🍂 Highfive Sep/Oct 2024

Bumps [cookie](https://github.com/jshttp/cookie) to 0.7.1 and updates ancestor dependencies [cookie](https://github.com/jshttp/cookie), [express](https://github.com/expressjs/express) and [socket.io](https://github.com/socketio/socket.io). These dependencies need to be updated together.


Updates `cookie` from 0.6.0 to 0.7.1
- [Release notes](https://github.com/jshttp/cookie/releases)
- [Commits](https://github.com/jshttp/cookie/compare/v0.6.0...v0.7.1)

Updates `express` from 4.21.0 to 4.21.1
- [Release notes](https://github.com/expressjs/express/releases)
- [Changelog](https://github.com/expressjs/express/blob/4.21.1/History.md)
- [Commits](https://github.com/expressjs/express/compare/4.21.0...4.21.1)

Updates `socket.io` from 4.7.5 to 4.8.0
- [Release notes](https://github.com/socketio/socket.io/releases)
- [Changelog](https://github.com/socketio/socket.io/blob/main/CHANGELOG.md)
- [Commits](https://github.com/socketio/socket.io/compare/socket.io@4.7.5...socket.io@4.8.0)

---
updated-dependencies:
- dependency-name: cookie
  dependency-type: indirect
- dependency-name: express
  dependency-type: direct:production
- dependency-name: socket.io
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>

prepare-labs/dns-netlify.sh

@@ -1,7 +1,9 @@
 #!/bin/sh
 
+set -eu
+
 # https://open-api.netlify.com/#tag/dnsZone
-[ "$1" ] || {
+[ "${1-}" ] || {
   echo ""
   echo "Add a record in Netlify DNS."
   echo "This script is hardcoded to add a record to container.training".
@@ -18,7 +20,7 @@
 }
 
 NETLIFY_CONFIG_FILE=~/.config/netlify/config.json
-if ! [ "$DOMAIN" ]; then
+if ! [ "${DOMAIN-}" ]; then
   DOMAIN=container.training
 fi
 

prepare-labs/konk.sh

@@ -1,4 +1,11 @@
 #!/bin/sh
+#
+# Baseline resource usage per vcluster in our usecase:
+# 500 MB RAM
+# 10% CPU
+# (See https://docs.google.com/document/d/1n0lwp6rQKQUIuo_A5LQ1dgCzrmjkDjmDtNj1Jn92UrI)
+# PRO2-XS = 4 core, 16 gb
+
 PROVIDER=scaleway
 
 case "$PROVIDER" in
@@ -25,7 +32,7 @@ while read node address; do
 done
 
 # vcluster all the things
-./labctl create --settings settings/mk8s.env --provider vcluster --mode mk8s --students 30
+./labctl create --settings settings/mk8s.env --provider vcluster --mode mk8s --students 50
 
 # install prometheus stack because that's cool
 helm upgrade --install --repo https://prometheus-community.github.io/helm-charts \

prepare-labs/lib/commands.sh

@@ -517,6 +517,7 @@ _cmd_kubeadm() {
         CLUSTER_CONFIGURATION_KUBERNETESVERSION='kubernetesVersion: "v'$KUBEVERSION'"'
         IGNORE_SYSTEMVERIFICATION="- SystemVerification"
         IGNORE_SWAP="- Swap"
+        IGNORE_IPTABLES="- FileContent--proc-sys-net-bridge-bridge-nf-call-iptables"
     fi
 
     # Install a valid configuration for containerd
@@ -540,6 +541,7 @@ nodeRegistration:
   - NumCPU
   $IGNORE_SYSTEMVERIFICATION
   $IGNORE_SWAP
+  $IGNORE_IPTABLES
 ---
 kind: JoinConfiguration
 apiVersion: kubeadm.k8s.io/v1beta3
@@ -553,6 +555,7 @@ nodeRegistration:
   - NumCPU
   $IGNORE_SYSTEMVERIFICATION
   $IGNORE_SWAP
+  $IGNORE_IPTABLES
 ---
 kind: KubeletConfiguration
 apiVersion: kubelet.config.k8s.io/v1beta1
@@ -744,6 +747,16 @@ EOF
         aws-iam-authenticator version
     fi"
 
+    # Install jless (jless.io)
+    pssh "
+    if [ ! -x /usr/local/bin/jless ]; then
+        ##VERSION##
+        sudo apt-get install -y libxcb-render0 libxcb-shape0 libxcb-xfixes0
+        wget https://github.com/PaulJuliusMartinez/jless/releases/download/v0.9.0/jless-v0.9.0-x86_64-unknown-linux-gnu.zip
+        unzip jless-v0.9.0-x86_64-unknown-linux-gnu
+        sudo mv jless /usr/local/bin
+    fi"
+
     # Install the krew package manager
     pssh "
     if [ ! -d /home/$USER_LOGIN/.krew ]; then
@@ -756,7 +769,7 @@ EOF
     fi"
 
     # Install kubecolor
-    KUBECOLOR_VERSION=0.3.2
+    KUBECOLOR_VERSION=0.4.0
     URL=https://github.com/kubecolor/kubecolor/releases/download/v${KUBECOLOR_VERSION}/kubecolor_${KUBECOLOR_VERSION}_linux_${ARCH}.tar.gz
     pssh "
     if [ ! -x /usr/local/bin/kubecolor ]; then
@@ -1055,6 +1068,7 @@ _cmd_tailhist () {
     # halfway through and we're actually trying to download it again.
     pssh "
     set -e
+    sudo apt-get install unzip -y
     wget -c https://github.com/joewalnes/websocketd/releases/download/v0.3.0/websocketd-0.3.0-linux_$ARCH.zip
     unzip websocketd-0.3.0-linux_$ARCH.zip websocketd
     sudo mv websocketd /usr/local/bin/websocketd

prepare-labs/settings/admin-oldversion.env

@@ -7,7 +7,7 @@ USER_PASSWORD=training
 
 # For a list of old versions, check:
 # https://kubernetes.io/releases/patch-releases/#non-active-branch-history
-KUBEVERSION=1.24.14
+KUBEVERSION=1.28.9
 
 STEPS="
   wait

prepare-labs/terraform/one-kubernetes/vcluster/main.tf

@@ -4,6 +4,7 @@ resource "helm_release" "_" {
   create_namespace = true
   repository       = "https://charts.loft.sh"
   chart            = "vcluster"
+  version          = "0.19.7"
   set {
     name  = "service.type"
     value = "NodePort"

prepare-labs/terraform/providers/hetzner/variables.tf

@@ -14,9 +14,9 @@ $ hcloud server-type list | grep shared
 variable "node_sizes" {
   type = map(any)
   default = {
-    S = "cx11"
-    M = "cx21"
-    L = "cx31"
+    S = "cpx11"
+    M = "cpx21"
+    L = "cpx31"
   }
 }
 

prepare-labs/terraform/virtual-machines/openstack/main.tf

@@ -13,7 +13,7 @@ data "openstack_images_image_v2" "_" {
   most_recent = true
   properties = {
     os      = "ubuntu"
-    version = "22.04"
+    version = "24.04"
   }
 }
 

slides/1.yml

@@ -5,7 +5,7 @@ chat: "[Mattermost](https://training.enix.io/mattermost)"
 
 gitrepo: github.com/jpetazzo/container.training
 
-slides: https://2024-05-enix.container.training/
+slides: https://2024-10-enix.container.training/
 
 #slidenumberprefix: "#SomeHashTag — "
 

slides/2.yml

@@ -5,7 +5,7 @@ chat: "[Mattermost](https://training.enix.io/mattermost)"
 
 gitrepo: github.com/jpetazzo/container.training
 
-slides: https://2024-05-enix.container.training/
+slides: https://2024-10-enix.container.training/
 
 #slidenumberprefix: "#SomeHashTag — "
 

slides/3.yml

@@ -6,7 +6,7 @@ chat: "[Mattermost](https://training.enix.io/mattermost)"
 
 gitrepo: github.com/jpetazzo/container.training
 
-slides: https://2024-05-enix.container.training/
+slides: https://2024-10-enix.container.training/
 
 #slidenumberprefix: "#SomeHashTag — "
 

slides/4.yml

@@ -5,7 +5,7 @@ chat: "[Mattermost](https://training.enix.io/mattermost)"
 
 gitrepo: github.com/jpetazzo/container.training
 
-slides: https://2024-05-enix.container.training/
+slides: https://2024-10-enix.container.training/
 
 #slidenumberprefix: "#SomeHashTag — "
 
@@ -27,6 +27,7 @@ content:
 - exercises/netpol-brief.md
 - exercises/sealed-secrets-brief.md
 - exercises/kyverno-ingress-domain-name-brief.md
+- exercises/reqlim-brief.md
 - #1
   - k8s/demo-apps.md
   - k8s/netpol.md
@@ -53,6 +54,7 @@ content:
   - k8s/apiserver-deepdive.md
   - k8s/aggregation-layer.md
   - k8s/hpa-v2.md
+  - exercises/reqlim-details.md
 - #4
   - k8s/statefulsets.md
   - k8s/consul.md

slides/5.yml

@@ -5,7 +5,7 @@ chat: "[Mattermost](https://training.enix.io/mattermost)"
 
 gitrepo: github.com/jpetazzo/container.training
 
-slides: https://2024-05-enix.container.training/
+slides: https://2024-10-enix.container.training/
 
 #slidenumberprefix: "#SomeHashTag — "
 

slides/_redirects

@@ -16,7 +16,7 @@
 
 # Shortlinks for next training in English and French
 #/next https://www.eventbrite.com/e/livestream-intensive-kubernetes-bootcamp-tickets-103262336428
-/next https://skillsmatter.com/courses/700-advanced-kubernetes-concepts-workshop-jerome-petazzoni
+/next https://qconsf.com/training/nov2024/asynchronous-architecture-patterns-scale-ml-and-other-high-latency-workloads
 /hi5 https://enix.io/fr/services/formation/online/
 /us https://www.ardanlabs.com/live-training-events/deploying-microservices-and-traditional-applications-with-kubernetes-march-28-2022.html
 /uk https://skillsmatter.com/workshops/827-deploying-microservices-and-traditional-applications-with-kubernetes-with-jerome-petazzoni

slides/autopilot/package.json

@@ -2,8 +2,8 @@
   "name": "container-training-pub-sub-server",
   "version": "0.0.1",
   "dependencies": {
-    "express": "^4.16.2",
-    "socket.io": "^4.7.5",
+    "express": "^4.21.1",
+    "socket.io": "^4.8.0",
     "socket.io-client": "^4.7.5"
   }
 }

slides/exercises/ingress-controller-brief.md

@@ -1,4 +1,4 @@
-## Exercise — Ingress
+## Exercise — Ingress Controller
 
 - Add an ingress controller to a Kubernetes cluster
 

slides/exercises/ingress-controller-details.md

@@ -1,4 +1,4 @@
-# Exercise — Ingress
+# Exercise — Ingress Controller
 
 - We want to expose a couple of web apps through an ingress controller
 
@@ -128,4 +128,4 @@ This is similar to the previous scenario, but with two significant changes:
 
 1. We only want to run the ingress controller on nodes that have the role `ingress`.
 
-2. We don't want to use `hostNetwork`, but a list of `externalIPs` instead.
+2. We want to either use `hostPort`, or a list of `externalIPs` (not `hostNetwork`).

slides/exercises/reqlim-brief.md

@@ -0,0 +1,7 @@
+## Exercise — Requests and Limits
+
+- Check current resource allocation and utilization
+
+- Make sure that all workloads have requests (and perhaps limits)
+
+- Make sure that all *future* workloads too!

slides/exercises/reqlim-details.md

@@ -0,0 +1,55 @@
+# Exercise — Requests and Limits
+
+By default, if we don't specify *resource requests*,
+our workloads will run in `BestEffort` quality of service.
+
+`BestEffort` is very bad for production workloads,
+because the scheduler has no idea of the actual resource
+requirements of our apps, and won't be able to make
+smart decisions about workload placement.
+
+As a result, when the cluster gets overloaded, 
+containers will be killed, pods will be evicted,
+and service disruptions will happen.
+
+Let's solve this!
+
+---
+
+## Check current state
+
+- Check *allocations*
+
+  (i.e. which pods have requests and limits for CPU and memory)
+
+- Then check *utilization*
+
+  (i.e. actual resource usage)
+
+- Possible tools: `kubectl`, plugins like `view-allocations`, Prometheus...
+
+---
+
+## Follow best practices
+
+- We want to make sure that *all* workloads have requests
+
+  (and perhaps limits, too!)
+
+- Depending on the workload:
+
+  - edit its YAML manifest
+
+  - adjust its Helm values
+
+  - add LimitRange in its Namespace
+
+- Then check again to confirm that the job has been done properly!
+
+---
+
+## Be future-proof!
+
+- We want to make sure that *future* workloads will have requests, too
+
+- How can that be implemented?

slides/highfive.html

@@ -12,118 +12,118 @@
     <table>
 
       <tr>
-        <td>Mardi 14 mai 2024</td>
+        <td>Mardi 24 septembre 2024</td>
         <td>
           <a href="1.yml.html">Docker Intensif</a>
         </td>
       </tr>
       <tr>
-        <td>Mercredi 15 mai 2024</td>
+        <td>Mercredi 25 septembre 2024</td>
         <td>
           <a href="1.yml.html">Docker Intensif</a>
         </td>
       </tr>
       <tr>
-        <td>Jeudi 16 mai 2024</td>
+        <td>Jeudi 26 septembre 2024</td>
         <td>
           <a href="1.yml.html">Docker Intensif</a>
         </td>
       </tr>
       <tr>
-        <td>Vendredi 17 mai 2024</td>
+        <td>Vendredi 27 septembre 2024</td>
         <td>
           <a href="1.yml.html">Docker Intensif</a>
         </td>
       </tr>
 
       <tr>
-        <td>Mardi 21 mai 2024</td>
+        <td>Mardi 1er octobre 2024</td>
         <td>
           <a href="2.yml.html">Fondamentaux Kubernetes</a>
         </td>
       </tr>
       <tr>
-        <td>Mercredi 22 mai 2024</td>
+        <td>Mercredi 2 octobre 2024</td>
         <td>
           <a href="2.yml.html">Fondamentaux Kubernetes</a>
         </td>
       </tr>
       <tr>
-        <td>Jeudi 23 mai 2024</td>
+        <td>Jeudi 3 octobre 2024</td>
         <td>
           <a href="2.yml.html">Fondamentaux Kubernetes</a>
         </td>
       </tr>
       <tr>
-        <td>Vendredi 24 mai 2024</td>
+        <td>Vendredi 4 octobre 2024</td>
         <td>
           <a href="2.yml.html">Fondamentaux Kubernetes</a>
         </td>
       </tr>
 
       <tr>
-        <td>Mardi 28 mai 2024</td>
+        <td>Lundi 7 octobre 2024</td>
         <td>
           <a href="4.yml.html">Kubernetes Avancé</a>
         </td>
       </tr>
       <tr>
-        <td>Mercredi 29 mai 2024</td>
+        <td>Mardi 8 octobre 2024</td>
         <td>
           <a href="4.yml.html">Kubernetes Avancé</a>
         </td>
       </tr>
       <tr>
-        <td>Jeudi 30 mai 2024</td>
+        <td>Mercredi 9 octobre 2024</td>
         <td>
           <a href="4.yml.html">Kubernetes Avancé</a>
         </td>
       </tr>
       <tr>
-        <td>Vendredi 31 mai 2024</td>
+        <td>Jeudi 10 octobre 2024</td>
         <td>
           <a href="4.yml.html">Kubernetes Avancé</a>
         </td>
       </tr>
 
       <tr>
-        <td>Mardi 4 juin 2024</td>
-        <td>
-          <a href="3.yml.html">Packaging d'applications pour Kubernetes</a>
-        </td>
-      </tr>
-      <tr>
-        <td>Mercredi 5 juin 2024</td>
-        <td>
-          <a href="3.yml.html">Packaging d'applications pour Kubernetes</a>
-        </td>
-      </tr>
-      <tr>
-        <td>Jeudi 6 juin 2024</td>
-        <td>
-          <a href="3.yml.html">Packaging d'applications pour Kubernetes</a>
-        </td>
-      </tr>
-
-      <tr>
-        <td>Lundi 10 juin 2024</td>
+        <td>Vendredi 11 octobre 2024</td>
         <td>
           <a href="5.yml.html">Opérer Kubernetes</a>
         </td>
       </tr>
       <tr>
-        <td>Mardi 11 juin 2024</td>
+        <td>Lundi 14 octobre 2024</td>
         <td>
           <a href="5.yml.html">Opérer Kubernetes</a>
         </td>
       </tr>
       <tr>
-        <td>Mercredi 12 juin 2024</td>
+        <td>Mardi 15 octobre 2024</td>
         <td>
           <a href="5.yml.html">Opérer Kubernetes</a>
         </td>
       </tr>
 
+      <tr>
+        <td>Mercredi 16 octobre 2024</td>
+        <td>
+          <a href="3.yml.html">Packaging d'applications pour Kubernetes</a>
+        </td>
+      </tr>
+      <tr>
+        <td>Jeudi 17 octobre 2024</td>
+        <td>
+          <a href="3.yml.html">Packaging d'applications pour Kubernetes</a>
+        </td>
+      </tr>
+      <tr>
+        <td>Vendredi 18 octobre 2024</td>
+        <td>
+          <a href="3.yml.html">Packaging d'applications pour Kubernetes</a>
+        </td>
+      </tr>
+
     </table>
   </body>
 </html>

slides/k8s/architecture.md

@@ -141,12 +141,6 @@ class: pic
 
 class: pic
 
-![](images/control-planes/non-dedicated-stacked-nodes.svg)
-
----
-
-class: pic
-
 ![](images/control-planes/advanced-control-plane.svg)
 
 ---
@@ -157,6 +151,12 @@ class: pic
 
 ---
 
+class: pic
+
+![](images/control-planes/non-dedicated-stacked-nodes.svg)
+
+---
+
 # The Kubernetes API
 
 [

slides/k8s/argocd.md

@@ -583,6 +583,18 @@ git push origin staging
 [Dex]: https://github.com/dexidp/dex
 [rollouts]: https://argoproj.github.io/argo-rollouts/
 
+---
+
+## Acknowledgements
+
+Many thanks to
+Anton (Ant) Weiss ([antweiss.com](https://antweiss.com), [@antweiss](https://twitter.com/antweiss))
+and
+Guilhem Lettron
+for contributing an initial version and suggestions to this ArgoCD chapter.
+
+All remaining typos, mistakes, or approximations are mine (Jérôme Petazzoni). 
+
 ???
 
 :EN:- Implementing gitops with ArgoCD

slides/k8s/cluster-upgrade.md

@@ -81,7 +81,7 @@
 
 ## What version are we running anyway?
 
-- When I say, "I'm running Kubernetes 1.22", is that the version of:
+- When I say, "I'm running Kubernetes 1.28", is that the version of:
 
   - kubectl
 
@@ -129,15 +129,15 @@
 
 ## Kubernetes uses semantic versioning
 
-- Kubernetes versions look like MAJOR.MINOR.PATCH; e.g. in 1.22.17:
+- Kubernetes versions look like MAJOR.MINOR.PATCH; e.g. in 1.28.9:
 
   - MAJOR = 1
-  - MINOR = 22
-  - PATCH = 17
+  - MINOR = 28
+  - PATCH = 9
 
 - It's always possible to mix and match different PATCH releases
 
-  (e.g. 1.22.17 and 1.22.5 are compatible)
+  (e.g. 1.28.9 and 1.28.13 are compatible)
 
 - It is recommended to run the latest PATCH release
 
@@ -153,9 +153,9 @@
 
 - All components support a difference of one¹ MINOR version
 
-- This allows live upgrades (since we can mix e.g. 1.22 and 1.23)
+- This allows live upgrades (since we can mix e.g. 1.28 and 1.29)
 
-- It also means that going from 1.22 to 1.24 requires going through 1.23
+- It also means that going from 1.28 to 1.30 requires going through 1.29
 
 .footnote[¹Except kubelet, which can be up to two MINOR behind API server,
 and kubectl, which can be one MINOR ahead or behind API server.]
@@ -254,7 +254,7 @@ and kubectl, which can be one MINOR ahead or behind API server.]
   sudo vim /etc/kubernetes/manifests/kube-apiserver.yaml
   ```
 
-- Look for the `image:` line, and update it to e.g. `v1.24.1`
+- Look for the `image:` line, and update it to e.g. `v1.30.1`
 
 ]
 
@@ -320,53 +320,29 @@ Note 2: kubeadm itself is still version 1.22.1..
 
 - First things first: we need to upgrade kubeadm
 
-.lab[
+- The Kubernetes package repositories are now split by minor versions
 
-- Upgrade kubeadm:
-  ```
-  sudo apt install kubeadm=1.27.0-00
-  ```
+  (i.e. there is one repository for 1.28, another for 1.29, etc.)
 
-- Check what kubeadm tells us:
-  ```
-  sudo kubeadm upgrade plan
-  ```
+- This avoids accidentally upgrading from one minor version to another
 
-]
+  (e.g. with unattended upgrades or if packages haven't been held/pinned)
 
-Problem: kubeadm doesn't know know how to handle
-upgrades from version 1.22.
-
-This is because we installed version 1.27.
-
-We need to install kubeadm version 1.23.X.
+- We'll need to add the new package repository and unpin packages!
 
 ---
 
-## Downgrading kubeadm
+## Installing the new packages
 
-- We need to go back to kubeadm version 1.23.X.
+- Edit `/etc/apt/sources.list.d/kubernetes.list`
 
-.lab[
+  (or copy it to e.g. `kubernetes-1.29.list` and edit that)
 
-- View available versions for package `kubeadm`:
-  ```bash
-  apt show kubeadm -a | grep ^Version | grep 1.23
-  ```
+- `apt-get update`
 
-- Downgrade kubeadm:
-  ```
-  sudo apt install kubeadm=1.23.0-00
-  ```
+- Now edit (or remove) `/etc/apt/preferences.d/kubernetes`
 
-- Check what kubeadm tells us:
-  ```
-  sudo kubeadm upgrade plan
-  ```
-
-]
-
-kubeadm should now agree to upgrade to 1.23.X.
+- `apt-get install kubeadm` should now upgrade `kubeadm` correctly! 🎉
 
 ---
 
@@ -385,7 +361,7 @@ kubeadm should now agree to upgrade to 1.23.X.
 
 - Look for the `image:` line, and restore it to the original value
 
-  (e.g. `v1.22.17`)
+  (e.g. `v1.28.9`)
 
 - Wait for the control plane to come back up
 
@@ -399,9 +375,14 @@ kubeadm should now agree to upgrade to 1.23.X.
 
 .lab[
 
+- Check the upgrade plan:
+  ```bash
+  sudo kubeadm upgrade plan
+  ```
+
 - Perform the upgrade:
   ```bash
-  sudo kubeadm upgrade apply v1.23.0
+  sudo kubeadm upgrade apply v1.29.0
   ```
 
 ]
@@ -418,15 +399,9 @@ kubeadm should now agree to upgrade to 1.23.X.
 
 - Log into node `oldversion2`
 
-- View available versions for package `kubelet`:
-  ```bash
-  apt show kubelet -a | grep ^Version
-  ```
+- Update package lists and APT pins like we did before
 
-- Upgrade kubelet:
-  ```bash
-  sudo apt install kubelet=1.23.0-00
-  ```
+- Then upgrade kubelet
 
 ]
 
@@ -479,13 +454,16 @@ kubeadm should now agree to upgrade to 1.23.X.
 
 .lab[
 
-- Download the configuration on each node, and upgrade kubelet:
+- Execute the whole upgrade procedure on each node:
   ```bash
     for N in 1 2 3; do
       ssh oldversion$N "
-        sudo apt install kubeadm=1.23.0-00 &&
+        sudo sed -i s/1.28/1.29/ /etc/apt/sources.list.d/kubernetes.list &&
+        sudo rm /etc/apt/preferences.d/kubernetes &&
+        sudo apt update &&
+        sudo apt install kubeadm -y &&
         sudo kubeadm upgrade node &&
-        sudo apt install kubelet=1.23.0-00"
+        sudo apt install kubelet -y"
     done
   ```
 ]
@@ -494,7 +472,7 @@ kubeadm should now agree to upgrade to 1.23.X.
 
 ## Checking what we've done
 
-- All our nodes should now be updated to version 1.23.0
+- All our nodes should now be updated to version 1.29
 
 .lab[
 
@@ -587,17 +565,35 @@ kubeadm should now agree to upgrade to 1.23.X.
 
 ---
 
+## Database operators to the rescue
+
+- Moving stateful pods (e.g.: database server) can cause downtime
+
+- Database replication can help:
+
+  - if a node contains database servers, we make sure these servers aren't primaries
+
+  - if they are primaries, we execute a *switch over*
+
+- Some database operators (e.g. [CNPG]) will do that switch over automatically
+
+  (when they detect that a node has been *cordoned*)
+
+[CNPG]: https://cloudnative-pg.io/
+
+---
+
 class: extra-details
 
 ## Skipping versions
 
-- This example worked because we went from 1.22 to 1.23
+- This example worked because we went from 1.28 to 1.29
 
-- If you are upgrading from e.g. 1.21, you will have to go through 1.22 first
+- If you are upgrading from e.g. 1.26, you will have to go through 1.27 first
 
-- This means upgrading kubeadm to 1.22.X, then using it to upgrade the cluster
+- This means upgrading kubeadm to 1.27.X, then using it to upgrade the cluster
 
-- Then upgrading kubeadm to 1.23.X, etc.
+- Then upgrading kubeadm to 1.28.X, etc.
 
 - **Make sure to read the release notes before upgrading!**
 

slides/k8s/service-types.md

@@ -352,6 +352,87 @@ class: pic
 class: pic
 ![](images/kubernetes-services/64-ING-nolocal.png)
 
+---
+
+class: extra-details
+
+## Traffic engineering
+
+- By default, connections to a ClusterIP or a NodePort are load balanced
+  across all the backends of their Service
+
+- This can incur extra network hops (which add latency)
+
+- To remove that extra hop, multiple mechanisms are available:
+
+  - `spec.externalTrafficPolicy`
+
+  - `spec.internalTrafficPolicy`
+
+  - [Topology aware routing](https://kubernetes.io/docs/concepts/services-networking/topology-aware-routing/) annotation (beta)
+
+  - `spec.trafficDistribution` (alpha in 1.30, beta in 1.31)
+
+---
+
+## `internal / externalTrafficPolicy`
+
+- Applies respectively to `ClusterIP` and `NodePort` connections
+
+- Can be set to `Cluster` or `Local`
+
+- `Cluster`: load balance connections across all backends (default)
+
+- `Local`: load balance connections to local backends (on the same node)
+
+- With `Local`, if there is no local backend, the connection will fail!
+
+  (the parameter expresses a "hard rule", not a preference)
+
+- Example: `externalTrafficPolicy: Local` for Ingress controllers
+
+  (as shown on earlier diagrams)
+
+---
+
+class: extra-details
+
+## Topology aware routing
+
+- In beta since Kubernetes 1.23
+
+- Enabled with annotation `service.kubernetes.io/topology-mode=Auto` 
+
+- Relies on node annotation `topology.kubernetes.io/zone`
+
+- Kubernetes service proxy will try to keep connections within a zone
+
+  (connections made by a pod in zone `a` will be sent to pods in zone `a`)
+
+- ...Except if there are no pods in the zone (then fallback to all zones)
+
+- This can mess up autoscaling!
+
+---
+
+class: extra-details
+
+## `spec.trafficDistribution`
+
+- [KEP4444, Traffic Distribution for Services][kep4444]
+
+- In alpha since Kubernetes 1.30, beta since Kubernetes 1.31
+
+- Should eventually supersede topology aware routing
+
+- Can be set to `PreferClose` (more values might be supported later)
+
+- The meaning of `PreferClose` is implementation dependent
+
+  (with kube-proxy, it should work like topology aware routing: stay in a zone)
+
+[kep4444]: https://github.com/kubernetes/enhancements/issues/4444
+
 ???
 
 :EN:- Service types: ClusterIP, NodePort, LoadBalancer

slides/k8s/setup-devel.md

@@ -144,6 +144,30 @@
 
 ---
 
+## [Orbstack](https://orbstack.dev/)
+
+- Mac only
+
+- Runs Docker containers, Kubernetes, and Linux virtual machines
+
+- Emphasis on speed and energy usage (battery life)
+
+- Great support for `ClusterIP` and `LoadBalancer` services
+
+- Free for personal use; paid product otherwise
+
+---
+
+## [Podman Desktop](https://podman-desktop.io/)
+
+- Available on Linux, Mac, and Windows
+
+- Free and open-source
+
+- Doesn't support Kubernetes directly, but [supports KinD](https://podman-desktop.io/docs/kind)
+
+---
+
 ## [Rancher Desktop](https://rancherdesktop.io/)
 
 - Available on Linux, Mac, and Windows
@@ -158,8 +182,6 @@
 
 - Emphasis on ease of use (like Docker Desktop)
 
-- Relatively young product (first release in May 2021)
-
 - Based on k3s and other proven components
 
 ---

slides/logistics-template.md

@@ -4,7 +4,7 @@
 
 - Sur scène : Jérôme ([@jpetazzo@hachyderm.io])
 
-- En backstage : Alexandre, Antoine, Aurélien (x2), Benjamin (x2), David, Kostas, Nicolas, Paul, Sébastien, Thibault...
+- En backstage : Alexandre, Antoine, Aurélien (x2), Benjamin, David, Kostas, Nicolas, Paul, Sébastien, Thibault...
 
 - Horaires : tous les jours de 9h à 13h
 
@@ -57,15 +57,11 @@
 
 ## Allô Docker¹ ?
 
-<!--
-
 - Chaque après-midi : une heure de questions/réponses ouvertes !
 
   (sauf le dernier jour)
 
--->
-
-- Une heure de questions/réposnes ouvertes !
+- Une heure de questions/réponses ouvertes !
 
 - Mercredi: 15h00-16h00
 
@@ -77,4 +73,4 @@
 
 [qdnd]: https://www.youtube.com/channel/UCOAhkxpryr_BKybt9wIw-NQ
 [ndeloof]: https://github.com/ndeloof
-[jitsi]: https://training.enix.io/jitsi-magic/jitsi.container.training/AlloDockerMai2024
+[jitsi]: https://training.enix.io/jitsi-magic/jitsi.container.training/HighFiveAutomne2024