10 Kube Commandments We've been in the game for years That in - - PowerPoint PPT Presentation

▶
10 kube commandments we ve been in the game for years
SMART_READER_LITE
LIVE PREVIEW

10 Kube Commandments We've been in the game for years That in - - PowerPoint PPT Presentation

Mar 19, 2024 341 likes •1.02k views

10 Kube Commandments We've been in the game for years That in itself is admirable There's rules to this biz We wrote y'all a manual A step-by-step conf talk for you to get... Your clusters on track And not your releases pushed back Bryan

slide-1
SLIDE 1

10 Kube Commandments

slide-2
SLIDE 2

We've been in the game for years

slide-3
SLIDE 3

That in itself is admirable

slide-4
SLIDE 4

There's rules to this biz

slide-5
SLIDE 5

We wrote y'all a manual

slide-6
SLIDE 6

A step-by-step conf talk for you to get...

slide-7
SLIDE 7

Your clusters on track

slide-8
SLIDE 8

And not your releases pushed back

slide-9
SLIDE 9

Staff Software Engineer Heptio Lots of years Years of Experience @bryanl

Bryan Liles

slide-10
SLIDE 10

Senior Software Engineer DigitalOcean Observability Cloud Compute Services Systems Engineering @cagedmantis

Carlos Amedee

slide-11
SLIDE 11

Rule Number Uno To go fast, you must start slow

slide-12
SLIDE 12

Rule Number Uno To go fast, you must start deliberately

slide-13
SLIDE 13

Public Cloud Datacenter Your Desktop

slide-14
SLIDE 14

Public Cloud Datacenter Your Desktop

  • GKE on Google Cloud
  • AKS on Azure
  • *lots of vendors*
  • kubeadm
  • *lots of vendors*
  • Minikube
  • Minik8s
  • Docker for Mac or Windows
slide-15
SLIDE 15

Public Cloud Datacenter

  • GKE on Google Cloud
  • AKS on Azure
  • *lots of vendors*
  • kubeadm
  • *lots of vendors*

X X

Not Declarative

slide-16
SLIDE 16

Cluster API

slide-17
SLIDE 17

Number Two Always let them know your next move

slide-18
SLIDE 18

Your next move is the images you'll deploy to your cluster

slide-19
SLIDE 19

Build Image Host Image

slide-20
SLIDE 20

docker build

slide-21
SLIDE 21

docker build

  • buildah
  • img
  • GCP Container Builder
slide-22
SLIDE 22

Why are you still building your containers with root privileges?

slide-23
SLIDE 23

Rule Number Three Never trust nobody: Hookup up that Pod Security Policy

slide-24
SLIDE 24

apiVersion: extensions/v1beta1 kind: PodSecurityPolicy metadata: name: how-not-to-get-robbed spec: privileged: false runAsUser: rule: MustRunAsNonRoot seLinux: rule: RunAsAny fsGroup: rule: RunAsAny supplementalGroups: rule: RunAsAny volumes:

  • nfs
slide-25
SLIDE 25

Number Four I know you heard this before: Never get high off what Kube supplies

slide-26
SLIDE 26

Custom Resource Definition

CRD Custom Controller

slide-27
SLIDE 27

Custom Resources Pattern

CRD Custom Controller K8s External Resource Native Resource

slide-28
SLIDE 28

Custom Resources Pattern

CRD Custom Controller Operator

slide-29
SLIDE 29

Custom Resources Pattern

CRD Custom Controller Native Resource Native Resource Native Resource

slide-30
SLIDE 30

Rule Number Five Communicating With Pods Never Mix Internal and External Traffic

slide-31
SLIDE 31

Ingress Traffic

slide-32
SLIDE 32

Cluster IP

apiVersion: v1 kind: Service metadata: name: sample-service spec: selector: app: sample-app type: ClusterIP ports:

  • name: http

port: 80 targetPort: 80 protocol: TCP

Pod Pod Pod Service Proxy

slide-33
SLIDE 33

Node Port

apiVersion: v1 kind: Service metadata: name: my-nodeport-service spec: selector: app: my-app type: NodePort ports:

  • name: http

port: 80 targetPort: 80 nodePort: 30036 protocol: TCP

Pod Pod Pod Service Pod

slide-34
SLIDE 34

Load Balancer

apiVersion: v1 kind: Service metadata: name: sample-lb spec: selector: app: some-app type: LoadBalancer ports:

  • name: http

port: 80 targetPort: 80 protocol: TCP

Pod Pod Pod Service Load Balancer

slide-35
SLIDE 35

Ingress

apiVersion: extensions/v1beta1 kind: Ingress metadata: name: my-ingress spec: backend: serviceName: other servicePort: 8080 rules:

  • host: foo.mydomain.com

http: paths:

  • backend:

serviceName: foo servicePort: 8080

  • host: mydomain.com

http: paths:

  • path: /bar/*

backend: serviceName: bar servicePort: 8080

Pod Pod Pod Service Ingress Pod Pod Pod Service

slide-36
SLIDE 36

Egress Traffic

slide-37
SLIDE 37

Egress

apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: name: sample-network-policy spec: podSelector: matchLabels: role: my-app policyTypes:

  • Egress

egress:

  • to:
  • ipBlock:

cidr: 10.0.0.0/24

slide-38
SLIDE 38

Service Mesh

slide-39
SLIDE 39

Rule Number Six If You Think You Know What’s Happening In Your Cluster… Forget it.

slide-40
SLIDE 40

Observability

What’s happening in your cluster?

slide-41
SLIDE 41

What’s happening on your cluster?

slide-42
SLIDE 42

Metrics and Alerting

slide-43
SLIDE 43

Logging

slide-44
SLIDE 44

Distributed Tracing

slide-45
SLIDE 45

Observability Dashboard

slide-46
SLIDE 46

Horizontal Pod Autoscaler

slide-47
SLIDE 47

Rule Number Seven Keep your storage and the business rules to manage it completely separated.

slide-48
SLIDE 48

Storage

slide-49
SLIDE 49

Easily create your own storage implementation

slide-50
SLIDE 50

Persistent Volume Snapshots

slide-51
SLIDE 51

Number 8: Using Tools

slide-52
SLIDE 52

Package Management Configuration Management

slide-53
SLIDE 53
  • Helm 2
  • Bounds of YAML

Package Management

slide-54
SLIDE 54

Configuration Management

  • ksonnet
  • Pulumi
  • Ballerina
slide-55
SLIDE 55
slide-56
SLIDE 56

Other types of tools?

  • skaffold
  • kustomize
slide-57
SLIDE 57

Number 9: Extending Kubernetes

slide-58
SLIDE 58

What happens if you get an API for free?

slide-59
SLIDE 59

What happens when you outgrow the Kubernetes API?

slide-60
SLIDE 60

Number 10: A live word called refinement -- Building On Kubernetes

slide-61
SLIDE 61

Cluster

App 1 App 2 App 3

"On top of Kubernetes"

slide-62
SLIDE 62

Cluster

App 1 App 2 App 3

"On Kubernetes"

slide-63
SLIDE 63

Follow these rules

slide-64
SLIDE 64

You'll have mad bread to break up

slide-65
SLIDE 65

If not, 24 hours of on-call with constant wake ups.