by Tiffany Jernigan, Developer Advocate, AWS Kubernetes offers a powerful abstraction layer for managing containerized infrastructure. Amazon Elastic Container Service for Kubernetes (Amazon EKS) makes it easy to run Kubernetes on AWS without having to manage master nodes or the etcd operator. In this session, we show how Amazon EKS makes deploying Kubernetes on AWS simple and scalable, including networking, security, monitoring, and logging.

1. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
kubernetes on
t iffa n y je r n ig a n
t iffa n y fa y j

2. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
T I F F A N Y F A Y J
CONTAINERS
Packaging Distribution Immutable
infrastructure

3. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
T I F F A N Y F A Y J
© 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
T I F F A N Y F A Y J

4. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
T I F F A N Y F A Y J
Open source container
management platform
Helps you run
containers at scale
Gives you primitives
for building
modern applications
WHAT IS KUBERNETES?

5. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
T I F F A N Y F A Y J
A SINGLE EXTENSIBLE API
SCALE PERFORMANCE BREADTH

6. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
T I F F A N Y F A Y J
© 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
T I F F A N Y F A Y J
Vibrant and growing community
of users and contributors

7. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
T I F F A N Y F A Y J
ON-PREMISES CLOUD
KUBERNETES CAN BE RUN ANYWHERE!

8. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
T I F F A N Y F A Y J
CLOUD-NATIVE APPLICATIONS
MICROSERVICE TOOLING NATIVE APPLICATIONS

9. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
T I F F A N Y F A Y J
“Run Kubernetes for me.”
“Native AWS integrations”
“An open source Kubernetes
experience.”

10. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
T I F F A N Y F A Y J
E L A S T I C C O N T A I N E R S E R V I C E FO R K U B E R N E T E S
© 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
T I F F A N Y F A Y J

11. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
T I F F A N Y F A Y J
AMAZON CONTAINER SERVICES

12. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Tenet 1
EKS is a platform for enterprises
to run production-grade workloads
T I F F A N Y F A Y J
© 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.

13. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Tenet 2
EKS provides a native and
upstream Kubernetes experience
T I F F A N Y F A Y J
© 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.

14. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
T I F F A N Y F A Y J
EKS IS KUBERNETES CERTIFIED
T I F F A N Y F A Y J

15. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Tenet 3
If EKS customers want to use additional
AWS services, the integrations are seamless
and eliminate undifferentiated heavy lifting
T I F F A N Y F A Y J
© 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.

16. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Tenet 4
EKS team actively contributes
to the Kubernetes project
T I F F A N Y F A Y J
© 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.

17. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
T I F F A N Y F A Y J
OPEN SOURCE KUBERNETES COMMUNITY
Kubernetes
https://github.com/kubernetes/kub
ernetes
CNI plugin
https://github.com/aws/amazon-
vpc-cni-k8s
Heptio AWS Authenticator
https://github.com/heptio/authenti
cator
Virtual Kubelet
https://github.com/virtual-
kubelet/virtual-kubelet/
SIG AWS
https://github.com/kubernetes/com
munity/tree/master/sig-aws
Cloud Provider Working
Group
https://github.com/kubernetes/com
munity/tree/master/wg-cloud-
provider
External-DNS
https://github.com/kubernetes-
incubator/external-dns
CoreOS ALB Ingress
https://github.com/coreos/alb-
ingress-controller
CODE
REVIEWS
FIXING
BUGS
IMPLEMENTING
NEW FEATURES

18. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
T I F F A N Y F A Y J
EKS - CUSTOMERS
Create EKS cluster
Provision worker
nodes
Launch add-ons
Launch
workloads

19. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
T I F F A N Y F A Y J
EKS - KUBERNETES CONTROL PLANE
Create cluster
Create HA
Control Plane
IAM integration
Certificate
Management
Setup LB

20. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
T I F F A N Y F A Y J
mycluster.eks.amazonaws.com
Availability
Zone 1
Availability
Zone 2
Availability
Zone 3
kubectl
Workers

21. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.@ C H R I S T O P H _ K @ T I F F A N Y F A Y J
EKS Architecture
© 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
T I F F A N Y F A Y J

22. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
T I F F A N Y F A Y J
EC2 Worker
Nodes
EKS
Control
Plane
Customer VPC EKS VPC
Network Load
Balancer
ENI
API Access
Kubectl
Exec/Logs
TLS
Static IPs
ENI Attachment
Autoscaling Group
EKS ARCHITECTURE

23. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
T I F F A N Y F A Y J
IAM AUTHENTICATION

24. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
T I F F A N Y F A Y J
kubectl
3) Authorizes AWS Identity with RBAC
K8s API
1) Passes AWS Identity
2) Verifies AWS Identity
4) K8s action
allowed/denied
IAM Auth
IAM AUTHENTICATION + KUBECTL
https://github.com/heptiolabs/kubernetes-aws-authenticator

25. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
T I F F A N Y F A Y J
EKS WORKER NODES

26. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
T I F F A N Y F A Y J
kubectl
AWS Auth
config map & RBAC
Workers
Role
Role
config
map
WORKER PROVISIONING

27. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
T I F F A N Y F A Y J
Nodes
Node exporter
Pod/Container
Kube-state-metrics
cAdvisor
Application
/metrics
JMX
Cluster-wide Aggregator
Prometheus, Heapster
Visualizer
Grafana, Kibana, Dashboard
Data Model
InfluxDB, Graphite
Alerting
AlertManager, Kapacitor
METRICS

28. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
T I F F A N Y F A Y J
NETWORKING

29. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
T I F F A N Y F A Y J
Native VPC networking
with CNI plugin
Pods have the same VPC
address inside the pod
as on the VPC
Simple, secure networking
Open source and
on Github
…{ }
https://github.com/aws/amazon-vpc-cni-k8s

30. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
T I F F A N Y F A Y J
Nginx Pod
Java Pod
ENI
Veth IP: 172.16.1.147
Veth IP: 172.16.1.224
Nginx Pod
Java Pod
ENI
Veth IP: 172.16.1.38
Veth IP: 172.16.1.24
ec2.associateaddress()
VPC Subnet – 172.16.1.0/24
Instance 1 Instance 2
Primary Private IP:
172.16.1.118
Secondary IPs:
172.16.1.147,
172.16.1.224, …
Primary Private IP:
172.16.1.15
Secondary IPs:
172.16.1.38,
172.16.1.24, …
172.16.0.0/16

31. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
T I F F A N Y F A Y J
© 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
T I F F A N Y F A Y J
How do I configure network security with EKS?

32. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
T I F F A N Y F A Y J
Kubernetes Network
Policies enforce network
security rules
Calico is the leading
implementation of the
network policy API
Open source, active
development (>100
contributors)
Commercial support
available from Tigera
https://www.projectcalico.org/

33. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
T I F F A N Y F A Y J
STAGE SEPARATION “TENANT” SEPARATION FINE-GRAINED FIREWALLS COMPLIANCE
Namespaces – without
network policy, they are
not network isolated
Reduce attack surface
within microservice-based
applications
Isolate dev, test, and prod E.g., PCI, HIPAA

34. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.@ C H R I S T O P H _ K @ T I F F A N Y F A Y J© 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
T I F F A N Y F A Y J
What version of Kubernetes does EKS support?
1.10.3 currently

35. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
T I F F A N Y F A Y J
AUTOSCALING

36. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
T I F F A N Y F A Y J
AUTO SCALING
Pods
Horizontal Pod Autoscaler
Scales pods in response to k8s
generated metrics (CPU)
Cluster
Two options
AWS AutoScaling
k8s Cluster Auto Scaler
Cluster Autoscaler
Reactive
Aware of Pod / Cluster state
Utilizes AWS AutoScaling
AWS AutoScaling
Scaling on CloudWatch Metrics

37. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
T I F F A N Y F A Y J
❯ helm search mysql
> helm search mysql
NAME CHART VERSION APP VERSION DESCRIPTION
stable/mysql 0.6.0 5.7.14 Fast, reliable, sc
stable/prometheus-mysql-exporter 0.1.0 v0.10.0 A Helm chart for p
stable/percona 0.3.2 5.7.17 free, fully compat
...
❯ helm install stable/mysql
[displays README + information about deployment]
❯ helm list
NAME REVISION UPDATED STATUS CHART NAMESPACE
nobby-cow 1 Wed Jun 6 12:54:00 2018 DEPLOYED mysql-0.6.0 default
Package manager that allows you to bundle up deployment resources
and publish them
https://github.com/kubernetes/helm

38. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
T I F F A N Y F A Y J
DEPLOYING HELM ON EKS
kubectl -n kube-system create serviceaccount tiller
kubectl create clusterrolebinding tiller --clusterrole
cluster-admin --serviceaccount=kube-system:tiller
helm init --service-account tiller
Helm 2.9+ works with EKS
RBAC permissions required

39. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
T I F F A N Y F A Y J
Demo
© 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
T I F F A N Y F A Y J

40. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
T I F F A N Y F A Y J
EKS – GETTING STARTED
https://aws.amazon.com/eks
https://aws.amazon.com/getting-started/projects/deploy-
kubernetes-app-amazon-eks/
https://aws.amazon.com/blogs/aws/amazon-eks-now-generally-
available/
https://aws.amazon.com/blogs/compute/
https://aws.amazon.com/blogs/opensource/category/compute/am
azon-elastic-container-service-for-kubernetes/
https://medium.com/containers-on-aws

41. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
tiffanyfayj
Special thanks to:
Paul Maddox, Abby Fuller, Nishi Davidson,
Brandon Chavis, Arun Gupta, Chris Hein,
Omar Lari, Christoph Kassen, and many
more...
aws.amazon.com/eks
THANK YOU!