Dungeons and Deployments: Leveling up in Kubernetes¶

Playlists: KubeCon + CloudNativeCon NA 2023

Novice-level introduction to Kubernetes concepts told through a Dungeons & Dragons game.

Topics: kubernetes basics, deployments, api server, novice

Transcript¶

▶ 0:00 It checks out. Did you bring snacks? No. [ __ ] Amateurs. Are we recording? Let's go. Autobots roll out. So, welcome everyone to Dungeons and Deployments, leveling up in Kubernetes. Uh we'll introduce ourselves, uh how this talk is going to work. Since this is the novice track, we're up here to try and teach some basics. Uh we're not going to go too deep. This is going to be like 101-level patterns. Uh but we are literally going to try and play the game while we're up here. We've got dice. We've got pens and paper. We've got character sheets. Emphasis on try. Try. Uh we're going to be breaking the fourth

▶ 0:45 wall a lot to give explanations, but everything else we're going to keep sort of focused inside the table, inside the game, sort of like you're watching a sitcom that won't be funny. Uh think of us like informative performance art, basically. Uh laughter is fine, groaning is expected. Uh the talk is silly, lots of bad jokes. Um we'll be having fun, maybe you will, too. We'll see. You're trapped in here with us, though, so. So, let's get started. Welcome everyone. I realize it's been 147 weeks of scheduling mishaps, but we're finally able to play AGAIN TONIGHT. WOO! UM

▶ 1:28 want everybody to introduce themselves cuz we may have forgotten who we all are. I'm Noah, I'm your DM for the evening. Okay. In the context of this game, the DM is going to be like the API server. Uh all the requests for interactions, all the understanding of actions that happen, all the requests for information, that's all going to go through me, just like it would for a cluster that has requests to go through the API server. And just like a real API server, I have a storage method. And if you ask for help, I will also

▶ 2:09 look it up and give it back to you. Moving on. All right. Hi everyone. My name is Era. I'm a Tiefling Grave Cleric, um also known as the healer um of the party standing my team back up again. Um and so I want you to think about a player like me being like the CI/CD system in this super very realistic version of Dungeons & Dragons that I'm playing with you today. Um and you know, obviously disguised as a kube controller. Thanks folks for putting us in last minute. Um CI/CD services, let's use Argo as an example. Um concern themselves with application health in inside inside the clusters that they're pointed at. They're making

▶ 2:52 sure that they're always running optimal versions by keeping patches and builds up to date. Um I'm the sucker. Uh I mean, I'm the healer that has to always put my team back together whether I like it or not. Um and in this game, I hate this joke so much that may occasionally require a mesh bandage. Good god. I love it. I love it. They pulled this OFF THE WAITLIST. THEY DID. UH HELLO EVERYBODY. MY NAME IS Cab but my character's name is Tav. I'm playing a half-elf warlock and my patron saint are the users who are fickle and unpredictable and very demanding.

▶ 3:37 Um you can think of me as a warlock as an application load generator. My job is to make things a little bit harder for you sometimes. I'm going to blow stuff up. Things might fall over but ultimately it's a good thing. You're going to learn from the mistakes and mishaps that happen when I blow something up. It's lit. Big. Okay, I'm Seth. My name is My character's name is JVM, spelled JVM. I AM I AM SOMETHING FAMILIAR TO MANY PEOPLE THAT WORK IN the work in the enterprise. I am a monolithic Java app, but I just want to be containerized. So, I'm a half-orc rogue. I'm not dexterous. I'm not athletic. Nothing like that. But I just want to

▶ 4:21 better myself in the search for the Holy Grail. Boo! Big boo. So, we do have some players missing tonight. Unfortunately, the load balancer couldn't make it, so we have no one to tank for our applications. OPA didn't show up tonight, so we don't have a paladin enforcing rules and being super stodgy about all the policies. Jaeger didn't make it, so we don't have the person who's normally the ranger and the hunter playing for things. And chaos testing didn't show up, so the murder hobo barbarian will be randomly killing things. They will not be here as well.

▶ 5:04 Um This adventure is just a taste into the world of cloud native. We couldn't possibly cover all of the major players, projects, and parts of the ecosystem. As an example of how many things are really there, a couple of us have thrown around the idea of doing a hey, let's do an intro to every single CNCF project as a day zero event. And by giving every project 3 minutes, it is an 8-hour marathon. Not even joking. I wish I was. So, let's recap our last couple of sessions. Last time, almost the entire party was taken down by DNS. Uh

▶ 5:48 R.I.P. Luckily, our healer survived to apply patches to everyone. Uh the guild has sent you on a mission to retrieve the magical bucket of secrets. It is an eternal artifact which grants access to locked doors and hidden information so that you could keep it away from evildoers. It was last tracked to Amazulin, the orange lich of Cascade Yeah. who was the last person attuned to it. However, when you arrived and confronted the dark wizard, it had already been stolen by a rainbow-plumed were-goose. THE GOOSE WAS JUST INTRIGUING enough to

▶ 6:37 be taught taken in by the wizard, but was not suspicious enough to be watched closely by the wizard. Ricky move. Ricky move. Made off with the bucket. So, if the goose gets the bucket into the wrong hands, then other dark wizards could use its secrets to terraform the entire countryside. Dun dun dun. So, in the game, a magic item can only be attuned to one person. Only one person can use that thing. And in the same vein, any buckets or other storage that are attached to your cluster as persistent volumes or PVCs, uh can only be accessed through a persistent volume claim, okay?

▶ 7:20 Uh usually by only one pod at a time. There are like situations where that's untrue, but we're going to we're going to keep it simple. So, uh just like the magic item is part of the game world, the volume is within the scope of the cluster, whereas the attunement is scoped to a particular pod. Okay? Okay. Also, in this example is the contents of the bucket. Now me, the D&D player that I am, I forgot to introduce myself. I'm Natalie by the way. That doesn't matter. In the context of a real D&D game, I, a cleric, would absolutely want to inspect or very likely taste what's in the bucket. My alignment is chaotic good, so I'm out there like licking it all all the things.

▶ 8:04 It's human and cleric nature. But we're in the cloud native novice track, so if you keep sensitive data in your buckets and they're attached to the cluster, do not be surprised if that do not be surprised that your somehow compromised cluster that suddenly means that bad guys have access to that sensitive data in the bucket. The lesson here is that you should never keep the keys to the cluster accessible from inside the cluster. Okay? Okay. Okay. So picking back up with our story today. Because you don't have your ranger, you were escorted by a ranger who'd been appointed by the guild, Sir David, who has been tracking the were-goose for you. Oh god. Strap in guys.

▶ 8:48 As you've been working with Sir David, he has been regaling you with lessons of the natural paths upon which you have traveled. Things like, "Now this particular mushroom only grows on this one tree You all came to this talk voluntarily. Yeah, you did. You all came here. Anyway, you all gain plus one to your nature rolls for having sat through all of that. Oh sick. And all of you two, you all gain plus one to your nature rolls. Yeah. So he has tracked the goose. As you have followed the goose along the trail Side note, that's a rolling update, right? That's a rolling update. Get out. Sir David has led you to a clearing

▶ 9:33 whereupon you see someone familiar, someone you have seen before. It is Dominus the Warlock. You've encountered him three or four times before. Once at a shack by the seaside, once in a small shantytown. And here he is again. And he says, Hey, how are you doing? I'm Dominus. Uh, we met before. What can we do for you guys? Um Are you following us? Have you seen Have you seen a goose around here? Oh, yeah. Yeah, I saw a goose. Yeah, it came right It came through here, flew down the path. Yeah, you want Flew down? Yeah. Yeah. That's how it goes. Goose flying. What, you don't believe me? Okay. And And you said went down the path this path here? Yeah. Right down here. Okay. Heading that way. Just heading that way?

▶ 10:18 Heading that way. Did this goose have a bucket? Hold on, let me think. You know, yeah. The goose did have a bucket. I start walking away. Okay. Yeah. Uh Cool. Thanks, man. Thanks. And I'm here wondering, would the goose have it around its neck or on its wing? Like, Or on its back? How big In its beak. Oh, yeah. Okay. this goose and how big is the bucket? bucket. Yeah. Exactly. Yeah. So, what we didn't explain just now is that Dominus shows up every time there is a wooden house. Showed up in the shantytown, he showed up in the in the seaside shack. And Dominus, who is a warlock, has a whole set of daemons off in the back. He is a daemon set. And a daemon set is a Kubernetes

▶ 11:06 construct that will run on every single node in a cluster as long as that node meets the defined criteria, like being a particular instance type or in this case being flagged with must have a wooden house. I know. Did it get worse from here? Keep going. So, you find your way following along this path and you come upon a man kneeling upon a stone foundation. He's been there so long he appears to have sunken into the foundation. His hair is long. He looks disheveled, decrepit, desperate. And as you as you approach he says

▶ 11:49 Hi guys, I'm Neil. Will you please take a map? Please take one from me. Please, I'm begging you, take a map. Yeah man, what's wrong with the map? No, I need to give out the maps. It's my curse. I feel terrible, I'll take a map. You take a map? Okay. Um the map is I mean It's a map. It's a map. It's pretty beat up. Is the map cursed or like haunted or something? It hasn't been updated in a while, I can tell. It's It's an older map. It still works but it's definitely out of date. So the CNCF trial map documents a journey that may have been taken by you know enterprises that want to move into a more cloud native ecosystem. An artifact from a time when you could

▶ 12:33 still list all the CNCF projects on the same page and it didn't look like an eye chart. But it's still useful these days but yeah, it hasn't been hasn't been updated in a little while. So you take the map and you see the map leads you along you shows where you've been and it shows that there is a beanstalk at the end. Okay. Which eventually you come upon the beanstalk. As you approach Sir David is again regaling you with various facts but now this rare flower only appears within the moon of and he just goes on and on and on. It's it he just keeps going. Um and then he points up and says hey by the way, you can see goose droppings

▶ 13:17 up there. They're like a quarter of a mile up in the air. You have no idea how he sees them. Cat doesn't, she doesn't got her contacts on. I don't have my contacts on, yeah. I can't see anything. That's legitimately true, by the way. So, there is a beanstalk with obviously goose droppings and rare flowers on the ground. What are you going to do? How stable does this beanstalk look? I mean, it looks climbable. I mean, what if I bit it that like bit of one of the Yeah, yeah, yeah. If we we just like gnaw it down. I gnaw on the beanstalk. You get bean juice in your mouth. Okay. I I will climb the beanstalk for a quarter of a mile into the sky. Okay. It goes all the way up into the clouds. You're climbing for a while. As you start climbing, Sir David

▶ 14:01 bids you adieu and wanders off into the forest. Okay. Well, good riddance. So, you're climbing for a while. You're hundreds of feet in the air. And the beanstalk getting a little bit slippery. Why don't you all go ahead and make deck saves? The DC is only 10. Uh nine. Lol, 14. OKAY. UH ONE. OKAY. YOU FALL ON YOUR FACE. YOU WERE FINE. Give me your character sheet. You all watch as the JVM plummets to the ground in Wile E. Coyote fashion. No.

▶ 14:49 Um Moments later as you are saying, "Hmm, what are we going to do about that?" One of the beans opens up. And Jovum is inside. It takes a minute to stand back up. Uh but he does so and he's back there. Safe to say it took a heap of work? IT TOOK A HEAP OKAY. YOU'VE BEEN REDEPLOYED. Uh okay. So, I failed the deck save. Uh one of the features of a deployment is to ensure that components uh pods are always filling the desired state uh and that includes restarting uh failed pods. So, I'm back.

▶ 15:34 So, uh in doing so, you realize that this is now treacherous and you remember that I don't remember what which one of you One of you has the goggles of Prometheus. Oh, yeah. Oh, yeah. So, by using Prometheus to monitor important metrics and alert manager to push out messages based on the thresholds that you set, uh you do not need to inspect all of your deployments anymore. You don't have to keep an eye on them actively. You can let alert manager do that for you and get you a sweet pair of Pit Vipers. And with that alerting, you are able to

▶ 16:20 successfully climb the beanstalk up into the fluffy white clouds. Shout out to Pit Vipers. This talk not sponsored by Pit Vipers. This talk has not been sponsored by Pit Vipers. This talk sponsored by Mountain Dew if anything. Woo. Uh you get to the top and you find yourself on top of the clouds. They are spongy, downright elastic. What do you do when you get to the top of the clouds? Um I would like to treat them like a trampoline. I I'm going to I'm going to bounce and bounce and bounce and bounce and bounce. Okay. Um let me let me see your sheet. What's your What's your passive perception?

▶ 17:03 Um hmm. Yeah. Okay, why don't you give me a roll? Give me a deck roll there. Well. Okay. So, as she is bouncing around on the clouds. Uh you two look over and see her again in a very cartoonish manner, look down, realize there is nothing below her, and then suddenly plummet to the ground. Um destroying the rare flowers that are at the bottom of the beanstalk. Sir David is unhappy with you. Okay. Jesus, Mary, and Joseph, people. All right. A lot of people make bad assumptions about the availability of cloud

▶ 17:48 resources. Um I mean, it's just someone else's huge mega available computer, right? Um so, yes, cloud the cloud is expensive. They are expensive, and they are typically elastic, uh growing and shrinking to fill your needs. Um but, they are not infinite, and they are subject uh to the same failures as any other system. Um in this case, that means gravity. Stupid. Yeah. Well, look, you were stupid. Um and also, it's bad for the environment, and it's bad for your wallet. You, the plural companies you. Um you want to kind of probably protect both of those. Um and definitely Sir David wants to protect those uh lovely plants that the stupid warlock just destroyed.

▶ 18:32 Can you res me, though? Uh what's in it for me? A hug? You get redeployed. Okay. There you go. And also, uh your coin purse is a little bit lighter now because that took resources. Well, that's a scam. Yeah, ain't it? However, while you're up here, you see there's only one place that the goose could have possibly gone. There is a castle in the middle of the clouds, something that you all know to be the domain of cloud giants. As you walk up, the main entrance is sealed shut, but you notice there is a side entrance that is open waiting for you. You walk up to the side entrance and the portcullis slams shut in front of you.

▶ 19:17 Ahead of you, you see a basin. Strange basin filled with all sorts of cubes. Cubes of all sorts of colors, shapes, sizes, and materials. One of them is 27 smaller colored cubes with a little bowler hat on it. You all have a passive perception above 10. Yeah. So, you notice there is a large placard and three square indentations on the wall. It looks like this. Lots of imprints of text over and above each other. And then you remember that you have the ability to read similar magic writings if you have the magic yammulet. Tearing up my own sheet. I can't handle

▶ 19:59 it. Can't handle this. And it's a yammulet because yammulet was way too hard to say repeatedly. to just leave? Can't handle Can't we just just quit? It's a pretty sweet potato. Oh my god. That was made by my friend Laura Santa Maria, so thank you to Laura for crocheting me a yammulet on short notice. Never saying it again after this talking. Oh, yeah. So, as you put on the amulet, you were able to see that there are additional indentations inside those three indentations, bits of text, and they line up with the text that now appears on some of the cubes that are floating around in the basin.

▶ 20:44 As you align them and you realize pretty easily, oh, this one's going to go here. I've played this. I'm not a child. You are able to find the cubes C, T, and L. I'm so sorry. I'm So, the primary tool for many to interface with a Kubernetes cluster is kubectl, cube control, cube cuddle, or cube ecto. Uh we all know it's cube cuddle. Cube ecto. It's cube control. Cube cuddle. I don't know about that one. Uh however it's pronounced, with proper authentication, it allows you to inspect and edit any of the objects in a cluster you have appropriate permissions for. Cube cuddle. So. As you look at the cube CTL uh with the

▶ 21:28 magic amulet. It doesn't get any better the second time around. It doesn't. No, this gets more painful the longer we go on. Uh the the indentations seem to recess a bit and uh some magical text starts to appear. If my There we go. There we go. Everyone with me, 1 2 3, GROAN. GOD. AND IF ANY of you are able to read this language that was not meant for mortal eyes, then you can translate it into its

▶ 22:11 essential meaning, which is speak friend and enter. Yes, we plagiarize. We reuse jokes. Come on, we're DMs. We don't write our own stuff. Thank you. It's public domain now, isn't it? It's probably public domain. Yeah, it's public domain. So, anyway. Oh, oops. Yeah, skipping my exposition, man. So, an ingress is one of the primary ways to define network access in Kubernetes. Uh ooh, there goes my speaker notes, allowing you to reach the inside of your application from the outside of your application, letting the internet touch your stuff. Uh it does this through a series of rules that describe the access pathways and uh point to your Kubernetes services. And that's what we have here. So, once you've made it through the

▶ 22:55 gated ingress, you find a surface entrance. I'm going to hyperventilate. The surface is this entrance hallway are all well carved, sculpted, and engraved. It's hard to tell what it's made of though. It doesn't feel quite like stone. Hmm, strange. At first glance, everything here appears to be frozen in its current state. It's pristine except for some goose droppings you notice heading off down the hallway, and you can hear some commotion coming from down the hall. We we go down the hallway. We got to we got to check out this goose poop and see what the with the kerfuffle is down there. We're running. We're moving fast. As you get there, you come upon a courtyard filled with what appears to be some sort

▶ 23:38 of sculptor's workshop or factory. Inside, there are small blue and white kobolds running everywhere. We'll call them koblets. We out? Later, y'all. Wait. Wait. There's more. I There's There's more session. No, I'm never doing this with you again. That's fair. They're carrying all sorts of miscellaneous stone and ingots and all sorts of things all over to various parts of the workshop. Can I eat one? I mean, you have to get there first. Okay. I'll wait. As you step further into the workshop, you see a woman in a cage wearing a purple suit jacket just kind of dancing in the cage, kind of amusing

▶ 24:23 herself. I respect that. She's vibing. She's chilling. Purple, nice choice. Can I roll for a vibe check? Sure. You Go ahead. 18. 12. Critical failure on THE VIBES. OKAY. YOU DON'T FEEL IT, but to you two, it just says, "Oh, yeah." And uh when she sees you, she waves you over. She says, "Hey, everybody. I'm Laverne." Hi, Laverne. I tried really hard to come up with an accent and failed. Um Laverne explains that she has been captured and uh she is here looking for her sister Barbie. Okay. Like one person's going to get this joke. Um us.

▶ 25:07 Yeah, I have no no idea what he's talking about. He sure says that that it's funny, just as we ensure you the rest of this is funny. So she explains that there are within her grasp a series of ingots, one might call them workloads that could be distributed among the workshop. And if you were to put them in the right places, which you can tell because there are statues and their faces match the images on the workloads Okay. Told you they keep getting worse. Okay. THAT YOU COULD ALL RIGHT, 7 MINUTES TO GO.

▶ 25:52 VALERIE, VALERIE, YOU'RE DEPARTING. I love it. I love it. So if you were to match the images on the workloads to the correct statues, that you could not only open her cage, but you could open the door up ahead, which apparently leads up and you can tell has goose prints in front of it. Okay, so I take one and I go put it in the thing. Okay. You take one of the workloads from her hands. The moment you do like a record scratch all the cobalts stop turn at you. Roll initiative. Yes, we're going to do this with 7 minutes left. Nine. 10. Nine. No, six. The cobalts go first. I'm swinging the amulet around my head. Okay.

▶ 26:36 Uh the cobalts mob you and try to take the try to take the workloads out of your hands. Uh you're going to need to roll a contested athletics roll. Oh, oh boy. You ready for this? Oh, Jesus. Uh nine. The cobalt got an 18. Uh yeah I got another six that is a six yeah damn okay they ripped the workloads out of your hand they're looking indignant and then they walk over and stick them in a slot and then go back to what they were doing. Laverne says oh yeah I might have forgot to mention you got to label the workloads no cobalts or they will just take it right out of your hands. Well you could have told us that could have let us like do you not want out of this I mean I do but I've been here a while.

▶ 27:20 She doesn't she was like vibing in there. She has a little chisel thing. Okay. So she'll she'll hand you a chisel and and a workload and allow you to do that. Okay fine. Okay. I don't really care about this lady she she clearly doesn't want out of there but I do want through that door. Okay. So You label the workloads you were very easily able to find that the faces do in fact match up to statues and with the three of you placing the handful of workloads in the right places the door swings open. Okay we go through the door. The cage opens and Laverne goes thank you for the you're already gone. We're gone okay. Awesome. She's got us too.

▶ 28:05 Thank you. As you as the door swings open you see a man with a push broom and a sack come out look around realize there's nothing for him to clean up and the cloud custodian goes back to where he was going TO BE GOING. YEP. YEAH. ONCE YOU GET UP TO THE TOP OF THE stairs you find an upstairs area it is mostly devoid of features stretching and branching in various directions many of these hallways and services look exactly the same it's difficult to tell one from another if you don't know them by name but you do see the infamous goose trail up ahead as you follow it you pass a shrine to

▶ 28:47 the god of answers, Etsy D. But you cannot commune with it because you do not have the holy certificate. Tragic. Sorrowful. Told you they were bad. Just past the shrine you find a set of open doors leads to an opulent bedroom. You can only surmise that this would be the home of one of the infamous cloud giants. You hear footsteps. You've heard tales of their magnificence of the their pinnacles of physical perfection, that they are the masters of magical arts, everything you aspire to be. I'm squealing with glee. Equally parts feared, awed, and respected. They come in and you prepare yourself.

▶ 29:31 Instead you see this guy. He looks like a children's drawing. We're not artists. Clearly. And he introduces himself. He says, "Oh, hello there." That's That's the accent you went with That's That's the That's the we're going for. That's the one we're going for. Hello there. I am Sir Ross, the cloud lord. I'm up here making sure it rains. What? It's important. You don't look impressed. Trust me, it's really important. What can I do for you? I don't get visitors up here very often. Uh we are looking for a goose. With a bucket. A colorful goose with a bucket. It's been pooping everywhere. It's just like Really, we need to get the goose some

▶ 30:14 Imodium. HIS IT'S A LOT OF POOP. HIS cartoon eyes narrow and he says, "Ah, the goose. It made its way through here, but it made off with my holy certificate so that I could commune with Etsy D. Now I can no longer. If you would retrieve it for me, I will show you where and I would surely shower you with riches." So this holy this this holy certificate a key value that you need. It definitely I'm interested in riches. I don't know about you. Two minutes till the end of this pain. As he As he points out the window, he shows you

▶ 30:57 over there you can see another harbor in the shadow of Mount Geets. Over in the DUCHY OF DEVOPS. NO. NO. YOU DID NOT CALL IT THE DUCHY OF DEVOPS. YOU DID NOT SAY THAT. I DID. And that is where we will end because it leads you onto your next mission further on the WILD GOOSE CHASE. BIG WE HAVE TO GIVE A LOT OF THANKS to Hero Forge for letting me make those awesome figurines in the beginning. Those were super cool. And to Unsplash for allowing

▶ 31:41 me to pull in tons of pictures most of which were from the Palace of Versailles. Go figure. Um Laura and Anna Maria for knitting the amulet or crocheting the amulet on the flight here. Um yeah. We We also want to thank the tech industry for the amount of trauma that has allowed us to make such terrible jokes. Yeah. Um and also thanks to all of you for coming and attending such a silly silly talk. It was actually super fun to work on this. Huge shout out to Noah. Exactly. Massive shout out to Noah. and he took this on and just ran with it and yeah. And big ups to whoever decided to pull this off of the waitlist. Yeah. YEAH. THANKS EVERYONE. I DON'T REALLY THINK WE HAVE A LOT OF

▶ 32:27 TIME FOR QUESTIONS AND I think the only question would probably be why but if you have questions If you really liked this talk, please scan the QR code and leave us feedback. And if you didn't like the talk, the doors are back there. Yeah. Don't Don't tell anybody you hated it. We're out. Thank you. Thank you. Thank you.