♻️ Public training March 2022

2026-03-02 01:10:20 +00:00 · 2022-03-27 13:05:24 +02:00
136 changed files with 2383 additions and 5974 deletions
--- a/.gitignore
+++ b/.gitignore
@@ -6,7 +6,13 @@ prepare-vms/tags
 prepare-vms/infra
 prepare-vms/www

-prepare-tf/tag-*
+prepare-tf/.terraform*
+prepare-tf/terraform.*
+prepare-tf/stage2/*.tf
+prepare-tf/stage2/kubeconfig.*
+prepare-tf/stage2/.terraform*
+prepare-tf/stage2/terraform.*
+prepare-tf/stage2/externalips.*

 slides/*.yml.html
 slides/autopilot/state.yaml
--- a/compose/frr-route-reflector/conf/zebra.conf
+++ b/compose/frr-route-reflector/conf/zebra.conf
@@ -1,3 +1,2 @@
 hostname frr
-ip nht resolve-via-default
 log stdout
--- a/compose/frr-route-reflector/docker-compose.yaml
+++ b/compose/frr-route-reflector/docker-compose.yaml
@@ -2,36 +2,30 @@ version: "3"

 services:
  bgpd:
-    image: frrouting/frr:v8.2.2
+    image: ajones17/frr:662
    volumes:
    - ./conf:/etc/frr
    - ./run:/var/run/frr
    network_mode: host
-    cap_add:
-    - NET_ADMIN
-    - SYS_ADMIN
-    entrypoint: /usr/lib/frr/bgpd -f /etc/frr/bgpd.conf --log=stdout --log-level=debug --no_kernel --no_zebra
+    entrypoint: /usr/lib/frr/bgpd -f /etc/frr/bgpd.conf --log=stdout --log-level=debug --no_kernel
    restart: always

  zebra:
-    image: frrouting/frr:v8.2.2
+    image: ajones17/frr:662
    volumes:
    - ./conf:/etc/frr
    - ./run:/var/run/frr
    network_mode: host
-    cap_add:
-    - NET_ADMIN
-    - SYS_ADMIN
    entrypoint: /usr/lib/frr/zebra -f /etc/frr/zebra.conf --log=stdout --log-level=debug
    restart: always

  vtysh:
-    image: frrouting/frr:v8.2.2
+    image: ajones17/frr:662
    volumes:
    - ./conf:/etc/frr
    - ./run:/var/run/frr
    network_mode: host
-    entrypoint: vtysh
+    entrypoint: vtysh -c "show ip bgp"

  chmod:
    image: alpine
--- a/dockercoins/Tiltfile
+++ b/dockercoins/Tiltfile
@@ -48,25 +48,20 @@ k8s_yaml('../k8s/dockercoins.yaml')
 # The following line lets Tilt run with the default kubeadm cluster-admin context.
 allow_k8s_contexts('kubernetes-admin@kubernetes')

-# Note: the whole section below (to set up ngrok tunnels) is disabled,
-# because ngrok now requires to set up an account to serve HTML
-# content. So we can still use ngrok for e.g. webhooks and "raw" APIs,
-# but not to serve web pages like the Tilt UI.
+# This will run an ngrok tunnel to expose Tilt to the outside world.
+# This is intended to be used when Tilt runs on a remote machine.
+local_resource(name='ngrok:tunnel', serve_cmd='ngrok http 10350')

-# # This will run an ngrok tunnel to expose Tilt to the outside world.
-# # This is intended to be used when Tilt runs on a remote machine.
-# local_resource(name='ngrok:tunnel', serve_cmd='ngrok http 10350')
-
-# # This will wait until the ngrok tunnel is up, and show its URL to the user.
-# # We send the output to /dev/tty so that it doesn't get intercepted by
-# # Tilt, and gets displayed to the user's terminal instead.
-# # Note: this assumes that the ngrok instance will be running on port 4040.
-# # If you have other ngrok instances running on the machine, this might not work.
-# local_resource(name='ngrok:showurl', cmd='''
-#   while sleep 1; do
-#     TUNNELS=$(curl -fsSL http://localhost:4040/api/tunnels | jq -r .tunnels[].public_url)
-#     [ "$TUNNELS" ] && break
-#   done
-#   printf "\nYou should be able to connect to the Tilt UI with the following URL(s): %s\n" "$TUNNELS" >/dev/tty
-#   '''
-# )
+# This will wait until the ngrok tunnel is up, and show its URL to the user.
+# We send the output to /dev/tty so that it doesn't get intercepted by
+# Tilt, and gets displayed to the user's terminal instead.
+# Note: this assumes that the ngrok instance will be running on port 4040.
+# If you have other ngrok instances running on the machine, this might not work.
+local_resource(name='ngrok:showurl', cmd='''
+  while sleep 1; do
+    TUNNELS=$(curl -fsSL http://localhost:4040/api/tunnels | jq -r .tunnels[].public_url)
+    [ "$TUNNELS" ] && break
+  done
+  printf "\nYou should be able to connect to the Tilt UI with the following URL(s): %s\n" "$TUNNELS" >/dev/tty
+  '''
+)
--- a/k8s/dashboard-insecure.yaml
+++ b/k8s/dashboard-insecure.yaml
@@ -17,8 +17,8 @@ metadata:
    app.kubernetes.io/instance: kubernetes-dashboard
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: kubernetes-dashboard
-    app.kubernetes.io/version: 2.7.0
-    helm.sh/chart: kubernetes-dashboard-6.0.0
+    app.kubernetes.io/version: 2.5.0
+    helm.sh/chart: kubernetes-dashboard-5.2.0
  name: kubernetes-dashboard
  namespace: kubernetes-dashboard
 ---
@@ -30,8 +30,8 @@ metadata:
    app.kubernetes.io/instance: kubernetes-dashboard
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: kubernetes-dashboard
-    app.kubernetes.io/version: 2.7.0
-    helm.sh/chart: kubernetes-dashboard-6.0.0
+    app.kubernetes.io/version: 2.5.0
+    helm.sh/chart: kubernetes-dashboard-5.2.0
  name: kubernetes-dashboard-certs
  namespace: kubernetes-dashboard
 type: Opaque
@@ -43,8 +43,8 @@ metadata:
    app.kubernetes.io/instance: kubernetes-dashboard
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: kubernetes-dashboard
-    app.kubernetes.io/version: 2.7.0
-    helm.sh/chart: kubernetes-dashboard-6.0.0
+    app.kubernetes.io/version: 2.5.0
+    helm.sh/chart: kubernetes-dashboard-5.2.0
  name: kubernetes-dashboard-csrf
  namespace: kubernetes-dashboard
 type: Opaque
@@ -56,8 +56,8 @@ metadata:
    app.kubernetes.io/instance: kubernetes-dashboard
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: kubernetes-dashboard
-    app.kubernetes.io/version: 2.7.0
-    helm.sh/chart: kubernetes-dashboard-6.0.0
+    app.kubernetes.io/version: 2.5.0
+    helm.sh/chart: kubernetes-dashboard-5.2.0
  name: kubernetes-dashboard-key-holder
  namespace: kubernetes-dashboard
 type: Opaque
@@ -71,8 +71,8 @@ metadata:
    app.kubernetes.io/instance: kubernetes-dashboard
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: kubernetes-dashboard
-    app.kubernetes.io/version: 2.7.0
-    helm.sh/chart: kubernetes-dashboard-6.0.0
+    app.kubernetes.io/version: 2.5.0
+    helm.sh/chart: kubernetes-dashboard-5.2.0
  name: kubernetes-dashboard-settings
  namespace: kubernetes-dashboard
 ---
@@ -84,8 +84,8 @@ metadata:
    app.kubernetes.io/instance: kubernetes-dashboard
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: kubernetes-dashboard
-    app.kubernetes.io/version: 2.7.0
-    helm.sh/chart: kubernetes-dashboard-6.0.0
+    app.kubernetes.io/version: 2.5.0
+    helm.sh/chart: kubernetes-dashboard-5.2.0
  name: kubernetes-dashboard-metrics
 rules:
 - apiGroups:
@@ -106,8 +106,8 @@ metadata:
    app.kubernetes.io/instance: kubernetes-dashboard
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: kubernetes-dashboard
-    app.kubernetes.io/version: 2.7.0
-    helm.sh/chart: kubernetes-dashboard-6.0.0
+    app.kubernetes.io/version: 2.5.0
+    helm.sh/chart: kubernetes-dashboard-5.2.0
  name: kubernetes-dashboard-metrics
 roleRef:
  apiGroup: rbac.authorization.k8s.io
@@ -126,8 +126,8 @@ metadata:
    app.kubernetes.io/instance: kubernetes-dashboard
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: kubernetes-dashboard
-    app.kubernetes.io/version: 2.7.0
-    helm.sh/chart: kubernetes-dashboard-6.0.0
+    app.kubernetes.io/version: 2.5.0
+    helm.sh/chart: kubernetes-dashboard-5.2.0
  name: kubernetes-dashboard
  namespace: kubernetes-dashboard
 rules:
@@ -182,8 +182,8 @@ metadata:
    app.kubernetes.io/instance: kubernetes-dashboard
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: kubernetes-dashboard
-    app.kubernetes.io/version: 2.7.0
-    helm.sh/chart: kubernetes-dashboard-6.0.0
+    app.kubernetes.io/version: 2.5.0
+    helm.sh/chart: kubernetes-dashboard-5.2.0
  name: kubernetes-dashboard
  namespace: kubernetes-dashboard
 roleRef:
@@ -204,8 +204,8 @@ metadata:
    app.kubernetes.io/instance: kubernetes-dashboard
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: kubernetes-dashboard
-    app.kubernetes.io/version: 2.7.0
-    helm.sh/chart: kubernetes-dashboard-6.0.0
+    app.kubernetes.io/version: 2.5.0
+    helm.sh/chart: kubernetes-dashboard-5.2.0
    kubernetes.io/cluster-service: "true"
  name: kubernetes-dashboard
  namespace: kubernetes-dashboard
@@ -229,8 +229,8 @@ metadata:
    app.kubernetes.io/instance: kubernetes-dashboard
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: kubernetes-dashboard
-    app.kubernetes.io/version: 2.7.0
-    helm.sh/chart: kubernetes-dashboard-6.0.0
+    app.kubernetes.io/version: 2.5.0
+    helm.sh/chart: kubernetes-dashboard-5.2.0
  name: kubernetes-dashboard
  namespace: kubernetes-dashboard
 spec:
@@ -253,8 +253,8 @@ spec:
        app.kubernetes.io/instance: kubernetes-dashboard
        app.kubernetes.io/managed-by: Helm
        app.kubernetes.io/name: kubernetes-dashboard
-        app.kubernetes.io/version: 2.7.0
-        helm.sh/chart: kubernetes-dashboard-6.0.0
+        app.kubernetes.io/version: 2.5.0
+        helm.sh/chart: kubernetes-dashboard-5.2.0
    spec:
      containers:
      - args:
@@ -262,7 +262,7 @@ spec:
        - --sidecar-host=http://127.0.0.1:8000
        - --enable-skip-login
        - --enable-insecure-login
-        image: kubernetesui/dashboard:v2.7.0
+        image: kubernetesui/dashboard:v2.5.0
        imagePullPolicy: IfNotPresent
        livenessProbe:
          httpGet:
@@ -293,7 +293,7 @@ spec:
          name: kubernetes-dashboard-certs
        - mountPath: /tmp
          name: tmp-volume
-      - image: kubernetesui/metrics-scraper:v1.0.8
+      - image: kubernetesui/metrics-scraper:v1.0.7
        imagePullPolicy: IfNotPresent
        livenessProbe:
          httpGet:
--- a/k8s/dashboard-recommended.yaml
+++ b/k8s/dashboard-recommended.yaml
@@ -17,8 +17,8 @@ metadata:
    app.kubernetes.io/instance: kubernetes-dashboard
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: kubernetes-dashboard
-    app.kubernetes.io/version: 2.7.0
-    helm.sh/chart: kubernetes-dashboard-6.0.0
+    app.kubernetes.io/version: 2.5.0
+    helm.sh/chart: kubernetes-dashboard-5.2.0
  name: kubernetes-dashboard
  namespace: kubernetes-dashboard
 ---
@@ -30,8 +30,8 @@ metadata:
    app.kubernetes.io/instance: kubernetes-dashboard
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: kubernetes-dashboard
-    app.kubernetes.io/version: 2.7.0
-    helm.sh/chart: kubernetes-dashboard-6.0.0
+    app.kubernetes.io/version: 2.5.0
+    helm.sh/chart: kubernetes-dashboard-5.2.0
  name: kubernetes-dashboard-certs
  namespace: kubernetes-dashboard
 type: Opaque
@@ -43,8 +43,8 @@ metadata:
    app.kubernetes.io/instance: kubernetes-dashboard
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: kubernetes-dashboard
-    app.kubernetes.io/version: 2.7.0
-    helm.sh/chart: kubernetes-dashboard-6.0.0
+    app.kubernetes.io/version: 2.5.0
+    helm.sh/chart: kubernetes-dashboard-5.2.0
  name: kubernetes-dashboard-csrf
  namespace: kubernetes-dashboard
 type: Opaque
@@ -56,8 +56,8 @@ metadata:
    app.kubernetes.io/instance: kubernetes-dashboard
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: kubernetes-dashboard
-    app.kubernetes.io/version: 2.7.0
-    helm.sh/chart: kubernetes-dashboard-6.0.0
+    app.kubernetes.io/version: 2.5.0
+    helm.sh/chart: kubernetes-dashboard-5.2.0
  name: kubernetes-dashboard-key-holder
  namespace: kubernetes-dashboard
 type: Opaque
@@ -71,8 +71,8 @@ metadata:
    app.kubernetes.io/instance: kubernetes-dashboard
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: kubernetes-dashboard
-    app.kubernetes.io/version: 2.7.0
-    helm.sh/chart: kubernetes-dashboard-6.0.0
+    app.kubernetes.io/version: 2.5.0
+    helm.sh/chart: kubernetes-dashboard-5.2.0
  name: kubernetes-dashboard-settings
  namespace: kubernetes-dashboard
 ---
@@ -84,8 +84,8 @@ metadata:
    app.kubernetes.io/instance: kubernetes-dashboard
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: kubernetes-dashboard
-    app.kubernetes.io/version: 2.7.0
-    helm.sh/chart: kubernetes-dashboard-6.0.0
+    app.kubernetes.io/version: 2.5.0
+    helm.sh/chart: kubernetes-dashboard-5.2.0
  name: kubernetes-dashboard-metrics
 rules:
 - apiGroups:
@@ -106,8 +106,8 @@ metadata:
    app.kubernetes.io/instance: kubernetes-dashboard
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: kubernetes-dashboard
-    app.kubernetes.io/version: 2.7.0
-    helm.sh/chart: kubernetes-dashboard-6.0.0
+    app.kubernetes.io/version: 2.5.0
+    helm.sh/chart: kubernetes-dashboard-5.2.0
  name: kubernetes-dashboard-metrics
 roleRef:
  apiGroup: rbac.authorization.k8s.io
@@ -126,8 +126,8 @@ metadata:
    app.kubernetes.io/instance: kubernetes-dashboard
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: kubernetes-dashboard
-    app.kubernetes.io/version: 2.7.0
-    helm.sh/chart: kubernetes-dashboard-6.0.0
+    app.kubernetes.io/version: 2.5.0
+    helm.sh/chart: kubernetes-dashboard-5.2.0
  name: kubernetes-dashboard
  namespace: kubernetes-dashboard
 rules:
@@ -182,8 +182,8 @@ metadata:
    app.kubernetes.io/instance: kubernetes-dashboard
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: kubernetes-dashboard
-    app.kubernetes.io/version: 2.7.0
-    helm.sh/chart: kubernetes-dashboard-6.0.0
+    app.kubernetes.io/version: 2.5.0
+    helm.sh/chart: kubernetes-dashboard-5.2.0
  name: kubernetes-dashboard
  namespace: kubernetes-dashboard
 roleRef:
@@ -204,8 +204,8 @@ metadata:
    app.kubernetes.io/instance: kubernetes-dashboard
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: kubernetes-dashboard
-    app.kubernetes.io/version: 2.7.0
-    helm.sh/chart: kubernetes-dashboard-6.0.0
+    app.kubernetes.io/version: 2.5.0
+    helm.sh/chart: kubernetes-dashboard-5.2.0
    kubernetes.io/cluster-service: "true"
  name: kubernetes-dashboard
  namespace: kubernetes-dashboard
@@ -229,8 +229,8 @@ metadata:
    app.kubernetes.io/instance: kubernetes-dashboard
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: kubernetes-dashboard
-    app.kubernetes.io/version: 2.7.0
-    helm.sh/chart: kubernetes-dashboard-6.0.0
+    app.kubernetes.io/version: 2.5.0
+    helm.sh/chart: kubernetes-dashboard-5.2.0
  name: kubernetes-dashboard
  namespace: kubernetes-dashboard
 spec:
@@ -253,15 +253,15 @@ spec:
        app.kubernetes.io/instance: kubernetes-dashboard
        app.kubernetes.io/managed-by: Helm
        app.kubernetes.io/name: kubernetes-dashboard
-        app.kubernetes.io/version: 2.7.0
-        helm.sh/chart: kubernetes-dashboard-6.0.0
+        app.kubernetes.io/version: 2.5.0
+        helm.sh/chart: kubernetes-dashboard-5.2.0
    spec:
      containers:
      - args:
        - --namespace=kubernetes-dashboard
        - --auto-generate-certificates
        - --sidecar-host=http://127.0.0.1:8000
-        image: kubernetesui/dashboard:v2.7.0
+        image: kubernetesui/dashboard:v2.5.0
        imagePullPolicy: IfNotPresent
        livenessProbe:
          httpGet:
@@ -292,7 +292,7 @@ spec:
          name: kubernetes-dashboard-certs
        - mountPath: /tmp
          name: tmp-volume
-      - image: kubernetesui/metrics-scraper:v1.0.8
+      - image: kubernetesui/metrics-scraper:v1.0.7
        imagePullPolicy: IfNotPresent
        livenessProbe:
          httpGet:
--- a/k8s/dashboard-with-token.yaml
+++ b/k8s/dashboard-with-token.yaml
@@ -17,8 +17,8 @@ metadata:
    app.kubernetes.io/instance: kubernetes-dashboard
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: kubernetes-dashboard
-    app.kubernetes.io/version: 2.7.0
-    helm.sh/chart: kubernetes-dashboard-6.0.0
+    app.kubernetes.io/version: 2.5.0
+    helm.sh/chart: kubernetes-dashboard-5.2.0
  name: kubernetes-dashboard
  namespace: kubernetes-dashboard
 ---
@@ -30,8 +30,8 @@ metadata:
    app.kubernetes.io/instance: kubernetes-dashboard
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: kubernetes-dashboard
-    app.kubernetes.io/version: 2.7.0
-    helm.sh/chart: kubernetes-dashboard-6.0.0
+    app.kubernetes.io/version: 2.5.0
+    helm.sh/chart: kubernetes-dashboard-5.2.0
  name: kubernetes-dashboard-certs
  namespace: kubernetes-dashboard
 type: Opaque
@@ -43,8 +43,8 @@ metadata:
    app.kubernetes.io/instance: kubernetes-dashboard
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: kubernetes-dashboard
-    app.kubernetes.io/version: 2.7.0
-    helm.sh/chart: kubernetes-dashboard-6.0.0
+    app.kubernetes.io/version: 2.5.0
+    helm.sh/chart: kubernetes-dashboard-5.2.0
  name: kubernetes-dashboard-csrf
  namespace: kubernetes-dashboard
 type: Opaque
@@ -56,8 +56,8 @@ metadata:
    app.kubernetes.io/instance: kubernetes-dashboard
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: kubernetes-dashboard
-    app.kubernetes.io/version: 2.7.0
-    helm.sh/chart: kubernetes-dashboard-6.0.0
+    app.kubernetes.io/version: 2.5.0
+    helm.sh/chart: kubernetes-dashboard-5.2.0
  name: kubernetes-dashboard-key-holder
  namespace: kubernetes-dashboard
 type: Opaque
@@ -71,8 +71,8 @@ metadata:
    app.kubernetes.io/instance: kubernetes-dashboard
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: kubernetes-dashboard
-    app.kubernetes.io/version: 2.7.0
-    helm.sh/chart: kubernetes-dashboard-6.0.0
+    app.kubernetes.io/version: 2.5.0
+    helm.sh/chart: kubernetes-dashboard-5.2.0
  name: kubernetes-dashboard-settings
  namespace: kubernetes-dashboard
 ---
@@ -84,8 +84,8 @@ metadata:
    app.kubernetes.io/instance: kubernetes-dashboard
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: kubernetes-dashboard
-    app.kubernetes.io/version: 2.7.0
-    helm.sh/chart: kubernetes-dashboard-6.0.0
+    app.kubernetes.io/version: 2.5.0
+    helm.sh/chart: kubernetes-dashboard-5.2.0
  name: kubernetes-dashboard-metrics
 rules:
 - apiGroups:
@@ -106,8 +106,8 @@ metadata:
    app.kubernetes.io/instance: kubernetes-dashboard
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: kubernetes-dashboard
-    app.kubernetes.io/version: 2.7.0
-    helm.sh/chart: kubernetes-dashboard-6.0.0
+    app.kubernetes.io/version: 2.5.0
+    helm.sh/chart: kubernetes-dashboard-5.2.0
  name: kubernetes-dashboard-metrics
 roleRef:
  apiGroup: rbac.authorization.k8s.io
@@ -126,8 +126,8 @@ metadata:
    app.kubernetes.io/instance: kubernetes-dashboard
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: kubernetes-dashboard
-    app.kubernetes.io/version: 2.7.0
-    helm.sh/chart: kubernetes-dashboard-6.0.0
+    app.kubernetes.io/version: 2.5.0
+    helm.sh/chart: kubernetes-dashboard-5.2.0
  name: kubernetes-dashboard
  namespace: kubernetes-dashboard
 rules:
@@ -182,8 +182,8 @@ metadata:
    app.kubernetes.io/instance: kubernetes-dashboard
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: kubernetes-dashboard
-    app.kubernetes.io/version: 2.7.0
-    helm.sh/chart: kubernetes-dashboard-6.0.0
+    app.kubernetes.io/version: 2.5.0
+    helm.sh/chart: kubernetes-dashboard-5.2.0
  name: kubernetes-dashboard
  namespace: kubernetes-dashboard
 roleRef:
@@ -204,8 +204,8 @@ metadata:
    app.kubernetes.io/instance: kubernetes-dashboard
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: kubernetes-dashboard
-    app.kubernetes.io/version: 2.7.0
-    helm.sh/chart: kubernetes-dashboard-6.0.0
+    app.kubernetes.io/version: 2.5.0
+    helm.sh/chart: kubernetes-dashboard-5.2.0
    kubernetes.io/cluster-service: "true"
  name: kubernetes-dashboard
  namespace: kubernetes-dashboard
@@ -229,8 +229,8 @@ metadata:
    app.kubernetes.io/instance: kubernetes-dashboard
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: kubernetes-dashboard
-    app.kubernetes.io/version: 2.7.0
-    helm.sh/chart: kubernetes-dashboard-6.0.0
+    app.kubernetes.io/version: 2.5.0
+    helm.sh/chart: kubernetes-dashboard-5.2.0
  name: kubernetes-dashboard
  namespace: kubernetes-dashboard
 spec:
@@ -253,15 +253,15 @@ spec:
        app.kubernetes.io/instance: kubernetes-dashboard
        app.kubernetes.io/managed-by: Helm
        app.kubernetes.io/name: kubernetes-dashboard
-        app.kubernetes.io/version: 2.7.0
-        helm.sh/chart: kubernetes-dashboard-6.0.0
+        app.kubernetes.io/version: 2.5.0
+        helm.sh/chart: kubernetes-dashboard-5.2.0
    spec:
      containers:
      - args:
        - --namespace=kubernetes-dashboard
        - --auto-generate-certificates
        - --sidecar-host=http://127.0.0.1:8000
-        image: kubernetesui/dashboard:v2.7.0
+        image: kubernetesui/dashboard:v2.5.0
        imagePullPolicy: IfNotPresent
        livenessProbe:
          httpGet:
@@ -292,7 +292,7 @@ spec:
          name: kubernetes-dashboard-certs
        - mountPath: /tmp
          name: tmp-volume
-      - image: kubernetesui/metrics-scraper:v1.0.8
+      - image: kubernetesui/metrics-scraper:v1.0.7
        imagePullPolicy: IfNotPresent
        livenessProbe:
          httpGet:
@@ -344,12 +344,3 @@ metadata:
  creationTimestamp: null
  name: cluster-admin
  namespace: kubernetes-dashboard
---
-apiVersion: v1
-kind: Secret
-type: kubernetes.io/service-account-token
-metadata:
-  name: cluster-admin-token
-  namespace: kubernetes-dashboard
-  annotations:
-    kubernetes.io/service-account.name: cluster-admin
--- a/k8s/hpa-v2-pa-httplat.yaml
+++ b/k8s/hpa-v2-pa-httplat.yaml
@@ -1,5 +1,5 @@
 kind: HorizontalPodAutoscaler
-apiVersion: autoscaling/v2
+apiVersion: autoscaling/v2beta2
 metadata:
  name: rng
 spec:
--- a/k8s/kyverno-pod-color-2.yaml
+++ b/k8s/kyverno-pod-color-2.yaml
@@ -15,10 +15,10 @@ spec:
    - key: "{{ request.operation }}"
      operator: Equals
      value: UPDATE
-    - key: "{{ request.oldObject.metadata.labels.color || '' }}"
+    - key: "{{ request.oldObject.metadata.labels.color }}"
      operator: NotEquals
      value: ""
-    - key: "{{ request.object.metadata.labels.color || '' }}"
+    - key: "{{ request.object.metadata.labels.color }}"
      operator: NotEquals
      value: ""
    validate:
--- a/k8s/kyverno-pod-color-3.yaml
+++ b/k8s/kyverno-pod-color-3.yaml
@@ -15,10 +15,10 @@ spec:
    - key: "{{ request.operation }}"
      operator: Equals
      value: UPDATE
-    - key: "{{ request.oldObject.metadata.labels.color || '' }}"
+    - key: "{{ request.oldObject.metadata.labels.color }}"
      operator: NotEquals
      value: ""
-    - key: "{{ request.object.metadata.labels.color || '' }}"
+    - key: "{{ request.object.metadata.labels.color }}"
      operator: Equals
      value: ""
    validate:
--- a/k8s/pizza-1.yaml
+++ b/k8s/pizza-1.yaml
@@ -1,14 +0,0 @@
-apiVersion: apiextensions.k8s.io/v1beta1
-kind: CustomResourceDefinition
-metadata:
-  name: pizzas.container.training
-spec:
-  group: container.training
-  version: v1alpha1
-  scope: Namespaced
-  names:
-    plural: pizzas
-    singular: pizza
-    kind: Pizza
-    shortNames:
-    - piz
--- a/k8s/pizza-2.yaml
+++ b/k8s/pizza-2.yaml
@@ -1,20 +0,0 @@
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
-  name: pizzas.container.training
-spec:
-  group: container.training
-  scope: Namespaced
-  names:
-    plural: pizzas
-    singular: pizza
-    kind: Pizza
-    shortNames:
-    - piz
-  versions:
-  - name: v1alpha1
-    served: true
-    storage: true
-    schema:
-      openAPIV3Schema:
-        type: object
--- a/k8s/pizza-3.yaml
+++ b/k8s/pizza-3.yaml
@@ -1,32 +0,0 @@
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
-  name: pizzas.container.training
-spec:
-  group: container.training
-  scope: Namespaced
-  names:
-    plural: pizzas
-    singular: pizza
-    kind: Pizza
-    shortNames:
-    - piz
-  versions:
-  - name: v1alpha1
-    served: true
-    storage: true
-    schema:
-      openAPIV3Schema:
-        type: object
-        required: [ spec ]
-        properties:
-          spec:
-            type: object
-            required: [ sauce, toppings ]
-            properties:
-              sauce:
-                type: string
-              toppings:
-                type: array
-                items:
-                  type: string
--- a/k8s/pizza-4.yaml
+++ b/k8s/pizza-4.yaml
@@ -1,39 +0,0 @@
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
-  name: pizzas.container.training
-spec:
-  group: container.training
-  scope: Namespaced
-  names:
-    plural: pizzas
-    singular: pizza
-    kind: Pizza
-    shortNames:
-    - piz
-  versions:
-  - name: v1alpha1
-    served: true
-    storage: true
-    schema:
-      openAPIV3Schema:
-        type: object
-        required: [ spec ]
-        properties:
-          spec:
-            type: object
-            required: [ sauce, toppings ]
-            properties:
-              sauce:
-                type: string
-              toppings:
-                type: array
-                items:
-                  type: string
-    additionalPrinterColumns:
-    - jsonPath: .spec.sauce
-      name: Sauce
-      type: string
-    - jsonPath: .spec.toppings
-      name: Toppings
-      type: string
--- a/k8s/pizza-5.yaml
+++ b/k8s/pizza-5.yaml
@@ -1,40 +0,0 @@
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
-  name: pizzas.container.training
-spec:
-  group: container.training
-  scope: Namespaced
-  names:
-    plural: pizzas
-    singular: pizza
-    kind: Pizza
-    shortNames:
-    - piz
-  versions:
-  - name: v1alpha1
-    served: true
-    storage: true
-    schema:
-      openAPIV3Schema:
-        type: object
-        required: [ spec ]
-        properties:
-          spec:
-            type: object
-            required: [ sauce, toppings ]
-            properties:
-              sauce:
-                type: string
-                enum: [ red, white ]
-              toppings:
-                type: array
-                items:
-                  type: string
-    additionalPrinterColumns:
-    - jsonPath: .spec.sauce
-      name: Sauce
-      type: string
-    - jsonPath: .spec.toppings
-      name: Toppings
-      type: string
--- a/k8s/pizzas.yaml
+++ b/k8s/pizzas.yaml
@@ -1,45 +0,0 @@
---
-apiVersion: container.training/v1alpha1
-kind: Pizza
-metadata:
-  name: margherita
-spec:
-  sauce: red
-  toppings:
-    - mozarella
-    - basil
---
-apiVersion: container.training/v1alpha1
-kind: Pizza
-metadata:
-  name: quatrostagioni
-spec:
-  sauce: red
-  toppings:
-    - artichoke
-    - basil
-    - mushrooms
-    - prosciutto
---
-apiVersion: container.training/v1alpha1
-kind: Pizza
-metadata:
-  name: mehl31
-spec:
-  sauce: white
-  toppings:
-    - goatcheese
-    - pear
-    - walnuts
-    - mozzarella
-    - rosemary
-    - honey
---
-apiVersion: container.training/v1alpha1
-kind: Pizza
-metadata:
-  name: brownie
-spec:
-  sauce: chocolate
-  toppings:
-    - nuts
--- a/k8s/update-dashboard-yaml.sh
+++ b/k8s/update-dashboard-yaml.sh
@@ -70,15 +70,4 @@ add_namespace() {
  kubectl create serviceaccount -n kubernetes-dashboard cluster-admin \
          -o yaml --dry-run=client \
          # 
-  echo ---
-  cat <<EOF
-apiVersion: v1
-kind: Secret
-type: kubernetes.io/service-account-token
-metadata:
-  name: cluster-admin-token
-  namespace: kubernetes-dashboard
-  annotations:
-    kubernetes.io/service-account.name: cluster-admin
-EOF
 ) > dashboard-with-token.yaml
--- a/k8s/ytt/1-variables/app.yaml
+++ b/k8s/ytt/1-variables/app.yaml
@@ -1,164 +0,0 @@
-#! Define and use variables.
---
-#@ repository = "dockercoins"
-#@ tag = "v0.1"
---
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  labels:
-    app: hasher
-  name: hasher
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: hasher
-  template:
-    metadata:
-      labels:
-        app: hasher
-    spec:
-      containers:
-      - image: #@ "{}/hasher:{}".format(repository, tag)
-        name: hasher
---
-apiVersion: v1
-kind: Service
-metadata:
-  labels:
-    app: hasher
-  name: hasher
-spec:
-  ports:
-  - port: 80
-    protocol: TCP
-    targetPort: 80
-  selector:
-    app: hasher
-  type: ClusterIP
---
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  labels:
-    app: redis
-  name: redis
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: redis
-  template:
-    metadata:
-      labels:
-        app: redis
-    spec:
-      containers:
-      - image: redis
-        name: redis
---
-apiVersion: v1
-kind: Service
-metadata:
-  labels:
-    app: redis
-  name: redis
-spec:
-  ports:
-  - port: 6379
-    protocol: TCP
-    targetPort: 6379
-  selector:
-    app: redis
-  type: ClusterIP
---
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  labels:
-    app: rng
-  name: rng
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: rng
-  template:
-    metadata:
-      labels:
-        app: rng
-    spec:
-      containers:
-      - image: #@ "{}/rng:{}".format(repository, tag)
-        name: rng
---
-apiVersion: v1
-kind: Service
-metadata:
-  labels:
-    app: rng
-  name: rng
-spec:
-  ports:
-  - port: 80
-    protocol: TCP
-    targetPort: 80
-  selector:
-    app: rng
-  type: ClusterIP
---
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  labels:
-    app: webui
-  name: webui
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: webui
-  template:
-    metadata:
-      labels:
-        app: webui
-    spec:
-      containers:
-      - image: #@ "{}/webui:{}".format(repository, tag)
-        name: webui
---
-apiVersion: v1
-kind: Service
-metadata:
-  labels:
-    app: webui
-  name: webui
-spec:
-  ports:
-  - port: 80
-    protocol: TCP
-    targetPort: 80
-  selector:
-    app: webui
-  type: NodePort
---
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  labels:
-    app: worker
-  name: worker
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: worker
-  template:
-    metadata:
-      labels:
-        app: worker
-    spec:
-      containers:
-      - image: #@ "{}/worker:{}".format(repository, tag)
-        name: worker
--- a/k8s/ytt/2-functions/app.yaml
+++ b/k8s/ytt/2-functions/app.yaml
@@ -1,167 +0,0 @@
-#! Define and use a function to set the deployment image.
---
-#@ repository = "dockercoins"
-#@ tag = "v0.1"
-#@ def image(component):
-#@   return "{}/{}:{}".format(repository, component, tag)
-#@ end
---
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  labels:
-    app: hasher
-  name: hasher
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: hasher
-  template:
-    metadata:
-      labels:
-        app: hasher
-    spec:
-      containers:
-      - image: #@ image("hasher")
-        name: hasher
---
-apiVersion: v1
-kind: Service
-metadata:
-  labels:
-    app: hasher
-  name: hasher
-spec:
-  ports:
-  - port: 80
-    protocol: TCP
-    targetPort: 80
-  selector:
-    app: hasher
-  type: ClusterIP
---
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  labels:
-    app: redis
-  name: redis
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: redis
-  template:
-    metadata:
-      labels:
-        app: redis
-    spec:
-      containers:
-      - image: redis
-        name: redis
---
-apiVersion: v1
-kind: Service
-metadata:
-  labels:
-    app: redis
-  name: redis
-spec:
-  ports:
-  - port: 6379
-    protocol: TCP
-    targetPort: 6379
-  selector:
-    app: redis
-  type: ClusterIP
---
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  labels:
-    app: rng
-  name: rng
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: rng
-  template:
-    metadata:
-      labels:
-        app: rng
-    spec:
-      containers:
-      - image: #@ image("rng")
-        name: rng
---
-apiVersion: v1
-kind: Service
-metadata:
-  labels:
-    app: rng
-  name: rng
-spec:
-  ports:
-  - port: 80
-    protocol: TCP
-    targetPort: 80
-  selector:
-    app: rng
-  type: ClusterIP
---
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  labels:
-    app: webui
-  name: webui
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: webui
-  template:
-    metadata:
-      labels:
-        app: webui
-    spec:
-      containers:
-      - image: #@ image("webui")
-        name: webui
---
-apiVersion: v1
-kind: Service
-metadata:
-  labels:
-    app: webui
-  name: webui
-spec:
-  ports:
-  - port: 80
-    protocol: TCP
-    targetPort: 80
-  selector:
-    app: webui
-  type: NodePort
---
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  labels:
-    app: worker
-  name: worker
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: worker
-  template:
-    metadata:
-      labels:
-        app: worker
-    spec:
-      containers:
-      - image: #@ image("worker")
-        name: worker
--- a/k8s/ytt/3-labels/app.yaml
+++ b/k8s/ytt/3-labels/app.yaml
@@ -1,164 +0,0 @@
-#! Define and use functions, demonstrating how to generate labels.
---
-#@ repository = "dockercoins"
-#@ tag = "v0.1"
-#@ def image(component):
-#@   return "{}/{}:{}".format(repository, component, tag)
-#@ end
-#@ def labels(component):
-#@   return {
-#@     "app": component,
-#@     "container.training/generated-by": "ytt",
-#@   }
-#@ end
---
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  labels: #@ labels("hasher")
-  name: hasher
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: hasher
-  template:
-    metadata:
-      labels:
-        app: hasher
-    spec:
-      containers:
-      - image: #@ image("hasher")
-        name: hasher
---
-apiVersion: v1
-kind: Service
-metadata:
-  labels: #@ labels("hasher")
-  name: hasher
-spec:
-  ports:
-  - port: 80
-    protocol: TCP
-    targetPort: 80
-  selector:
-    app: hasher
-  type: ClusterIP
---
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  labels: #@ labels("redis")
-  name: redis
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: redis
-  template:
-    metadata:
-      labels:
-        app: redis
-    spec:
-      containers:
-      - image: redis
-        name: redis
---
-apiVersion: v1
-kind: Service
-metadata:
-  labels: #@ labels("redis")
-  name: redis
-spec:
-  ports:
-  - port: 6379
-    protocol: TCP
-    targetPort: 6379
-  selector:
-    app: redis
-  type: ClusterIP
---
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  labels: #@ labels("rng")
-  name: rng
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: rng
-  template:
-    metadata:
-      labels:
-        app: rng
-    spec:
-      containers:
-      - image: #@ image("rng")
-        name: rng
---
-apiVersion: v1
-kind: Service
-metadata:
-  labels: #@ labels("rng")
-  name: rng
-spec:
-  ports:
-  - port: 80
-    protocol: TCP
-    targetPort: 80
-  selector:
-    app: rng
-  type: ClusterIP
---
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  labels: #@ labels("webui")
-  name: webui
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: webui
-  template:
-    metadata:
-      labels:
-        app: webui
-    spec:
-      containers:
-      - image: #@ image("webui")
-        name: webui
---
-apiVersion: v1
-kind: Service
-metadata:
-  labels: #@ labels("webui")
-  name: webui
-spec:
-  ports:
-  - port: 80
-    protocol: TCP
-    targetPort: 80
-  selector:
-    app: webui
-  type: NodePort
---
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  labels: #@ labels("worker")
-  name: worker
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: worker
-  template:
-    metadata:
-      labels:
-        app: worker
-    spec:
-      containers:
-      - image: #@ image("worker")
-        name: worker
--- a/k8s/ytt/4-data/app.yaml
+++ b/k8s/ytt/4-data/app.yaml
@@ -1,162 +0,0 @@
---
-#@ load("@ytt:data", "data")
-#@ def image(component):
-#@   return "{}/{}:{}".format(data.values.repository, component, data.values.tag)
-#@ end
-#@ def labels(component):
-#@   return {
-#@     "app": component,
-#@     "container.training/generated-by": "ytt",
-#@   }
-#@ end
---
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  labels: #@ labels("hasher")
-  name: hasher
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: hasher
-  template:
-    metadata:
-      labels:
-        app: hasher
-    spec:
-      containers:
-      - image: #@ image("hasher")
-        name: hasher
---
-apiVersion: v1
-kind: Service
-metadata:
-  labels: #@ labels("hasher")
-  name: hasher
-spec:
-  ports:
-  - port: 80
-    protocol: TCP
-    targetPort: 80
-  selector:
-    app: hasher
-  type: ClusterIP
---
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  labels: #@ labels("redis")
-  name: redis
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: redis
-  template:
-    metadata:
-      labels:
-        app: redis
-    spec:
-      containers:
-      - image: redis
-        name: redis
---
-apiVersion: v1
-kind: Service
-metadata:
-  labels: #@ labels("redis")
-  name: redis
-spec:
-  ports:
-  - port: 6379
-    protocol: TCP
-    targetPort: 6379
-  selector:
-    app: redis
-  type: ClusterIP
---
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  labels: #@ labels("rng")
-  name: rng
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: rng
-  template:
-    metadata:
-      labels:
-        app: rng
-    spec:
-      containers:
-      - image: #@ image("rng")
-        name: rng
---
-apiVersion: v1
-kind: Service
-metadata:
-  labels: #@ labels("rng")
-  name: rng
-spec:
-  ports:
-  - port: 80
-    protocol: TCP
-    targetPort: 80
-  selector:
-    app: rng
-  type: ClusterIP
---
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  labels: #@ labels("webui")
-  name: webui
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: webui
-  template:
-    metadata:
-      labels:
-        app: webui
-    spec:
-      containers:
-      - image: #@ image("webui")
-        name: webui
---
-apiVersion: v1
-kind: Service
-metadata:
-  labels: #@ labels("webui")
-  name: webui
-spec:
-  ports:
-  - port: 80
-    protocol: TCP
-    targetPort: 80
-  selector:
-    app: webui
-  type: NodePort
---
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  labels: #@ labels("worker")
-  name: worker
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: worker
-  template:
-    metadata:
-      labels:
-        app: worker
-    spec:
-      containers:
-      - image: #@ image("worker")
-        name: worker
--- a/k8s/ytt/4-data/schema.yaml
+++ b/k8s/ytt/4-data/schema.yaml
@@ -1,4 +0,0 @@
-#@data/values-schema
---
-repository: dockercoins
-tag: v0.1
--- a/k8s/ytt/5-factor/app.yaml
+++ b/k8s/ytt/5-factor/app.yaml
@@ -1,54 +0,0 @@
---
-#@ load("@ytt:data", "data")
---
-#@ def Deployment(component, repository=data.values.repository, tag=data.values.tag):
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  labels:
-    app: #@ component
-    container.training/generated-by: ytt
-  name: #@ component
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: #@ component
-  template:
-    metadata:
-      labels:
-        app: #@ component
-    spec:
-      containers:
-      - image: #@ repository + "/" + component + ":" + tag
-        name: #@ component
-#@ end
---
-#@ def Service(component, port=80, type="ClusterIP"):
-apiVersion: v1
-kind: Service
-metadata:
-  labels:
-    app: #@ component
-    container.training/generated-by: ytt
-  name: #@ component
-spec:
-  ports:
-  - port: #@ port
-    protocol: TCP
-    targetPort: #@ port
-  selector:
-    app: #@ component
-  type: #@ type
-#@ end
---
--- #@ Deployment("hasher")
--- #@ Service("hasher")
--- #@ Deployment("redis", repository="library", tag="latest")
--- #@ Service("redis", port=6379)
--- #@ Deployment("rng")
--- #@ Service("rng")
--- #@ Deployment("webui")
--- #@ Service("webui", type="NodePort")
--- #@ Deployment("worker")
---
--- a/k8s/ytt/5-factor/schema.yaml
+++ b/k8s/ytt/5-factor/schema.yaml
@@ -1,4 +0,0 @@
-#@data/values-schema
---
-repository: dockercoins
-tag: v0.1
--- a/k8s/ytt/6-template/app.yaml
+++ b/k8s/ytt/6-template/app.yaml
@@ -1,56 +0,0 @@
---
-#@ load("@ytt:data", "data")
-#@ load("@ytt:template", "template")
---
-#@ def component(name, repository=data.values.repository, tag=data.values.tag, port=None, type="ClusterIP"):
---
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  labels:
-    app: #@ name
-    container.training/generated-by: ytt
-  name: #@ name
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: #@ name
-  template:
-    metadata:
-      labels:
-        app: #@ name
-    spec:
-      containers:
-      - image: #@ repository + "/" + name + ":" + tag
-        name: #@ name
-        #@ if/end port==80:
-        readinessProbe:
-          httpGet:
-            port: #@ port
-#@ if port != None:
---
-apiVersion: v1
-kind: Service
-metadata:
-  labels:
-    app: #@ name
-    container.training/generated-by: ytt
-  name: #@ name
-spec:
-  ports:
-  - port: #@ port
-    protocol: TCP
-    targetPort: #@ port
-  selector:
-    app: #@ name
-  type: #@ type
-#@ end
-#@ end
---
--- #@ template.replace(component("hasher", port=80))
--- #@ template.replace(component("redis", repository="library", tag="latest", port=6379))
--- #@ template.replace(component("rng", port=80))
--- #@ template.replace(component("webui", port=80, type="NodePort"))
--- #@ template.replace(component("worker"))
---
--- a/k8s/ytt/6-template/schema.yaml
+++ b/k8s/ytt/6-template/schema.yaml
@@ -1,4 +0,0 @@
-#@data/values-schema
---
-repository: dockercoins
-tag: v0.1
--- a/k8s/ytt/7-morevalues/app.yaml
+++ b/k8s/ytt/7-morevalues/app.yaml
@@ -1,65 +0,0 @@
---
-#@ load("@ytt:data", "data")
-#@ load("@ytt:template", "template")
---
-#@ def component(name, repository, tag, port=None, type="ClusterIP"):
---
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  labels:
-    app: #@ name
-    container.training/generated-by: ytt
-  name: #@ name
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: #@ name
-  template:
-    metadata:
-      labels:
-        app: #@ name
-    spec:
-      containers:
-      - image: #@ repository + "/" + name + ":" + tag
-        name: #@ name
-        #@ if/end port==80:
-        readinessProbe:
-          httpGet:
-            port: #@ port
-#@ if port != None:
---
-apiVersion: v1
-kind: Service
-metadata:
-  labels:
-    app: #@ name
-    container.training/generated-by: ytt
-  name: #@ name
-spec:
-  ports:
-  - port: #@ port
-    protocol: TCP
-    targetPort: #@ port
-  selector:
-    app: #@ name
-  type: #@ type
-#@ end
-#@ end
---
-#@ defaults = {}
-#@ for name in data.values:
-#@   if name.startswith("_"):
-#@     defaults.update(data.values[name])
-#@   end
-#@ end
---
-#@ for name in data.values:
-#@   if not name.startswith("_"):
-#@     values = dict(name=name)
-#@     values.update(defaults)
-#@     values.update(data.values[name])
--- #@ template.replace(component(**values))
-#@   end
-#@ end
--- a/k8s/ytt/7-morevalues/schema.yaml
+++ b/k8s/ytt/7-morevalues/schema.yaml
@@ -1,19 +0,0 @@
-#@data/values-schema
-#! Entries starting with an underscore will hold default values.
-#! Entires NOT starting with an underscore will generate a Deployment
-#! (and a Service if a port number is set).
---
-_default_:
-  repository: dockercoins
-  tag: v0.1
-hasher:
-  port: 80
-redis:
-  repository: library
-  tag: latest
-rng:
-  port: 80
-webui:
-  port: 80
-  type: NodePort
-worker: {}
--- a/k8s/ytt/8-library/_ytt_lib/component/deployment.yaml
+++ b/k8s/ytt/8-library/_ytt_lib/component/deployment.yaml
@@ -1,26 +0,0 @@
-#@ load("@ytt:data", "data")
---
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  labels:
-    app: #@ data.values.name
-    container.training/generated-by: ytt
-  name: #@ data.values.name
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: #@ data.values.name
-  template:
-    metadata:
-      labels:
-        app: #@ data.values.name
-    spec:
-      containers:
-      - image: #@ data.values.repository + "/" + data.values.name + ":" + data.values.tag
-        name: #@ data.values.name
-        #@ if/end data.values.port==80:
-        readinessProbe:
-          httpGet:
-            port: #@ data.values.port
--- a/k8s/ytt/8-library/_ytt_lib/component/schema.yaml
+++ b/k8s/ytt/8-library/_ytt_lib/component/schema.yaml
@@ -1,7 +0,0 @@
-#@data/values-schema
---
-name: component
-repository: dockercoins
-tag: v0.1
-port: 0
-type: ClusterIP
--- a/k8s/ytt/8-library/_ytt_lib/component/service.yaml
+++ b/k8s/ytt/8-library/_ytt_lib/component/service.yaml
@@ -1,19 +0,0 @@
-#@ load("@ytt:data", "data")
-#@ if data.values.port > 0:
---
-apiVersion: v1
-kind: Service
-metadata:
-  labels:
-    app: #@ data.values.name
-    container.training/generated-by: ytt
-  name: #@ data.values.name
-spec:
-  ports:
-  - port: #@ data.values.port
-    protocol: TCP
-    targetPort: #@ data.values.port
-  selector:
-    app: #@ data.values.name
-  type: #@ data.values.type
-#@ end
--- a/k8s/ytt/8-library/app.yaml
+++ b/k8s/ytt/8-library/app.yaml
@@ -1,20 +0,0 @@
-#@ load("@ytt:data", "data")
-#@ load("@ytt:library", "library")
-#@ load("@ytt:template", "template")
-#@ 
-#@ component = library.get("component")
-#@ 
-#@ defaults = {}
-#@ for name in data.values:
-#@   if name.startswith("_"):
-#@     defaults.update(data.values[name])
-#@   end
-#@ end
-#@ for name in data.values:
-#@   if not name.startswith("_"):
-#@     values = dict(name=name)
-#@     values.update(defaults)
-#@     values.update(data.values[name])
--- #@ template.replace(component.with_data_values(values).eval())
-#@   end
-#@ end
--- a/k8s/ytt/8-library/schema.yaml
+++ b/k8s/ytt/8-library/schema.yaml
@@ -1,19 +0,0 @@
-#@data/values-schema
-#! Entries starting with an underscore will hold default values.
-#! Entires NOT starting with an underscore will generate a Deployment
-#! (and a Service if a port number is set).
---
-_default_:
-  repository: dockercoins
-  tag: v0.1
-hasher:
-  port: 80
-redis:
-  repository: library
-  tag: latest
-rng:
-  port: 80
-webui:
-  port: 80
-  type: NodePort
-worker: {}
--- a/k8s/ytt/9-overlay/_ytt_lib/component/deployment.yaml
+++ b/k8s/ytt/9-overlay/_ytt_lib/component/deployment.yaml
@@ -1,26 +0,0 @@
-#@ load("@ytt:data", "data")
---
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  labels:
-    app: #@ data.values.name
-    container.training/generated-by: ytt
-  name: #@ data.values.name
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: #@ data.values.name
-  template:
-    metadata:
-      labels:
-        app: #@ data.values.name
-    spec:
-      containers:
-      - image: #@ data.values.repository + "/" + data.values.name + ":" + data.values.tag
-        name: #@ data.values.name
-        #@ if/end data.values.port==80:
-        readinessProbe:
-          httpGet:
-            port: #@ data.values.port
--- a/k8s/ytt/9-overlay/_ytt_lib/component/schema.yaml
+++ b/k8s/ytt/9-overlay/_ytt_lib/component/schema.yaml
@@ -1,7 +0,0 @@
-#@data/values-schema
---
-name: component
-repository: dockercoins
-tag: v0.1
-port: 0
-type: ClusterIP
--- a/k8s/ytt/9-overlay/_ytt_lib/component/service.yaml
+++ b/k8s/ytt/9-overlay/_ytt_lib/component/service.yaml
@@ -1,19 +0,0 @@
-#@ load("@ytt:data", "data")
-#@ if data.values.port > 0:
---
-apiVersion: v1
-kind: Service
-metadata:
-  labels:
-    app: #@ data.values.name
-    container.training/generated-by: ytt
-  name: #@ data.values.name
-spec:
-  ports:
-  - port: #@ data.values.port
-    protocol: TCP
-    targetPort: #@ data.values.port
-  selector:
-    app: #@ data.values.name
-  type: #@ data.values.type
-#@ end
--- a/k8s/ytt/9-overlay/app.yaml
+++ b/k8s/ytt/9-overlay/app.yaml
@@ -1,20 +0,0 @@
-#@ load("@ytt:data", "data")
-#@ load("@ytt:library", "library")
-#@ load("@ytt:template", "template")
-#@ 
-#@ component = library.get("component")
-#@ 
-#@ defaults = {}
-#@ for name in data.values:
-#@   if name.startswith("_"):
-#@     defaults.update(data.values[name])
-#@   end
-#@ end
-#@ for name in data.values:
-#@   if not name.startswith("_"):
-#@     values = dict(name=name)
-#@     values.update(defaults)
-#@     values.update(data.values[name])
--- #@ template.replace(component.with_data_values(values).eval())
-#@   end
-#@ end
--- a/k8s/ytt/9-overlay/rng-healthcheck.yaml
+++ b/k8s/ytt/9-overlay/rng-healthcheck.yaml
@@ -1,20 +0,0 @@
-#@ load("@ytt:overlay", "overlay")
-
-#@ def match():
-kind: Deployment
-metadata:
-  name: rng
-#@ end
-
-#@overlay/match by=overlay.subset(match())
---
-spec:
-  template:
-    spec:
-      containers:
-      #@overlay/match by="name"
-      - name: rng
-        readinessProbe:
-          httpGet:
-            #@overlay/match missing_ok=True
-            path: /1
--- a/k8s/ytt/9-overlay/schema.yaml
+++ b/k8s/ytt/9-overlay/schema.yaml
@@ -1,19 +0,0 @@
-#@data/values-schema
-#! Entries starting with an underscore will hold default values.
-#! Entires NOT starting with an underscore will generate a Deployment
-#! (and a Service if a port number is set).
---
-_default_:
-  repository: dockercoins
-  tag: v0.1
-hasher:
-  port: 80
-redis:
-  repository: library
-  tag: latest
-rng:
-  port: 80
-webui:
-  port: 80
-  type: NodePort
-worker: {}
--- a/k8s/ytt/9-overlay/worker-scaling.yaml
+++ b/k8s/ytt/9-overlay/worker-scaling.yaml
@@ -1,25 +0,0 @@
-#@ load("@ytt:overlay", "overlay")
-
-#@ def match():
-kind: Deployment
-metadata:
-  name: worker
-#@ end
-
-#! This removes the number of replicas:
-#@overlay/match by=overlay.subset(match())
---
-spec:
-  #@overlay/remove
-  replicas:
-
-#! This overrides it:
-#@overlay/match by=overlay.subset(match())
---
-spec:
-  #@overlay/match missing_ok=True
-  replicas: 10
-
-#! Note that it's not necessary to remove the number of replicas.
-#! We're just presenting both options here (for instance, you might
-#! want to remove the number of replicas if you're using an HPA).
--- a/netlify.toml
+++ b/netlify.toml
@@ -2,3 +2,4 @@
  base = "slides"
  publish = "slides"
  command = "./build.sh once"
+
--- a/prepare-local/provisioning.yml
+++ b/prepare-local/provisioning.yml
@@ -1,10 +1,11 @@
 ---
 - hosts: nodes
-  become: yes
+  sudo: true
  vars_files:
    - vagrant.yml

  tasks:
+
    - name: clean up the home folder
      file:
        path: /home/vagrant/{{ item }}
@@ -23,23 +24,25 @@

    - name: installing dependencies
      apt:
-        name: apt-transport-https,ca-certificates,python3-pip,tmux
+        name: apt-transport-https,ca-certificates,python-pip,tmux
        state: present
        update_cache: true

    - name: fetching docker repo key
      apt_key:
-        url: https://download.docker.com/linux/ubuntu/gpg
-        state: present
+        keyserver: hkp://p80.pool.sks-keyservers.net:80
+        id: 58118E89F3A912897C070ADBF76221572C52609D

-    - name: adding docker repo
+    - name: adding package repos
      apt_repository:
-        repo: deb https://download.docker.com/linux/ubuntu focal stable
+        repo: "{{ item }}"
        state: present
+      with_items:
+        - deb https://apt.dockerproject.org/repo ubuntu-trusty main

    - name: installing docker
      apt:
-        name: docker-ce,docker-ce-cli,containerd.io,docker-compose-plugin
+        name: docker-engine
        state: present
        update_cache: true

@@ -53,7 +56,7 @@
      lineinfile:
        dest: /etc/default/docker
        line: DOCKER_OPTS="--host=unix:///var/run/docker.sock --host=tcp://0.0.0.0:55555"
-        regexp: "^#?DOCKER_OPTS=.*$"
+        regexp: '^#?DOCKER_OPTS=.*$'
        state: present
      register: docker_opts

@@ -63,14 +66,22 @@
        state: restarted
      when: docker_opts is defined and docker_opts.changed

-    - name: install docker-compose from official github repo
-      get_url:
-        url: https://github.com/docker/compose/releases/download/1.29.2/docker-compose-Linux-x86_64
-        dest: /usr/local/bin/docker-compose
-        mode: "u+x,g+x"
+    - name: performing pip autoupgrade
+      pip:
+        name: pip
+        state: latest
+
+    - name: installing virtualenv
+      pip:
+        name: virtualenv
+        state: latest
+
+    - name: Install Docker Compose via PIP
+      pip: name=docker-compose

    - name:
-      file: path="/usr/local/bin/docker-compose"
+      file:
+        path="/usr/local/bin/docker-compose"
        state=file
        mode=0755
        owner=vagrant
@@ -117,3 +128,5 @@
          line: "127.0.0.1 localhost {{ inventory_hostname }}"
        - regexp: '^127\.0\.1\.1'
          line: "127.0.1.1 {{ inventory_hostname }}"
+
+
--- a/prepare-local/vagrant.yml
+++ b/prepare-local/vagrant.yml
@@ -1,12 +1,13 @@
 ---
 vagrant:
-  default_box: ubuntu/focal64
+  default_box: ubuntu/trusty64
  default_box_check_update: true
  ssh_insert_key: false
  min_memory: 256
  min_cores: 1

 instances:
+
  - hostname: node1
    private_ip: 10.10.10.10
    memory: 1512
@@ -36,3 +37,6 @@ instances:
    private_ip: 10.10.10.50
    memory: 512
    cores: 1
+
+
+
--- a/prepare-tf/README.md
+++ b/prepare-tf/README.md
@@ -34,15 +34,28 @@ to that directory, then create the clusters using that configuration.

 - Scaleway: run `scw init`

-2. Run!
+2. Optional: set number of clusters, cluster size, and region.
+
+By default, 1 cluster will be configured, with 2 nodes, and auto-scaling up to 5 nodes.
+
+If you want, you can override these parameters, with the following variables.

 ```bash
-./run.sh <providername> <location> [number of clusters] [min nodes] [max nodes]
+export TF_VAR_how_many_clusters=5
+export TF_VAR_min_nodes_per_pool=2
+export TF_VAR_max_nodes_per_pool=4
+export TF_VAR_location=xxx
 ```

-If you don't specify a provider name, it will list available providers.
+The `location` variable is optional. Each provider should have a default value.
+The value of the `location` variable is provider-specific. Examples:

-If you don't specify a location, it will list locations available for this provider.
+| Provider      | Example value     | How to see possible values
+|---------------|-------------------|---------------------------
+| Digital Ocean | `ams3`            | `doctl compute region list`
+| Google Cloud  | `europe-north1-a` | `gcloud  compute zones list`
+| Linode        | `eu-central`      | `linode-cli regions list`
+| Oracle Cloud  | `eu-stockholm-1`  | `oci iam region list`

 You can also specify multiple locations, and then they will be
 used in round-robin fashion.
@@ -53,15 +66,22 @@ my requests to increase that quota were denied) you can do the
 following:

 ```bash
-LOCATIONS=$(gcloud compute zones list --format=json | jq -r .[].name | grep ^europe)
-./run.sh googlecloud "$LOCATIONS"
+export TF_VAR_location=$(gcloud compute zones list --format=json | jq -r .[].name | grep ^europe)
 ```

 Then when you apply, clusters will be created across all available
 zones in Europe. (When I write this, there are 20+ zones in Europe,
 so even with my quota, I can create 40 clusters.)

-3. Shutting down
+3. Run!
+
+```bash
+./run.sh <providername>
+```
+
+(If you don't specify a provider name, it will list available providers.)
+
+4. Shutting down

 Go to the directory that was created by the previous step (`tag-YYYY-MM...`)
 and run `terraform destroy`.
@@ -92,7 +112,7 @@ terraform init

 See steps above, and add the following extra steps:

- Digital Ocean:
+- Digital Coean:
  ```bash
  export DIGITALOCEAN_ACCESS_TOKEN=$(grep ^access-token ~/.config/doctl/config.yaml | cut -d: -f2 | tr -d " ")
  ```
@@ -140,30 +160,3 @@ terraform destroy
 ```bash
 rm stage2/terraform.tfstate*
 ```
-
-10. Clean up leftovers.
-
-Some providers don't clean up properly the resources created by the CCM.
-For instance, when you create a Kubernetes `Service` of type
-`LoadBalancer`, it generally provisions a cloud load balancer.
-On Linode (and possibly other providers, too!) these cloud load balancers
-aren't deleted when the cluster gets deleted, and they keep incurring
-charges. You should check for those, to make sure that you don't
-get charged for resources that you don't use anymore. As I write this
-paragraph, there is:
-
- `linode-delete-ccm-loadbalancers.sh` to delete the Linode
-  nodebalancers; but be careful: it deletes **all** the nodebalancers
-  whose name starts with `ccm-`, which means that if you still have
-  Kubernetes clusters, their load balancers will be deleted as well!
-
- `linode-delete-pvc-volumes.sh` to delete Linode persistent disks
-  that have been created to satisfy Persistent Volume Claims
-  (these need to be removed manually because the default Storage Class
-  on Linode has a RETAIN policy). Again, be careful, this will wipe
-  out any volume whose label starts with `pvc`. (I don't know if it
-  will remove volumes that are still attached.)
-
-Eventually, I hope to add more scripts for other providers, and make
-them more selective and more robust, but for now, that's better than
-nothing.
--- a/prepare-tf/linode-delete-ccm-loadbalancers.sh
+++ b/prepare-tf/linode-delete-ccm-loadbalancers.sh
@@ -1,4 +0,0 @@
-#!/bin/sh
-linode-cli nodebalancers list --json | 
-  jq '.[] | select(.label | startswith("ccm-")) | .id' | 
-  xargs -n1 -P10 linode-cli nodebalancers delete
--- a/prepare-tf/linode-delete-pvc-volumes.sh
+++ b/prepare-tf/linode-delete-pvc-volumes.sh
@@ -1,4 +0,0 @@
-#!/bin/sh
-linode-cli volumes list --json | 
-  jq '.[] | select(.label | startswith("pvc")) | .id' | 
-  xargs -n1 -P10 linode-cli volumes delete
--- a/prepare-tf/run.sh
+++ b/prepare-tf/run.sh
@@ -3,37 +3,11 @@ set -e

 TIME=$(which time)

-if [ -f ~/.config/doctl/config.yaml ]; then
-  export DIGITALOCEAN_ACCESS_TOKEN=$(grep ^access-token ~/.config/doctl/config.yaml | cut -d: -f2 | tr -d " ")
-fi
-
-if [ -f ~/.config/linode-cli ]; then
-  export LINODE_TOKEN=$(grep ^token ~/.config/linode-cli | cut -d= -f2 | tr -d " ")
-fi
-
-[ "$1" ] || {
-  echo "Syntax:"
-  echo ""
-  echo "$0 <provider> <region> [how-many-clusters] [min-nodes] [max-nodes]"
-  echo ""
+PROVIDER=$1
+[ "$PROVIDER" ] || {
+  echo "Please specify a provider as first argument, or 'ALL' for parallel mode."
  echo "Available providers:"
  ls -1 source/modules
-  echo ""
-  echo "Leave the region empty to show available regions for this provider."
-  echo "You can also specify ALL as a provider to simultaneously provision"
-  echo "many clusters on *each* provider for benchmarking purposes."
-  echo ""
-  exit 1
-}
-
-PROVIDER="$1"
-export TF_VAR_location="$2"
-export TF_VAR_how_many_clusters="${3-1}"
-export TF_VAR_min_nodes_per_pool="${4-2}"
-export TF_VAR_max_nodes_per_pool="${5-4}"
-
-[ "$TF_VAR_location" ] || {
-  "./source/modules/$PROVIDER/list_locations.sh"
  exit 1
 }

--- a/prepare-tf/source/locals.tf
+++ b/prepare-tf/source/locals.tf
@@ -1,6 +1,6 @@
 resource "random_string" "_" {
  length  = 4
-  numeric = false
+  number  = false
  special = false
  upper   = false
 }
--- a/prepare-tf/source/main.tf
+++ b/prepare-tf/source/main.tf
@@ -62,11 +62,9 @@ resource "null_resource" "wait_for_nodes" {
      KUBECONFIG = local_file.kubeconfig[each.key].filename
    }
    command = <<-EOT
-      while sleep 1; do
-        kubectl get nodes --watch | grep --silent --line-buffered . &&
-        kubectl wait node --for=condition=Ready --all --timeout=10m &&
-        break
-      done
+      set -e
+      kubectl get nodes --watch | grep --silent --line-buffered .
+      kubectl wait node --for=condition=Ready --all --timeout=10m
      EOT
  }
 }
--- a/prepare-tf/source/modules/digitalocean/list_locations.sh
+++ b/prepare-tf/source/modules/digitalocean/list_locations.sh
@@ -1,2 +0,0 @@
-#!/bin/sh
-doctl compute region list
--- a/prepare-tf/source/modules/digitalocean/variables.tf
+++ b/prepare-tf/source/modules/digitalocean/variables.tf
@@ -53,5 +53,5 @@ variable "location" {
 # doctl kubernetes options versions -o json | jq -r .[].slug
 variable "k8s_version" {
  type    = string
-  default = "1.22.8-do.1"
+  default = "1.21.5-do.0"
 }
--- a/prepare-tf/source/modules/googlecloud/list_locations.sh
+++ b/prepare-tf/source/modules/googlecloud/list_locations.sh
@@ -1,2 +0,0 @@
-#!/bin/sh
-gcloud compute zones list
--- a/prepare-tf/source/modules/linode/list_locations.sh
+++ b/prepare-tf/source/modules/linode/list_locations.sh
@@ -1,2 +0,0 @@
-#!/bin/sh
-linode-cli regions list
--- a/prepare-tf/source/modules/linode/main.tf
+++ b/prepare-tf/source/modules/linode/main.tf
@@ -3,7 +3,7 @@ resource "linode_lke_cluster" "_" {
  tags  = var.common_tags
  # "region" is mandatory, so let's provide a default value if none was given.
  region      = var.location != null ? var.location : "eu-central"
-  k8s_version = local.k8s_version
+  k8s_version = var.k8s_version

  pool {
    type  = local.node_type
--- a/prepare-tf/source/modules/linode/variables.tf
+++ b/prepare-tf/source/modules/linode/variables.tf
@@ -51,22 +51,7 @@ variable "location" {

 # To view supported versions, run:
 # linode-cli lke versions-list --json | jq -r .[].id
-data "external" "k8s_version" {
-  program = [
-    "sh",
-    "-c",
-    <<-EOT
-      linode-cli lke versions-list --json |
-      jq -r '{"latest": [.[].id] | sort [-1]}'
-    EOT
-  ]
-}
-
 variable "k8s_version" {
  type    = string
-  default = ""
-}
-
-locals {
-  k8s_version = var.k8s_version != "" ? var.k8s_version : data.external.k8s_version.result.latest
+  default = "1.21"
 }
--- a/prepare-tf/source/modules/oraclecloud/list_locations.sh
+++ b/prepare-tf/source/modules/oraclecloud/list_locations.sh
@@ -1,2 +0,0 @@
-#!/bin/sh
-oci iam region list
--- a/prepare-tf/source/modules/scaleway/list_locations.sh
+++ b/prepare-tf/source/modules/scaleway/list_locations.sh
@@ -1,6 +0,0 @@
-#!/bin/sh
-echo "# Note that this is hard-coded in $0.
-# I don't know if there is a way to list regions through the Scaleway API.
-fr-par
-nl-ams
-pl-waw"
--- a/prepare-tf/source/modules/scaleway/variables.tf
+++ b/prepare-tf/source/modules/scaleway/variables.tf
@@ -56,5 +56,5 @@ variable "location" {
 # scw k8s version list -o json | jq -r .[].name
 variable "k8s_version" {
  type    = string
-  default = "1.24.7"
+  default = "1.22.2"
 }
--- a/prepare-tf/source/stage2.tmpl
+++ b/prepare-tf/source/stage2.tmpl
@@ -2,7 +2,7 @@ terraform {
  required_providers {
    kubernetes = {
      source  = "hashicorp/kubernetes"
-      version = "2.16.1"
+      version = "2.7.1"
    }
  }
 }
@@ -145,15 +145,23 @@ resource "helm_release" "metrics_server_${index}" {
  # but only if it's not already installed.
  count = yamldecode(file("./flags.${index}"))["has_metrics_server"] ? 0 : 1
  provider = helm.cluster_${index}
-  repository = "https://kubernetes-sigs.github.io/metrics-server/"
+  repository = "https://charts.bitnami.com/bitnami"
  chart = "metrics-server"
-  version = "3.8.2"
+  version = "5.8.8"
  name = "metrics-server"
  namespace = "metrics-server"
  create_namespace = true
  set {
-    name = "args"
-    value = "{--kubelet-insecure-tls}"
+    name = "apiService.create"
+    value = "true"
+  }
+  set {
+    name = "extraArgs.kubelet-insecure-tls"
+    value = "true"
+  }
+  set {
+    name = "extraArgs.kubelet-preferred-address-types"
+    value = "InternalIP"
  }
 }

@@ -193,6 +201,7 @@ resource "tls_private_key" "cluster_admin_${index}" {
 }

 resource "tls_cert_request" "cluster_admin_${index}" {
+  key_algorithm = tls_private_key.cluster_admin_${index}.algorithm
  private_key_pem = tls_private_key.cluster_admin_${index}.private_key_pem
  subject {
    common_name = "cluster-admin"
--- a/prepare-vms/README.md
+++ b/prepare-vms/README.md
@@ -17,7 +17,6 @@ These tools can help you to create VMs on:
 - [Parallel SSH](https://github.com/lilydjwg/pssh)
  (should be installable with `pip install git+https://github.com/lilydjwg/pssh`;
  on a Mac, try `brew install pssh`)
- [yq](https://github.com/kislyuk/yq)

 Depending on the infrastructure that you want to use, you also need to install
 the CLI that is specific to that cloud. For OpenStack deployments, you will
--- a/prepare-vms/infra/scaleway
+++ b/prepare-vms/infra/scaleway
@@ -1,3 +1,3 @@
 INFRACLASS=scaleway
 #SCW_INSTANCE_TYPE=DEV1-L
-SCW_ZONE=fr-par-2
+#SCW_ZONE=fr-par-2
--- a/prepare-vms/lib/commands.sh
+++ b/prepare-vms/lib/commands.sh
@@ -131,8 +131,6 @@ set nowrap
 SQRL

    pssh -I "sudo -u $USER_LOGIN tee /home/$USER_LOGIN/.tmux.conf" <<SQRL
-set -g status-style bg=yellow,bold
-
 bind h select-pane -L
 bind j select-pane -D
 bind k select-pane -U
@@ -159,9 +157,6 @@ _cmd_clusterize() {
    TAG=$1
    need_tag

-    # Disable unattended upgrades so that they don't mess up with the subsequent steps
-    pssh sudo rm -f /etc/apt/apt.conf.d/50unattended-upgrades
-
    # Special case for scaleway since it doesn't come with sudo
    if [ "$INFRACLASS" = "scaleway" ]; then
        pssh -l root "
@@ -187,23 +182,9 @@ _cmd_clusterize() {
    pssh "
    if [ -f /etc/iptables/rules.v4 ]; then
        sudo sed -i 's/-A INPUT -j REJECT --reject-with icmp-host-prohibited//' /etc/iptables/rules.v4
-        sudo netfilter-persistent flush
        sudo netfilter-persistent start
    fi"

-    # oracle-cloud-agent upgrades pacakges in the background.
-    # This breaks our deployment scripts, because when we invoke apt-get, it complains
-    # that the lock already exists (symptom: random "Exited with error code 100").
-    # Workaround: if we detect oracle-cloud-agent, remove it.
-    # But this agent seems to also take care of installing/upgrading
-    # the unified-monitoring-agent package, so when we stop the snap,
-    # it can leave dpkg in a broken state. We "fix" it with the 2nd command.
-    pssh "
-    if [ -d /snap/oracle-cloud-agent ]; then
-        sudo snap remove oracle-cloud-agent
-        sudo dpkg --remove --force-remove-reinstreq unified-monitoring-agent
-    fi"
-
    # Copy settings and install Python YAML parser
    pssh -I tee /tmp/settings.yaml <tags/$TAG/settings.yaml
    pssh "
@@ -267,21 +248,19 @@ _cmd_docker() {

    # Add registry mirror configuration.
    if ! [ -f /etc/docker/daemon.json ]; then
-        sudo mkdir -p /etc/docker
        echo '{\"registry-mirrors\": [\"https://mirror.gcr.io\"]}' | sudo tee /etc/docker/daemon.json
        sudo systemctl restart docker
    fi
    "

    ##VERSION## https://github.com/docker/compose/releases
-    COMPOSE_VERSION=v2.11.1
-    COMPOSE_PLATFORM='linux-$(uname -m)'
-    
-    # Just in case you need Compose 1.X, you can use the following lines.
-    # (But it will probably only work for x86_64 machines.)
-    #COMPOSE_VERSION=1.29.2
-    #COMPOSE_PLATFORM='Linux-$(uname -m)'
-
+    if [ "$ARCHITECTURE" ]; then
+        COMPOSE_VERSION=v2.2.3
+        COMPOSE_PLATFORM='linux-$(uname -m)'
+    else
+        COMPOSE_VERSION=1.29.2
+        COMPOSE_PLATFORM='Linux-$(uname -m)'
+    fi
    pssh "
    set -e
    ### Install docker-compose.
@@ -359,8 +338,7 @@ EOF"
    pssh --timeout 200 "
    sudo apt-get update -q &&
    sudo apt-get install -qy kubelet kubeadm kubectl &&
-    sudo apt-mark hold kubelet kubeadm kubectl &&
-    kubeadm completion bash | sudo tee /etc/bash_completion.d/kubeadm &&
+    sudo apt-mark hold kubelet kubeadm kubectl
    kubectl completion bash | sudo tee /etc/bash_completion.d/kubectl &&
    echo 'alias k=kubectl' | sudo tee /etc/bash_completion.d/k &&
    echo 'complete -F __start_kubectl k' | sudo tee -a /etc/bash_completion.d/k"
@@ -433,9 +411,8 @@ EOF
    # Install weave as the pod network
    pssh "
    if i_am_first_node; then
-        #kubever=\$(kubectl version | base64 | tr -d '\n') &&
-        #kubectl apply -f https://cloud.weave.works/k8s/net?k8s-version=\$kubever
-        kubectl apply -f https://github.com/weaveworks/weave/releases/download/v2.8.1/weave-daemonset-k8s-1.11.yaml
+        kubever=\$(kubectl version | base64 | tr -d '\n') &&
+        kubectl apply -f https://cloud.weave.works/k8s/net?k8s-version=\$kubever
    fi"

    # Join the other nodes to the cluster
@@ -450,9 +427,6 @@ EOF
    pssh "
    if i_am_first_node; then
 	kubectl apply -f https://raw.githubusercontent.com/jpetazzo/container.training/master/k8s/metrics-server.yaml
-    #helm upgrade --install metrics-server \
-    #     --repo https://kubernetes-sigs.github.io/metrics-server/ metrics-server \
-    #     --namespace kube-system --set args={--kubelet-insecure-tls}
    fi"
 }

@@ -493,13 +467,12 @@ _cmd_kubetools() {
    # Install kube-ps1
    pssh "
    set -e
-    if ! [ -d /opt/kube-ps1 ]; then
+    if ! [ -f /etc/profile.d/kube-ps1.sh ]; then
      cd /tmp
      git clone https://github.com/jonmosco/kube-ps1
-      sudo mv kube-ps1 /opt/kube-ps1
+      sudo cp kube-ps1/kube-ps1.sh /etc/profile.d/kube-ps1.sh
      sudo -u $USER_LOGIN sed -i s/docker-prompt/kube_ps1/ /home/$USER_LOGIN/.bashrc &&
      sudo -u $USER_LOGIN tee -a /home/$USER_LOGIN/.bashrc <<EOF
-. /opt/kube-ps1/kube-ps1.sh
 KUBE_PS1_PREFIX=""
 KUBE_PS1_SUFFIX=""
 KUBE_PS1_SYMBOL_ENABLE="false"
@@ -510,13 +483,13 @@ EOF

    # Install stern
    ##VERSION## https://github.com/stern/stern/releases
-    STERN_VERSION=1.22.0
+    STERN_VERSION=1.20.1
    FILENAME=stern_${STERN_VERSION}_linux_${ARCH}
    URL=https://github.com/stern/stern/releases/download/v$STERN_VERSION/$FILENAME.tar.gz
    pssh "
    if [ ! -x /usr/local/bin/stern ]; then
        curl -fsSL $URL |
-        sudo tar -C /usr/local/bin -zx stern
+        sudo tar -C /usr/local/bin -zx --strip-components=1 $FILENAME/stern
        sudo chmod +x /usr/local/bin/stern
        stern --completion bash | sudo tee /etc/bash_completion.d/stern
        stern --version
@@ -532,7 +505,7 @@ EOF

    # Install kustomize
    ##VERSION## https://github.com/kubernetes-sigs/kustomize/releases
-    KUSTOMIZE_VERSION=v4.5.7
+    KUSTOMIZE_VERSION=v4.4.0
    URL=https://github.com/kubernetes-sigs/kustomize/releases/download/kustomize/${KUSTOMIZE_VERSION}/kustomize_${KUSTOMIZE_VERSION}_linux_${ARCH}.tar.gz
    pssh "
    if [ ! -x /usr/local/bin/kustomize ]; then
@@ -551,7 +524,7 @@ EOF
    if [ ! -x /usr/local/bin/ship ]; then
        ##VERSION##
        curl -fsSL https://github.com/replicatedhq/ship/releases/download/v0.51.3/ship_0.51.3_linux_$ARCH.tar.gz |
-            sudo tar -C /usr/local/bin -zx ship
+             sudo tar -C /usr/local/bin -zx ship
    fi"

    # Install the AWS IAM authenticator
@@ -559,8 +532,8 @@ EOF
    if [ ! -x /usr/local/bin/aws-iam-authenticator ]; then
        ##VERSION##
        sudo curl -fsSLo /usr/local/bin/aws-iam-authenticator https://amazon-eks.s3-us-west-2.amazonaws.com/1.12.7/2019-03-27/bin/linux/$ARCH/aws-iam-authenticator
-	      sudo chmod +x /usr/local/bin/aws-iam-authenticator
-        aws-iam-authenticator version
+	sudo chmod +x /usr/local/bin/aws-iam-authenticator
+    aws-iam-authenticator version
    fi"

    # Install the krew package manager
@@ -577,7 +550,7 @@ EOF
    # Install k9s
    pssh "
    if [ ! -x /usr/local/bin/k9s ]; then
-        FILENAME=k9s_Linux_$ARCH.tar.gz &&
+        FILENAME=k9s_Linux_$HERP_DERP_ARCH.tar.gz &&
        curl -fsSL https://github.com/derailed/k9s/releases/latest/download/\$FILENAME |
        sudo tar -zxvf- -C /usr/local/bin k9s
        k9s version
@@ -602,7 +575,6 @@ EOF
        FILENAME=tilt.\$TILT_VERSION.linux.$TILT_ARCH.tar.gz
        curl -fsSL https://github.com/tilt-dev/tilt/releases/download/v\$TILT_VERSION/\$FILENAME |
        sudo tar -zxvf- -C /usr/local/bin tilt
-        tilt completion bash | sudo tee /etc/bash_completion.d/tilt
        tilt version
    fi"

@@ -611,7 +583,6 @@ EOF
    if [ ! -x /usr/local/bin/skaffold ]; then
        curl -fsSLo skaffold https://storage.googleapis.com/skaffold/releases/latest/skaffold-linux-$ARCH &&
        sudo install skaffold /usr/local/bin/
-        skaffold completion bash | sudo tee /etc/bash_completion.d/skaffold
        skaffold version
    fi"

@@ -620,39 +591,20 @@ EOF
    if [ ! -x /usr/local/bin/kompose ]; then
        curl -fsSLo kompose https://github.com/kubernetes/kompose/releases/latest/download/kompose-linux-$ARCH &&
        sudo install kompose /usr/local/bin
-        kompose completion bash | sudo tee /etc/bash_completion.d/kompose
        kompose version
    fi"

-    # Install KinD
-    pssh "
-    if [ ! -x /usr/local/bin/kind ]; then
-        curl -fsSLo kind https://github.com/kubernetes-sigs/kind/releases/latest/download/kind-linux-$ARCH &&
-        sudo install kind /usr/local/bin
-        kind completion bash | sudo tee /etc/bash_completion.d/kind
-        kind version
-    fi"
-
-    # Install YTT
-    pssh "
-    if [ ! -x /usr/local/bin/ytt ]; then
-        curl -fsSLo ytt https://github.com/vmware-tanzu/carvel-ytt/releases/latest/download/ytt-linux-$ARCH &&
-        sudo install ytt /usr/local/bin
-        ytt completion bash | sudo tee /etc/bash_completion.d/ytt
-        ytt version
-    fi"
-
    ##VERSION## https://github.com/bitnami-labs/sealed-secrets/releases
-    KUBESEAL_VERSION=0.17.4
-    #case $ARCH in
-    #amd64) FILENAME=kubeseal-linux-amd64;;
-    #arm64) FILENAME=kubeseal-arm64;;
-    #*)     FILENAME=nope;;
-    #esac
-    pssh "
+    KUBESEAL_VERSION=v0.16.0
+    case $ARCH in
+    amd64) FILENAME=kubeseal-linux-amd64;;
+    arm64) FILENAME=kubeseal-arm64;;
+    *)     FILENAME=nope;;
+    esac
+    [ "$FILENAME" = "nope" ] || pssh "
    if [ ! -x /usr/local/bin/kubeseal ]; then
-        curl -fsSL https://github.com/bitnami-labs/sealed-secrets/releases/download/v$KUBESEAL_VERSION/kubeseal-$KUBESEAL_VERSION-linux-$ARCH.tar.gz |
-        sudo tar -zxvf- -C /usr/local/bin kubeseal
+        curl -fsSLo kubeseal https://github.com/bitnami-labs/sealed-secrets/releases/download/$KUBESEAL_VERSION/$FILENAME &&
+        sudo install kubeseal /usr/local/bin
        kubeseal --version
    fi"
 }
--- a/prepare-vms/lib/infra/linode.sh
+++ b/prepare-vms/lib/infra/linode.sh
@@ -26,24 +26,12 @@ infra_start() {
        info "          Name: $NAME"
        info " Instance type: $LINODE_TYPE"
        ROOT_PASS="$(base64 /dev/urandom | cut -c1-20 | head -n 1)"
-        MAX_TRY=5
-        TRY=1
-        WAIT=1
-        while ! linode-cli linodes create \
+        linode-cli linodes create \
            --type=${LINODE_TYPE} --region=${LINODE_REGION} \
            --image=linode/ubuntu18.04 \
            --authorized_keys="${LINODE_SSHKEY}" \
            --root_pass="${ROOT_PASS}" \
-            --tags=${TAG} --label=${NAME}; do
-              warning "Failed to create VM (attempt $TRY/$MAX_TRY)."
-              if [ $TRY -ge $MAX_TRY ]; then
-                  die "Giving up."
-              fi
-              info "Waiting $WAIT seconds and retrying."
-              sleep $WAIT
-              TRY=$(($TRY+1))
-              WAIT=$(($WAIT*2))
-            done
+            --tags=${TAG} --label=${NAME}
    done
    sep

--- a/prepare-vms/map-dns.py
+++ b/prepare-vms/map-dns.py
@@ -36,7 +36,7 @@ if os.path.isfile(domain_or_domain_file):
    clusters = [line.split() for line in lines]
  else:
    ips = open(f"tags/{ips_file_or_tag}/ips.txt").read().split()
-    settings_file = f"tags/{ips_file_or_tag}/settings.yaml"
+    settings_file = f"tags/{tag}/settings.yaml"
    clustersize = yaml.safe_load(open(settings_file))["clustersize"]
    clusters = []
    while ips:
--- a/prepare-vms/netlify-dns.sh
+++ b/prepare-vms/netlify-dns.sh
@@ -17,17 +17,8 @@
  exit 1
 }

-NETLIFY_CONFIG_FILE=~/.config/netlify/config.json
-
-if ! [ -f "$NETLIFY_CONFIG_FILE" ]; then
-  echo "Could not find Netlify configuration file ($NETLIFY_CONFIG_FILE)."
-  echo "Try to run the following command, and try again:"
-  echo "npx netlify-cli login"
-  exit 1
-fi
-
-NETLIFY_USERID=$(jq .userId < "$NETLIFY_CONFIG_FILE")
-NETLIFY_TOKEN=$(jq -r .users[$NETLIFY_USERID].auth.token < "$NETLIFY_CONFIG_FILE")
+NETLIFY_USERID=$(jq .userId < ~/.config/netlify/config.json)
+NETLIFY_TOKEN=$(jq -r .users[$NETLIFY_USERID].auth.token < ~/.config/netlify/config.json)

 netlify() {
  URI=$1
--- a/prepare-vms/settings/admin-oldversion.yaml
+++ b/prepare-vms/settings/admin-oldversion.yaml
@@ -16,7 +16,7 @@ user_password: training

 # For a list of old versions, check:
 # https://kubernetes.io/releases/patch-releases/#non-active-branch-history
-kubernetes_version: 1.20.15
+kubernetes_version: 1.18.20

 image:

--- a/prepare-vms/terraform/azure/main.tf
+++ b/prepare-vms/terraform/azure/main.tf
@@ -1,71 +0,0 @@
-resource "azurerm_resource_group" "_" {
-  name          = var.prefix
-  location = var.location
-}
-
-resource "azurerm_public_ip" "_" {
-  count               = var.how_many_nodes
-  name                = format("%s-%04d", var.prefix, count.index + 1)
-  location            = azurerm_resource_group._.location
-  resource_group_name = azurerm_resource_group._.name
-  allocation_method = "Dynamic"
-}
-
-resource "azurerm_network_interface" "_" {
-  count               = var.how_many_nodes
-  name                = format("%s-%04d", var.prefix, count.index + 1)
-  location            = azurerm_resource_group._.location
-  resource_group_name = azurerm_resource_group._.name
-
-  ip_configuration {
-    name                          = "internal"
-    subnet_id                     = azurerm_subnet._.id
-    private_ip_address_allocation = "Dynamic"
-    public_ip_address_id = azurerm_public_ip._[count.index].id
-  }
-}
-
-resource "azurerm_linux_virtual_machine" "_" {
-  count               = var.how_many_nodes
-  name                = format("%s-%04d", var.prefix, count.index + 1)
-  resource_group_name = azurerm_resource_group._.name
-  location            = azurerm_resource_group._.location
-  size                = var.size
-  admin_username      = "ubuntu"
-  network_interface_ids = [
-    azurerm_network_interface._[count.index].id,
-  ]
-
-  admin_ssh_key {
-    username   = "ubuntu"
-    public_key = local.authorized_keys
-  }
-
-  os_disk {
-    caching              = "ReadWrite"
-    storage_account_type = "Standard_LRS"
-  }
-
-  source_image_reference {
-    publisher = "Canonical"
-    offer     = "UbuntuServer"
-    sku       = "18.04-LTS" # FIXME
-    version   = "latest"
-  }
-}
-
-# The public IP address only gets allocated when the address actually gets
-# attached to the virtual machine. So we need to do this extra indrection
-# to retrieve the IP addresses. Otherwise the IP addresses show up as blank.
-# See: https://github.com/hashicorp/terraform-provider-azurerm/issues/310#issuecomment-335479735
-
-data "azurerm_public_ip" "_" {
-  count               = var.how_many_nodes
-  name                = format("%s-%04d", var.prefix, count.index + 1)
-  resource_group_name = azurerm_resource_group._.name
-  depends_on = [azurerm_linux_virtual_machine._]
-}
-
-output "ip_addresses" {
-  value = join("", formatlist("%s\n", data.azurerm_public_ip._.*.ip_address))
-}
--- a/prepare-vms/terraform/azure/network.tf
+++ b/prepare-vms/terraform/azure/network.tf
@@ -1,13 +0,0 @@
-resource "azurerm_virtual_network" "_" {
-  name                = "tf-vnet"
-  address_space       = ["10.10.0.0/16"]
-  location            = azurerm_resource_group._.location
-  resource_group_name = azurerm_resource_group._.name
-}
-
-resource "azurerm_subnet" "_" {
-  name                 = "tf-subnet"
-  resource_group_name  = azurerm_resource_group._.name
-  virtual_network_name = azurerm_virtual_network._.name
-  address_prefixes     = ["10.10.0.0/20"]
-}
--- a/prepare-vms/terraform/azure/provider.tf
+++ b/prepare-vms/terraform/azure/provider.tf
@@ -1,13 +0,0 @@
-terraform {
-  required_version = ">= 1"
-  required_providers {
-    azurerm = {
-      source  = "hashicorp/azurerm"
-      version = "=3.33.0"
-    }
-  }
-}
-
-provider "azurerm" {
-  features {}
-}
--- a/prepare-vms/terraform/azure/variables.tf
+++ b/prepare-vms/terraform/azure/variables.tf
@@ -1,32 +0,0 @@
-variable "prefix" {
-  type    = string
-  default = "provisioned-with-terraform"
-}
-
-variable "how_many_nodes" {
-  type    = number
-  default = 2
-}
-
-locals {
-  authorized_keys = file("~/.ssh/id_rsa.pub")
-}
-
-/*
-Available sizes:
-"Standard_D11_v2" # CPU=2 RAM=14
-"Standard_F4s_v2" # CPU=4 RAM=8
-"Standard_D1_v2"  # CPU=1 RAM=3.5
-"Standard_B1ms"   # CPU=1 RAM=2
-"Standard_B2s"    # CPU=2 RAM=4
-*/
-
-variable "size" {
-  type    = string
-  default = "Standard_F4s_v2"
-}
-
-variable "location" {
-  type    = string
-  default = "South Africa North"
-}
--- a/slides/autopilot/package-lock.json
+++ b/slides/autopilot/package-lock.json
--- a/slides/autopilot/package.json
+++ b/slides/autopilot/package.json
@@ -3,7 +3,6 @@
  "version": "0.0.1",
  "dependencies": {
    "express": "^4.16.2",
-    "socket.io": "^4.5.1",
-    "socket.io-client": "^4.5.1"
+    "socket.io": "^2.4.0"
  }
 }
--- a/slides/containers/Ambassadors.md
+++ b/slides/containers/Ambassadors.md
@@ -19,7 +19,7 @@ They abstract the connection details for this services, and can help with:

 * fail over (how do I know to which instance of a replicated service I should connect?)

-* load balancing (how do I spread my requests across multiple instances of a service?)
+* load balancing (how to I spread my requests across multiple instances of a service?)

 * authentication (what if my service requires credentials, certificates, or otherwise?)

--- a/slides/containers/Compose_For_Dev_Stacks.md
+++ b/slides/containers/Compose_For_Dev_Stacks.md
@@ -58,7 +58,7 @@ class: pic

  - it uses different concepts (Compose services ≠ Kubernetes services)

-  - it needs a Docker Engine (although containerd support might be coming)
+  - it needs a Docker Engine (althought containerd support might be coming)

 ---

--- a/slides/containers/Container_Networking_Basics.md
+++ b/slides/containers/Container_Networking_Basics.md
@@ -35,7 +35,7 @@ At the end of this section, you will be able to:

 ---

-## Running an NGINX server
+## Runing an NGINX server

 ```bash
 $ docker run -d -P nginx
--- a/slides/containers/Dockerfile_Tips.md
+++ b/slides/containers/Dockerfile_Tips.md
@@ -111,7 +111,7 @@ CMD ["python", "app.py"]
    RUN wget http://.../foo.tar.gz \
     && tar -zxf foo.tar.gz \
     && mv foo/fooctl /usr/local/bin \
-     && rm -rf foo foo.tar.gz
+     && rm -rf foo
  ...
  ```

--- a/slides/containers/Local_Development_Workflow.md
+++ b/slides/containers/Local_Development_Workflow.md
@@ -317,11 +317,9 @@ class: extra-details
 ## Trash your servers and burn your code

 *(This is the title of a
-[2013 blog post][immutable-deployments]
+[2013 blog post](http://chadfowler.com/2013/06/23/immutable-deployments.html)
 by Chad Fowler, where he explains the concept of immutable infrastructure.)*

-[immutable-deployments]: https://web.archive.org/web/20160305073617/http://chadfowler.com/blog/2013/06/23/immutable-deployments/
-
 --

 * Let's majorly mess up our container.
--- a/slides/containers/intro.md
+++ b/slides/containers/intro.md
@@ -13,7 +13,7 @@
 - ... Or be comfortable spending some time reading the Docker
 [documentation](https://docs.docker.com/) ...

- ... And looking for answers in the [Docker forums](https://forums.docker.com),
+- ... And looking for answers in the [Docker forums](forums.docker.com),
  [StackOverflow](http://stackoverflow.com/questions/tagged/docker),
  and other outlets

--- a/slides/count-slides.py
+++ b/slides/count-slides.py
@@ -1,75 +1,57 @@
 #!/usr/bin/env python
 import re
 import sys
-import yaml
-
-FIRST_SLIDE_MARKER = "name: toc-"
-PART_PREFIX = "part-"
-
-filename = sys.argv[1]
-if filename.endswith(".html"):
-    html_file = filename
-    yaml_file = filename[: -len(".html")]
-else:
-    html_file = filename + ".html"
-    yaml_file = filename
-excluded_classes = yaml.safe_load(open(yaml_file))["exclude"]

+PREFIX = "name: toc-"
+EXCLUDED = ["in-person"]

 class State(object):
    def __init__(self):
-        self.current_slide = -1
-        self.parts = {}
-
-    def end_section(self):
-        if state.section_title:
-            print(
-                "{0.section_start}\t{0.section_slides}\t{0.section_title}".format(self)
-            )
-        if self.section_part:
-            if self.section_part not in self.parts:
-                self.parts[self.section_part] = 0
-            self.parts[self.section_part] += self.section_slides
-
-    def new_section(self, slide):
-        # Normally, the title should be prefixed by a space
-        # (because section titles are first-level titles in markdown,
-        # e.g. "# Introduction", and markmaker removes the # but leaves
-        # the leading space).
+        self.current_slide = 1
        self.section_title = None
-        if "\n " in slide:
-            self.section_title = slide.split("\n ")[1].split("\n")[0]
-        toc_links = re.findall("\(#toc-(.*)\)", slide)
-        self.section_part = None
-        for toc_link in toc_links:
-            if toc_link.startswith(PART_PREFIX):
-                self.section_part = toc_link
-        self.section_start = self.current_slide
+        self.section_start = 0
        self.section_slides = 0
-
+        self.parts = {}
+        self.sections = {}
+    def show(self):
+        if self.section_title.startswith("part-"):
+            return
+        print("{0.section_title}\t{0.section_start}\t{0.section_slides}".format(self))
+        self.sections[self.section_title] = self.section_slides

 state = State()
-state.new_section("")
-print("{}\t{}\t{}".format("index", "size", "title"))

-for slide in open(html_file).read().split("\n---\n"):
-    excluded = False
-    for line in slide.split("\n"):
-        if line.startswith("class:"):
-            for klass in excluded_classes:
-                if klass in line.split():
-                    excluded = True
-    if excluded:
-        continue
-    if FIRST_SLIDE_MARKER in slide:
-        # A new section starts. Show info about the part that just ended.
-        state.end_section()
-        state.new_section(slide)
-    state.section_slides += 1
-    for sub_slide in slide.split("\n--\n"):
+title = None
+for line in open(sys.argv[1]):
+    line = line.rstrip()
+    if line.startswith(PREFIX):
+        if state.section_title is None:
+            print("{}\t{}\t{}".format("title", "index", "size"))
+        else:
+            state.show()
+        state.section_title = line[len(PREFIX):].strip()
+        state.section_start = state.current_slide
+        state.section_slides = 0
+    if line == "---":
        state.current_slide += 1
-else:
-    state.end_section()
+        state.section_slides += 1
+    if line == "--":
+        state.current_slide += 1
+    toc_links = re.findall("\(#toc-(.*)\)", line)
+    if toc_links and state.section_title.startswith("part-"):
+        if state.section_title not in state.parts:
+            state.parts[state.section_title] = []
+        state.parts[state.section_title].append(toc_links[0])
+    # This is really hackish
+    if line.startswith("class:"):
+        for klass in EXCLUDED:
+            if klass in line:
+                state.section_slides -= 1
+                state.current_slide -= 1
+
+state.show()

 for part in sorted(state.parts, key=lambda f: int(f.split("-")[1])):
-    print("{}\t{}\t{}".format(0, state.parts[part], "total size for " + part))
+    part_size = sum(state.sections[s] for s in state.parts[part])
+    print("{}\t{}\t{}".format("total size for", part, part_size))
+
--- a/slides/exercises/healthchecks-brief.md
+++ b/slides/exercises/healthchecks-brief.md
@@ -4,6 +4,6 @@

  (we will use the `rng` service in the dockercoins app)

- See what happens when the load increases
+- See what happens when the load increses

  (spoiler alert: it involves timeouts!)
--- a/slides/exercises/ingress-brief.md
+++ b/slides/exercises/ingress-brief.md
@@ -2,7 +2,7 @@

 - Add an ingress controller to a Kubernetes cluster

- Create an ingress resource for a couple of web apps on that cluster
+- Create an ingress resource for a web app on that cluster

 - Challenge: accessing/exposing port 80

--- a/slides/exercises/ingress-details.md
+++ b/slides/exercises/ingress-details.md
@@ -1,131 +1,49 @@
 # Exercise — Ingress

- We want to expose a couple of web apps through an ingress controller
+- We want to expose a web app through an ingress controller

 - This will require:

-  - the web apps (e.g. two instances of `jpetazzo/color`)
+  - the web app itself (dockercoins, NGINX, whatever we want)

  - an ingress controller

+  - a domain name (`use \*.nip.io` or `\*.localdev.me`)
+
  - an ingress resource

 ---

-## Different scenarios
+## Goal

-We will use a different deployment mechanism depending on the cluster that we have:
+- We want to be able to access the web app using a URL like:

- Managed cluster with working `LoadBalancer` Services
+  http://webapp.localdev.me

- Local development cluster
+  *or*

- Cluster without `LoadBalancer` Services (e.g. deployed with `kubeadm`)
+  http://webapp.A.B.C.D.nip.io

---
-
-## The apps
-
- The web apps will be deployed similarly, regardless of the scenario
-
- Let's start by deploying two web apps, e.g.:
-
-  a Deployment called `blue` and another called `green`, using image `jpetazzo/color`
-
- Expose them with two `ClusterIP` Services
-
---
-
-## Scenario "classic cloud Kubernetes"
-
-*Difficulty: easy*
-
-For this scenario, we need a cluster with working `LoadBalancer` Services.
-
-(For instance, a managed Kubernetes cluster from a cloud provider.)
-
-We suggest to use "Ingress NGINX" with its default settings.
-
-It can be installed with `kubectl apply` or with `helm`.
-
-Both methods are described in [the documentation][ingress-nginx-deploy].
-
-We want our apps to be available on e.g. http://X.X.X.X/blue and http://X.X.X.X/green
-<br/>
-(where X.X.X.X is the IP address of the `LoadBalancer` allocated by Ingress NGINX).
-
-[ingress-nginx-deploy]: https://kubernetes.github.io/ingress-nginx/deploy/
-
---
-
-## Scenario "local development cluster"
-
-*Difficulty: easy-hard (depends on the type of cluster!)*
-
-For this scenario, we want to use a local cluster like KinD, minikube, etc.
-
-We suggest to use "Ingress NGINX" again, like for the previous scenario.
-
-Furthermore, we want to use `localdev.me`.
-
-We want our apps to be available on e.g. `blue.localdev.me` and `green.localdev.me`.
-
-The difficulty is to ensure that `localhost:80` will map to the ingress controller.
-
-(See next slide for hints!)
+  (where A.B.C.D is the IP address of one of our nodes)

 ---

 ## Hints

- With clusters like Docker Desktop, the first `LoadBalancer` service uses `localhost`
+- For the ingress controller, we can use:

-  (if the ingress controller is the first `LoadBalancer` service, we're all set!)
+  - [ingress-nginx](https://github.com/kubernetes/ingress-nginx/blob/main/docs/deploy/index.md)

- With clusters like K3D and KinD, it is possible to define extra port mappings
+  - the [Traefik Helm chart](https://doc.traefik.io/traefik/getting-started/install-traefik/#use-the-helm-chart)

-  (and map e.g. `localhost:80` to port 30080 on the node; then use that as a `NodePort`)
+  - the container.training [Traefik DaemonSet](https://raw.githubusercontent.com/jpetazzo/container.training/main/k8s/traefik-v2.yaml)

---
+- If our cluster supports LoadBalancer Services: easy

-## Scenario "on premises cluster", take 1
+  (nothing special to do)

-*Difficulty: easy*
+- For local clusters, things can be more difficult; two options:

-For this scenario, we need a cluster with nodes that are publicly accessible.
+  - map localhost:80 to e.g. a NodePort service, and use `\*.localdev.me`

-We want to deploy the ingress controller so that it listens on port 80 on all nodes.
-
-This can be done e.g. with the manifests in @@LINK[k8s/traefik.yaml].
-
-We want our apps to be available on e.g. http://X.X.X.X/blue and http://X.X.X.X/green
-<br/>
-(where X.X.X.X is the IP address of any of our nodes).
-
---
-
-## Scenario "on premises cluster", take 2
-
-*Difficulty: medium*
-
-We want to deploy the ingress controller so that it listens on port 80 on all nodes.
-
-But this time, we want to use a Helm chart to install the ingress controller.
-
-We can use either the Ingress NGINX Helm chart, or the Traefik Helm chart.
-
-Test with an untainted node first.
-
-Feel free to make it work on tainted nodes (e.g. control plane nodes) later.
-
---
-
-## Scenario "on premises cluster", take 3
-
-*Difficulty: hard*
-
-This is similar to the previous scenario, but with two significant changes:
-
-1. We only want to run the ingress controller on nodes that have the role `ingress`.
-
-2. We don't want to use `hostNetwork`, but a list of `externalIPs` instead.
+  - use hostNetwork, or ExternalIP, and use `\*.nip.io`
--- a/slides/exercises/netpol-brief.md
+++ b/slides/exercises/netpol-brief.md
@@ -1,7 +0,0 @@
-## Exercise — Network Policies
-
- Implement a system with 3 levels of security
-
-  (private pods, public pods, namespace pods)
-
- Apply it to the DockerCoins demo app
--- a/slides/exercises/netpol-details.md
+++ b/slides/exercises/netpol-details.md
@@ -1,63 +0,0 @@
-# Exercise — Network Policies
-
-We want to to implement a generic network security mechanism.
-
-Instead of creating one policy per service, we want to
-create a fixed number of policies, and use a single label
-to indicate the security level of our pods.
-
-Then, when adding a new service to the stack, instead
-of writing a new network policy for that service, we
-only need to add the right label to the pods of that service.
-
---
-
-## Specifications
-
-We will use the label `security` to classify our pods.
-
- If `security=private`:
-
-  *the pod shouldn't accept any traffic*
-
- If `security=public`:
-
-  *the pod should accept all traffic*
-
- If `security=namespace`:
-
-  *the pod should only accept connections coming from the same namespace*
-
-If `security` isn't set, assume it's `private`.
-
---
-
-## Test setup
-
- Deploy a copy of the DockerCoins app in a new namespace
-
- Modify the pod templates so that:
-
-  - `webui` has `security=public`
-
-  - `worker` has `security=private`
-
-  - `hasher`, `redis`, `rng` have `security=namespace`
-
---
-
-## Implement and test policies
-
- Write the network policies
-
-  (feel free to draw inspiration from the ones we've seen so far)
-
- Check that:
-
-  - you can connect to the `webui` from outside the cluster
-
-  - the application works correctly (shows 3-4 hashes/second)
-
-  - you cannot connect to the `hasher`, `redis`, `rng` services
-
-  - you cannot connect or even ping the `worker` pods
--- a/slides/exercises/rbac-brief.md
+++ b/slides/exercises/rbac-brief.md
@@ -1,9 +0,0 @@
-## Exercise — RBAC
-
- Create two namespaces for users `alice` and `bob`
-
- Give each user full access to their own namespace
-
- Give each user read-only access to the other's namespace
-
- Let `alice` view the nodes of the cluster as well
--- a/slides/exercises/rbac-details.md
+++ b/slides/exercises/rbac-details.md
@@ -1,97 +0,0 @@
-# Exercise — RBAC
-
-We want to:
-
- Create two namespaces for users `alice` and `bob`
-
- Give each user full access to their own namespace
-
- Give each user read-only access to the other's namespace
-
- Let `alice` view the nodes of the cluster as well
-
---
-
-## Initial setup
-
- Create two namespaces named `alice` and `bob`
-
- Check that if we impersonate Alice, we can't access her namespace yet:
-  ```bash
-  kubectl --as alice get pods --namespace alice
-  ```
-
---
-
-## Access for Alice
-
- Grant Alice full access to her own namespace
-
-  (you can use a pre-existing Cluster Role)
-
- Check that Alice can create stuff in her namespace:
-  ```bash
-  kubectl --as alice create deployment hello --image nginx --namespace alice
-  ```
-
- But that she can't create stuff in Bob's namespace:
-  ```bash
-  kubectl --as alice create deployment hello --image nginx --namespace bob
-  ```
-
---
-
-## Access for Bob
-
- Similarly, grant Bob full access to his own namespace
-
- Check that Bob can create stuff in his namespace:
-  ```bash
-  kubectl --as bob create deployment hello --image nginx --namespace bob
-  ```
-
- But that he can't create stuff in Alice's namespace:
-  ```bash
-  kubectl --as bob create deployment hello --image nginx --namespace alice
-  ```
-
---
-
-## Read-only access
-
- Now, give Alice read-only access to Bob's namespace
-
- Check that Alice can view Bob's stuff:
-  ```bash
-  kubectl --as alice get pods --namespace bob
-  ```
-
- But that she can't touch this:
-  ```bash
-  kubectl --as alice delete pods --namespace bob --all
-  ```
-
- Likewise, give Bob read-only access to Alice's namespace
-
---
-
-## Nodes
-
- Give Alice read-only access to the cluster nodes
-
-  (this will require creating a custom Cluster Role)
-
- Check that Alice can view the nodes:
-  ```bash
-  kubectl --as alice get nodes
-  ```
-
- But that Bob cannot:
-  ```bash
-  kubectl --as bob get nodes
-  ```
-
- And that Alice can't update nodes:
-  ```bash
-  kubectl --as alice label nodes --all hello=world
-  ```
--- a/slides/images/canary-cage.jpg
+++ b/slides/images/canary-cage.jpg
--- a/slides/interstitials.txt
+++ b/slides/interstitials.txt
@@ -13,4 +13,3 @@ https://gallant-turing-d0d520.netlify.com/containers/train-of-containers-1.jpg
 https://gallant-turing-d0d520.netlify.com/containers/train-of-containers-2.jpg
 https://gallant-turing-d0d520.netlify.com/containers/two-containers-on-a-truck.jpg
 https://gallant-turing-d0d520.netlify.com/containers/wall-of-containers.jpeg
-https://gallant-turing-d0d520.netlify.com/containers/catene-de-conteneurs.jpg
--- a/slides/k8s/authn-authz.md
+++ b/slides/k8s/authn-authz.md
@@ -168,7 +168,7 @@ class: extra-details

  (`O=system:nodes`, `CN=system:node:name-of-the-node`)

- The Kubernetes API can act as a CA
+- The Kubernetse API can act as a CA

  (by wrapping an X509 CSR into a CertificateSigningRequest resource)

@@ -246,7 +246,7 @@ class: extra-details

  (they don't require hand-editing a file and restarting the API server)

- A service account can be associated with a set of secrets
+- A service account is associated with a set of secrets

  (the kind that you can view with `kubectl get secrets`)

@@ -256,28 +256,6 @@ class: extra-details

 ---

-## Service account tokens evolution
-
- In Kubernetes 1.21 and above, pods use *bound service account tokens*:
-
-  - these tokens are *bound* to a specific object (e.g. a Pod)
-
-  - they are automatically invalidated when the object is deleted
-
-  - these tokens also expire quickly (e.g. 1 hour) and gets rotated automatically
-
- In Kubernetes 1.24 and above, unbound tokens aren't created automatically
-
-  - before 1.24, we would see unbound tokens with `kubectl get secrets`
-
-  - with 1.24 and above, these tokens can be created with `kubectl create token`
-
-  - ...or with a Secret with the right [type and annotation][create-token]
-
-[create-token]: https://kubernetes.io/docs/reference/access-authn-authz/service-accounts-admin/#create-token
-
---
-
 class: extra-details

 ## Checking our authentication method
@@ -412,10 +390,6 @@ class: extra-details

 It should be named `default-token-XXXXX`.

-When running Kubernetes 1.24 and above, this Secret won't exist.
-<br/>
-Instead, create a token with `kubectl create token default`.
-
 ---

 class: extra-details
--- a/slides/k8s/bootstrap.md
+++ b/slides/k8s/bootstrap.md
@@ -202,9 +202,7 @@ class: extra-details

 - These are JWS signatures using HMAC-SHA256

-  (see [the reference documentation][configmap-signing] for more details)
-
-[configmap-signing]: https://kubernetes.io/docs/reference/access-authn-authz/bootstrap-tokens/#configmap-signing
+  (see [here](https://kubernetes.io/docs/reference/access-authn-authz/bootstrap-tokens/#configmap-signing) for more details)

 ---

--- a/slides/k8s/cainjector.md
+++ b/slides/k8s/cainjector.md
@@ -1,60 +0,0 @@
-## CA injector - overview
-
- The Kubernetes API server can invoke various webhooks:
-
-  - conversion webhooks (registered in CustomResourceDefinitions)
-
-  - mutation webhooks (registered in MutatingWebhookConfigurations)
-
-  - validation webhooks (registered in ValidatingWebhookConfiguration)
-
- These webhooks must be served over TLS
-
- These webhooks must use valid TLS certificates
-
---
-
-## Webhook certificates
-
- Option 1: certificate issued by a global CA
-
-  - doesn't work with internal services
-    <br/>
-    (their CN must be `<servicename>.<namespace>.svc`)
-
- Option 2: certificate issued by private CA + CA certificate in system store
-
-  - requires access to API server certificates tore
-
-  - generally not doable on managed Kubernetes clusters
-
- Option 3: certificate issued by private CA + CA certificate in `caBundle`
-
-  - pass the CA certificate in `caBundle` field
-    <br/>
-    (in CRD or webhook manifests)
-
-  - can be managed automatically by cert-manager
-
---
-
-## CA injector - details
-
- Add annotation to *injectable* resource
-  (CustomResouceDefinition, MutatingWebhookConfiguration, ValidatingWebhookConfiguration)
-
- Annotation refers to the thing holding the certificate:
-
-  - `cert-manager.io/inject-ca-from: <namespace>/<certificate>`
-
-  - `cert-manager.io/inject-ca-from-secret: <namespace>/<secret>`
-
-  - `cert-manager.io/inject-apiserver-ca: true` (use API server CA)
-
- When injecting from a Secret, the Secret must have a special annotation:
-
-  `cert-manager.io/allow-direct-injection: "true"`
-
- See [cert-manager documentation][docs] for details
-
-[docs]: https://cert-manager.io/docs/concepts/ca-injector/
--- a/slides/k8s/cluster-autoscaler.md
+++ b/slides/k8s/cluster-autoscaler.md
@@ -48,7 +48,7 @@

 - We must run nodes on a supported infrastructure

- Check the [GitHub repo][autoscaler-providers] for a non-exhaustive list of supported providers
+- See [here] for a non-exhaustive list of supported providers

 - Sometimes, the cluster autoscaler is installed automatically

@@ -58,7 +58,7 @@

  (which is often non-trivial and highly provider-specific)

-[autoscaler-providers]: https://github.com/kubernetes/autoscaler/tree/master/cluster-autoscaler/cloudprovider
+[here]: https://github.com/kubernetes/autoscaler/tree/master/cluster-autoscaler/cloudprovider

 ---

--- a/slides/k8s/cluster-sizing.md
+++ b/slides/k8s/cluster-sizing.md
@@ -138,7 +138,7 @@ class: extra-details

 - The Cluster Autoscaler only supports a few cloud infrastructures

-  (see the [kubernetes/autoscaler repo][kubernetes-autoscaler-repo] for a list)
+  (see [here](https://github.com/kubernetes/autoscaler/tree/master/cluster-autoscaler/cloudprovider) for a list)

 - The Cluster Autoscaler cannot scale down nodes that have pods using:

@@ -148,8 +148,6 @@ class: extra-details

  - a restrictive PodDisruptionBudget

-[kubernetes-autoscaler-repo]: https://github.com/kubernetes/autoscaler/tree/master/cluster-autoscaler/cloudprovider
-
 ---

 ## Other way to do capacity planning
--- a/slides/k8s/cluster-upgrade.md
+++ b/slides/k8s/cluster-upgrade.md
@@ -81,7 +81,7 @@

 ## What version are we running anyway?

- When I say, "I'm running Kubernetes 1.20", is that the version of:
+- When I say, "I'm running Kubernetes 1.18", is that the version of:

  - kubectl

@@ -157,15 +157,15 @@

 ## Kubernetes uses semantic versioning

- Kubernetes versions look like MAJOR.MINOR.PATCH; e.g. in 1.20.15:
+- Kubernetes versions look like MAJOR.MINOR.PATCH; e.g. in 1.18.20:

  - MAJOR = 1
-  - MINOR = 20
-  - PATCH = 15
+  - MINOR = 18
+  - PATCH = 20

 - It's always possible to mix and match different PATCH releases

-  (e.g. 1.20.0 and 1.20.15 are compatible)
+  (e.g. 1.18.20 and 1.18.15 are compatible)

 - It is recommended to run the latest PATCH release

@@ -181,9 +181,9 @@

 - All components support a difference of one¹ MINOR version

- This allows live upgrades (since we can mix e.g. 1.20 and 1.21)
+- This allows live upgrades (since we can mix e.g. 1.18 and 1.19)

- It also means that going from 1.20 to 1.22 requires going through 1.21
+- It also means that going from 1.18 to 1.20 requires going through 1.19

 .footnote[¹Except kubelet, which can be up to two MINOR behind API server,
 and kubectl, which can be one MINOR ahead or behind API server.]
@@ -254,7 +254,7 @@ and kubectl, which can be one MINOR ahead or behind API server.]
  sudo vim /etc/kubernetes/manifests/kube-apiserver.yaml
  ```

- Look for the `image:` line, and update it to e.g. `v1.24.0`
+- Look for the `image:` line, and update it to e.g. `v1.19.0`

 ]

@@ -308,11 +308,11 @@ and kubectl, which can be one MINOR ahead or behind API server.]

 ]

-Note 1: kubeadm thinks that our cluster is running 1.24.0.
+Note 1: kubeadm thinks that our cluster is running 1.19.0.
 <br/>It is confused by our manual upgrade of the API server!

-Note 2: kubeadm itself is still version 1.20.15..
-<br/>It doesn't know how to upgrade do 1.21.X.
+Note 2: kubeadm itself is still version 1.18.20..
+<br/>It doesn't know how to upgrade do 1.19.X.

 ---

@@ -335,28 +335,28 @@ Note 2: kubeadm itself is still version 1.20.15..
 ]

 Problem: kubeadm doesn't know know how to handle
-upgrades from version 1.20.
+upgrades from version 1.18.

-This is because we installed version 1.24 (or even later).
+This is because we installed version 1.22 (or even later).

-We need to install kubeadm version 1.21.X.
+We need to install kubeadm version 1.19.X.

 ---

 ## Downgrading kubeadm

- We need to go back to version 1.21.X.
+- We need to go back to version 1.19.X.

 .lab[

 - View available versions for package `kubeadm`:
  ```bash
-  apt show kubeadm -a | grep ^Version | grep 1.21
+  apt show kubeadm -a | grep ^Version | grep 1.19
  ```

 - Downgrade kubeadm:
  ```
-  sudo apt install kubeadm=1.21.0-00
+  sudo apt install kubeadm=1.19.8-00
  ```

 - Check what kubeadm tells us:
@@ -366,7 +366,7 @@ We need to install kubeadm version 1.21.X.

 ]

-kubeadm should now agree to upgrade to 1.21.X.
+kubeadm should now agree to upgrade to 1.19.8.

 ---

@@ -464,9 +464,9 @@ kubeadm should now agree to upgrade to 1.21.X.
  ```bash
    for N in 1 2 3; do
      ssh oldversion$N "
-        sudo apt install kubeadm=1.21.14-00 &&
+        sudo apt install kubeadm=1.19.8-00 &&
        sudo kubeadm upgrade node &&
-        sudo apt install kubelet=1.21.14-00"
+        sudo apt install kubelet=1.19.8-00"
    done
  ```
 ]
@@ -475,7 +475,7 @@ kubeadm should now agree to upgrade to 1.21.X.

 ## Checking what we've done

- All our nodes should now be updated to version 1.21.14
+- All our nodes should now be updated to version 1.19.8

 .lab[

@@ -492,7 +492,7 @@ class: extra-details

 ## Skipping versions

- This example worked because we went from 1.20 to 1.21
+- This example worked because we went from 1.18 to 1.19

 - If you are upgrading from e.g. 1.16, you will have to go through 1.17 first

--- a/slides/k8s/cni.md
+++ b/slides/k8s/cni.md
@@ -24,11 +24,11 @@

 - Interface parameters (MTU, sysctls) could be tweaked by the `tuning` plugin

-The reference plugins are available [here][cni-reference-plugins].
+The reference plugins are available [here].

 Look in each plugin's directory for its documentation.

-[cni-reference-plugins]: https://github.com/containernetworking/plugins/tree/master/plugins
+[here]: https://github.com/containernetworking/plugins/tree/master/plugins

 ---

@@ -404,17 +404,17 @@ class: extra-details

 - Create a Deployment running a web server:
  ```bash
-  kubectl create deployment blue --image=jpetazzo/color
+  kubectl create deployment web --image=jpetazzo/httpenv
  ```

 - Scale it so that it spans multiple nodes:
  ```bash
-  kubectl scale deployment blue --replicas=5
+  kubectl scale deployment web --replicas=5
  ```

 - Expose it with a Service:
  ```bash
-  kubectl expose deployment blue --port=8888
+  kubectl expose deployment web --port=8888
  ```

 ]
--- a/slides/k8s/concepts-k8s.md
+++ b/slides/k8s/concepts-k8s.md
@@ -79,20 +79,6 @@

  (blue/green deployment, canary deployment)

--
-
-.footnote[
-On the next page: canary cage with an oxygen bottle, designed to keep the canary alive.
-<br/>
-(See https://post.lurk.org/@zilog/109632335293371919 for details.)
-]
-
---
-
-class: pic
-
-![Canary cage](images/canary-cage.jpg)
-
 ---

 ## More things that Kubernetes can do for us
@@ -301,9 +287,7 @@ No!

 --

- The Docker Engine used to be the default option to run containers with Kubernetes
-
- Support for Docker (specifically: dockershim) was removed in Kubernetes 1.24
+- By default, Kubernetes uses the Docker Engine to run containers

 - We can leverage other pluggable runtimes through the *Container Runtime Interface*

@@ -345,26 +329,32 @@ Yes!

 - We can do these things without Docker
  <br/>
-  (but with some languages/frameworks, it might be much harder)
+  (and get diagnosed with NIH¹ syndrome)

 - Docker is still the most stable container engine today
  <br/>
  (but other options are maturing very quickly)

+.footnote[¹[Not Invented Here](https://en.wikipedia.org/wiki/Not_invented_here)]
+
 ---

 class: extra-details

 ## Do we need to run Docker at all?

- On our Kubernetes clusters:
-
-  *Not anymore*
-
 - On our development environments, CI pipelines ... :

  *Yes, almost certainly*

+- On our production servers:
+
+  *Yes (today)*
+
+  *Probably not (in the future)*
+
+.footnote[More information about CRI [on the Kubernetes blog](https://kubernetes.io/blog/2016/12/container-runtime-interface-cri-in-kubernetes)]
+
 ---

 ## Interacting with Kubernetes
--- a/slides/k8s/crd.md
+++ b/slides/k8s/crd.md
@@ -14,20 +14,22 @@

 ## Creating a CRD

- We will create a CRD to represent different recipes of pizzas
+- We will create a CRD to represent the different species of coffee

- We will be able to run `kubectl get pizzas` and it will list the recipes
+  (arabica, liberica, and robusta)

- Creating/deleting recipes won't do anything else
+- We will be able to run `kubectl get coffees` and it will list the species

-  (because we won't implement a *controller*)
+- Then we can label, edit, etc. the species to attach some information
+
+  (e.g. the taste profile of the coffee, or whatever we want)

 ---

-## First slice of pizza
+## First shot of coffee

 ```yaml
-@@INCLUDE[k8s/pizza-1.yaml]
+@@INCLUDE[k8s/coffee-1.yaml]
 ```

 ---
@@ -46,9 +48,9 @@

 ---

-## Second slice of pizza
+## Second shot of coffee

- The next slide will show file @@LINK[k8s/pizza-2.yaml]
+- The next slide will show file @@LINK[k8s/coffee-2.yaml]

 - Note the `spec.versions` list

@@ -63,20 +65,20 @@
 ---

 ```yaml
-@@INCLUDE[k8s/pizza-2.yaml]
+@@INCLUDE[k8s/coffee-2.yaml]
 ```

 ---

-## Baking some pizza
+## Creating our Coffee CRD

- Let's create the Custom Resource Definition for our Pizza resource
+- Let's create the Custom Resource Definition for our Coffee resource

 .lab[

 - Load the CRD:
  ```bash
-  kubectl apply -f ~/container.training/k8s/pizza-2.yaml
+  kubectl apply -f ~/container.training/k8s/coffee-2.yaml
  ```

 - Confirm that it shows up:
@@ -93,57 +95,19 @@
 The YAML below defines a resource using the CRD that we just created:

 ```yaml
-kind: Pizza
+kind: Coffee
 apiVersion: container.training/v1alpha1
 metadata:
-  name: napolitana
+  name: arabica
 spec:
-  toppings: [ mozzarella ]
+  taste: strong
 ```

 .lab[

- Try to create a few pizza recipes:
+- Create a few types of coffee beans:
  ```bash
-  kubectl apply -f ~/container.training/k8s/pizzas.yaml
-  ```
-
-]
-
---
-
-## Type validation
-
- Older versions of Kubernetes will accept our pizza definition as is
-
- Newer versions, however, will issue warnings about unknown fields
-
-  (and if we use `--validate=false`, these fields will simply be dropped)
-
- We need to improve our OpenAPI schema
-
-  (to add e.g. the `spec.toppings` field used by our pizza resources)
-
---
-
-## Third slice of pizza
-
- Let's add a full OpenAPI v3 schema to our Pizza CRD
-
- We'll require a field `spec.sauce` which will be a string
-
- And a field `spec.toppings` which will have to be a list of strings
-
-.lab[
-
- Update our pizza CRD:
-  ```bash
-  kubectl apply -f ~/container.training/k8s/pizza-3.yaml
-  ```
-
- Load our pizza recipes:
-  ```bash
-  kubectl apply -f ~/container.training/k8s/pizzas.yaml
+  kubectl apply -f ~/container.training/k8s/coffees.yaml
  ```

 ]
@@ -156,48 +120,91 @@ spec:

 .lab[

- View the pizza recipes that we just created:
+- View the coffee beans that we just created:
  ```bash
-  kubectl get pizzas
+  kubectl get coffees
  ```

 ]

- Let's see how we can improve that display!
+- We'll see in a bit how to improve that
+
+---
+
+## What can we do with CRDs?
+
+There are many possibilities!
+
+- *Operators* encapsulate complex sets of resources
+
+  (e.g.: a PostgreSQL replicated cluster; an etcd cluster...
+  <br/>
+  see [awesome operators](https://github.com/operator-framework/awesome-operators) and
+  [OperatorHub](https://operatorhub.io/) to find more)
+
+- Custom use-cases like [gitkube](https://gitkube.sh/)
+
+  - creates a new custom type, `Remote`, exposing a git+ssh server
+
+  - deploy by pushing YAML or Helm charts to that remote
+
+- Replacing built-in types with CRDs
+
+  (see [this lightning talk by Tim Hockin](https://www.youtube.com/watch?v=ji0FWzFwNhA))
+
+---
+
+## What's next?
+
+- Creating a basic CRD is quick and easy
+
+- But there is a lot more that we can (and probably should) do:
+
+  - improve input with *data validation*
+
+  - improve output with *custom columns*
+
+- And of course, we probably need a *controller* to go with our CRD!
+
+  (otherwise, we're just using the Kubernetes API as a fancy data store)

 ---

 ## Additional printer columns

- We can tell Kubernetes which columns to show:
-  ```yaml
-    additionalPrinterColumns:
-    - jsonPath: .spec.sauce
-      name: Sauce
-      type: string
-    - jsonPath: .spec.toppings
-      name: Toppings
-      type: string
-  ```
+- We can specify `additionalPrinterColumns` in the CRD

- There is an updated CRD in @@LINK[k8s/pizza-4.yaml]
+- This is similar to `-o custom-columns`
+
+  (map a column name to a path in the object, e.g. `.spec.taste`)
+
+```yaml
+    additionalPrinterColumns:
+    - jsonPath: .spec.taste
+      description: Subjective taste of that kind of coffee bean
+      name: Taste
+      type: string
+    - jsonPath: .metadata.creationTimestamp
+      name: Age
+      type: date
+```

 ---

 ## Using additional printer columns

- Let's update our CRD!
+- Let's update our CRD using @@LINK[k8s/coffee-3.yaml]

 .lab[

 - Update the CRD:
  ```bash
-  kubectl apply -f ~/container.training/k8s/pizza-4.yaml
+  kubectl apply -f ~/container.training/k8s/coffee-3.yaml
  ```

- Look at our Pizza resources:
+- Look at our Coffee resources:
  ```bash
-  kubectl get pizzas
+  kubectl get coffees
  ```

 ]
@@ -208,26 +215,50 @@ Note: we can update a CRD without having to re-create the corresponding resource

 ---

-## Better data validation
+## Data validation

- Let's change the data schema so that the sauce can only be `red` or `white`
+- CRDs are validated with the OpenAPI v3 schema that we specify

- This will be implemented by @@LINK[k8s/pizza-5.yaml]
+  (with older versions of the API, when the schema was optional,
+  <br/>
+  no schema = no validation at all)

-.lab[
+- Otherwise, we can put anything we want in the `spec`

- Update the Pizza CRD:
-  ```bash
-  kubectl apply -f ~/container.training/k8s/pizza-5.yaml
-  ```
+- More advanced validation can also be done with admission webhooks, e.g.:

-]
+  - consistency between parameters
+
+  - advanced integer filters (e.g. odd number of replicas)
+
+  - things that can change in one direction but not the other
+
+---
+
+## OpenAPI v3 schema example
+
+This is what we have in @@LINK[k8s/coffee-3.yaml]:
+
+```yaml
+    schema:
+      openAPIV3Schema:
+        type: object
+        required: [ spec ]
+        properties:
+          spec:
+            type: object
+            properties:
+              taste:
+                description: Subjective taste of that kind of coffee bean
+                type: string
+            required: [ taste ]
+```

 ---

 ## Validation *a posteriori*

- Some of the pizzas that we defined earlier *do not* pass validation
+- Some of the "coffees" that we defined earlier *do not* pass validation

 - How is that possible?

@@ -295,23 +326,15 @@ Note: we can update a CRD without having to re-create the corresponding resource

 ---

-## Even better data validation
+## What's next?

- If we need more complex data validation, we can use a validating webhook
+- Generally, when creating a CRD, we also want to run a *controller*

- Use cases:
+  (otherwise nothing will happen when we create resources of that type)

-  - validating a "version" field for a database engine
+- The controller will typically *watch* our custom resources

-  - validating that the number of e.g. coordination nodes is even
-
-  - preventing inconsistent or dangerous changes
-    <br/>
-    (e.g. major version downgrades)
-
-  - checking a key or certificate format or validity
-
-  - and much more!
+  (and take action when they are created/updated)

 ---

@@ -353,24 +376,6 @@ Note: we can update a CRD without having to re-create the corresponding resource

  (unrelated to containers, clusters, etc.)

---
-
-## What's next?
-
- Creating a basic CRD is relatively straightforward
-
- But CRDs generally require a *controller* to do anything useful
-
- The controller will typically *watch* our custom resources
-
-  (and take action when they are created/updated)
-
- Most serious use-cases will also require *validation web hooks*
-
- When our CRD data format evolves, we'll also need *conversion web hooks*
-
- Doing all that work manually is tedious; use a framework!
-
 ???

 :EN:- Custom Resource Definitions (CRDs)
--- a/slides/k8s/healthchecks.md
+++ b/slides/k8s/healthchecks.md
@@ -1,62 +1,46 @@
 # Healthchecks

- Containers can have *healthchecks* (also called "probes")
+- Containers can have *healthchecks*

- There are three kinds of healthchecks, corresponding to different use-cases:
+- There are three kinds of healthchecks, corresponding to very different use-cases:

-  `startupProbe`, `readinessProbe`, `livenessProbe`
+  - liveness  = detect when a container is "dead" and needs to be restarted
+
+  - readiness = detect when a container is ready to serve traffic
+
+  - startup = detect if a container has finished to boot

 - These healthchecks are optional (we can use none, all, or some of them)

- Different probes are available:
+- Different probes are available (HTTP request, TCP connection, program execution)

-  HTTP GET, TCP connection, arbitrary program execution, GRPC
-
- All these probes have a binary result (success/failure)
-
- Probes that aren't defined will default to a "success" result
+- Let's see the difference and how to use them!

 ---

-## Use-cases in brief
-
-*My container takes a long time to boot before being able to serve traffic.*
-
-→ use a `startupProbe` (but often a `readinessProbe` can also do the job)
-
-*Sometimes, my container is unavailable or overloaded, and needs to e.g. be taken temporarily out of load balancer rotation.*
-
-→ use a `readinessProbe`
-
-*Sometimes, my container enters a broken state which can only be fixed by a restart.*
-
-→ use a `livenessProbe`
-
---
-
-## Liveness probes
+## Liveness probe

 *This container is dead, we don't know how to fix it, other than restarting it.*

- Check if the container is dead or alive
+- Indicates if the container is dead or alive

- If Kubernetes determines that the container is dead:
+- A dead container cannot come back to life

-  - it terminates the container gracefully
+- If the liveness probe fails, the container is killed (destroyed)

-  - it restarts the container (unless the Pod's `restartPolicy` is `Never`)
+  (to make really sure that it's really dead; no zombies or undeads!)

- With the default parameters, it takes:
+- What happens next depends on the pod's `restartPolicy`:

-  - up to 30 seconds to determine that the container is dead
+  - `Never`: the container is not restarted

-  - up to 30 seconds to terminate it
+  - `OnFailure` or `Always`: the container is restarted

 ---

 ## When to use a liveness probe

- To detect failures that can't be recovered
+- To indicate failures that can't be recovered

  - deadlocks (causing all requests to time out)

@@ -64,45 +48,47 @@

 - Anything where our incident response would be "just restart/reboot it"

---
-
-## Liveness probes gotchas
-
 .warning[**Do not** use liveness probes for problems that can't be fixed by a restart]

 - Otherwise we just restart our pods for no reason, creating useless load

-.warning[**Do not** depend on other services within a liveness probe]
+---

- Otherwise we can experience cascading failures
+## Readiness probe (1)

-  (example: web server liveness probe that makes a requests to a database)
+*Make sure that a container is ready before continuing a rolling update.*

-.warning[**Make sure** that liveness probes respond quickly]
+- Indicates if the container is ready to handle traffic

- The default probe timeout is 1 second (this can be tuned!)
+- When doing a rolling update, the Deployment controller waits for Pods to be ready

- If the probe takes longer than that, it will eventually cause a restart
+  (a Pod is ready when all the containers in the Pod are ready)
+
+- Improves reliability and safety of rolling updates:
+
+  - don't roll out a broken version (that doesn't pass readiness checks)
+
+  - don't lose processing capacity during a rolling update

 ---

-## Readiness probes
+## Readiness probe (2)

-*Sometimes, my container "needs a break".*
+*Temporarily remove a container (overloaded or otherwise) from a Service load balancer.*

- Check if the container is ready or not
+- A container can mark itself "not ready" temporarily

- If the container is not ready, its Pod is not ready
+  (e.g. if it's overloaded or needs to reload/restart/garbage collect...)

- If the Pod belongs to a Service, it is removed from its Endpoints
+- If a container becomes "unready" it might be ready again soon

-  (it stops receiving new connections but existing ones are not affected)
+- If the readiness probe fails:

- If there is a rolling update in progress, it might pause
+  - the container is *not* killed

-  (Kubernetes will try to respect the MaxUnavailable parameter)
+  - if the pod is a member of a service, it is temporarily removed

- As soon as the readiness probe suceeds again, everything goes back to normal
+  - it is re-added as soon as the readiness probe passes again

 ---

@@ -116,31 +102,67 @@

 - To indicate temporary failure or unavailability

-  - runtime is busy doing garbage collection or (re)loading data
-
  - application can only service *N* parallel connections

-  - new connections will be directed to other Pods
+  - runtime is busy doing garbage collection or initial data load
+
+- To redirect new connections to other Pods
+
+  (e.g. fail the readiness probe when the Pod's load is too high)

 ---

-## Startup probes
+## Dependencies

-*My container takes a long time to boot before being able to serve traffic.*
+- If a web server depends on a database to function, and the database is down:

- After creating a container, Kubernetes runs its startup probe
+  - the web server's liveness probe should succeed

- The container will be considered "unhealthy" until the probe succeeds
+  - the web server's readiness probe should fail

- As long as the container is "unhealthy", its Pod...:
+- Same thing for any hard dependency (without which the container can't work)

-  - is not added to Services' endpoints
+.warning[**Do not** fail liveness probes for problems that are external to the container]

-  - is not considered as "available" for rolling update purposes
+---

- Readiness and liveness probes are enabled *after* startup probe reports success
+## Timing and thresholds

-  (if there is no startup probe, readiness and liveness probes are enabled right away)
+- Probes are executed at intervals of `periodSeconds` (default: 10)
+
+- The timeout for a probe is set with `timeoutSeconds` (default: 1)
+
+.warning[If a probe takes longer than that, it is considered as a FAIL]
+
+- A probe is considered successful after `successThreshold` successes (default: 1)
+
+- A probe is considered failing after `failureThreshold` failures (default: 3)
+
+- A probe can have an `initialDelaySeconds` parameter (default: 0)
+
+- Kubernetes will wait that amount of time before running the probe for the first time
+
+  (this is important to avoid killing services that take a long time to start)
+
+---
+
+## Startup probe
+
+*The container takes too long to start, and is killed by the liveness probe!*
+
+- By default, probes (including liveness) start immediately
+
+- With the default probe interval and failure threshold:
+
+  *a container must respond in less than 30 seconds, or it will be killed!*
+
+- There are two ways to avoid that:
+
+  - set `initialDelaySeconds` (a fixed, rigid delay)
+
+  - use a `startupProbe`
+
+- Kubernetes will run only the startup probe, and when it succeeds, run the other probes

 ---

@@ -156,296 +178,121 @@

 ---

-## Startup probes gotchas
-
- When defining a `startupProbe`, we almost always want to adjust its parameters
-
-  (specifically, its `failureThreshold` - this is explained in next slide)
-
- Otherwise, if the container fails to start within 30 seconds...
-
-  *Kubernetes terminates the container and restarts it!*
-
- Sometimes, it's easier/simpler to use a `readinessProbe` instead
-
-  (except when also using a `livenessProbe`)
-
---
-
-## Timing and thresholds
-
- Probes are executed at intervals of `periodSeconds` (default: 10)
-
- The timeout for a probe is set with `timeoutSeconds` (default: 1)
-
-.warning[If a probe takes longer than that, it is considered as a FAIL]
-
-.warning[For liveness probes **and startup probes** this terminates and restarts the container]
-
- A probe is considered successful after `successThreshold` successes (default: 1)
-
- A probe is considered failing after `failureThreshold` failures (default: 3)
-
- All these parameters can be set independently for each probe
-
---
-
-class: extra-details
-
-## `initialDelaySeconds`
-
- A probe can have an `initialDelaySeconds` parameter (default: 0)
-
- Kubernetes will wait that amount of time before running the probe for the first time
-
- It is generally better to use a `startupProbe` instead
-
-  (but this parameter did exist before startup probes were implemented)
-
---
-
-class: extra-details
-
-## `readinessProbe` vs `startupProbe`
-
- A lot of blog posts / documentations / tutorials recommend readiness probes...
-
- ...even in scenarios where a startup probe would seem more appropriate!
-
- This is because startup probes are relatively recent
-
-  (they reached GA status in Kubernetes 1.20)
-
- When there is no `livenessProbe`, using a `readinessProbe` is simpler:
-
-  - a `startupProbe` generally requires to change the `failureThreshold`
-
-  - a `startupProbe` generally also requires a `readinessProbe`
-
-  - a single `readinessProbe` can fulfill both roles
-
---
-
 ## Different types of probes

- Kubernetes supports the following mechanisms:
+- HTTP request

-  - `exec` (arbitrary program execution)
+  - specify URL of the request (and optional headers)

-  - `httpGet` (HTTP GET request)
+  - any status code between 200 and 399 indicates success

-  - `tcpSocket` (check if a TCP port is accepting connections)
+- TCP connection

-  - `grpc` (standard [GRPC Health Checking Protocol][grpc])
+  - the probe succeeds if the TCP port is open

- All probes give binary results ("it works" or "it doesn't")
+- arbitrary exec

- Let's see the specific details for each of them!
+  - a command is executed in the container

-[grpc]: https://grpc.github.io/grpc/core/md_doc_health-checking.html
+  - exit status of zero indicates success

 ---

-## `exec`
+## Benefits of using probes

- Runs an arbitrary program *inside* the container
+- Rolling updates proceed when containers are *actually ready*

-  (like with `kubectl exec` or `docker exec`)
+  (as opposed to merely started)

- The program must be available in the container image
+- Containers in a broken state get killed and restarted

- Kubernetes uses the exit status of the program
+  (instead of serving errors or timeouts)

-  (standard UNIX convention: 0 = success, anything else = failure)
+- Unavailable backends get removed from load balancer rotation
+
+  (thus improving response times across the board)
+
+- If a probe is not defined, it's as if there was an "always successful" probe

 ---

-## `exec` example
+## Example: HTTP probe

-When the worker is ready, it should create `/tmp/ready`.
-<br/>
-The following probe will give it 5 minutes to do so.
+Here is a pod template for the `rng` web service of the DockerCoins app:

 ```yaml
 apiVersion: v1
 kind: Pod
 metadata:
-  name: queueworker
+  name: healthy-app
 spec:
  containers:
-  - name: worker
-    image: myregistry.../worker:v1.0
-    startupProbe:
-      exec:
-        command:
-        - test
-        - -f
-        - /tmp/ready
-      failureThreshold: 30
-```
-
---
-
-## Using shell constructs
-
- If we want to use pipes, conditionals, etc. we should invoke a shell
-
- Example:
-  ```yaml
-    exec:
-      command:
-      - sh
-      - -c
-      - "curl http://localhost:5000/status | jq .ready | grep true"
-  ```
-
---
-
-## `httpGet`
-
- Make an HTTP GET request to the container
-
- The request will be made by Kubelet
-
-  (doesn't require extra binaries in the container image)
-
- `port` must be specified
-
- `path` and extra `httpHeaders` can be specified optionally
-
- Kubernetes uses HTTP status code of the response:
-
-  - 200-399 = success
-
-  - anything else = failure
-
---
-
-## `httpGet` example
-
-The following liveness probe restarts the container if it stops responding on `/healthz`:
-
-```yaml
-apiVersion: v1
-kind: Pod
-metadata:
-  name: frontend
-spec:
-  containers:
-  - name: frontend
-    image: myregistry.../frontend:v1.0
+  - name: myapp
+    image: myregistry.io/myapp:v1.0
    livenessProbe:
      httpGet:
+        path: /health
        port: 80
-        path: /healthz
+      periodSeconds: 5
 ```

---
-
-## `tcpSocket`
-
- Kubernetes checks if the indicated TCP port accepts connections
-
- There is no additional check
-
-.warning[It's quite possible for a process to be broken, but still accept TCP connections!]
+If the backend serves an error, or takes longer than 1s, 3 times in a row, it gets killed.

 ---

-## `grpc`
+## Example: exec probe

-<!-- ##VERSION## -->
+Here is a pod template for a Redis server:

- Available in beta since Kubernetes 1.24
+```yaml
+apiVersion: v1
+kind: Pod
+metadata:
+  name: redis-with-liveness
+spec:
+  containers:
+  - name: redis
+    image: redis
+    livenessProbe:
+      exec:
+        command: ["redis-cli", "ping"]
+```

- Leverages standard [GRPC Health Checking Protocol][grpc]
-
-[grpc]: https://grpc.github.io/grpc/core/md_doc_health-checking.html
+If the Redis process becomes unresponsive, it will be killed.

 ---

-## Best practices for healthchecks
+## Questions to ask before adding healthchecks

- Readiness probes are almost always beneficial
+- Do we want liveness, readiness, both?

-  - don't hesitate to add them early!
+  (sometimes, we can use the same check, but with different failure thresholds)

-  - we can even make them *mandatory*
+- Do we have existing HTTP endpoints that we can use?

- Be more careful with liveness and startup probes
+- Do we need to add new endpoints, or perhaps use something else?

-  - they aren't always necessary
+- Are our healthchecks likely to use resources and/or slow down the app?

-  - they can even cause harm
+- Do they depend on additional services?
+
+  (this can be particularly tricky, see next slide)

 ---

-## Readiness probes
+## Healthchecks and dependencies

- Almost always beneficial
+- Liveness checks should not be influenced by the state of external services

- Exceptions:
+- All checks should reply quickly (by default, less than 1 second)

-  - web service that doesn't have a dedicated "health" or "ping" route
+- Otherwise, they are considered to fail

-  - ...and all requests are "expensive" (e.g. lots of external calls)
+- This might require to check the health of dependencies asynchronously

---
-
-## Liveness probes
-
- If we're not careful, we end up restarting containers for no reason
-
-  (which can cause additional load on the cluster, cascading failures, data loss, etc.)
-
- Suggestion:
-
-  - don't add liveness probes immediately
-
-  - wait until you have a bit of production experience with that code
-
-  - then add narrow-scoped healthchecks to detect specific failure modes
-
- Readiness and liveness probes should be different
-
-  (different check *or* different timeouts *or* different thresholds)
-
---
-
-## Startup probes
-
- Only beneficial for containers that need a long time to start
-
-  (more than 30 seconds)
-
- If there is no liveness probe, it's simpler to just use a readiness probe
-
-  (since we probably want to have a readiness probe anyway)
-
- In other words, startup probes are useful in one situation:
-
-  *we have a liveness probe, AND the container needs a lot of time to start*
-
- Don't forget to change the `failureThreshold`
-
-  (otherwise the container will fail to start and be killed)
-
---
-
-## Recap of the gotchas
-
- The default timeout is 1 second
-
-  - if a probe takes longer than 1 second to reply, Kubernetes considers that it fails
-
-  - this can be changed by setting the `timeoutSeconds` parameter
-    <br/>(or refactoring the probe)
-
- Liveness probes should not be influenced by the state of external services
-
- Liveness probes and readiness probes should have different paramters
-
- For startup probes, remember to increase the `failureThreshold`
+  (e.g. if a database or API might be healthy but still take more than
+  1 second to reply, we should check the status asynchronously and report
+  a cached status)

 ---

@@ -453,21 +300,21 @@ spec:

 (In that context, worker = process that doesn't accept connections)

- A relatively easy solution is to use files
+- Readiness is useful mostly for rolling updates

- For a startup or readiness probe:
+  (because workers aren't backends for a service)

-  - worker creates `/tmp/ready` when it's ready
-  - probe checks the existence of `/tmp/ready`
+- Liveness may help us restart a broken worker, but how can we check it?

- For a liveness probe:
+- Embedding an HTTP server is a (potentially expensive) option

-  - worker touches `/tmp/alive` regularly
-    <br/>(e.g. just before starting to work on a job)
-  - probe checks that the timestamp on `/tmp/alive` is recent
-  - if the timestamp is old, it means that the worker is stuck
+- Using a "lease" file can be relatively easy:

- Sometimes it can also make sense to embed a web server in the worker
+  - touch a file during each iteration of the main loop
+
+  - check the timestamp of that file from an exec probe
+
+- Writing logs (and checking them from the probe) also works

 ???

--- a/slides/k8s/helm-create-better-chart.md
+++ b/slides/k8s/helm-create-better-chart.md
@@ -157,7 +157,7 @@ class: extra-details

  (as opposed to, e.g., installing a new release each time we run it)

- Other example: `kubectl apply -f some-file.yaml`
+- Other example: `kubectl -f some-file.yaml`

 ---

--- a/slides/k8s/helm-dependencies.md
+++ b/slides/k8s/helm-dependencies.md
@@ -66,7 +66,7 @@

 Where do that `repository` and `version` come from?

-We're assuming here that we did our research,
+We're assuming here that we did our reserach,
 or that our resident Helm expert advised us to
 use Bitnami's Redis chart.

@@ -317,22 +317,6 @@ class: extra-details

 class: extra-details

-## Determining if we're in a subchart
-
- `.Chart.IsRoot` indicates if we're in the top-level chart or in a sub-chart
-
- Useful in charts that are designed to be used standalone or as dependencies
-
- Example: generic chart
-
-  - when used standalone (`.Chart.IsRoot` is `true`), use `.Release.Name`
-
-  - when used as a subchart e.g. with multiple aliases, use `.Chart.Name`
-
---
-
-class: extra-details
-
 ## Compatibility with Helm 2

 - Chart `apiVersion: v1` is the only version supported by Helm 2
--- a/Show More
+++ b/Show More