Saravana's Musings: July 2020

Topics covered:

Kubernetes components

Kubernetes building blocks

Namespace

Batch job

Configmap secrets

Ingress controller

Application health checks

Advanced kubernetes scheduling

Statefulsets

Advanced volume management

Role based access control

Quota management

Helm

Custom resource definition

Logging and Debugging

Monitoring with Prometheus

Istio

CICD

Microservice tracing

Kubeadm

https://kubernetes.io/docs/setup/independent/create-cluster-kubeadm/

Kubeadm reset - To reset the node state

To know the last output:

kubeadm token create --print-join-command

Kubernetes components

API server

ETCD

Scheduler

Controller manager

Node

API server

All administrative tasks performed via API server.

User/Operator sends REST commands to API server, which validates and processes

The requests.

ETCD

Key-value store - cluster state stored.

Either with master or externally configured.

Scheduler

Schedules work to different worker nodes.

Schedule a work on a node where label disk == ssd is set

Works in terms of pods and services.

Controller manager:

Runs all the controllers.

Node controller
Replication controller
Endpoints controller
Service account and Token controllers

Cloud Controller manager

Manage the underlying cloud provider.

Loadbalancer / EBS volumes in AWS.

Node

3 main componenets

Kubelet
Kube-proxy
Container runtime

Kubelet

Takes set of podspecs that are provided through various mechanism and

Ensure containers in podspecs are running and healthy.

Kube-proxy

Helps in providing k8s service abstraction.

Network rules, and forwarding incoming connection

Container runtime

Main software responsible for running containers.

Pods and service used by kubernetes services.

4149 / TCP Kubelet

10250/TCP kubelet

10255/TCP kubelet

9099/TCP calico-felix

6443/TCP kube-apiserver

Static pods - system pods

Pods not under the control of API server

/etc/kubernetes/manifest/ <static pods>

Make use of static ip - hostnetwork -

1 vcpu - 1000 millicores

/etc/kubernetes/admin.config

// to delete

Kubeadm reset

// master

Kubeadm init

// from the worker node

Kubeadm join

kubectl --config = /path

export KUBECONFIG=/tmp/config

// default

~/.kube/config

Frontend + backend -> different type of scaling -> so different pods better.

Multiple containers in a pod -> login + transaction - complimentary in nature. runs together.

IP is per pod (not container).

CNI plugins

api<group> / version/ resource

// to view configuration

kubectl config view

// create / modify existing

kubectl apply

Kubernetes Building blocks

Pods
Replicasets
Deployments
Labels, selectors, Annotation

Annotations like label but 'without selector'

Services

- not tied to deployment

Daemonsets

On each node
No replica count - only one on a node
Used in monitoring logging

Namespaces

Way to divide the cluster resources between multiple users.

Name of resources are unique within the namespace. (means different namespace you can use same name).

Batch jobs

One or more pods successfully run and then terminate.

Deleting the job -> cleanup the pods created by it.

Configmaps and secrets:

Configmaps are designed to work more conveniently with data

That does not container sensitive information.

Key-value pairs.

Can be used as

Environment variables
Command line args for a container.
Config files in a volume

Configmaps as volumes.

Secrets:

Store and manage sensitive information like credentials and encryption keys.

Image pull secret

Ingress controllers:

Services and pods have IPs only routable by the cluster network.

An Ingress is a collection of rules that allow inbound connections to reach the cluster services.

Can be configured to give services externally :

Reachable URLs
Load balance traffic
Terminate SSL
Name based virtual hosting.

kind: Ingress

example.com/b

example.com/g

b.example.com/

g.example.com/

Example: https://github.com/kubernetes-sigs/aws-alb-ingress-controller

Application health checks

Liveness probe

Readiness probe

Scheduling

Schedule work (pods) onto computing resources (nodes)

// It is not about running the pod , it is kublet’s job.

Assigning pod to a node.

Pod auto scaling:

Horizontal pod autoscaling

Custom metrics

Graceful shutdown

Prestop and termination grace period

Drain node

Pod affinity and anti-affinity

Pod disruption budget

Blue green and canary deployment

Taint toleration

Network policy

Statefulset

For stateful workloads like databases.

Manages deployment and scaling of the pods in ordered manner by maintaining a unique, sticky

Identity for each of their pods.

Statefulsets manage pods that are based on an identical container spec.

Pods in a statefulset are not interchangeable.

Each pod has a persistent identifier that it maintains across scheduling.

Kind: Statefulset

Pod name does not change
Order in which pods comes up

Storage management

PVC

dynamic provisioning

Storage classes

Subpath

Allows you to mount multiple volumes inside the same directory.

Also, mounting a single volume multiple times with different sub-paths.

Role Based Access control (RBAC)

User -> Authentication -> Authorization -> Admission control (valid request ?) -> k8s objects

Users - not first class citizens in k8s.

Normal users
Service account

Service accounts with default names get created as we create a namespace.

User defined service accounts can be created as well, which we can attach to the pod running in the same namespace.

Dashboard special access API server -> needs service account

Context -> Cluster + User

kubectl config get-contexts

kubectl config use-context <context name>

Operations possible with kubectl:

Create
Get
Delete
List
Update
Edit
Patch
Watch

RBAC roles

Role - only for namespace
ClusterRole - cluster wide

RoleBinding - namespace
ClusterRoleBinding - cluster wide

Rolebinding -> grants permission defined in a role to a user or a set of users.

Quota Resource limits

Resources request

Resource Limit

OOM killer

Resource Quota namespace

Storage limit

Default memory limits and requests

Quotas for API objects

Helm

- yum in k8s world.

Manage kubernetes applications.

Define, install and upgrade complex k8s applications.

Helm charts are easy to create, version, share and publish.

ksonnet -https://ksonnet.io/

https://github.com/kubernetes-sigs/kustomize

CRD

CustomResourceDefinitions (CRD) -> plugging in your own managed object and application

as if it were a native k8s component.

kubectl can be used to manage.

Custom controllers.

Can work with any resources, but effective with custom resources.

logging and Debugging

kubectl logs and exec

kubectl logs <podname > -c <container name>

kubectl get events

kubectl describe pod <podname>

/var/log/containers/kube-controller-manager….log

journalctl -fu kubelet

kubectl --v=6 get pods verbose

v=7, v=8

Monitoring with Prometheus

Istio

Service mesh which provides platform to connect, manage and secure microservices

Network of deployed services with load balancing, service to service authentication, monitoring and more.

Deploying a special sidecar proxy along with the service that tracks all network communication

between microservices.

Sidecars are configured and managed by Istio’s control plane functionality.

Traffic shifting:

70% and 30% to two different services.

Istio virtual service

Istio rule

Retry logic

Number of retry attempts for an HTTP request

Maximum number of retries with the default or overridden timeout period.

https://istio.io/docs/tasks/traffic-management/ingress/#determining-the-ingress-ip-and-ports

CICD

CircleCI

CircleCI workflow

ArgoCD

ArgoCD manifest

https://www.weave.works/technologies/gitops/

https://circleci.com/

https://github.com/argoproj/argo-cd

Saravana's Musings

Thursday, July 30, 2020

Firefox & extensions

Tuesday, July 28, 2020

Placement of argument matters - in few commands

Saturday, July 25, 2020

disable swap

Friday, July 24, 2020

Password prompted with update in sudoers file

Thursday, July 23, 2020

Kubernetes concepts

Topics covered: