This is still one of the BEST explanations I've heard EVER!
@akk276610 ай бұрын
Thank you, thank you, thank you!!! This video is GOLD! The main treasure discovered at 8:32
@josefromspace Жыл бұрын
Great explanation, great communicating skills. This video is just great, it shows how things should be explained, first presents the problem in a clear and relatable manner and then presents the solution in clear technical terms. Subscribed.
@hide7890 Жыл бұрын
This video is amazing! I love the examples
@enzanto6 ай бұрын
Dang, always struggled with getting this in my head.. Until i saw this video!
@johndangelo9630 Жыл бұрын
Loved it! GREAT JOB!!
@bbstriker11 ай бұрын
This is great, but if you segment applications and DBs at infrastructure level layer 3, you can use NACLs and NSGs to ensure that the DB only ever accepts connections from a specific IP segment and port number. Products like Cillium are great provided you have an underlay of L3/L4 segments ( that we can call 'macro-segementation') governed by firewalls applying ingress and egress policies. These policies should not be accessible by developers. As long as microServices are architected to perform web, middleware, business logic and DB roles, you can segement. Cillium can be used as a microsegnentation over a macro-segmented environment. Developers can then be given freedom to microsegment using Ciliium. This approach provides governance, delivers separation of duties and provides a level assurance over misconfiguration errors.
@josephrajareddy46063 ай бұрын
You got a new subscriber today!
@김도형-g2i10 ай бұрын
great tip you gave that the namespaceSelector to be set to kube-system for ingress controller!
@swapnilshingote8773 Жыл бұрын
My god the much awaited video is here....❤
@pranaysinghparihar47385 ай бұрын
This was amazing
@KnThSelf2ThSelfBTrue Жыл бұрын
I'm okay with "Connection Refused! Why? You figure it out!" alongside extremely clear boundaries where we everyone can be absolutely certain there is no reason to hop across, accompanied by other means of identifying what's going on if for some reason someone didn't get the memo. Otherwise, I want it to be easy to diagnose the problem and solve it the right way. This can be solved with great docs or visualization tools, or clear error messages closer to the application layer. Hasty, over-permissive solutions often emerge from frustrated devs. That's what scares me a little about Network Policies, but I do think they have their use-cases. One really good use-case for this, I think, is multi-tenancy.
@SumanChakraborty0 Жыл бұрын
Thanks for the great explanation!! What would be a better offering in terms of applying network policies - Managed Network policy (e g Calico Enterprise) or an open source version implementation?
@DevOpsToolkit Жыл бұрын
I rarely used enterprise version of an open source networking solution so I'm not sure what the differences are.
@TitusCornelius Жыл бұрын
thanks for your amazing videos, you're really great! What are you using for creating your diagrams, they're so nice!
@DevOpsToolkit Жыл бұрын
I have an agency that does editing, animations, audio, etc.
@salihamallem Жыл бұрын
Google is working on separate branch where they provide NP with hostname restriction capabilities, layer 7 🎉
@diegonayalazo Жыл бұрын
Thanks ❤
@mateuszlachowski5282 Жыл бұрын
Hi Viktor i would love see video about Paralus or diffrent centralized platform to manage multiple clusters with zero trust concept.
@DevOpsToolkit Жыл бұрын
Adding it to my to-do list....
@ibrahimmohammed33869 ай бұрын
I am seeing traffic is blocked from external even after adding kube-system in ingress but when I add ipblock 0.0.0.0/0 it allows but it is opened for external and internal, how can i resolve it?
@DevOpsToolkit9 ай бұрын
It's hard for me to answer such a question without take a look at it first.
@me4jas9 ай бұрын
Excellent video. Stupid question may be - Can you somehow select podselector to use IP addresses instead of labels ? Sorry I came from cisco NACL background :D
@DevOpsToolkit9 ай бұрын
If it's for internal communication (within a cluster), IPs would not help much since they are changing allí the time since pods are being created and destroyed all the time.
@me4jas9 ай бұрын
@@DevOpsToolkit Make sense. Thanks !
@dimaj1 Жыл бұрын
Thanks for the great video! I thought, altho haven't played with it myself yet, that OPA Gatekeeper could also be used to limit who can access what. Is there a reason to avoid managing network policies with OPA?
@DevOpsToolkit Жыл бұрын
OPA is first and foremost about policies that verify whether resources are defined correctly rather than enforcing networking rules. You could do it though, but that would not be a good idea and would be very limiting.
@dimaj1 Жыл бұрын
@@DevOpsToolkit Sounds good. Thank you!
@davids25404 ай бұрын
Sorry if I missed it in the video but my understanding is that by default pods can communicate with each other directly, whether you use a service or not
@DevOpsToolkit4 ай бұрын
They could talk to each other, just as anything else, by sending requests to the IP of the other. The problem is that pods would have a hard time discovering IPs and keeping them up to date. Services are, first and foremost, resources that do service discovery.
@junaidahmed970410 ай бұрын
can a pod access other pods without using services?
@DevOpsToolkit10 ай бұрын
Assuming that there are no additional protections, yes. A pod can access anything as long as it knows how to find it. It would need to know the IPs of those Pods or to go out and come back in through a DNS and a load balancer. There would have to be a very good reasons NOT to use Services.
@nbensa6 ай бұрын
Am I the only one who cannot get the ingress rule to work with Cilium? Also Viktor, you missed the namespaces definition in the gist/repo. My guess is the namespaces have the label environment=production and environment=staging.
@DevOpsToolkit6 ай бұрын
Oh my. I did forget to push namespaces.yaml. Can you make a PR if you have them at hand? I haven't had problems making ingress work with cilium. It might be something else that's failing. We can do screen sharing session and take a look at it together. However, I'll be traveling for the most of June so it would have to be aonth from now 😔
@nbensa6 ай бұрын
@@DevOpsToolkit Thanks for your reply! I just made the PR. As for the screensharing offer, I can wait. In fact it gives me time to try to debug the problem myself. But I must warn you. My spoken English is very weak :-)
@DevOpsToolkit6 ай бұрын
@nbensa no worries about your English. I don't speak it natively either. Send me a direct message on LinkedIn or Twitter and I'll get back to you with a calendar link. You can choose any time available there.
@AdamAlzein-p2f Жыл бұрын
is there any SRE training from Zero to Hero ?
@DevOpsToolkit Жыл бұрын
It's a long road that starts with Linux and a programming language of choose, continues towards Cloud and Kubernetes, and never ends.
@ppasouza Жыл бұрын
--image alpine/curl ;)
@DevOpsToolkit Жыл бұрын
True. Sometimes I make silly mistakes often caused by lazyness.
@ppasouza Жыл бұрын
@@DevOpsToolkit oh to me this is not even a mistake, sorry if it sounded like that. I'm studying for the CKA so I'm a bit crazy about saving time, it was automatic hehe ;P BTW, thank you for the great content you make!
@zenobikraweznick Жыл бұрын
Is there a way to apply such policies as egress to my wife ? 🙄
@prinson001 Жыл бұрын
@NomDayPloom Жыл бұрын
...last? 😅
@JohnNguyen-x1w6 ай бұрын
Not get shut in your back? Is this English?
@DevOpsToolkit6 ай бұрын
English is not my mother tongue so it could be the case of me inventing a phrase thinking that it is used by others