🔗Fix broken link

slides/_redirects

@@ -2,6 +2,7 @@
 #/ /kube-halfday.yml.html 200!
 #/ /kube-fullday.yml.html 200!
 #/ /kube-twodays.yml.html 200!
+/ /lke.yml.html 200!
 
 # And this allows to do "git clone https://container.training".
 /info/refs service=git-upload-pack https://github.com/jpetazzo/container.training/info/refs?service=git-upload-pack

slides/intro-fullday.yml

@@ -1,70 +0,0 @@
-title: |
-  Introduction
-  to Containers
-
-chat: "[Slack](https://dockercommunity.slack.com/messages/C7GKACWDV)"
-#chat: "[Gitter](https://gitter.im/jpetazzo/workshop-yyyymmdd-city)"
-
-gitrepo: github.com/jpetazzo/container.training
-
-slides: http://container.training/
-
-#slidenumberprefix: "#SomeHashTag — "
-
-exclude:
-- self-paced
-
-content:
-- shared/title.md
-- logistics.md
-- containers/intro.md
-- shared/about-slides.md
-- shared/chat-room-im.md
-#- shared/chat-room-slack.md
-#- shared/chat-room-zoom-meeting.md
-#- shared/chat-room-zoom-webinar.md
-- shared/toc.md
--
-  #- containers/Docker_Overview.md
-  #- containers/Docker_History.md
-  - containers/Training_Environment.md
-  #- containers/Installing_Docker.md
-  - containers/First_Containers.md
-  - containers/Background_Containers.md
-  #- containers/Start_And_Attach.md
-  - containers/Naming_And_Inspecting.md
-  #- containers/Labels.md
-  - containers/Getting_Inside.md
-  - containers/Initial_Images.md
--
-  - containers/Building_Images_Interactively.md
-  - containers/Building_Images_With_Dockerfiles.md
-  - containers/Cmd_And_Entrypoint.md
-  - containers/Copying_Files_During_Build.md
-  - containers/Exercise_Dockerfile_Basic.md
--
-  - containers/Container_Networking_Basics.md
-  #- containers/Network_Drivers.md
-  - containers/Local_Development_Workflow.md
-  - containers/Container_Network_Model.md
-  - containers/Compose_For_Dev_Stacks.md
-  - containers/Exercise_Composefile.md
--
-  - containers/Multi_Stage_Builds.md
-  #- containers/Publishing_To_Docker_Hub.md
-  - containers/Dockerfile_Tips.md
-  - containers/Exercise_Dockerfile_Advanced.md
-  #- containers/Docker_Machine.md
-  #- containers/Advanced_Dockerfiles.md
-  #- containers/Init_Systems.md
-  #- containers/Application_Configuration.md
-  #- containers/Logging.md
-  #- containers/Namespaces_Cgroups.md
-  #- containers/Copy_On_Write.md
-  #- containers/Containers_From_Scratch.md
-  #- containers/Container_Engines.md
-  #- containers/Pods_Anatomy.md
-  #- containers/Ecosystem.md
-  #- containers/Orchestration_Overview.md
-  - shared/thankyou.md
-  - containers/links.md

slides/intro-selfpaced.yml

@@ -1,71 +0,0 @@
-title: |
-  Introduction
-  to Containers
-
-chat: "[Slack](https://dockercommunity.slack.com/messages/C7GKACWDV)"
-#chat: "[Gitter](https://gitter.im/jpetazzo/workshop-yyyymmdd-city)"
-
-gitrepo: github.com/jpetazzo/container.training
-
-slides: http://container.training/
-
-#slidenumberprefix: "#SomeHashTag — "
-
-exclude:
-- in-person
-
-content:
-- shared/title.md
-# - shared/logistics.md
-- containers/intro.md
-- shared/about-slides.md
-#- shared/chat-room-im.md
-#- shared/chat-room-slack.md
-#- shared/chat-room-zoom-meeting.md
-#- shared/chat-room-zoom-webinar.md
-- shared/toc.md
-- - containers/Docker_Overview.md
-  - containers/Docker_History.md
-  - containers/Training_Environment.md
-  - containers/Installing_Docker.md
-  - containers/First_Containers.md
-  - containers/Background_Containers.md
-  - containers/Start_And_Attach.md
-- - containers/Initial_Images.md
-  - containers/Building_Images_Interactively.md
-  - containers/Building_Images_With_Dockerfiles.md
-  - containers/Cmd_And_Entrypoint.md
-  - containers/Copying_Files_During_Build.md
-  - containers/Exercise_Dockerfile_Basic.md
-- - containers/Multi_Stage_Builds.md
-  - containers/Publishing_To_Docker_Hub.md
-  - containers/Dockerfile_Tips.md
-  - containers/Exercise_Dockerfile_Advanced.md
-- - containers/Naming_And_Inspecting.md
-  - containers/Labels.md
-  - containers/Getting_Inside.md
-- - containers/Container_Networking_Basics.md
-  - containers/Network_Drivers.md
-  - containers/Container_Network_Model.md
-  #- containers/Connecting_Containers_With_Links.md
-  - containers/Ambassadors.md
-- - containers/Local_Development_Workflow.md
-  - containers/Windows_Containers.md
-  - containers/Working_With_Volumes.md
-  - containers/Compose_For_Dev_Stacks.md
-  - containers/Exercise_Composefile.md
-  - containers/Docker_Machine.md
-- - containers/Advanced_Dockerfiles.md
-  - containers/Init_Systems.md
-  - containers/Application_Configuration.md
-  - containers/Logging.md
-  - containers/Resource_Limits.md
-- - containers/Namespaces_Cgroups.md
-  - containers/Copy_On_Write.md
-  #- containers/Containers_From_Scratch.md
-- - containers/Container_Engines.md
-  - containers/Pods_Anatomy.md
-  - containers/Ecosystem.md
-  - containers/Orchestration_Overview.md
-  - shared/thankyou.md
-  - containers/links.md

slides/intro-twodays.yml

@@ -1,79 +0,0 @@
-title: |
-  Introduction
-  to Containers
-
-chat: "[Slack](https://dockercommunity.slack.com/messages/C7GKACWDV)"
-#chat: "[Gitter](https://gitter.im/jpetazzo/workshop-yyyymmdd-city)"
-
-gitrepo: github.com/jpetazzo/container.training
-
-slides: http://container.training/
-
-#slidenumberprefix: "#SomeHashTag — "
-
-exclude:
-- self-paced
-
-content:
-- shared/title.md
-- logistics.md
-- containers/intro.md
-- shared/about-slides.md
-- shared/chat-room-im.md
-#- shared/chat-room-slack.md
-#- shared/chat-room-zoom-meeting.md
-#- shared/chat-room-zoom-webinar.md
-- shared/toc.md
-- # DAY 1
-  - containers/Docker_Overview.md
-  #- containers/Docker_History.md
-  - containers/Training_Environment.md
-  - containers/First_Containers.md
-  - containers/Background_Containers.md
-  - containers/Initial_Images.md
--
-  - containers/Building_Images_Interactively.md
-  - containers/Building_Images_With_Dockerfiles.md
-  - containers/Cmd_And_Entrypoint.md
-  - containers/Copying_Files_During_Build.md
-  - containers/Exercise_Dockerfile_Basic.md
--
-  - containers/Dockerfile_Tips.md
-  - containers/Multi_Stage_Builds.md
-  - containers/Publishing_To_Docker_Hub.md
-  - containers/Exercise_Dockerfile_Advanced.md
--
-  - containers/Naming_And_Inspecting.md
-  - containers/Labels.md
-  - containers/Start_And_Attach.md
-  - containers/Getting_Inside.md
-  - containers/Resource_Limits.md
-- # DAY 2
-  - containers/Container_Networking_Basics.md
-  - containers/Network_Drivers.md
-  - containers/Container_Network_Model.md
--
-  - containers/Local_Development_Workflow.md
-  - containers/Working_With_Volumes.md
-  - containers/Compose_For_Dev_Stacks.md
-  - containers/Exercise_Composefile.md
--
-  - containers/Installing_Docker.md
-  - containers/Container_Engines.md
-  - containers/Init_Systems.md
-  - containers/Advanced_Dockerfiles.md
--
-  - containers/Application_Configuration.md
-  - containers/Logging.md
-  - containers/Orchestration_Overview.md
--
-  - shared/thankyou.md
-  - containers/links.md
-#-
-  #- containers/Docker_Machine.md
-  #- containers/Ambassadors.md
-  #- containers/Namespaces_Cgroups.md
-  #- containers/Copy_On_Write.md
-  #- containers/Containers_From_Scratch.md
-  #- containers/Pods_Anatomy.md
-  #- containers/Ecosystem.md

slides/k8s/accessinternal.md

@@ -1,41 +1,13 @@
 # Accessing internal services
 
-- When we are logged in on a cluster node, we can access internal services
-
-  (by virtue of the Kubernetes network model: all nodes can reach all pods and services)
-
-- When we are accessing a remote cluster, things are different
-
-  (generally, our local machine won't have access to the cluster's internal subnet)
-
 - How can we temporarily access a service without exposing it to everyone?
 
---
-
 - `kubectl proxy`: gives us access to the API, which includes a proxy for HTTP resources
 
 - `kubectl port-forward`: allows forwarding of TCP ports to arbitrary pods, services, ...
 
 ---
 
-## Suspension of disbelief
-
-The exercises in this section assume that we have set up `kubectl` on our
-local machine in order to access a remote cluster.
-
-We will therefore show how to access services and pods of the remote cluster,
-from our local machine.
-
-You can also run these exercises directly on the cluster (if you haven't
-installed and set up `kubectl` locally).
-
-Running commands locally will be less useful
-(since you could access services and pods directly),
-but keep in mind that these commands will work anywhere as long as you have
-installed and set up `kubectl` to communicate with your cluster.
-
----
-
 ## `kubectl proxy` in theory
 
 - Running `kubectl proxy` gives us access to the entire Kubernetes API
@@ -56,7 +28,7 @@ installed and set up `kubectl` to communicate with your cluster.
 
 ## `kubectl proxy` in practice
 
-- Let's access the `webui` service through `kubectl proxy`
+- Let's access the `web` service through `kubectl proxy`
 
 .exercise[
 
@@ -65,9 +37,9 @@ installed and set up `kubectl` to communicate with your cluster.
   kubectl proxy &
   ```
 
-- Access the `webui` service:
+- Access the `web` service:
   ```bash
-  curl localhost:8001/api/v1/namespaces/default/services/webui/proxy/index.html
+  curl localhost:8001/api/v1/namespaces/default/services/web/proxy/
   ```
 
 - Terminate the proxy:
@@ -99,22 +71,20 @@ installed and set up `kubectl` to communicate with your cluster.
 
 ## `kubectl port-forward` in practice
 
-- Let's access our remote Redis server
+- Let's access our remote NGINX server
 
 .exercise[
 
-- Forward connections from local port 10000 to remote port 6379:
+- Forward connections from local port 1234 to remote port 80:
   ```bash
-  kubectl port-forward svc/redis 10000:6379 &
+  kubectl port-forward svc/web 1234:80 &
   ```
 
-- Connect to the Redis server:
+- Connect to the NGINX server:
   ```bash
-  telnet localhost 10000
+  curl localhost:1234
   ```
 
-- Issue a few commands, e.g. `INFO server` then `QUIT`
-
 <!--
 ```wait Connected to localhost```
 ```keys INFO server```

slides/k8s/cert-manager.md

@@ -84,13 +84,15 @@
 
 ## Creating the ClusterIssuer
 
-- The manifest shown on the previous slide is in @@LINK[k8s/cm-clusterissuer.yaml]
+- Download the file @@LINK[k8s/cm-clusterissuer.yaml]
+
+  (or copy-paste from the previous slide)
 
 .exercise[
 
 - Create the ClusterIssuer:
   ```bash
-  kubectl apply -f ~/container.training/k8s/cm-clusterissuer.yaml
+  kubectl apply cm-clusterissuer.yaml
   ```
 
 ]
@@ -113,7 +115,9 @@
 
 ## Creating the Certificate
 
-- The manifest shown on the previous slide is in @@LINK[k8s/cm-certificate.yaml]
+- Download the file @@LINK[k8s/cm-certificate.yaml]
+
+  (or copy-paste from the previous slide)
 
 .exercise[
 
@@ -123,7 +127,7 @@
 
 - Create the Certificate:
   ```bash
-  kubectl apply -f ~/container.training/k8s/cm-certificate.yaml
+  kubectl apply -f cm-certificate.yaml
   ```
 
 ]
@@ -170,25 +174,14 @@
 
 ---
 
-## What's missing ?
+## And then...
 
---
-
-An Ingress Controller! 😅
-
-.exercise[
-
-- Install an Ingress Controller:
-  ```bash
-  kubectl apply -f ~/container.training/k8s/traefik-v2.yaml
-  ```
-
-- Wait a little bit, and check that we now have a `kubernetes.io/tls` Secret:
+- A little bit later, we will have a `kubernetes.io/tls` Secret:
   ```bash
   kubectl get secrets
   ```
 
-]
+- Note that this might take a few minutes, because of the DNS integration!
 
 ---
 
@@ -232,25 +225,6 @@ class: extra-details
 
 - Note: the Ingress still needs the `tls` section with `secretName` and `hosts`
 
----
-
-class: extra-details
-
-## Let's Encrypt and nip.io
-
-- Let's Encrypt has [rate limits](https://letsencrypt.org/docs/rate-limits/) per domain
-
-  (the limits only apply to the production environment, not staging)
-
-- There is a limit of 50 certificates per registered domain
-
-- If we try to use the production environment, we will probably hit the limit
-
-- It's fine to use the staging environment for these experiments
-
-  (our certs won't validate in a browser, but we can always check
-  the details of the cert to verify that it was issued by Let's Encrypt!)
-
 ???
 
 :EN:- Obtaining certificates with cert-manager

slides/k8s/gitlab.md

@@ -164,154 +164,493 @@ class: extra-details
 
 ---
 
-## Ingress
-
-- We will assume that we have a domain name pointing to our cluster
-
-  (i.e. with a wildcard record pointing to at least one node of the cluster)
-
-- We will get traffic in the cluster by leveraging `ExternalIPs` services
-
-  (but it would be easy to use `LoadBalancer` services instead)
-
-- We will use Traefik as the ingress controller
-
-  (but any other one should work too)
-
-- We will use cert-manager to obtain certificates with Let's Encrypt
-
----
-
-## Other details
+## Install GitLab itself
 
 - We will deploy GitLab with its official Helm chart
 
 - It will still require a bunch of parameters and customization
 
-- We also need a Storage Class
-
-  (unless our cluster already has one, of course)
-
-- We suggest the [Rancher local path provisioner](https://github.com/rancher/local-path-provisioner)
+- Brace!
 
 ---
 
-## Setting everything up
+## Installing the GitLab chart
 
-1. `git clone https://github.com/jpetazzo/kubecoin`
+```bash
+helm repo add gitlab https://charts.gitlab.io/
+DOMAIN=`cloudnative.party`
+ISSUER=letsencrypt-production
+helm upgrade --install gitlab gitlab/gitlab \
+    --create-namespace --namespace gitlab \
+    --set global.hosts.domain=$DOMAIN \
+    --set certmanager.install=false \
+    --set nginx-ingress.enabled=false \
+    --set global.ingress.class=traefik \
+    --set global.ingress.provider=traefik \
+    --set global.ingress.configureCertmanager=false \
+    --set global.ingress.annotations."cert-manager\.io/cluster-issuer"=$ISSUER \
+    --set gitlab.webservice.ingress.tls.secretName=gitlab-gitlab-tls \
+    --set registry.ingress.tls.secretName=gitlab-registry-tls \
+    --set minio.ingress.tls.secretName=gitlab-minio-tls
+```
 
-2. `export EMAIL=xxx@example.com DOMAIN=awesome-kube-ci.io`
-
-   (we need a real email address and a domain pointing to the cluster!)
-
-3. `. setup-gitlab-on-k8s.rc`
-
-   (this doesn't do anything, but defines a number of helper functions)
-
-4. Execute each helper function, one after another
-
-   (try `do_[TAB]` to see these functions)
+😰 Can we talk about all these parameters?
 
 ---
 
-## Local Storage
+## Breaking down all these parameters
 
-`do_1_localstorage`
+- `certmanager.install=false`
 
-Applies the YAML directly from Rancher's repository.
+  do not install cert-manager, we already have it
 
-Annotate the Storage Class so that it becomes the default one.
+- `nginx-ingress.enabled=false`
+
+  do not install the NGINX ingress controller, we already have Traefik
+
+- `global.ingress.class=traefik`, `global.ingress.provider=traefik`
+
+  these merely enable creation of Ingress resources
+
+- `global.ingress.configureCertmanager=false`
+
+  do not create a cert-manager Issuer or ClusterIssuer, we have ours
 
 ---
 
-## Traefik
+## More parameters
 
-`do_2_traefik_with_externalips`
+- `global.ingress.annotations."cert-manager\.io/cluster-issuer"=$ISSUER`
 
-Install the official Traefik Helm chart.
+  this annotation tells cert-manager to automatically issue certs
 
-Instead of a `LoadBalancer` service, use a `ClusterIP` with `ExternalIPs`.
+- `gitlab.webservice.ingress.tls.secretName=gitlab-gitlab-tls`,
+  <br/>
+  `registry.ingress.tls.secretName=gitlab-registry-tls`,
+  <br/>
+  `minio.ingress.tls.secretName=gitlab-minio-tls`
 
-Automatically infer the `ExternalIPs` from `kubectl get nodes`.
-
-Enable TLS.
+  these annotations enable TLS in the Ingress controller
 
 ---
 
-## cert-manager
+## Wait for GitLab to come up
 
-`do_3_certmanager`
+- Let's watch what's happening in the GitLab namespace:
+  ```bash
+  watch kubectl get all --namespace gitlab
+  ```
 
-Install cert-manager using their official YAML.
+- We want to wait for all the Pods to be "Running" or "Completed"
 
-Easy-peasy.
+- This will take a few minutes (10-15 minutes for me)
+
+- Don't worry if you see Pods crashing and restarting
+
+  (it happens when they are waiting on a dependency which isn't up yet)
 
 ---
 
-## Certificate issuers
+## Things that could go wrong
 
-`do_4_issuers`
+- Symptom: Pods remain "Pending" or "ContainerCreating" for a while
 
-Create a couple of `ClusterIssuer` resources for cert-manager.
+- Investigate these pods (with `kubectl describe pod ...`)
 
-(One for the staging Let's Encrypt environment, one for production.)
+- Also look at events:
+  ```bash
+    kubectl get events \
+      --field-selector=type=Warning --sort-by=metadata.creationTimestamp
+  ```
 
-Note: this requires to specify a valid `$EMAIL` address!
+- Make sure your cluster is big enough
 
-Note: if this fails, wait a bit and try again (cert-manager needs to be up).
+  (I use 3 `g6-standard-4` nodes)
 
 ---
 
-## GitLab
+## Log into GitLab
 
-`do_5_gitlab`
+- First, let's check that we can connect to GitLab (with TLS):
 
-Deploy GitLab using their official Helm chart.
+  `https://gitlab.$DOMAIN`
 
-We pass a lot of parameters to this chart:
-- the domain name to use
-- disable GitLab's own ingress and cert-manager
-- annotate the ingress resources so that cert-manager kicks in
-- bind the shell service (git over SSH) to port 222 to avoid conflict
-- use ExternalIPs for that shell service
+- It's asking us for a login and password!
 
-Note: on modest cloud instances, it can take 10 minutes for GitLab to come up.
-
-We can check the status with `kubectl get pods --namespace=gitlab`
+- The login is `root`, and the password is stored in a Secret:
+  ```bash
+    kubectl get secrets --namespace=gitlab gitlab-gitlab-initial-root-password \
+      -o jsonpath={.data.password} | base64 -d
+  ```
 
 ---
 
-## Log into GitLab and configure it
+## Configure GitLab
 
-`do_6_showlogin`
+- For simplicity, we're going to use that "root" user
 
-This will get the GitLab root password (stored in a Secret).
+  (but later, you can create multiple users, teams, etc.)
 
-Then we need to:
-- log into GitLab
-- add our SSH key (top-right user menu → settings, then SSH keys on the left)
-- create a project (using the + menu next to the search bar on top)
-- go to project configuration (on the left, settings → CI/CD)
-- add a `KUBECONFIG` file variable with the content of our `.kube/config` file
-- go to settings → access tokens to create a read-only registry token
-- add variables `REGISTRY_USER` and `REGISTRY_PASSWORD` with that token
-- push our repo (`git remote add gitlab ...` then `git push gitlab ...`)
+- First, let's add our SSH key
+
+  (top-right user menu → settings, then SSH keys on the left)
+
+- Then, create a project
+
+  (using the + menu next to the search bar on top)
+
+- Let's call it `kubecoin`
+
+  (you can change it, but you'll have to adjust Git paths later on)
 
 ---
 
-## Monitoring progress and troubleshooting
+## Try to push our repository
 
-- Click on "CI/CD" in the left bar to view pipelines
+- This is the repository that we're going to use:
 
-- If you see a permission issue mentioning `system:serviceaccount:gitlab:...`:
+  https://github.com/jpetazzo/kubecoin
 
-  *make sure you did set `KUBECONFIG` correctly!*
+- Let's clone that repository locally first:
+  ```bash
+  git clone https://github.com/jpetazzo/kubecoin
+  ```
 
-- GitLab will create namespaces named `gl-<user>-<project>`
+- Add our GitLab instance as a remote:
+  ```bash
+  git remote add gitlab git@gitlab.$DOMAIN:root/kubecoin.git
+  ```
 
-- At the end of the deployment, the web UI will be available on some unique URL
+- Try to push:
+  ```bash
+  git push -u gitlab
+  ```
 
-  (`http://<user>-<project>-<githash>-gitlab.<domain>`)
+---
+
+## Connection refused?
+
+- Normally, we get the following error:
+
+  `port 22: Connection refused`
+
+- Why? 🤔
+
+--
+
+- What does `gitlab.$DOMAIN` point to?
+
+--
+
+- Our Ingress Controller! (i.e. Traefik) 💡
+
+- Our Ingress Controller has nothing to do with port 22
+
+- So how do we solve this?
+
+---
+
+## Routing port 22
+
+- Whatever is on `gitlab.$DOMAIN` needs to have the following "routing":
+
+  - port 80 → GitLab web service
+
+  - port 443 → GitLab web service, with TLS
+
+  - port 22 → GitLab shell service
+
+- Currently, Traefik is managing `gitlab.$DOMAIN`
+
+- We are going to tell Traefik to:
+
+  - accept connections on port 22
+
+  - send them to GitLab
+
+---
+
+## TCP routing
+
+- The technique that we are going to use is specific to Traefik
+
+- Other Ingress Controllers may or may not have similar features
+
+- When they have similar features, they will be enabled very differently
+
+---
+
+## Telling Traefik to open port 22
+
+- Let's reconfigure Traefik:
+  ```bash
+    helm upgrade --install traefik traefik/traefik \
+        --create-namespace --namespace traefik \
+        --set "ports.websecure.tls.enabled=true" \
+        --set "providers.kubernetesIngress.publishedService.enabled=true" \
+        --set "ports.ssh.port=2222" \
+        --set "ports.ssh.exposedPort=22" \
+        --set "ports.ssh.expose=true" \
+        --set "ports.ssh.protocol=TCP"
+  ```
+
+- This creates a new "port" on Traefik, called "ssh", listening on port 22
+
+- Internally, Traefik listens on port 2222 (for permission reasons)
+
+- Note: Traefik docs also call these ports "entrypoints"
+
+  (these entrypoints are totally unrelated to the `ENTRYPOINT` in Dockerfiles)
+
+---
+
+## Knocking on port 22
+
+- What happens if we try to connect to that port 22 right now?
+  ```bash
+  curl gitlab.$DOMAIN:22
+  ```
+
+- We hit GitLab's web service!
+
+- We need to tell Traefik what to do with connections to that port 22
+
+- For that, we will create a "TCP route"
+
+---
+
+## Traefik TCP route
+
+The following custom resource tells Traefik to route the `ssh` port that we
+created earlier, to the `gitlab-gitlab-shell` service belonging to GitLab.
+
+```yaml
+apiVersion: traefik.containo.us/v1alpha1
+kind: IngressRouteTCP
+metadata:
+  name: gitlab-shell
+  namespace: gitlab
+spec:
+  entryPoints:
+  - ssh
+  routes:
+  - match: HostSNI(\`*`)
+    services:
+    - name: gitlab-gitlab-shell
+      port: 22
+```
+
+The `HostSNI` wildcard is the magic option to define a "default route".
+
+---
+
+## Creating the TCP route
+
+Since our manifest has backticks, we must pay attention to quoting:
+
+```bash
+kubectl apply -f- << "EOF"
+apiVersion: traefik.containo.us/v1alpha1
+kind: IngressRouteTCP
+metadata:
+  name: gitlab-shell
+  namespace: gitlab
+spec:
+  entryPoints:
+  - ssh
+  routes:
+  - match: HostSNI(\`*`)
+    services:
+    - name: gitlab-gitlab-shell
+      port: 22
+EOF
+```
+
+---
+
+## Knocking on port 22, again
+
+- Let's see what happens if we try port 22 now:
+  ```bash
+  curl gitlab.$DOMAIN:22
+  ```
+
+- This should tell us something like `Received HTTP/0.9 when not allowed`
+
+  (because we're no longer talking to an HTTP server, but to SSH!)
+
+- Try with SSH:
+  ```bash
+  ssh git@gitlab.$DOMAIN
+  ```
+
+- After accepting the key fingerprint, we should see `Welcome to GitLab, @root!`
+
+---
+
+## Pushing again
+
+- Now we can try to push our repository again:
+  ```bash
+  git push -u gitlab
+  ```
+
+- Reload the project page in GitLab
+
+- We should see our repository!
+
+---
+
+## CI/CD
+
+- Click on the CI/CD tab on the left
+ 
+  (the one with the shuttle / space rocket icon)
+
+- Our pipeline was detected...
+
+- But it failed 😕
+
+- Let's click on one of the failed jobs
+
+- This is a permission issue!
+
+---
+
+## Fixing permissions
+
+- GitLab needs to do a few of things in our cluster:
+
+  - create Pods to build our container images with BuildKit
+
+  - create Namespaces to deploy staging and production versions of our app
+
+  - create and update resources in these Namespaces
+
+- For the time being, we're going to grant broad permissions
+
+  (and we will revisit and discuss what to do later)
+
+---
+
+## Granting permissions
+
+- Let's give `cluster-admin` permissions to the GitLab ServiceAccount:
+  ```bash
+    kubectl create clusterrolebinding gitlab \
+        --clusterrole=cluster-admin --serviceaccount=gitlab:default
+  ```
+
+- Then retry the CI/CD pipeline
+
+- The build steps will now succeed; but the deploy steps will fail
+
+- We need to set the `REGISTRY_USER` and `REGISTRY_PASSWORD` variables
+
+- Let's explain what this is about!
+
+---
+
+## GitLab container registry access
+
+- A registry access token is created for the duration of the CI/CD pipeline
+
+  (it is exposed through the `$CI_JOB_TOKEN` environment variable)
+
+- This token gives access only to a specific repository in the registry
+
+- It is valid only during the execution of the CI/CD pipeline
+
+- We can (and we do!) use it to *push* images to the registry
+
+- We cannot use it to *pull* images when running in staging or production
+
+  (because Kubernetes might need to pull images *after* the token expires)
+
+- We need to create a separate read-only registry access token
+
+---
+
+## Creating the registry access token
+
+- Let's go to "Settings" (the cog wheel on the left) / "Access Tokens"
+
+- Create a token with `read_registry` permission
+
+- Save the token name and the token value
+
+- Then go to "Settings" / "CI/CD"
+
+- In the "Variables" section, add two variables:
+
+  - `REGISTRY_USER` → token name
+  - `REGISTRY_PASSWORD` → token value
+
+- Make sure that they are **not** protected!
+
+  (otherwise, they won't be available in non-default tags and branches)
+
+---
+
+## Trying again
+
+- Go back to the CI/CD pipeline view, and hit "Retry"
+
+- The deploy stage should now work correctly! 🎉
+
+---
+
+## Our CI/CD pipeline
+
+- Let's have a look at the [.gitlab-ci.yml](https://github.com/jpetazzo/kubecoin/blob/107dac5066087c52747e557babc97e57f42dd71d/.gitlab-ci.yml) file
+
+- We have multiple *stages*:
+
+  - lint (currently doesn't do much, it's mostly as an example)
+
+  - build (currently uses BuildKit)
+
+  - deploy
+
+- "Deploy" behaves differently in staging and production
+
+- Let's investigate that!
+
+---
+
+## Staging vs production
+
+- In our pipeline, "production" means "a tag or branch named `production`"
+
+  (see the `except:` and `only:` sections)
+
+- Everything else is "staging"
+
+- In "staging":
+
+  - we build and push images
+  - we create a staging Namespace and deploy a copy of the app there
+
+- In "production":
+
+  - we do not build anything
+  - we deploy (or update) a copy of the app in the production Namespace
+
+---
+
+## Namespace naming
+
+- GitLab will create Namespaces named `gl-<user>-<project>-<hash>`
+
+- At the end of the deployment, the web UI will be available at:
+
+  `http://<user>-<project>-<githash>-gitlab.<domain>`
+
+- The "production" Namespace will be `<user>-<project>`
+
+- And it will be available on its own domain as well:
+
+  `http://<project>-<githash>-gitlab.<domain>`
 
 ---
 
@@ -325,7 +664,7 @@ Then we need to:
 
 - It will do it *only* if that same git commit was pushed to staging first
 
-  (look in the pipeline configuration file to see how it's done!)
+  (because the "production" pipeline skips the build phase)
 
 ---
 
@@ -411,35 +750,15 @@ Then we need to:
 
 ---
 
-## Pros
+## Why not use GitLab's Kubernetes integration?
 
-- GitLab is an amazing, open source, all-in-one platform
+- "All-in-one" approach
 
-- Available as hosted, community, or enterprise editions
+  (deploys its own Ingress, cert-manager, Prometheus, and much more)
 
-- Rich ecosystem, very customizable
+- I wanted to show you something flexible and customizable instead
 
-- Can run on Kubernetes, or somewhere else
-
----
-
-## Cons
-
-- It can be difficult to use components separately
-
-  (e.g. use a different registry, or a different job runner)
-
-- More than one way to configure it
-
-  (it's not an opinionated platform)
-
-- Not "Kubernetes-native"
-
-  (for instance, jobs are not Kubernetes jobs)
-
-- Job latency could be improved
-
-*Note: most of these drawbacks are the flip side of the "pros" on the previous slide!*
+- But feel free to explore it now that we have shown the basics!
 
 ???
 

slides/k8s/helm-intro.md

@@ -504,8 +504,7 @@ The `readme` may or may not have (accurate) explanations for the values.
 
 - Update `my-juice-shop`:
   ```bash
-  helm upgrade my-juice-shop juice/my-juice-shop \
-       --set service.type=NodePort
+  helm upgrade my-juice-shop juice/juice-shop --set service.type=NodePort
   ```
 
 ]

slides/kadm-fullday.yml

@@ -1,60 +0,0 @@
-title: |
-  Kubernetes
-  for Admins and Ops
-
-#chat: "[Slack](https://dockercommunity.slack.com/messages/C7GKACWDV)"
-#chat: "[Gitter](https://gitter.im/jpetazzo/workshop-yyyymmdd-city)"
-chat: "In person!"
-
-gitrepo: github.com/jpetazzo/container.training
-
-slides: http://container.training/
-
-#slidenumberprefix: "#SomeHashTag — "
-
-exclude:
-- self-paced
-- static-pods-exercise
-
-content:
-- shared/title.md
-- logistics.md
-- k8s/intro.md
-- shared/about-slides.md
-- shared/chat-room-im.md
-#- shared/chat-room-slack.md
-#- shared/chat-room-zoom-meeting.md
-#- shared/chat-room-zoom-webinar.md
-- shared/toc.md
--
-  - k8s/prereqs-admin.md
-  - k8s/architecture.md
-  #- k8s/internal-apis.md
-  - k8s/deploymentslideshow.md
-  - k8s/dmuc.md
--
-  - k8s/multinode.md
-  - k8s/cni.md
-  - k8s/cni-internals.md
-  - k8s/interco.md
--
-  - k8s/apilb.md
-  #- k8s/setup-overview.md
-  #- k8s/setup-devel.md
-  #- k8s/setup-managed.md
-  #- k8s/setup-selfhosted.md
-  - k8s/cluster-upgrade.md
-  - k8s/cluster-backup.md
-  - k8s/staticpods.md
--
-  #- k8s/cloud-controller-manager.md
-  #- k8s/bootstrap.md  
-  - k8s/control-plane-auth.md
-  - k8s/podsecuritypolicy.md
-  - k8s/user-cert.md
-  - k8s/csr-api.md
-  - k8s/openid-connect.md
--
-  #- k8s/lastwords-admin.md
-  - k8s/links.md
-  - shared/thankyou.md

slides/kadm-twodays.yml

@@ -1,84 +0,0 @@
-title: |
-  Kubernetes
-  for administrators
-  and operators
-
-#chat: "[Slack](https://dockercommunity.slack.com/messages/C7GKACWDV)"
-#chat: "[Gitter](https://gitter.im/jpetazzo/workshop-yyyymmdd-city)"
-chat: "In person!"
-
-gitrepo: github.com/jpetazzo/container.training
-
-slides: http://container.training/
-
-#slidenumberprefix: "#SomeHashTag — "
-
-exclude:
-- self-paced
-
-content:
-- shared/title.md
-- logistics.md
-- k8s/intro.md
-- shared/about-slides.md
-- shared/chat-room-im.md
-#- shared/chat-room-slack.md
-#- shared/chat-room-zoom-meeting.md
-#- shared/chat-room-zoom-webinar.md
-- shared/toc.md
-# DAY 1
-- - k8s/prereqs-admin.md
-  - k8s/architecture.md
-  - k8s/internal-apis.md
-  - k8s/deploymentslideshow.md
-  - k8s/dmuc.md
-- - k8s/multinode.md
-  - k8s/cni.md
-  - k8s/cni-internals.md
-  - k8s/interco.md
-- - k8s/apilb.md
-  - k8s/setup-overview.md
-  #- k8s/setup-devel.md
-  - k8s/setup-managed.md
-  - k8s/setup-selfhosted.md
-  - k8s/cluster-upgrade.md
-  - k8s/staticpods.md
-- - k8s/cluster-backup.md
-  - k8s/cloud-controller-manager.md
-  - k8s/healthchecks.md
-  - k8s/healthchecks-more.md
-# DAY 2
-- - k8s/kubercoins.md
-  - k8s/logs-cli.md
-  - k8s/logs-centralized.md
-  - k8s/authn-authz.md
-  - k8s/user-cert.md
-  - k8s/csr-api.md
-- - k8s/openid-connect.md
-  - k8s/control-plane-auth.md
-  ###- k8s/bootstrap.md
-  - k8s/netpol.md
-  - k8s/podsecuritypolicy.md
-- - k8s/resource-limits.md
-  - k8s/metrics-server.md
-  - k8s/cluster-sizing.md
-  - k8s/horizontal-pod-autoscaler.md
-- - k8s/prometheus.md
-  - k8s/extending-api.md
-  - k8s/crd.md
-  - k8s/operators.md
-  - k8s/eck.md
-  ###- k8s/operators-design.md
-# CONCLUSION
-- - k8s/lastwords.md
-  - k8s/links.md
-  - shared/thankyou.md
-  - |
-    # (All content after this slide is bonus material)
-# EXTRA
-- - k8s/volumes.md
-  - k8s/configuration.md
-  - k8s/secrets.md
-  - k8s/statefulsets.md
-  - k8s/local-persistent-volumes.md
-  - k8s/portworx.md

slides/kube-adv.yml

@@ -1,84 +0,0 @@
-title: |
-  Advanced
-  Kubernetes
-
-chat: "[Slack](https://dockercommunity.slack.com/messages/C7GKACWDV)"
-#chat: "[Gitter](https://gitter.im/jpetazzo/workshop-yyyymmdd-city)"
-
-gitrepo: github.com/jpetazzo/container.training
-
-slides: https://container.training/
-
-#slidenumberprefix: "#SomeHashTag — "
-
-exclude:
-- self-paced
-
-content:
-- shared/title.md
-- logistics.md
-- k8s/intro.md
-- shared/about-slides.md
-#- shared/chat-room-im.md
-#- shared/chat-room-slack.md
-#- shared/chat-room-zoom-meeting.md
-#- shared/chat-room-zoom-webinar.md
-- shared/toc.md
-- #1
-  - k8s/prereqs-admin.md
-  - k8s/architecture.md
-  - k8s/internal-apis.md
-  - k8s/deploymentslideshow.md
-  - k8s/dmuc.md
-- #2
-  - k8s/multinode.md
-  - k8s/cni.md
-  - k8s/interco.md
-- #3
-  - k8s/cni-internals.md
-  - k8s/apilb.md
-  - k8s/control-plane-auth.md
-  - |
-    # (Extra content)
-  - k8s/staticpods.md
-  - k8s/cluster-upgrade.md
-- #4
-  - k8s/kustomize.md
-  - k8s/helm-intro.md
-  - k8s/helm-chart-format.md
-  - k8s/helm-create-basic-chart.md
-  - |
-    # (Extra content)
-  - k8s/helm-create-better-chart.md
-  - k8s/helm-dependencies.md
-  - k8s/helm-values-schema-validation.md
-  - k8s/helm-secrets.md
-- #5
-  - k8s/extending-api.md
-  - k8s/operators.md
-  - k8s/sealed-secrets.md
-  - k8s/crd.md
-- #6
-  - k8s/ingress-tls.md
-  - k8s/cert-manager.md
-  - k8s/eck.md
-- #7
-  - k8s/admission.md
-  - k8s/kyverno.md
-- #8
-  - k8s/aggregation-layer.md
-  - k8s/metrics-server.md
-  - k8s/prometheus.md
-  - k8s/hpa-v2.md
-- #9
-  - k8s/operators-design.md
-  - k8s/kubebuilder.md
-  - k8s/events.md
-  - k8s/finalizers.md
-  - |
-    # (Extra content)
-  - k8s/owners-and-dependents.md
-  - k8s/apiserver-deepdive.md
-  #- k8s/record.md
-  - shared/thankyou.md
-

slides/kube-fullday.yml

@@ -1,125 +0,0 @@
-title: |
-  Deploying and Scaling Microservices
-  with Kubernetes
-
-#chat: "[Slack](https://dockercommunity.slack.com/messages/C7GKACWDV)"
-#chat: "[Gitter](https://gitter.im/jpetazzo/workshop-yyyymmdd-city)"
-chat: "In person!"
-
-gitrepo: github.com/jpetazzo/container.training
-
-slides: http://container.training/
-
-#slidenumberprefix: "#SomeHashTag — "
-
-exclude:
-- self-paced
-
-content:
-- shared/title.md
-- logistics.md
-- k8s/intro.md
-- shared/about-slides.md
-- shared/chat-room-im.md
-#- shared/chat-room-slack.md
-#- shared/chat-room-zoom-meeting.md
-#- shared/chat-room-zoom-webinar.md
-- shared/toc.md
--
-  - shared/prereqs.md
-  #- shared/webssh.md
-  - shared/connecting.md
-  #- k8s/versions-k8s.md
-  - shared/sampleapp.md
-  #- shared/composescale.md
-  #- shared/hastyconclusions.md
-  - shared/composedown.md
-  - k8s/concepts-k8s.md
-  - k8s/kubectlget.md
--
-  - k8s/kubectl-run.md
-  - k8s/batch-jobs.md
-  - k8s/labels-annotations.md
-  - k8s/kubectl-logs.md
-  - k8s/logs-cli.md
-  - shared/declarative.md
-  - k8s/declarative.md
-  - k8s/deploymentslideshow.md
-  - k8s/kubenet.md
-  - k8s/kubectlexpose.md
-  - k8s/shippingimages.md
-  #- k8s/buildshiprun-selfhosted.md
-  - k8s/buildshiprun-dockerhub.md
-  - k8s/ourapponkube.md
-  #- k8s/exercise-wordsmith.md
--
-  - k8s/yamldeploy.md
-  - k8s/setup-overview.md
-  #- k8s/setup-devel.md
-  #- k8s/setup-managed.md
-  #- k8s/setup-selfhosted.md
-  #- k8s/dashboard.md
-  #- k8s/k9s.md
-  #- k8s/tilt.md
-  #- k8s/kubectlscale.md
-  - k8s/scalingdockercoins.md
-  - shared/hastyconclusions.md
-  - k8s/daemonset.md
-  #- k8s/authoring-yaml.md
-  #- k8s/exercise-yaml.md
-  #- k8s/localkubeconfig.md
-  #- k8s/access-eks-cluster.md
-  #- k8s/accessinternal.md
-  #- k8s/kubectlproxy.md
-  - k8s/rollout.md
-  #- k8s/healthchecks.md
-  #- k8s/healthchecks-more.md
-  #- k8s/record.md
--
-  - k8s/namespaces.md
-  - k8s/ingress.md
-  #- k8s/ingress-tls.md
-  #- k8s/kustomize.md
-  #- k8s/helm-intro.md
-  #- k8s/helm-chart-format.md
-  #- k8s/helm-create-basic-chart.md
-  #- k8s/helm-create-better-chart.md
-  #- k8s/helm-dependencies.md
-  #- k8s/helm-values-schema-validation.md
-  #- k8s/helm-secrets.md
-  #- k8s/exercise-helm.md
-  #- k8s/gitlab.md
-  #- k8s/create-chart.md
-  #- k8s/create-more-charts.md
-  #- k8s/netpol.md
-  #- k8s/authn-authz.md
-  #- k8s/user-cert.md
-  #- k8s/csr-api.md
-  #- k8s/openid-connect.md
-  #- k8s/podsecuritypolicy.md
-  - k8s/volumes.md
-  #- k8s/exercise-configmap.md
-  #- k8s/build-with-docker.md
-  #- k8s/build-with-kaniko.md
-  - k8s/configuration.md
-  - k8s/secrets.md
-  #- k8s/logs-centralized.md
-  #- k8s/prometheus.md
-  #- k8s/statefulsets.md
-  #- k8s/local-persistent-volumes.md
-  #- k8s/portworx.md
-  #- k8s/openebs.md
-  #- k8s/extending-api.md
-  #- k8s/crd.md
-  #- k8s/admission.md
-  #- k8s/operators.md
-  #- k8s/operators-design.md
-  #- k8s/staticpods.md
-  #- k8s/finalizers.md
-  #- k8s/owners-and-dependents.md
-  #- k8s/gitworkflows.md
--
-  - k8s/whatsnext.md
-  - k8s/lastwords.md
-  - k8s/links.md
-  - shared/thankyou.md

slides/kube-halfday.yml

@@ -1,88 +0,0 @@
-title: |
-  Kubernetes 101
-
-
-#chat: "[Slack](https://dockercommunity.slack.com/messages/C7GKACWDV)"
-#chat: "[Gitter](https://gitter.im/jpetazzo/training-20180413-paris)"
-chat: "In person!"
-
-gitrepo: github.com/jpetazzo/container.training
-
-slides: http://container.training/
-
-#slidenumberprefix: "#SomeHashTag — "
-
-exclude:
-- self-paced
-
-content:
-- shared/title.md
-#- logistics.md
-# Bridget-specific; others use logistics.md
-- logistics-bridget.md
-- k8s/intro.md
-- shared/about-slides.md
-- shared/chat-room-im.md
-#- shared/chat-room-slack.md
-#- shared/chat-room-zoom-meeting.md
-#- shared/chat-room-zoom-webinar.md
-- shared/toc.md
-- - shared/prereqs.md
-  #- shared/webssh.md
-  - shared/connecting.md
-  - k8s/versions-k8s.md
-  - shared/sampleapp.md
-# Bridget doesn't go into as much depth with compose
-  #- shared/composescale.md
-  #- shared/hastyconclusions.md
-  - shared/composedown.md
-  - k8s/concepts-k8s.md
-  - shared/declarative.md
-  - k8s/declarative.md
-  - k8s/kubenet.md
-  - k8s/kubectlget.md
-  - k8s/setup-overview.md
-  #- k8s/setup-devel.md
-  #- k8s/setup-managed.md
-  #- k8s/setup-selfhosted.md
-- - k8s/kubectl-run.md
-  #- k8s/batch-jobs.md
-  #- k8s/labels-annotations.md
-  - k8s/kubectl-logs.md
-  - k8s/deploymentslideshow.md
-  - k8s/kubectlexpose.md
-  - k8s/shippingimages.md
-  #- k8s/buildshiprun-selfhosted.md
-  - k8s/buildshiprun-dockerhub.md
-  - k8s/ourapponkube.md
-  #- k8s/localkubeconfig.md
-  #- k8s/access-eks-cluster.md
-  #- k8s/accessinternal.md
-  #- k8s/kubectlproxy.md
-- - k8s/dashboard.md
-  #- k8s/k9s.md
-  #- k8s/tilt.md
-  #- k8s/kubectlscale.md
-  - k8s/scalingdockercoins.md
-  - shared/hastyconclusions.md
-  - k8s/daemonset.md
-  - k8s/rollout.md
-  #- k8s/record.md
-- - k8s/logs-cli.md
-# Bridget hasn't added EFK yet
-  #- k8s/logs-centralized.md
-  - k8s/namespaces.md
-  - k8s/helm-intro.md
-  #- k8s/helm-chart-format.md
-  - k8s/helm-create-basic-chart.md
-  #- k8s/helm-create-better-chart.md
-  #- k8s/helm-dependencies.md
-  #- k8s/helm-values-schema-validation.md
-  #- k8s/helm-secrets.md
-  #- k8s/kustomize.md
-  #- k8s/netpol.md
-  - k8s/whatsnext.md
-#  - k8s/links.md
-# Bridget-specific
-  - k8s/links-bridget.md
-  - shared/thankyou.md

slides/kube-selfpaced.yml

@@ -1,154 +0,0 @@
-title: |
-  Deploying and Scaling Microservices
-  with Docker and Kubernetes
-
-chat: "[Slack](https://dockercommunity.slack.com/messages/C7GKACWDV)"
-#chat: "[Gitter](https://gitter.im/jpetazzo/workshop-yyyymmdd-city)"
-
-
-gitrepo: github.com/jpetazzo/container.training
-
-slides: http://container.training/
-
-#slidenumberprefix: "#SomeHashTag — "
-
-exclude:
-- in-person
-
-content:
-- shared/title.md
-#- logistics.md
-- k8s/intro.md
-- shared/about-slides.md
-#- shared/chat-room-im.md
-#- shared/chat-room-slack.md
-#- shared/chat-room-zoom-meeting.md
-#- shared/chat-room-zoom-webinar.md
-- shared/toc.md
--
-  - shared/prereqs.md
-  #- shared/webssh.md
-  - shared/connecting.md
-  - k8s/versions-k8s.md
-  - shared/sampleapp.md
-  #- shared/composescale.md
-  #- shared/hastyconclusions.md
-  - shared/composedown.md
-  - k8s/concepts-k8s.md
--
-  - k8s/kubectlget.md
-  - k8s/kubectl-run.md
-  - k8s/batch-jobs.md
-  - k8s/labels-annotations.md
-  - k8s/kubectl-logs.md
-  - k8s/logs-cli.md
-  - shared/declarative.md
-  - k8s/declarative.md
-  - k8s/deploymentslideshow.md
--
-  - k8s/kubenet.md
-  - k8s/kubectlexpose.md
-  - k8s/shippingimages.md
-  - k8s/buildshiprun-selfhosted.md
-  - k8s/buildshiprun-dockerhub.md
-  - k8s/ourapponkube.md
-  #- k8s/exercise-wordsmith.md
-  - k8s/yamldeploy.md
--
-  - k8s/setup-overview.md
-  - k8s/setup-devel.md
-  - k8s/setup-managed.md
-  - k8s/setup-selfhosted.md
-  - k8s/dashboard.md
-  - k8s/k9s.md
-  - k8s/tilt.md
-  #- k8s/kubectlscale.md
-  - k8s/scalingdockercoins.md
-  - shared/hastyconclusions.md
-  - k8s/daemonset.md
-  - k8s/authoring-yaml.md
-  #- k8s/exercise-yaml.md
--
-  - k8s/rollout.md
-  - k8s/healthchecks.md
-  - k8s/healthchecks-more.md
-  - k8s/record.md
--
-  - k8s/namespaces.md
-  - k8s/localkubeconfig.md
-  #- k8s/access-eks-cluster.md
-  - k8s/accessinternal.md
-  - k8s/kubectlproxy.md
--
-  - k8s/ingress.md
-  - k8s/ingress-tls.md
-  - k8s/cert-manager.md
-  - k8s/kustomize.md
-  - k8s/helm-intro.md
-  - k8s/helm-chart-format.md
-  - k8s/helm-create-basic-chart.md
-  - k8s/helm-create-better-chart.md
-  - k8s/helm-dependencies.md
-  - k8s/helm-values-schema-validation.md
-  - k8s/helm-secrets.md
-  #- k8s/exercise-helm.md
-  - k8s/gitlab.md
--
-  - k8s/netpol.md
-  - k8s/authn-authz.md
-  - k8s/podsecuritypolicy.md
-  - k8s/user-cert.md
-  - k8s/csr-api.md
-  - k8s/openid-connect.md
-  - k8s/control-plane-auth.md
--
-  - k8s/volumes.md
-  #- k8s/exercise-configmap.md
-  - k8s/build-with-docker.md
-  - k8s/build-with-kaniko.md
--
-  - k8s/configuration.md
-  - k8s/secrets.md
-  - k8s/statefulsets.md
-  - k8s/local-persistent-volumes.md
-  - k8s/portworx.md
-  - k8s/openebs.md
--
-  - k8s/logs-centralized.md
-  - k8s/prometheus.md
-  - k8s/resource-limits.md
-  - k8s/metrics-server.md
-  - k8s/cluster-sizing.md
-  - k8s/horizontal-pod-autoscaler.md
-  - k8s/hpa-v2.md
--
-  - k8s/extending-api.md
-  - k8s/apiserver-deepdive.md
-  - k8s/crd.md
-  - k8s/aggregation-layer.md
-  - k8s/admission.md
-  - k8s/operators.md
-  - k8s/operators-design.md
-  - k8s/kubebuilder.md
-  - k8s/sealed-secrets.md
-  - k8s/kyverno.md
-  - k8s/eck.md
-  - k8s/finalizers.md
-  - k8s/owners-and-dependents.md
-  - k8s/events.md
--
-  - k8s/dmuc.md
-  - k8s/multinode.md
-  - k8s/cni.md
-  - k8s/cni-internals.md
-  - k8s/apilb.md
-  - k8s/staticpods.md
--
-  - k8s/cluster-upgrade.md
-  - k8s/cluster-backup.md
-  - k8s/cloud-controller-manager.md
-  - k8s/gitworkflows.md
--
-  - k8s/lastwords.md
-  - k8s/links.md
-  - shared/thankyou.md

slides/kube-twodays.yml

@@ -1,124 +0,0 @@
-title: |
-  Deploying and Scaling Microservices
-  with Kubernetes
-
-#chat: "[Slack](https://dockercommunity.slack.com/messages/C7GKACWDV)"
-#chat: "[Gitter](https://gitter.im/jpetazzo/workshop-yyyymmdd-city)"
-chat: "In person!"
-
-gitrepo: github.com/jpetazzo/container.training
-
-slides: http://container.training/
-
-#slidenumberprefix: "#SomeHashTag — "
-
-exclude:
-- self-paced
-
-content:
-- shared/title.md
-- logistics.md
-- k8s/intro.md
-- shared/about-slides.md
-- shared/chat-room-im.md
-#- shared/chat-room-slack.md
-#- shared/chat-room-zoom-meeting.md
-#- shared/chat-room-zoom-webinar.md
-- shared/toc.md
--
-  - shared/prereqs.md
-  #- shared/webssh.md
-  - shared/connecting.md
-  #- k8s/versions-k8s.md
-  - shared/sampleapp.md
-  #- shared/composescale.md
-  #- shared/hastyconclusions.md
-  - shared/composedown.md
-  - k8s/concepts-k8s.md
-  - k8s/kubectlget.md
--
-  - k8s/kubectl-run.md
-  - k8s/batch-jobs.md
-  - k8s/labels-annotations.md
-  - k8s/kubectl-logs.md
-  - k8s/logs-cli.md
-  - shared/declarative.md
-  - k8s/declarative.md
-  - k8s/deploymentslideshow.md
-  - k8s/kubenet.md
-  - k8s/kubectlexpose.md
-  - k8s/shippingimages.md
-  #- k8s/buildshiprun-selfhosted.md
-  - k8s/buildshiprun-dockerhub.md
-  - k8s/ourapponkube.md
-  #- k8s/exercise-wordsmith.md
--
-  - k8s/yamldeploy.md
-  - k8s/setup-overview.md
-  - k8s/setup-devel.md
-  #- k8s/setup-managed.md
-  #- k8s/setup-selfhosted.md
-  - k8s/dashboard.md
-  - k8s/k9s.md
-  #- k8s/tilt.md
-  #- k8s/kubectlscale.md
-  - k8s/scalingdockercoins.md
-  - shared/hastyconclusions.md
-  - k8s/daemonset.md
-  - k8s/authoring-yaml.md
-  #- k8s/exercise-yaml.md
--
-  - k8s/localkubeconfig.md
-  #- k8s/access-eks-cluster.md
-  - k8s/accessinternal.md
-  #- k8s/kubectlproxy.md
-  - k8s/rollout.md
-  - k8s/healthchecks.md
-  #- k8s/healthchecks-more.md
-  - k8s/record.md
--
-  - k8s/namespaces.md
-  - k8s/ingress.md
-  #- k8s/ingress-tls.md
-  - k8s/kustomize.md
-  - k8s/helm-intro.md
-  - k8s/helm-chart-format.md
-  - k8s/helm-create-basic-chart.md
-  - k8s/helm-create-better-chart.md
-  - k8s/helm-dependencies.md
-  - k8s/helm-values-schema-validation.md
-  - k8s/helm-secrets.md
-  #- k8s/exercise-helm.md
-  - k8s/gitlab.md
--
-  - k8s/netpol.md
-  - k8s/authn-authz.md
-  #- k8s/csr-api.md
-  #- k8s/openid-connect.md
-  #- k8s/podsecuritypolicy.md
--
-  - k8s/volumes.md
-  #- k8s/exercise-configmap.md
-  #- k8s/build-with-docker.md
-  #- k8s/build-with-kaniko.md
-  - k8s/configuration.md
-  - k8s/secrets.md
-  - k8s/logs-centralized.md
-  - k8s/prometheus.md
--
-  - k8s/statefulsets.md
-  - k8s/local-persistent-volumes.md
-  - k8s/portworx.md
-  #- k8s/openebs.md
-  #- k8s/extending-api.md
-  #- k8s/admission.md
-  #- k8s/operators.md
-  #- k8s/operators-design.md
-  #- k8s/staticpods.md
-  #- k8s/owners-and-dependents.md
-  #- k8s/gitworkflows.md
--
-  - k8s/whatsnext.md
-  - k8s/lastwords.md
-  - k8s/links.md
-  - shared/thankyou.md

slides/lke.yml

@@ -0,0 +1,57 @@
+title: |
+  Cloud Native
+  Continuous Deployment
+  with GitLab, Helm, and
+  Linode Kubernetes Engine
+
+#chat: "[Slack](https://dockercommunity.slack.com/messages/C7GKACWDV)"
+#chat: "[Gitter](https://gitter.im/jpetazzo/workshop-yyyymmdd-city)"
+chat: "In person!"
+
+gitrepo: github.com/jpetazzo/container.training
+
+slides: https://2021-03-lke.container.training/
+
+#slidenumberprefix: "#SomeHashTag — "
+
+exclude:
+- self-paced
+
+content:
+- shared/title.md
+- logistics.md
+- shared/about-slides.md
+#- shared/chat-room-im.md
+#- shared/chat-room-zoom-meeting.md
+#- shared/chat-room-zoom-webinar.md
+- shared/toc.md
+-
+  - lke/intro.md
+  - shared/sampleapp.md
+  - shared/composedown.md
+  - lke/deploy-cluster.md
+  - lke/kubernetes-review.md
+  - k8s/deploymentslideshow.md
+  - k8s/accessinternal.md
+  - lke/what-is-missing.md
+-
+  - k8s/helm-intro.md
+  - lke/external-dns.md
+  - lke/traefik.md
+  - lke/metrics-server.md
+  #- k8s/prometheus.md
+  - lke/prometheus.md
+  - k8s/cert-manager.md
+  - k8s/gitlab.md
+  #- k8s/helm-chart-format.md
+  #- k8s/helm-create-basic-chart.md
+  #- k8s/helm-create-better-chart.md
+  #- k8s/helm-dependencies.md
+  #- k8s/helm-values-schema-validation.md
+  #- k8s/helm-secrets.md
+  #- k8s/exercise-helm.md
+-
+  - shared/thankyou.md
+
+
+#grep md$ lke.yml | grep -v '#' | cut -d- -f2- | xargs subl3 

slides/lke/deploy-cluster.md

@@ -0,0 +1,163 @@
+# Deploying our LKE cluster
+
+- *If we wanted to deploy Kubernetes manually*, what would we need to do?
+
+  (not that I recommend doing that...)
+
+- Control plane (etcd, API server, scheduler, controllers)
+
+- Nodes (VMs with a container engine + the Kubelet agent; CNI setup)
+
+- High availability (etcd clustering, API load balancer)
+
+- Security (CA and TLS certificates everywhere)
+
+- Cloud integration (to provision LoadBalancer services, storage...)
+
+*And that's just to get a basic cluster!*
+
+---
+
+## The best way to deploy Kubernetes
+
+*The best way to deploy Kubernetes is to get someone else to
+do it for us.*
+
+(Me, ever since I've been working with Kubernetes)
+
+---
+
+## Managed Kubernetes
+
+- Cloud provider runs the control plane
+
+  (including etcd, API load balancer, TLS setup, cloud integration)
+
+- We run nodes
+
+  (the cloud provider generally gives us an easy way to provision them)
+
+- Get started in *minutes*
+
+- We're going to use [Linode Kubernetes Engine](https://www.linode.com/products/kubernetes/)
+
+---
+
+## Creating a cluster
+
+- With the web console:
+
+  https://cloud.linode.com/kubernetes/clusters
+
+- Pick the region of your choice
+
+- Pick the latest available Kubernetes version
+
+- Pick 3 nodes with 8 GB of RAM
+
+- Click! ✨
+
+- Wait a few minutes... ⌚️
+
+- Download the kubeconfig file 💾
+
+---
+
+## With the CLI
+
+- View available regions with `linode-cli regions list`
+
+- View available server types with `linode-cli linodes types`
+
+- View available Kubernetes versions with `linode-cli lke versions-list`
+
+- Create cluster:
+  ```bash
+    linode-cli lke cluster-create --label=hello-lke --region=us-east \
+      --k8s_version=1.20 --node_pools.type=g6-standard-4 --node_pools.count=3 
+  ```
+
+- Note the cluster ID (e.g.: 12345)
+
+- Download the kubeconfig file:
+  ```bash
+  linode-cli lke kubeconfig-view `12345` --text --no-headers | base64 -d
+  ```
+
+---
+
+## Communicating with the cluster
+
+- All the Kubernetes tools (`kubectl`, but also `helm` etc) use the same config file
+
+- That file is (by default) `$HOME/.kube/config`
+
+- It can hold multiple cluster definitions (or *contexts*)
+
+- Or, we can have multiple config files and switch between them:
+
+  - by adding the `--kubeconfig` flag each time we invoke a tool (🙄)
+
+  - or by setting the `KUBECONFIG` environment variable (☺️)
+
+---
+
+## Using the kubeconfig file
+
+Option 1:
+
+- move the kubeconfig file to e.g. `~/.kube/config.lke`
+
+- set the environment variable: `export KUBECONFIG=~/.kube/config.lke`
+
+Option 2:
+
+- directly move the kubeconfig file to `~/.kube/config`
+
+- **do not** do that if you already have a file there!
+
+Option 3:
+
+- merge the new kubeconfig file with our existing file
+
+---
+
+## Merging kubeconfig
+
+- Assuming that we want to merge `~/.kube/config` and `~/.kube/config.lke` ...
+
+- Move our existing kubeconfig file:
+  ```bash
+  cp ~/.kube/config ~/.kube/config.old
+  ```
+
+- Merge both files:
+  ```bash
+  KUBECONFIG=~/.kube/config.old:~/.kube/config.lke kubectl config \
+      view --raw > ~/.kube/config
+  ```
+
+- Check that everything is there:
+  ```bash
+  kubectl config get-contexts
+  ```
+
+---
+
+## Are we there yet?
+
+- Let's check if our control plane is available:
+  ```bash
+  kubectl get services
+  ```
+
+  → This should show the `kubernetes` `ClusterIP` service
+
+- Look for our nodes:
+  ```bash
+  kubectl get nodes
+  ```
+
+  → This should show 3 nodes (or whatever amount we picked earlier)
+
+- If the nodes aren't visible yet, give them a minute to join the cluster

slides/lke/external-dns.md

@@ -0,0 +1,108 @@
+# [ExternalDNS](https://github.com/kubernetes-sigs/external-dns)
+
+- ExternalDNS will automatically create DNS records from Kubernetes resources
+
+  - Services (with the annotation `external-dns.alpha.kubernetes.io/hostname`)
+
+  - Ingresses (automatically)
+
+- It requires a domain name (obviously)
+
+- ... And that domain name should be configurable through an API
+
+- As of April 2021, it supports [a few dozens of providers](https://github.com/kubernetes-sigs/external-dns#status-of-providers)
+
+- We're going to use Linode DNS
+
+---
+
+## Prep work
+
+- We need a domain name
+
+  (if you need a cheap one, look e.g. at [GANDI](https://shop.gandi.net/?search=funwithlinode); there are many options below $10)
+
+- That domain name should be configured to point to Linode DNS servers
+
+  (ns1.linode.com to ns5.linode.com)
+
+- We need to generate a Linode API token with DNS API access
+
+- Pro-tip: reduce the default TTL of the domain to 5 minutes!
+
+---
+
+## Deploying ExternalDNS
+
+- The ExternalDNS documentation has a [tutorial](https://github.com/kubernetes-sigs/external-dns/blob/master/docs/tutorials/linode.md) for Linode
+
+- ... It's basically a lot of YAML!
+
+- That's where using a Helm chart will be very helpful
+
+- There are a few ExternalDNS charts available out there
+
+- We will use the one from Bitnami
+
+  (these folks maintain *a lot* of great Helm charts!)
+
+---
+
+## How we'll install things with Helm
+
+- We will install each chart in its own namespace
+
+  (this is not mandatory, but it helps to see what belongs to what)
+
+- We will use `helm upgrade --install` instead of `helm install`
+
+  (that way, if we want to change something, we can just re-run the command)
+
+- We will use the `--create-namespace` and `--namespace ...` options
+
+- To keep things boring and predictible, if we are installing chart `xyz`:
+
+  - we will install it in namespace `xyz`
+
+  - we will name the release `xyz` as well
+
+---
+
+## Installing ExternalDNS
+
+- First, let's add the Bitnami repo:
+  ```bash
+  helm repo add bitnami https://charts.bitnami.com/bitnami
+  ```
+
+- Then, install ExternalDNS:
+  ```bash
+    LINODE_API_TOKEN=`1234abcd...6789`
+    helm upgrade --install external-dns bitnami/external-dns \
+      --namespace external-dns --create-namespace \
+      --set provider=linode \
+      --set linode.apiToken=$LINODE_API_TOKEN
+  ```
+
+  (Make sure to update your API token above!)
+
+---
+
+## Testing ExternalDNS
+
+- Let's annotate our NGINX service to expose it with a DNS record:
+  ```bash
+    kubectl annotate service web \
+      external-dns.alpha.kubernetes.io/hostname=nginx.`cloudnative.party`
+  ```
+
+  (make sure to use *your* domain name above, otherwise that won't work!)
+
+- Check ExternalDNS logs:
+  ```bash
+    kubectl logs -n external-dns -l app.kubernetes.io/name=external-dns
+  ```
+
+- It might take a few minutes for ExternalDNS to start, patience!
+
+- Then try to access `nginx.cloudnative.party` (or whatever domain you picked)

slides/lke/intro.md

@@ -0,0 +1,175 @@
+# Get ready!
+
+- We're going to set up a whole Continous Deployment pipeline
+
+- ... for Kubernetes apps
+
+- ... on a Kubernetes cluster
+
+- Ingredients: cert-manager, GitLab, Helm, Linode DNS, LKE, Traefik
+
+---
+
+## Philosophy
+
+- "Do one thing, do it well"
+
+--
+
+- ... But a CD pipeline is a complex system with interconnected parts!
+
+- GitLab is no exception to that rule
+
+- Let's have a look at its components!
+
+---
+
+## GitLab components
+
+- GitLab dependencies listed in the GitLab official Helm chart
+
+- External dependencies:
+
+  cert-manager, grafana, minio, nginx-ingress, postgresql, prometheus,
+  redis, registry, shared-secrets
+
+  (these dependencies correspond to external charts not created by GitLab)
+
+- Internal dependencies:
+
+  geo-logcursor, gitaly, gitlab-exporter, gitlab-grafana, gitlab-pages,
+  gitlab-shell, kas, mailroom, migrations, operator, praefect, sidekiq,
+  task-runner, webservice
+
+  (these dependencies correspond to subcharts embedded in the GitLab chart)
+
+---
+
+## Philosophy
+
+- Use the GitLab chart to deploy everything that is specific to GitLab
+
+- Deploy cluster-wide components separately
+
+  (cert-manager, ExternalDNS, Ingress Controller...)
+
+---
+
+## What we're going to do
+
+- Spin up an LKE cluster
+
+- Run a simple test app
+
+- Install a few extras
+
+  (the cluster-wide components mentioned earlier)
+
+- Set up GitLab
+
+- Push an app with a CD pipeline to GitLab
+
+---
+
+## What you need to know
+
+- If you just want to follow along and watch...
+
+  - container basics (what's an image, what's a container...)
+
+  - Kubernetes basics (what are Deployments, Namespaces, Pods, Services)
+
+- If you want to run this on your own Kubernetes cluster...
+
+  - intermediate Kubernetes concepts (annotations, Ingresses)
+
+  - Helm basic concepts (how to install/upgrade releases; how to set "values")
+
+  - basic Kubernetes troubleshooting commands (view logs, events)
+
+- There will be a lot of explanations and reminders along the way
+
+---
+
+## What you need to have
+
+If you want to run this on your own...
+
+- A Linode account
+
+- A domain name that you will point to Linode DNS
+
+  (I got cloudnative.party for $5)
+
+- Local tools to control your Kubernetes cluster:
+
+  - [kubectl](https://kubernetes.io/docs/tasks/tools/#kubectl)
+
+  - [helm](https://helm.sh/docs/intro/install/)
+
+- Patience, as many operations will require us to wait a few minutes!
+
+---
+
+## Do I really need a Linode account?
+
+- *Can I use a local cluster, e.g. with Minikube?*
+
+  It will be very difficult to get valid TLS certs with a local cluster.
+
+  Also, GitLab needs quite a bit of resources.
+
+- *Can I use another Kubernetes provider?*
+
+  You certainly can: Kubernetes is a standard platform!
+
+  But you'll have to adjust a few things.
+
+  (I'll try my best to tell you what as we go along.)
+
+---
+
+## Why do I need a domain name?
+
+- Because accessing gitlab.cloudnative.party is easier than 102.34.55.67
+
+- Because we'll need TLS certificates
+
+  (and it's very easy to obtain certs with Let's Encrypt when we have a domain)
+
+- We'll illustrate automatic DNS configuration with ExternalDNS, too!
+
+  (Kubernetes will automatically create DNS entries in our domain)
+
+---
+
+## Nice-to-haves
+
+Here are a few tools that I like...
+
+- [linode-cli](https://github.com/linode/linode-cli#installation)
+  to manage Linode resources from the command line
+
+- [stern](https://github.com/stern/stern)
+  to comfortably view logs of Kubernetes pods
+
+- [k9s](https://k9scli.io/topics/install/)
+  to manage Kubernetes resources with that retro BBS look and feel 😎
+
+- [kube-ps1](https://github.com/jonmosco/kube-ps1)
+  to keep track of which Kubernetes cluster and namespace we're working on
+
+- [kubectx](https://github.com/ahmetb/kubectx)
+  to easily switch between clusters, contexts, and namespaces
+
+---
+
+## Warning ⚠️💸
+
+- We're going to spin up cloud resources
+
+- Remember to shut them down when you're down!
+
+- In the immortal words of Cloud Economist [Corey Quinn](https://twitter.com/QuinnyPig):
+
+  *[You're charged for what you forget to turn off.](https://www.theregister.com/2020/09/03/cloud_control_costs/)*

slides/lke/kubernetes-review.md

@@ -0,0 +1,168 @@
+# Quick Kubernetes review
+
+- Let's deploy a simple HTTP server
+
+- And expose it to the outside world!
+
+- Feel free to skip this section if you're familiar with Kubernetes
+
+---
+
+## Creating a container
+
+- On Kubernetes, one doesn't simply run a container
+
+- We need to create a "Pod"
+
+- A Pod will be a group of containers running together
+
+  (often, it will be a group of *one* container)
+
+- We can create a standalone Pod, but generally, we'll use a *controller*
+
+  (for instance: Deployment, Replica Set, Daemon Set, Job, Stateful Set...)
+
+- The *controller* will take care of scaling and recreating the Pod if needed
+
+  (note that within a Pod, containers can also be restarted automatically if needed)
+
+---
+
+## A *controller*, you said?
+
+- We're going to use one of the most common controllers: a *Deployment*
+
+- Deployments...
+
+  - can be scaled (will create the requested number of Pods)
+
+  - will recreate Pods if e.g. they get evicted or their Node is down
+
+  - handle rolling updates
+
+- Deployments actually delegate a lot of these tasks to *Replica Sets*
+
+- We will generally have the following hierarchy:
+ 
+  Deployment → Replica Set → Pod
+
+---
+
+## Creating a Deployment
+
+- Without further ado:
+  ```bash
+  kubectl create deployment web --image=nginx
+  ```
+
+- Check what happened:
+  ```bash
+  kubectl get all
+  ```
+
+- Wait until the NGINX Pod is "Running"!
+
+- Note: `kubectl create deployment` is great when getting started...
+
+- ... But later, we will probably write YAML instead!
+
+---
+
+## Exposing the Deployment
+
+- We need to create a Service
+
+- We can use `kubectl expose` for that
+
+  (but, again, we will probably use YAML later!)
+
+- For *internal* use, we can use the default Service type, ClusterIP:
+  ```bash
+  kubectl expose deployment web --port=80
+  ```
+
+- For *external* use, we can use a Service of type LoadBalancer:
+  ```bash
+  kubectl expose deployment web --port=80 --type=LoadBalancer
+  ```
+
+---
+
+## Changing the Service type
+
+- We can `kubectl delete service web` and recreate it
+
+- Or, `kubectl edit service web` and dive into the YAML
+
+- Or, `kubectl patch service web --patch '{"spec": {"type": "LoadBalancer"}}'`
+
+- ... These are just a few "classic" methods; there are many ways to do this!
+
+---
+
+## Deployment → Pod
+
+- Can we check exactly what's going on when the Pod is created?
+
+- Option 1: `watch kubectl get all`
+
+  - displays all object types
+  - refreshes every 2 seconds
+  - puts a high load on the API server when there are many objects
+
+- Option 2: `kubectl get pods --watch --output-watch-events`
+
+  - can only display one type of object
+  - will show all modifications happening (à la `tail -f`)
+  - doesn't put a high load on the API server (except for initial display)
+
+---
+
+## Recreating the Deployment
+
+- Let's delete our Deployment:
+  ```bash
+  kubectl delete deployment web
+  ```
+
+- Watch Pod updates:
+  ```bash
+  kubectl get pods --watch --output-watch-events
+  ```
+
+- Recreate the Deployment and see what Pods do:
+  ```bash
+  kubectl create deployment web --image=nginx
+  ```
+
+---
+
+## Service stability
+
+- Our Service *still works* even though we deleted and re-created the Deployment
+
+- It wouldn't have worked while the Deployment was deleted, though
+
+- A Service is a *stable endpoint*
+
+???
+
+:T: Warming up with a quick Kubernetes review
+
+:Q: In Kubernetes, what is a Pod?
+:A: ✔️A basic unit of scaling that can contain one or more containers
+:A: An abstraction for an application and its dependencies
+:A: It's just a fancy name for "container" but they're the same
+:A: A group of cluster nodes used for scheduling purposes
+
+:Q: In Kubernetes, what is a Replica Set?
+:A: ✔️A controller used to create one or multiple identical Pods
+:A: A numeric parameter in a Pod specification, used to scale that Pod
+:A: A group of containers running on the same node
+:A: A group of containers running on different nodes
+
+:Q: In Kubernetes, what is a Deployment?
+:A: ✔️A controller that can manage Replica Sets corresponding to different configurations
+:A: A manifest telling Kubernetes how to deploy an app and its dependencies
+:A: A list of instructions executed in a container to configure that container
+:A: A basic unit of work for the Kubernetes scheduler

slides/lke/metrics-server.md

@@ -0,0 +1,147 @@
+# Installing metrics-server
+
+- We've installed a few things on our cluster so far
+
+- How much resources (CPU, RAM) are we using?
+
+- We need metrics!
+
+- If metrics-server is installed, we can get Nodes metrics like this:
+  ```bash
+  kubectl top nodes
+  ```
+
+- At the moment, this should show us `error: Metrics API not available`
+
+- How do we fix this?
+
+---
+
+## Many ways to get metrics
+
+- We could use a SAAS like Datadog, New Relic...
+
+- We could use a self-hosted solution like Prometheus
+
+- Or we could use metrics-server
+
+- What's special about metrics-server?
+
+---
+
+## Pros/cons
+
+Cons:
+
+- no data retention (no history data, just instant numbers)
+
+- only CPU and RAM of nodes and pods (no disk or network usage or I/O...)
+
+Pros:
+
+- very lightweight
+
+- doesn't require storage
+
+- used by Kubernetes autoscaling
+
+---
+
+## Why metrics-server
+
+- We may install something fancier later
+
+  (think: Prometheus with Grafana)
+
+- But metrics-server will work in *minutes*
+
+- It will barely use resources on our cluster
+
+- It's required for autoscaling anyway
+
+---
+
+## How metric-server works
+
+- It runs a single Pod
+
+- That Pod will fetch metrics from all our Nodes
+
+- It will expose them through the Kubernetes API agregation layer
+
+  (we won't say much more about that agregation layer; that's fairly advanced stuff!)
+
+---
+
+## Installing metrics-server
+
+- In a lot of places, this is done with a little bit of custom YAML
+
+  (derived from the [official installation instructions](https://github.com/kubernetes-sigs/metrics-server#installation))
+
+- We're going to use Helm one more time:
+  ```bash
+    helm upgrade --install metrics-server bitnami/metrics-server \
+      --create-namespace --namespace metrics-server \
+      --set apiService.create=true \
+      --set extraArgs.kubelet-insecure-tls=true \
+      --set extraArgs.kubelet-preferred-address-types=InternalIP
+  ```
+
+- What are these options for?
+
+---
+
+## Installation options
+
+- `apiService.create=true`
+
+  register `metrics-server` with the Kubernetes agregation layer
+
+  (create an entry that will show up in `kubectl get apiservices`)
+
+- `extraArgs.kubelet-insecure-tls=true`
+
+  when connecting to nodes to collect their metrics, don't check kubelet TLS certs
+
+  (because most kubelet certs include the node name, but not its IP address)
+
+- `extraArgs.kubelet-preferred-address-types=InternalIP`
+
+  when connecting to nodes, use their internal IP address instead of node name
+
+  (because the latter requires an internal DNS, which is rarely configured)
+
+---
+
+## Testing metrics-server
+
+- After a minute or two, metrics-server should be up
+
+- We should now be able to check Nodes resource usage:
+  ```bash
+  kubectl top nodes
+  ```
+
+- And Pods resource usage, too:
+  ```bash
+  kubectl top pods --all-namespaces
+  ```
+
+---
+
+## Keep some padding
+
+- The RAM usage that we see should correspond more or less to the Resident Set Size
+
+- Our pods also need some extra space for buffers, caches...
+
+- Do not aim for 100% memory usage!
+
+- Some more realistic targets:
+
+  50% (for workloads with disk I/O and leveraging caching)
+
+  90% (on very big nodes with mostly CPU-bound workloads)
+
+  75% (anywhere in between!)

slides/lke/prometheus.md

@@ -0,0 +1,120 @@
+# Prometheus and Grafana
+
+- What if we want metrics retention, view graphs, trends?
+
+- A very popular combo is Prometheus+Grafana:
+
+  - Prometheus as the "metrics engine"
+
+  - Grafana to display comprehensive dashboards
+
+- Prometheus also has an alert-manager component to trigger alerts
+
+  (we won't talk about that one)
+
+---
+
+## Installing Prometheus and Grafana
+
+- A complete metrics stack needs at least:
+
+  - the Prometheus server (collects metrics and stores them efficiently)
+
+  - a collection of *exporters* (exposing metrics to Prometheus)
+
+  - Grafana
+
+  - a collection of Grafana dashboards (building them from scratch is tedious)
+
+- The Helm chart `kube-prometheus-stack` combines all these elements
+
+- ... So we're going to use it to deploy our metrics stack!
+
+---
+
+## Installing `kube-prometheus-stack`
+
+- Let's install that stack *directly* from its repo
+
+  (without doing `helm repo add` first)
+
+- Otherwise, keep the same naming strategy:
+  ```bash
+    helm upgrade --install kube-prometheus-stack kube-prometheus-stack \
+      --namespace kube-prometheus-stack --create-namespace \
+      --repo https://prometheus-community.github.io/helm-charts 
+  ```
+
+- This will take a minute...
+
+- Then check what was installed:
+  ```bash
+  kubectl get all --namespace kube-prometheus-stack
+  ```
+
+---
+
+## Exposing Grafana
+
+- Let's create an Ingress for Grafana
+  ```bash
+    kubectl create ingress --namespace kube-prometheus-stack grafana \
+      --rule=grafana.`cloudnative.party`/*=kube-prometheus-stack-grafana:80
+  ```
+
+  (as usual, make sure to use *your* domain name above)
+
+- Connect to Grafana
+
+  (remember that the DNS record might take a few minutes to come up)
+
+---
+
+## Grafana credentials
+
+- What could the login and password be?
+
+- Let's look at the Secrets available in the namespace:
+  ```bash
+  kubectl get secrets --namespace kube-prometheus-stack
+  ```
+
+- There is a `kube-prometheus-stack-grafana` that looks promising!
+
+- Decode the Secret:
+  ```bash
+    kubectl get secret --namespace kube-prometheus-stack \
+      kube-prometheus-stack-grafana -o json | jq '.data | map_values(@base64d)'
+  ```
+
+- If you don't have the `jq` tool mentioned above, don't worry...
+
+--
+
+- The login/password is hardcoded to `admin`/`prom-operator` 😬
+
+---
+
+## Grafana dashboards
+
+- Once logged in, click on the "Dashboards" icon on the left
+
+  (it's the one that looks like four squares)
+
+- Then click on the "Manage" entry
+
+- Then click on "Kubernetes / Compute Resources / Cluster"
+
+- This gives us a breakdown of resource usage by Namespace
+
+- Feel free to explore the other dashboards!
+
+???
+
+:T: Observing our cluster with Prometheus and Grafana
+
+:Q: What's the relationship between Prometheus and Grafana?
+:A: Prometheus collects and graphs metrics; Grafana sends alerts
+:A: ✔️Prometheus collects metrics; Grafana displays them on dashboards
+:A: Prometheus collects and graphs metrics; Grafana is its configuration interface
+:A: Grafana collects and graphs metrics; Prometheus sends alerts

slides/lke/traefik.md

@@ -0,0 +1,150 @@
+# Installing Traefik
+
+- Traefik is going to be our Ingress Controller
+
+- Let's install it with a Helm chart, in its own namespace
+
+- First, let's add the Traefik chart repository:
+  ```bash
+  helm repo add traefik https://helm.traefik.io/traefik
+  ```
+
+- Then, install the chart:
+  ```bash
+    helm upgrade --install traefik traefik/traefik \
+        --create-namespace --namespace traefik \
+        --set "ports.websecure.tls.enabled=true"
+  ```
+
+  (that option that we added enables HTTPS, it will be useful later!)
+
+---
+
+## Testing Traefik
+
+- Let's create an Ingress resource!
+
+- If we're using Kubernetes 1.20 or later, we can simply do this:
+  ```bash
+  kubectl create ingress web \
+      --rule=`ingress-is-fun.cloudnative.party`/*=web:80
+  ```
+
+  (make sure to update and use your own domain)
+
+- Check that the Ingress was correctly created:
+  ```bash
+  kubectl get ingress
+  kubectl describe ingress
+  ```
+
+- If we're using Kubernetes 1.19 or earlier, we'll need some YAML
+
+---
+
+## Creating an Ingress with YAML
+
+- This is how we do it with YAML:
+  ```bash
+    kubectl apply -f- <<EOF
+    apiVersion: networking.k8s.io/v1beta1
+    kind: Ingress
+    metadata:
+      name: web
+    spec:
+      rules:
+      - host: `ingress-is-fun.cloudnative.party`
+        http:
+          paths:
+          - path: /
+            backend:
+              serviceName: web
+              servicePort: 80
+    EOF
+  ```
+
+---
+
+## Ingress versions...
+
+- Note how we used the `v1beta1` Ingress version on the previous YAML
+
+  (to be compatible with older Kubernetes versions)
+
+- This YAML will give you deprecation warnings on recent version of Kubernetes
+
+  (since the Ingress spec is now at version `v1`)
+
+- Don't worry too much about the deprecation warnings
+
+  (on Kubernetes, deprecation happens over a long time window, typically 1 year)
+
+- You will have time to revisit and worry later! 😅
+
+---
+
+## Does it work?
+
+- Try to connect to the Ingress host name
+
+  (in my example, http://ingress-is-fun.cloudnative.party/)
+
+- *Normally,* it doesn't work (yet) 🤔
+
+- Let's look at `kubectl get ingress` again
+
+- ExternalDNS is trying to create records mapping HOSTS to ADDRESS
+
+- But the ADDRESS field is currently empty!
+
+- We need to tell Traefik to fill that ADDRESS field
+
+---
+
+## Reconfiguring Traefik
+
+- There is a "magic" flag to tell Traefik to update the address status field
+
+- Let's update our Traefik install:
+  ```bash
+    helm upgrade --install traefik traefik/traefik \
+        --create-namespace --namespace traefik \
+        --set "ports.websecure.tls.enabled=true" \
+        --set "providers.kubernetesIngress.publishedService.enabled=true"
+  ```
+
+---
+
+## Checking what we did
+
+- Check the output of `kubectl get ingress`
+
+  (there should be an address now)
+
+- Check the logs of ExternalDNS
+
+  (there should be a mention of the new DNS record)
+
+- Try again to connect to the HTTP address
+
+  (now it should work)
+
+- Note that some of these operations might take a minute or two
+
+  (be patient!)
+
+???
+
+:T: Installing the Traefik Ingress Controller
+
+:Q: What's the job of an Ingress Controller?
+:A: Prevent unauthorized access to Kubernetes services
+:A: Firewall inbound traffic on the Kubernetes API
+:A: ✔️Handle inbound HTTP traffic for Kubernetes services
+:A: Keep track of the location of Kubernetes operators
+
+:Q: What happens when we create an "Ingress resource"?
+:A: A web service is automatically deployed and scaled on our cluster
+:A: Kubernetes starts tracking the location of our users
+:A: Traffic coming from the specified addresses will be allowed
+:A: ✔️A load balancer is configured with HTTP traffic rules

slides/lke/what-is-missing.md

@@ -0,0 +1,87 @@
+# DNS, Ingress, Metrics
+
+- We got a basic app up and running
+
+- We accessed it over a raw IP address
+
+- Can we do better?
+
+  (i.e. access it with a domain name!)
+
+- How much resources is it using?
+
+---
+
+## DNS
+
+- We'd like to associate a fancy name to that LoadBalancer Service
+
+  (e.g. `nginx.cloudnative.party` → `A.B.C.D`)
+
+  - option 1: manually add a DNS record
+
+  - option 2: find a way to create DNS records automatically
+
+- We will install ExternalDNS to automate DNS records creatoin
+
+- ExternalDNS supports Linode DNS and dozens of other providers
+
+---
+
+## Ingress
+
+- What if we have multiple web services to expose?
+
+- We could create one LoadBalancer Service for each of them
+
+- This would create a lot of cloud load balancers
+
+  (and they typically incur a cost, even if it's a small one)
+
+- Instead, we can use an *Ingress Controller*
+
+- Ingress Controller = HTTP load balancer / reverse proxy
+
+- Put all our HTTP services behind a single LoadBalancer Service
+
+- Can also do fancy "content-based" routing (using headers, request path...)
+
+- We will install Traefik as our Ingress Controller
+
+---
+
+## Metrics
+
+- How much resources are we using right now?
+
+- When will we need to scale up our cluster?
+
+- We need metrics!
+
+- We're going to install the *metrics server*
+
+- It's a very basic metrics system
+
+  (no retention, no graphs, no alerting...)
+
+- But it's lightweight, and it is used internally by Kubernetes for autoscaling
+
+---
+
+## What's next
+
+- We're going to install all these components
+
+- Very often, things can be installed with a simple YAML file
+
+- Very often, that YAML file needs to be customized a little bit
+
+  (add command-line parameters, provide API tokens...)
+
+- Instead, we're going to use Helm charts
+
+- Helm charts give us a way to customize what we deploy
+
+- Helm can also keep track of what we install
+
+  (for easier uninstall and updates)

slides/logistics-template.md

@@ -1,35 +1,15 @@
 ## Intros
 
-- This slide should be customized by the tutorial instructor(s).
+- Hello! I'm Jérôme Petazzoni
 
-- Hello! We are:
+  ([@jpetazzo](https://twitter.com/jpetazzo) on Twitter)
 
-   - .emoji[👩🏻‍🏫] Ann O'Nymous ([@...](https://twitter.com/...), Megacorp Inc)
+- I worked at Docker from \~2011 to 2018
 
-   - .emoji[👨🏾‍🎓] Stu Dent ([@...](https://twitter.com/...), University of Wakanda)
+- I'm now doing consulting, training, etc. on Docker & Kubernetes
 
- <!-- .dummy[
+  (check out [container.training](https://container.training/)!)
 
-   - .emoji[👷🏻‍♀️] AJ ([@s0ulshake](https://twitter.com/s0ulshake), Travis CI)
+- I'll show you how to deploy a complete CI/CD pipeline on LKE!
 
-   - .emoji[🚁] Alexandre ([@alexbuisine](https://twitter.com/alexbuisine), Enix SAS)
-
-   - .emoji[🐳] Jérôme ([@jpetazzo](https://twitter.com/jpetazzo), Enix SAS)
-
-   - .emoji[⛵] Jérémy ([@jeremygarrouste](twitter.com/jeremygarrouste), Inpiwee)
-
-   - .emoji[🎧] Romain ([@rdegez](https://twitter.com/rdegez), Enix SAS)
-
-] -->
-
-- The workshop will run from ...
-
-- There will be a lunch break at ...
-
-  (And coffee breaks!)
-
-- Feel free to interrupt for questions at any time
-
-- *Especially when you see full screen container pictures!*
-
-- Live feedback, questions, help: @@CHAT@@
+  (Linode Kubernetes Engine 😎)

slides/shared/sampleapp.md

@@ -1,8 +1,8 @@
 # Our sample application
 
-- We will clone the GitHub repository onto our `node1`
+- I'm going to run our demo app locally, with Docker
 
-- The repository also contains scripts and tools that we will use through the workshop
+  (you don't have to do that; do it if you like!)
 
 .exercise[
 
@@ -15,7 +15,7 @@ fi
 ```
 -->
 
-- Clone the repository on `node1`:
+- Clone the repository:
   ```bash
   git clone https://@@GITREPO@@
   ```
@@ -34,7 +34,7 @@ Let's start this before we look around, as downloading will take a little time..
 
 - Go to the `dockercoins` directory, in the cloned repo:
   ```bash
-  cd ~/container.training/dockercoins
+  cd container.training/dockercoins
   ```
 
 - Use Compose to build and run all containers:

slides/shared/thankyou.md

@@ -6,6 +6,6 @@ Thank you!
 
 class: title, in-person
 
-That's all, folks! <br/> Questions?
+That's all, folks! <br/> Thank you ✨
 
 ![end](images/end.jpg)

slides/swarm-fullday.yml

@@ -1,71 +0,0 @@
-title: |
-  Container Orchestration
-  with Docker and Swarm
-
-chat: "[Slack](https://dockercommunity.slack.com/messages/C7GKACWDV)"
-#chat: "[Gitter](https://gitter.im/jpetazzo/workshop-yyyymmdd-city)"
-
-gitrepo: github.com/jpetazzo/container.training
-
-slides: http://container.training/
-
-#slidenumberprefix: "#SomeHashTag — "
-
-exclude:
-- self-paced
-- snap
-- btp-auto
-- benchmarking
-- elk-manual
-- prom-manual
-
-content:
-- shared/title.md
-- logistics.md
-- swarm/intro.md
-- shared/about-slides.md
-- shared/chat-room-im.md
-#- shared/chat-room-slack.md
-#- shared/chat-room-zoom-meeting.md
-#- shared/chat-room-zoom-webinar.md
-- shared/toc.md
-- - shared/prereqs.md
-  - shared/connecting.md
-  - swarm/versions.md
-  - shared/sampleapp.md
-  - shared/composescale.md
-  - shared/hastyconclusions.md
-  - shared/composedown.md
-  - swarm/swarmkit.md
-  - shared/declarative.md
-  - swarm/swarmmode.md
-  - swarm/creatingswarm.md
-  #- swarm/machine.md
-  - swarm/morenodes.md
-- - swarm/firstservice.md
-  - swarm/ourapponswarm.md
-  - swarm/hostingregistry.md
-  - swarm/testingregistry.md
-  - swarm/btp-manual.md
-  - swarm/swarmready.md
-  - swarm/stacks.md
-  - swarm/cicd.md
-  - swarm/updatingservices.md
-  - swarm/rollingupdates.md
-  - swarm/healthchecks.md
-- - swarm/operatingswarm.md
-  - swarm/netshoot.md
-  - swarm/ipsec.md
-  - swarm/swarmtools.md
-  - swarm/security.md
-  - swarm/secrets.md
-  - swarm/encryptionatrest.md
-  - swarm/leastprivilege.md
-  - swarm/apiscope.md
-- - swarm/logging.md
-  - swarm/metrics.md
-  - swarm/gui.md
-  - swarm/stateful.md
-  - swarm/extratips.md
-  - shared/thankyou.md
-  - swarm/links.md

slides/swarm-halfday.yml

@@ -1,70 +0,0 @@
-title: |
-  Container Orchestration
-  with Docker and Swarm
-
-chat: "[Slack](https://dockercommunity.slack.com/messages/C7GKACWDV)"
-#chat: "[Gitter](https://gitter.im/jpetazzo/workshop-yyyymmdd-city)"
-
-gitrepo: github.com/jpetazzo/container.training
-
-slides: http://container.training/
-
-#slidenumberprefix: "#SomeHashTag — "
-
-exclude:
-- self-paced
-- snap
-- btp-manual
-- benchmarking
-- elk-manual
-- prom-manual
-
-content:
-- shared/title.md
-- logistics.md
-- swarm/intro.md
-- shared/about-slides.md
-- shared/chat-room-im.md
-#- shared/chat-room-slack.md
-#- shared/chat-room-zoom-meeting.md
-#- shared/chat-room-zoom-webinar.md
-- shared/toc.md
-- - shared/prereqs.md
-  - shared/connecting.md
-  - swarm/versions.md
-  - shared/sampleapp.md
-  - shared/composescale.md
-  - shared/hastyconclusions.md
-  - shared/composedown.md
-  - swarm/swarmkit.md
-  - shared/declarative.md
-  - swarm/swarmmode.md
-  - swarm/creatingswarm.md
-  #- swarm/machine.md
-  - swarm/morenodes.md
-- - swarm/firstservice.md
-  - swarm/ourapponswarm.md
-  #- swarm/hostingregistry.md
-  #- swarm/testingregistry.md
-  #- swarm/btp-manual.md
-  #- swarm/swarmready.md
-  - swarm/stacks.md
-  - swarm/cicd.md
-  - swarm/updatingservices.md
-  #- swarm/rollingupdates.md
-  #- swarm/healthchecks.md
-- - swarm/operatingswarm.md
-  #- swarm/netshoot.md
-  #- swarm/ipsec.md
-  #- swarm/swarmtools.md
-  - swarm/security.md
-  #- swarm/secrets.md
-  #- swarm/encryptionatrest.md
-  - swarm/leastprivilege.md
-  - swarm/apiscope.md
-  - swarm/logging.md
-  - swarm/metrics.md
-  #- swarm/stateful.md
-  #- swarm/extratips.md
-  - shared/thankyou.md
-  - swarm/links.md

slides/swarm-selfpaced.yml

@@ -1,79 +0,0 @@
-title: |
-  Container Orchestration
-  with Docker and Swarm
-
-chat: "[Slack](https://dockercommunity.slack.com/messages/C7GKACWDV)"
-
-gitrepo: github.com/jpetazzo/container.training
-
-slides: http://container.training/
-
-#slidenumberprefix: "#SomeHashTag — "
-
-exclude:
-- in-person
-- btp-auto
-
-content:
-- shared/title.md
-#- shared/logistics.md
-- swarm/intro.md
-- shared/about-slides.md
-#- shared/chat-room-im.md
-#- shared/chat-room-slack.md
-#- shared/chat-room-zoom-meeting.md
-#- shared/chat-room-zoom-webinar.md
-- shared/toc.md
-- - shared/prereqs.md
-  - shared/connecting.md
-  - swarm/versions.md
-  - |
-    name: part-1
-
-    class: title, self-paced
-
-    Part 1
-  - shared/sampleapp.md
-  - shared/composescale.md
-  - shared/hastyconclusions.md
-  - shared/composedown.md
-  - swarm/swarmkit.md
-  - shared/declarative.md
-  - swarm/swarmmode.md
-  - swarm/creatingswarm.md
-  #- swarm/machine.md
-  - swarm/morenodes.md
-- - swarm/firstservice.md
-  - swarm/ourapponswarm.md
-  - swarm/hostingregistry.md
-  - swarm/testingregistry.md
-  - swarm/btp-manual.md
-  - swarm/swarmready.md
-  - swarm/stacks.md
-  - swarm/cicd.md
-  - |
-    name: part-2
-
-    class: title, self-paced
-
-    Part 2
-- - swarm/operatingswarm.md
-  - swarm/netshoot.md
-  - swarm/swarmnbt.md
-  - swarm/ipsec.md
-  - swarm/updatingservices.md
-  - swarm/rollingupdates.md
-  - swarm/healthchecks.md
-  - swarm/nodeinfo.md
-  - swarm/swarmtools.md
-- - swarm/security.md
-  - swarm/secrets.md
-  - swarm/encryptionatrest.md
-  - swarm/leastprivilege.md
-  - swarm/apiscope.md
-  - swarm/logging.md
-  - swarm/metrics.md
-  - swarm/stateful.md
-  - swarm/extratips.md
-  - shared/thankyou.md
-  - swarm/links.md

slides/swarm-video.yml

@@ -1,74 +0,0 @@
-title: |
-  Container Orchestration
-  with Docker and Swarm
-
-chat: "[Slack](https://dockercommunity.slack.com/messages/C7GKACWDV)"
-
-gitrepo: github.com/jpetazzo/container.training
-
-slides: http://container.training/
-
-#slidenumberprefix: "#SomeHashTag — "
-
-exclude:
-- in-person
-- btp-auto
-
-content:
-- shared/title.md
-#- shared/logistics.md
-- swarm/intro.md
-- shared/about-slides.md
-- shared/toc.md
-- - shared/prereqs.md
-  - shared/connecting.md
-  - swarm/versions.md
-  - |
-    name: part-1
-
-    class: title, self-paced
-
-    Part 1
-  - shared/sampleapp.md
-  - shared/composescale.md
-  - shared/hastyconclusions.md
-  - shared/composedown.md
-  - swarm/swarmkit.md
-  - shared/declarative.md
-  - swarm/swarmmode.md
-  - swarm/creatingswarm.md
-  #- swarm/machine.md
-  - swarm/morenodes.md
-- - swarm/firstservice.md
-  - swarm/ourapponswarm.md
-  - swarm/hostingregistry.md
-  - swarm/testingregistry.md
-  - swarm/btp-manual.md
-  - swarm/swarmready.md
-  - swarm/stacks.md
-  - |
-    name: part-2
-
-    class: title, self-paced
-
-    Part 2
-- - swarm/operatingswarm.md
-  #- swarm/netshoot.md
-  #- swarm/swarmnbt.md
-  - swarm/ipsec.md
-  - swarm/updatingservices.md
-  - swarm/rollingupdates.md
-  #- swarm/healthchecks.md
-  - swarm/nodeinfo.md
-  - swarm/swarmtools.md
-- - swarm/security.md
-  - swarm/secrets.md
-  - swarm/encryptionatrest.md
-  - swarm/leastprivilege.md
-  - swarm/apiscope.md
-  #- swarm/logging.md
-  #- swarm/metrics.md
-  - swarm/stateful.md
-  - swarm/extratips.md
-  - shared/thankyou.md
-  - swarm/links.md

slides/workshop.css

@@ -29,7 +29,7 @@ code {
 code.remark-code {
   font-size: 100%;
 }
-.exercise ul li code.remark-code.hljs.bash {
+.x-exercise ul li code.remark-code.hljs.bash {
   padding: 0;
 }
 
@@ -177,7 +177,7 @@ div img {
   background-repeat: no-repeat;
   background-position: left;
 }
-.exercise {
+.x-exercise {
   background-color: #eee;
   background-image: url("images/keyboard.png");
   background-size: 1.4em;
@@ -185,7 +185,7 @@ div img {
   background-position: 0.2em 0.2em;
   border: 2px dotted black;
 }
-.exercise:before {
+.x-exercise:before {
   content: "Exercise";
   margin-left: 1.8em;
 }