There you go. Hey guys, we are recording the video. So what I was talking about is understanding what this Terraform tool does. We have covered a little bit of a similar type of tool in another example, if you recall. We used this thing called Cloud Formation as a templating tool. This templating tool, which gives you a template that you can apply to the Amazon Web Services Cloud, and you can create whatever design you have, and it just goes live. We have seen that example in at least one case of auto-scaling group creation. So we applied the template and it went live. This same idea implemented, but in a neutral fashion, is what Terraform is. So when you have a Terraform folder, it is called a TF folder. In that folder, you will create a bunch of things and put them, and then you apply the design to a cloud of some sort, and it goes live with your design, with your implementation. That's how it is. Let me get my microphone also. I think I forget that. So the idea behind this Terraform tool is something I want to give you a good idea about how do you make use of it. And we have done an Amazon exercise already in the past in which we created our own VPC. And so what I want to do is do that same exercise, which was fairly elaborate in the cloud technology segment. I want to do that same exercise, but with the help of Terraform. And I want to just ready-made, use a ready-made implementation, and show you how you apply that to create exactly the kind of VPC you wanted to see. We did that by hand, mechanically, like by mouse clicks. We want to do that through automation this time. So that is where this thing called Terraform comes into play. And it is an agnostic tool, so it works with any cloud provider. So that's the concept I will be interested in covering. We have a precursor to that, is this multi-tiered architecture using Docker, which is what I want to quickly go through. There is already a video that illustrates that. And then we will jump to the Amazon VPC example, which I think is right here somewhere down below that. Where is that? Yeah, the N-tier architecture, so multi-tier architecture blueprint. How do you create that setup? We will go through that exercise to help us understand how do we apply this in practice for a case where you have some design, in the design idea in mind, and you want to take that to a given cloud. And cloud solutions available are quite a bit. You can see that major cloud providers supported include all the big suspects. And then there are other cloud providers also, and it's a long list. And lots of other things it does, but we will focus on the big ones first, and specifically focus on the Amazon usage, and see how it interfaces with the Amazon cloud and creates what we want to create from an application deployment, a full configuration deployment perspective. So that's what I have in mind. We have other ideas that we want to discuss and do live exercises with. They include enterprise-grade storage deployment. So we have been discussing Kubernetes as an orchestration solution for any kind of architecture that you want to deploy in any cloud. That Kubernetes can be configured to use storage. And in case of enterprise like yours, you may have a need to use internal storage and your internal private cloud. And for that, you need high-end enterprise-grade storage solution, which is, of course, available from companies like EMC and other places. And I think you already used that, which is nothing wrong with that. But I want to give you another perspective on using open source to create high-end storage solutions that you can create and integrate into Kubernetes or just about anywhere else. It doesn't have to be this, but this is, of course, the most popular enterprise-grade solution available today that people are using. And so to supplement that, to supplement storage capabilities into your own solution, doesn't have to be this solution, any solution. You can just provide an open source, solid enterprise-quality storage using open source technologies, such as Gluster. This Gluster is a product which gives you, a free, open source, scalable, software-based network file system. And this thing is now owned by Red Hat. So they bought it because it's a good thing. So it is still open source, and it is owned by Red Hat, they maintain it. And it is high quality, very, very efficient, and cost-effective, and open source, free solution. And that is something that is used across the board, and many companies use it already. So you want to pay attention to these things. Similar to this one is another one called Ceph. And Ceph is another storage solution, which is the future of, they call it the future of storage, whatever. But let's see what it does. So it is a unified, distributed storage system designed for excellence, performance, reliability, and scalability. Now this thing, Ceph, is also open source. So it is, code is available here. And it is on GitHub. And by the way, this thing is also stellar in terms of its performance, reliability, quality, use in enterprise, and all that. And this is also acquired by Red Hat. So you can see it is now a part of Red Hat. So that is another thing that we can do if you're interested in that direction, to focus on storage abilities, to focus on network capability, using open source technology, you should pay attention to these things because they are actually very, very popular. Another topic that you want to cover, maybe, is monitoring, which is how do you monitor your infrastructure in a cloud context. So you want to use a thing called Prometheus. And Prometheus is also open source. So all the things that we will cover is open source. And so basically, I don't want to tie myself with a company. That's why I stick to best of breed, great quality, open standard that is maintained and publicly available to everybody who can use and consume. So this thing called Prometheus is a first-class native Kubernetes solution available that you can use to monitor your Kubernetes deployments. And this is also open source. And this is a part of the Cloud Native Compute Foundation, just like you would think of all the good products these days are going straight incorporated into the CNCF, which is a good institution in itself. And all the big players are there already. Now this thing called Prometheus is a monitoring tool. And it is, I think it came from Google also. So just like Kubernetes came from Google, this Prometheus also, I think is based on Borgman, like Prometheus is based on Borgman. And Kubernetes itself is based on Borg. These are two internal Google products, and it's a rewrite to create open source. And this is a rewrite to create Prometheus also open source. So these two tools, we already covered this. This is a monitoring tool that we want to be able to understand. It is also very popular. And to supplement this is another tool called Grafana. Grafana is another open source tool that gives you the ability to visualize as to what is going on in a cloud. So that is here, Grafana open platform for beautiful analytics and monitoring your cloud infrastructure. And so it gives you beautiful charts and graphs and views about what is going on in your setup. That is something that you need to pick and choose as to what you want us to cover. And then tell me that we will cover that. And so we'll go in that direction. If you don't tell me and you keep quiet, I'll do what I like. So I'm just telling you that, please let me know what you are interested in. Otherwise I will have no idea and I'm going to make assumptions, which will be a bad thing. I don't want to assume. So you tell me if you have any interest. Just your inclination, just slightest inclinations, give me those. So I can then guide my discussion in the direction that you may like, as opposed to bore you with something that you may not want. So please speak and tell me, what do you think is more interesting to you? And if you don't speak. So, quick question for Pramithi, is that a tool that we can use at an enterprise level? Yes, of course, it should be designed for that. It is exactly designed for enterprise usage. So this is not a toy. This is not a toy implementation. It is fairly elaborate and you can read up a little bit more of it and maybe we'll discuss it next time. That's also okay. You don't have to do it right away. Get yourself some feel of what this thing is. And it is built at SoundCloud. It has been in place since 2012. It is now a part of Pramithi's joint, the Cloud Native Compute Foundation in 2016 as a second hosted project after Kubernetes. Kubernetes was the first one. Now these things that are, you can read about feature sets and it is fairly extensive and it will run inside a Kubernetes cluster fairly easily. You know, I'll walk you through. In fact, we have it written down here already. You can see how it is there somewhere here. I'll just point it to you as to where I have it written down somewhere in this list, monitoring right there. And so here, you know, you can, where is that? Monitoring right there, click. Click on that one to go to the, come on, click. Yeah, Prometheus. So here is how you deploy Prometheus and how do you see it? How do you allocate memory? How do you allocate disk space? And then you, once you have that allocations created, you can then run a YAML. So this is a YAML example, the custom values. And then you install Prometheus and you then see it. And you can then visit, point your browser at that location to see. And then you deploy Grafana to see the beautiful UI that corresponds to what I just showed you, this UI, this kind of UI you can create. And, you know, it looks very fancy, but you can customize it to what you need from your, from your application monitoring perspective. Take a look at, and this is competing with all the other people in the industry. If you look at the industry solution set, you will have every cloud vendor will have their own monitoring solution, you know, that you have to pay for. So there is, from Amazon Web Services, they have thing called CloudWatch, and you have to pay for that. Microsoft Azure has their own monitoring service. Google has their own thing called, what is it called? Stackdriver. So these are paid solutions, you have to pay for them. And there are other companies outside that will also collect money from you and give you a monitoring solution from, from any of these places that you deploy your clusters and your services. Those companies may include New Relic, that's a commercial product. Another company called Datadog, another commercial product. And you have to pay for these guys. Everybody will ask for money. And there is nothing wrong with paying them money, but when there is a better solution available called Grafana, which is probably more easy to tweak and easy to use and better looking and more customizable than any of the other solutions. And it is free, you would be naturally inclined to use it. I mean, there is no no-brainer in my mind as to why would anybody use anything else when they have such a thing available to them. And on top it runs with Prometheus, and this runs in Kubernetes, and Kubernetes runs in any cloud provider that you choose. But why would you go anywhere else? I mean, it's a no-brainer to me. You know, you need to decide what is right for you. But solutions are available. You need to pick and choose. So you go Amazon, you probably likely get this. You go Microsoft, go Google, go other places, go third-party solutions. They are all commercial products. I don't talk about them because that is not my interest, because it is commercial in nature. And so I don't want to make this a marketing program. I'm not selling stuff to you. So I'm not doing it. I am focusing on open source. And I think this is better. Now, honestly, seriously think this is better, because you should be able to figure it yourself out. And you can put Prometheus, Grafana, Kubernetes as a solution, and compare it with what other people provide. And then do a A to B comparison, or many to many comparison, and see what is best for you, for your company. And then you select your choice. I mean, nothing wrong in selecting any of these choices, but I don't want to advocate any one of these. So I go open and stay neutral. That's how I operate. And that's my way of operations. So I don't venture into commercial software for a specific reason, because I think open source is actually better. It's harder somewhat. It is harder to put pieces together. It is difficult to identify what is the right course of action when you need help and support. That is also a difficult challenge when you don't know what to do. Who do you ask? And you have to resort to reading the source code, which is possible, but that's how I operate. So I feel very comfortable doing that. That's one of the reasons why I like open source. And also there is community behind these products that will help you if you get stuck. And they will come out of the way, out of the blue and come and help you out on GitHub when you open an issue. And they will not ask you for money, but they just want to improve the product for the sake of improving and doing good things. And that's why open source thrives. It has not only survived, but also is thriving and is actually killing everything else, literally. Killing as in, I should say, not death killing, but killing as in winning everything over. So that's happening. So you need to decide. So having understood that piece, you may be interested in Prometheus and Grafana. So we'll cover it, is what I understand. Is that the area of your interest? We'll include that. And extend our Kubernetes exercise to include, where was that? Where did I misplace it? Here, yeah. So that exercise, we can do it. And you can get a feel of what this thing can do. And you can deploy Grafana also and take a look at how the UI looks and connect it to a given set of applications and understand the monitoring characteristics. And then there are a ton of dashboards available that you can just apply. So here are ready-made dashboards that you can just pick and choose. These are openly available. You can just take the dashboard, apply to your Grafana, and you get a ready solution. For example, I'll just pick some. You want to say, you get alerts from Linux nodes. You just copy this ID and then maybe download the JSON file and apply that to your Grafana and it becomes ready for you. It runs, it takes data from Prometheus and shows you this dashboard, which kind of sort of looks like they don't have a good picture for it, but it doesn't hurt to actually try it out. Maybe this is not as popular. This is not as popular, only 85 downloads. No, not super popular. Let's go look at some popular ones that are highly developed. So here is a good one for Elasticsearch, which should have a picture for us. And so here is how it looks like. This is a Chinese implementation, but that doesn't matter. The idea is that people are contributing to create good quality stuff and they're giving it away in the hopes that somebody will improve even further. That's how open source grows. And that's how you see Linux. That's how you see Kubernetes. That's how you see all the products that we have used are primarily, you know, almost everything of them is open source is what we have been observing is that people are, maybe this one has some good pictures. Does it? Yes. So you can see this is your Apache monitoring overview, Apache overview. It has 3000 downloads. So people have been using this particular view to get a ready solution to look at Apache's performance characteristics. And you can monitor it readily by just getting this ID and putting that in Grafana. So it just shows you a ready view of all the Apache machines inside your cluster. But it's an easy way to get to a solution quickly. There are tons of dashboards already available already here. And you can of course use it. If you happen to use a storage solution, you get the Ceph cluster dashboard and you copy that. And you get to see how your Ceph deployment from a storage perspective is looking like from available capacity and its consumption, its metrics, and all the things that you may be interested in examining how is your Ceph storage solution running and doing for your set of applications in your company. And so that's giving you some flavor about it. Read up on it and tell me what you want to cover. We will cover that. For today, what I want to do is, let's go that section where we had. If you recall, we did a exercise long ago in cloud technologies in which we created a virtual private cloud. That was a fairly comprehensive exercise that you may recall. It was called data center in the cloud. Where was that? Here. And it begins with understanding what VPC is. And we went through subnets and this and that, that whole exercise that we have done through this already. What I want to do today is do the same exercise, but in a matter of one command, one command line and run the whole thing. That's the magic, but it is actually not magical. So what I want to actually do is to help you understand the magic underneath as to what does it take to build such a thing out. So we'll do the same exercise, except this time in cloud architecture, we are doing it through automation. So we'll get to that exercise and it is located in the segment here called blueprint for an end tier architecture. That is what I want to run. So if I go there, there is already a video walkthrough. You can read it if there's a three hour video right there. It's one of the previous sessions that I posted a recording for. But the source code that I will like to use today is available right here. And what I will do is help you understand what the magic is. That magic is available in this location on GitHub. So I'll grab a link to you and paste it in Slack chat. So you can also read along and probably you can do this exercise with me as I operate because it's fairly easy to run. It's difficult to understand. Running is a fairly easy action. It just says Terraform apply and you're done. That's as simple as that. So here is your code. And what I want to do is grab this code, put that in a virtual machine. So I clone it like that, take it to my VM. And here is that code. So I'll say, hello, do I have it already? No, I don't. So a git clone, I clone it. And that comes down locally and it's available to me right there. And I open up an atom and I inspect. That's the difficult part is understanding it. So we'll do that part. And then running it is literally one line, Terraform apply. That's it. That's all it takes to run this setup. This setup is a representation, a Terraform representation of the entire exercise that we did to create a VPC from scratch. You remember we created a VPC, right? I hope you do remember that. So let's get to understanding what Terraform does. Okay. So what Terraform essentially does is captures the state of some architectural implementation in a cloud, any cloud. It doesn't even have to be a cloud, by the way. It can be as small as a machine in your garage. You can also configure it to run it with Terraform. So any kind of infrastructure in IT, that's what it deals with. Mostly people use it with cloud. And so what it does is you have some design that you create some application that run and this is a live setup. What you need to do is you need to create that setup again in another situation. And that reproducing a setup exactly like that is hard. You want to kill this off and create a new one. That part is really, really difficult. So to simplify that action, if we are able to programmatically create all these things to begin with, then reproducing this in another location becomes really easy. So this idea of Terraform as a tool uses its own language, its own slightly proprietary kind of looking language, but it is actually open source. So I cannot use the word proprietary because it is open, but it's a custom language. It's not your standard Ruby Python or other known languages, but it's slightly different looking language. It's not complex though. So let's go begin with understanding what the overall structure of a folder in Terraform looks like. So here is your Terraform folder. And in that, we have a bunch of things. Let me hide all these things first to simplify our understanding. So what I want to do is there are these files here that look like complex detail. I want to hide all of them and put them in this whole folder, which contains nothing. So I'm going to move these files out like that, just hiding them away from your view and also hiding it away from the view of Terraform. So that Terraform will have no idea what I'm doing. So basically the whole folder hides it. I'm hiding all the TF files away in a whole folder so that I simplify our understanding as well as I simplify the understanding of Terraform to make things work for us. And so here I have hidden all these files away in a whole folder. And all I have right now is this Terraform variables file. That's it. And there are some other things that I will use later on. These are binary folders for some scripts that I have written here for our usage. Once the setup is ready, we'll use that bin folder and the cloud config app YAML file later on. For a specific example, I'll describe what that means. But right now I have put all the most of the files in this whole folder, which is hidden from view of Terraform. So Terraform will have no idea what to do. It's an empty project from Terraform's perspective. And the only file we have is this, which expects me to have an access key and a secret key for Amazon Cloud. So I need to change these things. I need to do that. What does that mean? It means I need to go to the Amazon Cloud and grab my credentials and put it in the Terraform folder so that it knows how to deal with Amazon's cloud and actually connect to it and operate on it and all that good stuff. So I need to get a credential set. I go to my account, get my security credentials in place. And this credential set, you should not show it to anybody as you know already. So I am going to show it to you, but that's okay. I will delete that later on. I am copying this access key and putting it right here. You know the usual stuff, right? This is what we do every time. We have to interface with the cloud. Get some credentials from the cloud and put that in the right spot like this. Now I save it. Now my Terraform can connect to my Amazon account because I asked it to connect. And I gave it permission. So now in this folder here, I have the Terraform folder. So I go inside and there I find that I have the binary folder, which I'm not using. Cloud configuration folder, which I will be using. And hold folder, which hides most of the stuff. So in here, the only file that Terraform can see is this file, which kind of creates, contains credentials. If I now say Terraform, what's the plan? What do you want to do when you run? Tell me the plan. When I say Terraform apply, it will actually execute the plan. But before that, I can just ask Terraform, what is your plan? And it tells me Terraform command not found. That means we don't have a typing mistake, Terraform. Terraform, what is your plan? And it says, I did not find any configuration files. I cannot do anything because I don't know what to do. So nothing was visible to me. I said, okay, fine. I'll show something to you. Give me a second. What I will do is actually expose one of the files to Terraform. So one of the files that I want to actually do is grab from here, one of these files. And the first thing you do when you go to a cloud and then here you want to select one of these locations. Say for example, go to your VPC section here. And there you want to select say Oregon or maybe Northern California, your choice. Any location doesn't matter. But there you have to actually go and look at your VPC and there is this cloud genius VPC that I want to get rid of and all that and maybe create a new one. And so I will not actually delete anything else, but I'll just create a brand new VPC right there and configure it and run applications inside, put a NAT machine and all the routing and run a real applications inside, put a load balancer, all of that thing in one command. So I want to create a VPC. The first thing is to click the button and create a VPC here. Give it some name. Give it some name like that and put in a cider block. 10-0-0-0 slash 16, something like that. That's the first logical step that you would create. And so that is what I want to do, but not by hand. I want to do it through Terraform. So I go look at my VPC sample. And in here, what I'm doing is grabbing that file and putting it outside of the whole folder like that. And then I will read that file. In that file, what I find is it sets up AWS provider, which means there is a concept of a provider, which is how Terraform talks to a cloud. So it is going to talk to the Amazon cloud. And here it expects to see the Amazon access key and the secret key that I have put in the variable called access key and secret key inside the Terraform tf.vars file. That's where the variables are stored. So to pick up those variables and provide it to the tf file here and here and here. And I have also selected a region variables region. That region file is not defined in here. So maybe we can add it or we can go to the whole folder and find out a variables file already, which describes a lot of variables. So I want to grab that variables file also and put it outside for Terraform to be able to see. And by doing that, I'm exposing the variables file to Terraform in which I define my access key, my secret key, my region of choice. And the choice region is uswest1. I can change it to something else if I like to in the variables definition. Here what I'm doing is basically defining a variety of variables that I want to be able to use with some default values if I'm interested in. And I can put the default right here, or I can put this default right in that file, pretty much like here. Like that. So I'm not typing it here because it already is included, but I'm just giving you an idea about what that can take. Having understood that piece, let's go look at what are the things we have in the variables file. We have an availability zone selection, uswest1. I will select availability zone, uswest1 A, or B, or C, or whatever you have. I'm also selecting a CIDR block for my VPC. This is the number that you choose with a slash 16. Like in our example here, I was about to select, create a VPC and select a CIDR block of 10, 0, 0, 0, 16. In this example, we are selecting a 10, 1, 28, 0, 0, slash 16. So it's a slightly different block. But this is the block I want to actually apply to my VPC that I will create through automation. Then I'm also defining a subnet for public and a subnet for private. Like that. I'm also defining some other additional variables, such as the Amazon machine image numbers. If I choose the uswest1 region in here, then I have a machine ID number this, versus if I choose uswest2, which is Oregon, then I have a different machine ID number. Or if I choose east1, which is Virginia, then I have another ID number. So depending on the region choice, I need to fill it up with machine images that correspond to Ubuntu operating system for my region choice. So since I am not changing my region choice, I don't need to fill it up with another new number. So I can just use the example that I have already. So that's how you define your variables. And having understood this piece, what I would like to do now is ask Terraform, what's the plan? And so it says something. And let's go read that. It says, I did not find any version installed. A version of what? Version of the provider, called Amazon Web Services provider. I did not find anything. So it tells you what to do. Right there. Plug-in reinitialization required. Please run Terraform initialize. So we will have to run this step before we ask this question, Terraform plan. So it begins with Terraform init. So when we initialize the provider we need, and that provider is Amazon Web Services in our example, because that's what we call it. Right there. We are calling a provider for Amazon with this version number, and then configuring it with our access key and secret key and region. Then we go ahead and define a resource inside the provider, which is to create a VPC. With the cider block we have chosen on our variables, and giving it a DNS host name true, which is allowing you to create DNS host names inside the VPC, and tagging it with a name called automated. That will be the name of our VPC also, by the way, because we are tagging it. And so that becomes the VPC creation. So you define your VPC like that. This step is logically similar to you creating here. You know, my new VPC, and putting a cider block of 10.128.0.0 slash 16. Pretty much like that. Except this name will be something different, like automated. Something like that. It'll be something like that. Automated VPC will be the name that will pop up. So I'm canceling this one here, going back to here. And in our AWS example, I want to make sure that I initialize my Terraform. So I said, Terraform, please initialize yourself. So it initializes. And by initializing, what it does is downloads a plugin to operate with Amazon. So it initialized that plugin, and tells me that it is all green color, which means it is good. And now I can actually ask for the plan. Hey Terraform, what do you want to do when you run? And so it says, okay, let me go check. And what it's going to do right now, is actually goes to the Amazon account, and connects there, and finds out what do we have, versus what do we need to have? That's the key thing to remember and understand, is that this thing, let me do it one more time to clearly understand this. So let me run it one more, Terraform plan. And when you run the plan action, it is actually connecting to Amazon in my account, and finding out, do I have a VPC, or do I not? And so it finds out that I don't have the VPC there, by this construction, it will actually create this green symbol, plus sign, means it will create a new VPC, because there is no such thing inside my account. And so it tells me that I will add one resource, nothing to change, nothing to destroy. And it will be called automated VPC in my account. So as soon as I run Terraform apply, as opposed to plan, it will go and create a VPC right there. So we'll just do it right now. Terraform apply. And you will see that it goes to the Amazon cloud, and creates a new VPC for me. And it's doing it with a validation question, it will probably ask me, and it did the creation action already. So we have a Terraform apply action, in which we now have a report saying resources one added, zero changed, zero destroyed. So let's go check what Amazon did for us. The in Amazon, what did Terraform do? So we'll go look at, we had initially, we had a cloud genius VPC, and a default VPC, those two ones already existed. I will now refresh my browser to see what do I have, anything new I have, do I? And apparently so. I have now another VPC called automated. And this VPC has the cider block that we chose in our Terraform. 10.128.00 slash 16. It has all the characteristics that you expected to see, the DNS resolutions, yes. DNS host names, yes. We called these things out, specifically in our Terraform example. If you recall, DNS host names, I said true. So that's where you see DNS host names say yes. Whereas in the other example, we do not have that yes, because I did not select it when I created that manually. I did not enable it manually, probably I forgot, but it's not critical. But I'm just pointing out to you that this is something that is configurable. Every single parameter you see here is configurable through Terraform, including the cider blocks we chose right there. And the details about whether the name, the tag, the network access control, the option set for DHCP, the routing table selection, which is automatically assigned. And these parameters that you can see is reported here as computed values. These are computed on the fly, dynamically generated, depending on what Amazon decides or what Terraform decides, depending on who needs to decide. And then this idea about the IP address range of the cider block is assigned to the VPC. And as a result, we get apply complete, one added, nothing changed, nothing destroyed. Now, if you go back here and say that VPC should be deleted, just like that. So Terraform doesn't know that I deleted the VPC. And so when I run Terraform apply one more time here, it figures out that, hey, there was a VPC before, but now it doesn't exist. So now what do I do? Oh, let me create one. So it'll go and create it. Another VPC will be created because I deleted it. And it was created. It has a new identifier number compared to the previous one that we had before. No, no, no, same number. Hold on, is it the same number? Yes, it is the same number. The VPC ID is the same. How come it's the same? It should not be the same. No, this is the old one. This is the old ID. This is the new ID. Yes. So that's the new VPC ID. Let's go compare this ID with brother brother 30, BB30 with the actual Amazon implementation. See what do we have? We should have a matching ID brother brother 30. Write that. And the idea that we have is VPC ID for automated VPC is BB30. So that was a report back from Amazon coming up and showing up here. So this is a new creation. We deleted this one without telling Terraform. So Terraform figured out that the old VPC was there and it could not find it. So it decides to create it and it creates it. And then it reports back the ID number and other details. And then you have a resource added state. Now, if you run Terraform apply one more time without actually deleting it on the cloud, you will see that it does nothing. It will gladly do nothing and say, yeah, nothing needs to be done. So zero added, zero changed, zero destroyed. Now, does this give you a flavor of what is going on with Terraform? Does it help you understand what's going on? Yeah. Yeah, I mean, starting to, yeah. Okay, okay. Good, good. That's what I want to hear. That you actually get the point. So what I want to do now is slightly increase the complexity of the exercise. And you will see how where we are heading towards. If you're heading towards setting up a couple of machines, install Docker, put a load balancer in front, put a VPC in place, have subnets, routing table, NAT device, and on top, one more thing. We are adding a VPN connection, virtual private network connection. Now that you're familiar with what a VPN is, you already use Cisco VPNs in your company. We'll have our own open source implementation of a VPN using OpenVPN. And I will set it up and I'll give you credentials. So you can also connect to my cloud using your machine without effort, without much effort. We just use my credentials. I'll pass it on to you in form of an OpenVPN configuration file. And that will give you access to OpenVPN is the open source VPN solution. And that is what I will be running. By the way, it's configured into Terraform. So it will create that. All we need to do is download the credentials that I will use from my laptop and you will use from your laptop. And all of us can then access the private cloud that we are setting up right now. That's the ultimate end game for today. So I'm slowly adding complexity to the exercise. Right now, we just created a VPC skeleton. It has nothing inside yet. Okay, now further adding more stuff. As you will notice here, it has kept track of the state of the union or state of the cloud. By that, I mean it is keeping track of what was created and specific detail about the CIDR lock, the option sets, the links and host names and tenancy and routing table and tags and all that. You can see that the state is preserved in this tf.state file. And in addition to the tf.state, there is a backup also, which is a replica of currently the replica of what we had. And this is how Terraform keeps track of the state of the cloud for a given example. These files are critical files. So you will need to keep track of them and hold them in version control. So keep track of what you have in a private deployment setup that you might have. That's where it actually stores the details. So now we'll add more files outside of the whole folder, bring it outside. And what I want to do now is create a public subnet. You know what a public subnet is already. I'll just remind you or refresh your memory. A public subnet is something like 10.128.0.0 slash 24. And this is just a number that I pick. And I will have another subnet also, by the way, 10.128.1.0 slash 24. This one is different from the zero here. And we will have a NAT device here and a bunch of other things and then machines here like that. And then we have a load balancer and we'll have users and they will connect to it, not NAT, not NAT. The load balancer connects directly to these machines inside. And these machines will run Docker in there and they will have inside Docker, they will have an application running here. And all of these things will be done through automation. So the first step or rather the next step after creating a VPC is to create this public subnet. And along with the public subnet, we'll have a routing table. Along with this private subnet, we'll have a routing table. And we'll have to make sure that they match each other and allow the traffic to flow and all that. And this routing table should let the traffic for these guys to flow through the NAT device, not directly. There will be a gateway that will allow the NAT machine to go directly to the world outside. You remember these things from our previous exercise. So that's what we are really trying to accomplish. But through automation and this load balancer is the front end endpoint for the customers to come in. So public subnet is what I want to do next. It's very easy. You just have to create a routing, a cider block. The whole VPC has a bigger cider, 128.0.0-16. This is a bigger cider compared to the 24 ciders. These are smaller. They have about 256 addresses, whereas these guys have 64 K addresses. If I'm not mistaken, maybe I'm wrong. I'll check my math later. But let's go get a public subnet created. So I need to move this file and move it outside of the whole area like that. And then it did not move. So let me move it again carefully and put it in the Terraform folder like that. And now hide the whole folder again and focus on the public subnet folder. Sorry, public subnet.tf file. In this file, there are two big sections, actually three sections. One of them is this section. Now this section creates a gateway. A gateway is something that we already know, is a gateway to the world outside. That is the first thing we'll create. The next thing to create is the public subnet. Actually, there are four things I missed. There are four things here. This is the second thing, by the way. And the third thing is a route table for the public subnet. And the fourth thing is to associate the route table to the public subnet. This association needs to be created between the table and the subnet itself. So the fourth item here at the bottom is the association between the table and the subnet. So we are creating first a gateway. So you see a gateway pop up. Right now we don't have any gateway. If you look at our Amazon implementation for the automated VPC, you will filter it to the automated VPC and look at our gateways. We don't have any. We can create one by clicking this button and giving it a name, but that's not the idea. So we'll cancel it. Instead, create the gateway through automation. And that is this automation line number 1234, is to create a new resource called AWS Internet Gateway. And assign it, or rather associate it with the VPC, which is identified by the default identifier for VPC. And this ID is actually stored in your state. And that is this ID. And so that's what will be associated. This gateway will be associated with the VPC ID that you already know, and it is preserved in your state. So that's how it creates a gateway and associates it with the VPC that you have in question. So that is the one beginning step. Then we create a public subnet. And that resource we use is called AWS subnet. So the next logical question you will have is where are these things coming from? How do I know what to write here? Like here and here. What do I write? I mean, I understand these things, but where do I come up with these names? AWS Internet Gateway, do I make them up? AWS route table, do I make it up? No. You actually go back to open source documentation for Terraform and you will find it right there. So go to the provider documentation for Amazon, and here you will find a, how, this documentation sucks. I must be honest with you. It sucks. And it's hard to find. So how do you find it? You go to Google and say Terraform, and then AWS, and then gateway. And then you're easy to find it right there. There it is. That's how you find. So you can find AWS Internet Gateway. How do you create? You create it like this. There's an example usage given to you. You can just get a resource called AWS Internet Gateway and associate it with the AWS VPC ID that you have preserved already in the previous step and also give it a tag if you like. In my example, I'm not tagging it, but you can tag it. And so maybe I can include this tag into my example and use it. Similarly, you're going to create the very beginning step, which is to create a VPC. You can say Terraform, AWS, VPC, and it should bring it up. Google is much better than actual sources itself. And so here is a resource that you can let you create a VPC with a CIDR block that you choose here. So here you can actually go further and expand CIDR block and instance tenancy dedicated. This is going to create an instance tenancy dedicated, which is going to be expensive, but the default value is not dedicated. Default value is shared tenancy. So just you understand that you can create a modification to any setup that you want to create. And these things are further documented here. So you can go and read specific examples of what you want to create as an additional attribute to the example of a resource of a given choice, like in this case, AWS VPC. Back in one more example, route table. How do you find out what do you need to write when you are using a route table? Same idea. Terraform, AWS route table. There we go. It should bring up right there. And there we find it. And we should be able to, there are some notes here. Okay. You can probably skip the note for now and go straight to the example usage. And here you find it. Here is how you create a route table. You associate that with the VPC. You define a route and another route and a tag. Once you have a route created, you need to then create an association between the table and the subnet. That association part is also very simple. You just have a subnet and a route table. Subnet ID, route table ID. Just make an association between the two and it will associate it for you. That's what you will see happen when I now Terraform apply. So I'll go here and before I even apply, I'll say, hey Terraform, tell me your plan. So it will go and find out what do you have versus what do you want to have and show you the difference. It'll tell you that we have to create a new gateway because it doesn't exist. We have to create a route table called public because it doesn't exist. We have to create a subnet called public because it doesn't exist. And you have to associate the route table with the subnet. So this association between the route table ID and the subnet ID will be calculated based on this creation and the other creation for the public route table as well as the public subnet. And then it will be associated with each other so that the routing will actually flow. And so there are four things that we need to do here. So four to add, nothing to change, nothing to destroy. And now if you run it, say Terraform, please go ahead and apply the design. It will gladly do it for you. And so it is going to go to the cloud and implement the plan that you had seen and then report success. And so you see that it is doing it. One, two, three, four thing added. Now you can go back to Amazon and check what it did. So we go see Amazon, can you tell us what you have? We'll just go look at our subnets and we see that there is a public subnet created. We look at our route tables and we see that there are two route tables. One of them was given to us by default. And let's see which one was the default one. I think the one below was the default one, I think. Let's check. I think this is the one by default, given to us by default. But this one was created just now as I read it, but I'll confirm this also. So this one was called public. Maybe we should tag it in the documentation in our Terraform itself so that I don't have to get confused between what was created and what was already there. And this tagging that I did manually, you can also do through automation. But I want to confirm that before I make an edit. The route table ID created was A-C-E. Let's go see what the Terraform results are. A route table ID created was A-C-E. So that was the one created. This route table ID is actually a route table ID is here. And it was computed. And the result was stored in the route table called A-C-E. And this was finally associated with the subnet ID, which was also created. The subnet created was seven, B, eight, B, seven, delta, eight, brother. That number was created as a consequence of the subnet step. And that result was here. It was then finally associated between the subnet and the route table association happened. This is the association step. So let's go make notes and compare what we have seen here. Is this route table that we see is the A-C-E route table and associated with the subnet that you see is the only one we have, which is seven, delta, eight, brother. And the route table association is already made. And let's check that piece also. So in the route table section, you'll see the association made already with the public route, sorry. Let's go back again. Route table associations with this subnet called public, number seven, eight, sorry, seven, delta, eight, brother. That number matching number with the public route table, sorry, public subnet with the side of chosen is already associated according to the public route table. We also have a gateway created, which is showing up right here. And that gateway is not visible to us because we need to refresh. And now you can see that the gateway to the automated VPC is already created and attached to the automated VPC, as you can see from the view here. So that automated VPC now has a gateway already created and connected. So now we have these four resources created. So from a user's, or rather visual perspective, what do we have accomplished by now? We have a VPC. It has a 10, 128, 0016 slider. We have this public subnet. We have a route table corresponding to it. This public subnet is 10, 128, 0024. We have a gateway, internet gateway created. And we have an association between this and that. And that association has been established. So the first action was this, the second action, the third action, the fourth action, and the fifth was the association action. Those are the five actions we have done through Terraform by now. We'll keep building these things by adding more items to the flow. I hope you are with me on what I'm doing, even though it may be like the first time you're ever looking at Terraform, but it is not difficult to understand. You just have to pay attention to what we are going through. If you're having trouble understanding, please tell me so I can further simplify. I hope I'm able to get my point across to you as to what am I doing. Please tell me that, that you're with me. Yep, following. Oh, good, good, good. Now, what I want to do is create a place where I can put some security groups in place and put my key pair in hand. So key pair is the easy idea. So let's go look at the key pair idea. So this is the key pair file. What I want to do is grab that file out from the hold area and put that in the Terraform folder like that, and then hide the hold folder again. Now we have a key pairs file. This file basically picks up my SSH IDRSA public key and dumps it into Amazon. So like in usual cases, we'll go to Amazon and there we'll say EC2, oh, come on, EC2, not you. Go to EC, come on, EC2, and then we'll say here, you please take my key pair, and that is the key pair that I usually give, and I import my key pair and then paste it here, right? That's what I usually do, but that is boring. So what I would like to do is actually ask Terraform to take my public key and dump it into Amazon and call it this name. The key name will be called whatever I give here. And that's my key. So I want to dump that key into Amazon. I currently don't have it. So it's not in Northern California. You don't see it, but I want to dump it. So I will just use this key pair construct, AWS key pair, the resource definition, and I'm putting my key in there. And so I will ask Terraform, hello, what's the plan? And so it says, oh, let me check. And you don't seem to have the key pair there. So let me put the key in your location. And so it says, I will create something and I will update in place something, what is that thing? So AWS key pair called deployer key will be included. It has a key name called automated VPC. It is the public key that I have in my local computer. It will be picked up like that. And then AWS route table for public, the tag has to be made, this is the point that I think you should pay attention to as to what is going on. Why is this line even exists? Why does it exist? Can you tell me why do we have to make an update in place? This is something that you should pay attention to, this segment, this segment here. And what did I do to my VPC and route table in the automated VPC? So you see in my automated VPC, I put in a name called public there, right? This is something that is not according to design. So it is going to remove the tag. It has a tag called public, it will become empty tagged because my design doesn't have the tag. So it will go and wipe it off, wipe off the name public because the design doesn't include the tag. Somebody manipulated after the fact without the knowledge of Terraform, which is me going and putting a tag called public after the fact, manually, you saw me do that. And so it doesn't like that idea and so it has to go and make a change in place, update in place. Somebody put in this tag, that tag should not be there. So it will be removed, that an update in place. There is one tag, it should be zero tags. That's what's going to happen. An update in place will happen to the route table public because the design doesn't include a tag. So the new implementation will be wiping off the tag that has been spurious put in place. I hope you understand that. So when you say Terraform apply, it will create a key pair and also wipe my public tag. And that should report back success saying, I added one, I changed one. So now if you go back to Amazon and see that I have this tag right now, the tag will just disappear if I refresh and focus on my automated VPC and the tag is gone. Similarly, you have in your and the tag is gone. Similarly, you have in EC2, a new key pair created called automated VPC. So that's what's happening. So now if you go back to Amazon and see that I have this tag right now, the tag will just disappear if I refresh and focus on my automated VPC and the tag is gone. So now you have a new key pair created called automated VPC. It has the same fingerprint as the other key I have, which is the exact same key, but a new item created, which is what we wanted. And so which is what we have. And that was possible through the addition step and the removal of tag was through the change step. Now, if you want to have the tag, what do you do? If you really want to have the public tag in place, what do you need to do? Like in the public subnet, do I have a... I have a tag. Hold on, this is confusing. Why do I have to, hold on, let me go compare. So I thought I, didn't I put the tag manually? I think I did in the route table for automated VPC, I put that tag manually here, I remember doing that. But then what is this tag? It is empty, but it should have a tag for the ACE subnet, public subnet. It should have a tag because the tag is included. Okay, let's run it one more time. Let's see if there is any difference in what I'm thinking versus what Terraform is thinking. So Terraform, check the plan. And so it is going to compare and it should tell me that there is nothing needs to change. Yes, nothing, no changes, infrastructure is up to date. Okay, now, if I go back there to Amazon and put that tag back, some random tag. And the tag shows up here, some random. For this public subnet, I go back here and say Terraform, please check the plan. It should tell me that there is a change needed because it will go and read some random tag and want to remove that tag. And that's what you see here. Now, what I, the piece I don't understand is we have a tag. What's going on with that one? Is it not the same public subnet? It is. Name equals public. Why is it ignoring it? I don't know. I will find out later. Maybe I'll just change this to something else and see what happens. And see what Terraform does. It sounds like a bug to me. Oh, I'm confused, I'm confused. Now I understand what the confusion is. This is a route table tag as opposed to a subnet tag and I am, as a consequence, confused. So if I want to put a tag, I should actually put that tag to the route table like this. Now this is clear and save. So that is my public subnet. And this is my public route table. The two different tags. And now I will go back here and say Terraform. And it'll correctly do the way I was thinking was wrong. But now I understand what the confusion was in my mind is that I was confusing between a route table and a subnet. The subnet had a name public. Now it will become my public subnet. And the route table had a name called some random. It will become my public route table. That is the plan to change these two items. So I will go and apply and you will see the result. And it's very quick. So it should be like nothing much to do, just change some tags. We'll come back and report the tags are done. And we'll go and check the tags out here by refreshing it. And you should see them, the auto variant VPC should show you my public route table tag showing up for the route table. And is it the route table? Yes, it is the route table. And on the subnet C, you should see my public subnet shows up. So you understand the tagging part and the confusion associated with that. Okay, back here. I want to further increase complexity and you will want to pay attention to one piece that I did not highlight already, which is important to highlight, which I should. So I will focus on line number 12, this line. It is important to remember that it includes a dependency here, depends on. The word depends on is a keyword, which shows you that it depends on something else. So creation of this resource called AWS subnet called public will depend on the existence of a gateway. And if that gateway doesn't exist, then we have a problem, we cannot create that resource. This is how you can create a dependency map. A dependency structure is important to understand. And what I'm really trying to highlight to you is that this gateway needs to exist before this public subnet can be created. And that is the dependency that I'm putting in place in my Terraform design. And by doing that, what I'm basically ensuring is that anything that is necessary for creation of another thing is created before creation of the other thing. In other words, if I want to have a public, sorry, a private route table, let me do it again. Do it again. Okay, if I want to have another subnet called private subnet, and a route table associated with that like that, this association between the subnet and the route table. And before I even create a private subnet, I need to make sure that this subnet and the machines on this subnet will have a way to get to the internet. And so I can allow that traffic to flow directly through the gateway and go out. But that is not a good idea, as you know already. So that is not what I want. So what do I want is a dependency. A dependency on what? On existence of a NAT device in the public subnet so that I can route my traffic from the public machines, sorry, private machines here through the NAT, which in turn is connected to the gateway, so it can go out. That's how I want to route my traffic through the NAT device. So this needs to be a dependency on creation of the private subnet. I hope you understand this. Just like we have a dependency of the gateway, existence of the gateway is necessary for routing to happen for machines on here, here and here, for them to be able to go out. We need a gateway. And that is a dependency required before we can create a public subnet. And similar to that, what I'm doing is making sure that we put in a dependency like this, like this. If this doesn't exist, we should not even create a private subnet because it does not make sense because no traffic will flow without this dependency in place. So we need to create a NAT machine and make it functional before we create this subnet. Otherwise, there is no point in creating this and then the machine cannot go and do anything else at all and it will fail. So that dependency we have to put in place. And that's what we have to have as a dependency for the private subnet creation, which is the next step, which means before we do that, we need to have this in place. So back here, we have created our public subnet and it looks like that. And I think we already have done this step. So now I will go back to my hold area and look for NAT server because that is what I want to really create first before I create a private subnet. I can create a private subnet and if I just drag it out, it will fail because it depends on a NAT instance. That instance doesn't exist yet. So I need to create the NAT machine first. And so I'll move this file out of hold area into the Terraform folder and then hide the hold folder and then look at my NAT server. In that NAT server file, I have a resource. And that resource, what I'm doing is creating a new Amazon Web Services instance. And again, this is documented well. You just Google for AWS instance and Terraform and you will find how to invoke this resource. What this resource does is basically creates a machine, AWS instance. And it's very easy to understand what's going to happen in this example is basically we are going to create a new machine. How do you create a machine? Go to EC2 and select the region and then say launch an instance. And then you describe exactly what you need. You have to describe the operating system you want and the size you want and the configuration details and security groups and this and that and goes on and on. So you have to capture all these details inside here between the resource. And that resource defines an AMI machine image, which is already in our variables file for the region selected. We are choosing the size of the machine in terms of instance type, T2 micro, the very, very small size, which is also free for first year. We are selecting a subnet ID to make sure that this machine gets created. The NAT machine gets created in a subnet called our public subnet. So you're selecting that to create in the public subnet. We also require some security groups in place and that piece is also necessary for it to exist before we create a machine. Now we haven't done that piece yet. And so there is the securitygroup.tf file also needs to be pulled out into the Terraform folder and hide the hold area. And this action is also necessary to create a variety of security groups for us to be able to consume in our automated default VPC that we have. So we had to create a bunch of different security group rules or firewall rules. And we have them written down here and they're easy to understand, but make sure that we will go through that. But just be aware of the fact that we need to have security groups in place before we create a machine like NAT, because it requires existence of the security group by the name default and a security group by the name NAT. So two groups are associated with that particular machine. We also have to have a key name, which is our key pair we have already in place called deployer key name. We have to disable source destination check for a NAT machine to operate like NAT. Remember we did this by hand the last time, disable, right click and disable, source destination checks, make it false. We can do this through line number eight, source destination check, make it false. That is when NAT will start to function like NAT. We are also giving it a tag called NAT. And then once the machine gets ready, we are going to put some additional work or other additional things to do for the NAT device. We are adding an application to the NAT device. In addition to just using it as a NAT, I would like to make it become a open VPN server, not just my NAT box, but also become open VPN solution for my company employees to connect to the open VPN solution that we have in our cloud. So we are basically doing that step in line number 12 all the way down. What we are really doing in line number 12 through 15 is establishing an SSH connection using the user called Ubuntu and the private key files stored in local computer. Make a connection and then use that connection to provision the machine, the NAT machine with a remote execution. And in there, what I'm doing is actually converting this Ubuntu box that I have. This is just an Ubuntu box. We are not choosing, by the way, I should elaborate that. Hold on. So if you remember, the last time we did the exercise, we chose Amazon, NAT, AMI, 2017, 09, something like that. Some number, some AMI number we chose. And this is Amazon Linux. It has a user called EC2-user, and it is Amazon AMI. It is not an Ubuntu AMI. But in our example right now, what we are choosing is not this. We are just using plain vanilla Ubuntu. And plain Ubuntu is not a NAT to begin with. This one is, but this is not. So we have to create a NAT. Create a router out of plain machine. First, make it a router. And then add open VPN. And then that becomes our NAT box and our open VPN box. So double purpose, two purposes here. Creating a NAT is a very, very simple thing. It literally takes like a few lines of code. And those few lines are right here. Actually, it has two lines. These two lines, which is line number 18 and 19, will convert any Linux box into a router. Any Linux. Just run these two lines, the box becomes a router. What it's doing in line number 18 is masquerading traffic through IP tables. So you can see that. IP tables, dash T NAT, after routing, masquerade traffic. You know what a NAT does? It masquerades traffic. It tells other people a lie. The lie is that I am that box, pretending to be that box asking for CNN.com. So, hey CNN, I am that laptop. Show me CNN. So CNN thinks that it is the laptop asking for CNN, so it just shows it CNN.com content. And then the NAT will take that content and transmit it back to the machine asking for it, and the machine will then show CNN.com to the user, internal user. That's what masquerading is. It's basically blatantly lying that I am the one that is asking for it, but it's not. But that's how NAT's supposed to behave, is through masquerade. So we are actually enabling IP tables and masquerade rule by including that one command, and then allow for traffic to be forwarded to the machines inside. That is the line number 19. What we are really doing is echoing the number one and putting it in this file here. So if you add the number one to that file, which is currently empty to begin with in a plain vanilla Linux machine, your file is empty. You just add the number one to it to enable forwarding traffic. And so it will start forwarding IPv4 traffic. And that's how you make a machine into a router. Two lines, line number 18 and 19. Now, once that is done, the rest of the lines 20 through down are actually setting up OpenVPN. It involves two steps. First, install Docker. Actually three steps. First, install Docker, which is line number 21. Install Docker. Second is line number 23, 24. This will initialize a data container to store data for OpenVPN. And the third one is to generate server configuration for OpenVPN to function like an OpenVPN server so we can use that VPN machine as a VPN solution for our cloud, for our employees to access our cloud. We'll run through these things and actually play with it a little bit more once the setup completes. Then we'll go into VPN and actually hand off, I'll hand off to you VPN credentials and you can come into the cloud also using VPN. So with this understood, what I want to do now is make sure that I, when I run this setup, it will grab a machine, which is a plain vanilla Ubuntu machine, T2 microsize, put that in the public subnet, use my security groups that I haven't described next, use my key pair that I have, disable source destination check, tag it like a NAT, that's just a tag. And then establish a connection and remotely execute, make it a router by masquerading traffic and allow traffic forwarding. And then install Docker, install OpenVPN and configuring it up so that it actually becomes a functional OpenVPN server inside Docker, inside the NAT box in the public subnet. Now the remaining piece is the security group. So we'll go look at the security group file also, like right here. And here you will find that there are a couple of security groups. One of them is called the default security group. And what this does is allows ingress any to any, any to any ingress, as long as you are inside the VPC. So any to any all allowed. You want to come inside from any machine to any port, from any port to any port, any protocol, self equals true. Meaning it is, if you read this summary description, that's gonna help you understand what's going to happen in the default security group. The default security group allows all inbound and outbound traffic from all. Sorry about that. So all inbound traffic, where did that screen disappear? Okay, here. The default security group will allow all traffic as long as it is within the VPC, any to any communication between machines. Okay, let it happen. That's the idea behind the default security group that we are creating, which allows ingress any to any, and egress, meaning going outside, go anywhere you like on the internet, 0000 slash zero means anywhere on the internet, just go wherever you feel like. All traffic allowed for all internal machines, everything okay. That's the default behavior, default security group. And then I have some additional security groups here. One of them is the NAT, specifically for the NAT machine. I have some rules. The rules are allow me to access port number 22. So I can go into the NAT machine if I want to, which I want to. I also want my employees in my company to get access to the open VPN server that is also running on the same NAT machine. And that means I need to open port number 1194. This 1194 is a specific port design designated for open VPN usage. It is how the open VPN software is set up, that it expects that port 1194 on UDP protocol to be open and available so employees in the company can access open VPN. So that's the ingress permitted. Let people come into the VPC using open VPN. Now, going outbound, yes, of course, let the NAT machine go to the internet. And that's going to be tagged as NAT. There is one more security group that I need to have, which is to allow people, customers, to access my services. And those people will come in from port number 80 and also from port number 443. And these need to be able to connect to the load balancer. That is the security group that I call web that allows traffic for web traffic from the internet, from public. So anybody on the internet, that is 0000 slash zero, can come in through port number 80 and also from port number 443. That's the web security group. So there are three groups here. One is the web security group for public to come in. The second one is for me to go in. For me to go in, port number 22 SSH. Port number 1194 is for my employees to come in to the VPN, open VPN. And on the very top is a default group, which allows my machines to communicate with other machines inside the VPC. So machine to machine communication within the VPC, I want to allow that. And that's the default security group. So there are three groups, default, NAT, and web. And then there is this machine. The machine uses the security group, creates itself in the public subnet, configures itself to become a NAT, and also enable disable source destination check. So it actually functions like NAT, and also sets up open VPN. That's what you will see happen next. So let's go check Terraform. What do you have in mind? So Terraform will read what is there in the Amazon cloud and compare with what you have in mind, and tell us the difference. It tells you that there are four things to be done, four to add. And let's go see what they are. The first thing is to create a NAT instance. This is going to use an Amazon machine ID, the Ubuntu machine, plain vanilla Ubuntu. It will be put in using the automated VPC key pair that we have. It will be put in the location that we chose, which is the subnet that we have, and the tag we have assigned. And that will also use all these variety of computed values. These computed values are generated either by Amazon or by Terraform. And for example, the security group called default will need to be created in Amazon. That security group allows any to any communication between machines inside the VPC, all instances in the VPC that allows traffic between machines. So we want that to happen. The default security group. Then another security group we have is the NAT security group. This group allows me to connect to the machine SSH and allows the employees of the company to connect to the open VPN server through 1194 UDP, that is this port UDP protocol, and also allows the machine NAT machine itself to go out to the internet. Then the last one, web security group. Port number 80 and 443 allow for public access. And those are the four things. So three security groups or one NAT machine created. That's what you will see when I say apply. Now, before I actually run it, let's go to see what the remainder things are in our folder. So I'll close this NAT machine right now. Look at my hold area for the remaining items. And I find that I have... Hey, Nilesh. Yes. Could we take a quick break before you move on? Yeah. Next step. Thank you. Totally, totally. Anytime. Yeah, I tend to forget about things. I'm sorry about that, but yeah, it's good that you actually remind me. You remind me to take a break. I tend to forget and I completely keep on talking and talking non-stop. I hope it is not nonsense. I hope I make sense. Okay. Get started timer. And I will come back in a few. Hey, just checking if you're back. Are you back? Yeah, I'm here. Yeah. Okay, good, good. So we should resume. I just want to re-correct my thoughts and you'll process it. So I'll just go ahead and close this. Okay. I'll re-correct my thoughts and we'll proceed. So what was I doing? There we are. And so what I was talking about is the other three things that are left over. Let's take a look at that also while we are at almost at the finishing stage of this discussion. What I want to focus on is the other remainder of three items here. One of them is this private subnet which is similar to the public subnet except that it has a dependency on the NAT device which we will now have. So the dependency will be met. See that dependency right there on a NAT instance. That dependency will be met because we are making sure that the NAT is created. So what I want to actually do is in the same set of things that we are doing, I want to prepare a private subnet also. So I'll move it outside to the Terraform folder and look at this private subnet. And just for the sake of completion, completeness, I would like to tag it just like we did the tag public route table and tag public subnet. I want to also tag my private subnet and my private route table like that. So the route is defined. This is the route table and this is the subnet. There is a tag already for the name called private subnet. So I'll just make it clear that this is my private subnet and very similar to that, I will create another tag called my private route table. And that completes the tagging actions that are missing in the initial design. I included this new tag called my private route table and that will tag my route table for private subnet. And this is the private subnet itself, which has a dependency on the NAT machine. We are creating that NAT machine right here, as you have seen already. And so therefore that dependency will be met. So we can now create a public, sorry, private subnet also and a private route table and also associate the private subnet with the private route table. That association will be created as a consequence of this particular step. And so private subnet also gets created. Now the very last thing that remains in our hidden area, hold folder, is this one file, which is basically creating machines in the private subnet. If you look at this picture again, I will create these machines out there, M and M, right there. So I can create them by just calling it out in a much more clear fashion. Let me draw this cleaner. And what I'm doing is I have this NAT box that will be created, this private subnet and private route table and the association between the two. I would like to also create some machines here and here like that. So this is my application server and I will create two of them, application servers and that M1, M2, call it whatever you want. So there's two machines, this and this and they will be created in the private subnet. You can see that I am identifying the subnet to be private. I'm also creating them and associating with the security group default, which is basically allowing machine to machine communication using my key name that I have already called the deployer key, which is already provided to Amazon. Excuse me. In this machine type, the source destination check is kept true because it is not a NAT machine. So I'm going to keep it true. I will also tag it in a count index fashion, meaning for the two machines I have, I would like to call them M1, M2 or automated app zero, app one. I think that's how I would like to name them or I think it will be one, two. I think it is zero base or one base, I don't remember. It may be one, two or zero, one, depending on what of the base is for this count. I suspect it is zero based. So automated dash app dash zero and one, two machines will be created. In addition to that two machines, you will also see that there is a load balancer we want to have. This load balancer will basically balance the load between those two machines. So I'm creating a load balancer here and connecting this like that. And that's what you will see happen once I have this load balancer created, which is another resource, AWS ELV resource. And that resource uses a subnet called public, which is where I want it to be here on the public side. I'm using a security group. There are two groups here. The default security group allows for machine to machine communication inside the VPC and a web security group that allows customers outside to come in on port number 80 and 443. Then I'm setting up a listener. This listener will listen for port number 80 on HTTP protocol and match it up with instance, sorry, load balancer port 80 on HTTP protocol, match it up with instance port number 80 on HTTP protocol. That's the connection established between the listeners. That's these lines here. It listens on port 80 on that target as well as this target. And then I also have a health check defined. The health check basically checks for health of these machines. Are these two machines healthy or not? If they're not healthy, then the load balancer is not ready to serve traffic. If one of them dies, the load balancer will make sure that that machine is marked as unhealthy. And the other one is still operating. So you will see these actions depending on health check. And then we are associating this load balancer resource with the instances that we have created in the previous step here. And that instances, those instances will be associated in a list of instances to be associated with the load balancer. And that's how you create a load balancer in these steps. Then the upper section, you have two machines created in the lower section and load balancer created. Now the machine that we want to create will need to also install Docker and run some application there. And so that is this line number 10 will do for us. Line number 10 invokes user data, which has a reference to a file called Cloud Config. In that folder, there is a file called app.yaml. And that yaml file decides what the user data is. And so we are passing this user data yaml file into the machine at the time of creation. As a consequence, the machine will invoke this yaml and do what it says. What it says is to run these two commands. The commands are line number six and line number eight. The first command, line number six, sets up Docker. And second command, line number eight, runs nginx-container, very simple. There are literally two things, set up Docker and then run nginx. And that's what we want to have in our machines, app zero, app one. And those two machines are the app servers that we have. And that's the user data that we are passing on as a parameter in a app.yaml file located here, passed on to the machines, app zero, app one. And that is how you create two machines out in your private subnet, m0, m1, app zero, app one. And what I want to now do is bring this file out of the hold area into the Terraform folder like that. Now there's only one thing remaining. And that thing is the outputs.tf, which is basically just a printout of things that you created is the result that Terraform will print. I created machine for you, created a load balancer for you, created a NAT machine, created app servers, load balancer, just dumps the values out. And that's what this thing does. Basically it is a result dump. The output section here is basically going to print the results for us. Nothing much, no action here. It's just an output. And so what I want to do is grab this file also out of the hold area into the Terraform folder. So we have all these files now ready for exit. This did not happen. So we'll move it again from here out to the Terraform folder. And now my hold folder is empty. And my actionable items are now available inside the Terraform folder. So now I can go back here to the terminal and ask Terraform, hey, what's the plan? Tell me the plan, please. So if you go and inspect and tell me a little bit comprehensive plan this time, because lots of things to happen. And so you will see lots of things that will be created. There will be like 10 things added. Let's go see what those 10 things are. And we'll go item by item and understand what those 10 things are. And you will see what it means. And it's kind of logical. Yeah, we're going to create a load balancer. We know that. It needs to be created in the subnet we defined, which is our public subnet. And next we have to have an instance called app zero, which is a machine that I have in here. Let's call it app zero. And this is going to be app one. So two machines created. You will see them. In the app zero creation, it uses the AMI, Ubuntu AMI, again plain vanilla, same Ubuntu AMI. And it will be put in the private subnet. Another machine gets created, app one. It will be dumped in the private subnet also. App one in the private subnet. We have a NAT machine created. It will also use the same machine image, same image. You see that number, C2, C3, AE, whatever that number is, the C2, C3 number, is the same as this C2, C3 number. The application uses the same operating system as the NAT. We are not using a NAT ready-made NAT. We are actually going to create our own NAT. And that creation will happen, as you know already, in the NAT server file in line number 18 and 19. That will create, convert a Ubuntu box into a router. And that will happen through invocation of the script. As you see this here, remote execution of an inline script, line number 18, 19, and then rest of the things. Install Docker, install open VPN, like that. So back here, NAT machine will be created apart from app zero, app one. We have more things. Let's go see what those things are. We have a route table called private. We have a security group called default. We have a route table association with the private route table and the private subnet at the very top. I think we had it somewhere, maybe at the bottom. Somewhere at the bottom, you will see a route subnet also, a subnet and route table and association. Those three things will be together. Yeah, at the very bottom you see subnet called private. Then somewhere on the top, you will see a route table for private and then you'll see the association between route table and the private subnet, that association. We also have three security groups, the default security group, the web security group, and the NAT security group. This is the NAT security group that allows 22 traffic for me and 1194 traffic to employees in the company and the web security group allows for customer traffic. And those are the 10 things that we are going to create in the next step and to add nothing to change. And we also see an output parameter in the result. So as soon as I say Terraform apply, it will go and do its thing and then report back success. As a consequence, it will take a little more time than the previous steps. There are 10 things to do and three machines to create and load balancers created and connecting them together and all that good stuff is happening right now. So let's go see the party. What is going on in Amazon? We'll go check and go to our VPC and find out that there is a route table in our automated VPC. There is a public route table already, but what is my private route table that is missing, right? So we wait for it. In the meanwhile, we'll go to the Amazon location and see if there are the machines created. And we see that there is one running instance and that running instance is the NAT machine. That is a necessary thing to happen to be created before the private subnet gets created. It's a dependency. That's why you see that the NAT machine is running first before the subnet private shows up. You will also notice that the source destination check is disabled already. It is false, which is what we wanted. And now that this NAT resource is ready, we should now see the subnet called private showing up in the VPC section and the automated VPC in here. We have a subnet called private created. We also have a route table called private created. And we have that association between the private route table and the private subnet configured. Now that the private subnet is ready, we should go back to Amazon and look for machines. And you will see two more machines, app0 and app1 showing up. And they are right here. And you will now see that those two machines, app0 and app1 also show up. And they are these guys, app0, app1 show up. These are the same operating system, by the way, same OS, which is your Ubuntu number C2, C3, A, E, E, whatever that is, C2, C3, A. I cannot even say it properly, but forget that. That number, that AMI number here, is the same as you have in NAT. And it's the same as you have in app0. It's the same operating system image. app0 and app1 source destination check is true. NAT source destination check is false. These machines are getting configured right now. This NAT machine is getting configured to run like a NAT and also getting configured to become an open VPN server for my company. You will also see in the app0, app1, that these machines are getting configured with Docker. And you have a bunch of security groups already created. Let's go see the security groups created. You will narrow it down, and you will find that in our VPC ID, if you sort by VPC, and you focus on the first four items, this, this, this, and this, are the four that we created. One of them was the default given to us, so you can ignore that one. That was given assigned when you create a new VPC. It just gets created by default. We're not, not bothering about that. You just ignore it. We have three security groups essentially defined, and they are the, the default security group. This one, default automated VPC group. It allows machine-to-machine communication between the VPC. So inbound, all traffic, all protocols, all port range is allowed as long as the source is inside the VPC. The source has to be within the group, and then if it's inside the group, traffic is allowed. The other two groups we have are web security group, which allows inbound traffic for people outside the, or the public outside, customers outside to come in from anywhere on the internet, to port number 80 and 443, and these guys will go to the load balancer. We have a NAT security group that allows traffic for me to come in from port number 22 and allow traffic, UDP traffic for port number 1194 for employees in the company to come into the OpenVPN network. Next, we have this web. We have the Web Automated VPC security group here that needs to be mapped to a load balancer, and that load balancer is also getting created, by the way. There it is. And it should pop up. And there it is. This automated load balancer is already constructed and is mapped to the instances we have, and they are already in service. The two machines we have, app 0, app 1, they are already in service. The health checks are succeeding. The listeners are active. And monitoring is also active. And that is what we are doing with our automated elastic load balancer. If you go to the description page, you will have a DNS name right there. And let's go copy that DNS name and paste it in your Slack chat. And let's hit it. And what do you see? You see our NGINX application running already, already functional. And that is a result of what we've done. What we have done is created 10 resources. We got two internal IP addresses. These are app 0, app 1 internal IPs. There is a load balancer hostname dumped out in the output section. And our NAT has an IP address. This is the IP address we got for our NAT machine. It's a public-facing IP address. We already saw our applications are live here. And this is our NAT machine. In order for me to access the NAT, I can totally go there and say SSH. And then Ubuntu at the IP address we have here. So we copy that, paste it, boom. And we connect. In that machine, you will see that it is running a lot of things, of course. But more importantly, it is running Docker. Oh, sorry, sudo. And then Docker. You have a container running called OpenVPN data. That is going to store the data for my OpenVPN setup configuration, which I'll configure next. So it's already functional. You will also see that in this machine, our proc. Let me identify the thing that I have in mind for you to read. And that item is the line number 18 here, or rather 19 here. Proc sys net, IPv4 config all forwarding. That file is something very important to understand because this is the way a machine becomes a router. So we go look at that file in that location. We'll say, please go to that file and show me what it contains. Oops, I did not copy properly. So cat, and copy properly. This line, say copy, and then paste. And then you see it contains the letter number one right there. And that number one is what is really driving the forwarding of traffic, IP forwarding. And our IP table rules have already enabled for NAT to masquerade. We have your Docker functioning, and we have OpenVPN data container ready for us to consume. So NAT is already functional. Let's now use this NAT to go to look at our internal machines out there. These machines, we have app 0, app 1. They need to be running something as defined in the user data segment in the app YAML. We have app YAML here. They need to have Docker installed, and they need to be running NGINX. By the way, we already saw it is running NGINX, and it is already showing us through the load balancer. But let's go inspect the machines directly and see what it shows. So right now we are connected to the NAT device. So come out of it like that. I'm back into my location on my local machine. In there, I want to actually go inside to the private area. As you know, we have this file here in our folder called config. And that configuration is how you jump inside to a machine inside. So I want to edit that configuration and say vi. And this time what I want to do is modify the configuration to make it go to my NAT box. Let me just use atom instead. So atom in atom configuration will open up that file. In here, I have this host name that I need to change. That change needs to be taken up. Remove this, and I should put the IP address of my NAT machine, which is right here. So I'll grab that IP address and then put it right in place of the host name right there. Save it. I have the name jump box, which is not the name I want. So I want to change it to NAT. And I change that. Then I have my users to connect to the machines inside. It's not easy to user, but it's actually Ubuntu. Because we are not using a ready-made AMI, ready-made Linux AMI, ready-made Amazon AMI running NAT. You created our own NAT using Ubuntu. So the username has to be Ubuntu. So we have it all in all places. Our routing inside to a host is actually not this IP address, but it's 128.01 in the private area. And so that's what I need to change. So I can actually go connect to my private machines, app0, app1. And this is how you reconfigure your SSH configuration. Now that you have it, you can now route your traffic directly to this segment. And I will do exactly that. What I will do is go look at my IP address in the outputs file that's created. So we can go and examine the Terraform state file and grab the app server IP addresses like that, one of them. And then connect to it. How do you connect? We just say SSH and then IP address. It automatically routes the traffic through the NAT as a jumping point all the way inside. And there it goes. And so we are now connected to the machine inside. This is your app0 or app1, one of the two. We don't know which one is which, but it doesn't matter. We go sudo, and then we say docker, and it will show you running nginx right there. Now here, what I want to do is come out and go to the other machine. The other machine has a different IP address. We will find out its IP address, and it is 94 at the end. So we will go connect to the other machine, 94. There we go. And we'll say yes, and we'll go sudo, and then check for docker, running nginx, and you see it right there. We have two machines, both running docker, inside docker, running nginx, and showing that result back to us like this. And they are load balancing right now. You can confirm the load balancing very, very easily by actually making a little change to one of these nginx containers. We'll go inside these containers, one of them, like this one, the goofy swirls one, like this one. I'm going to go inside and make a change to it so that it looks different from the outside. Like here, it says welcome to nginx. I want to make this one a little bit different. So what I'll do is I'll say docker exit, and then go inside the machine. A9 is the container ID. A9. Initial letters are good enough. You don't have to type the whole thing. If it is unambiguous, you can just begin with 2, and it will let you in. And get in the bash command, and you are now inside the container. In there, what I want to do is to see if we can get to modify the HTML rendered by the application itself. So we will go and hack. How do you hack? You go to user, share, nginx, HTML, and there you should find a file called index. And then you don't have VI. Containers are so small that they don't carry VI with them. So we'll install VI. There we go. No pseudo needed. Just app update. And then we'll install VI. Container images are really, really tiny. They don't have much stuff. And so app install vim should get us the VI editor. As you can see, this thing is able to connect to the Internet, grab updates, download all that through the NAT that we have already in place. That's why routing is already functional, as you can see. This is in a private subnet. There is no direct route to the Internet. It is going through the NAT device that we have put in place. So now that we have editor in place, we can now hack the file. And what I want to do is make it different. And say, welcome to something else. Not nginx. Just making a change so we can see it. And what was that change made? It will come out of the container, come out of the root plugin, come out of the Ubuntu box, back to my workstation. Now I go back here. And now I will refresh the browser. And what do you see? Something else. Now this is happening. And I will refresh the browser one more time. I see nginx. I refresh it again. I see something else. And it is going to round robin. This round robin is happening between app 0 and app 1 on the back end where we have two machines running Docker, running containers nginx, and each of them has a slightly different content. You see them right there, toggling between A, B, 0, 1, 0, 1, like that. This toggling is happening because there is no stickiness in place in our Cloud Balancer by design. We did not want stickiness, so we didn't include it. You can, of course, include stickiness by editing stickiness and say enable stickiness. So you can enable load balancer generated cookies or you can enable cookies in the application side, your choice. So we'll go with a simple choice right now and enable a cookie expiration period of maybe 10 seconds or leave blank for disabling no expiration at all and save. When I save, load balancer will start to generate a cookie. So I save it. I now open Firefox browser so I can examine my cookies better. And then I will click on the same load balancer link like that. And it should take me to the Firefox browser where I want to actually examine my cookies like that. There is the cookie section here. Firefox is the slightly better way to look at inspect cookies and I like that. So I'm going to just clear everything I have, clear all the data I have, and then inspect my cookies, which should show me nothing to begin with. So clear history, clear data. And then I have nothing, right? Yes. Okay. Now I will open up that load balancer. Like that. Hello. It should show me something else. The fact that I see something else means that I now have a cookie. And I can go inspect my cookies and say, where are the cookies? Hello. Cookie please. Where is the cookie? Manage data. The cookies did not stick. Why? Hello. Refresh. Refresh. The cookie is sticking. But where is the cookie? I don't see it. It has a cookie, but where is it? Manage data. I don't see the cookie. Maybe I'm not looking at it right. The cookie is stuck, and I am stuck with something else and not the other one. It is sticking, but I don't know how to see the cookie. That's the problem. Okay. But you get the idea. Oh, you know what? This is not Firefox. This is Firefox Developer Edition, which updates every day. So I should use Firefox. Not this crazy thing which changes every day on me to quit. Let's start real Firefox right there. That should have some familiar interface to me so I can see my cookies. So preferences and privacy, clear history, clear everything, clear data, clear everything. And please, please show me how to see the cookies. I thought you had the best interface. Whatever. Let's go check it out. We'll find it. I see that, and I'm stuck with something else, and I refresh, and I refresh, and I'm stuck with something else. Nice. Now please show me the cookies. Where are you hiding? Privacy and security, manage data, and there is the cookie. We can inspect the cookie itself and figure out that this is actually put in by the load balancer. It says that right there. And if you want to use application-generated cookies, that's totally fine. It's up to you as to what you want. You can just edit the stickiness. Now having done this part, let's go further understand how do we allow our company employees to come inside our VPC and just do whatever they want or whatever they need to do. And so for that to happen, what I need to be able to discuss with you briefly is the virtual private network concept. I'm not sure how many of you have used VPN, but I guess almost everybody must have used VPN in your companies already. So that should not be foreign to you as such. It should not be a foreign concept because you've used it. But I'll describe the concept in a different fashion, slightly different fashion to make it easy and clear to understand for everybody to understand what is this VPN thing. So VPN is virtual private network. It is, think of it as, what's it called? Teleport. That's the way I describe it. Teleportation. Teleport is the right way to say it. This is the word I would like to say when I say VPN. Teleport. Imagine you are in your home and you want to connect to your company. So this is your company or maybe this is your cloud. This has the VPN server running here and you cannot go to Amazon. They will not even let you into the building. So if you want to go here, can you go there? No, not possible. And you are here in your home. Sometimes you go to Starbucks and you want to be able to be here. But you cannot go there. So you want to teleport yourself or rather I should say you want to teleport your laptop you have with you, right, this laptop. You want that laptop to be somehow teleported to that location here. Which means this laptop needs to get an IP address assigned inside the VPN, inside the VPC using the VPN software. So we need to get an IP address assigned to this machine. This is dynamically generated IP address generated by the VPN software and it will receive an IP address inside your VPC as you connect your laptop to the VPN. This VPN connection happens on UDP protocol on port number 1194 and you need to run a client here. This client software will connect to the VPN server that is already running there. It is running on the NAT box. We set it up already, right? So we want to configure it, one time configuration by the system administrator in the company that will create individual employee certificates and assign it to every employee in the company so that they can then come in using a client and connect to the VPN server. And as soon as they do, they receive an IP address inside VPC. And once you are inside the VPC, what happens? This security group here, where is that? This one called automated VPC default group. It allows any to any communication all within the group. So that will allow you to just connect to any machine you feel like, doesn't even have to worry about it. So you need to have a client on your laptop, your iPhone, whatever you have, and use a certificate that the administrator will create on this VPN server. And that will basically teleport your laptop from your hand and put it in your cloud right there. You will get an IP address assigned and you can then connect to M1, M2, M0, M1, NAT, whatever you want. You are inside the network now. Once you teleport yourself, you're there. And so now I am here right now and this is my laptop. If I take my laptop and connect it to VPN, I will get a new IP address, which means if I do it like that right now, our video conference will break because I am sending traffic to you through this Zoom video conference and it will suddenly don't know what to do because the laptop was here in the home and then it is not here in the home, it is here in our home, teleported. And so it will confuse and break the video conference. So I don't want to do that. So what I want to do is actually have a different machine, which is my VM. I want to use that VM and use the VM to connect to the VPN. And I don't care about the VM because it is this separate machine I have here. This can go to the VPC and get connected and all that. And that is what I want to do. I will not use my Macintosh to directly connect to the VPN, although I can very easily adjust the VPN. I'll show you how to do it in the Mac later on. But bottom line is I should not be doing it in my Mac, connect it directly to the virtual private network server in my VPC because the video conference will break because I'm teleporting it. So it will not know, Zoom will not know what to do. It was here in the home, but not here anymore. What just happened? It will break. We don't want that to happen. So I'll use the VM to connect and you can use any machine you like. It doesn't matter. For you, it doesn't matter. It is critical for me to not use VPN on directly on my Macintosh. Having said, let's first configure this server as a one-time action by the administrator. So that it becomes a resource for the entire company. Let's go see what that takes. It is actually documented right here in our file called VIN. And there's a README. README describes what needs to happen by the administrator needs to do one-time action to establish a certificate authority. Are you familiar with the idea of certificate authority and issuing certificates to individuals and machines and things of that nature? Have you seen such a thing or done such a thing before? Anybody? Yep. Yep. Okay. So that's exactly what we will do, but scripted automated fashion. We'll establish a certificate authority first. That's the step number one. It would be a good idea to map your VPN box with a friendly CNAME, like VPN.cloudgenius and use that reference. That's what I want to actually do. So I will create such a name right now. I will go to my Cloudflare account and in there, go to login and then enable two-factor. And then create a new record in here for the DNS, for the VPN. No records found. So create a canonical name or rather an A record for VPN.cloudvd.us and give it the IP address for the NAT machine like this. And so I will grab my NAT machine IP from here and here. And the NAT has an IP. I'll copy that and then give it to my DNS like this and then add the record. Now this record is in place. So now I can just dig. I can simply say dig. I can say dig vpn.cloudvd.us and it should go to the IP address that I had in place. So there it is. Not correctly. Nice. What I would like to do next is run this first step. The first step is actually a long script which is kind of convoluted. If you ask me, there are lots of things here going on in multiple lines. If you want to pay attention to what I'm doing essentially is like this. Let me just simplify this. This is quite complex to digest in the very first look. So we'll simplify it. And first of all, we'll go in the bin folder and run it inside. As you can see in the readme file says, you can run it from the bin slash number one. That's what you want to invoke. So I can invoke it directly like, no, no, no, no. Full screen. And I can copy this and run it pretty much like bin slash one. And it should run. But I don't want to run it like that. What I want to do is actually understand what it contains. So inside here we have a Terraform command. That command is actually going to dump an output for the NAT IP address. So Terraform output will look at the Terraform tfstate file. This file here. tfstate and look for the NAT IP address and dump it. So you grab that value and use that as the IP address to connect to the Ubuntu machine. It's an add symbol. An IP address. So when you go like that, it will give you a structure to connect to the remote machine. Ubuntu add IP address. And then what I want to do is use SSH to connect to that IP address using Ubuntu username and get a teletypewriter interactive. Sorry, not interactive, but this is the private key reference that I'm passing. Use my private key. And then make a connection in teletypewriter mode. Connect to the machine first. And then inside, once you have the connection hold, you escalate to sudo, run Docker, and then using Docker, run an OpenVPN init pki command inside an image called kylmana. This kyl is the person who created that OpenVPN image. So I'm using his image to run OpenVPN as a container and initializing pki authority, the certificate authority. That's what this thing actually does. And also use a volume from OpenVPN data, which is a container already running inside, which is responsible to store OpenVPN certificate data. So that's the volume from reference. Once you have this in hand, you can just invoke it simply by saying bin slash one, and it will go initialize your authority. It says, give me a passphrase, please. So I'm going to create a private key, c a key, and so it expects me to give it a passphrase. So I'm going to give it a passphrase. Right now I'm going to give some passphrase. And it says, OK, do it again. So I do it again. Then it says, OK, give me a common name. What is the server name you have? Post name you have? I have a very friendly name for it. I'll just type that name. Now it is going to take a long time to generate a 2048-bit long prime number. It takes about two minutes to generate a long prime number. This is a part of your TKR authority to generate Diffie-Hellman parameters, and it is going to take a long time, roughly about two minutes. It finished quickly. Nice. Now those parameters are saved in that location, dh10. What I want to now do is give it the passphrase one more time for the c a key to be used with the dh parameters that we have now saved. I'll provide my passphrase one more time. And then another time. And then it says that a CRM file has been established. Your connection to that NAT machine. Actually, this is the OpenVPN machine. Also, the OpenVPN machine is closed. You're now back doing the usual stuff. So that is the first step. In the readme, we have another step. The second step is to generate client configuration for the employee called Nilesh. So I want to create a client configuration that I can hand off to Nilesh. And hey, you can now connect to the OpenVPN server. So I would like you to get this set of parameters that you can use to connect to the VPN into the VPC. So now we run it, not here, break, refresh, paste. No, break. And say bin number two. And so this will generate a new configuration for the user called Nilesh. You run it like this. So pass in the name of the user. And then invoke it. So it says, OK, give me a passphrase. So I give it a passphrase. And then it says, OK, a certificate is generated. It is valid for the next 10 years, 3650 days. And there's a new entry added into the database. And connection closed. So the VPN server is now configured to allow Nilesh to connect using a configuration. But that configuration, we need to give it to Nilesh that needs to be downloaded. So that is another step. We have to download that configuration from that remote location. So we will do exactly that. If you look at my current folder, I don't have the configuration locally available to me. But as soon as I run bin number three and say, get me the configuration for Nilesh, it will download that configuration file and dump it into my local folder. And that will be the Nilesh automated OVPN file. This file is actually available in Atom now. And this contains the entire configuration for the client to use a terminal device and establish a remote certificate TLS connection with the server using a remote IP address that you have here, which is the open VPN server IP address. Connect to that server using port number 1194 on the UDP protocol. Here is your private key that you have been assigned. And then here is the end of private key. Here is the certificate beginning. And then we have a certificate end. Then a CA beginning and a CAN, like that. Then we have key direction. We have some TLS authentication parameters. And all of this thing is a ready open VPN configuration. So what I can do is grab all this and dump it in Slack chat. So you have open VPN configuration for the Nilesh employee. So here it is coming to you in form of a snippet that I'm dumping. And you can just use it directly as user.ovpn with the plain text dump that I created for you and dumped it in Slack chat. So you have it. You have the entire credential that you can just consume right now. And use this credential to connect to the open VPN server that I have set up in my cloud. Now, how will I connect? I need to use a client software. And that means before anybody can connect, I need to start my open VPN server in the container on that machine that we have. So this is the start action. This is your bin slash number four action, which is basically starting the open VPN container. I'm saying docker run and map the port 1194 from the machine to the container inside and using this image Kyle mana open VPN. This machine image is actually very nicely created. You can actually inspect that image right here in open source. So for Kyle mana open VPN, that should pop up. It's a fairly popular repository with 754 forks, 3,000 stars. And this is open VPN server in a Docker container, complete with an easy RSA PKI certificate authority. That's the source code for the image. The image is available in Docker Hub. You can use it. There are many commercial companies that use it and provide cheap VPN solutions. You may have seen some of them. Here are some names of those commercial solutions available. But yeah, it doesn't matter. I don't focus on commercial nature. So yeah, you run it yourself in a Docker container. It's free for you, open source, so enjoy. Back here, what I want to do is start that open VPN container. So I will start it now. So it will run persistently. And you have a new machine, sorry, container ID issued to you, which is as a reference, you can take a look at. If you want to go back to the machine and connect, you can see it. Having done these steps, let's go read the last step. Now, what do the employee need to do? So steps for employees. The step for employee is to find an open VPN client. What is a client? A client is a piece of software available from the open VPN people. Open VPN will give you a list of clients available for that. So you go to the download section. Here you will find there are a bunch of downloads for clients. So where are the clients? Open VPN, where is that client? Hello? Client, please. Let me go search Google. Open VPN client. It's easier to find it this way. There it is. So we find clients for source code of the client. So zip file, there's a Windows 7 installer. You want to get Windows installers right there. If you want to use Linux, that is also available in form of a tarwall. There are more Windows installations available. But I use another open source product if I'm using it on Macintosh. Not these products. There is a better client called TunnelBlick that I like to use on Macintosh, which is also open source. This works much better than other clients. It's a free open source graphical user interface for open VPN client on OS X and Mac OS that is available. You also have an iPhone app and an Android app where you can just provide that file that I dumped in SlackChat, which is this file, nilesh-automated-ovpn. You can just import that file into the iPhone app and it will allow you to connect to MyVPC just like that, with one click, boom, connected. That means your phone gets an IP address inside MyVPC. That's what you can actually play with it right now. There's an iPhone app for that if you want to. There's also an Android app for that. Now, the steps for employee involves running an open VPN client. I need to run open VPN on this VM. I don't want to run it on the Macintosh right now because you know my confidence will break and I don't want it to break. So what I do is install the client for open VPN just like that. And it should ask me for a password and it will install open VPN client. It's already installed. Nice. Now, I will check my IF configuration to see what IP address do I currently have. I see that my IP address is 10.0.2.15. This is the IP address assigned to me by VirtualBox. Now, what I want to see is once I connect and establish a connection to the cloud using VPN, this is the command for that, by the way, and what I will do is open another terminal. And here I will check IF config. And you see them that I have these three addresses, three adapters. One of them is Docker adapter, which is this address, zero adapter, which is the 10.0.2.15 address from VirtualBox, and a local adapter, which is localhost. Now, on this window, I will actually make a connection with the open VPN server. And the connection step is this. You have to pass on the configuration, which is the open OVPN file. So I'm copying that from here and then pasting it in here. And this invokes the client on the VM. I don't want to connect to my actual machine, so I'm using the VM to go. And then I establish a connection. You can see that this is actually negotiating with the open VPN server and initializes a new tunnel device with an IP address assigned. And it writes. Apparently, this is an error of some sorts, but it's not going to work. It's still functional. Write to tunnel, tap, invalid argument. Some error is happening, but we'll figure out later. The initialization sequence is completed, which is where the client has successfully connected to the VPN server, which means if I now check my IF configuration one more time, I see that there is one other adapter opened up, 10.0. This is a new adapter now available to my machine, which has a new IP address allocated to me by the open VPN server running on the net box in the public subnet in my VPC in the Amazon Cloud. Now, logically, I am inside the VPC, logically speaking. Actually, I should say, logically speaking, this VM is now inside the VPC, which means I should be able to ping anybody I want and connect to anybody I want, just like that. Or just establish a ping connection is easy. So if I say ping and 10, what are the IP address for the app 0, app 1? Let's go find them out. App 0, app 1, what are your IP addresses? So this is app 0. The internal IP address is that IP address, 10.128. So we'll just ping it. It is not pinging because ICMP is disabled. Our security group doesn't allow ICMP, so it is not going to let you ping. However, if you attempt to establish an SSH connection, it will let you connect, like that. It connected. And you come out, and you establish a connection to another IP address. I think it is 94, if I remember right. Here, 94. So connect, and it will work. And by the way, I did not even bother to use the, whatever that thing was, the config, SSH config. You see that thing here? SSH has this file called config. That configuration has a reference that you know, we are not using this reference at all. We are not using our jump behavior, which is known as proxy command. We are not using this proxy command at all. We are inside and connect. Let me just erase this file, for example. I'll just move this file out. I'll say mv config out to some location and save the config. It's moved out already. It's not in the folder anymore. And we are back to our Terraform folder. In that folder is what you see here. And now I am in my laptop, in my VM. I just happen to have a new adapter, which is my foot in the door inside my VPC. This is like my leg into the VPC. Specifically in here. I have a leg in there. I'm like with one foot standing in that location, logically speaking. That's what this terminal adapter is doing right now for me. It is generated by the OpenVPN setup, which has a client configuration already connected and gives me this IP address right there, which is what you see here. It is assigned to me by the OpenVPN server. As a consequence of this foot in the door that I have one leg in the cloud, I can easily connect to any internal machine, such as this, I connected, or this, and I connected. I cannot ping because ping is disabled in our security group. So ping will not function because ICMP is disabled. But it's not working. Maybe it was a transient issue. Probably because of this, I had to go understand why ping works. So hold on. Why does ping work? Let's go read the rules again one more time. Security group rules for any to any inbound. It is actually all traffic, and it doesn't have to have an add rule for ICMP. It is superfluous. This is superfluous. So not necessary. All traffic includes ICMP. So it was a transient issue. This in access, unable to access, unable to ping before was a transient issue. We have successfully pinged the machine called 94, and we are going to ping the other machine also, which was the 248 machine. So we'll just ping it, test it. Pings, let's go also connect to the NAT box. So we have a NAT box here in the dashboard. This machine has a NAT and an internal IP address like there, this IP. So I want to ping it. Can I ping my NAT machine? I should be, yes, pinging. And I should be able to connect to the NAT machine also like that. Go, connect, and it corrected. And so we are able to connect to any machine inside and do whatever we like because we are employees at the company entered into the VPN setup. Now this VPN is very similar to your Cisco VPN or Juniper VPN. I would argue that he's actually better than them. You can spend $50,000 and pay to Cisco and get their VPN setup functional, or you can just use Kyle Mana, open VPN in a Docker container. It works just fine right here. You can use that for free. I mean, free as in not just money, $0 free, but free as in freedom, liberty, libre. Freedom is more important than free as in $0. I hope you understand the difference between this word and this word. Free as in beer, meaning it is $0. It doesn't mean that you can do whatever you want, but this is the more important idea in open source. It is not gratis. It's not gratis, but it is libre. I think those are two words that are very clearly defined. In English language, it's confusing. Libre and gratis are two different things. I'm not talking about gratis. I'm talking about libre. I hope you understand. I don't know which language this is. Is it French or Spanish? Spanish, it says Spanish. Spanish has a better annotation in terms of gratis versus libre. Is gratis Spanish or not? I have no idea. Help me out if you know this. Please tell me. Yeah, it's Spanish. I'm not talking about gratis. Gratis is irrelevant to me. Libre is more important. That's what open source is about, libre. It gives me the ability to choose what I want, do what I want, and don't care about anything else. That is more important than not having to worry about payment. Actually, think about it. Open source can be expensive. It is actually sometimes expensive. In that, you have to really study how to read the source code. You may not have any help. You are on your own. There are challenges. Real challenges in open source. I'm not saying that it's all easy and it's all great. It can be expensive. If you don't know what you're doing, you have to go and ask for help. So open source can be not gratis, not zero dollars. But it is definitely libre, meaning it gets you to do whatever you want. Liberty. That is the real benefit of open source, not gratis. When I was at Microsoft, Microsoft salespeople will actually bring up this topic of gratis and libre and tell other people as to how Microsoft software is better than libre. Because they'll say that open source is like a puppy. Really, really good, really, really nice, and really, really free. Gratis, puppy. You want to take puppy home? You might want to. But imagine that a puppy is not gratis. The moment you take it home, you have to go pay veterinary doctors to get the vaccination done. And then the food and the toys and this and that, it never ends. So a puppy is not really free, not really gratis. It may be very cute. It may be very, very desirable. And it is actually libre. But it is not gratis. So open source is not zero dollars. Don't get me wrong in there. It is not gratis. It is not necessary. It is gratis for me because I understand source code. But for people who don't, it can be an expensive thing. Just understand that and then take the libre idea and move with it. Okay. So what are the things that are missing? Let me quickly check if I miss any ideas here. We have a sequence established. Let's break that sequence. So breaking it. Once I break it, you will see that nothing will work. Yes. I have one quick question. So the BPN, where is that hosted? Is that hosted in the NAT? Yeah. Right here. You can see that I did that right in our NAT server. VPN in line number 21 down. Okay. 21 and down is all VPN server. You see that? Okay. So once I break my VPN connection, which I did, exit it. Now nothing is able to connect. It doesn't even know where to go. So it just fails. The other one, ping will fail, of course. It will try and not work. It doesn't know where to go. All these other things will completely fail left and right. Nothing works. But now back here, you establish the VPN connection one more time. Sequence completes and now you can come back here and ping. In a matter of a few seconds, it should actually pick up the ping action and it will start pinging. It has already started. Not yet. Give it some time. It took us a little time for the traffic to flow properly. But SSH should work. Hello. Now it's not working. Okay. Let's check IP config and see if we have a tunnel adapter. So it should work. Come on. Something is wrong here. I don't know what that thing is causing it, but we'll give it a little time. It should fix itself. It did fix the last time. So by the way, any one of you can actually use the same configuration I pasted in Slack chat and establish a connection to the VPN server that we have running right now. You can find a client in OpenVPN website or in your iPhone or Android and just import that file I gave you and it will establish a connection. Something is broken in this, so let's do it again. Okay. This should be okay. Another question when you get a chance. Go ahead. I'm not going to deep on this. Ignore that. So if I'm a global company and I, do I need to have multiple VPNs? Yeah, it's a good idea to have multiple for different people, different groups, different sections, different rules, different need to access. The important thing to do is to not let everybody in the company give access to the cloud. There's no need to know, need to go. So don't give it to everybody. Only on a need to know basis, need to go basis, need to access basis that you open and give credentials to the people that need to go. Now in your company, which is not in the cloud, in your regular internal operations, you want to have your employees connect to the VPN inside your company. Of course you get to every employee. That's a different kind of setup, which is to let companies, let employees come into your company when they're working from home. That is a different, basically the same software connected in, not in a VPC, but in your data center, in your corporate network. That's when you install open VPN, configure it the same exact way and give credentials to every employee so that they can access the network from home when they're working from home. Yeah. But what happens if they're in a different country? Nothing changes. Nothing changes. Nothing happens. I mean, literally nothing changes. Except you might notice that the people in Zimbabwe are trying to access a Seattle server will be slow, somewhat slow, depending on internet bandwidth and latency. So you may want to have a local connection. If you have a big presence in Zimbabwe or in South Africa, you may want to create a VPN server for that region and have the people come into the Zimbabwe location, South Africa data center location, which will improve the performance of the network for them. And you can have a site to site VPN between South Africa and Bellevue and Charleston, or things of that nature. Okay. So in regards to the automation, so if I create a container through automation and I want to send some type of alert or log to a different system, where would I establish that? So you want to capture some kind of an alert and log it somewhere and send it to some other people. If I create a, let's say, a container that's hosting some type of application, when that happens, I want that to be logged in a specific database where I keep track of all my applications. So let's go see a live example. I think we have it functional already. So we will just break this and break this also and go establish a connection to our VPN server. Right there. So we are connected now to the VPN server because it's a publicly accessible machine, so we can go to the public subnet. We are there now. We'll go sudo and then we'll examine Docker. We have two containers running. Now in there, we have this container that is currently up and running. So we want to inspect the logs generated by that container. So we'll say Docker logs and then FDE. And you see the logs. The same logs that you expect to see inside the application, they're exposed to Docker and that, Docker logs. You see there are Docker containers and Docker logs or the FDE container, which is this container, which is this container, which has some logs. And so you want to inspect them. You can use the Docker log command to just quickly inspect. That's a quick way to get it. But you want to systematically grab these logs and dump it to some other machine. You want to find a way to pipe it of some method of piping the flow of these logs. And you can maybe stream these logs to another destination. So for that, you want to capture it. And one quick and dirty way would be to just tail it like this. And here you will see that it is waiting for the next action to happen, for the next log to dump. And as soon as the next log dumps, it will just append into the stream. And you will see that the stream gets accumulated. It's a tail. We are tailing the Docker logs right now. You see that new item came up just now. Now, once that stream is established in the form of a tail, you want to now take that stream and pipe it to some destination, some kind of a log store, some kind of a store to keep track of what these things are doing for us. And there are a variety of solutions available to capture log. One of the well-known ones is this called Logstash. And it is an open source product. And it is available for download and run and all that. And you can use this, or you can pay $10 million to Splunk and use Splunk, depending on what you want to do in your company. You can use the Splunk tool or use the ELK stack. ELK stack is basically similar to Splunk. What it does is captures logs in the ELK stack. ELK stands for Elastic Cache, Logstash, and Kibana. We have Elastic Search. This is the one element. Logstash, like I mentioned, is the second element. And the third element was Kibana, which is the graphical interface to Logstash. So we have to have these three things, ELK, together to construct, conceptually similar to what Splunk is. And this Splunk tool will capture logs. You might have Splunk in your company, I suspect. And so what you can do is use Splunk and pipe these logs that are generated here into Splunk by putting a plugin to capture logs from this container. If you are running Kubernetes, these ELK stack will run inside Kubernetes for you. And there is probably a Helm chart for running ELK stack in Kubernetes already. So you can go look at the Helm chart, which will give you one line command to run a ELK stack. Let's go find out where it is. And it should be... No, not easy to find. So, you know what? Elastic stack. That should be it. But it is not official, so let's forget that. Official solution would be to not use ELK, but instead use Prometheus and Grafana, for which you have a Helm chart already. Prometheus has an official stable Prometheus chart that you can get to run directly in Kubernetes. So it will let you run Prometheus. Similarly, there is an official chart for Grafana. We can do the exercise next time when we get together. So there is... What else is talking about Helm? Helm chart for Grafana is another solution. It is also open source, and this is a stable chart ready for Kubernetes consumption. And that is the chart stable Grafana. You can run it in this one line. And as a consequence, you have a tool to not only capture logs, but also present to the user. So, in short summary, it will be either you can use Splunk, which is a commercial solution, or you can use Elastic Cache, Logstash, and Kibana as a combination, or you can use Prometheus and Grafana as a Kubernetes solution. You can also use this in Kubernetes, or you can use this in any other location. That's okay. But it's most dominantly used with Kubernetes. So it's easier to deploy this one line, boom, brings it up. And this Prometheus is your storage of logs. And this is your presenter of logs. It shows you output in terms of nice looking charts, so you can see what's going on. And these are popular. They're also cloud native compute foundation products, just like Kubernetes is. These guys are not, but they're also good. They're also open source and a good solution. This guy is commercial. So you can deal with them directly. Further questions on this before we hang up? Not for now. Thank you. That helps a lot. So I will now stop recording.