10 - Kubernetes Handout
10 - Kubernetes Handout
SERVICE CONFIGMAP
POD
INGRESS SECRET
DEPLOYMENT
VOLUMES
STATEFULSET
Core Kubernetes Components - 2
POD
INGRESS
CONFIGMAP
Pods can consume
To store non-confidential
ConfigMaps and Secrets as
data in key-value pairs
environment variables, CLI
SECRET arguments or as config files in a
passwords or tokens
Storing the data in a Secret component doesn't automatically make it secure. There are built-in
mechanisms (like encryption, defining authorization policies) for basic security, which are not enabled
by default! Recommended to use third-party secret management tools, because the provided
capabilities by K8s are not enough for most companies
Core Kubernetes Components - 6
When a container crashes, K8s restarts the container but with a clean state. Meaning your data is lost!
VOLUME
DEPLOYMENT STATEFULSET
intelligent forwarding of
Detects state changes, like crashing K8s' backing store for all cluster data. A
cluster state as soon as possible Think of it as a cluster brain, every change in the cluster gets saved or
For that it makes request to the updated into it
Scheduler to reschedule those Pods All other processes like Scheduler, Controller Manager etc work based
and the same cycle happens on the data in etcd as well as communicate with each other through etcd
store
cluster, thus forming a more powerful and robust cluster to meet your application resource requirements
CRUD
desired state of a K8s component Config files should be stored in version control
1) metadata 2) specification
configuration
resources, such as Pods. Via selector the user can identify a set of
port = the port where the service itself is accessible containerPort = port, the container
to the DB
Namespaces - 1
Namespaces provide a mechanism for isolating groups of resources within a single cluster
Names of resources need to be unique within a namespace, but not across namespaces
running
Most K8s resources (e.g. pods, services, etc.) are Live globally in a cluster, you can't isolate them
Service is determined by a
selector
PORTS:
The service port is arbitrary
to write to database
NodePort Service
Unlike internal Service, is accessible directly from outside cluster
Node
URL = IP address of Worker Node : nodePort
Not Secure: External traffic has access to fixed port on each Worker Node
Loadbalancer Service
Exposes the Service externally using a cloud provider's load balancer
NodePort and ClusterIP Services, to which the external load balancer routes, are automatically created
Node Loadbalancer
Ingress - 1
External Services are a way to access applications in K8s from outside
Not a Service type, but acts as the entry point for your cluster
More intelligent and flexible: Let's you consolidate your routing rules into a single resource as it
Configure TLS
Certificate - https://
Ingress - 3
Manages redirections
Which is Ingress Controller
Entry point to the cluster
Option 2 - Bare Metal: You need to configure some kind of entry point. Either
Source: https://kubernetes.io/docs/concepts/services-networking/ingress/
Volumes - 1
At its core, a volume is a directory (with some data in it), which is accessible to the containers in a Pod
Ephemeral volume types have a lifetime of a Pod, persistent volumes exist beyond the lifetime of a Pod
Storage Requirements
In this lecture we talk about persistent Storage that doesn't depend on pod lifecycle
crashes
Volumes - 2
The way to persist data in K8s using Volumes is with these 3 resources:
Storage in the cluster that has been provisioned by SC provisions PV dynamically when PVC claims it
Storage Classes
namespaced, so PV resource is
Configuration Example
accessible to the whole cluster:
attributes differ
Claims can request specific size and access modes (e.g. they can be mounted
Manages the deployment and scaling of a set of Pods and provides guarantees about the
These pods are created from the same spec, but are not
synchronized
Kubernetes on Cloud platform
2 options to create a Kubernetes cluster on a cloud platform
You need to manage everything You only care about Worker Nodes
Not practical, when you want to Control Plane Nodes created and managed by cloud
Packages YAML files and distributes them in public and private repositories
Tool that installs and manages K8s Helm package that contain
This is done via Charts, so Helm manages 1 or more templates, which contain K8s
K8s manifests
Many of these created by the official sources. Charts are hosted on their own repositories
Mysql Chart from Mysql or ElasticSearch Chart There are public repos, but you can have own
placeholders
Many
values are
the same!
multiple clusters:
Pull Docker Images into K8s cluster
PRIVATE REPO: For K8s to fetch
no credentials needed
Steps to pull image from Private Registry
Is managed by Kubernetes
Stateful applications:
Operators
K8s can't automate the process natively
Kubernetes Operators - 2
How it works:
How to run it
How to update
Layers of Security
In K8s, you must be authenticated
to access)
Authentication Authorization
K8s doesn't manage Users natively K8s supports multiple authorization modules, such
No K8s resources exist for representing normal as ABAC mode, RBAC Mode and Webhook mode
user accounts On cluster creation, admins configure the
Admins can choose from different authentication authorization modules that should be used
strategies K8s checks each module, and if any module
authorizes the request, then the request can
proceed
Authentication
API server handles authentication of all the requests
Client Certificates Static Token File 3rd Party Identitiy Service, like LDAP
names
Authorization
As a security best practice, we only want to give people or services just enough permission to do
A method of regulating access to resources based on the roles of users within the organization
ClusterRole
Role
resource
Authorization with RBAC - 3
ClusterRoleBinding RoleBinding
Link ("Bind") ClusterRole to a User or Group Link ("Bind") Role to a User or Group
Authorization for Applications
A RoleBinding or
bind a role to a
ServiceAccount
Introduction to Microservices
Benefits
independently
service?
Developers develop the As a DevOps engineer your
3. How are they communicating?
microservice applications task would be to deploy the
4. Which database are they using? 3rd
existing microservices
party services
application in a K8s cluster
5. On which port does each service
run?
DevOps Task: Deploy Microservices App - 2
Why? Otherwise, latest version is fetched, which makes it unpredictable and intransparent as to which
versions are deployed in the cluster
Why? K8s knows the Pod state, not the application state. Sometimes
pod is running, but container inside crashed. With liveness probe we
can let K8s know when it needs to restart the container
Why? To make sure your application is always available, no downtime for users!
Best Practices - 3
Why? Have an identifier for your components to group pods and reference in Service e.g.
Why? Third-party libraries or base images can have known vulnerabilities. You
Why? With root access they have access to host-level resources. Much more
Why & How? Latest versions include patches to previous security issues etc.
Upgrade with zero downtime by having multiple nodes and pod replicas on different nodes