Hello, and welcome to this demo on
getting started with the Calico Kubernetes
networking tool. So to start out, I'm in Google
Cloud. And I'm going to go ahead and create a new
Kubernetes cluster for this demo. Let's go
overhead. Let's go ahead and go to the Kubernetes
engine page. And you see I don't have anything
right now. So I'm going to go ahead and open my
Cloud Shell. And Cloud Shell is primarily where
I'll be working for this demo. Let's go ahead and
create our Kubernetes cluster. I've got the
command saved off here, we're going to create a
new cluster called Calico demo cluster. And we're
going to enable the network policy add on, we'll
also make this in US central one A and we'll limit
it to just two nodes. Go ahead and pause the video
here and let this create and I'll resume once it's
done. Alright, we're back here in G Ke and our
Kubernetes cluster is up and running. Now the next
thing I have to do is download the Calico CTL
binary from GitHub, I'm just going to grab the
latest release there. Next, I'm going to go ahead
and make it executable. And then I will create a
symlink to that in my user local bin directory. So
I have access to it on the system path. So now
that that's set up, I can see I've got my Calico
CTL version here. It's worth noting you don't have
to do this on Cloud Shell, you can do this on any
control machine that you're managing your
Kubernetes cluster from or even install it as a
separate pod inside your Kubernetes cluster. It's
a pretty versatile installation process. But now
that it's on the system path, I can use it to list
the nodes in my Kubernetes cluster. Except there's
one catch here. At the time of recording, there is
a bug in Calico CTL, where you'll get this version
mismatch error, I checked on the GitHub issues
page. And it's actually only a couple of days old.
So it's not going to be resolved for this
recording. But depending on when you're watching
this video, you may or may not encounter this.
That being said, I'm going to add this allow
version mismatch flag because it's not going to
affect the demo if we use that. But now Calico is
allowing me to list the nodes in my cluster. And
I'll go ahead and verify that by going into the
cluster here in my G ke Console, go into nodes and
then scrolling down and you can see those do match
the nodes. So we know it's installed. It's
connected to my Kubernetes data store. And we're
ready to do some work with Calico. So we actually
don't need the console. For the rest of this demo,
I'm going to go ahead and just open it up in a new
window here. So the next thing we're going to do
is we're going to create a new Kubernetes
deployment that we can use to test the networking
policy that we'll create with Calico. So first I'm
going to create a new namespace called Calico
policy, and S or Calico policy namespace. Next,
I'll create a deployment to that namespace. And
I'll just deploy a simple nginx server. And then
I'll go ahead and expose that nginx server on port
80. Now that that's done, I want to create a new
pod with busybox. So that I can run some tools
alongside nginx that I'll use to manage it, or to
show the demo here. So there's my prompt, I'm in a
BusyBox pod that is alongside my nginx pod. And
I'm gonna go ahead and just run a W get on nginx
here. And you see I am getting the nginx welcome
page back. So I know my ingress rules to the pod
are working. Let's see if I can go out to the
public internet and do the same with google.com.
So yep, there we go. That's going to recall this
last command just so you can see it. But I just
ran the same command again against Google. And of
course, it returns a lot more than a simple nginx
server. So let's clear the screen. Now that we
know that's working, I'm going to open up a new
tab here. I'll clear the screen one more time. So
let's take a look at what I've got here. I've got
the Calico CTL binary which we installed earlier.
And I've got this policy dot Yamo file. And that
is a calico networking policy document. So what
this policy is doing is it's selecting this access
pod which is the BusyBox pod that we're running
all these commands in and it's going to allow
egress from that pod. And you'll remember this is
the command that I went and created the BusyBox
pod with and it's got the access tag right there.
I'm going going to take that policy document and
pipe it into the Calico CTL create command. And
I've got the dash f parameter. But instead of
specifying the file name, I'm going and reading it
from standard input, I could just as easily
substitute that dash for the name of the file or
the path to the policy document. And then I've got
the allowed version mismatch flag. So let's run
that. Now that that's applied. Let's go back to
our BusyBox pod and try and run those same
commands again. So now my network policy has been
applied. And I'm back here in my BusyBox machine.
Let's go ahead and try and reach outbound to
google.com. See, that still works fine. But now
I'm going to try and do the same to the nginx pod.
And that is going to timeout because we do not
have a policy that allows that traffic anymore. So
in this video, you'll learn how to set up a
Kubernetes cluster with the network policy add on
install and configure the Calico CTL plugin and
then apply a network policy to restrict traffic.
Thank you for watching.