2:25:36
2024-12-16 09:21:57
2:03:59
2024-12-16 11:06:33
1:46:52
2024-12-16 13:50:28
1:56:02
2024-12-17 09:35:43
1:52:29
2024-12-17 09:39:32
1:51:17
2024-12-17 13:36:38
1:35:13
2024-12-18 08:59:20
23:23
2024-12-18 11:50:59
1:47:49
2024-12-18 13:41:04
Visit the Docker and Kubernetes Training Course course recordings page
United Arab Emirates - Docker and Kubernetes on AWS
WEBVTT
-->
okay so now let's continue yeah so you're doing this
-->
are you done till here first step okay fine now the next step is try to create a pod
-->
you
-->
and save this again you can apply
-->
join is there any feedback link or something they have to take it at the end of the session
-->
today join and type in ENV and you see the information coming up do the same for volume
-->
and confirm once you're done
-->
it's uh charles are you good you're getting it good yes so now do the other method charles
-->
and others do the other method for volumes amount of this exit exit exit charles please
-->
yeah create one more yaml file or you can play around try to make some changes in the yaml file
-->
of config map refresh and see whether changes are getting updated in your volume based or
-->
ENV based play around
-->
yes are we good so if we do on your volume method you have to do a cat and the file name
-->
use a volume method you have to go to etc config give it the file names you have to do a cat
-->
and the file name yeah yeah that's how it works now you can do one more gene others try to
-->
make some change in your config map apply it and see whether data gets updated in your
-->
yeah the config map yeah dot yaml make some changes so make some change uh enter
-->
no no you're in the content yes make some changes so for example modify database name
-->
to my sequel for example insert mode modify the database to mongo db not that yeah yeah
-->
yes below that below line what anything just modify anything okay and save this
-->
save this and apply it apply apply hyphen f and the file name okay so now login to the
-->
part which you get using volume method and check if you see a contents getting updated
-->
do you know the part name yeah yeah the volume one the second the first one
-->
exec config map hyphen volume space hyphen f and bash yeah so now go to cd
-->
false etc
-->
forward slash config yeah enter now do ls yeah whatever you see changes getting updated
-->
yeah you see so in your volume you can see now try to do the same try to go and do the
-->
env method and check whether the data getting updated env method log into the other part and
-->
observe type in env no no type in env and you see that the changes are not getting updated you
-->
observe that the older one so if you want the changes so volume is a update better method than
-->
env clear okay others are we good okay uh then junwe charles any questions and uh
-->
practicing once again let's wait for others you know go inside env did it make some change
-->
okay so you don't see the changes getting updated the top you still see the older one
-->
okay ck are we good charles be good
-->
okay so this is about your content the next one is secrets so what are secrets what are
-->
secrets so we all tell some secrets to your friends yes or no do you say secrets your friends
-->
no you don't say any secret your friends yes we say secrets your friends
-->
yeah so similarly secrets are very very confidential obviously so you do not want others
-->
to know so similarly we have secrets uh in kubernetes in which you can save in passwords
-->
you can save in tokens you can save in private keys which is very confidential which you do
-->
not want to expose in the main file we use the secrets let's learn about it so i said for
-->
secrets and this is your yaml file of your documentation of secrets so what is secret the
-->
is something which you do not want to put in the main file and there are different types of
-->
secrets and remember amazon doesn't encrypt it they do the encryption they do not encrypt it
-->
you are supposed to do encryption so you need to do encryption you are supposed to
-->
manage the access management you have to protect your passwords even if you're saving secrets
-->
and they provided different types of secret which you can use so example they provide you
-->
type of opaque if you mention as opaque it will get created using the gender category you
-->
cannot classify so if you want service account token like this we can use metadata if you
-->
are using service account you want to save it use this metadata for docker all these are
-->
examples so what is opaque so opaque is a generic method it will not have any specific type in it
-->
just mention it get saved in the backend but now when you want to store service account
-->
token for example you can mention the annotations and say this is for the service
-->
account so tomorrow if you want to know which type of data you saved in secrets you can do
-->
a filtering or processing and see the annotation yes so this secret is for a service account
-->
that's how you understand it sometimes you get confused or you want to know which one
-->
and then put the data inside it now if you want to store like docker configurations i would
-->
use the type as docker configuration and then i save in the docker configuration information
-->
if you want to use it for example for password and usernames for example very basic
-->
so that use the type as secret basic auth and then username and password which is encrypted
-->
now we can also use it for private keys for that use ssh auth so either you can mention
-->
default opaque if you don't want or you can classify to specific categories
-->
that's what we're talking about in the annotations and all we have to mention
-->
data certificates you can store and you can use some of the tokens all these are use cases
-->
where you can use secrets so similar to how you can get retrieved in for your config map
-->
similarly you can retrieve it using your enbs and the volume methods
-->
so let's see the lab so lab two so you can use some methods like this
-->
so i'm using a base64 encryption i want to store these two in my secret
-->
so i may use base64 to get some value and then you can store it inside your secret
-->
but base64 is not very strong someone can easily decrypt it so you have to use much strict
-->
mechanisms so this is one method so you can use your other methods also or if you use
-->
generic method it does a base64 either you can do like this right now base64 and do it
-->
or directly if you do it generate it is going to a base64 encryption and then you store it
-->
is the one method you can use then we do a describe secret these are optional just for
-->
observing for you with your base64 anyone can go ahead and easily get the data to decrypt it
-->
so four and five just for observation that how we can decode it in case one decode next
-->
we will start from the task two so you have created a secret now how do you retrieve it
-->
so you would want to mention that data what you have in my secret you map it to a variable
-->
like secret underscore username similarly whatever you save in a secret password
-->
it will have an information of my secret the password what you saved
-->
that will get mounted to this variable so now once you're done you create a part log in the
-->
part and it actually can do a print or log into the machine and do an env you see the
-->
information similarly you can also mount the details to volume so go ahead and mount to
-->
volume so this is your mount path and the actual data of the volume is this one this one is
-->
getting mounted to a volume named this and this is a mount path log into the container
-->
and go to the location and you can see the password same what we did before are we clear
-->
let's get started either you can use this method or directly you can use this method
-->
also so that we if you want you can actually use this method so that we copy this and create it
-->
and say get sequence
-->
so since we did not mention any type it creates your opaque
-->
do a describe of the secret and see what exactly does it have
-->
so when you do outside you cannot see the actual values you can see the actual value
-->
one day when you log in okay please start do yourself give an idea about how to do this
-->
please do next step please do yourself you're good to do the next step
-->
you could skip the three four five this for observation so directly you can go to
-->
yeah yeah if you want you can do it if you want to observe this you can do it yeah
-->
you can do whatever you can play around you can observe you can play around and then you
-->
have a good big questions what are trying to do you're supposed to go to
-->
uh in your container
-->
the container and go to the path which one was it you created engine x2
-->
the latest one what he created was engine x2 correct
-->
once again it not a secret once again let me confirm one used to use for was my secret
-->
one correct yeah my secret one okay yeah okay go inside secret env one that is done now go
-->
into engine x2 go inside engine x2 now login engine x2 execute exec hyphen it engine x2 kk is
-->
missing exec hyphen it base hyphen it engine x2 hyphen hyphen bash hyphen it in the next space
-->
yeah enter now inside this go to cd forward slash data data data forward slash db db yeah enter
-->
do ls do a cat do a cat password type in cat space password now do a cat username
-->
queue i just said ck are you good okay
-->
genv you're good okay fine now we'll do one more lab last lab and then take a break
-->
okay so let's we'll do one more lab in a secret itself so before we start delete the parts
-->
okay next one i'll explain the lab in lab three i have a certificate in this location and this
-->
is here we talk about tls and i have this is my location where i have the key so for example
-->
if i access this in my laptop i can download the certificate on my laptop in this similarly
-->
we also have a certificate the website so i i'm trying to download these two inside my vm
-->
that is on the master and then you say create a secret generic and you want to encrypt
-->
these information and the secret name is this and this is a file name so both these are going to
-->
save as a secret inside to confirm by doing describe and see some values now so what is
-->
tls certificate used for what the purpose of tls certificate what why do we use this testing
-->
why do you use this anyone you all know you all know that bank net banking on the right side
-->
you see a lock a small lock you see this something like this you're seeing the browser yes no so what
-->
exactly does so when you're trying to log in from your laptop and it has to reach your server
-->
the traffic from here to here gets encrypted doing encryption we use tls certificate and
-->
if you have a hacker example you have a hacker we'll make some diagrams so the hacker
-->
cannot see the information what is going here because this encrypted this is what
-->
tls certificate we normally bind these certificate to a user and the user traffic
-->
goes from say encrypted once for the use case so this is one use case other one is
-->
if a pod is communicating with api for any service you want these two to use the tls
-->
certificates so they can use data certificate between users and the backend services or
-->
between services so now i have a certificate i want to use the certificate for pod to
-->
communicate outside world using the certificate that's my use case so what i do i want to
-->
in my pod i create a pod and in the pod i mount that to a path so it picks up the certificate
-->
from this location and it starts using it for communication so once you create a pod
-->
i would once i do something like this so i do qfc to port forward it means that it is trying
-->
to do some other port or something when it's trying to do it and when i do this it'll go
-->
ahead and it'll use the certificate in the backend to do a quick in here do it and you
-->
open a new session and see the logs of it and you would see a certificate being used
-->
now you see the logs of it it means that the certificate is being used by the pod
-->
okay understood everyone yeah let's do this so you have to create you have to
-->
don't disturb the existing session the last step try to create a new session
-->
into the logs of it like we can see the output easily so let's get started so first do a curl
-->
okay
-->
don't go control still wait till it comes in property
-->
use apparel just modify these values like this
-->
okay got it now do a ls and see those do a cat of the files observe the certificate and the key
-->
do a cat so this is your certificate the public certificate
-->
another one is your private key
-->
and how do you know it if it says begin private key it means it is a private keys
-->
and other say is the algorithm so now i want to store these in my secret that's my use case
-->
copy the man
-->
and runs
-->
okay get secrets
-->
that's fine
-->
yeah okay do all the steps so create a secret and then do a describe secret
-->
and observe it good so now what we do is we want to use that in my part just create a pod
-->
and use it go down and copy the file
-->
we can say pod secret dot yaml
-->
so move and paste it
-->
apply it
-->
get pods
-->
while doing this collect the pod and see what is the pod has
-->
and you say that it is mounted
-->
the tls concepts
-->
now do a port forward
-->
paste it run
-->
so you can try to
-->
okay so now what you do is go ahead and create one more terminal
-->
open a terminal and now login the same machine
-->
loss and pod name
-->
and you see this coming in something as you can play around a simple example of
-->
how we can use the certificate mounted in this. Let me know once you're done
-->
yes yes okay the simple example thing so so we learned about config maps config
-->
maps are for non-sensitive information secrets use sensitive information and
-->
for secrets we again have classifications in which you can generate
-->
or could be you can mention the annotation types we can separate we can
-->
mount using ENVs and volumes yeah so are we good for lunch break everyone okay so
-->
we'll be back by 1 30 your time okay thank you break till 1 30