Professional Documents
Culture Documents
Kubernetes Docker
Kubernetes Docker
4 Backing Services Treat Backing services like DB, Cache as attached resources
5 Build, Release, Run Separate Build and Run Stages
6 Process Execute App as One or more Stateless Process
Source: https://12factor.net/
7 Port Binding Export Services with Specific Port Binding
8 Concurrency Scale out via the process Model
9 Disposability Maximize robustness with fast startup and graceful exit
10 Dev / Prod Parity Keep Development, Staging and Production as similar as possible
11 Logs Treat logs as Event Streams
12 Admin Process Run Admin Tasks as one of Process
21-10-2018
1 4
High Level Objectives #19 Slide No’s
Docker Containers
Understanding Containers
Docker Images / Containers
Docker Networking
1 6
What’s a Container?
Looks like a
Walks like a
Virtual
Runs like a Machine
Containers are a Sandbox inside Linux Kernel sharing the kernel with
separate Network Stack, Process Stack, IPC Stack etc.
21-10-2018
1 7
Servers / Virtual Machines / Containers
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/6/html/resource_management_guide/ch01
21-10-2018
1 9
Docker Container – Linux and Windows
• Docker Registries
• Docker registries hold images.
• These are public or private stores from which you upload or download images.
• The public Docker registry is called Docker Hub.
• It provides a huge collection of existing images for your use.
• These can be images you create yourself or you can use images that others have previously created.
• Docker registries are the distribution component of Docker.
21-10-2018
1 11
How Docker works….
1 2
Docker Client Docker Daemon Docker Hub
4 3
$ docker search ….
Containers
$ docker build ….
Images
$ docker push ….
$ docker container create ..
$ docker container run ..
$ docker container start ..
$ docker container stop ..
$ docker container ls ..
$ docker swarm ..
Docker Daemon
Client
Cent OS
Linux
Kernel Alpine
Host Kernel
Debian
All the containers will have Host Kernel
the same Host OS Kernel
If you require a specific
Kernel version then Host
Kernel needs to be updated
HOST OS (Ubuntu)
21-10-2018 12
1
Docker Daemon
Client
Nano Server
Windows
Windows Kernel
Host Kernel
Nano Server
All the containers will have Host Kernel
the same Host OS Kernel
If you require a specific
Kernel version then Host
Kernel needs to be updated
HOST OS (Windows 10)
21-10-2018 13
1 14
Docker Image structure
• Images are read-only.
• Multiple layers of image
gives the final Container.
• Layers can be sharable.
• Layers are portable.
21-10-2018
1 15
Running a Docker Container
$ docker pull ubuntu Docker pulls the image from the Docker Registry
Creates a Docker Container of Ubuntu OS and runs the container and execute bash shell with a script.
$ ID=$(docker container run -d ubuntu –bin/bash -c “while true; do date; sleep 1; done”)
$ docker container logs $ID Shows output from the( bash script) container
The FROM instruction sets the Base Image for subsequent instructions. As such, a
valid Dockerfile must have FROM as its first instruction. The image can be any valid FROM ubuntu
FROM FROM alpine
image – it is especially easy to start by pulling an image from the Public repositories
The MAINTAINER instruction allows you to set the Author field of the generated
MAINTAINER images.
MAINTAINER johndoe
The COPY instruction copies new files or directories from <src> and adds them to the COPY hom* /mydir/
COPY filesystem of the container at the path <dest>. COPY hom?.txt /mydir/
The ENV instruction sets the environment variable <key> to the value <value>. This
ENV JAVA_HOME /JDK8
ENV value will be in the environment of all "descendent" Dockerfile commands and can be ENV JRE_HOME /JRE8
replaced inline in many as well.
21-10-2018
1 17
Anatomy of a Dockerfile
Command Description Example
The VOLUME instruction creates a mount point with the specified name and marks it as
holding externally mounted volumes from native host or other containers. The value can be a
VOLUME JSON array, VOLUME ["/var/log/"], or a plain string with multiple arguments, such as VOLUME
VOLUME /data/webapps
/var/log or VOLUME /var/log
The USER instruction sets the user name or UID to use when running the image and for any
USER RUN, CMD and ENTRYPOINT instructions that follow it in the Dockerfile.
USER johndoe
The WORKDIR instruction sets the working directory for any RUN, CMD, ENTRYPOINT, COPY
WORKDIR and ADD instructions that follow it in the Dockerfile.
WORKDIR /home/user
There can only be one CMD instruction in a Dockerfile. If you list more than one CMD then only
the last CMD will take effect.
CMD echo "This is a test." |
CMD The main purpose of a CMD is to provide defaults for an executing container. These defaults
wc -
can include an executable, or they can omit the executable, in which case you must specify an
ENTRYPOINT instruction as well.
The EXPOSE instructions informs Docker that the container will listen on the
specified network ports at runtime. Docker uses this information to interconnect
EXPOSE containers using links and to determine which ports to expose to the host when
EXPOSE 8080
1 2 3
21-10-2018
1 19
Build a Docker Java image
1. Create your Dockerfile
• FROM
• RUN
• ADD
• WORKDIR
• USER
• ENTRYPOINT
$ docker container rm $(docker container ls –aq) Remove ALL the Container (in Exit status)
$ docker container run –restart=Policy –d –it ubuntu /sh Policies = NO / ON-FAILURE / ALWAYS
$ ID=$(docker container run –d –i ubuntu) Start the Container and Store ID in ID field
$ docker container exec inspect $ID Read Containers MetaData
$ docker container run –cap-drop=chown –it ubuntu /sh To prevent Chown inside the Container
$ docker image history image-name Get the History of the Docker Image
$ docker image save –output=file.tar image-name Save the Docker image as a tar ball.
21-10-2018
1 24
Build Docker Tomcat image
1. Create your Dockerfile
• FROM alpine
• RUN
• COPY
• EXPOSE
• ENTRYPOINT
21-10-2018
1 25
Docker Images in the Github Workshop
From Ubuntu
Ubuntu
Build My Ubuntu
Docker Networking
• Docker Networking – Bridge / Host / None
• Docker Container sharing IP Address
• Docker Communication – Node to Node
• Docker Volumes
21-10-2018
1 27
Docker Networking – Bridge / Host / None
$ docker network ls
$ docker container run --rm alpine ip address $ docker container run --rm –net=host alpine ip address
Docker Containers
Sharing IP Address
IP
(Container)
Service 1 Service 3
(Container) (Container)
Service 2
(Container)
21-10-2018
1 30
Docker Networking: Node to Node
Node 1 Node 2
Web Server 8080 Microservice 9002 Web Server 8080 Microservice 9002
Container 1 Container 2 Same IP Container 1 Container 2
172.17.3.2 172.17.3.3 172.17.3.2 172.17.3.3
eth0 eth0
Addresses for eth0 eth0
the Containers
Microservice 9003 Microservice 9004 across different Microservice 9003 Microservice 9004
Container 3 Container 4 Nodes. Container 3 Container 4
172.17.3.4 172.17.3.5 172.17.3.4 172.17.3.5
eth0 eth0 eth0 eth0
This requires
Docker0 NAT. Docker0
172.17.3.1/16 172.17.3.1/16
IP tables rules IP tables rules
eth0 eth0
10.130.1.101/24 10.130.1.102/24
21-10-2018
1 31
Docker Volumes
Data Volumes are special directory in the Docker Host.
$ docker volume create hostvolume $ docker volume ls
Source: https://github.com/meta-magic/kubernetes_workshop
21-10-2018
1 32
Docker Volumes
$ docker container run - - rm –v $HOME/data:/data alpine Mount Specific File Path
Source: https://github.com/meta-magic/kubernetes_workshop
21-10-2018
33
Kubernetes
21-10-2018
2 Kubernetes Key Aspects
Using yaml or json Internet 34
declare the desired
Architecture Firewall
• Declarative Model state of the app. Worker Node 1 Allows multiple
implementation of Ingress K8s Cluster
• Desired State State is stored in
Master Node (Control Plane) the Cluster store. Port 10255 containers from v1.7
Namespace 1
RESTful yaml / json
Kind Store API Server Port 443
Node
gRPC
Runtime Network Proxy
• Pods $ kubectl …. ProtoBuf TCP / UDP Forwarding
• ReplicaSet Manager Interface IPTABLES / IPVS
•
•
Deployment
Service
etcd Declarative Model
•
•
Endpoints
StatefulSet
Key Value • apiVersion:
• Namespace Store Controller • kind: POD (Cgroup / Namespaces)
• Resource Quota Scheduler • metadata:
• Limit Range Manager • spec: POD itself is a Linux
• Persistent Secrets
Volume Container, Docker
Kind container will run inside
Names
Namespace 2
• Pod the POD. PODs with single
• ReplicaSet or multiple containers
Node End Point Deployment Pod • Service
…. (Sidecar Pattern) will share
Controller Controller Controller Controller
• Deployment Cgroup, Volumes,
• Virtual Service Namespaces of the POD.
For the cloud providers to manage • Gateway, SE, DR
nodes, services, routes, volumes etc. Cloud Controller • Policy, MeshPolicy
• RbaConfig Self healing is done by Kubernetes using watch loops if the desired state is changed.
Cluster IP • Prometheus, Rule,
@ • ListChekcer …
Node Label Selector
Port Service BE Pod IP Address is dynamic, communication should Deployment – Updates and rollbacks, Canary Release
Load be based on Service which will have routable IP
15.1.2.100 ReplicaSet – Self Healing, Scalability, Desired State
Balancer
1.2 and DNS Name. Labels (BE, 1.2) play a critical role
DNS: a.b.com
External in ReplicaSet, Deployment, & Services etc.
D R
Name
POD POD POD
EP Pod IP ...34 ...35 ...36 Label Selector selects pods based on the Labels.
@ BE BE BE Label
Labels
Selector
@
10.1.2.34
1.2 10.1.2.35
1.2 1.2 Label Selector
21-10-2018 10.1.2.36
2 35
Kubernetes Setup – Minikube
• Minikube provides a developer environment with master and a single node
installation within the Minikube with all necessary add-ons installed like DNS,
Ingress controller etc.
• In a real world production environment you will have master installed (with a
failover) and ‘n’ number of nodes in the cluster.
• If you go with a Cloud Provider like Amazon EKS then the node will be created
automatically based on the load.
• Minikube is available for Linux / Mac OS and Windows.
Ubuntu Installation https://kubernetes.io/docs/tasks/tools/install-kubectl/
$ sudo snap install kubectl --classic Install Kubectl using Snap Package Manager
$ kubectl version Shows the Current version of Kubectl
Windows Installation
C:\> choco install kubernetes-cli Install Kubectl using Choco Package Manager
C:\> kubectl version Shows the Current version of Kubectl
C:\> cd c:\users\youraccount
Create .kube directory
C:\> mkdir .kube
C:\> minikube-installer.exe Install Minikube using Minikube Installer
$ kubectl get nodes $ kubectl cluster-info $ kubectl get namespace $ kubectl config current-context
List all Nodes Shows the cluster details Shows all the namespaces Shows Current Context
Create a set of Pods for Hello World App with an External IP Address (Imperative Model)
$ kubectl run hello-world --replicas=7 --labels="run=load-balancer-example" --image=metamagic/hello:1.0 --port=8080
Creates a Deployment Object and a ReplicaSet object with 7 replicas of Hello-World Pod running on port 8080
$ kubectl expose deployment hello-world --type=LoadBalancer --name=hello-world-service
Creates a Service Object that exposes the deployment (Hello-World) with an external IP Address.
$ kubectl get deployments hello-world List all the Hello-World Deployments $ kubectl get pods –o wide
$ kubectl describe deployments hello-world Describe the Hello-World Deployments List all the Pods with internal IP Address
$ kubectl get replicasets List all the ReplicaSet
$ kubectl delete services hello-world-service
$ kubectl describe replicasets Describe the ReplicaSet
Delete the Service Hello-World-Service
List the Service Hello-World-Service with
$ kubectl get services hello-world-service
Custer IP and External IP $ kubectl delete deployment hello-world
$ kubectl describe services hello-world-service Describe the Service Hello-World-Service Delete the Hello-Word Deployment
21-10-2018 Source: https://github.com/meta-magic/kubernetes_workshop
2 38
21-10-2018
2 39
3 Fundamental Concepts
1. Desired State
2. Current State
3. Declarative Model
21-10-2018
2 40
Kubernetes Commands – Namespace
(Declarative Model)
• Namespaces are used to group your teams and software’s in
logical business group.
• A definition of Service will add a entry in DNS with respect to
Namespace.
• Not all objects are there in Namespace. Ex. Nodes, Persistent
Volumes etc.
21-10-2018
The above command will let you switch the namespace to your namespace (your-ns).
2 41
Kubernetes Pods
Atomic Unit
Virtual Server Pod Container
Big Small
• Pod is a shared environment for one of more
Containers.
• Pod in a Kubernetes cluster has a unique IP
address, even Pods on the same Node.
• Pod is a pause Container
$ kubectl create –f app1-pod.yml
$ kubectl get pods
• Pod Template
• Desired No. of Replicas
Create the ReplicaSet which will automatically create all the Pods
Applies new changes to the ReplicaSet. For example Scaling the replicas
from x to x + new value.
Deletes the ReplicaSet. If the cascade=true then deletes all the Pods,
Cascade=false will keep all the pods running and ONLY the ReplicaSet will be
21-10-2018 deleted.
2 45
Kubernetes Commands – Deployment
(Declarative Model)
• Deployments manages
ReplicaSets and
• ReplicaSets manages
Pods
• Rollbacks
• Canary Deployments
$ kubectl rollout status deployment app-deploy Show the Rollout status of the Deployment
$ kubectl rollout history deployment app-deploy Show Rollout History of the Deployment
Creates Deployment
Deployments contains Pods and its Replica information. Based on
$ kubectl create –f app-deploy.yml the Pod info Deployment will start downloading the containers
(Docker) and will install the containers based on replication factor.
$ kubectl scale deployment app-deploy - -replicas=6 Scale up the pods to 6 from the initial 2 Pods.
21-10-2018 Source: https://github.com/meta-magic/kubernetes_workshop
2 47
Kubernetes Services
Why do we need Services?
• Accessing Pods from Inside the
Cluster
• Accessing Pods from Outside
• Autoscale brings Pods with new IP
Addresses or removes existing Pods.
• Pod IP Addresses are dynamic.
Service Types
Service will have a stable IP Address. 1. Cluster IP (Default)
2. Node Port
Service uses Labels to associate with a 3. Load Balancer
set of Pods
21-10-2018 Source: https://github.com/meta-magic/kubernetes_workshop
4. External Name
2 48
Kubernetes Commands – Service / Endpoints
(Declarative Model)
Cluster IP (default) - Exposes the Service
on an internal IP in the cluster. This type
$ kubectl get svc List all the Services
makes the Service only reachable from
within the cluster.
$ kubectl describe svc app-service Describe the Service details
Node Port - Exposes the Service on the
$ kubectl get ep app-service List the status of the Endpoints
same port of each selected Node in the
$ kubectl describe ep app-service cluster using NAT. Makes a Service
Describe the Endpoint Details accessible from outside the cluster
using <NodeIP>:<NodePort>. Superset
of ClusterIP.
Create a Service for the Pods.
Service will focus on creating a Load Balancer - Creates an external load
routable IP Address and DNS for balancer in the current cloud (if
$ kubectl create –f app-service.yml the Pods Selected based on the supported) and assigns a fixed, external
labels defined in the service. IP to the Service. Superset of NodePort.
Endpoints will be automatically
created based on the labels in External Name - Exposes the Service
using an arbitrary name (specified
the Selector. by external Name in the spec) by
returning a CNAME record with the
$ kubectl delete svc app-service Deletes the Service. name. No proxy is used. This type
requires v1.7 or higher of kube-dns.
21-10-2018 Source: https://github.com/meta-magic/kubernetes_workshop
2 49
Kubernetes Ingress
(Declarative Model)
Kubernetes Networking
• Comparison between Docker and Kubernetes Networking
• Kubernetes DNS
• Pod to Pod Networking within the same Node
• Pod to Pod Networking across the Node
• Pod to Service Networking
• Ingress - Internet to Service Networking
• Egress – Pod to Internet Networking
21-10-2018
3 54
Kubernetes Networking
Mandatory requirements for Network implementation
veth0 veth1
the Pods EP EP EP
veth1 veth1 selected by a
Service based
on Pod Labels
2. Pod Network
Source: https://github.com/meta-magic/kubernetes_workshop
3 57
Docker Networking Vs. Kubernetes Networking
Node 1 Node 2 Node 1 Node 2
Web Server 8080 Microservice 9002 Web Server 8080 Microservice 9002 Web Server 8080 Microservice 9002 Web Server 8080 Microservice 9002
Microservice 9003 Microservice 9004 Microservice 9003 Microservice 9004 Microservice 9003 Microservice 9004 Microservice 9003 Microservice 9004
21-10-2018
4 68
21-10-2018
4 69
Kubernetes Pod Quality of Service
QoS: QoS: QoS:
Guaranteed Burstable Best Effort
Source: https://kubernetes.io/docs/tasks/configure-pod-container/configure-pod-configmap/
21-10-2018 Source: https://github.com/meta-magic/kubernetes_workshop
4 74
Kubernetes Pod in Depth 3 kinds of action handlers can be configured to perform
A probe is an indicator to a container's health. It against a container:
judges the health through periodically performing a
diagnostic action against a container via kubelet: exec: Executes a defined command inside the container.
Considered to be successful if the exit code is 0.
• Liveness probe: Indicates whether a container is
alive or not. If a container fails on this probe, tcpSocket: Tests a given port via TCP, successful if the
kubelet kills it and may restart it based on the port is opened.
restartPolicy of a pod.
httpGet: Performs an HTTP GET to the IP address of
• Readiness probe: Indicates whether a container is target container. Headers in the request to be sent is
ready for incoming traffic. If a pod behind a customizable. This check is considered to be healthy if
service is not ready, its endpoint won't be created the status code satisfies: 400 > CODE >= 200.
until the pod is ready.
Source: https://kubernetes.io/docs/tasks/configure-pod-
container/configure-liveness-readiness-probes/
Source: https://kubernetes.io/docs/concepts/configuration/secret/
21-10-2018 Source: https://github.com/meta-magic/kubernetes_workshop
4 77
Kubernetes Pod Presets
A Pod Preset is an API resource for injecting
additional runtime requirements into a Pod
at creation time. You use label selectors to
specify the Pods to which a given Pod
Preset applies.
You use labels and annotations to attach metadata to your resources. To inject data into your
resources, you’d likely create ConfigMaps (for non-confidential data) or Secrets (for confidential data).
Taints and Tolerations - These provide a way for nodes to “attract” or “repel” your Pods. They are often
used when an application needs to be deployed onto specific hardware, such as GPUs for scientific
computing. Read more.
Pod Presets - Normally, to mount runtime requirements (such as environmental variables, ConfigMaps,
and Secrets) into a resource, you specify them in the resource’s configuration file. PodPresets allow you
to dynamically inject these requirements instead, when the resource is created. For instance, this
allows team A to mount any number of new Secrets into the resources created by teams B and C,
without requiring action from B and C.
Source: https://kubernetes.io/docs/user-journeys/users/application-developer/advanced/
Provision
Network Request Use
Storage Storage Storage
Static / Dynamic
1 2 3
21-10-2018
4 82
Kubernetes Volume Volume Mode
• There are two modes
Persistent Volume Access Mode
• File System and or
• A Persistent Volume is the • ReadOnlyMany: Can be • raw Storage Block.
physical storage available. mounted as read-only by many
nodes • Default is File System.
• Storage Class is used to configure
• ReadWriteOnce: Can be Reclaim Policy
custom Storage option (nfs, cloud
mounted as read-write by a
storage) in the cluster. They are
single node Retain: The volume will need to
the foundation of Dynamic
Provisioning. • ReadWriteMany: Can be be reclaimed manually
mounted as read-write by many Delete: The associated storage
• Persistent Volume Claim is used nodes asset, such as AWS EBS, GCE PD,
to mount the required storage
Azure disk, or OpenStack Cinder
into the Pod.
volume, is deleted
Persistent Persistent Recycle: Delete content only (rm
Storage Class
Volume Volume Claim -rf /volume/*)
Source: https://kubernetes.io/docs/concepts/storage/persistent-volumes/#claims-as-volumes
4 83
Kubernetes Volume Types
Host Based Block Storage
Life cycle of a
o Amazon EBS
Persistent Volume
o EmptyDir
o HostPath o OpenStack Cinder
o Local o GCE Persistent Disk o Provisioning
o Azure Disk
Distributed File System
o vSphere Volume o Binding
o NFS
o Ceph
Others
o Using
o Gluster
o FlexVolume o iScsi o Releasing
o PortworxVolume o Flocker
o Amazon EFS o Git Repo o Reclaiming
o Azure File System o Quobyte
Source: https://github.com/meta-magic/kubernetes_workshop
4 84
Kubernetes Persistent Volume - hostPath
• HostPath option is to make the Volume available from the
Host Machine.
1
• A Volume is created and its linked with a storage provider. In
the following example the storage provider is Minikube for
the host path.
• Any PVC (Persistent Volume Claim) will be bound to the
Persistent Volume which matches the storage class.
• If it doesn't match a dynamic persistent volume will be
created.
• Developer is focused on 2
the availability of
storage space using PVC
and is not bothered
about storage solutions
or provisioning.
2
3
Source: https://github.com/meta-magic/kubernetes_workshop
4 87
Kubernetes Persistent Volume – AWS EBS
• Use a Network File System or Block Storage for Pods to access
and data from multiple sources. AWS EBS is such a storage 1
system.
• A Volume is created and its linked with a storage provider. In
the following example the storage provider is AWS for the
EBS.
• Any PVC (Persistent Volume Claim) will be bound to the
Persistent Volume which matches the storage class.
Source: https://github.com/meta-magic/kubernetes_workshop
$ aws ec2 create-volume - -size 100 Volume ID is auto generated
4 88
Persistent Volume – AWS EBS 3
• Manual Provisioning of Pod Access storage by issuing a
the AWS EBS supports Persistent Volume Claim.
ReadWriteMany, In the following example Pod
However all the pods claims for 2Gi Disk space from
are getting scheduled the network on AWS EBS.
into a Single Node.
Source: https://github.com/meta-magic/kubernetes_workshop
• For Dynamic
Provisioning use
2
ReadWriteOnce.
https://cloud.google.com/kubernetes-engine/docs/concepts/persistent-volumes
4 89
21-10-2018
4 90
Kubernetes Jobs
A job creates one or more pods and ensures that a
specified number of them successfully terminate.
As pods successfully complete, the job tracks the
successful completions. When a specified number
of successful completions is reached, the job itself
is complete. Deleting a Job will cleanup the pods it
created.
A Job can also be used to run multiple pods in Command is wrapped for display purpose.
parallel.
21-10-2018 Source: https://github.com/meta-magic/kubernetes_workshop Source: https://kubernetes.io/docs/concepts/workloads/controllers/jobs-run-to-completion/
4 91
Kubernetes DaemonSet
A DaemonSet ensures that all (or some) Nodes run a copy of a
Pod. As nodes are added to the cluster, Pods are added to them.
As nodes are removed from the cluster, those Pods are garbage
collected. Deleting a DaemonSet will clean up the Pods it created.
Container-level features
Sidecar container: Although your Pod should still have a single main
container, you can add a secondary container that acts as a helper
(see a logging example). Two containers within a single Pod can
communicate via a shared volume.
Source: https://kubernetes.io/docs/user-journeys/users/application-developer/advanced/
21-10-2018
4 93
Kubernetes Commands – Quick Help
(Declarative Model)
Deployment
$ kubectl get deploy app-deploy
$ kubectl create –f app-deploy.yml $ kubectl describe deploy app-deploy $ kubectl rollout undo deployment
app-deploy - -to-revision=1
$ kubectl apply –f app-deploy.yml $ kubectl rollout status deployment app-deploy
Supported Operators
You can use the =, ==, and != operators with field selectors (= and == mean the
same thing). This kubectl command, for example, selects all Kubernetes Services
that aren’t in the default namespace:
$ kubectl get services --field-selector metadata.namespace!=default
Source: https://kubernetes.io/docs/concepts/overview/working-with-objects/field-selectors/
21-10-2018
4 96
Kubernetes Commands – Field Selectors
Chained Selectors
As with label and other selectors, field selectors can be chained together as a
comma-separated list. This kubectl command selects all Pods for which
the status.phase does not equal Running and the spec.restartPolicy field
equals Always:
$ kubectl get pods --field-selector=status.phase!=Running,spec.restartPolicy=Always
Source: https://kubernetes.io/docs/concepts/overview/working-with-objects/field-selectors/
21-10-2018
97
Gateway
Virtual Service
Destination Rule
5 98
Istio Components
Data Plane Control Plane
UI Layer UI Layer
Process 1
Business Logic Business Logic
Web Services Web Services
Process 2
Service Mesh
Service Mesh
Sidecar
Sidecar
Microservice CB LB SD Service
Mesh
CB LB SD
CB – Circuit Breaker Data Plane Calls
Router Router
LB – Load Balancer
SD – Service Discovery
Service Discovery Calls
Control Plane will have all the rules for Routing and
Service Discovery. Local Service Mesh will download the Routing Service
rules from the Control pane will have a local copy. Service Mesh Control Plane Rules Discovery
Admin
Source: https://github.com/meta-magic/kubernetes_workshop
21-10-2018
5 107
Shopping Portal – Docker / Kubernetes
UI Pod N2
Firewall UI Pod N2
UI Service
Load Balancer EndPoints UI Pod N1
Internal
/ui Load Balancers
Source: https://github.com/meta-magic/kubernetes_workshop
Product Pod N3
EndPoints
Product MySQL
/productms Product Pod
Pod
Service
Product Pod N4
Service Call
/productreview Kube DNS
Review Pod N4
Ingress Review Review Pod N1
Service
EndPoints Review Pod N3
UI Pod N2
Firewall
UI
Load Balancer Service
UI Pod N2
Gateway Destination EndPoints UI Pod N1
Rule
/ui Internal
Source: https://github.com/meta-magic/kubernetes_workshop
Load Balancers
Source: https://github.com/meta-magic/kubernetes_workshop
/ui Others = Stable
Source: https://github.com/meta-magic/kubernetes_workshop
/ui 90% = Stable
EndPoints v1 UI Pod N2
Firewall
Stable / v1 UI
Load Balancer Service
UI Pod N2
Gateway Destination UI Pod N1
Rule Canary v2
v2 UI Pod N5
Source: https://github.com/meta-magic/kubernetes_workshop
/ui 100% = Stable
EndPoints v1 UI Pod N2
Firewall
Stable / v1 UI
Load Balancer Service
UI Pod N2
Gateway Destination UI Pod N1
Rule Canary v2
v2 UI Pod N5
100% = Stable
Source: https://github.com/meta-magic/kubernetes_workshop
/ui Mirror = Canary
EndPoints v1 UI Pod N2
Firewall
UI
Load Balancer Service
UI Pod N2
Gateway Destination UI Pod N1
Internal
Rule Load Balancers
Source: https://github.com/meta-magic/kubernetes_workshop
/ui EndPoints Product Pod N3
Destination Product MySQL
Product Pod
/productms Rule Service Pod
Product Pod N4
Fault Injection Service Call
Delay = 2 Sec Kube DNS
Abort = 10%
/productreview
Destination Review Pod N4
Virtual Service Rule
Review
Review Pod N1
Service
Istio Objects EndPoints Review Pod N3
Amazon AWS
• Virtual Private Network / Subnets
• Internet Gateway
• Routes
21-10-2018
5 115
Create VPC & Subnet
$ aws ec2 create-vpc --cidr-block 10.0.0.0/16 When you create a VPC, just define
{
"Vpc": { • one network CIDR block and
"VpcId": "vpc-7532a92g", • AWS region.
"InstanceTenancy": "default",
• For example, CIDR 10.0.0.0/16 on us-east-1.
"Tags": [],
"State": "pending",
"DhcpOptionsId": "dopt-3d901958", You can define any network address range (between
"CidrBlock": "10.0.0.0/16" /16 to /28 netmask range).
}
} Create one or more subnets within VPC.
$ aws ec2 create-subnet --vpc-id vpc- 7532a92g --cidr-block 10.0.2.0/24 -- availability-zone us-east-1b
{ "Subnet": { "VpcId": " vpc- 7532a92g ", "CidrBlock": "10.0.2.0/24", "State": "pending", "AvailabilityZone":
"us-east-1b", "SubnetId": "subnet-16938e09", "AvailableIpAddressCount": 251 } }
21-10-2018
5 116
Create Gateway and Attach it
$ aws ec2 create-internet-gateway You need to have a Internet Gateway for
{ your VPC to connect to the internet.
"InternetGateway": {
"Tags": [], Create an Internet Gateway and attach that
"InternetGatewayId": "igw-b837249v1", to the VPC.
“Attachments": []
} Set the routing rules for the subnet to point
}
to the gateway.
Attach VPC to the Gateway
21-10-2018
5 117
Create Routes
$ aws ec2 create-route-table --vpc-id vpc-7532a92g Create Route table for the VPC
{ "RouteTable":
{ "Associations": [],
"RouteTableId": "rtb-ag89x582",
"VpcId": "vpc-7532a92g",
"PropagatingVgws": [],
"Tags": [], "Routes": [
{ "GatewayId": "local",
"DestinationCidrBlock": "10.0.0.0/16",
"State": "active",
"Origin": "CreateRouteTable"
}
]
}}
Attach VPC to the Gateway
21-10-2018
Best Practices
• Simple Java Web Apps with Ubuntu & Tomcat can have a size of
700 MB
• Use Alpine Image as your base Linux OS
• Alpine images are 10x smaller than base Ubuntu images
• Smaller Image size reduce the Container vulnerabilities.
• Ensure that only Runtime Environments are there in your
container. For Example your Alpine + Java + Tomcat image
should contain only the JRE and NOT JDK.
• Log the App output to Container Std out and Std error.
21-10-2018
6 120
Docker: To Root or Not to Root! 2
21-10-2018
6 121
Docker: Container Security 3
21-10-2018
6 122
Kubernetes: Naked Pods 4
• Never use a Naked Pod, that is Pod without any
ReplicaSet or Deployments. Naked pods will never
get re-scheduled if the Pod goes down.
• Never access a Pod directly from another Pod.
Always use a Service to access a Pod.
• User labels to select the pods { app: myapp, tier:
frontend, phase: test, deployment: v3 }.
• Never use :latest tag in the image in the
21-10-2018
production scenario.
6 123
Kubernetes: Namespace 5
Service-Name.Namespace.svc.cluster.local
• Group your Services / Pods / Traffic Rules based on Kubernetes Cluster
Specific Namespace.
• This helps you apply specific Network Policies for default
that Namespace with increase in Security and
Performance.
• Handle specific Resource Allocations for a Kube system
Namespace.
• If you have more than a dozen Microservices then
it’s time to bring in Namespaces. Kube public
21-10-2018
6 128
Kubernetes: Upgrade Cluster 10
• Make sure that the Master behind a Load Balancer.
• Upgrade Master
• Scale up the Node with an extra Node
• Drain the Node and
• Upgrade Node
• Cluster will be running even if the master is not working.
Only Kubectl and any master specific functions will be
down until the master is up.
21-10-2018
129
Source: https://github.com/meta-magic/kubernetes_workshop