Kubernetes is a core component of most modern app delivery strategies because it helps organizations deliver apps faster with more agility and avoid costly downtime. But adopting Kubernetes is far from easy for organizations that are used to delivering three-tier apps. How do you decide which apps to refactor and which to build from scratch? What kinds of processes and tools can help you avoid common challenges around security and complexity? Join this session led by Rey Lejano, Kubernetes Field Engineer at Racher, for answers to these common questions. Speakers: Rey Lejano

1. Guide to Adopting
Kubernetes
Rey Lejano
Kubernetes Field Engineer, SUSE
Kubernetes v1.23 Release Lead, v1.25 Emeritus Adviser

2. ©2022 F5
2
• Kubernetes Field Engineer, Center of Excellence with SUSE (via Rancher Labs)
• Upstream Kubernetes contributor
• v.1.23 Release Lead
• v1.25 Emeritus Adviser
• SIG Docs co-chair
• SIG Security subproject lead
whoami

3. ©2022 F5
3
1. Cloud Native Applications
2. Adopting Kubernetes
3. More than Pods, Day 2 Processes and Tools
Agenda

4. ©2022 F5
4
Cloud Native Applications

5. ©2022 F5
5
• Official definition from the Cloud Native Computing Foundation’s charter:
Cloud native technologies empower organizations to build and run scalable applications in modern, dynamic environments such
as public, private, and hybrid clouds. Containers, service meshes, microservices, immutable infrastructure, and declarative APIs
exemplify this approach.
These techniques enable loosely coupled systems that are resilient, manageable, and observable. Combined with robust
automation, they allow engineers to make high-impact changes frequently and predictably with minimal toil.
What is Cloud Native?

6. ©2022 F5
6
Application modules and logic
UI
Catalog
Identity
Ordering
• Monolith
• Three-tier application
• Presentation
• Application
• Data
Monolith vs Cloud Native Application
Relational DB
• Cloud Native Application
• Microservices
• Self-contained
• Lightweight
• Crisply defined
• Atomically
deployable
UI API Gateway
Catalog Microservice
REST
API
Identity Microservice
REST
API
Ordering Microservice
REST
API
Relational DB

7. ©2022 F5
7
• Rehost
• Lift & Shift
• Refactor
• Cloud-native
• Rearchitect
• Monolith à Microservices
• Rebuild
• Redesign in the cloud
• Replace
• SaaS
Gartner’s 5Rs of Cloud Rationalization

8. ©2022 F5
8
Adopting Kubernetes

9. ©2022 F5
9
Pre-requisite: Containers!
• A running instance of a container
image
• Portable - You build your
application once, and you run it
anywhere
• Clean, isolated runtime
environment for your application.
• Scale your application horizontally
by spawning more containers
• Each container is guaranteed to be
identical
Application
Code
Application
Dependencies
Container
Image
Container
Container
Container

10. ©2022 F5
10
Containers
Managing a couple – no problem

11. ©2022 F5
11
Containers
How about managing many? How do we address:
Networking, Security, Scheduling, Automation, etc?

12. ©2022 F5
12
“Kubernetes is a powerful open-source platform for managing containerized workloads and services”
• Declarative configuration
• Self-healing
• Service discovery and load balancing
• Automated rollouts and rollbacks

13. ©2022 F5
13
Deploy! Is it Enough?
Not Enough
Need to optimize with processes and
tools

14. ©2022 F5
14
More than Pods
Day 2 Processes and Tools

15. ©2022 F5
15
• Declarative Management of infrastructure (VMs, Kubernetes)
• Solves environment drift
• Immutable Infra
• Orchestration not just configuration
• Portability
• Automation
• Reliability
• Consistent
• Terraform, Ansible, Chef, Pulumi
Infrastructure as Code

16. ©2022 F5
16
• CI
• Run all the PR pipeline steps, testing checks,
deployment checks
• CD
• Triggered by CI builds. Uses templates to
open a PR to the GitOps repo to request a
change to a desired state of a Kubernetes
resource(s)
• GitOps
• Git is the single source of truth and represents
the desired state of clusters. Any change in a
GitOps repo is picked up by a GitOps tool and
updated or deployed to clusters
CI/CD with GitOps
Change Code
CI Pipeline
Validation/
Tests
App Repo
Build
CD Pipeline GitOps Repo / K8s
Deploy to
Clusters
Example Flow

17. ©2022 F5
17
Layered Security: Defense In Depth
Supply Chain
Security
Runtime
Security
Vulnerability Scanning
Compliance Scanning
Admission Control
Runtime Scanning
Threat Based Controls
Zero-Trust Controls

18. ©2022 F5
18
• Admission control is validation
• In Kubernetes, an admission controller that intercepts requests to the Kubernetes API before the object is created
• Request must be authenticated, authorized, validated against policies (can be mutated)
• Example policies:
• All container images must be from allowed container registries
• All pods must have resource requests and limits
• All namespaces must have a label for a team or business unit
• Tools like NeuVector, OPA Gatekeeper, Kubewarden, Kyverno
Admission Control – Policy and Governance

19. ©2022 F5
19
Tools
Text information
Infrastructure
as Code
CI/CD GitOps
Security /
Admission
Control
Terraform Jenkins Argo NeuVector
Ansible Travis CI Flux OPA Gatekeeper
Chef GitLab CI Fleet Kubewarden
Pulumi Bamboo Kyverno
Circle CI
Source: Information example