Kubernetes is an open-source system for automating deployment, scaling, and management of containerized applications. It groups containers that make up an application into logical units for easy management and discovery called pods. Its main components include a master node that manages the cluster and worker nodes that run the applications. It uses labels to identify pods and services and selectors to group related pods. Common concepts include deployments for updating apps, services for network access, persistent volumes for storage, and roles/bindings for access control. The deployment process involves the API server, controllers, scheduler and kubelet to reconcile the desired state and place pods on nodes from images while providing discovery and load balancing.
Author: Oleg Chunikhin, www.eastbanctech.com
Kubernetes is a portable open source system for managing and orchestrating containerized cluster applications. Kubernetes solves a number of DevOps related problems out of the box in a simple and unified way – rolling updates and update rollback, canary deployment and other complicated deployment scenarios, scaling, load balancing, service discovery, logging, monitoring, persistent storage management, and much more. You will learn how in less than 30 minutes a reliable self-healing production-ready Kubernetes cluster may be deployed on AWS and used to host and operate multiple environments and applications.
History and Basics of containers, LXC, Docker and Kubernetes. This presentation is given to Engineering colleage students at VIT DevFest 2018. Beginner to Intermediate level.
Kubernetes has two simple but powerful network concepts: every Pod is connected to the same network, and Services let you talk to a Pod by name. Bryan will take you through how these concepts are implemented - Pod Networks via the Container Network Interface (CNI), Service Discovery via kube-dns and Service virtual IPs, then on to how Services are exposed to the rest of the world.
Author: Oleg Chunikhin, www.eastbanctech.com
Kubernetes is a portable open source system for managing and orchestrating containerized cluster applications. Kubernetes solves a number of DevOps related problems out of the box in a simple and unified way – rolling updates and update rollback, canary deployment and other complicated deployment scenarios, scaling, load balancing, service discovery, logging, monitoring, persistent storage management, and much more. You will learn how in less than 30 minutes a reliable self-healing production-ready Kubernetes cluster may be deployed on AWS and used to host and operate multiple environments and applications.
History and Basics of containers, LXC, Docker and Kubernetes. This presentation is given to Engineering colleage students at VIT DevFest 2018. Beginner to Intermediate level.
Kubernetes has two simple but powerful network concepts: every Pod is connected to the same network, and Services let you talk to a Pod by name. Bryan will take you through how these concepts are implemented - Pod Networks via the Container Network Interface (CNI), Service Discovery via kube-dns and Service virtual IPs, then on to how Services are exposed to the rest of the world.
Kubernetes for Beginners: An Introductory GuideBytemark
An introduction to Kubernetes for beginners. Includes the definition, architecture, benefits and misconceptions of Kubernetes. Written in plain English, ideal for both developers and non-developers who are new to Kubernetes.
Find out more about Kubernetes at Bytemark here: https://www.bytemark.co.uk/managed-kubernetes/
A basic introductory slide set on Kubernetes: What does Kubernetes do, what does Kubernetes not do, which terms are used (Containers, Pods, Services, Replica Sets, Deployments, etc...) and how basic interaction with a Kubernetes cluster is done.
A basic introduction to Kubernetes. Kubernetes is an open-source system for automating deployment, scaling, and management of containerized applications.
An in depth overview of Kubernetes and it's various components.
NOTE: This is a fixed version of a previous presentation (a draft was uploaded with some errors)
Service Discovery in kubernetes is all about how services of kubernetes get discovered internally and externally. How does a single POD communicate to another POD the within the cluster and how does a user request reach to a specific POD in the cluster? These are some questions that are answered by this TOPIC.
An overview of the Kubernetes architectureIgor Sfiligoi
This talk provides a 101 introdution to Kubernetes from a user point of view.
Aimed at service providers, it was presented at the GPN Annual Meeting 2019. https://conferences.k-state.edu/gpn/
K8s in 3h - Kubernetes Fundamentals TrainingPiotr Perzyna
Kubernetes (K8s) is an open-source system for automating deployment, scaling, and management of containerized applications. This training helps you understand key concepts within 3 hours.
If you’re working with just a few containers, managing them isn't too complicated. But what if you have hundreds or thousands? Think about having to handle multiple upgrades for each container, keeping track of container and node state, available resources, and more. That’s where Kubernetes comes in. Kubernetes is an open source container management platform that helps you run containers at scale. This talk will cover Kubernetes components and show how to run applications on it.
A brief study on Kubernetes and its componentsRamit Surana
Kubernetes is an open source orchestration system for Docker containers. It handles scheduling onto nodes in a compute cluster and actively manages workloads to ensure that their state matches the users declared intentions. Using the concepts of "labels" and "pods", it groups the containers which make up an application into logical units for easy management and discovery.
Kubernetes for Beginners: An Introductory GuideBytemark
An introduction to Kubernetes for beginners. Includes the definition, architecture, benefits and misconceptions of Kubernetes. Written in plain English, ideal for both developers and non-developers who are new to Kubernetes.
Find out more about Kubernetes at Bytemark here: https://www.bytemark.co.uk/managed-kubernetes/
A basic introductory slide set on Kubernetes: What does Kubernetes do, what does Kubernetes not do, which terms are used (Containers, Pods, Services, Replica Sets, Deployments, etc...) and how basic interaction with a Kubernetes cluster is done.
A basic introduction to Kubernetes. Kubernetes is an open-source system for automating deployment, scaling, and management of containerized applications.
An in depth overview of Kubernetes and it's various components.
NOTE: This is a fixed version of a previous presentation (a draft was uploaded with some errors)
Service Discovery in kubernetes is all about how services of kubernetes get discovered internally and externally. How does a single POD communicate to another POD the within the cluster and how does a user request reach to a specific POD in the cluster? These are some questions that are answered by this TOPIC.
An overview of the Kubernetes architectureIgor Sfiligoi
This talk provides a 101 introdution to Kubernetes from a user point of view.
Aimed at service providers, it was presented at the GPN Annual Meeting 2019. https://conferences.k-state.edu/gpn/
K8s in 3h - Kubernetes Fundamentals TrainingPiotr Perzyna
Kubernetes (K8s) is an open-source system for automating deployment, scaling, and management of containerized applications. This training helps you understand key concepts within 3 hours.
If you’re working with just a few containers, managing them isn't too complicated. But what if you have hundreds or thousands? Think about having to handle multiple upgrades for each container, keeping track of container and node state, available resources, and more. That’s where Kubernetes comes in. Kubernetes is an open source container management platform that helps you run containers at scale. This talk will cover Kubernetes components and show how to run applications on it.
A brief study on Kubernetes and its componentsRamit Surana
Kubernetes is an open source orchestration system for Docker containers. It handles scheduling onto nodes in a compute cluster and actively manages workloads to ensure that their state matches the users declared intentions. Using the concepts of "labels" and "pods", it groups the containers which make up an application into logical units for easy management and discovery.
This presentation covers how app deployment model evolved from bare metal servers to Kubernetes World.
In addition to theoretical information, you will find free KATACODA workshops url to perform practices to understand the details of the each topics.
This is the most basic presentation introducing to the concepts of kubernetes this presentation only solves the mundane purpose as a visual aid to the session
These slides were used during a technical session for the Cloud-Native El Salvador community. It covers the basic Kubernetes components, some installers and main Kubernetes resources. For the demo, it was used the capabilites provided by the Horizontal Pod Autoscaler.
Recent momentum around the evolution of Containers are gradually increase in last two years.Containers virtualize an OS and applications running in each container believe that they have full access to their very own copy of that OS. This is analogous to what VMs do when they virtualize at a lower level, the hardware. In the case of containers, it’s the OS that does the virtualization and maintains the illusion.
Recent past many software companies have quickly adopted container technologies, including Docker Containers, aware of the threat and advantage of the approach. For example, Linux companies have also jumped into the ground, seeing as this as an opportunity to grow the Linux market. Also Microsoft is going to add features to support containers and VMware have made efforts in integrating support for Docker into virtual machine technology.
Recent momentum around the evolution of Containers are gradually increase in last two years.Containers virtualize an OS and applications running in each container believe that they have full access to their very own copy of that OS. This is analogous to what VMs do when they virtualize at a lower level, the hardware. In the case of containers, it’s the OS that does the virtualization and maintains the illusion.
Recent past many software companies have quickly adopted container technologies, including Docker Containers, aware of the threat and advantage of the approach. For example, Linux companies have also jumped into the ground, seeing as this as an opportunity to grow the Linux market. Also Microsoft is going to add features to support containers and VMware have made efforts in integrating support for Docker into virtual machine technology.
In Apache Cassandra Lunch #41: Apache Cassandra Lunch #41: Cassandra on Kubernetes - Docker/Kubernetes/Helm Part 1, we discuss Cassandra on Kubernetes and give an introduction to Docker, Kubernetes, and Helm.
Accompanying Blog: https://blog.anant.us/apache-cassandra-lunch-41-cassandra-on-kubernetes-docker-kubernetes-helm-part-1/
Accompanying YouTube: https://youtu.be/-I8cKQO_Qr0
Sign Up For Our Newsletter: http://eepurl.com/grdMkn
Join Cassandra Lunch Weekly at 12 PM EST Every Wednesday: https://www.meetup.com/Cassandra-DataStax-DC/events/
Cassandra.Link:
https://cassandra.link/
Follow Us and Reach Us At:
Anant:
https://www.anant.us/
Awesome Cassandra:
https://github.com/Anant/awesome-cassandra
Cassandra.Lunch:
https://github.com/Anant/Cassandra.Lunch
Email:
solutions@anant.us
LinkedIn:
https://www.linkedin.com/company/anant/
Twitter:
https://twitter.com/anantcorp
Eventbrite:
https://www.eventbrite.com/o/anant-1072927283
Facebook:
https://www.facebook.com/AnantCorp/
Recent momentum around the evolution of Containers are gradually increase in last two years.Containers virtualize an OS and applications running in each container believe that they have full access to their very own copy of that OS. This is analogous to what VMs do when they virtualize at a lower level, the hardware. In the case of containers, it’s the OS that does the virtualization and maintains the illusion.
Kubernetes (commonly referred to as "K8s") is an open-source system for automating deployment, scaling and management of containerized applications It aims to provide a "platform for automating deployment, scaling, and operations of application containers across clusters of hosts". We will see Kubernetes architecture, use cases, basics and live demo
GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using Deplo...James Anderson
Effective Application Security in Software Delivery lifecycle using Deployment Firewall and DBOM
The modern software delivery process (or the CI/CD process) includes many tools, distributed teams, open-source code, and cloud platforms. Constant focus on speed to release software to market, along with the traditional slow and manual security checks has caused gaps in continuous security as an important piece in the software supply chain. Today organizations feel more susceptible to external and internal cyber threats due to the vast attack surface in their applications supply chain and the lack of end-to-end governance and risk management.
The software team must secure its software delivery process to avoid vulnerability and security breaches. This needs to be achieved with existing tool chains and without extensive rework of the delivery processes. This talk will present strategies and techniques for providing visibility into the true risk of the existing vulnerabilities, preventing the introduction of security issues in the software, resolving vulnerabilities in production environments quickly, and capturing the deployment bill of materials (DBOM).
Speakers:
Bob Boule
Robert Boule is a technology enthusiast with PASSION for technology and making things work along with a knack for helping others understand how things work. He comes with around 20 years of solution engineering experience in application security, software continuous delivery, and SaaS platforms. He is known for his dynamic presentations in CI/CD and application security integrated in software delivery lifecycle.
Gopinath Rebala
Gopinath Rebala is the CTO of OpsMx, where he has overall responsibility for the machine learning and data processing architectures for Secure Software Delivery. Gopi also has a strong connection with our customers, leading design and architecture for strategic implementations. Gopi is a frequent speaker and well-known leader in continuous delivery and integrating security into software delivery.
LF Energy Webinar: Electrical Grid Modelling and Simulation Through PowSyBl -...DanBrown980551
Do you want to learn how to model and simulate an electrical network from scratch in under an hour?
Then welcome to this PowSyBl workshop, hosted by Rte, the French Transmission System Operator (TSO)!
During the webinar, you will discover the PowSyBl ecosystem as well as handle and study an electrical network through an interactive Python notebook.
PowSyBl is an open source project hosted by LF Energy, which offers a comprehensive set of features for electrical grid modelling and simulation. Among other advanced features, PowSyBl provides:
- A fully editable and extendable library for grid component modelling;
- Visualization tools to display your network;
- Grid simulation tools, such as power flows, security analyses (with or without remedial actions) and sensitivity analyses;
The framework is mostly written in Java, with a Python binding so that Python developers can access PowSyBl functionalities as well.
What you will learn during the webinar:
- For beginners: discover PowSyBl's functionalities through a quick general presentation and the notebook, without needing any expert coding skills;
- For advanced developers: master the skills to efficiently apply PowSyBl functionalities to your real-world scenarios.
The Art of the Pitch: WordPress Relationships and SalesLaura Byrne
Clients don’t know what they don’t know. What web solutions are right for them? How does WordPress come into the picture? How do you make sure you understand scope and timeline? What do you do if sometime changes?
All these questions and more will be explored as we talk about matching clients’ needs with what your agency offers without pulling teeth or pulling your hair out. Practical tips, and strategies for successful relationship building that leads to closing the deal.
Builder.ai Founder Sachin Dev Duggal's Strategic Approach to Create an Innova...Ramesh Iyer
In today's fast-changing business world, Companies that adapt and embrace new ideas often need help to keep up with the competition. However, fostering a culture of innovation takes much work. It takes vision, leadership and willingness to take risks in the right proportion. Sachin Dev Duggal, co-founder of Builder.ai, has perfected the art of this balance, creating a company culture where creativity and growth are nurtured at each stage.
Generating a custom Ruby SDK for your web service or Rails API using Smithyg2nightmarescribd
Have you ever wanted a Ruby client API to communicate with your web service? Smithy is a protocol-agnostic language for defining services and SDKs. Smithy Ruby is an implementation of Smithy that generates a Ruby SDK using a Smithy model. In this talk, we will explore Smithy and Smithy Ruby to learn how to generate custom feature-rich SDKs that can communicate with any web service, such as a Rails JSON API.
JMeter webinar - integration with InfluxDB and GrafanaRTTS
Watch this recorded webinar about real-time monitoring of application performance. See how to integrate Apache JMeter, the open-source leader in performance testing, with InfluxDB, the open-source time-series database, and Grafana, the open-source analytics and visualization application.
In this webinar, we will review the benefits of leveraging InfluxDB and Grafana when executing load tests and demonstrate how these tools are used to visualize performance metrics.
Length: 30 minutes
Session Overview
-------------------------------------------
During this webinar, we will cover the following topics while demonstrating the integrations of JMeter, InfluxDB and Grafana:
- What out-of-the-box solutions are available for real-time monitoring JMeter tests?
- What are the benefits of integrating InfluxDB and Grafana into the load testing stack?
- Which features are provided by Grafana?
- Demonstration of InfluxDB and Grafana using a practice web application
To view the webinar recording, go to:
https://www.rttsweb.com/jmeter-integration-webinar
Slack (or Teams) Automation for Bonterra Impact Management (fka Social Soluti...Jeffrey Haguewood
Sidekick Solutions uses Bonterra Impact Management (fka Social Solutions Apricot) and automation solutions to integrate data for business workflows.
We believe integration and automation are essential to user experience and the promise of efficient work through technology. Automation is the critical ingredient to realizing that full vision. We develop integration products and services for Bonterra Case Management software to support the deployment of automations for a variety of use cases.
This video focuses on the notifications, alerts, and approval requests using Slack for Bonterra Impact Management. The solutions covered in this webinar can also be deployed for Microsoft Teams.
Interested in deploying notification automations for Bonterra Impact Management? Contact us at sales@sidekicksolutionsllc.com to discuss next steps.
Transcript: Selling digital books in 2024: Insights from industry leaders - T...BookNet Canada
The publishing industry has been selling digital audiobooks and ebooks for over a decade and has found its groove. What’s changed? What has stayed the same? Where do we go from here? Join a group of leading sales peers from across the industry for a conversation about the lessons learned since the popularization of digital books, best practices, digital book supply chain management, and more.
Link to video recording: https://bnctechforum.ca/sessions/selling-digital-books-in-2024-insights-from-industry-leaders/
Presented by BookNet Canada on May 28, 2024, with support from the Department of Canadian Heritage.
Dev Dives: Train smarter, not harder – active learning and UiPath LLMs for do...UiPathCommunity
💥 Speed, accuracy, and scaling – discover the superpowers of GenAI in action with UiPath Document Understanding and Communications Mining™:
See how to accelerate model training and optimize model performance with active learning
Learn about the latest enhancements to out-of-the-box document processing – with little to no training required
Get an exclusive demo of the new family of UiPath LLMs – GenAI models specialized for processing different types of documents and messages
This is a hands-on session specifically designed for automation developers and AI enthusiasts seeking to enhance their knowledge in leveraging the latest intelligent document processing capabilities offered by UiPath.
Speakers:
👨🏫 Andras Palfi, Senior Product Manager, UiPath
👩🏫 Lenka Dulovicova, Product Program Manager, UiPath
Neuro-symbolic is not enough, we need neuro-*semantic*Frank van Harmelen
Neuro-symbolic (NeSy) AI is on the rise. However, simply machine learning on just any symbolic structure is not sufficient to really harvest the gains of NeSy. These will only be gained when the symbolic structures have an actual semantics. I give an operational definition of semantics as “predictable inference”.
All of this illustrated with link prediction over knowledge graphs, but the argument is general.
4. Intro - Who am I?
Bob Killen / rkillen@umich.edu
Twitter / Github: @mrbobbytables
Senior Research Cloud Administrator @ ARC-TS
http://arc-ts.umich.edu
5. Intro - What is Kubernetes?
Kubernetes or K8s was a project spun out of Google as a open source
next-gen container scheduler designed with the lessons learned from
developing and managing Borg and Omega.
Kubernetes was designed from the ground-up as a loosely coupled collection
of components centered around deploying, maintaining, and scaling
applications.
6. Intro - What Does Kubernetes do?
Kubernetes is the linux kernel of distributed systems.
It abstracts away the underlying hardware of the nodes and provides a
uniform interface for applications to be both deployed and consume the
shared pool of resources.
8. Architecture Overview
Masters - Acts as the primary control plane for Kubernetes. Masters are
responsible at a minimum for running the API Server, scheduler, and cluster
controller. They commonly also manage storing cluster state, cloud-provider
specific components and other cluster essential services.
Nodes - Are the ‘workers’ of a Kubernetes cluster. They run a minimal agent
that manages the node itself, and are tasked with executing workloads as
designated by the master.
12. kube-apiserver
The apiserver provides a forward facing REST interface into the kubernetes
control plane and datastore. All clients, including nodes, users and other
applications interact with kubernetes strictly through the API Server.
It is the true core of Kubernetes acting as the gatekeeper to the cluster by
handling authentication and authorization, request validation, mutation, and
admission control in addition to being the front-end to the backing datastore.
13. etcd
Etcd acts as the cluster datastore; providing a strong, consistent and highly
available key-value store used for persisting cluster state.
14. kube-controller-manager
The controller-manager is the primary daemon that manages all core
component control loops. It monitors the cluster state via the apiserver and
steers the cluster towards the desired state.
List of core controllers:
https://github.com/kubernetes/kubernetes/blob/master/cmd/kube-controller-manager/app/controllermanager.go#L332
15. cloud-controller-manager
The cloud-controller-manager is a daemon that provides cloud-provider
specific knowledge and integration capability into the core control loop of
Kubernetes. The controllers include Node, Route, Service, and add an
additional controller to handle PersistentVolumeLabels .
16. kube-scheduler
Kube-scheduler is a verbose policy-rich engine that evaluates workload
requirements and attempts to place it on a matching resource. These
requirements can include such things as general hardware reqs, affinity,
anti-affinity, and other custom resource requirements.
19. kubelet
Acts as the node agent responsible for managing pod lifecycle on its host.
Kubelet understands YAML container manifests that it can read from several
sources:
● File path
● HTTP Endpoint
● Etcd watch acting on any changes
● HTTP Server mode accepting container manifests over a simple API.
20. kube-proxy
Manages the network rules on each node and performs connection
forwarding or load balancing for Kubernetes cluster services.
Available Proxy Modes:
● Userspace
● iptables
● ipvs (alpha in 1.8)
21. Container Runtime
With respect to Kubernetes, A container runtime is a CRI (Container Runtime Interface)
compatible application that executes and manages containers.
● Containerd (docker)
● Cri-o
● Rkt
● Kata (formerly clear and hyper)
● Virtlet (VM CRI compatible runtime)
22. Additional Services
Kube-dns - Provides cluster wide DNS Services. Services are resolvable to
<service>.<namespace>.svc.cluster.local.
Heapster - Metrics Collector for kubernetes cluster, used by some resources
such as the Horizontal Pod Autoscaler. (required for kubedashboard metrics)
Kube-dashboard - A general purpose web based UI for kubernetes.
24. Networking - Fundamental Rules
1) All Pods can communicate with all other Pods without NAT
2) All nodes can communicate with all Pods (and vice-versa) without NAT.
3) The IP that a Pod sees itself as is the same IP that others see it as.
25. Networking - Fundamentals Applied
Containers in a pod exist within the same network namespace and share an
IP; allowing for intrapod communication over localhost.
Pods are given a cluster unique IP for the duration of its lifecycle, but the pods
themselves are fundamentally ephemeral.
Services are given a persistent cluster unique IP that spans the Pods lifecycle.
External Connectivity is generally handed by an integrated cloud provider or
other external entity (load balancer)
26. Networking - CNI
Networking within Kubernetes is plumbed via the Container Network
Interface (CNI), an interface between a container runtime and a network
implementation plugin.
Compatible CNI Network Plugins:
● Calico
● Cillium
● Contiv
● Contrail
● Flannel
● GCE
● kube-router
● Multus
● OpenVSwitch
● OVN
● Romana
● Weave
28. Kubernetes Concepts - Core
Cluster - A collection of hosts that aggregate their available resources including cpu, ram, disk,
and their devices into a usable pool.
Master - The master(s) represent a collection of components that make up the control plane of
Kubernetes. These components are responsible for all cluster decisions including both
scheduling and responding to cluster events.
Node - A single host, physical or virtual capable of running pods. A node is managed by the
master(s), and at a minimum runs both kubelet and kube-proxy to be considered part of the
cluster.
Namespace - A logical cluster or environment. Primary method of dividing a cluster or
scoping access.
29. Concepts - Core (cont.)
Label - Key-value pairs that are used to identify, describe and group together related sets of
objects. Labels have a strict syntax and available character set. *
Annotation - Key-value pairs that contain non-identifying information or metadata.
Annotations do not have the the syntax limitations as labels and can contain structured or
unstructured data.
Selector - Selectors use labels to filter or select objects. Both equality-based (=, ==, !=) or
simple key-value matching selectors are supported.
* https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#syntax-and-character-set
32. Concepts - Workloads
Pod - A pod is the smallest unit of work or management resource within Kubernetes. It is
comprised of one or more containers that share their storage, network, and context
(namespace, cgroups etc).
ReplicationController - Method of managing pod replicas and their lifecycle. Their
scheduling, scaling, and deletion.
ReplicaSet - Next Generation ReplicationController. Supports set-based selectors.
Deployment - A declarative method of managing stateless Pods and ReplicaSets. Provides
rollback functionality in addition to more granular update control mechanisms.
33. Deployment
ReplicaSet
Contains configuration
of how updates or
‘deployments’ should be
managed in addition to
the pod template used to
generate the ReplicaSet.
Generated ReplicaSet
from Deployment spec.
34. Concepts - Workloads (cont.)
StatefulSet - A controller tailored to managing Pods that must persist or maintain state. Pod
identity including hostname, network, and storage will be persisted.
DaemonSet - Ensures that all nodes matching certain criteria will run an instance of a
supplied Pod. Ideal for cluster wide services such as log forwarding, or health monitoring.
35. StatefulSet
● Attaches to ‘headeless service’ (not shown) nginx.
● Pods given unique ordinal names using the pattern
<statefulset name>-<ordinal index>.
● Creates independent persistent volumes based on
the ‘volumeClaimTemplates’.
36. DaemonSet
● Bypasses default scheduler
● Schedules a single instance on every host while
adhering to tolerances and taints.
37. Concepts - Workloads (cont.)
Job - The job controller ensures one or more pods are executed and successfully terminates. It
will do this until it satisfies the completion and/or parallelism condition.
CronJob - An extension of the Job Controller, it provides a method of executing jobs on a
cron-like schedule.
38. Jobs
● Number of pod executions can be controlled
via spec.completions
● Jobs can be parallelized using spec.parallelism
● Jobs and Pods are NOT automatically
cleaned up after a job has completed.
40. Concepts - Network
Service - Services provide a method of exposing and consuming L4 Pod network accessible
resources. They use label selectors to map groups of pods and ports to a cluster-unique virtual
IP.
Ingress - An ingress controller is the primary method of exposing a cluster service (usually
http) to the outside world. These are load balancers or routers that usually offer SSL
termination, name-based virtual hosting etc.
41. Service
● Acts as the unified method of accessing replicated pods.
● Four major Service Types:
○ CluterIP - Exposes service on a strictly cluster-internal IP (default)
○ NodePort - Service is exposed on each node’s IP on a statically
defined port.
○ LoadBalancer - Works in combination with a cloud provider to
expose a service outside the cluster on a static external IP.
○ ExternalName - used to references endpoints OUTSIDE the cluster
by providing a static internally referenced DNS name.
42. Ingress Controller
● Deployed as a pod to one or more hosts
● Ingress controllers are an external
controller with multiple options.
○ Nginx
○ HAproxy
○ Contour
○ Traefik
● Specific features and controller specific
configuration is passed through
annotations.
43. Concepts - Storage
Volume - Storage that is tied to the Pod Lifecycle, consumable by one or more
containers within the pod.
PersistentVolume - A PersistentVolume (PV) represents a storage resource. PVs are
commonly linked to a backing storage resource, NFS, GCEPersistentDisk, RBD etc. and are
provisioned ahead of time. Their lifecycle is handled independently from a pod.
PersistentVolumeClaim - A PersistentVolumeClaim (PVC) is a request for storage that
satisfies a set of requirements instead of mapping to a storage resource directly. Commonly
used with dynamically provisioned storage.
StorageClass - Storage classes are an abstraction on top of an external storage resource.
These will include a provisioner, provisioner configuration parameters as well as a PV
reclaimPolicy.
45. Persistent Volumes
● PVs are a cluster-wide resource
● Not directly consumable by a Pod
● PV Parameters:
○ Capacity
○ accessModes
■ ReadOnlyMany (ROX)
■ ReadWriteOnce (RWO)
■ ReadWriteMany (RWX)
○ persistentVolumeReclaimPolicy
■ Retain
■ Recycle
■ Delete
○ StorageClass
46. Persistent Volume Claims
● PVCs are scoped to namespaces
● Supports accessModes like PVs
● Uses resource request model similar to Pods
● Claims will consume storage from matching PVs
or StorageClasses based on storageClass and
selectors.
47. Storage Classes
● Uses an external system defined by the
provisioner to dynamically consume and
allocate storage.
● Storage Class Fields
○ Provisioner
○ Parameters
○ reclaimPolicy
48. Concepts - Configuration
ConfigMap - Externalized data stored within kubernetes that can be referenced as a
commandline argument, environment variable, or injected as a file into a volume mount. Ideal
for separating containerized application from configuration.
Secret - Functionally identical to ConfigMaps, but stored encoded as base64, and encrypted at
rest (if configured).
49. ConfigMaps and Secrets
● Can be used in Pod Config:
○ Injected as a file
○ Passed as an environment variable
○ Used as a container command (requires passing as env var)
50. Concepts - Auth and Identity (RBAC)
[Cluster]Role - Roles contain rules that act as a set of permissions that apply verbs like “get”,
“list”, “watch” etc over resources that are scoped to apiGroups. Roles are scoped to namespaces,
and ClusterRoles are applied cluster-wide.
[Cluster]RoleBinding - Grant the permissions as defined in a [Cluster]Role to one or more
“subjects” which can be a user, group, or service account.
ServiceAccount- ServiceAccounts provide a consumable identity for pods or external
services that interact with the cluster directly and are scoped to namespaces.
51. [Cluster]Role
● Permissions translate to url
path. With “” defaulting to core
group.
● Resources act as items the role
should be granted access to.
● Verbs are the actions the role
can perform on the referenced
resources.
52. [Cluster]RoleBinding
● Can reference multiple subjects
● Subjects can be of kind:
○ User
○ Group
○ ServiceAccount
● roleRef targets a single role only.
57. Kubectl
1) Kubectl performs client side
validation on manifest (linting).
2) Manifest is prepared and serialized
creating a JSON payload.
58. APIserver Request Loop
3) Kubectl authenticates to apiserver via x509, jwt,
http auth proxy, other plugins, or http-basic auth.
4) Authorization iterates over available AuthZ
sources: Node, ABAC, RBAC, or webhook.
5) AdmissionControl checks resource quotas,
other security related checks etc.
6) Request is stored in etcd.
7) Initializers are given opportunity to mutate request before the object is published.
8) Request is published on apiserver.
59. Deployment Controller
9) Deployment Controller is notified of the new
Deployment via callback.
10) Deployment Controller evaluates cluster state and
reconciles the desired vs current state and forms a
request for the new ReplicaSet.
11) apiserver request loop evaluates Deployment
Controller request.
12) ReplicaSet is published.
60. ReplicaSet Controller
13) ReplicaSet Controller is notified of the new ReplicaSet
via callback.
14) ReplicaSet Controller evaluates cluster state and
reconciles the desired vs current state and forms a request
for the desired amount of pods.
15) apiserver request loop evaluates ReplicaSet
Controller request.
16) Pods published, and enter ‘Pending’ phase.
61.
62. Scheduler
17) Scheduler monitors published pods with no
‘NodeName’ assigned.
18) Applies scheduling rules and filters to find a
suitable node to host the Pod.
19) Scheduler creates a binding of Pod to Node and
POSTs to apiserver.
20) apiserver request loop evaluates POST request.
21) Pod status is updated with node binding and sets
status to ‘PodScheduled’.
63. Kubelet - PodSync
22) The kubelet daemon on every node polls the apiserver filtering
for pods matching its own ‘NodeName’; checking its current state
with the desired state published through the apiserver.
23) Kubelet will then move through a series of internal processes to
prepare the pod environment. This includes pulling secrets,
provisioning storage, applying AppArmor profiles and other various
scaffolding. During this period, it will asynchronously be POST’ing
the ‘PodStatus’ to the apiserver through the standard apiserver
request loop.
64. Pause and Plumbing
24) Kubelet then provisions a ‘pause’ container via the
CRI (Container Runtime Interface). The pause container
acts as the parent container for the Pod.
25) The network is plumbed to the Pod via the CNI
(Container Network Interface), creating a veth pair
attached to the pause container and to a container
bridge (cbr0).
26) IPAM handled by the CNI plugin assigns an IP to the
pause container.
65. Kublet - Create Containers
24) Kubelet pulls the container Images.
25) Kubelet first creates and starts any init containers.
26) Once the optional init containers complete, the
primary pod containers are started.
66. Pod Status
27) If there are any liveless/readiness probes, these are executed before the
PodStatus is updated.
28) If all complete successfully, PodStatus is set to ready and the container
has started successfully.
The Pod is Deployed!