WIP TKO Demo Feedback

[mbentley]

@Boskey - Here are a few thoughts from what I see at the moment. Of course, everything is just a suggestion so take or leave anything. Or if there are some things you would like me to try, I am more than happy to try to submit a PR for some things:

Add a .gitignore

Include the following so these files don't get added (and remove them from the committed git changes):

.DS_Store
.vscode/

setup-environment.md

It might be good to have a in window dashboard created for Tanzu Mission Control within the screen similar to how it is configured to create one for Harbor: https://github.com/tanzu-end-to-end/tko-workshop/blob/6ad62733bb893c11b8eb3b383182f8bc351f267e/workshop/content/setup-environment.md?plain=1#L7-L10

```dashboard:create-dashboard
name: Harbor
url: https://harbor.{{ ingress_domain }}/harbor/projects/{{ harbor_project_id }}/repositories

As that would allow the user to walk through the steps in the upcoming sections without having to flip back and forth.  I normally don't love that sort of embedded window but with how many steps there are in the upcoming sections, it is hard to follow otherwise.  The same might be true for Tanzu Service Mesh and Tanzu Observability.  Of course, giving users the option of poping them out to their own windows would be fine too

## 01-developer-self-service.md

There might just be organizations who want different tiers of Operations where one tier is making design and architectural decisions and another is doing day to day operations.  Same tooling, different use case.  I think it is also important to address the use case of standardizing operational tasks in the case of developer self-service not being the goal.  I would maybe even rename this section to something higher level thinking than self-service, for example, `Standardized Cluster Provisioning`.  Then you could have `Developer Self Service` and `Efficient Cluster Operations` or something like that for the two similar use cases for the different personas.

Provision Kubernetes Clusters via Tanzu Kubernetes Grid - It might be worth mentioning that we are building upon the upstream Cluster API project or maybe even include a diagram like this:

![screenshot 2021-11-04 at 2 22 16 PM](https://user-images.githubusercontent.com/414445/140404134-2894c324-eff0-4e73-8df0-6c0461d8c7c0.jpg)
(source: https://onevmw-my.sharepoint.com/:p:/r/personal/mbentley_vmware_com/Documents/custom_decks/Tanzu%20Introduction%20-%20Accenture.pptx?d=w1f9ccaa929c14edfb2721ad80cf3ae64&csf=1&web=1&e=PfKs40&nav=eyJzSWQiOjE5NjAyMjYzMjMsImNJZCI6Mjk5NTM1MzYzOH0)

Suggestion - for screen shots, use the browser Zoom function to make the text larger or make your window smaller as it is difficult to see detail, even when clicking on the screen shots (workshop/content/images/aws-cluster-create.png).  The Policies screen shot is easier to see might it might even be better if it is not as wide but it is much easier to read than the create cluster one.

## 02-implement-policy.md

The name of this section is a bit wordy as "Implement Access, Security, Quota and Backup Policies".  It might be better to simplify it as something like "Implement Cluster Policies".

For some of the tasks, there are a number of steps which can be a bit complex.  It might be easier to consume if some of the bullets are broken down into individual steps or even in numbered steps so it is easier to keep track of where you are in the process.  Some additional screen shots of specific parts of the UI could help break it apart as well.

## 03-enterprise-observability.md

It might be helpful if we could break down the Enterprise observability section into personas focused views of what each would care about for the developer/app owner wanting to see details about their apps and then the Container platform operator who is troubleshooting problems that could span the IaaS, CaaS, and application layers.  Details of what I should be seeing from a value perspective would also help to realize the value being shown.

[mbentley]

I went back through the workshop just now to check a bit more in depth and get a feel for the overall flow. I stopped mentioning smaller typos as it would be easier to just submit a PR for some of those.

1: Workshop Overview

• Screen shot has "Policy (Tanzu Mission Control)" that doesn't fit in the box
• VM's = VMs
• Access: Identity+RBAC (need to take screenshot in present mode so it doesn't show spelling"
• Day 0-n
  • Maybe include scaling of clusters as well

2: Setup Environment

• "Obersrvability" should be Observability
• Tanzu Mission Control - change URL to default to https://tanzuendtoend.tmc.cloud.vmware.com/clusters
• Tanzu Observability - we need to update the link from the pez-tools cluster as that was in the PEZ environment
  • Should be e2e-acme-attached-attached.tmc ?
  • Something besides the Pet Clinic Dashboard? Maybe the Acme shop app? 3: Build Consistent Clusters & Enable Developer Self-Service
• Tanzu Mission Control - in the attach part, I would make sure to clarify that it can be TKG or any other CNCF conformant Kubernetes clusters
• Create Workload Clusters
  • How are we solving the "Create cluster" issues where there are no permissions to advance through the UI?
    • Should we have slides with screen shots as backup? (I've seen another workshop that has slides somewhere)
• Providing RBAC and Authentication to Development Teams
  • It seems like this section should be in the next section (#4) where there are other access controls being shown
    • The value of policies are explained in section 4
  • Conclude that any clusters that are created or attached to the tko-psp-demo cluster group will inherit the policies set and new policies that are added will be applied to the same clusters.

4: Implement Access, Security, Quota and Backup Policies

• Focus on how k8s provides standardized extractions of common infrastructure components
• "They can run rouge containers with vulnerabilities etc. As such, running Kubernetes platform with appropriate polices that implement security best practices is imperative."
  • I would change this to something more focused around how Kubernetes and containers make it easier to deploy applications from anywhere but that also brings new security challenges and how Kubernetes provides a lot of flexibility about how to secure an environment
  • Maybe add security questions
    • How do you ensure consistently applied RBAC?
    • How do you control where containers come from and are deployed to your clusters?
    • How do you ensure network traffic is limited appropriately between pods?
    • How do you allow pods to have the correct level of permissions to the underlying host to function but not more?
    • How can you allow for multi-tenancy within a cluster, allowing teams to consume their share of resources?
• I would flip image policies and pod security policies to keep the flow natural through the tabs
  • Nothing covers network policies
• The formatting starts to get broken down toward "Image Download Policy" and "Quota policies"
• Implement mTLS for Application Services across Multiple CLouds
  • This feels like it should be its own section as we just completed policy and this transitions over to Tanzu Service Mesh
  • I would explain that mTLS is Mutual TLS just to make sure everyone understands what that means any why it is important (allowing for both ends of communication between services establish a secure connection and can validate each other; or some other simplified explanation)
  • It might be good to have a screen shot that show what we are going to look at with Tanzu Service Mesh, understanding that we are looking at an application that has been deployed across two Kubernetes clusters on different clouds
  • Looking at app stats - I would also explain that metrics are available without modifying the application
  • Some of the steps are difficult to follow in the section as it feels like a bit of a great wall of text "and there you have it" - makes it feel like this is the end.

5: Enterprise Observability

• Intro screen shot, diagram would be good to help visualize what we are seeing
• Pez-tools to e2e-acme?
• I don't see the Pet Clinic App since it hasn't been deployed
  • Should we switch to using something like e2e-acme to use the shopping app? https://vmware.wavefront.com/dashboards/integration-kubernetes-clusters#_v01(p:(cluster_name:(m:(Label:'e2e-acme.attached.attached.tmc'),s:Label))) in the default namespace
• Since the acme fitness app isn't being deployed, the text would need to be updated (pet shop also not part of this demo)

6: Upgrades and Backup

• Get "access denied" when clicking Edit on the tko-dataprotection-target location
  • Maybe go through the "Create Target Location" wizard?
• tko-psp-demo cluster is offline, could be distracting
• Upgrades
  • Can we specifically add a cluster that has an older version possibly?
  • Should we explain the upgrade methodology and how it performs the upgrade via Cluster API, replacing instances, order of operations?

7: Demo Summary

• I would add a screen shot that helps iterate the outcome driven approach Up front at the very beginning, it would be ideal if we could highlight what the result is expecting to be with TKO, also mentioning Labs to help up front as well so it is not as "tacked on"

[mbentley]

I believe between the two of us, we have addressed or discussed all of the feedback.