.8125,1.34375 1.03125,1.32812 1.03125,3.71875 z m -1.67188,-0.20313 q 0,-1.65625 -0.71875,-2.625 -0.70312,-0.96875 -1.95312,-0.96875 -1.53125,0 -2.29688,1.35938 v 4.70312 q 0.76563,1.35938 2.32813,1.35938 1.20312,0 1.92187,-0.95313 0.71875,-0.96875 0.71875,-2.875 z m 3.37307,0 q 0,-1.45312 0.5625,-2.60937 0.57812,-1.15625 1.59375,-1.78125 1.01562,-0.625 2.3125,-0.625 2.01562,0 3.25,1.39062 1.25,1.39063 1.25,3.70313 v 0.125 q 0,1.4375 -0.54688,2.57812 -0.54687,1.14063 -1.57812,1.78125 -1.01563,0.64063 -2.35938,0.64063 -2,0 -3.25,-1.39063 -1.23437,-1.40625 -1.23437,-3.70312 z m 1.6875,0.20313 q 0,1.64062 0.76562,2.64062 0.76563,0.98438 2.03125,0.98438 1.29688,0 2.04688,-1 0.75,-1.01563 0.75,-2.82813 0,-1.625 -0.76563,-2.625 -0.76562,-1.01562 -2.04687,-1.01562 -1.25,0 -2.01563,1 -0.76562,0.98437 -0.76562,2.84375 z m 8.98364,-0.20313 q 0,-2.26562 1.07813,-3.64062 1.07812,-1.375 2.8125,-1.375 1.73437,0 2.75,1.17187 v -5.14062 h 1.6875 v 14 h -1.54688 l -0.0937,-1.0625 q -1,1.25 -2.8125,1.25 -1.70312,0 -2.79687,-1.40625 -1.07813,-1.40625 -1.07813,-3.65625 z m 1.6875,0.20313 q 0,1.67187 0.6875,2.625 0.70313,0.9375 1.92188,0.9375 1.60937,0 2.34375,-1.4375 v -4.53125 q -0.76563,-1.39063 -2.32813,-1.39063 -1.23437,0 -1.9375,0.95313 -0.6875,0.95312 -0.6875,2.84375 z"
-       fill-rule="nonzero"
-       id="path346" />
-    <path
-       fill="#d9d9d9"
-       d="m 398.08398,209.82724 v 0 c 0,-13.08115 10.60437,-23.6855 23.68552,-23.6855 h 205.92032 c 6.2818,0 12.30627,2.49542 16.74817,6.93732 4.44189,4.44189 6.93731,10.4664 6.93731,16.74818 v 94.73923 c 0,13.08115 -10.60437,23.68552 -23.68548,23.68552 H 421.7695 c -13.08115,0 -23.68552,-10.60437 -23.68552,-23.68552 z"
-       fill-rule="evenodd"
-       id="path348" />
-    <path
-       stroke="#434343"
-       stroke-width="2"
-       stroke-linejoin="round"
-       stroke-linecap="butt"
-       d="m 398.08398,209.82724 v 0 c 0,-13.08115 10.60437,-23.6855 23.68552,-23.6855 h 205.92032 c 6.2818,0 12.30627,2.49542 16.74817,6.93732 4.44189,4.44189 6.93731,10.4664 6.93731,16.74818 v 94.73923 c 0,13.08115 -10.60437,23.68552 -23.68548,23.68552 H 421.7695 c -13.08115,0 -23.68552,-10.60437 -23.68552,-23.68552 z"
-       fill-rule="evenodd"
-       id="path350" />
-    <path
-       fill="#000000"
-       d="m 416.89624,210.1396 0.0469,1.23437 q 1.125,-1.40625 2.95313,-1.40625 3.125,0 3.15625,3.51563 v 6.51562 h -1.6875 v -6.51562 q -0.0156,-1.07813 -0.5,-1.57813 -0.46875,-0.51562 -1.48438,-0.51562 -0.8125,0 -1.4375,0.4375 -0.60937,0.4375 -0.96875,1.15625 v 7.01562 h -1.67187 v -9.85937 z m 8.24686,4.84375 q 0,-1.45313 0.5625,-2.60938 0.57812,-1.15625 1.59375,-1.78125 1.01562,-0.625 2.3125,-0.625 2.01562,0 3.25,1.39063 1.25,1.39062 1.25,3.70312 v 0.125 q 0,1.4375 -0.54688,2.57813 -0.54687,1.14062 -1.57812,1.78125 -1.01563,0.64062 -2.35938,0.64062 -2,0 -3.25,-1.39062 -1.23437,-1.40625 -1.23437,-3.70313 z m 1.6875,0.20312 q 0,1.64063 0.76562,2.64063 0.76563,0.98437 2.03125,0.98437 1.29688,0 2.04688,-1 0.75,-1.01562 0.75,-2.82812 0,-1.625 -0.76563,-2.625 -0.76562,-1.01563 -2.04687,-1.01563 -1.25,0 -2.01563,1 -0.76562,0.98438 -0.76562,2.84375 z m 8.98364,-0.20312 q 0,-2.26563 1.07812,-3.64063 1.07813,-1.375 2.8125,-1.375 1.73438,0 2.75,1.17188 v -5.14063 h 1.6875 v 14 h -1.54687 l -0.0937,-1.0625 q -1,1.25 -2.8125,1.25 -1.70313,0 -2.79688,-1.40625 -1.07812,-1.40625 -1.07812,-3.65625 z m 1.6875,0.20312 q 0,1.67188 0.6875,2.625 0.70312,0.9375 1.92187,0.9375 1.60938,0 2.34375,-1.4375 v -4.53125 q -0.76562,-1.39062 -2.32812,-1.39062 -1.23438,0 -1.9375,0.95312 -0.6875,0.95313 -0.6875,2.84375 z m 13.33395,5 q -2,0 -3.26562,-1.3125 -1.25,-1.32812 -1.25,-3.53125 v -0.3125 q 0,-1.46875 0.5625,-2.60937 0.5625,-1.15625 1.5625,-1.79688 1.01562,-0.65625 2.1875,-0.65625 1.92187,0 2.98437,1.26563 1.0625,1.26562 1.0625,3.625 v 0.6875 h -6.67187 q 0.0312,1.46875 0.84375,2.375 0.82812,0.89062 2.07812,0.89062 0.89063,0 1.51563,-0.35937 0.625,-0.375 1.07812,-0.96875 l 1.03125,0.79687 q -1.23437,1.90625 -3.71875,1.90625 z m -0.20312,-8.84375 q -1.01563,0 -1.71875,0.75 -0.6875,0.73438 -0.84375,2.07813 h 4.9375 v -0.125 q -0.0781,-1.28125 -0.70313,-1.98438 -0.60937,-0.71875 -1.67187,-0.71875 z"
-       fill-rule="nonzero"
-       id="path352" />
-    <path
-       fill="#f4cccc"
-       d="m 436.5315,244.97638 h 63.53265 l 8.34137,8.34137 v 41.70587 H 436.5315 Z"
-       fill-rule="evenodd"
-       id="path354" />
-    <path
-       stroke="#434343"
-       stroke-width="1"
-       stroke-linejoin="round"
-       stroke-linecap="butt"
-       d="m 436.5315,244.97638 h 63.53265 l 8.34137,8.34137 v 41.70587 H 436.5315 Z"
-       fill-rule="evenodd"
-       id="path356" />
-    <path
-       fill="#000000"
-       d="m 455.12524,271.25458 q 0,2.25 -1.03125,3.625 -1.01562,1.375 -2.78125,1.375 -1.79687,0 -2.82812,-1.14063 v 4.75 h -1.67188 V 266.2077 h 1.53125 l 0.0781,1.09375 q 1.03125,-1.26562 2.85937,-1.26562 1.78125,0 2.8125,1.34375 1.03125,1.32812 1.03125,3.71875 z m -1.67187,-0.20313 q 0,-1.65625 -0.71875,-2.625 -0.70313,-0.96875 -1.95313,-0.96875 -1.53125,0 -2.29687,1.35938 v 4.70312 q 0.76562,1.35938 2.32812,1.35938 1.20313,0 1.92188,-0.95313 0.71875,-0.96875 0.71875,-2.875 z m 3.37307,0 q 0,-1.45312 0.5625,-2.60937 0.57813,-1.15625 1.59375,-1.78125 1.01563,-0.625 2.3125,-0.625 2.01563,0 3.25,1.39062 1.25,1.39063 1.25,3.70313 v 0.125 q 0,1.4375 -0.54687,2.57812 -0.54688,1.14063 -1.57813,1.78125 -1.01562,0.64063 -2.35937,0.64063 -2,0 -3.25,-1.39063 -1.23438,-1.40625 -1.23438,-3.70312 z m 1.6875,0.20313 q 0,1.64062 0.76563,2.64062 0.76562,0.98438 2.03125,0.98438 1.29687,0 2.04687,-1 0.75,-1.01563 0.75,-2.82813 0,-1.625 -0.76562,-2.625 -0.76563,-1.01562 -2.04688,-1.01562 -1.25,0 -2.01562,1 -0.76563,0.98437 -0.76563,2.84375 z m 8.98365,-0.20313 q 0,-2.26562 1.07812,-3.64062 1.07813,-1.375 2.8125,-1.375 1.73438,0 2.75,1.17187 v -5.14062 h 1.6875 v 14 h -1.54687 l -0.0937,-1.0625 q -1,1.25 -2.8125,1.25 -1.70313,0 -2.79688,-1.40625 -1.07812,-1.40625 -1.07812,-3.65625 z m 1.6875,0.20313 q 0,1.67187 0.6875,2.625 0.70312,0.9375 1.92187,0.9375 1.60938,0 2.34375,-1.4375 v -4.53125 q -0.76562,-1.39063 -2.32812,-1.39063 -1.23438,0 -1.9375,0.95313 -0.6875,0.95312 -0.6875,2.84375 z"
-       fill-rule="nonzero"
-       id="path358" />
-    <path
-       fill="#d9d9d9"
-       d="m 95.60105,380.54904 v 0 c 0,-13.08115 10.60436,-23.68552 23.68551,-23.68552 h 205.92032 c 6.2818,0 12.30627,2.49543 16.74817,6.93732 4.44192,4.4419 6.93735,10.4664 6.93735,16.7482 v 94.7392 c 0,13.08115 -10.60437,23.68552 -23.68552,23.68552 H 119.28656 c -13.08115,0 -23.68551,-10.60437 -23.68551,-23.68552 z"
-       fill-rule="evenodd"
-       id="path360" />
-    <path
-       stroke="#434343"
-       stroke-width="2"
-       stroke-linejoin="round"
-       stroke-linecap="butt"
-       d="m 95.60105,380.54904 v 0 c 0,-13.08115 10.60436,-23.68552 23.68551,-23.68552 h 205.92032 c 6.2818,0 12.30627,2.49543 16.74817,6.93732 4.44192,4.4419 6.93735,10.4664 6.93735,16.7482 v 94.7392 c 0,13.08115 -10.60437,23.68552 -23.68552,23.68552 H 119.28656 c -13.08115,0 -23.68551,-10.60437 -23.68551,-23.68552 z"
-       fill-rule="evenodd"
-       id="path362" />
-    <path
-       fill="#000000"
-       d="m 114.4133,380.8614 0.0469,1.23437 q 1.125,-1.40625 2.95312,-1.40625 3.125,0 3.15625,3.51563 v 6.51562 h -1.6875 v -6.51562 q -0.0156,-1.07813 -0.5,-1.57813 -0.46875,-0.51562 -1.48437,-0.51562 -0.8125,0 -1.4375,0.4375 -0.60938,0.4375 -0.96875,1.15625 v 7.01562 h -1.67188 v -9.85937 z m 8.24686,4.84375 q 0,-1.45313 0.5625,-2.60938 0.57812,-1.15625 1.59375,-1.78125 1.01562,-0.625 2.3125,-0.625 2.01562,0 3.25,1.39063 1.25,1.39062 1.25,3.70312 v 0.125 q 0,1.4375 -0.54688,2.57813 -0.54687,1.14062 -1.57812,1.78125 -1.01563,0.64062 -2.35938,0.64062 -2,0 -3.25,-1.39062 -1.23437,-1.40625 -1.23437,-3.70313 z m 1.6875,0.20312 q 0,1.64063 0.76562,2.64063 0.76563,0.98437 2.03125,0.98437 1.29688,0 2.04688,-1 0.75,-1.01562 0.75,-2.82812 0,-1.625 -0.76563,-2.625 -0.76562,-1.01563 -2.04687,-1.01563 -1.25,0 -2.01563,1 -0.76562,0.98438 -0.76562,2.84375 z m 8.98364,-0.20312 q 0,-2.26563 1.07812,-3.64063 1.07813,-1.375 2.8125,-1.375 1.73438,0 2.75,1.17188 v -5.14063 h 1.6875 v 14 h -1.54687 l -0.0937,-1.0625 q -1,1.25 -2.8125,1.25 -1.70313,0 -2.79688,-1.40625 -1.07812,-1.40625 -1.07812,-3.65625 z m 1.6875,0.20312 q 0,1.67188 0.6875,2.625 0.70312,0.9375 1.92187,0.9375 1.60938,0 2.34375,-1.4375 v -4.53125 q -0.76562,-1.39062 -2.32812,-1.39062 -1.23438,0 -1.9375,0.95312 -0.6875,0.95313 -0.6875,2.84375 z m 13.33397,5 q -2,0 -3.26563,-1.3125 -1.25,-1.32812 -1.25,-3.53125 v -0.3125 q 0,-1.46875 0.5625,-2.60937 0.5625,-1.15625 1.5625,-1.79688 1.01563,-0.65625 2.1875,-0.65625 1.92188,0 2.98438,1.26563 1.0625,1.26562 1.0625,3.625 v 0.6875 h -6.67188 q 0.0312,1.46875 0.84375,2.375 0.82813,0.89062 2.07813,0.89062 0.89062,0 1.51562,-0.35937 0.625,-0.375 1.07813,-0.96875 l 1.03125,0.79687 q -1.23438,1.90625 -3.71875,1.90625 z m -0.20313,-8.84375 q -1.01562,0 -1.71875,0.75 -0.6875,0.73438 -0.84375,2.07813 h 4.9375 v -0.125 q -0.0781,-1.28125 -0.70312,-1.98438 -0.60938,-0.71875 -1.67188,-0.71875 z"
-       fill-rule="nonzero"
-       id="path364" />
-    <path
-       fill="#f4cccc"
-       d="m 200.92651,377.43307 h 63.53262 l 8.3414,8.34137 v 41.70587 h -71.87402 z"
-       fill-rule="evenodd"
-       id="path366" />
-    <path
-       stroke="#434343"
-       stroke-width="1"
-       stroke-linejoin="round"
-       stroke-linecap="butt"
-       d="m 200.92651,377.43307 h 63.53262 l 8.3414,8.34137 v 41.70587 h -71.87402 z"
-       fill-rule="evenodd"
-       id="path368" />
-    <path
-       fill="#000000"
-       d="m 219.52026,403.71124 q 0,2.25 -1.03125,3.625 -1.01563,1.375 -2.78125,1.375 -1.79688,0 -2.82813,-1.14063 v 4.75 h -1.67187 v -13.65625 h 1.53125 l 0.0781,1.09375 q 1.03125,-1.26562 2.85938,-1.26562 1.78125,0 2.8125,1.34375 1.03125,1.32812 1.03125,3.71875 z m -1.67188,-0.20313 q 0,-1.65625 -0.71875,-2.625 -0.70312,-0.96875 -1.95312,-0.96875 -1.53125,0 -2.29688,1.35938 v 4.70312 q 0.76563,1.35938 2.32813,1.35938 1.20312,0 1.92187,-0.95313 0.71875,-0.96875 0.71875,-2.875 z m 3.37307,0 q 0,-1.45312 0.5625,-2.60937 0.57812,-1.15625 1.59375,-1.78125 1.01562,-0.625 2.3125,-0.625 2.01562,0 3.25,1.39062 1.25,1.39063 1.25,3.70313 v 0.125 q 0,1.4375 -0.54688,2.57812 -0.54687,1.14063 -1.57812,1.78125 -1.01563,0.64063 -2.35938,0.64063 -2,0 -3.25,-1.39063 -1.23437,-1.40625 -1.23437,-3.70312 z m 1.6875,0.20313 q 0,1.64062 0.76562,2.64062 0.76563,0.98438 2.03125,0.98438 1.29688,0 2.04688,-1 0.75,-1.01563 0.75,-2.82813 0,-1.625 -0.76563,-2.625 -0.76562,-1.01562 -2.04687,-1.01562 -1.25,0 -2.01563,1 -0.76562,0.98437 -0.76562,2.84375 z m 8.98364,-0.20313 q 0,-2.26562 1.07813,-3.64062 1.07812,-1.375 2.8125,-1.375 1.73437,0 2.75,1.17187 v -5.14062 h 1.6875 v 14 h -1.54688 l -0.0937,-1.0625 q -1,1.25 -2.8125,1.25 -1.70312,0 -2.79687,-1.40625 -1.07813,-1.40625 -1.07813,-3.65625 z m 1.6875,0.20313 q 0,1.67187 0.6875,2.625 0.70313,0.9375 1.92188,0.9375 1.60937,0 2.34375,-1.4375 v -4.53125 q -0.76563,-1.39063 -2.32813,-1.39063 -1.23437,0 -1.9375,0.95313 -0.6875,0.95312 -0.6875,2.84375 z"
-       fill-rule="nonzero"
-       id="path370" />
-    <path
-       fill="#000000"
-       fill-opacity="0"
-       d="m 145.48819,305.3176 v 0 c 0,-108.95232 87.37144,-197.2756 195.1496,-197.2756 v 0 c 51.7569,0 101.39395,20.78433 137.99161,57.78069 36.59766,36.99635 57.15802,87.17416 57.15802,139.49492 v 0 c 0,108.9523 -87.37146,197.27557 -195.14963,197.27557 v 0 c -107.77815,0 -195.1496,-88.32327 -195.1496,-197.27557 z"
-       fill-rule="evenodd"
-       id="path372" />
-    <path
-       stroke="#0000ff"
-       stroke-width="4"
-       stroke-linejoin="round"
-       stroke-linecap="butt"
-       d="m 145.48819,305.3176 v 0 c 0,-108.95232 87.37144,-197.2756 195.1496,-197.2756 v 0 c 51.7569,0 101.39395,20.78433 137.99161,57.78069 36.59766,36.99635 57.15802,87.17416 57.15802,139.49492 v 0 c 0,108.9523 -87.37146,197.27557 -195.14963,197.27557 v 0 c -107.77815,0 -195.1496,-88.32327 -195.1496,-197.27557 z"
-       fill-rule="evenodd"
-       id="path374" />
-    <path
-       fill="#f4cccc"
-       d="m 108.9895,417.0105 h 63.53264 l 8.34137,8.34137 v 41.70587 H 108.9895 Z"
-       fill-rule="evenodd"
-       id="path376" />
-    <path
-       stroke="#434343"
-       stroke-width="1"
-       stroke-linejoin="round"
-       stroke-linecap="butt"
-       d="m 108.9895,417.0105 h 63.53264 l 8.34137,8.34137 v 41.70587 H 108.9895 Z"
-       fill-rule="evenodd"
-       id="path378" />
-    <path
-       fill="#000000"
-       d="m 127.58325,443.2887 q 0,2.25 -1.03125,3.625 -1.01562,1.375 -2.78125,1.375 -1.79687,0 -2.82812,-1.14063 v 4.75 h -1.67188 v -13.65625 h 1.53125 l 0.0781,1.09375 q 1.03125,-1.26562 2.85937,-1.26562 1.78125,0 2.8125,1.34375 1.03125,1.32812 1.03125,3.71875 z m -1.67187,-0.20313 q 0,-1.65625 -0.71875,-2.625 -0.70313,-0.96875 -1.95313,-0.96875 -1.53125,0 -2.29687,1.35938 v 4.70312 q 0.76562,1.35938 2.32812,1.35938 1.20313,0 1.92188,-0.95313 0.71875,-0.96875 0.71875,-2.875 z m 3.37306,0 q 0,-1.45312 0.5625,-2.60937 0.57812,-1.15625 1.59375,-1.78125 1.01562,-0.625 2.3125,-0.625 2.01562,0 3.25,1.39062 1.25,1.39063 1.25,3.70313 v 0.125 q 0,1.4375 -0.54688,2.57812 -0.54687,1.14063 -1.57812,1.78125 -1.01563,0.64063 -2.35938,0.64063 -2,0 -3.25,-1.39063 -1.23437,-1.40625 -1.23437,-3.70312 z m 1.6875,0.20313 q 0,1.64062 0.76562,2.64062 0.76563,0.98438 2.03125,0.98438 1.29688,0 2.04688,-1 0.75,-1.01563 0.75,-2.82813 0,-1.625 -0.76563,-2.625 -0.76562,-1.01562 -2.04687,-1.01562 -1.25,0 -2.01563,1 -0.76562,0.98437 -0.76562,2.84375 z m 8.98364,-0.20313 q 0,-2.26562 1.07813,-3.64062 1.07812,-1.375 2.8125,-1.375 1.73437,0 2.75,1.17187 v -5.14062 h 1.6875 v 14 h -1.54688 l -0.0937,-1.0625 q -1,1.25 -2.8125,1.25 -1.70312,0 -2.79687,-1.40625 -1.07813,-1.40625 -1.07813,-3.65625 z m 1.6875,0.20313 q 0,1.67187 0.6875,2.625 0.70313,0.9375 1.92188,0.9375 1.60937,0 2.34375,-1.4375 v -4.53125 q -0.76563,-1.39063 -2.32813,-1.39063 -1.23437,0 -1.9375,0.95313 -0.6875,0.95312 -0.6875,2.84375 z"
-       fill-rule="nonzero"
-       id="path380" />
-    <path
-       fill="#f4cccc"
-       d="m 87.96063,209.9895 h 63.53264 l 8.34137,8.34137 v 41.70587 H 87.96063 Z"
-       fill-rule="evenodd"
-       id="path382" />
-    <path
-       stroke="#434343"
-       stroke-width="1"
-       stroke-linejoin="round"
-       stroke-linecap="butt"
-       d="m 87.96063,209.9895 h 63.53264 l 8.34137,8.34137 v 41.70587 H 87.96063 Z"
-       fill-rule="evenodd"
-       id="path384" />
-    <path
-       fill="#000000"
-       d="m 106.55438,236.26768 q 0,2.25 -1.03125,3.625 -1.01563,1.375 -2.78125,1.375 -1.79688,0 -2.828125,-1.14062 v 4.75 H 98.24188 v -13.65625 h 1.53125 l 0.07813,1.09375 q 1.03124,-1.26563 2.85937,-1.26563 1.78125,0 2.8125,1.34375 1.03125,1.32813 1.03125,3.71875 z m -1.67188,-0.20312 q 0,-1.65625 -0.71875,-2.625 -0.70312,-0.96875 -1.95312,-0.96875 -1.53125,0 -2.296875,1.35937 v 4.70313 q 0.765625,1.35937 2.328125,1.35937 1.20312,0 1.92187,-0.95312 0.71875,-0.96875 0.71875,-2.875 z m 3.37307,0 q 0,-1.45313 0.5625,-2.60938 0.57812,-1.15625 1.59375,-1.78125 1.01562,-0.625 2.3125,-0.625 2.01562,0 3.25,1.39063 1.25,1.39062 1.25,3.70312 v 0.125 q 0,1.4375 -0.54688,2.57813 -0.54687,1.14062 -1.57812,1.78125 -1.01563,0.64062 -2.35938,0.64062 -2,0 -3.25,-1.39062 -1.23437,-1.40625 -1.23437,-3.70313 z m 1.6875,0.20312 q 0,1.64063 0.76562,2.64063 0.76563,0.98437 2.03125,0.98437 1.29688,0 2.04688,-1 0.75,-1.01562 0.75,-2.82812 0,-1.625 -0.76563,-2.625 -0.76562,-1.01563 -2.04687,-1.01563 -1.25,0 -2.01563,1 -0.76562,0.98438 -0.76562,2.84375 z m 8.98364,-0.20312 q 0,-2.26563 1.07813,-3.64063 1.07812,-1.375 2.8125,-1.375 1.73437,0 2.75,1.17188 v -5.14063 h 1.6875 v 14 h -1.54688 l -0.0937,-1.0625 q -1,1.25 -2.8125,1.25 -1.70312,0 -2.79687,-1.40625 -1.07813,-1.40625 -1.07813,-3.65625 z m 1.6875,0.20312 q 0,1.67188 0.6875,2.625 0.70313,0.9375 1.92188,0.9375 1.60937,0 2.34375,-1.4375 v -4.53125 q -0.76563,-1.39062 -2.32813,-1.39062 -1.23437,0 -1.9375,0.95312 -0.6875,0.95313 -0.6875,2.84375 z"
-       fill-rule="nonzero"
-       id="path386" />
-    <path
-       fill="#000000"
-       fill-opacity="0"
-       d="m 204.99213,171.03674 -81.10236,38.96063"
-       fill-rule="evenodd"
-       id="path388" />
-    <path
-       stroke="#0000ff"
-       stroke-width="4"
-       stroke-linejoin="round"
-       stroke-linecap="butt"
-       d="m 204.99213,171.03674 -81.10236,38.96063"
-       fill-rule="evenodd"
-       id="path390" />
-    <path
-       fill="#000000"
-       fill-opacity="0"
-       d="m 185.52843,162.97461 31.27559,49.10237"
-       fill-rule="evenodd"
-       id="path392" />
-    <path
-       stroke="#0000ff"
-       stroke-width="4"
-       stroke-linejoin="round"
-       stroke-linecap="butt"
-       d="m 185.52843,162.97461 31.27559,49.10237"
-       fill-rule="evenodd"
-       id="path394" />
-    <path
-       fill="#000000"
-       fill-opacity="0"
-       d="m 182.18898,171.03674 46.07873,5.60631"
-       fill-rule="evenodd"
-       id="path396" />
-    <path
-       stroke="#0000ff"
-       stroke-width="4"
-       stroke-linejoin="round"
-       stroke-linecap="butt"
-       d="m 182.18898,171.03674 46.07873,5.60631"
-       fill-rule="evenodd"
-       id="path398" />
-    <path
-       fill="#000000"
-       fill-opacity="0"
-       d="m 180.86351,442.03412 44,27.2756"
-       fill-rule="evenodd"
-       id="path400" />
-    <path
-       stroke="#0000ff"
-       stroke-width="4"
-       stroke-linejoin="round"
-       stroke-linecap="butt"
-       d="m 180.86351,442.03412 44,27.2756"
-       fill-rule="evenodd"
-       id="path402" />
-    <path
-       fill="#000000"
-       fill-opacity="0"
-       d="M 236.86351,427.48032 208.73753,469.3386"
-       fill-rule="evenodd"
-       id="path404" />
-    <path
-       stroke="#0000ff"
-       stroke-width="4"
-       stroke-linejoin="round"
-       stroke-linecap="butt"
-       d="M 236.86351,427.48032 208.73753,469.3386"
-       fill-rule="evenodd"
-       id="path406" />
-    <path
-       fill="#000000"
-       fill-opacity="0"
-       d="m 228.2021,461.26248 h 24.53543"
-       fill-rule="evenodd"
-       id="path408" />
-    <path
-       stroke="#0000ff"
-       stroke-width="4"
-       stroke-linejoin="round"
-       stroke-linecap="butt"
-       d="m 228.2021,461.26248 h 24.53543"
-       fill-rule="evenodd"
-       id="path410" />
-    <path
-       fill="#000000"
-       fill-opacity="0"
-       d="m 521.6842,219.98076 35.21259,20.59843"
-       fill-rule="evenodd"
-       id="path412" />
-    <path
-       stroke="#0000ff"
-       stroke-width="4"
-       stroke-linejoin="round"
-       stroke-linecap="butt"
-       d="m 521.6842,219.98076 35.21259,20.59843"
-       fill-rule="evenodd"
-       id="path414" />
-    <path
-       fill="#000000"
-       fill-opacity="0"
-       d="m 505.5599,219.98076 -33.10236,25.00789"
-       fill-rule="evenodd"
-       id="path416" />
-    <path
-       stroke="#0000ff"
-       stroke-width="4"
-       stroke-linejoin="round"
-       stroke-linecap="butt"
-       d="m 505.5599,219.98076 -33.10236,25.00789"
-       fill-rule="evenodd"
-       id="path418" />
-    <path
-       fill="#0000ff"
-       d="m 205.39896,461.26248 v 0 c 0,-6.29694 5.10466,-11.40158 11.40157,-11.40158 v 0 c 3.02389,0 5.92392,1.20123 8.06213,3.33945 2.13821,2.13818 3.33945,5.03823 3.33945,8.06213 v 0 c 0,6.29691 -5.10466,11.40155 -11.40158,11.40155 v 0 c -6.29691,0 -11.40157,-5.10465 -11.40157,-11.40155 z"
-       fill-rule="evenodd"
-       id="path420" />
-    <path
-       fill="#000000"
-       fill-opacity="0"
-       d="m 208.73839,453.20035 16.12427,16.12424 m 0,-16.12424 -16.12427,16.12424"
-       fill-rule="evenodd"
-       id="path422" />
-    <path
-       fill="#000000"
-       fill-opacity="0"
-       d="m 205.39896,461.26248 v 0 c 0,-6.29694 5.10466,-11.40158 11.40157,-11.40158 v 0 c 3.02389,0 5.92392,1.20123 8.06213,3.33945 2.13821,2.13818 3.33945,5.03823 3.33945,8.06213 v 0 c 0,6.29691 -5.10466,11.40155 -11.40158,11.40155 v 0 c -6.29691,0 -11.40157,-5.10465 -11.40157,-11.40155 z"
-       fill-rule="evenodd"
-       id="path424" />
-    <path
-       stroke="#ffffff"
-       stroke-width="1"
-       stroke-linejoin="round"
-       stroke-linecap="butt"
-       d="m 208.73839,453.20035 16.12427,16.12424 m 0,-16.12424 -16.12427,16.12424"
-       fill-rule="evenodd"
-       id="path426" />
-    <path
-       stroke="#ffffff"
-       stroke-width="1"
-       stroke-linejoin="round"
-       stroke-linecap="butt"
-       d="m 205.39896,461.26248 v 0 c 0,-6.29694 5.10466,-11.40158 11.40157,-11.40158 v 0 c 3.02389,0 5.92392,1.20123 8.06213,3.33945 2.13821,2.13818 3.33945,5.03823 3.33945,8.06213 v 0 c 0,6.29691 -5.10466,11.40155 -11.40158,11.40155 v 0 c -6.29691,0 -11.40157,-5.10465 -11.40157,-11.40155 z"
-       fill-rule="evenodd"
-       id="path428" />
-    <path
-       fill="#0000ff"
-       d="m 182.18898,171.03674 v 0 c 0,-6.29692 5.10466,-11.40157 11.40157,-11.40157 v 0 c 3.02389,0 5.92392,1.20124 8.06213,3.33944 2.13821,2.13821 3.33945,5.03825 3.33945,8.06213 v 0 c 0,6.29692 -5.10466,11.40158 -11.40158,11.40158 v 0 c -6.29691,0 -11.40157,-5.10466 -11.40157,-11.40158 z"
-       fill-rule="evenodd"
-       id="path430" />
-    <path
-       fill="#000000"
-       fill-opacity="0"
-       d="m 185.52843,162.97461 16.12425,16.12427 m 0,-16.12427 -16.12425,16.12427"
-       fill-rule="evenodd"
-       id="path432" />
-    <path
-       fill="#000000"
-       fill-opacity="0"
-       d="m 182.18898,171.03674 v 0 c 0,-6.29692 5.10466,-11.40157 11.40157,-11.40157 v 0 c 3.02389,0 5.92392,1.20124 8.06213,3.33944 2.13821,2.13821 3.33945,5.03825 3.33945,8.06213 v 0 c 0,6.29692 -5.10466,11.40158 -11.40158,11.40158 v 0 c -6.29691,0 -11.40157,-5.10466 -11.40157,-11.40158 z"
-       fill-rule="evenodd"
-       id="path434" />
-    <path
-       stroke="#ffffff"
-       stroke-width="1"
-       stroke-linejoin="round"
-       stroke-linecap="butt"
-       d="m 185.52843,162.97461 16.12425,16.12427 m 0,-16.12427 -16.12425,16.12427"
-       fill-rule="evenodd"
-       id="path436" />
-    <path
-       stroke="#ffffff"
-       stroke-width="1"
-       stroke-linejoin="round"
-       stroke-linecap="butt"
-       d="m 182.18898,171.03674 v 0 c 0,-6.29692 5.10466,-11.40157 11.40157,-11.40157 v 0 c 3.02389,0 5.92392,1.20124 8.06213,3.33944 2.13821,2.13821 3.33945,5.03825 3.33945,8.06213 v 0 c 0,6.29692 -5.10466,11.40158 -11.40158,11.40158 v 0 c -6.29691,0 -11.40157,-5.10466 -11.40157,-11.40158 z"
-       fill-rule="evenodd"
-       id="path438" />
-    <path
-       fill="#0000ff"
-       d="m 502.22046,211.91864 v 0 c 0,-6.29692 5.10468,-11.40158 11.40161,-11.40158 v 0 c 3.02387,0 5.92389,1.20123 8.06214,3.33945 2.13818,2.13821 3.33941,5.03823 3.33941,8.06213 v 0 c 0,6.29691 -5.10467,11.40157 -11.40155,11.40157 v 0 c -6.29693,0 -11.40161,-5.10466 -11.40161,-11.40157 z"
-       fill-rule="evenodd"
-       id="path440" />
-    <path
-       fill="#000000"
-       fill-opacity="0"
-       d="m 505.5599,203.8565 16.1243,16.12425 m 0,-16.12425 -16.1243,16.12425"
-       fill-rule="evenodd"
-       id="path442" />
-    <path
-       fill="#000000"
-       fill-opacity="0"
-       d="m 502.22046,211.91864 v 0 c 0,-6.29692 5.10468,-11.40158 11.40161,-11.40158 v 0 c 3.02387,0 5.92389,1.20123 8.06214,3.33945 2.13818,2.13821 3.33941,5.03823 3.33941,8.06213 v 0 c 0,6.29691 -5.10467,11.40157 -11.40155,11.40157 v 0 c -6.29693,0 -11.40161,-5.10466 -11.40161,-11.40157 z"
-       fill-rule="evenodd"
-       id="path444" />
-    <path
-       stroke="#ffffff"
-       stroke-width="1"
-       stroke-linejoin="round"
-       stroke-linecap="butt"
-       d="m 505.5599,203.8565 16.1243,16.12425 m 0,-16.12425 -16.1243,16.12425"
-       fill-rule="evenodd"
-       id="path446" />
-    <path
-       stroke="#ffffff"
-       stroke-width="1"
-       stroke-linejoin="round"
-       stroke-linecap="butt"
-       d="m 502.22046,211.91864 v 0 c 0,-6.29692 5.10468,-11.40158 11.40161,-11.40158 v 0 c 3.02387,0 5.92389,1.20123 8.06214,3.33945 2.13818,2.13821 3.33941,5.03823 3.33941,8.06213 v 0 c 0,6.29691 -5.10467,11.40157 -11.40155,11.40157 v 0 c -6.29693,0 -11.40161,-5.10466 -11.40161,-11.40157 z"
-       fill-rule="evenodd"
-       id="path448" />
-    <path
-       fill="#f4cccc"
-       d="m 520.96063,240.58267 h 63.53265 l 8.34137,8.34138 v 41.70586 h -71.87402 z"
-       fill-rule="evenodd"
-       id="path450" />
-    <path
-       stroke="#434343"
-       stroke-width="1"
-       stroke-linejoin="round"
-       stroke-linecap="butt"
-       d="m 520.96063,240.58267 h 63.53265 l 8.34137,8.34138 v 41.70586 h -71.87402 z"
-       fill-rule="evenodd"
-       id="path452" />
-    <path
-       fill="#000000"
-       d="m 539.5544,266.86087 q 0,2.25 -1.03125,3.625 -1.01563,1.375 -2.78125,1.375 -1.79688,0 -2.82813,-1.14063 v 4.75 h -1.67187 v -13.65625 h 1.53125 l 0.0781,1.09375 q 1.03125,-1.26562 2.85938,-1.26562 1.78125,0 2.8125,1.34375 1.03125,1.32812 1.03125,3.71875 z m -1.67188,-0.20313 q 0,-1.65625 -0.71875,-2.625 -0.70312,-0.96875 -1.95312,-0.96875 -1.53125,0 -2.29688,1.35938 v 4.70312 q 0.76563,1.35938 2.32813,1.35938 1.20312,0 1.92187,-0.95313 0.71875,-0.96875 0.71875,-2.875 z m 3.37305,0 q 0,-1.45312 0.5625,-2.60937 0.57813,-1.15625 1.59375,-1.78125 1.01563,-0.625 2.3125,-0.625 2.01563,0 3.25,1.39062 1.25,1.39063 1.25,3.70313 v 0.125 q 0,1.4375 -0.54687,2.57812 -0.54688,1.14063 -1.57813,1.78125 -1.01562,0.64063 -2.35937,0.64063 -2,0 -3.25,-1.39063 -1.23438,-1.40625 -1.23438,-3.70312 z m 1.6875,0.20313 q 0,1.64062 0.76563,2.64062 0.76562,0.98438 2.03125,0.98438 1.29687,0 2.04687,-1 0.75,-1.01563 0.75,-2.82813 0,-1.625 -0.76562,-2.625 -0.76563,-1.01562 -2.04688,-1.01562 -1.25,0 -2.01562,1 -0.76563,0.98437 -0.76563,2.84375 z m 8.98364,-0.20313 q 0,-2.26562 1.07813,-3.64062 1.07812,-1.375 2.8125,-1.375 1.73437,0 2.75,1.17187 v -5.14062 h 1.6875 v 14 h -1.54688 l -0.0937,-1.0625 q -1,1.25 -2.8125,1.25 -1.70312,0 -2.79687,-1.40625 -1.07813,-1.40625 -1.07813,-3.65625 z m 1.6875,0.20313 q 0,1.67187 0.6875,2.625 0.70313,0.9375 1.92188,0.9375 1.60937,0 2.34375,-1.4375 v -4.53125 q -0.76563,-1.39063 -2.32813,-1.39063 -1.23437,0 -1.9375,0.95313 -0.6875,0.95312 -0.6875,2.84375 z"
-       fill-rule="nonzero"
-       id="path454" />
-    <path
-       fill="#f4cccc"
-       d="m 252.73753,436.23883 h 63.53264 l 8.34137,8.3414 v 41.70587 h -71.87401 z"
-       fill-rule="evenodd"
-       id="path456" />
-    <path
-       stroke="#434343"
-       stroke-width="1"
-       stroke-linejoin="round"
-       stroke-linecap="butt"
-       d="m 252.73753,436.23883 h 63.53264 l 8.34137,8.3414 v 41.70587 h -71.87401 z"
-       fill-rule="evenodd"
-       id="path458" />
-    <path
-       fill="#000000"
-       d="m 271.33127,462.51703 q 0,2.25 -1.03125,3.625 -1.01562,1.375 -2.78125,1.375 -1.79687,0 -2.82812,-1.14063 v 4.75 h -1.67188 v -13.65625 h 1.53125 l 0.0781,1.09375 q 1.03125,-1.26562 2.85937,-1.26562 1.78125,0 2.8125,1.34375 1.03125,1.32812 1.03125,3.71875 z m -1.67187,-0.20313 q 0,-1.65625 -0.71875,-2.625 -0.70313,-0.96875 -1.95313,-0.96875 -1.53125,0 -2.29687,1.35938 v 4.70312 q 0.76562,1.35938 2.32812,1.35938 1.20313,0 1.92188,-0.95313 0.71875,-0.96875 0.71875,-2.875 z m 3.37307,0 q 0,-1.45312 0.5625,-2.60937 0.57813,-1.15625 1.59375,-1.78125 1.01563,-0.625 2.3125,-0.625 2.01563,0 3.25,1.39062 1.25,1.39063 1.25,3.70313 v 0.125 q 0,1.4375 -0.54687,2.57812 -0.54688,1.14063 -1.57813,1.78125 -1.01562,0.64063 -2.35937,0.64063 -2,0 -3.25,-1.39063 -1.23438,-1.40625 -1.23438,-3.70312 z m 1.6875,0.20313 q 0,1.64062 0.76563,2.64062 0.76562,0.98438 2.03125,0.98438 1.29687,0 2.04687,-1 0.75,-1.01563 0.75,-2.82813 0,-1.625 -0.76562,-2.625 -0.76563,-1.01562 -2.04688,-1.01562 -1.25,0 -2.01562,1 -0.76563,0.98437 -0.76563,2.84375 z m 8.98365,-0.20313 q 0,-2.26562 1.07812,-3.64062 1.07813,-1.375 2.8125,-1.375 1.73438,0 2.75,1.17187 v -5.14062 h 1.6875 v 14 h -1.54687 l -0.0937,-1.0625 q -1,1.25 -2.8125,1.25 -1.70313,0 -2.79688,-1.40625 -1.07812,-1.40625 -1.07812,-3.65625 z m 1.6875,0.20313 q 0,1.67187 0.6875,2.625 0.70312,0.9375 1.92187,0.9375 1.60938,0 2.34375,-1.4375 v -4.53125 q -0.76562,-1.39063 -2.32812,-1.39063 -1.23438,0 -1.9375,0.95313 -0.6875,0.95312 -0.6875,2.84375 z"
-       fill-rule="nonzero"
-       id="path460" />
-  </g>
-</svg>

slides/index.yaml

@@ -1,119 +1,3 @@
-- date: [2021-02-08, 2021-02-10]
-  country: www
-  city: streaming
-  event: ENIX SAS
-  speaker: jpetazzo
-  title: Docker intensif (en français)
-  lang: fr
-  attend: https://enix.io/fr/services/formation/online/
-
-- date: [2021-02-15, 2021-02-18]
-  country: www
-  city: streaming
-  event: ENIX SAS
-  speaker: jpetazzo
-  title: Fondamentaux Kubernetes (en français)
-  lang: fr
-  attend: https://enix.io/fr/services/formation/online/
-
-- date: [2021-02-22, 2021-02-23]
-  country: www
-  city: streaming
-  event: ENIX SAS
-  speaker: jpetazzo
-  title: Packaging et CI/CD pour Kubernetes (en français)
-  lang: fr
-  attend: https://enix.io/fr/services/formation/online/
-
-- date: [2021-02-24, 2021-02-26]
-  country: www
-  city: streaming
-  event: ENIX SAS
-  speaker: jpetazzo
-  title: Kubernetes avancé (en français)
-  lang: fr
-  attend: https://enix.io/fr/services/formation/online/
-
-- date: [2021-03-01, 2021-03-02]
-  country: www
-  city: streaming
-  event: ENIX SAS
-  speaker: jpetazzo
-  title: Opérer Kubernetes (en français)
-  lang: fr
-  attend: https://enix.io/fr/services/formation/online/
-
-- date: [2020-10-05, 2020-10-06]
-  country: www
-  city: streaming
-  event: ENIX SAS
-  speaker: jpetazzo
-  title: Docker intensif (en français)
-  lang: fr
-  attend: https://enix.io/fr/services/formation/online/
-
-- date: [2020-10-07, 2020-10-09]
-  country: www
-  city: streaming
-  event: ENIX SAS
-  speaker: jpetazzo
-  title: Fondamentaux Kubernetes (en français)
-  lang: fr
-  attend: https://enix.io/fr/services/formation/online/
-
-- date: 2020-10-12
-  country: www
-  city: streaming
-  event: ENIX SAS
-  speaker: jpetazzo
-  title: Packaging pour Kubernetes (en français)
-  lang: fr
-  attend: https://enix.io/fr/services/formation/online/
-
-- date: [2020-10-13, 2020-10-14]
-  country: www
-  city: streaming
-  event: ENIX SAS
-  speaker: jpetazzo
-  title: Kubernetes avancé (en français)
-  lang: fr
-  attend: https://enix.io/fr/services/formation/online/
-
-- date: [2020-10-19, 2020-10-20]
-  country: www
-  city: streaming
-  event: ENIX SAS
-  speaker: jpetazzo
-  title: Opérer Kubernetes (en français)
-  lang: fr
-  attend: https://enix.io/fr/services/formation/online/
-
-- date: [2020-09-28, 2020-10-01]
-  country: www
-  city: streaming
-  event: Skills Matter
-  speaker: jpetazzo
-  title: Advanced Kubernetes Concepts
-  attend: https://skillsmatter.com/courses/700-advanced-kubernetes-concepts-workshop-jerome-petazzoni
-
-- date: [2020-08-29, 2020-08-30]
-  country: www
-  city: streaming
-  event: fwdays
-  speaker: jpetazzo
-  title: Intensive Docker Online Workshop
-  attend: https://fwdays.com/en/event/intensive-docker-workshop
-  slides: https://2020-08-fwdays.container.training/
-
-- date: [2020-09-12, 2020-09-13]
-  country: www
-  city: streaming
-  event: fwdays
-  speaker: jpetazzo
-  title: Kubernetes Intensive Online Workshop
-  attend: https://fwdays.com/en/event/kubernetes-intensive-workshop
-  slides: https://2020-09-fwdays.container.training/
-
 - date: [2020-07-07, 2020-07-09]
   country: www
   city: streaming

slides/intro-fullday.yml

@@ -20,7 +20,6 @@ content:
 - containers/intro.md
 - shared/about-slides.md
 - shared/chat-room-im.md
-#- shared/chat-room-slack.md
 #- shared/chat-room-zoom-meeting.md
 #- shared/chat-room-zoom-webinar.md
 - shared/toc.md
@@ -45,8 +44,8 @@ content:
 -
   - containers/Container_Networking_Basics.md
   #- containers/Network_Drivers.md
+  #- containers/Container_Network_Model.md
   - containers/Local_Development_Workflow.md
-  - containers/Container_Network_Model.md
   - containers/Compose_For_Dev_Stacks.md
   - containers/Exercise_Composefile.md
 -
@@ -66,5 +65,6 @@ content:
   #- containers/Pods_Anatomy.md
   #- containers/Ecosystem.md
   #- containers/Orchestration_Overview.md
+-
   - shared/thankyou.md
   - containers/links.md

slides/intro-selfpaced.yml

@@ -20,7 +20,6 @@ content:
 - containers/intro.md
 - shared/about-slides.md
 #- shared/chat-room-im.md
-#- shared/chat-room-slack.md
 #- shared/chat-room-zoom-meeting.md
 #- shared/chat-room-zoom-webinar.md
 - shared/toc.md

slides/intro.yml

@@ -1,13 +1,14 @@
 title: |
-  Introduction
-  to Containers
+  Intensive
+  Docker
+  Bootcamp
 
-chat: "[Slack](https://dockercommunity.slack.com/messages/C7GKACWDV)"
-#chat: "[Gitter](https://gitter.im/jpetazzo/workshop-yyyymmdd-city)"
+#chat: "[Slack](https://dockercommunity.slack.com/messages/C7GKACWDV)"
+chat: "[Gitter](https://gitter.im/jpetazzo/training-20200707-online)"
 
 gitrepo: github.com/jpetazzo/container.training
 
-slides: http://container.training/
+slides: https://2020-07-ardan.container.training/
 
 #slidenumberprefix: "#SomeHashTag — "
 
@@ -20,12 +21,11 @@ content:
 - containers/intro.md
 - shared/about-slides.md
 - shared/chat-room-im.md
-#- shared/chat-room-slack.md
 #- shared/chat-room-zoom-meeting.md
 #- shared/chat-room-zoom-webinar.md
 - shared/toc.md
 - # DAY 1
-  - containers/Docker_Overview.md
+  #- containers/Docker_Overview.md
   #- containers/Docker_History.md
   - containers/Training_Environment.md
   - containers/First_Containers.md
@@ -37,38 +37,30 @@ content:
   - containers/Cmd_And_Entrypoint.md
   - containers/Copying_Files_During_Build.md
   - containers/Exercise_Dockerfile_Basic.md
--
-  - containers/Dockerfile_Tips.md
-  - containers/Multi_Stage_Builds.md
+- # DAY 2
   - containers/Publishing_To_Docker_Hub.md
-  - containers/Exercise_Dockerfile_Advanced.md
--
   - containers/Naming_And_Inspecting.md
   - containers/Labels.md
   - containers/Start_And_Attach.md
   - containers/Getting_Inside.md
   - containers/Resource_Limits.md
-- # DAY 2
+-
+  - containers/Dockerfile_Tips.md
+  - containers/Multi_Stage_Builds.md
+  - containers/Advanced_Dockerfiles.md
+  - containers/Exercise_Dockerfile_Advanced.md
+- # DAY 3
   - containers/Container_Networking_Basics.md
   - containers/Network_Drivers.md
   - containers/Container_Network_Model.md
 -
   - containers/Local_Development_Workflow.md
-  - containers/Working_With_Volumes.md
   - containers/Compose_For_Dev_Stacks.md
   - containers/Exercise_Composefile.md
--
-  - containers/Installing_Docker.md
-  - containers/Container_Engines.md
-  - containers/Init_Systems.md
-  - containers/Advanced_Dockerfiles.md
--
-  - containers/Application_Configuration.md
   - containers/Logging.md
-  - containers/Orchestration_Overview.md
--
+  #- containers/Working_With_Volumes.md
+  #- containers/Application_Configuration.md
   - shared/thankyou.md
-  - containers/links.md
 #-
   #- containers/Docker_Machine.md
   #- containers/Ambassadors.md

slides/k8s/access-eks-cluster.md

@@ -1,104 +0,0 @@
-## Accessing our EKS cluster
-
-- We also have a shared EKS cluster
-
-- With individual IAM users
-
-- Let's connect to this cluster!
-
----
-
-## What we need
-
-- `kubectl` (obviously!)
-
-- `aws` CLI (recent-ish version)
-
-  (or `aws` CLI + `aws-iam-authenticator` plugin)
-
-- AWS API access key and secret access key
-
-- AWS region
-
-- EKS cluster name
-
----
-
-## Setting up AWS credentials
-
-- There are many ways to do this
-
-- We're going to use environment variables
-
-- You're welcome to use whatever you like (e.g. AWS profiles)
-
-.exercise[
-
-- Set the AWS region, API access key, and secret key:
-  ```bash
-  export AWS_DEFAULT_REGION=`us-east-2`
-  export AWS_ACCESS_KEY_ID=`AKI...`
-  export AWS_SECRET_ACCESS_KEY=`xyz123...`
-  ```
-
-- Check that the AWS API recognizes us:
-  ```bash
-  aws sts get-caller-identity
-  ```
-
-]
-
----
-
-## Updating our kubeconfig file
-
-- Now we can use the AWS CLI to:
-
-  - obtain the Kubernetes API address
-
-  - register it in our kubeconfig file
-
-.exercise[
-
-- Update our kubeconfig file:
-  ```bash
-  aws eks update-kubeconfig --name `fancy-clustername-1234`
-  ```
-
-- Run some harmless command:
-  ```bash
-  kubectl version
-  ```
-
-]
-
----
-
-## Our resources
-
-- We have the following permissions:
-
-  - `view` in the `default` namespace
-
-  - `edit` in the `container-training` namespace
-
-  - `admin` in our personal namespace
-
-- Our personal namespace is our IAM user name
-
-  (but with dots replaced with dashes)
-
-- For instance, user `ada.lovelace` has namespace `ada-lovelace`
-
----
-
-## Deploying things
-
-- Let's deploy DockerCoins in our personal namespace!
-
-- Expose the Web UI with a `LoadBalancer` service
-
-???
-
-:EN:- Working with an EKS cluster
-:FR:- Travailler avec un cluster EKS

slides/k8s/accessinternal.md

@@ -134,17 +134,3 @@ installed and set up `kubectl` to communicate with your cluster.
 
 :EN:- Securely accessing internal services
 :FR:- Accès sécurisé aux services internes
-
-:T: Accessing internal services from our local machine
-
-:Q: What's the advantage of "kubectl port-forward" compared to a NodePort?
-:A: It can forward arbitrary protocols
-:A: It doesn't require Kubernetes API credentials
-:A: It offers deterministic load balancing (instead of random)
-:A: ✔️It doesn't expose the service to the public
-
-:Q: What's the security concept behind "kubectl port-forward"?
-:A: ✔️We authenticate with the Kubernetes API, and it forwards connections on our behalf
-:A: It detects our source IP address, and only allows connections coming from it
-:A: It uses end-to-end mTLS (mutual TLS) to authenticate our connections
-:A: There is no security (as long as it's running, anyone can connect from anywhere)

slides/k8s/admission.md

@@ -1,549 +0,0 @@
-# Dynamic Admission Control
-
-- This is one of the many ways to extend the Kubernetes API
-
-- High level summary: dynamic admission control relies on webhooks that are ...
-
-  - dynamic (can be added/removed on the fly)
-
-  - running inside our outside the cluster
-
-  - *validating* (yay/nay) or *mutating* (can change objects that are created/updated)
-
-  - selective (can be configured to apply only to some kinds, some selectors...)
-
-  - mandatory or optional (should it block operations when webhook is down?)
-
-- Used for themselves (e.g. policy enforcement) or as part of operators
-
----
-
-## Use cases
-
-Some examples ...
-
-- Stand-alone admission controllers
-
-  *validating:* policy enforcement (e.g. quotas, naming conventions ...)
-
-  *mutating:* inject or provide default values (e.g. pod presets)
-
-- Admission controllers part of a greater system
-
-  *validating:* advanced typing for operators
-
-  *mutating:* inject sidecars for service meshes
-
----
-
-## You said *dynamic?*
-
-- Some admission controllers are built in the API server
-
-- They are enabled/disabled through Kubernetes API server configuration
-
-  (e.g. `--enable-admission-plugins`/`--disable-admission-plugins` flags)
-
-- Here, we're talking about *dynamic* admission controllers
-
-- They can be added/remove while the API server is running
-
-  (without touching the configuration files or even having access to them)
-
-- This is done through two kinds of cluster-scope resources:
-
-  ValidatingWebhookConfiguration and MutatingWebhookConfiguration
-
----
-
-## You said *webhooks?*
-
-- A ValidatingWebhookConfiguration or MutatingWebhookConfiguration contains:
-
-  - a resource filter
-    <br/>
-    (e.g. "all pods", "deployments in namespace xyz", "everything"...)
-
-  - an operations filter
-    <br/>
-    (e.g. CREATE, UPDATE, DELETE)
-
-  - the address of the webhook server
-
-- Each time an operation matches the filters, it is sent to the webhook server
-
----
-
-## What gets sent exactly?
-
-- The API server will `POST` a JSON object to the webhook
-
-- That object will be a Kubernetes API message with `kind` `AdmissionReview`
-
-- It will contain a `request` field, with, notably:
-
-  - `request.uid` (to be used when replying)
-
-  - `request.object` (the object created/deleted/changed)
-
-  - `request.oldObject` (when an object is modified)
-
-  - `request.userInfo` (who was making the request to the API in the first place)
-
-(See [the documentation](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#request) for a detailed example showing more fields.)
-
----
-
-## How should the webhook respond?
-
-- By replying with another `AdmissionReview` in JSON
-
-- It should have a `response` field, with, notably:
-
-  - `response.uid` (matching the `request.uid`)
-
-  - `response.allowed` (`true`/`false`)
-
-  - `response.status.message` (optional string; useful when denying requests)
-
-  - `response.patchType` (when a mutating webhook changes the object; e.g. `json`)
-
-  - `response.patch` (the patch, encoded in base64)
-
----
-
-## What if the webhook *does not* respond?
-
-- If "something bad" happens, the API server follows the `failurePolicy` option
-
-  - this is a per-webhook option (specified in the webhook configuration)
-
-  - it can be `Fail` (the default) or `Ignore` ("allow all, unmodified")
-
-- What's "something bad"?
-
-  - webhook responds with something invalid
-
-  - webhook takes more than 10 seconds to respond
-    <br/>
-    (this can be changed with `timeoutSeconds` field in the webhook config)
-
-  - webhook is down or has invalid certificates
-    <br/>
-    (TLS! It's not just a good idea; for admission control, it's the law!)
-
----
-
-## What did you say about TLS?
-
-- The webhook configuration can indicate:
-
-  - either `url` of the webhook server (has to begin with `https://`)
-
-  - or `service.name` and `service.namespace` of a Service on the cluster
-
-- In the latter case, the Service has to accept TLS connections on port 443
-
-- It has to use a certificate with CN `<name>.<namespace>.svc`
-
-  (**and** a `subjectAltName` extension with `DNS:<name>.<namespace>.svc`)
-
-- The certificate needs to be valid (signed by a CA trusted by the API server)
-
-  ... alternatively, we can pass a `caBundle` in the webhook configuration
-
----
-
-## Webhook server inside or outside
-
-- "Outside" webhook server is defined with `url` option
-
-  - convenient for external webooks (e.g. tamper-resistent audit trail)
-
-  - also great for initial development (e.g. with ngrok)
-
-  - requires outbound connectivity (duh) and can become a SPOF
-
-- "Inside" webhook server is defined with `service` option
-
-  - convenient when the webhook needs to be deployed and managed on the cluster
-
-  - also great for air gapped clusters
-
-  - development can be harder (but tools like [Tilt](https://tilt.dev) can help)
-
----
-
-## Developing a simple admission webhook
-
-- We're going to register a custom webhook!
-
-- First, we'll just dump the `AdmissionRequest` object
-
-  (using a little Node app)
-
-- Then, we'll implement a strict policy on a specific label
-
-  (using a little Flask app)
-
-- Development will happen in local containers, plumbed with ngrok
-
-- The we will deploy to the cluster 🔥
-
----
-
-## Running the webhook locally
-
-- We prepared a Docker Compose file to start the whole stack
-
-  (the Node "echo" app, the Flask app, and one ngrok tunnel for each of them)
-
-.exercise[
-
-- Go to the webhook directory:
-  ```bash
-  cd ~/container.training/webhooks/admission
-  ```
-
-- Start the webhook in Docker containers:
-  ```bash
-  docker-compose up
-  ```
-
-]
-
-*Note the URL in `ngrok-echo_1` looking like `url=https://xxxx.ngrok.io`.*
-
----
-
-class: extra-details
-
-## What's ngrok?
-
-- Ngrok provides secure tunnels to access local services
-
-- Example: run `ngrok http 1234`
-
-- `ngrok` will display a publicly-available URL (e.g. https://xxxxyyyyzzzz.ngrok.io)
-
-- Connections to https://xxxxyyyyzzzz.ngrok.io will terminate at `localhost:1234`
-
-- Basic product is free; extra features (vanity domains, end-to-end TLS...) for $$$
-
-- Perfect to develop our webhook!
-
-- Probably not for production, though
-
-  (webhook requests and responses now pass through the ngrok platform)
-
----
-
-## Update the webhook configuration
-
-- We have a webhook configuration in `k8s/webhook-configuration.yaml`
-
-- We need to update the configuration with the correct `url`
-
-.exercise[
-
-- Edit the webhook configuration manifest:
-  ```bash
-  vim k8s/webhook-configuration.yaml
-  ```
-
-- **Uncomment** the `url:` line
-
-- **Update** the `.ngrok.io` URL with the URL shown by Compose
-
-- Save and quit
-
-]
-
----
-
-## Register the webhook configuration
-
-- Just after we register the webhook, it will be called for each matching request
-
-  (CREATE and UPDATE on Pods in all namespaces)
-
-- The `failurePolicy` is `Ignore`
-
-  (so if the webhook server is down, we can still create pods)
-
-.exercise[
-
-- Register the webhook:
-  ```bash
-  kubectl apply -f k8s/webhook-configuration.yaml
-  ```
-
-]
-
-It is strongly recommended to tail the logs of the API server while doing that.
-
----
-
-## Create a pod
-
-- Let's create a pod and try to set a `color` label
-
-.exercise[
-
-- Create a pod named `chroma`:
-  ```bash
-  kubectl run --restart=Never chroma --image=nginx
-  ```
-
-- Add a label `color` set to `pink`:
-  ```bash
-  kubectl label pod chroma color=pink
-  ```
-
-]
-
-We should see the `AdmissionReview` objects in the Compose logs.
-
-Note: the webhook doesn't do anything (other than printing the request payload).
-
----
-
-## Use the "real" admission webhook
-
-- We have a small Flask app implementing a particular policy on pod labels:
-
-  - if a pod sets a label `color`, it must be `blue`, `green`, `red`
-
-  - once that `color` label is set, it cannot be removed or changed
-
-- That Flask app was started when we did `docker-compose up` earlier
-
-- It is exposed through its own ngrok tunnel
-
-- We are going to use that webhook instead of the other one
-
-  (by changing only the `url` field in the ValidatingWebhookConfiguration)
-
----
-
-## Update the webhook configuration
-
-.exercise[
-
-- First, check the ngrok URL of the tunnel for the Flask app:
-  ```bash
-  docker-compose logs ngrok-flask
-  ```
-
-- Then, edit the webhook configuration:
-  ```bash
-  kubectl edit validatingwebhookconfiguration admission.container.training
-  ```
-- Find the `url:` field with the `.ngrok.io` URL and update it
-
-- Save and quit; the new configuration is applied immediately
-
-]
-
----
-
-## Verify the behavior of the webhook
-
-- Try to create a few pods and/or change labels on existing pods
-
-- What happens if we try to make changes to the earlier pod?
-
-  (the one that has `label=pink`)
-
----
-
-## Deploying the webhook on the cluster
-
-- Let's see what's needed to self-host the webhook server!
-
-- The webhook needs to be reachable through a Service on our cluster
-
-- The Service needs to accept TLS connections on port 443
-
-- We need a proper TLS certificate:
-
-  - with the right `CN` and `subjectAltName` (`<servicename>.<namespace>.svc`)
-
-  - signed by a trusted CA
-
-- We can either use a "real" CA, or use the `caBundle` option to specify the CA cert
-
-  (the latter makes it easy to use self-signed certs)
-
----
-
-## In practice
-
-- We're going to generate a key pair and a self-signed certificate
-
-- We will store them in a Secret
-
-- We will run the webhook in a Deployment, exposed with a Service
-
-- We will update the webhook configuration to use that Service
-
-- The Service will be named `admission`, in Namespace `webhooks`
-
-  (keep in mind that the ValidatingWebhookConfiguration itself is at cluster scope)
-
----
-
-## Let's get to work!
-
-.exercise[
-
-- Make sure we're in the right directory:
-  ```bash
-  cd ~/container.training/webhooks/admission
-  ```
-
-- Create the namespace:
-  ```bash
-  kubectl create namespace webhooks
-  ```
-
-- Switch to the namespace:
-  ```bash
-  kubectl config set-context --current --namespace=webhooks
-  ```
-
-]
-
----
-
-## Deploying the webhook
-
-- *Normally,* we would author an image for this
-
-- Since our webhook is just *one* Python source file ...
-
-  ... we'll store it in a ConfigMap, and install dependencies on the fly
-
-.exercise[
-
-- Load the webhook source in a ConfigMap:
-  ```bash
-  kubectl create configmap admission --from-file=flask/webhook.py
-  ```
-
-- Create the Deployment and Service:
-  ```bash
-  kubectl apply -f k8s/webhook-server.yaml
-  ```
-
-]
-
----
-
-## Generating the key pair and certificate
-
-- Let's call OpenSSL to the rescue!
-
-  (of course, there are plenty others options; e.g. `cfssl`)
-
-.exercise[
-
-- Generate a self-signed certificate:
-  ```bash
-    NAMESPACE=webhooks
-    SERVICE=admission
-    CN=$SERVICE.$NAMESPACE.svc
-    openssl req -x509 -newkey rsa:4096 -nodes -keyout key.pem -out cert.pem \
-        -days 30 -subj /CN=$CN -addext subjectAltName=DNS:$CN
-  ```
-
-- Load up the key and cert in a Secret:
-  ```bash
-  kubectl create secret tls admission --cert=cert.pem --key=key.pem
-  ```
-
-]
-
----
-
-## Update the webhook configuration
-
-- Let's reconfigure the webhook to use our Service instead of ngrok
-
-.exercise[
-
-- Edit the webhook configuration manifest:
-  ```bash
-  vim k8s/webhook-configuration.yaml
-  ```
-
-- Comment out the `url:` line
-
-- Uncomment the `service:` section
-
-- Save, quit
-
-- Update the webhook configuration:
-  ```bash
-  kubectl apply -f k8s/webhook-configuration.yaml
-  ```
-
-]
-
----
-
-## Add our self-signed cert to the `caBundle`
-
-- The API server won't accept our self-signed certificate
-
-- We need to add it to the `caBundle` field in the webhook configuration
-
-- The `caBundle` will be our `cert.pem` file, encoded in base64
-
----
-
-Shell to the rescue!
-
-.exercise[
-
-- Load up our cert and encode it in base64:
-  ```bash
-  CA=$(base64 -w0 < cert.pem)
-  ```
-
-- Define a patch operation to update the `caBundle`:
-  ```bash
-    PATCH='[{
-        "op": "replace",
-        "path": "/webhooks/0/clientConfig/caBundle",
-        "value":"'$CA'"
-    }]'
-  ```
-
-- Patch the webhook configuration:
-  ```bash
-    kubectl patch validatingwebhookconfiguration \
-                  admission.webhook.container.training \
-                  --type='json' -p="$PATCH"
-  ```
-
-]
-
----
-
-## Try it out!
-
-- Keep an eye on the API server logs
-
-- Tail the logs of the pod running the webhook server
-
-- Create a few pods; we should see requests in the webhook server logs
-
-- Check that the label `color` is enforced correctly
-
-  (it should only allow values of `red`, `green`, `blue`)
-
-???
-
-:EN:- Dynamic admission control with webhooks
-:FR:- Contrôle d'admission dynamique (webhooks)

slides/k8s/aggregation-layer.md

@@ -1,394 +0,0 @@
-# The Aggregation Layer
-
-- The aggregation layer is a way to extend the Kubernetes API
-
-- It is similar to CRDs
-
-  - it lets us define new resource types
-
-  - these resources can then be used with `kubectl` and other clients
-
-- The implementation is very different
-
-  - CRDs are handled within the API server
-
-  - the aggregation layer offloads requests to another process
-
-- They are designed for very different use-cases
-
----
-
-## CRDs vs aggregation layer
-
-- The Kubernetes API is a REST-ish API with a hierarchical structure
-
-- It can be extended with Custom Resource Definifions (CRDs)
-
-- Custom resources are managed by the Kubernetes API server
-
-  - we don't need to write code
-
-  - the API server does all the heavy lifting
-
-  - these resources are persisted in Kubernetes' "standard" database
-    <br/>
-    (for most installations, that's `etcd`)
-
-- We can also define resources that are *not* managed by the API server
-
-  (the API server merely proxies the requests to another server)
-
----
-
-## Which one is best?
-
-- For things that "map" well to objects stored in a traditional database:
-
-  *probably CRDs*
-
-- For things that "exist" only in Kubernetes and don't represent external resources:
-
-  *probably CRDs*
-
-- For things that are read-only, at least from Kubernetes' perspective:
-
-  *probably aggregation layer*
-
-- For things that can't be stored in etcd because of size or access patterns:
-
-  *probably aggregation layer*
-
----
-
-## How are resources organized?
-
-- Let's have a look at the Kubernetes API hierarchical structure
-
-- We'll ask `kubectl` to show us the exacts requests that it's making
-
-.exercise[
-
-- Check the URI for a cluster-scope, "core" resource, e.g. a Node:
-  ```bash
-  kubectl -v6 get node node1
-  ```
-
-- Check the URI for a cluster-scope, "non-core" resource, e.g. a ClusterRole:
-  ```bash
-  kubectl -v6 get clusterrole view
-  ```
-
-]
-
----
-
-## Core vs non-core
-
-- This is the structure of the URIs that we just checked:
-
-  ```
-    /api/v1/nodes/node1
-         ↑    ↑     ↑
-     `version` `kind` `name`
-
-    /apis/rbac.authorization.k8s.io/v1/clusterroles/view
-                        ↑           ↑        ↑       ↑
-                      `group`      `version`   `kind`    `name`
-  ```
-
-- There is no group for "core" resources
-
-- Or, we could say that the group, `core`, is implied
-
----
-
-## Group-Version-Kind
-
-- In the API server, the Group-Version-Kind triple maps to a Go type
-
-  (look for all the "GVK" occurrences in the source code!)
-
-- In the API server URI router, the GVK is parsed "relatively early"
-
-  (so that the server can know which resource we're talking about)
-
-- "Well, actually ..." Things are a bit more complicated, see next slides!
-
----
-
-class: extra-details
-
-## Namespaced resources
-
-- What about namespaced resources?
-
-.exercise[
-
-- Check the URI for a namespaced, "core" resource, e.g. a Service:
-  ```bash
-  kubectl -v6 get service kubernetes --namespace default
-  ```
-
-]
-
-- Here are what namespaced resources URIs look like:
-
-  ```
-    /api/v1/namespaces/default/services/kubernetes
-         ↑               ↑        ↑         ↑
-      `version`        `namespace`  `kind`      `name`
-
-    /apis/apps/v1/namespaces/kube-system/daemonsets/kube-proxy
-           ↑   ↑                 ↑           ↑          ↑
-       `group`  `version`        `namespace`     `kind`       `name`
-  ```
-
----
-
-class: extra-details
-
-## Subresources
-
-- Many resources have *subresources*, for instance:
-
-  - `/status` (decouples status updates from other updates)
-
-  - `/scale` (exposes a consistent interface for autoscalers)
-
-  - `/proxy` (allows access to HTTP resources)
-
-  - `/portforward` (used by `kubectl port-forward`)
-
-  - `/logs` (access pod logs)
-
-- These are added at the end of the URI
-
----
-
-class: extra-details
-
-## Accessing a subresource
-
-.exercise[
-
-- List `kube-proxy` pods:
-  ```bash
-    kubectl get pods --namespace=kube-system --selector=k8s-app=kube-proxy
-    PODNAME=$(
-      kubectl get pods --namespace=kube-system --selector=k8s-app=kube-proxy \
-              -o json | jq -r .items[0].metadata.name)
-  ```
-
-- Execute a command in a pod, showing the API requests:
-  ```bash
-  kubectl -v6 exec --namespace=kube-system $PODNAME -- echo hello world
-  ```
-
-]
-
---
-
-The full request looks like:
-```
-POST https://.../api/v1/namespaces/kube-system/pods/kube-proxy-c7rlw/exec?
-command=echo&command=hello&command=world&container=kube-proxy&stderr=true&stdout=true
-```
-
----
-
-## Listing what's supported on the server
-
-- There are at least three useful commands to introspect the API server
-
-.exercise[
-
-- List resources types, their group, kind, short names, and scope:
-  ```bash
-  kubectl api-resources
-  ```
-
-- List API groups + versions:
-  ```bash
-  kubectl api-versions
-  ```
-
-- List APIServices:
-  ```bash
-  kubectl get apiservices
-  ```
-
-]
-
---
-
-🤔 What's the difference between the last two?
-
----
-
-## API registration
-
-- `kubectl api-versions` shows all API groups, including `apiregistration.k8s.io`
-
-- `kubectl get apiservices` shows the "routing table" for API requests
-
-- The latter doesn't show `apiregistration.k8s.io`
-
-  (APIServices belong to `apiregistration.k8s.io`)
-
-- Most API groups are `Local` (handled internally by the API server)
-
-- If we're running the `metrics-server`, it should handle `metrics.k8s.io`
-
-- This is an API group handled *outside* of the API server
-
-- This is the *aggregation layer!*
-
----
-
-## Finding resources
-
-The following assumes that `metrics-server` is deployed on your cluster.
-
-.exercise[
-
-- Check that the metrics.k8s.io is registered with `metrics-server`:
-  ```bash
-  kubectl get apiservices | grep metrics.k8s.io
-  ```
-
-- Check the resource kinds registered in the metrics.k8s.io group:
-  ```bash
-  kubectl api-resources --api-group=metrics.k8s.io
-  ```
-
-]
-
-(If the output of either command is empty, install `metrics-server` first.)
-
----
-
-## `nodes` vs `nodes`
-
-- We can have multiple resources with the same name
-
-.exercise[
-
-- Look for resources named `node`:
-  ```bash
-  kubectl api-resources | grep -w nodes
-  ```
-
-- Compare the output of both commands:
-  ```bash
-  kubectl get nodes
-  kubectl get nodes.metrics.k8s.io
-  ```
-
-]
-
---
-
-🤔 What are the second kind of nodes? How can we see what's really in them?
-
----
-
-## Node vs NodeMetrics
-
-- `nodes.metrics.k8s.io` (aka NodeMetrics) don't have fancy *printer columns*
-
-- But we can look at the raw data (with `-o json` or `-o yaml`)
-
-.exercise[
-
-- Look at NodeMetrics objects with one of these commands:
-  ```bash
-  kubectl get -o yaml nodes.metrics.k8s.io
-  kubectl get -o yaml NodeMetrics
-  ```
-
-]
-
---
-
-💡 Alright, these are the live metrics (CPU, RAM) for our nodes.
-
----
-
-## An easier way to consume metrics
-
-- We might have seen these metrics before ... With an easier command!
-
---
-
-.exercise[
-
-- Display node metrics:
-  ```bash
-  kubectl top nodes
-  ```
-
-- Check which API requests happen behind the scenes:
-  ```bash
-  kubectl top nodes -v6
-  ```
-
-]
-
----
-
-## Aggregation layer in practice
-
-- We can write an API server to handle a subset of the Kubernetes API
-
-- Then we can register that server by creating an APIService resource
-
-.exercise[
-
-- Check the definition used for the `metrics-server`:
-  ```bash
-  kubectl describe apiservices v1beta1.metrics.k8s.io
-  ```
-]
-
-- Group priority is used when multiple API groups provide similar kinds
-
-  (e.g. `nodes` and `nodes.metrics.k8s.io` as seen earlier)
-
----
-
-## Authentication flow
-
-- We have two Kubernetes API servers:
- 
-  - "aggregator" (the main one; clients connect to it)
-
-  - "aggregated" (the one providing the extra API; aggregator connects to it)
-
-- Aggregator deals with client authentication
-
-- Aggregator authenticates with aggregated using mutual TLS
-
-- Aggregator passes (/forwards/proxies/...) requests to aggregated
-
-- Aggregated performs authorization by calling back aggregator
-
-  ("can subject X perform action Y on resource Z?")
-
-[This doc page](https://kubernetes.io/docs/tasks/extend-kubernetes/configure-aggregation-layer/#authentication-flow) has very nice swim lanes showing that flow.
-
----
-
-## Discussion
-
-- Aggregation layer is great for metrics
-
-  (fast-changing, ephemeral data, that would be outrageously bad for etcd)
-
-- It *could* be a good fit to expose other REST APIs as a pass-thru 
-
-  (but it's more common to see CRDs instead)
-
-???
-
-:EN:- The aggregation layer
-:FR:- Étendre l'API avec le *aggregation layer*

slides/k8s/apiserver-deepdive.md

@@ -1,179 +0,0 @@
-# API server internals
-
-- Understanding the internals of the API server is useful.red[¹]:
-
-  - when extending the Kubernetes API server (CRDs, webhooks...)
-
-  - when running Kubernetes at scale
-
-- Let's dive into a bit of code!
-
-.footnote[.red[¹]And by *useful*, we mean *strongly recommended or else...*]
-
----
-
-## The main handler
-
-- The API server parses its configuration, and builds a `GenericAPIServer`
-
-- ... which contains an `APIServerHandler` ([src](https://github.com/kubernetes/apiserver/blob/release-1.19/pkg/server/handler.go#L37
-))
-
-- ... which contains a couple of `http.Handler` fields
-
-- Requests go through:
-
-  - `FullhandlerChain` (a series of HTTP filters, see next slide)
-
-  - `Director` (switches the request to `GoRestfulContainer` or `NonGoRestfulMux`)
-
-- `GoRestfulContainer`  is for "normal" APIs; integrates nicely with OpenAPI
-
-- `NonGoRestfulMux` is for everything else (e.g. proxy, delegation)
-
----
-
-## The chain of handlers
-
-- API requests go through a complex chain of filters ([src](https://github.com/kubernetes/apiserver/blob/release-1.19/pkg/server/config.go#L671))
-
-  (note when reading that code: requests start at the bottom and go up)
-
-- This is where authentication, authorization, and admission happen
-
-  (as well as a few other things!)
-
-- Let's review an arbitrary selection of some of these handlers!
-
-*In the following slides, the handlers are in chronological order.*
-
-*Note: handlers are nested; so they can act at the beginning and end of a request.*
-
----
-
-## `WithPanicRecovery`
-
-- Reminder about Go: there is no exception handling in Go; instead:
-
-  - functions typically return a composite `(SomeType, error)` type
-
-  - when things go really bad, the code can call `panic()`
-
-  - `panic()` can be caught with `recover()`
-    <br/>
-    (but this is almost never used like an exception handler!)
-
-- The API server code is not supposed to `panic()`
-
-- But just in case, we have that handler to prevent (some) crashes
-
----
-
-## `WithRequestInfo` ([src](https://github.com/kubernetes/apiserver/blob/release-1.19/pkg/endpoints/request/requestinfo.go#L163))
-
-
-- Parse out essential information:
-
-  API group, version, namespace, resource, subresource, verb ...
-
-- WithRequestInfo: parse out API group+version, Namespace, resource, subresource ...
-
-- Maps HTTP verbs (GET, PUT, ...) to Kubernetes verbs (list, get, watch, ...)
-
----
-
-class: extra-details
-
-## HTTP verb mapping
-
-- POST → create
-
-- PUT → update
-
-- PATCH → patch
-
-- DELETE
-  <br/> → delete (if a resource name is specified)
-  <br/> → deletecollection (otherwise)
-
-- GET, HEAD
-  <br/> → get (if a resource name is specified)
-  <br/> → list (otherwise)
-  <br/> → watch (if the `?watch=true` option is specified)
-
----
-
-## `WithWaitGroup`, 
-
-- When we shutdown, tells clients (with in-flight requests) to retry
-
-  - only for "short" requests
-
-  - for long running requests, the client needs to do more
-
-- Long running requests include `watch` verb, `proxy` sub-resource
-
-(See also `WithTimeoutForNonLongRunningRequests`)
-
----
-
-## AuthN and AuthZ
-
-- `WithAuthentication`:
-  the request goes through a *chain* of authenticators
-  ([src](https://github.com/kubernetes/apiserver/blob/release-1.19/pkg/endpoints/filters/authentication.go#L38))
-
-- WithAudit
-
-- WithImpersonation: used for e.g. `kubectl ... --as another.user`
-
-- WithPriorityAndFairness or WithMaxInFlightLimit
-
-  (`system:masters` can bypass these)
-
-- WithAuthorization
-
----
-
-## After all these handlers ...
-
-- We get to the "director" mentioned above
-
-- Api Groups get installed into the "gorestfulhandler"
-  ([src](https://github.com/kubernetes/apiserver/blob/release-1.19/pkg/server/genericapiserver.go#L423))
-
-- REST-ish resources are managed by various handlers
-  (in [this directory](https://github.com/kubernetes/apiserver/blob/release-1.19/pkg/endpoints/handlers/))
-
-- These files show us the code path for each type of request
-
----
-
-class: extra-details
-
-## Request code path
-
-- [create.go](https://github.com/kubernetes/apiserver/blob/release-1.19/pkg/endpoints/handlers/create.go):
-  decode to HubGroupVersion; admission; mutating admission; store
-
-- [delete.go](https://github.com/kubernetes/apiserver/blob/release-1.19/pkg/endpoints/handlers/delete.go):
-  validating admission only; deletion
-
-- [get.go](https://github.com/kubernetes/apiserver/blob/release-1.19/pkg/endpoints/handlers/get.go) (get, list):
-  directly fetch from rest storage abstraction
-
-- [patch.go](https://github.com/kubernetes/apiserver/blob/release-1.19/pkg/endpoints/handlers/patch.go):
-  admission; mutating admission; patch
-
-- [update.go](https://github.com/kubernetes/apiserver/blob/release-1.19/pkg/endpoints/handlers/update.go):
-  decode to HubGroupVersion; admission; mutating admission; store
-
-- [watch.go](https://github.com/kubernetes/apiserver/blob/release-1.19/pkg/endpoints/handlers/watch.go):
-  similar to get.go, but with watch logic
-
-(HubGroupVersion = in-memory, "canonical" version.)
-
-???
-
-:EN:- Kubernetes API server internals
-:FR:- Fonctionnement interne du serveur API

slides/k8s/architecture.md

@@ -273,26 +273,6 @@ class: extra-details
 
 ---
 
-class: extra-details
-
-## Group-Version-Kind, or GVK
-
-- A particular type will be identified by the combination of:
-
-  - the API group it belongs to (core, `apps`, `metrics.k8s.io`, ...)
-
-  - the version of this API group (`v1`, `v1beta1`, ...)
-
-  - the "Kind" itself (Pod, Role, Job, ...)
-
-- "GVK" appears a lot in the API machinery code
-
-- Conversions are possible between different versions and even between API groups
-
-  (e.g. when Deployments moved from `extensions` to `apps`)
-
----
-
 ## Update
 
 - Let's update our namespace object
@@ -354,34 +334,6 @@ We demonstrated *update* and *watch* semantics.
 
 ---
 
-class: extra-details
-
-## Watch events
-
-- `kubectl get --watch` shows changes
-
-- If we add `--output-watch-events`, we can also see:
-
-  - the difference between ADDED and MODIFIED resources
-
-  - DELETED resources
-
-.exercise[
-
-- In one terminal, watch pods, displaying full events:
-  ```bash
-  kubectl get pods --watch --output-watch-events
-  ```
-
-- In another, run a short-lived pod:
-  ```bash
-  kubectl run pause --image=alpine --rm -ti --restart=Never -- sleep 5
-  ```
-
-]
-
----
-
 # Other control plane components
 
 - API server ✔️

slides/k8s/authn-authz.md

@@ -118,7 +118,7 @@
 
 - [HTTP basic auth](https://en.wikipedia.org/wiki/Basic_access_authentication)
 
-  (carrying user and password in an HTTP header; [deprecated since Kubernetes 1.19](https://github.com/kubernetes/kubernetes/pull/89069))
+  (carrying user and password in an HTTP header)
 
 - Authentication proxy
 
@@ -749,7 +749,7 @@ class: extra-details
 
 :EN:- Authentication and authorization in Kubernetes
 :EN:- Authentication with tokens and certificates
-:EN:- Authorization with RBAC (Role-Based Access Control)
+:EN:- Aithorization with RBAC (Role-Based Access Control)
 :EN:- Restricting permissions with Service Accounts
 :EN:- Working with Roles, Cluster Roles, Role Bindings, etc.
 

slides/k8s/batch-jobs.md

@@ -10,7 +10,7 @@
 
 - Jobs are great for "long" background work
 
-  ("long" being at least minutes or hours)
+  ("long" being at least minutes our hours)
 
 - CronJobs are great to schedule Jobs at regular intervals
 
@@ -148,28 +148,6 @@ class: extra-details
 
 class: extra-details
 
-## Setting a time limit
-
-- It is possible to set a time limit (or deadline) for a job
-
-- This is done with the field `spec.activeDeadlineSeconds`
-
-  (by default, it is unlimited)
-
-- When the job is older than this time limit, all its pods are terminated
-
-- Note that there can also be a `spec.activeDeadlineSeconds` field in pods!
-
-- They can be set independently, and have different effects:
-
-  - the deadline of the job will stop the entire job
-
-  - the deadline of the pod will only stop an individual pod
-
----
-
-class: extra-details
-
 ## What about `kubectl run` before v1.18?
 
 - Creating a Deployment:
@@ -198,8 +176,12 @@ class: extra-details
 
   - can't express parallelism or completions of Jobs
 
+  - can't express Pods with multiple containers
+
   - can't express healthchecks, resource limits
 
+  - etc.
+
 - `kubectl create` and `kubectl run` are *helpers* that generate YAML manifests
 
 - If we write these manifests ourselves, we can use all features and options

slides/k8s/cert-manager.md

@@ -1,246 +0,0 @@
-# cert-manager
-
-- cert-manager¹ facilitates certificate signing through the Kubernetes API:
-
-  - we create a Certificate object (that's a CRD)
-
-  - cert-manager creates a private key
-
-  - it signs that key ...
-
-  - ... or interacts with a certificate authority to obtain the signature
-
-  - it stores the resulting key+cert in a Secret resource
-
-- These Secret resources can be used in many places (Ingress, mTLS, ...)
-
-.footnote[.red[¹]Always lower case, words separated with a dash; see the [style guide](https://cert-manager.io/docs/faq/style/_.)]
-
----
-
-## Getting signatures
-
-- cert-manager can use multiple *Issuers* (another CRD), including:
-
-  - self-signed
-
-  - cert-manager acting as a CA
-
-  - the [ACME protocol](https://en.wikipedia.org/wiki/Automated_Certificate_Management_Environment]) (notably used by Let's Encrypt)
-
-  - [HashiCorp Vault](https://www.vaultproject.io/)
-
-- Multiple issuers can be configured simultaneously
-
-- Issuers can be available in a single namespace, or in the whole cluster
-
-  (then we use the *ClusterIssuer* CRD)
-
----
-
-## cert-manager in action
-
-- We will install cert-manager
-
-- We will create a ClusterIssuer to obtain certificates with Let's Encrypt
-
-  (this will involve setting up an Ingress Controller)
-
-- We will create a Certificate request
-
-- cert-manager will honor that request and create a TLS Secret
-
----
-
-## Installing cert-manager
-
-- It can be installed with a YAML manifest, or with Helm
-
-.exercise[
-
-- Create the namespace for cert-manager:
-  ```bash
-  kubectl create ns cert-manager
-  ```
-
-- Add the Jetstack repository:
-  ```bash
-  helm repo add jetstack https://charts.jetstack.io
-  ```
-
-- Install cert-manager:
-  ```bash
-    helm install cert-manager jetstack/cert-manager \
-         --namespace cert-manager \
-         --set installCRDs=true
-  ```
-
-]
-
----
-
-## ClusterIssuer manifest
-
-```yaml
-@@INCLUDE[k8s/cm-clusterissuer.yaml]
-```
-
----
-
-## Creating the ClusterIssuer
-
-- The manifest shown on the previous slide is in @@LINK[k8s/cm-clusterissuer.yaml]
-
-.exercise[
-
-- Create the ClusterIssuer:
-  ```bash
-  kubectl apply -f ~/container.training/k8s/cm-clusterissuer.yaml
-  ```
-
-]
-
----
-
-## Certificate manifest
-
-```yaml
-@@INCLUDE[k8s/cm-certificate.yaml]
-```
-
-- The `name`, `secretName`, and `dnsNames` don't have to match
-
-- There can be multiple `dnsNames`
-
-- The `issuerRef` must match the ClusterIssuer that we created earlier
-
----
-
-## Creating the Certificate
-
-- The manifest shown on the previous slide is in @@LINK[k8s/cm-certificate.yaml]
-
-.exercise[
-
-- Edit the Certificate to update the domain name
-
-  (make sure to replace A.B.C.D with the IP address of one of your nodes!)
-
-- Create the Certificate:
-  ```bash
-  kubectl apply -f ~/container.training/k8s/cm-certificate.yaml
-  ```
-
-]
-
----
-
-## What's happening?
-
-- cert-manager will create:
-
-  - the secret key
-
-  - a Pod, a Service, and an Ingress to complete the HTTP challenge
-
-- then it waits for the challenge to complete
-
-.exercise[
-
-- View the resources created by cert-manager:
-  ```bash
-    kubectl get pods,services,ingresses \
-            --selector=acme.cert-manager.io/http01-solver=true
-  ```
-
-]
-
----
-
-## HTTP challenge
-
-- The CA (in this case, Let's Encrypt) will fetch a particular URL:
-
-  `http://<our-domain>/.well-known/acme-challenge/<token>`
-
-.exercise[
-
-- Check the *path* of the Ingress in particular:
-  ```bash
-    kubectl describe ingress 
-            --selector=acme.cert-manager.io/http01-solver=true
-  ```
-
-]
-
----
-
-## What's missing ?
-
---
-
-An Ingress Controller! 😅
-
-.exercise[
-
-- Install an Ingress Controller:
-  ```bash
-  kubectl apply -f ~/container.training/k8s/traefik-v2.yaml
-  ```
-
-- Wait a little bit, and check that we now have a `kubernetes.io/tls` Secret:
-  ```bash
-  kubectl get secrets
-  ```
-
-]
-
----
-
-class: extra-details
-
-## Using the secret
-
-- For bonus points, try to use the secret in an Ingress!
-
-- This is what the manifest would look like:
-
-```yaml
-apiVersion: networking.k8s.io/v1beta1
-kind: Ingress
-metadata:
-  name: xyz
-spec:
-  tls:
-  - secretName: xyz.A.B.C.D.nip.io
-    hosts:
-    - xyz.A.B.C.D.nip.io
-  rules:
-  ...
-```
-
----
-
-class: extra-details
-
-## Let's Encrypt and nip.io
-
-- Let's Encrypt has [rate limits](https://letsencrypt.org/docs/rate-limits/) per domain
-
-  (the limits only apply to the production environment, not staging)
-
-- There is a limit of 50 certificates per registered domain
-
-- If we try to use the production environment, we will probably hit the limit
-
-- It's fine to use the staging environment for these experiments
-
-  (our certs won't validate in a browser, but we can always check
-  the details of the cert to verify that it was issued by Let's Encrypt!)
-
-???
-
-:EN:- Obtaining certificates with cert-manager
-:FR:- Obtenir des certificats avec cert-manager
-
-:T: Obtaining TLS certificates with cert-manager

slides/k8s/cluster-backup.md

@@ -338,9 +338,9 @@ docker run --rm --net host -v $PWD:/vol \
 
   (e.g. [Portworx](https://docs.portworx.com/portworx-install-with-kubernetes/storage-operations/create-snapshots/) can [create snapshots through annotations](https://docs.portworx.com/portworx-install-with-kubernetes/storage-operations/create-snapshots/snaps-annotations/#taking-periodic-snapshots-on-a-running-pod))
 
-- Option 3: [snapshots through Kubernetes API](https://kubernetes.io/docs/concepts/storage/volume-snapshots/)
+- Option 3: [snapshots through Kubernetes API](https://kubernetes.io/blog/2018/10/09/introducing-volume-snapshot-alpha-for-kubernetes/)
 
-  (Generally available since Kuberentes 1.20 for a number of [CSI](https://kubernetes.io/blog/2019/01/15/container-storage-interface-ga/) volume plugins : GCE, OpenSDS, Ceph, Portworx, etc)
+  (now in alpha for a few storage providers: GCE, OpenSDS, Ceph, Portworx)
 
 ---
 

slides/k8s/cni-internals.md

@@ -1,193 +0,0 @@
-# CNI internals
-
-- Kubelet looks for a CNI configuration file
-
-  (by default, in `/etc/cni/net.d`)
-
-- Note: if we have multiple files, the first one will be used
-
-  (in lexicographic order)
-
-- If no configuration can be found, kubelet holds off on creating containers
-
-  (except if they are using `hostNetwork`)
-
-- Let's see how exactly plugins are invoked!
-
----
-
-## General principle
-
-- A plugin is an executable program
-
-- It is invoked with by kubelet to set up / tear down networking for a container
-
-- It doesn't take any command-line argument
-
-- However, it uses environment variables to know what to do, which container, etc.
-
-- It reads JSON on stdin, and writes back JSON on stdout
-
-- There will generally be multiple plugins invoked in a row
-
-  (at least IPAM + network setup; possibly more)
-
----
-
-## Environment variables
-
-- `CNI_COMMAND`: `ADD`, `DEL`, `CHECK`, or `VERSION`
-
-- `CNI_CONTAINERID`: opaque identifier
-
-  (container ID of the "sandbox", i.e. the container running the `pause` image)
-
-- `CNI_NETNS`: path to network namespace pseudo-file
-
-  (e.g. `/var/run/netns/cni-0376f625-29b5-7a21-6c45-6a973b3224e5`)
-
-- `CNI_IFNAME`: interface name, usually `eth0`
-
-- `CNI_PATH`: path(s) with plugin executables (e.g. `/opt/cni/bin`)
-
-- `CNI_ARGS`: "extra arguments" (see next slide)
-
----
-
-## `CNI_ARGS`
-
-- Extra key/value pair arguments passed by "the user"
-
-- "The user", here, is "kubelet" (or in an abstract way, "Kubernetes")
-
-- This is used to pass the pod name and namespace to the CNI plugin
-
-- Example:
-  ```
-  IgnoreUnknown=1
-  K8S_POD_NAMESPACE=default
-  K8S_POD_NAME=web-96d5df5c8-jcn72
-  K8S_POD_INFRA_CONTAINER_ID=016493dbff152641d334d9828dab6136c1ff...
-  ```
-
-Note that technically, it's a `;`-separated list, so it really looks like this:
-```
-CNI_ARGS=IgnoreUnknown=1;K8S_POD_NAMESPACE=default;K8S_POD_NAME=web-96d...
-```
-
----
-
-## JSON in, JSON out
-
-- The plugin reads its configuration on stdin
-
-- It writes back results in JSON
-
-  (e.g. allocated address, routes, DNS...)
-
-⚠️ "Plugin configuration" is not always the same as "CNI configuration"!
-
----
-
-## Conf vs Conflist
-
-- The CNI configuration can be a single plugin configuration
-
-  - it will then contain a `type` field in the top-most structure
-
-  - it will be passed "as-is"
-
-- It can also be a "conflist", containing a chain of plugins
-
-  (it will then contain a `plugins` field in the top-most structure)
-
-- Plugins are then invoked in order (reverse order for `DEL` action)
-
-- In that case, the input of the plugin is not the whole configuration
-
-  (see details on next slide)
-
----
-
-## List of plugins
-
-- When invoking a plugin in a list, the JSON input will be:
-
-  - the configuration of the plugin
-
-  - augmented with `name` (matching the conf list `name`)
-
-  - augmented with `prevResult` (which will be the output of the previous plugin)
-
-- Conceptually, a plugin (generally the first one) will do the "main setup"
-
-- Other plugins can do tuning / refinement (firewalling, traffic shaping...)
-
----
-
-## Analyzing plugins
-
-- Let's see what goes in and out of our CNI plugins!
-
-- We will create a fake plugin that:
-
-  - saves its environment and input
-
-  - executes the real plugin with the saved input
-
-  - saves the plugin output
-
-  - passes the saved output
-
----
-
-## Our fake plugin
-
-```bash
-#!/bin/sh
-PLUGIN=$(basename $0)
-cat > /tmp/cni.$$.$PLUGIN.in
-env | sort > /tmp/cni.$$.$PLUGIN.env
-echo "PPID=$PPID, $(readlink /proc/$PPID/exe)" > /tmp/cni.$$.$PLUGIN.parent
-$0.real < /tmp/cni.$$.$PLUGIN.in > /tmp/cni.$$.$PLUGIN.out
-EXITSTATUS=$?
-cat /tmp/cni.$$.$PLUGIN.out
-exit $EXITSTATUS
-```
-
-Save this script as `/opt/cni/bin/debug` and make it executable.
-
----
-
-## Substituting the fake plugin
-
-- For each plugin that we want to instrument:
-
-  - rename the plugin from e.g. `ptp` to `ptp.real`
-
-  - symlink `ptp` to our `debug` plugin
-
-- There is no need to change the CNI configuration or restart kubelet
-
----
-
-## Create some pods and looks at the results
-
-- Create a pod
-
-- For each instrumented plugin, there will be files in `/tmp`:
-
-  `cni.PID.pluginname.in` (JSON input)
-
-  `cni.PID.pluginname.env` (environment variables)
-
-  `cni.PID.pluginname.parent` (parent process information)
-
-  `cni.PID.pluginname.out` (JSON output)
-
-❓️ What is calling our plugins?
-
-???
-
-:EN:- Deep dive into CNI internals
-:FR:- La Container Network Interface (CNI) en détails

slides/k8s/configuration.md

@@ -60,41 +60,21 @@
 
 ## Command-line arguments
 
-- Indicate what should run in the container
+- Pass options to `args` array in the container specification
 
-- Pass `command` and/or `args` in the container options in a Pod's template
-
-- Both `command` and `args` are arrays
-
-- Example ([source](https://github.com/jpetazzo/container.training/blob/main/k8s/consul-1.yaml#L70)):
+- Example ([source](https://github.com/coreos/pods/blob/master/kubernetes.yaml#L29)): 
   ```yaml
-    args:
-    - "agent"
-    - "-bootstrap-expect=3"
-    - "-retry-join=provider=k8s label_selector=\"app=consul\" namespace=\"$(NS)\""
-    - "-client=0.0.0.0"
-    - "-data-dir=/consul/data"
-    - "-server"
-    - "-ui"
+      args: 
+        - "--data-dir=/var/lib/etcd"
+        - "--advertise-client-urls=http://127.0.0.1:2379"
+        - "--listen-client-urls=http://127.0.0.1:2379"
+        - "--listen-peer-urls=http://127.0.0.1:2380"
+        - "--name=etcd"
   ```
 
----
+- The options can be passed directly to the program that we run ...
 
-## `args` or `command`?
-
-- Use `command` to override the `ENTRYPOINT` defined in the image
-
-- Use `args` to keep the `ENTRYPOINT` defined in the image
-
-  (the parameters specified in `args` are added to the `ENTRYPOINT`)
-
-- In doubt, use `command`
-
-- It is also possible to use *both* `command` and `args`
-
-  (they will be strung together, just like `ENTRYPOINT` and `CMD`)
-
-- See the [docs](https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#notes) to see how they interact together
+  ... or to a wrapper script that will use them to e.g. generate a config file
 
 ---
 
@@ -230,8 +210,6 @@
 
   (through files that get created in the container filesystem)
 
-- That second link also includes a list of all the fields that can be used with the downward API
-
 ---
 
 ## Environment variables, pros and cons
@@ -534,12 +512,48 @@ spec:
 
 ]
 
+---
+
+## Passwords, tokens, sensitive information
+
+- For sensitive information, there is another special resource: *Secrets*
+
+- Secrets and Configmaps work almost the same way
+
+  (we'll expose the differences on the next slide)
+
+- The *intent* is different, though:
+
+  *"You should use secrets for things which are actually secret like API keys, 
+  credentials, etc., and use config map for not-secret configuration data."*
+
+  *"In the future there will likely be some differentiators for secrets like rotation or support for backing the secret API w/ HSMs, etc."*
+
+  (Source: [the author of both features](https://stackoverflow.com/a/36925553/580281
+))
+
+---
+
+## Differences between configmaps and secrets
+ 
+- Secrets are base64-encoded when shown with `kubectl get secrets -o yaml`
+
+  - keep in mind that this is just *encoding*, not *encryption*
+
+  - it is very easy to [automatically extract and decode secrets](https://medium.com/@mveritym/decoding-kubernetes-secrets-60deed7a96a3)
+
+- [Secrets can be encrypted at rest](https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/)
+
+- With RBAC, we can authorize a user to access configmaps, but not secrets
+
+  (since they are two different kinds of resources)
+
 ???
 
 :EN:- Managing application configuration
 :EN:- Exposing configuration with the downward API
-:EN:- Exposing configuration with Config Maps
+:EN:- Exposing configuration with Config Maps and Secrets
 
 :FR:- Gérer la configuration des applications
 :FR:- Configuration au travers de la *downward API*
-:FR:- Configurer les applications avec des *Config Maps*
+:FR:- Configuration via les *Config Maps* et *Secrets*

slides/k8s/control-plane-auth.md

@@ -92,29 +92,6 @@
 
 ---
 
-## etcd authorization
-
-- etcd supports RBAC, but Kubernetes doesn't use it by default
-
-  (note: etcd RBAC is completely different from Kubernetes RBAC!)
-
-- By default, etcd access is "all or nothing"
-
-  (if you have a valid certificate, you get in)
-
-- Be very careful if you use the same root CA for etcd and other things
-
-  (if etcd trusts the root CA, then anyone with a valid cert gets full etcd access)
-
-- For more details, check the following resources:
-
-  - [etcd documentation on authentication](https://etcd.io/docs/current/op-guide/authentication/)
-
-  - [PKI The Wrong Way](https://www.youtube.com/watch?v=gcOLDEzsVHI) at KubeCon NA 2020
-
----
-
-
 ## API server clients
 
 - The API server has a sophisticated authentication and authorization system
@@ -213,24 +190,6 @@
 
 ---
 
-class: extra-details
-
-## How are these permissions set up?
-
-- A bunch of roles and bindings are defined as constants in the API server code:
-
-  [auth/authorizer/rbac/bootstrappolicy/policy.go](https://github.com/kubernetes/kubernetes/blob/release-1.19/plugin/pkg/auth/authorizer/rbac/bootstrappolicy/policy.go#L188)
-
-- They are created automatically when the API server starts:
-
-  [registry/rbac/rest/storage_rbac.go](https://github.com/kubernetes/kubernetes/blob/release-1.19/pkg/registry/rbac/rest/storage_rbac.go#L140)
-
-- We must use the correct Common Names (`CN`) for the control plane certificates
-
-  (since the bindings defined above refer to these common names)
-
----
-
 ## Service account tokens
 
 - Each time we create a service account, the controller manager generates a token

slides/k8s/crd.md

@@ -1,334 +0,0 @@
-# Custom Resource Definitions
-
-- CRDs are one of the (many) ways to extend the API
-
-- CRDs can be defined dynamically
-
-  (no need to recompile or reload the API server)
-
-- A CRD is defined with a CustomResourceDefinition resource
-
-  (CustomResourceDefinition is conceptually similar to a *metaclass*)
-
----
-
-## A very simple CRD
-
-The file @@LINK[k8s/coffee-1.yaml] describes a very simple CRD representing different kinds of coffee:
-
-```yaml
-@@INCLUDE[k8s/coffee-1.yaml]
-```
-
----
-
-## Creating a CRD
-
-- Let's create the Custom Resource Definition for our Coffee resource
-
-.exercise[
-
-- Load the CRD:
-  ```bash
-  kubectl apply -f ~/container.training/k8s/coffee-1.yaml
-  ```
-
-- Confirm that it shows up:
-  ```bash
-  kubectl get crds
-  ```
-
-]
-
----
-
-## Creating custom resources
-
-The YAML below defines a resource using the CRD that we just created:
-
-```yaml
-kind: Coffee
-apiVersion: container.training/v1alpha1
-metadata:
-  name: arabica
-spec:
-  taste: strong
-```
-
-.exercise[
-
-- Create a few types of coffee beans:
-  ```bash
-  kubectl apply -f ~/container.training/k8s/coffees.yaml
-  ```
-
-]
-
----
-
-## Viewing custom resources
-
-- By default, `kubectl get` only shows name and age of custom resources
-
-.exercise[
-
-- View the coffee beans that we just created:
-  ```bash
-  kubectl get coffees
-  ```
-
-]
-
-- We'll see in a bit how to improve that
-
----
-
-## What can we do with CRDs?
-
-There are many possibilities!
-
-- *Operators* encapsulate complex sets of resources
-
-  (e.g.: a PostgreSQL replicated cluster; an etcd cluster...
-  <br/>
-  see [awesome operators](https://github.com/operator-framework/awesome-operators) and
-  [OperatorHub](https://operatorhub.io/) to find more)
-
-- Custom use-cases like [gitkube](https://gitkube.sh/)
-
-  - creates a new custom type, `Remote`, exposing a git+ssh server
-
-  - deploy by pushing YAML or Helm charts to that remote
-
-- Replacing built-in types with CRDs
-
-  (see [this lightning talk by Tim Hockin](https://www.youtube.com/watch?v=ji0FWzFwNhA))
-
----
-
-## What's next?
-
-- Creating a basic CRD is quick and easy
-
-- But there is a lot more that we can (and probably should) do:
-
-  - improve input with *data validation*
-
-  - improve output with *custom columns*
-
-- And of course, we probably need a *controller* to go with our CRD!
-
-  (otherwise, we're just using the Kubernetes API as a fancy data store)
-
----
-
-## Additional printer columns
-
-- We can specify `additionalPrinterColumns` in the CRD
-
-- This is similar to `-o custom-columns`
-
-  (map a column name to a path in the object, e.g. `.spec.taste`)
-
-```yaml
-    additionalPrinterColumns:
-    - jsonPath: .spec.taste
-      description: Subjective taste of that kind of coffee bean
-      name: Taste
-      type: string
-    - jsonPath: .metadata.creationTimestamp
-      name: Age
-      type: date
-```
-
----
-
-## Using additional printer columns
-
-- Let's update our CRD using @@LINK[k8s/coffee-3.yaml]
-
-.exercise[
-
-- Update the CRD:
-  ```bash
-  kubectl apply -f ~/container.training/k8s/coffee-3.yaml
-  ```
-
-- Look at our Coffee resources:
-  ```bash
-  kubectl get coffees
-  ```
-
-]
-
-Note: we can update a CRD without having to re-create the corresponding resources.
-
-(Good news, right?)
-
----
-
-## Data validation
-
-- By default, CRDs are not *validated*
-
-  (we can put anything we want in the `spec`)
-
-- When creating a CRD, we can pass an OpenAPI v3 schema
-
-  (which will then be used to validate resources)
-
-- More advanced validation can also be done with admission webhooks, e.g.:
-
-  - consistency between parameters
-
-  - advanced integer filters (e.g. odd number of replicas)
-
-  - things that can change in one direction but not the other
-
----
-
-## OpenAPI v3 scheme exapmle
-
-This is what we have in @@LINK[k8s/coffee-3.yaml]:
-
-```yaml
-    schema:
-      openAPIV3Schema:
-        type: object
-        required: [ spec ]
-        properties:
-          spec:
-            type: object
-            properties:
-              taste:
-                description: Subjective taste of that kind of coffee bean
-                type: string
-            required: [ taste ]
-```
-
----
-
-## Validation *a posteriori*
-
-- Some of the "coffees" that we defined earlier *do not* pass validation
-
-- How is that possible?
-
---
-
-- Validation happens at *admission*
-
-  (when resources get written into the database)
-
-- Therefore, we can have "invalid" resources in etcd
-
-  (they are invalid from the CRD perspective, but the CRD can be changed)
-
-🤔 How should we handle that ?
-
----
-
-## Versions
-
-- If the data format changes, we can roll out a new version of the CRD
-
-  (e.g. go from `v1alpha1` to `v1alpha2`)
-
-- In a CRD we can specify the versions that exist, that are *served*, and *stored*
-
-  - multiple versions can be *served*
-
-  - only one can be *stored*
-
-- Kubernetes doesn't automatically migrate the content of the database
-
-- However, it can convert between versions when resources are read/written
-
----
-
-## Conversion
-
-- When *creating* a new resource, the *stored* version is used
-
-  (if we create it with another version, it gets converted)
-
-- When *getting* or *watching* resources, the *requested* version is used
-
-  (if it is stored with another version, it gets converted)
-
-- By default, "conversion" only changes the `apiVersion` field
-
-- ... But we can register *conversion webhooks*
-
-  (see [that doc page](https://kubernetes.io/docs/tasks/extend-kubernetes/custom-resources/custom-resource-definition-versioning/#webhook-conversion) for details)
-
----
-
-## Migrating database content
-
-- We need to *serve* a version as long as we *store* objects in that version
-
-  (=as long as the database has at least one object with that version)
-
-- If we want to "retire" a version, we need to migrate these objects first
-
-- All we have to do is to read and re-write them
-
-  (the [kube-storage-version-migrator](https://github.com/kubernetes-sigs/kube-storage-version-migrator) tool can help)
-
----
-
-## What's next?
-
-- Generally, when creating a CRD, we also want to run a *controller*
-
-  (otherwise nothing will happen when we create resources of that type)
-
-- The controller will typically *watch* our custom resources
-
-  (and take action when they are created/updated)
-
----
-
-## CRDs in the wild
-
-- [gitkube](https://storage.googleapis.com/gitkube/gitkube-setup-stable.yaml)
-
-- [A redis operator](https://github.com/amaizfinance/redis-operator/blob/master/deploy/crds/k8s_v1alpha1_redis_crd.yaml)
-
-- [cert-manager](https://github.com/jetstack/cert-manager/releases/download/v1.0.4/cert-manager.yaml)
-
-*How big are these YAML files?*
-
-*What's the size (e.g. in lines) of each resource?*
-
----
-
-## CRDs in practice
-
-- Production-grade CRDs can be extremely verbose
-
-  (because of the openAPI schema validation)
-
-- This can (and usually will) be managed by a framework
-
----
-
-## (Ab)using the API server
-
-- If we need to store something "safely" (as in: in etcd), we can use CRDs
-
-- This gives us primitives to read/write/list objects (and optionally validate them)
-
-- The Kubernetes API server can run on its own
-
-  (without the scheduler, controller manager, and kubelets)
-
-- By loading CRDs, we can have it manage totally different objects
-
-  (unrelated to containers, clusters, etc.)
-
-???
-
-:EN:- Custom Resource Definitions (CRDs)
-:FR:- Les CRDs *(Custom Resource Definitions)*

slides/k8s/csr-api.md

@@ -108,26 +108,6 @@ The CA (or anyone else) never needs to know my private key.
 
 ---
 
-## Warning
-
-- The CSR API isn't really suited to issue user certificates
-
-- It is primarily intended to issue control plane certificates
-
-  (for instance, deal with kubelet certificates renewal)
-
-- The API was expanded a bit in Kubernetes 1.19 to encompass broader usage
-
-- There are still lots of gaps in the spec
-
-  (e.g. how to specify expiration in a standard way)
-
-- ... And no other implementation to this date
-
-  (but [cert-manager](https://cert-manager.io/docs/faq/#kubernetes-has-a-builtin-certificatesigningrequest-api-why-not-use-that) might eventually get there!)
-
----
-
 ## General idea
 
 - We will create a Namespace named "users"

slides/k8s/daemonset.md

@@ -52,7 +52,7 @@
 
 <!-- ##VERSION## -->
 
-- Unfortunately, as of Kubernetes 1.19, the CLI cannot create daemon sets
+- Unfortunately, as of Kubernetes 1.17, the CLI cannot create daemon sets
 
 --
 
@@ -431,23 +431,15 @@ class: extra-details
 
 ---
 
-## Selectors with multiple labels
+## Complex selectors
 
 - If a selector specifies multiple labels, they are understood as a logical *AND*
 
-  (in other words: the pods must match all the labels)
+  (In other words: the pods must match all the labels)
 
-- We cannot have a logical *OR*
+- Kubernetes has support for advanced, set-based selectors
 
-  (e.g. `app=api AND (release=prod OR release=preprod)`)
-
-- We can, however, apply as many extra labels as we want to our pods:
-
-  - use selector `app=api AND prod-or-preprod=yes`
-
-  - add `prod-or-preprod=yes` to both sets of pods
-
-- We will see later that in other places, we can use more advanced selectors
+  (But these cannot be used with services, at least not yet!)
 
 ---
 
@@ -697,95 +689,6 @@ class: extra-details
 
 - This gives us building blocks for canary and blue/green deployments
 
----
-
-class: extra-details
-
-## Advanced label selectors
-
-- As indicated earlier, service selectors are limited to a `AND`
-
-- But in many other places in the Kubernetes API, we can use complex selectors
-
-  (e.g. Deployment, ReplicaSet, DaemonSet, NetworkPolicy ...)
-
-- These allow extra operations; specifically:
-
-  - checking for presence (or absence) of a label
-
-  - checking if a label is (or is not) in a given set
-
-- Relevant documentation:
-
-  [Service spec](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.19/#servicespec-v1-core),
-  [LabelSelector spec](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.19/#labelselector-v1-meta),
-  [label selector doc](https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#label-selectors)
-
----
-
-class: extra-details
-
-## Example of advanced selector
-
-```yaml
-  theSelector:
-    matchLabels:
-      app: portal
-      component: api
-    matchExpressions:
-    - key: release
-      operator: In
-      values: [ production, preproduction ]
-    - key: signed-off-by
-      operator: Exists
-```
-
-This selector matches pods that meet *all* the indicated conditions.
-
-`operator` can be `In`, `NotIn`, `Exists`, `DoesNotExist`.
-
-A `nil` selector matches *nothing*, a `{}` selector matches *everything*.
-<br/>
-(Because that means "match all pods that meet at least zero condition".)
-
----
-
-class: extra-details
-
-## Services and Endpoints
-
-- Each Service has a corresponding Endpoints resource
-
-  (see `kubectl get endpoints` or `kubectl get ep`)
-
-- That Endpoints resource is used by various controllers
-
-  (e.g. `kube-proxy` when setting up `iptables` rules for ClusterIP services)
-
-- These Endpoints are populated (and updated) with the Service selector
-
-- We can update the Endpoints manually, but our changes will get overwritten
-
-- ... Except if the Service selector is empty!
-
----
-
-class: extra-details
-
-## Empty Service selector
-
-- If a service selector is empty, Endpoints don't get updated automatically
-
-  (but we can still set them manually)
-
-- This lets us create Services pointing to arbitrary destinations
-
-  (potentially outside the cluster; or things that are not in pods)
-
-- Another use-case: the `kubernetes` service in the `default` namespace
-
-  (its Endpoints are maintained automatically by the API server)
-
 ???
 
 :EN:- Scaling with Daemon Sets

slides/k8s/dashboard.md

@@ -2,65 +2,47 @@
 
 - Kubernetes resources can also be viewed with a web dashboard
 
+- That dashboard is usually exposed over HTTPS
+
+  (this requires obtaining a proper TLS certificate)
+
 - Dashboard users need to authenticate
 
-  (typically with a token)
-
-- The dashboard should be exposed over HTTPS
-
-  (to prevent interception of the aforementioned token)
-
-- Ideally, this requires obtaining a proper TLS certificate
-
-  (for instance, with Let's Encrypt)
+- We are going to take a *dangerous* shortcut
 
 ---
 
-## Three ways to install the dashboard
+## The insecure method
 
-- Our `k8s` directory has no less than three manifests!
+- We could (and should) use [Let's Encrypt](https://letsencrypt.org/) ...
 
-- `dashboard-recommended.yaml`
+- ... but we don't want to deal with TLS certificates
 
-  (purely internal dashboard; user must be created manually)
+- We could (and should) learn how authentication and authorization work ...
 
-- `dashboard-with-token.yaml`
+- ... but we will use a guest account with admin access instead
 
-  (dashboard exposed with NodePort; creates an admin user for us)
-
-- `dashboard-insecure.yaml` aka *YOLO*
-
-  (dashboard exposed over HTTP; gives root access to anonymous users)
+.footnote[.warning[Yes, this will open our cluster to all kinds of shenanigans. Don't do this at home.]]
 
 ---
 
-## `dashboard-insecure.yaml`
+## Running a very insecure dashboard
 
-- This will allow anyone to deploy anything on your cluster
+- We are going to deploy that dashboard with *one single command*
 
-  (without any authentication whatsoever)
+- This command will create all the necessary resources
 
-- **Do not** use this, except maybe on a local cluster
+  (the dashboard itself, the HTTP wrapper, the admin/guest account)
 
-  (or a cluster that you will destroy a few minutes later)
+- All these resources are defined in a YAML file
 
-- On "normal" clusters, use `dashboard-with-token.yaml` instead!
-
----
-
-## What's in the manifest?
-
-- The dashboard itself
-
-- An HTTP/HTTPS unwrapper (using `socat`)
-
-- The guest/admin account
+- All we have to do is load that YAML file with with `kubectl apply -f`
 
 .exercise[
 
 - Create all the dashboard resources, with the following command:
   ```bash
-  kubectl apply -f ~/container.training/k8s/dashboard-insecure.yaml
+  kubectl apply -f ~/container.training/k8s/insecure-dashboard.yaml
   ```
 
 ]
@@ -107,26 +89,11 @@ The dashboard will then ask you which authentication you want to use.
 
 --
 
-.warning[Remember, we just added a backdoor to our Kubernetes cluster!]
+.warning[By the way, we just added a backdoor to our Kubernetes cluster!]
 
 ---
 
-## Closing the backdoor
-
-- Seriously, don't leave that thing running!
-
-.exercise[
-
-- Remove what we just created:
-  ```bash
-    kubectl delete -f ~/container.training/k8s/dashboard-insecure.yaml
-  ```
-
-]
-
----
-
-## The risks
+## Running the Kubernetes dashboard securely
 
 - The steps that we just showed you are *for educational purposes only!*
 
@@ -138,99 +105,6 @@ The dashboard will then ask you which authentication you want to use.
 
 ---
 
-## `dashboard-with-token.yaml`
-
-- This is a less risky way to deploy the dashboard
-
-- It's not completely secure, either:
-
-  - we're using a self-signed certificate
-
-  - this is subject to eavesdropping attacks
-
-- Using `kubectl port-forward` or `kubectl proxy` is even better
-
----
-
-## What's in the manifest?
-
-- The dashboard itself (but exposed with a `NodePort`)
-
-- A ServiceAccount with `cluster-admin` privileges
-
-  (named `kubernetes-dashboard:cluster-admin`)
-
-.exercise[
-
-- Create all the dashboard resources, with the following command:
-  ```bash
-  kubectl apply -f ~/container.training/k8s/dashboard-with-token.yaml
-  ```
-
-]
-
----
-
-## Obtaining the token
-
-- The manifest creates a ServiceAccount
-
-- Kubernetes will automatically generate a token for that ServiceAccount
-
-.exercise[
-
-- Display the token:
-  ```bash
-    kubectl --namespace=kubernetes-dashboard \
-      describe secret cluster-admin-token
-  ```
-
-]
-
-The token should start with `eyJ...` (it's a JSON Web Token).
-
-Note that the secret name will actually be `cluster-admin-token-xxxxx`.
-<br/>
-(But `kubectl` prefix matches are great!)
-
----
-
-## Connecting to the dashboard
-
-.exercise[
-
-- Check which port the dashboard is on:
-  ```bash
-  kubectl get svc --namespace=kubernetes-dashboard
-  ```
-
-]
-
-You'll want the `3xxxx` port.
-
-
-.exercise[
-
-- Connect to http://oneofournodes:3xxxx/
-
-<!-- ```open http://node1:3xxxx/``` -->
-
-]
-
-The dashboard will then ask you which authentication you want to use.
-
----
-
-## Dashboard authentication
-
-- Select "token" authentication
-
-- Copy paste the token (starting with `eyJ...`) obtained earlier
-
-- We're logged in!
-
----
-
 ## Other dashboards
 
 - [Kube Web View](https://codeberg.org/hjacobs/kube-web-view)
@@ -241,7 +115,7 @@ The dashboard will then ask you which authentication you want to use.
 
   - see [vision and goals](https://kube-web-view.readthedocs.io/en/latest/vision.html#vision) for details
 
-- [Kube Ops View](https://codeberg.org/hjacobs/kube-ops-view)
+- [Kube Ops View](https://github.com/hjacobs/kube-ops-view)
 
   - "provides a common operational picture for multiple Kubernetes clusters"
 

slides/k8s/dryrun.md

@@ -1,6 +1,6 @@
 # Authoring YAML
 
-- We have already generated YAML implicitly, with e.g.:
+- There are various ways to generate YAML with Kubernetes, e.g.:
 
   - `kubectl run`
 
@@ -32,63 +32,26 @@
 
 ---
 
-## Various ways to write YAML
+## We don't have to start from scratch
 
-- Completely from scratch with our favorite editor
+- Create a resource (e.g. Deployment)
 
-  (yeah, right)
+- Dump its YAML with `kubectl get -o yaml ...`
 
-- Dump an existing resource with `kubectl get -o yaml ...`
+- Edit the YAML
 
-  (it is recommended to clean up the result)
+- Use `kubectl apply -f ...` with the YAML file to:
 
-- Ask `kubectl` to generate the YAML
+  - update the resource (if it's the same kind)
 
-  (with a `kubectl create --dry-run -o yaml`)
+  - create a new resource (if it's a different kind)
 
-- Use The Docs, Luke
+- Or: Use The Docs, Luke
 
   (the documentation almost always has YAML examples)
 
 ---
 
-## Generating YAML from scratch
-
-- Start with a namespace:
-  ```yaml
-    kind: Namespace
-    apiVersion: v1
-    metadata:
-      name: hello
-  ```
-
-- We can use `kubectl explain` to see resource definitions:
-  ```bash
-  kubectl explain -r pod.spec
-  ```
-
-- Not the easiest option!
-
----
-
-## Dump the YAML for an existing resource
-
-- `kubectl get -o yaml` works!
-
-- A lot of fields in `metadata` are not necessary
-
-  (`managedFields`, `resourceVersion`, `uid`, `creationTimestamp` ...)
-
-- Most objects will have a `status` field that is not necessary
-
-- Default or empty values can also be removed for clarity
-
-- This can be done manually or with the `kubectl-neat` plugin
-
-  `kubectl get -o yaml ... | kubectl neat`
-
----
-
 ## Generating YAML without creating resources
 
 - We can use the `--dry-run` option
@@ -100,18 +63,14 @@
   kubectl create deployment web --image nginx --dry-run
   ```
 
-- Optionally clean it up with `kubectl neat`, too
-
 ]
 
-Note: in recent versions of Kubernetes, we should use `--dry-run=client`
+- We can clean up that YAML even more if we want
 
-(Or `--dry-run=server`; more on that later!)
+  (for instance, we can remove the `creationTimestamp` and empty dicts)
 
 ---
 
-class: extra-details
-
 ## Using `--dry-run` with `kubectl apply`
 
 - The `--dry-run` option can also be used with `kubectl apply`
@@ -128,8 +87,6 @@ class: extra-details
 
 ---
 
-class: extra-details
-
 ## The limits of `kubectl apply --dry-run`
 
 .exercise[
@@ -155,8 +112,6 @@ The resulting YAML doesn't represent a valid DaemonSet.
 
 ---
 
-class: extra-details
-
 ## Server-side dry run
 
 - Since Kubernetes 1.13, we can use [server-side dry run and diffs](https://kubernetes.io/blog/2019/01/14/apiserver-dry-run-and-kubectl-diff/)
@@ -169,7 +124,7 @@ class: extra-details
 
 - Try the same YAML file as earlier, with server-side dry run:
   ```bash
-  kubectl apply -f web.yaml --dry-run=server --validate=false -o yaml
+  kubectl apply -f web.yaml --server-dry-run --validate=false -o yaml
   ```
 
 ]
@@ -180,8 +135,6 @@ Instead, it has the fields expected in a DaemonSet.
 
 ---
 
-class: extra-details
-
 ## Advantages of server-side dry run
 
 - The YAML is verified much more extensively
@@ -196,8 +149,6 @@ class: extra-details
 
 ---
 
-class: extra-details
-
 ## `kubectl diff`
 
 - Kubernetes 1.13 also introduced `kubectl diff`
@@ -258,8 +209,3 @@ Note: we don't need to specify `--validate=false` here.
   - check that it still works!
 
 - That YAML will be useful later when using e.g. Kustomize or Helm
-
-???
-
-:EN:- Techniques to write YAML manifests
-:FR:- Comment écrire des *manifests* YAML

slides/k8s/eck.md

@@ -1,455 +0,0 @@
-# An ElasticSearch Operator
-
-- We will install [Elastic Cloud on Kubernetes](https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-quickstart.html), an ElasticSearch operator
-
-- This operator requires PersistentVolumes
-
-- We will install Rancher's [local path storage provisioner](https://github.com/rancher/local-path-provisioner) to automatically create these
-
-- Then, we will create an ElasticSearch resource
-
-- The operator will detect that resource and provision the cluster
-
-- We will integrate that ElasticSearch cluster with other resources
-
-  (Kibana, Filebeat, Cerebro ...)
-
----
-
-## Installing a Persistent Volume provisioner
-
-(This step can be skipped if you already have a dynamic volume provisioner.)
-
-- This provisioner creates Persistent Volumes backed by `hostPath`
-
-  (local directories on our nodes)
-
-- It doesn't require anything special ...
-
-- ... But losing a node = losing the volumes on that node!
-
-.exercise[
-
-- Install the local path storage provisioner:
-  ```bash
-  kubectl apply -f ~/container.training/k8s/local-path-storage.yaml
-  ```
-
-]
-
----
-
-## Making sure we have a default StorageClass
-
-- The ElasticSearch operator will create StatefulSets
-
-- These StatefulSets will instantiate PersistentVolumeClaims
-
-- These PVCs need to be explicitly associated with a StorageClass
-
-- Or we need to tag a StorageClass to be used as the default one
-
-.exercise[
-
-- List StorageClasses:
-  ```bash
-  kubectl get storageclasses
-  ```
-
-]
-
-We should see the `local-path` StorageClass.
-
----
-
-## Setting a default StorageClass
-
-- This is done by adding an annotation to the StorageClass:
-
-  `storageclass.kubernetes.io/is-default-class: true`
-
-.exercise[
-
-- Tag the StorageClass so that it's the default one:
-  ```bash
-  kubectl annotate storageclass local-path \
-            storageclass.kubernetes.io/is-default-class=true
-  ```
-
-- Check the result:
-  ```bash
-  kubectl get storageclasses
-  ```
-
-]
-
-Now, the StorageClass should have `(default)` next to its name.
-
----
-
-## Install the ElasticSearch operator
-
-- The operator provides:
-
-  - a few CustomResourceDefinitions
-  - a Namespace for its other resources
-  - a ValidatingWebhookConfiguration for type checking
-  - a StatefulSet for its controller and webhook code
-  - a ServiceAccount, ClusterRole, ClusterRoleBinding for permissions
-
-- All these resources are grouped in a convenient YAML file
-
-.exercise[
-
-- Install the operator:
-  ```bash
-  kubectl apply -f ~/container.training/k8s/eck-operator.yaml
-  ```
-
-]
-
----
-
-## Check our new custom resources
-
-- Let's see which CRDs were created
-
-.exercise[
-
-- List all CRDs:
-  ```bash
-  kubectl get crds
-  ```
-
-]
-
-This operator supports ElasticSearch, but also Kibana and APM. Cool!
-
----
-
-## Create the `eck-demo` namespace
-
-- For clarity, we will create everything in a new namespace, `eck-demo`
-
-- This namespace is hard-coded in the YAML files that we are going to use
-
-- We need to create that namespace
-
-.exercise[
-
-- Create the `eck-demo` namespace:
-  ```bash
-  kubectl create namespace eck-demo
-  ```
-
-- Switch to that namespace:
-  ```bash
-  kns eck-demo
-  ```
-
-]
-
----
-
-class: extra-details
-
-## Can we use a different namespace?
-
-Yes, but then we need to update all the YAML manifests that we
-are going to apply in the next slides.
-
-The `eck-demo` namespace is hard-coded in these YAML manifests.
-
-Why?
-
-Because when defining a ClusterRoleBinding that references a
-ServiceAccount, we have to indicate in which namespace the
-ServiceAccount is located.
-
----
-
-## Create an ElasticSearch resource
-
-- We can now create a resource with `kind: ElasticSearch`
-
-- The YAML for that resource will specify all the desired parameters:
-
-  - how many nodes we want
-  - image to use
-  - add-ons (kibana, cerebro, ...)
-  - whether to use TLS or not
-  - etc.
-
-.exercise[
-
-- Create our ElasticSearch cluster:
-  ```bash
-  kubectl apply -f ~/container.training/k8s/eck-elasticsearch.yaml
-  ```
-
-]
-
----
-
-## Operator in action
-
-- Over the next minutes, the operator will create our ES cluster
-
-- It will report our cluster status through the CRD
-
-.exercise[
-
-- Check the logs of the operator:
-  ```bash
-  stern --namespace=elastic-system operator
-  ```
-
-<!--
-```wait elastic-operator-0```
-```tmux split-pane -v```
---->
-
-- Watch the status of the cluster through the CRD:
-  ```bash
-  kubectl get es -w
-  ```
-
-<!--
-```longwait green```
-```key ^C```
-```key ^D```
-```key ^C```
--->
-
-]
-
----
-
-## Connecting to our cluster
-
-- It's not easy to use the ElasticSearch API from the shell
-
-- But let's check at least if ElasticSearch is up!
-
-.exercise[
-
-- Get the ClusterIP of our ES instance:
-  ```bash
-  kubectl get services
-  ```
-
-- Issue a request with `curl`:
-  ```bash
-  curl http://`CLUSTERIP`:9200
-  ```
-
-]
-
-We get an authentication error. Our cluster is protected!
-
----
-
-## Obtaining the credentials
-
-- The operator creates a user named `elastic`
-
-- It generates a random password and stores it in a Secret
-
-.exercise[
-
-- Extract the password:
-  ```bash
-    kubectl get secret demo-es-elastic-user \
-            -o go-template="{{ .data.elastic | base64decode }} "
-  ```
-
-- Use it to connect to the API:
-  ```bash
-  curl -u elastic:`PASSWORD` http://`CLUSTERIP`:9200
-  ```
-
-]
-
-We should see a JSON payload with the `"You Know, for Search"` tagline.
-
----
-
-## Sending data to the cluster
-
-- Let's send some data to our brand new ElasticSearch cluster!
-
-- We'll deploy a filebeat DaemonSet to collect node logs
-
-.exercise[
-
-- Deploy filebeat:
-  ```bash
-  kubectl apply -f ~/container.training/k8s/eck-filebeat.yaml
-  ```
-
-- Wait until some pods are up:
-  ```bash
-  watch kubectl get pods -l k8s-app=filebeat
-  ```
-
-<!--
-```wait Running```
-```key ^C```
--->
-
-- Check that a filebeat index was created:
-  ```bash
-  curl -u elastic:`PASSWORD` http://`CLUSTERIP`:9200/_cat/indices
-  ```
-
-]
-
----
-
-## Deploying an instance of Kibana
-
-- Kibana can visualize the logs injected by filebeat
-
-- The ECK operator can also manage Kibana
-
-- Let's give it a try!
-
-.exercise[
-
-- Deploy a Kibana instance:
-  ```bash
-  kubectl apply -f ~/container.training/k8s/eck-kibana.yaml
-  ```
-
-- Wait for it to be ready:
-  ```bash
-  kubectl get kibana -w
-  ```
-
-<!--
-```longwait green```
-```key ^C```
--->
-
-]
-
----
-
-## Connecting to Kibana
-
-- Kibana is automatically set up to conect to ElasticSearch
-
-  (this is arranged by the YAML that we're using)
-
-- However, it will ask for authentication
-
-- It's using the same user/password as ElasticSearch
-
-.exercise[
-
-- Get the NodePort allocated to Kibana:
-  ```bash
-  kubectl get services
-  ```
-
-- Connect to it with a web browser
-
-- Use the same user/password as before
-
-]
-
----
-
-## Setting up Kibana
-
-After the Kibana UI loads, we need to click around a bit
-
-.exercise[
-
-- Pick "explore on my own"
-
-- Click on Use Elasticsearch data / Connect to your Elasticsearch index"
-
-- Enter `filebeat-*` for the index pattern and click "Next step"
-
-- Select `@timestamp` as time filter field name
-
-- Click on "discover" (the small icon looking like a compass on the left bar)
-
-- Play around!
-
-]
-
----
-
-## Scaling up the cluster
-
-- At this point, we have only one node
-
-- We are going to scale up
-
-- But first, we'll deploy Cerebro, an UI for ElasticSearch
-
-- This will let us see the state of the cluster, how indexes are sharded, etc.
-
----
-
-## Deploying Cerebro
-
-- Cerebro is stateless, so it's fairly easy to deploy
-
-  (one Deployment + one Service)
-
-- However, it needs the address and credentials for ElasticSearch
-
-- We prepared yet another manifest for that!
-
-.exercise[
-
-- Deploy Cerebro:
-  ```bash
-  kubectl apply -f ~/container.training/k8s/eck-cerebro.yaml
-  ```
-
-- Lookup the NodePort number and connect to it:
-  ```bash
-  kubectl get services
-  ```
-
-]
-
----
-
-## Scaling up the cluster
-
-- We can see on Cerebro that the cluster is "yellow"
-
-  (because our index is not replicated)
-
-- Let's change that!
-
-.exercise[
-
-- Edit the ElasticSearch cluster manifest:
-  ```bash
-  kubectl edit es demo
-  ```
-
-- Find the field `count: 1` and change it to 3
-
-- Save and quit
-
-<!--
-```wait Please edit```
-```keys /count:```
-```key ^J```
-```keys $r3:x```
-```key ^J```
--->
-
-]
-
-???
-
-:EN:- Deploying ElasticSearch with ECK
-:FR:- Déployer ElasticSearch avec ECK

slides/k8s/events.md

@@ -1,152 +0,0 @@
-# Events
-
-- Kubernetes has an internal structured log of *events*
-
-- These events are ordinary resources:
-
-  - we can view them with `kubectl get events`
-
-  - they can be viewed and created through the Kubernetes API
-
-  - they are stored in Kubernetes default database (e.g. etcd)
-
-- Most components will generate events to let us know what's going on
-
-- Events can be *related* to other resources
-
----
-
-## Reading events
-
-- `kubectl get events` (or `kubectl get ev`)
-
-- Can use `--watch`
-
-  ⚠️ Looks like `tail -f`, but events aren't necessarily sorted!
-
-- Can use `--all-namespaces`
-
-- Cluster events (e.g. related to nodes) are in the `default` namespace
-
-- Viewing all "non-normal" events:
-  ```bash
-  kubectl get ev -A --field-selector=type!=Normal
-  ```
-
-  (as of Kubernetes 1.19, `type` can be either `Normal` or `Warning`)
-
----
-
-## Reading events (take 2)
-
-- When we use `kubectl describe` on an object, `kubectl` retrieves the associated events
-
-.exercise[
-
-- See the API requests happening when we use `kubectl describe`:
-  ```bash
-  kubectl describe service kubernetes --namespace=default -v6 >/dev/null
-  ```
-
-]
-
----
-
-## Generating events
-
-- This is rarely (if ever) done manually
-
-  (i.e. by crafting some YAML)
-
-- But controllers (e.g. operators) need this!
-
-- It's not mandatory, but it helps with *operability*
-
-  (e.g. when we `kubectl describe` a CRD, we will see associated events)
-
----
-
-## ⚠️ Work in progress
-
-- "Events" can be :
-
-  - "old-style" events (in core API group, aka `v1`)
-
-  - "new-style" events (in API group `events.k8s.io`)
-
-- See [KEP 383](https://github.com/kubernetes/enhancements/blob/master/keps/sig-instrumentation/383-new-event-api-ga-graduation/README.md) in particular this [comparison between old and new APIs](https://github.com/kubernetes/enhancements/blob/master/keps/sig-instrumentation/383-new-event-api-ga-graduation/README.md#comparison-between-old-and-new-apis)
-
----
-
-## Experimenting with events
-
-- Let's create an event related to a Node, based on @@LINK[k8s/event-node.yaml]
-
-.exercise[
-
-- Edit `k8s/event-node.yaml`
-
-- Update the `name` and `uid` of the `involvedObject`
-
-- Create the event with `kubectl create -f`
-
-- Look at the Node with `kubectl describe`
-
-]
-
----
-
-## Experimenting with events
-
-- Let's create an event related to a Pod, based on @@LINK[k8s/event-pod.yaml]
-
-.exercise[
-
-- Create a pod
-
-- Edit `k8s/event-pod.yaml`
-
-- Edit the `involvedObject` section (don't forget the `uid`)
-
-- Create the event with `kubectl create -f`
-
-- Look at the Pod with `kubectl describe`
-
-]
-
----
-
-## Generating events in practice
-
-- In Go, use an `EventRecorder` provided by the `kubernetes/client-go` library
-
-  - [EventRecorder interface](https://github.com/kubernetes/client-go/blob/release-1.19/tools/record/event.go#L87)
-  
-  - [kubebuilder book example](https://book-v1.book.kubebuilder.io/beyond_basics/creating_events.html)
-
-- It will take care of formatting / aggregating events
-
-- To get an idea of what to put in the `reason` field, check [kubelet events](
-https://github.com/kubernetes/kubernetes/blob/release-1.19/pkg/kubelet/events/event.go)
-
----
-
-## Cluster operator perspective
-
-- Events are kept 1 hour by default
-
-- This can be changed with the `--event-ttl` flag on the API server
-
-- On very busy clusters, events can be kept on a separate etcd cluster
-
-- This is done with the `--etcd-servers-overrides` flag on the API server
-
-- Example:
-  ```
-  --etcd-servers-overrides=/events#http://127.0.0.1:12379
-  ```
-
-???
-
-:EN:- Consuming and generating cluster events
-:FR:- Suivre l'activité du cluster avec les *events*

slides/k8s/exercise-helm.md

@@ -10,7 +10,7 @@ Level 2: make it so that the number of replicas can be set with `--set replicas=
 
 Level 3: change the colors of the lego bricks.
 
-(For level 3, you'll have to build/push your own images.)
+(For level 3, fork the repository and use ctr.run to build images.)
 
 See next slide if you need hints!
 
@@ -44,12 +44,20 @@ Also add `replicas: 5` to `values.yaml` to provide a default value.
 
 ## Changing the color
 
-- Create an account on e.g. Docker Hub (e.g. `janedoe`)
+- Fork the repository
 
-- Create an image repository (e.g. `janedoe/web`)
+- Make sure that your fork has valid Dockerfiles
+
+  (or identify a branch that has valid Dockerfiles)
+
+- Use the following images:
+
+  ctr.run/yourgithubusername/wordsmith/db:branchname
+
+  (replace db with web and words for the other components)
 
 - Change the images and/or CSS in `web/static`
 
-- Build and push
+- Commit, push, trigger a rolling update
 
-- Trigger a rolling update using the image you just pushed
+  (`imagePullPolicy` should be `Always`, which is the default)