SlideShare a Scribd company logo
Kubernetes
A Comprehensive Overview
Kubernetes v1.8
Agenda
● Introduction
○ Who am I?
○ What is Kubernetes?
○ What does Kubernetes do?
● Architecture
○ Master Components
○ Node Components
○ Additional Services
○ Networking
● Concepts
○ Core
○ Workloads
○ Network
○ Storage
○ Configuration
○ Auth and Identity
● Behind the Scenes
○ Deployment from Beginning to End
Introduction
Intro - Who am I?
Bob Killen / rkillen@umich.edu
Twitter / Github: @mrbobbytables
Senior Research Cloud Administrator @ ARC-TS
http://arc-ts.umich.edu
Intro - What is Kubernetes?
Kubernetes or K8s was a project spun out of Google as a open source
next-gen container scheduler designed with the lessons learned from
developing and managing Borg and Omega.
Kubernetes was designed from the ground-up as a loosely coupled collection
of components centered around deploying, maintaining, and scaling
applications.
Intro - What Does Kubernetes do?
Kubernetes is the linux kernel of distributed systems.
It abstracts away the underlying hardware of the nodes and provides a
uniform interface for applications to be both deployed and consume the
shared pool of resources.
Kubernetes
Architecture
Architecture Overview
Masters - Acts as the primary control plane for Kubernetes. Masters are
responsible at a minimum for running the API Server, scheduler, and cluster
controller. They commonly also manage storing cluster state, cloud-provider
specific components and other cluster essential services.
Nodes - Are the ‘workers’ of a Kubernetes cluster. They run a minimal agent
that manages the node itself, and are tasked with executing workloads as
designated by the master.
Architecture
Overview
Master
Components
Master Components
● Kube-apiserver
● Etcd
● Kube-controller-manager
● Cloud-controller-manager
● Kube-scheduler
kube-apiserver
The apiserver provides a forward facing REST interface into the kubernetes
control plane and datastore. All clients, including nodes, users and other
applications interact with kubernetes strictly through the API Server.
It is the true core of Kubernetes acting as the gatekeeper to the cluster by
handling authentication and authorization, request validation, mutation, and
admission control in addition to being the front-end to the backing datastore.
etcd
Etcd acts as the cluster datastore; providing a strong, consistent and highly
available key-value store used for persisting cluster state.
kube-controller-manager
The controller-manager is the primary daemon that manages all core
component control loops. It monitors the cluster state via the apiserver and
steers the cluster towards the desired state.
List of core controllers:
https://github.com/kubernetes/kubernetes/blob/master/cmd/kube-controller-manager/app/controllermanager.go#L332
cloud-controller-manager
The cloud-controller-manager is a daemon that provides cloud-provider
specific knowledge and integration capability into the core control loop of
Kubernetes. The controllers include Node, Route, Service, and add an
additional controller to handle PersistentVolumeLabels .
kube-scheduler
Kube-scheduler is a verbose policy-rich engine that evaluates workload
requirements and attempts to place it on a matching resource. These
requirements can include such things as general hardware reqs, affinity,
anti-affinity, and other custom resource requirements.
Node
Components
Node Components
● Kubelet
● Kube-proxy
● Container runtime engine
kubelet
Acts as the node agent responsible for managing pod lifecycle on its host.
Kubelet understands YAML container manifests that it can read from several
sources:
● File path
● HTTP Endpoint
● Etcd watch acting on any changes
● HTTP Server mode accepting container manifests over a simple API.
kube-proxy
Manages the network rules on each node and performs connection
forwarding or load balancing for Kubernetes cluster services.
Available Proxy Modes:
● Userspace
● iptables
● ipvs (alpha in 1.8)
Container Runtime
With respect to Kubernetes, A container runtime is a CRI (Container Runtime Interface)
compatible application that executes and manages containers.
● Containerd (docker)
● Cri-o
● Rkt
● Kata (formerly clear and hyper)
● Virtlet (VM CRI compatible runtime)
Additional Services
Kube-dns - Provides cluster wide DNS Services. Services are resolvable to
<service>.<namespace>.svc.cluster.local.
Heapster - Metrics Collector for kubernetes cluster, used by some resources
such as the Horizontal Pod Autoscaler. (required for kubedashboard metrics)
Kube-dashboard - A general purpose web based UI for kubernetes.
Networking
Networking - Fundamental Rules
1) All Pods can communicate with all other Pods without NAT
2) All nodes can communicate with all Pods (and vice-versa) without NAT.
3) The IP that a Pod sees itself as is the same IP that others see it as.
Networking - Fundamentals Applied
Containers in a pod exist within the same network namespace and share an
IP; allowing for intrapod communication over localhost.
Pods are given a cluster unique IP for the duration of its lifecycle, but the pods
themselves are fundamentally ephemeral.
Services are given a persistent cluster unique IP that spans the Pods lifecycle.
External Connectivity is generally handed by an integrated cloud provider or
other external entity (load balancer)
Networking - CNI
Networking within Kubernetes is plumbed via the Container Network
Interface (CNI), an interface between a container runtime and a network
implementation plugin.
Compatible CNI Network Plugins:
● Calico
● Cillium
● Contiv
● Contrail
● Flannel
● GCE
● kube-router
● Multus
● OpenVSwitch
● OVN
● Romana
● Weave
Kubernetes
Concepts
Kubernetes Concepts - Core
Cluster - A collection of hosts that aggregate their available resources including cpu, ram, disk,
and their devices into a usable pool.
Master - The master(s) represent a collection of components that make up the control plane of
Kubernetes. These components are responsible for all cluster decisions including both
scheduling and responding to cluster events.
Node - A single host, physical or virtual capable of running pods. A node is managed by the
master(s), and at a minimum runs both kubelet and kube-proxy to be considered part of the
cluster.
Namespace - A logical cluster or environment. Primary method of dividing a cluster or
scoping access.
Concepts - Core (cont.)
Label - Key-value pairs that are used to identify, describe and group together related sets of
objects. Labels have a strict syntax and available character set. *
Annotation - Key-value pairs that contain non-identifying information or metadata.
Annotations do not have the the syntax limitations as labels and can contain structured or
unstructured data.
Selector - Selectors use labels to filter or select objects. Both equality-based (=, ==, !=) or
simple key-value matching selectors are supported.
* https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#syntax-and-character-set
Labels:
app: nginx
tier: frontned
Annotations
description: “nginx frontend”
Selector:
app: nginx
tier: frontend
Labels, and Annotations,
and Selectors
Set-based selectors
Valid Operators:
● In
● NotIn
● Exists
● DoesNotExist
Supported Objects with set-based selectors:
● Job
● Deployment
● ReplicaSet
● DaemonSet
● PersistentVolumeClaims
Concepts - Workloads
Pod - A pod is the smallest unit of work or management resource within Kubernetes. It is
comprised of one or more containers that share their storage, network, and context
(namespace, cgroups etc).
ReplicationController - Method of managing pod replicas and their lifecycle. Their
scheduling, scaling, and deletion.
ReplicaSet - Next Generation ReplicationController. Supports set-based selectors.
Deployment - A declarative method of managing stateless Pods and ReplicaSets. Provides
rollback functionality in addition to more granular update control mechanisms.
Deployment
ReplicaSet
Contains configuration
of how updates or
‘deployments’ should be
managed in addition to
the pod template used to
generate the ReplicaSet.
Generated ReplicaSet
from Deployment spec.
Concepts - Workloads (cont.)
StatefulSet - A controller tailored to managing Pods that must persist or maintain state. Pod
identity including hostname, network, and storage will be persisted.
DaemonSet - Ensures that all nodes matching certain criteria will run an instance of a
supplied Pod. Ideal for cluster wide services such as log forwarding, or health monitoring.
StatefulSet
● Attaches to ‘headeless service’ (not shown) nginx.
● Pods given unique ordinal names using the pattern
<statefulset name>-<ordinal index>.
● Creates independent persistent volumes based on
the ‘volumeClaimTemplates’.
DaemonSet
● Bypasses default scheduler
● Schedules a single instance on every host while
adhering to tolerances and taints.
Concepts - Workloads (cont.)
Job - The job controller ensures one or more pods are executed and successfully terminates. It
will do this until it satisfies the completion and/or parallelism condition.
CronJob - An extension of the Job Controller, it provides a method of executing jobs on a
cron-like schedule.
Jobs
● Number of pod executions can be controlled
via spec.completions
● Jobs can be parallelized using spec.parallelism
● Jobs and Pods are NOT automatically
cleaned up after a job has completed.
CronJob
● Adds cron schedule to job template
Concepts - Network
Service - Services provide a method of exposing and consuming L4 Pod network accessible
resources. They use label selectors to map groups of pods and ports to a cluster-unique virtual
IP.
Ingress - An ingress controller is the primary method of exposing a cluster service (usually
http) to the outside world. These are load balancers or routers that usually offer SSL
termination, name-based virtual hosting etc.
Service
● Acts as the unified method of accessing replicated pods.
● Four major Service Types:
○ CluterIP - Exposes service on a strictly cluster-internal IP (default)
○ NodePort - Service is exposed on each node’s IP on a statically
defined port.
○ LoadBalancer - Works in combination with a cloud provider to
expose a service outside the cluster on a static external IP.
○ ExternalName - used to references endpoints OUTSIDE the cluster
by providing a static internally referenced DNS name.
Ingress Controller
● Deployed as a pod to one or more hosts
● Ingress controllers are an external
controller with multiple options.
○ Nginx
○ HAproxy
○ Contour
○ Traefik
● Specific features and controller specific
configuration is passed through
annotations.
Concepts - Storage
Volume - Storage that is tied to the Pod Lifecycle, consumable by one or more
containers within the pod.
PersistentVolume - A PersistentVolume (PV) represents a storage resource. PVs are
commonly linked to a backing storage resource, NFS, GCEPersistentDisk, RBD etc. and are
provisioned ahead of time. Their lifecycle is handled independently from a pod.
PersistentVolumeClaim - A PersistentVolumeClaim (PVC) is a request for storage that
satisfies a set of requirements instead of mapping to a storage resource directly. Commonly
used with dynamically provisioned storage.
StorageClass - Storage classes are an abstraction on top of an external storage resource.
These will include a provisioner, provisioner configuration parameters as well as a PV
reclaimPolicy.
Volumes
Persistent Volumes
● PVs are a cluster-wide resource
● Not directly consumable by a Pod
● PV Parameters:
○ Capacity
○ accessModes
■ ReadOnlyMany (ROX)
■ ReadWriteOnce (RWO)
■ ReadWriteMany (RWX)
○ persistentVolumeReclaimPolicy
■ Retain
■ Recycle
■ Delete
○ StorageClass
Persistent Volume Claims
● PVCs are scoped to namespaces
● Supports accessModes like PVs
● Uses resource request model similar to Pods
● Claims will consume storage from matching PVs
or StorageClasses based on storageClass and
selectors.
Storage Classes
● Uses an external system defined by the
provisioner to dynamically consume and
allocate storage.
● Storage Class Fields
○ Provisioner
○ Parameters
○ reclaimPolicy
Concepts - Configuration
ConfigMap - Externalized data stored within kubernetes that can be referenced as a
commandline argument, environment variable, or injected as a file into a volume mount. Ideal
for separating containerized application from configuration.
Secret - Functionally identical to ConfigMaps, but stored encoded as base64, and encrypted at
rest (if configured).
ConfigMaps and Secrets
● Can be used in Pod Config:
○ Injected as a file
○ Passed as an environment variable
○ Used as a container command (requires passing as env var)
Concepts - Auth and Identity (RBAC)
[Cluster]Role - Roles contain rules that act as a set of permissions that apply verbs like “get”,
“list”, “watch” etc over resources that are scoped to apiGroups. Roles are scoped to namespaces,
and ClusterRoles are applied cluster-wide.
[Cluster]RoleBinding - Grant the permissions as defined in a [Cluster]Role to one or more
“subjects” which can be a user, group, or service account.
ServiceAccount- ServiceAccounts provide a consumable identity for pods or external
services that interact with the cluster directly and are scoped to namespaces.
[Cluster]Role
● Permissions translate to url
path. With “” defaulting to core
group.
● Resources act as items the role
should be granted access to.
● Verbs are the actions the role
can perform on the referenced
resources.
[Cluster]RoleBinding
● Can reference multiple subjects
● Subjects can be of kind:
○ User
○ Group
○ ServiceAccount
● roleRef targets a single role only.
Behind
The Scenes
Behind
The Scenes
Deployment From
Beginning to End
Kubernetes - A Comprehensive Overview
Kubectl
1) Kubectl performs client side
validation on manifest (linting).
2) Manifest is prepared and serialized
creating a JSON payload.
APIserver Request Loop
3) Kubectl authenticates to apiserver via x509, jwt,
http auth proxy, other plugins, or http-basic auth.
4) Authorization iterates over available AuthZ
sources: Node, ABAC, RBAC, or webhook.
5) AdmissionControl checks resource quotas,
other security related checks etc.
6) Request is stored in etcd.
7) Initializers are given opportunity to mutate request before the object is published.
8) Request is published on apiserver.
Deployment Controller
9) Deployment Controller is notified of the new
Deployment via callback.
10) Deployment Controller evaluates cluster state and
reconciles the desired vs current state and forms a
request for the new ReplicaSet.
11) apiserver request loop evaluates Deployment
Controller request.
12) ReplicaSet is published.
ReplicaSet Controller
13) ReplicaSet Controller is notified of the new ReplicaSet
via callback.
14) ReplicaSet Controller evaluates cluster state and
reconciles the desired vs current state and forms a request
for the desired amount of pods.
15) apiserver request loop evaluates ReplicaSet
Controller request.
16) Pods published, and enter ‘Pending’ phase.
Kubernetes - A Comprehensive Overview
Scheduler
17) Scheduler monitors published pods with no
‘NodeName’ assigned.
18) Applies scheduling rules and filters to find a
suitable node to host the Pod.
19) Scheduler creates a binding of Pod to Node and
POSTs to apiserver.
20) apiserver request loop evaluates POST request.
21) Pod status is updated with node binding and sets
status to ‘PodScheduled’.
Kubelet - PodSync
22) The kubelet daemon on every node polls the apiserver filtering
for pods matching its own ‘NodeName’; checking its current state
with the desired state published through the apiserver.
23) Kubelet will then move through a series of internal processes to
prepare the pod environment. This includes pulling secrets,
provisioning storage, applying AppArmor profiles and other various
scaffolding. During this period, it will asynchronously be POST’ing
the ‘PodStatus’ to the apiserver through the standard apiserver
request loop.
Pause and Plumbing
24) Kubelet then provisions a ‘pause’ container via the
CRI (Container Runtime Interface). The pause container
acts as the parent container for the Pod.
25) The network is plumbed to the Pod via the CNI
(Container Network Interface), creating a veth pair
attached to the pause container and to a container
bridge (cbr0).
26) IPAM handled by the CNI plugin assigns an IP to the
pause container.
Kublet - Create Containers
24) Kubelet pulls the container Images.
25) Kubelet first creates and starts any init containers.
26) Once the optional init containers complete, the
primary pod containers are started.
Pod Status
27) If there are any liveless/readiness probes, these are executed before the
PodStatus is updated.
28) If all complete successfully, PodStatus is set to ready and the container
has started successfully.
The Pod is Deployed!
Questions?

More Related Content

What's hot

Introduction to Kubernetes Workshop
Introduction to Kubernetes WorkshopIntroduction to Kubernetes Workshop
Introduction to Kubernetes Workshop
Bob Killen
 
Kubernetes
KubernetesKubernetes
Kubernetes
erialc_w
 
Kubernetes - introduction
Kubernetes - introductionKubernetes - introduction
Kubernetes - introduction
Sparkbit
 
Introduction to helm
Introduction to helmIntroduction to helm
Introduction to helm
Jeeva Chelladhurai
 
Kubernetes Basics
Kubernetes BasicsKubernetes Basics
Kubernetes Basics
Eueung Mulyana
 
Hands-On Introduction to Kubernetes at LISA17
Hands-On Introduction to Kubernetes at LISA17Hands-On Introduction to Kubernetes at LISA17
Hands-On Introduction to Kubernetes at LISA17
Ryan Jarvinen
 
Docker and Kubernetes 101 workshop
Docker and Kubernetes 101 workshopDocker and Kubernetes 101 workshop
Docker and Kubernetes 101 workshop
Sathish VJ
 
Kubernetes Architecture | Understanding Kubernetes Components | Kubernetes Tu...
Kubernetes Architecture | Understanding Kubernetes Components | Kubernetes Tu...Kubernetes Architecture | Understanding Kubernetes Components | Kubernetes Tu...
Kubernetes Architecture | Understanding Kubernetes Components | Kubernetes Tu...
Edureka!
 
Helm 3
Helm 3Helm 3
Getting Started with Kubernetes
Getting Started with Kubernetes Getting Started with Kubernetes
Getting Started with Kubernetes
VMware Tanzu
 
Evolution of containers to kubernetes
Evolution of containers to kubernetesEvolution of containers to kubernetes
Evolution of containers to kubernetes
Krishna-Kumar
 
An overview of the Kubernetes architecture
An overview of the Kubernetes architectureAn overview of the Kubernetes architecture
An overview of the Kubernetes architecture
Igor Sfiligoi
 
Kubernetes Concepts And Architecture Powerpoint Presentation Slides
Kubernetes Concepts And Architecture Powerpoint Presentation SlidesKubernetes Concepts And Architecture Powerpoint Presentation Slides
Kubernetes Concepts And Architecture Powerpoint Presentation Slides
SlideTeam
 
Kubernetes Introduction
Kubernetes IntroductionKubernetes Introduction
Kubernetes Introduction
Martin Danielsson
 
Kubernetes for Beginners: An Introductory Guide
Kubernetes for Beginners: An Introductory GuideKubernetes for Beginners: An Introductory Guide
Kubernetes for Beginners: An Introductory Guide
Bytemark
 
Gitlab, GitOps & ArgoCD
Gitlab, GitOps & ArgoCDGitlab, GitOps & ArgoCD
Gitlab, GitOps & ArgoCD
Haggai Philip Zagury
 
Kubernetes Basics
Kubernetes BasicsKubernetes Basics
Kubernetes Basics
Rishabh Kumar
 
Helm - Application deployment management for Kubernetes
Helm - Application deployment management for KubernetesHelm - Application deployment management for Kubernetes
Helm - Application deployment management for Kubernetes
Alexei Ledenev
 
Getting started with kubernetes
Getting started with kubernetesGetting started with kubernetes
Getting started with kubernetes
Janakiram MSV
 
Introduction to Helm
Introduction to HelmIntroduction to Helm
Introduction to Helm
Harshal Shah
 

What's hot (20)

Introduction to Kubernetes Workshop
Introduction to Kubernetes WorkshopIntroduction to Kubernetes Workshop
Introduction to Kubernetes Workshop
 
Kubernetes
KubernetesKubernetes
Kubernetes
 
Kubernetes - introduction
Kubernetes - introductionKubernetes - introduction
Kubernetes - introduction
 
Introduction to helm
Introduction to helmIntroduction to helm
Introduction to helm
 
Kubernetes Basics
Kubernetes BasicsKubernetes Basics
Kubernetes Basics
 
Hands-On Introduction to Kubernetes at LISA17
Hands-On Introduction to Kubernetes at LISA17Hands-On Introduction to Kubernetes at LISA17
Hands-On Introduction to Kubernetes at LISA17
 
Docker and Kubernetes 101 workshop
Docker and Kubernetes 101 workshopDocker and Kubernetes 101 workshop
Docker and Kubernetes 101 workshop
 
Kubernetes Architecture | Understanding Kubernetes Components | Kubernetes Tu...
Kubernetes Architecture | Understanding Kubernetes Components | Kubernetes Tu...Kubernetes Architecture | Understanding Kubernetes Components | Kubernetes Tu...
Kubernetes Architecture | Understanding Kubernetes Components | Kubernetes Tu...
 
Helm 3
Helm 3Helm 3
Helm 3
 
Getting Started with Kubernetes
Getting Started with Kubernetes Getting Started with Kubernetes
Getting Started with Kubernetes
 
Evolution of containers to kubernetes
Evolution of containers to kubernetesEvolution of containers to kubernetes
Evolution of containers to kubernetes
 
An overview of the Kubernetes architecture
An overview of the Kubernetes architectureAn overview of the Kubernetes architecture
An overview of the Kubernetes architecture
 
Kubernetes Concepts And Architecture Powerpoint Presentation Slides
Kubernetes Concepts And Architecture Powerpoint Presentation SlidesKubernetes Concepts And Architecture Powerpoint Presentation Slides
Kubernetes Concepts And Architecture Powerpoint Presentation Slides
 
Kubernetes Introduction
Kubernetes IntroductionKubernetes Introduction
Kubernetes Introduction
 
Kubernetes for Beginners: An Introductory Guide
Kubernetes for Beginners: An Introductory GuideKubernetes for Beginners: An Introductory Guide
Kubernetes for Beginners: An Introductory Guide
 
Gitlab, GitOps & ArgoCD
Gitlab, GitOps & ArgoCDGitlab, GitOps & ArgoCD
Gitlab, GitOps & ArgoCD
 
Kubernetes Basics
Kubernetes BasicsKubernetes Basics
Kubernetes Basics
 
Helm - Application deployment management for Kubernetes
Helm - Application deployment management for KubernetesHelm - Application deployment management for Kubernetes
Helm - Application deployment management for Kubernetes
 
Getting started with kubernetes
Getting started with kubernetesGetting started with kubernetes
Getting started with kubernetes
 
Introduction to Helm
Introduction to HelmIntroduction to Helm
Introduction to Helm
 

Similar to Kubernetes - A Comprehensive Overview

Kubernetes PPT.pptx
Kubernetes PPT.pptxKubernetes PPT.pptx
Kubernetes PPT.pptx
ssuser0cc9131
 
08 - kubernetes.pptx
08 - kubernetes.pptx08 - kubernetes.pptx
08 - kubernetes.pptx
RanjithM61
 
Kubernetes presentation
Kubernetes presentationKubernetes presentation
Kubernetes presentation
GauranG Bajpai
 
Container Orchestration using kubernetes
Container Orchestration using kubernetesContainer Orchestration using kubernetes
Container Orchestration using kubernetes
Puneet Kumar Bhatia (MBA, ITIL V3 Certified)
 
Intro to Kubernetes
Intro to KubernetesIntro to Kubernetes
Intro to Kubernetes
Joonathan Mägi
 
Kubernetes From Scratch .pdf
Kubernetes From Scratch .pdfKubernetes From Scratch .pdf
Kubernetes From Scratch .pdf
ssuser9b44c7
 
Introduction+to+Kubernetes-Details-D.pptx
Introduction+to+Kubernetes-Details-D.pptxIntroduction+to+Kubernetes-Details-D.pptx
Introduction+to+Kubernetes-Details-D.pptx
SantoshPandey160
 
Kubernetes-introduction to kubernetes for beginers.pptx
Kubernetes-introduction to kubernetes for beginers.pptxKubernetes-introduction to kubernetes for beginers.pptx
Kubernetes-introduction to kubernetes for beginers.pptx
rathnavel194
 
Kubernetes Architecture with Components
 Kubernetes Architecture with Components Kubernetes Architecture with Components
Kubernetes Architecture with Components
Ajeet Singh
 
Kubernetes #1 intro
Kubernetes #1   introKubernetes #1   intro
Kubernetes #1 intro
Terry Cho
 
DevJam 2019 - Introduction to Kubernetes
DevJam 2019 - Introduction to KubernetesDevJam 2019 - Introduction to Kubernetes
DevJam 2019 - Introduction to Kubernetes
Ronny Trommer
 
Kubernetes
KubernetesKubernetes
Kubernetes
Mihir Shah
 
Introduction to kubernetes
Introduction to kubernetesIntroduction to kubernetes
Introduction to kubernetes
Rishabh Indoria
 
Docker Online Training | Kubernetes Training in Ameerpet
Docker Online Training | Kubernetes Training in AmeerpetDocker Online Training | Kubernetes Training in Ameerpet
Docker Online Training | Kubernetes Training in Ameerpet
navyatejavisualpath
 
A brief study on Kubernetes and its components
A brief study on Kubernetes and its componentsA brief study on Kubernetes and its components
A brief study on Kubernetes and its components
Ramit Surana
 
Containers kuberenetes
Containers kuberenetesContainers kuberenetes
Containers kuberenetes
Gayan Gunarathne
 
Containers kuberenetes
Containers kuberenetesContainers kuberenetes
Containers kuberenetes
Gayan Gunarathne
 
Kubernetes fundamentals
Kubernetes fundamentalsKubernetes fundamentals
Kubernetes fundamentals
Victor Morales
 
Containers kuberenetes
Containers kuberenetesContainers kuberenetes
Containers kuberenetes
csegayan
 
Apache Cassandra Lunch #41: Cassandra on Kubernetes - Docker/Kubernetes/Helm ...
Apache Cassandra Lunch #41: Cassandra on Kubernetes - Docker/Kubernetes/Helm ...Apache Cassandra Lunch #41: Cassandra on Kubernetes - Docker/Kubernetes/Helm ...
Apache Cassandra Lunch #41: Cassandra on Kubernetes - Docker/Kubernetes/Helm ...
Anant Corporation
 

Similar to Kubernetes - A Comprehensive Overview (20)

Kubernetes PPT.pptx
Kubernetes PPT.pptxKubernetes PPT.pptx
Kubernetes PPT.pptx
 
08 - kubernetes.pptx
08 - kubernetes.pptx08 - kubernetes.pptx
08 - kubernetes.pptx
 
Kubernetes presentation
Kubernetes presentationKubernetes presentation
Kubernetes presentation
 
Container Orchestration using kubernetes
Container Orchestration using kubernetesContainer Orchestration using kubernetes
Container Orchestration using kubernetes
 
Intro to Kubernetes
Intro to KubernetesIntro to Kubernetes
Intro to Kubernetes
 
Kubernetes From Scratch .pdf
Kubernetes From Scratch .pdfKubernetes From Scratch .pdf
Kubernetes From Scratch .pdf
 
Introduction+to+Kubernetes-Details-D.pptx
Introduction+to+Kubernetes-Details-D.pptxIntroduction+to+Kubernetes-Details-D.pptx
Introduction+to+Kubernetes-Details-D.pptx
 
Kubernetes-introduction to kubernetes for beginers.pptx
Kubernetes-introduction to kubernetes for beginers.pptxKubernetes-introduction to kubernetes for beginers.pptx
Kubernetes-introduction to kubernetes for beginers.pptx
 
Kubernetes Architecture with Components
 Kubernetes Architecture with Components Kubernetes Architecture with Components
Kubernetes Architecture with Components
 
Kubernetes #1 intro
Kubernetes #1   introKubernetes #1   intro
Kubernetes #1 intro
 
DevJam 2019 - Introduction to Kubernetes
DevJam 2019 - Introduction to KubernetesDevJam 2019 - Introduction to Kubernetes
DevJam 2019 - Introduction to Kubernetes
 
Kubernetes
KubernetesKubernetes
Kubernetes
 
Introduction to kubernetes
Introduction to kubernetesIntroduction to kubernetes
Introduction to kubernetes
 
Docker Online Training | Kubernetes Training in Ameerpet
Docker Online Training | Kubernetes Training in AmeerpetDocker Online Training | Kubernetes Training in Ameerpet
Docker Online Training | Kubernetes Training in Ameerpet
 
A brief study on Kubernetes and its components
A brief study on Kubernetes and its componentsA brief study on Kubernetes and its components
A brief study on Kubernetes and its components
 
Containers kuberenetes
Containers kuberenetesContainers kuberenetes
Containers kuberenetes
 
Containers kuberenetes
Containers kuberenetesContainers kuberenetes
Containers kuberenetes
 
Kubernetes fundamentals
Kubernetes fundamentalsKubernetes fundamentals
Kubernetes fundamentals
 
Containers kuberenetes
Containers kuberenetesContainers kuberenetes
Containers kuberenetes
 
Apache Cassandra Lunch #41: Cassandra on Kubernetes - Docker/Kubernetes/Helm ...
Apache Cassandra Lunch #41: Cassandra on Kubernetes - Docker/Kubernetes/Helm ...Apache Cassandra Lunch #41: Cassandra on Kubernetes - Docker/Kubernetes/Helm ...
Apache Cassandra Lunch #41: Cassandra on Kubernetes - Docker/Kubernetes/Helm ...
 

More from Bob Killen

Tackling New Challenges in a Virtual Focused Community
Tackling New Challenges in a Virtual Focused CommunityTackling New Challenges in a Virtual Focused Community
Tackling New Challenges in a Virtual Focused Community
Bob Killen
 
KubeCon EU 2021 Keynote: Shaping Kubernetes Community Culture
KubeCon EU 2021 Keynote: Shaping Kubernetes Community CultureKubeCon EU 2021 Keynote: Shaping Kubernetes Community Culture
KubeCon EU 2021 Keynote: Shaping Kubernetes Community Culture
Bob Killen
 
Intro to Kubernetes SIG Contributor Experience
Intro to Kubernetes SIG Contributor ExperienceIntro to Kubernetes SIG Contributor Experience
Intro to Kubernetes SIG Contributor Experience
Bob Killen
 
Intro to the CNCF Research User Group
Intro to the CNCF Research User GroupIntro to the CNCF Research User Group
Intro to the CNCF Research User Group
Bob Killen
 
A Peek Behind the Curtain: Managing the Kubernetes Contributor Community
A Peek Behind the Curtain: Managing the Kubernetes Contributor CommunityA Peek Behind the Curtain: Managing the Kubernetes Contributor Community
A Peek Behind the Curtain: Managing the Kubernetes Contributor Community
Bob Killen
 
Kubernetes The New Research Platform
Kubernetes The New Research PlatformKubernetes The New Research Platform
Kubernetes The New Research Platform
Bob Killen
 
Kubernetes: The Next Research Platform
Kubernetes: The Next Research PlatformKubernetes: The Next Research Platform
Kubernetes: The Next Research Platform
Bob Killen
 
Getting started with kubernetes
Getting started with kubernetesGetting started with kubernetes
Getting started with kubernetes
Bob Killen
 
Federated Kubernetes: As a Platform for Distributed Scientific Computing
Federated Kubernetes: As a Platform for Distributed Scientific ComputingFederated Kubernetes: As a Platform for Distributed Scientific Computing
Federated Kubernetes: As a Platform for Distributed Scientific Computing
Bob Killen
 
The (mutable) config management showdown
The (mutable) config management showdownThe (mutable) config management showdown
The (mutable) config management showdown
Bob Killen
 
Ansible, integration testing, and you.
Ansible, integration testing, and you.Ansible, integration testing, and you.
Ansible, integration testing, and you.
Bob Killen
 
Pluggable Infrastructure with CI/CD and Docker
Pluggable Infrastructure with CI/CD and DockerPluggable Infrastructure with CI/CD and Docker
Pluggable Infrastructure with CI/CD and Docker
Bob Killen
 

More from Bob Killen (12)

Tackling New Challenges in a Virtual Focused Community
Tackling New Challenges in a Virtual Focused CommunityTackling New Challenges in a Virtual Focused Community
Tackling New Challenges in a Virtual Focused Community
 
KubeCon EU 2021 Keynote: Shaping Kubernetes Community Culture
KubeCon EU 2021 Keynote: Shaping Kubernetes Community CultureKubeCon EU 2021 Keynote: Shaping Kubernetes Community Culture
KubeCon EU 2021 Keynote: Shaping Kubernetes Community Culture
 
Intro to Kubernetes SIG Contributor Experience
Intro to Kubernetes SIG Contributor ExperienceIntro to Kubernetes SIG Contributor Experience
Intro to Kubernetes SIG Contributor Experience
 
Intro to the CNCF Research User Group
Intro to the CNCF Research User GroupIntro to the CNCF Research User Group
Intro to the CNCF Research User Group
 
A Peek Behind the Curtain: Managing the Kubernetes Contributor Community
A Peek Behind the Curtain: Managing the Kubernetes Contributor CommunityA Peek Behind the Curtain: Managing the Kubernetes Contributor Community
A Peek Behind the Curtain: Managing the Kubernetes Contributor Community
 
Kubernetes The New Research Platform
Kubernetes The New Research PlatformKubernetes The New Research Platform
Kubernetes The New Research Platform
 
Kubernetes: The Next Research Platform
Kubernetes: The Next Research PlatformKubernetes: The Next Research Platform
Kubernetes: The Next Research Platform
 
Getting started with kubernetes
Getting started with kubernetesGetting started with kubernetes
Getting started with kubernetes
 
Federated Kubernetes: As a Platform for Distributed Scientific Computing
Federated Kubernetes: As a Platform for Distributed Scientific ComputingFederated Kubernetes: As a Platform for Distributed Scientific Computing
Federated Kubernetes: As a Platform for Distributed Scientific Computing
 
The (mutable) config management showdown
The (mutable) config management showdownThe (mutable) config management showdown
The (mutable) config management showdown
 
Ansible, integration testing, and you.
Ansible, integration testing, and you.Ansible, integration testing, and you.
Ansible, integration testing, and you.
 
Pluggable Infrastructure with CI/CD and Docker
Pluggable Infrastructure with CI/CD and DockerPluggable Infrastructure with CI/CD and Docker
Pluggable Infrastructure with CI/CD and Docker
 

Recently uploaded

UMN degree offer diploma Transcript
UMN degree offer diploma TranscriptUMN degree offer diploma Transcript
UMN degree offer diploma Transcript
cenocb
 
Female Service Girls Call Delhi 9873940964 Provide Best And Top Girl Service ...
Female Service Girls Call Delhi 9873940964 Provide Best And Top Girl Service ...Female Service Girls Call Delhi 9873940964 Provide Best And Top Girl Service ...
Female Service Girls Call Delhi 9873940964 Provide Best And Top Girl Service ...
elbertablack
 
How-to-Diagnose-Hard-Drives-by-DFL-DDP-2024.pdf
How-to-Diagnose-Hard-Drives-by-DFL-DDP-2024.pdfHow-to-Diagnose-Hard-Drives-by-DFL-DDP-2024.pdf
How-to-Diagnose-Hard-Drives-by-DFL-DDP-2024.pdf
Dolphin Data Lab
 
2023. Archive - Gigabajtos selfpublisher homepage
2023. Archive - Gigabajtos selfpublisher homepage2023. Archive - Gigabajtos selfpublisher homepage
2023. Archive - Gigabajtos selfpublisher homepage
Zsolt Nemeth
 
Why Your Business Needs a Professional Web Design Company UAE
Why Your Business Needs a Professional Web Design Company UAEWhy Your Business Needs a Professional Web Design Company UAE
Why Your Business Needs a Professional Web Design Company UAE
adelewhite125
 
202254.com香蕉影视,在线观看《我才不要和你做朋友呢》在线观看最新电影,香蕉影视在线观看《我才不要和你做朋友呢》在线观看高清电影
202254.com香蕉影视,在线观看《我才不要和你做朋友呢》在线观看最新电影,香蕉影视在线观看《我才不要和你做朋友呢》在线观看高清电影202254.com香蕉影视,在线观看《我才不要和你做朋友呢》在线观看最新电影,香蕉影视在线观看《我才不要和你做朋友呢》在线观看高清电影
202254.com香蕉影视,在线观看《我才不要和你做朋友呢》在线观看最新电影,香蕉影视在线观看《我才不要和你做朋友呢》在线观看高清电影
ffg01100
 
workbook and project U5 1ºsecundaria.pdf
workbook and project U5 1ºsecundaria.pdfworkbook and project U5 1ºsecundaria.pdf
workbook and project U5 1ºsecundaria.pdf
anya2024forgya
 
202254.com免费观看《长相思第二季》免费观看高清,长相思第二季线上看,《长相思第二季》最新电视剧在线观看,杨紫最新电视剧
202254.com免费观看《长相思第二季》免费观看高清,长相思第二季线上看,《长相思第二季》最新电视剧在线观看,杨紫最新电视剧202254.com免费观看《长相思第二季》免费观看高清,长相思第二季线上看,《长相思第二季》最新电视剧在线观看,杨紫最新电视剧
202254.com免费观看《长相思第二季》免费观看高清,长相思第二季线上看,《长相思第二季》最新电视剧在线观看,杨紫最新电视剧
ffg01100
 
High Profile Girls Call ServiCe Chennai XX00XXX00X Tanisha Best High Class Ch...
High Profile Girls Call ServiCe Chennai XX00XXX00X Tanisha Best High Class Ch...High Profile Girls Call ServiCe Chennai XX00XXX00X Tanisha Best High Class Ch...
High Profile Girls Call ServiCe Chennai XX00XXX00X Tanisha Best High Class Ch...
shamrisumri
 
Draya Michele’s Son – Kniko Howard’s Rise to Fame.pptx
Draya Michele’s Son – Kniko Howard’s Rise to Fame.pptxDraya Michele’s Son – Kniko Howard’s Rise to Fame.pptx
Draya Michele’s Son – Kniko Howard’s Rise to Fame.pptx
ashishkumarrana9
 
@Girls @Call Chennai 🛬 XXXXXXXXXX 🛬 available 24*7 cash payment book now pay ...
@Girls @Call Chennai 🛬 XXXXXXXXXX 🛬 available 24*7 cash payment book now pay ...@Girls @Call Chennai 🛬 XXXXXXXXXX 🛬 available 24*7 cash payment book now pay ...
@Girls @Call Chennai 🛬 XXXXXXXXXX 🛬 available 24*7 cash payment book now pay ...
shamrisumri
 
Chennai Girls Call ServiCe X00XXX00XX Tanisha Best High Class Chennai Available
Chennai Girls Call ServiCe X00XXX00XX Tanisha Best High Class Chennai AvailableChennai Girls Call ServiCe X00XXX00XX Tanisha Best High Class Chennai Available
Chennai Girls Call ServiCe X00XXX00XX Tanisha Best High Class Chennai Available
shamrisumri
 
Jarren Duran Fuck EM T shirts Jarren Duran Fuck EM T shirts
Jarren Duran Fuck EM T shirts Jarren Duran Fuck EM T shirtsJarren Duran Fuck EM T shirts Jarren Duran Fuck EM T shirts
Jarren Duran Fuck EM T shirts Jarren Duran Fuck EM T shirts
exgf28
 
Iot-Internet-of-Things_Industrial revolution 4.0-ppt.pptx
Iot-Internet-of-Things_Industrial revolution 4.0-ppt.pptxIot-Internet-of-Things_Industrial revolution 4.0-ppt.pptx
Iot-Internet-of-Things_Industrial revolution 4.0-ppt.pptx
DeepakKumar862274
 
Cyber Security Course & Guide. X.GI. pdf
Cyber Security Course & Guide. X.GI. pdfCyber Security Course & Guide. X.GI. pdf
Cyber Security Course & Guide. X.GI. pdf
RohitRoshanBengROHIT
 
Quiz Quiz Hota Hai (School Quiz 2018-19)
Quiz Quiz Hota Hai (School Quiz 2018-19)Quiz Quiz Hota Hai (School Quiz 2018-19)
Quiz Quiz Hota Hai (School Quiz 2018-19)
Kashyap J
 
Tarun Gaur On Data Breaches and Privacy Fears
Tarun Gaur On Data Breaches and Privacy FearsTarun Gaur On Data Breaches and Privacy Fears
Tarun Gaur On Data Breaches and Privacy Fears
Tarun Gaur
 
Book dating , international dating phgra
Book dating , international dating phgraBook dating , international dating phgra
Book dating , international dating phgra
thomaskurtha9
 
Dewanstudio Project Portfolio 2023 show case
Dewanstudio Project Portfolio 2023 show caseDewanstudio Project Portfolio 2023 show case
Dewanstudio Project Portfolio 2023 show case
DEWANSTUDIO.COM
 
Build a Professional Resume using Canva , Tanapat Limsaiprom
Build a Professional Resume using Canva , Tanapat LimsaipromBuild a Professional Resume using Canva , Tanapat Limsaiprom
Build a Professional Resume using Canva , Tanapat Limsaiprom
TanapatLimsaiprom1
 

Recently uploaded (20)

UMN degree offer diploma Transcript
UMN degree offer diploma TranscriptUMN degree offer diploma Transcript
UMN degree offer diploma Transcript
 
Female Service Girls Call Delhi 9873940964 Provide Best And Top Girl Service ...
Female Service Girls Call Delhi 9873940964 Provide Best And Top Girl Service ...Female Service Girls Call Delhi 9873940964 Provide Best And Top Girl Service ...
Female Service Girls Call Delhi 9873940964 Provide Best And Top Girl Service ...
 
How-to-Diagnose-Hard-Drives-by-DFL-DDP-2024.pdf
How-to-Diagnose-Hard-Drives-by-DFL-DDP-2024.pdfHow-to-Diagnose-Hard-Drives-by-DFL-DDP-2024.pdf
How-to-Diagnose-Hard-Drives-by-DFL-DDP-2024.pdf
 
2023. Archive - Gigabajtos selfpublisher homepage
2023. Archive - Gigabajtos selfpublisher homepage2023. Archive - Gigabajtos selfpublisher homepage
2023. Archive - Gigabajtos selfpublisher homepage
 
Why Your Business Needs a Professional Web Design Company UAE
Why Your Business Needs a Professional Web Design Company UAEWhy Your Business Needs a Professional Web Design Company UAE
Why Your Business Needs a Professional Web Design Company UAE
 
202254.com香蕉影视,在线观看《我才不要和你做朋友呢》在线观看最新电影,香蕉影视在线观看《我才不要和你做朋友呢》在线观看高清电影
202254.com香蕉影视,在线观看《我才不要和你做朋友呢》在线观看最新电影,香蕉影视在线观看《我才不要和你做朋友呢》在线观看高清电影202254.com香蕉影视,在线观看《我才不要和你做朋友呢》在线观看最新电影,香蕉影视在线观看《我才不要和你做朋友呢》在线观看高清电影
202254.com香蕉影视,在线观看《我才不要和你做朋友呢》在线观看最新电影,香蕉影视在线观看《我才不要和你做朋友呢》在线观看高清电影
 
workbook and project U5 1ºsecundaria.pdf
workbook and project U5 1ºsecundaria.pdfworkbook and project U5 1ºsecundaria.pdf
workbook and project U5 1ºsecundaria.pdf
 
202254.com免费观看《长相思第二季》免费观看高清,长相思第二季线上看,《长相思第二季》最新电视剧在线观看,杨紫最新电视剧
202254.com免费观看《长相思第二季》免费观看高清,长相思第二季线上看,《长相思第二季》最新电视剧在线观看,杨紫最新电视剧202254.com免费观看《长相思第二季》免费观看高清,长相思第二季线上看,《长相思第二季》最新电视剧在线观看,杨紫最新电视剧
202254.com免费观看《长相思第二季》免费观看高清,长相思第二季线上看,《长相思第二季》最新电视剧在线观看,杨紫最新电视剧
 
High Profile Girls Call ServiCe Chennai XX00XXX00X Tanisha Best High Class Ch...
High Profile Girls Call ServiCe Chennai XX00XXX00X Tanisha Best High Class Ch...High Profile Girls Call ServiCe Chennai XX00XXX00X Tanisha Best High Class Ch...
High Profile Girls Call ServiCe Chennai XX00XXX00X Tanisha Best High Class Ch...
 
Draya Michele’s Son – Kniko Howard’s Rise to Fame.pptx
Draya Michele’s Son – Kniko Howard’s Rise to Fame.pptxDraya Michele’s Son – Kniko Howard’s Rise to Fame.pptx
Draya Michele’s Son – Kniko Howard’s Rise to Fame.pptx
 
@Girls @Call Chennai 🛬 XXXXXXXXXX 🛬 available 24*7 cash payment book now pay ...
@Girls @Call Chennai 🛬 XXXXXXXXXX 🛬 available 24*7 cash payment book now pay ...@Girls @Call Chennai 🛬 XXXXXXXXXX 🛬 available 24*7 cash payment book now pay ...
@Girls @Call Chennai 🛬 XXXXXXXXXX 🛬 available 24*7 cash payment book now pay ...
 
Chennai Girls Call ServiCe X00XXX00XX Tanisha Best High Class Chennai Available
Chennai Girls Call ServiCe X00XXX00XX Tanisha Best High Class Chennai AvailableChennai Girls Call ServiCe X00XXX00XX Tanisha Best High Class Chennai Available
Chennai Girls Call ServiCe X00XXX00XX Tanisha Best High Class Chennai Available
 
Jarren Duran Fuck EM T shirts Jarren Duran Fuck EM T shirts
Jarren Duran Fuck EM T shirts Jarren Duran Fuck EM T shirtsJarren Duran Fuck EM T shirts Jarren Duran Fuck EM T shirts
Jarren Duran Fuck EM T shirts Jarren Duran Fuck EM T shirts
 
Iot-Internet-of-Things_Industrial revolution 4.0-ppt.pptx
Iot-Internet-of-Things_Industrial revolution 4.0-ppt.pptxIot-Internet-of-Things_Industrial revolution 4.0-ppt.pptx
Iot-Internet-of-Things_Industrial revolution 4.0-ppt.pptx
 
Cyber Security Course & Guide. X.GI. pdf
Cyber Security Course & Guide. X.GI. pdfCyber Security Course & Guide. X.GI. pdf
Cyber Security Course & Guide. X.GI. pdf
 
Quiz Quiz Hota Hai (School Quiz 2018-19)
Quiz Quiz Hota Hai (School Quiz 2018-19)Quiz Quiz Hota Hai (School Quiz 2018-19)
Quiz Quiz Hota Hai (School Quiz 2018-19)
 
Tarun Gaur On Data Breaches and Privacy Fears
Tarun Gaur On Data Breaches and Privacy FearsTarun Gaur On Data Breaches and Privacy Fears
Tarun Gaur On Data Breaches and Privacy Fears
 
Book dating , international dating phgra
Book dating , international dating phgraBook dating , international dating phgra
Book dating , international dating phgra
 
Dewanstudio Project Portfolio 2023 show case
Dewanstudio Project Portfolio 2023 show caseDewanstudio Project Portfolio 2023 show case
Dewanstudio Project Portfolio 2023 show case
 
Build a Professional Resume using Canva , Tanapat Limsaiprom
Build a Professional Resume using Canva , Tanapat LimsaipromBuild a Professional Resume using Canva , Tanapat Limsaiprom
Build a Professional Resume using Canva , Tanapat Limsaiprom
 

Kubernetes - A Comprehensive Overview

  • 2. Agenda ● Introduction ○ Who am I? ○ What is Kubernetes? ○ What does Kubernetes do? ● Architecture ○ Master Components ○ Node Components ○ Additional Services ○ Networking ● Concepts ○ Core ○ Workloads ○ Network ○ Storage ○ Configuration ○ Auth and Identity ● Behind the Scenes ○ Deployment from Beginning to End
  • 4. Intro - Who am I? Bob Killen / rkillen@umich.edu Twitter / Github: @mrbobbytables Senior Research Cloud Administrator @ ARC-TS http://arc-ts.umich.edu
  • 5. Intro - What is Kubernetes? Kubernetes or K8s was a project spun out of Google as a open source next-gen container scheduler designed with the lessons learned from developing and managing Borg and Omega. Kubernetes was designed from the ground-up as a loosely coupled collection of components centered around deploying, maintaining, and scaling applications.
  • 6. Intro - What Does Kubernetes do? Kubernetes is the linux kernel of distributed systems. It abstracts away the underlying hardware of the nodes and provides a uniform interface for applications to be both deployed and consume the shared pool of resources.
  • 8. Architecture Overview Masters - Acts as the primary control plane for Kubernetes. Masters are responsible at a minimum for running the API Server, scheduler, and cluster controller. They commonly also manage storing cluster state, cloud-provider specific components and other cluster essential services. Nodes - Are the ‘workers’ of a Kubernetes cluster. They run a minimal agent that manages the node itself, and are tasked with executing workloads as designated by the master.
  • 11. Master Components ● Kube-apiserver ● Etcd ● Kube-controller-manager ● Cloud-controller-manager ● Kube-scheduler
  • 12. kube-apiserver The apiserver provides a forward facing REST interface into the kubernetes control plane and datastore. All clients, including nodes, users and other applications interact with kubernetes strictly through the API Server. It is the true core of Kubernetes acting as the gatekeeper to the cluster by handling authentication and authorization, request validation, mutation, and admission control in addition to being the front-end to the backing datastore.
  • 13. etcd Etcd acts as the cluster datastore; providing a strong, consistent and highly available key-value store used for persisting cluster state.
  • 14. kube-controller-manager The controller-manager is the primary daemon that manages all core component control loops. It monitors the cluster state via the apiserver and steers the cluster towards the desired state. List of core controllers: https://github.com/kubernetes/kubernetes/blob/master/cmd/kube-controller-manager/app/controllermanager.go#L332
  • 15. cloud-controller-manager The cloud-controller-manager is a daemon that provides cloud-provider specific knowledge and integration capability into the core control loop of Kubernetes. The controllers include Node, Route, Service, and add an additional controller to handle PersistentVolumeLabels .
  • 16. kube-scheduler Kube-scheduler is a verbose policy-rich engine that evaluates workload requirements and attempts to place it on a matching resource. These requirements can include such things as general hardware reqs, affinity, anti-affinity, and other custom resource requirements.
  • 18. Node Components ● Kubelet ● Kube-proxy ● Container runtime engine
  • 19. kubelet Acts as the node agent responsible for managing pod lifecycle on its host. Kubelet understands YAML container manifests that it can read from several sources: ● File path ● HTTP Endpoint ● Etcd watch acting on any changes ● HTTP Server mode accepting container manifests over a simple API.
  • 20. kube-proxy Manages the network rules on each node and performs connection forwarding or load balancing for Kubernetes cluster services. Available Proxy Modes: ● Userspace ● iptables ● ipvs (alpha in 1.8)
  • 21. Container Runtime With respect to Kubernetes, A container runtime is a CRI (Container Runtime Interface) compatible application that executes and manages containers. ● Containerd (docker) ● Cri-o ● Rkt ● Kata (formerly clear and hyper) ● Virtlet (VM CRI compatible runtime)
  • 22. Additional Services Kube-dns - Provides cluster wide DNS Services. Services are resolvable to <service>.<namespace>.svc.cluster.local. Heapster - Metrics Collector for kubernetes cluster, used by some resources such as the Horizontal Pod Autoscaler. (required for kubedashboard metrics) Kube-dashboard - A general purpose web based UI for kubernetes.
  • 24. Networking - Fundamental Rules 1) All Pods can communicate with all other Pods without NAT 2) All nodes can communicate with all Pods (and vice-versa) without NAT. 3) The IP that a Pod sees itself as is the same IP that others see it as.
  • 25. Networking - Fundamentals Applied Containers in a pod exist within the same network namespace and share an IP; allowing for intrapod communication over localhost. Pods are given a cluster unique IP for the duration of its lifecycle, but the pods themselves are fundamentally ephemeral. Services are given a persistent cluster unique IP that spans the Pods lifecycle. External Connectivity is generally handed by an integrated cloud provider or other external entity (load balancer)
  • 26. Networking - CNI Networking within Kubernetes is plumbed via the Container Network Interface (CNI), an interface between a container runtime and a network implementation plugin. Compatible CNI Network Plugins: ● Calico ● Cillium ● Contiv ● Contrail ● Flannel ● GCE ● kube-router ● Multus ● OpenVSwitch ● OVN ● Romana ● Weave
  • 28. Kubernetes Concepts - Core Cluster - A collection of hosts that aggregate their available resources including cpu, ram, disk, and their devices into a usable pool. Master - The master(s) represent a collection of components that make up the control plane of Kubernetes. These components are responsible for all cluster decisions including both scheduling and responding to cluster events. Node - A single host, physical or virtual capable of running pods. A node is managed by the master(s), and at a minimum runs both kubelet and kube-proxy to be considered part of the cluster. Namespace - A logical cluster or environment. Primary method of dividing a cluster or scoping access.
  • 29. Concepts - Core (cont.) Label - Key-value pairs that are used to identify, describe and group together related sets of objects. Labels have a strict syntax and available character set. * Annotation - Key-value pairs that contain non-identifying information or metadata. Annotations do not have the the syntax limitations as labels and can contain structured or unstructured data. Selector - Selectors use labels to filter or select objects. Both equality-based (=, ==, !=) or simple key-value matching selectors are supported. * https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#syntax-and-character-set
  • 30. Labels: app: nginx tier: frontned Annotations description: “nginx frontend” Selector: app: nginx tier: frontend Labels, and Annotations, and Selectors
  • 31. Set-based selectors Valid Operators: ● In ● NotIn ● Exists ● DoesNotExist Supported Objects with set-based selectors: ● Job ● Deployment ● ReplicaSet ● DaemonSet ● PersistentVolumeClaims
  • 32. Concepts - Workloads Pod - A pod is the smallest unit of work or management resource within Kubernetes. It is comprised of one or more containers that share their storage, network, and context (namespace, cgroups etc). ReplicationController - Method of managing pod replicas and their lifecycle. Their scheduling, scaling, and deletion. ReplicaSet - Next Generation ReplicationController. Supports set-based selectors. Deployment - A declarative method of managing stateless Pods and ReplicaSets. Provides rollback functionality in addition to more granular update control mechanisms.
  • 33. Deployment ReplicaSet Contains configuration of how updates or ‘deployments’ should be managed in addition to the pod template used to generate the ReplicaSet. Generated ReplicaSet from Deployment spec.
  • 34. Concepts - Workloads (cont.) StatefulSet - A controller tailored to managing Pods that must persist or maintain state. Pod identity including hostname, network, and storage will be persisted. DaemonSet - Ensures that all nodes matching certain criteria will run an instance of a supplied Pod. Ideal for cluster wide services such as log forwarding, or health monitoring.
  • 35. StatefulSet ● Attaches to ‘headeless service’ (not shown) nginx. ● Pods given unique ordinal names using the pattern <statefulset name>-<ordinal index>. ● Creates independent persistent volumes based on the ‘volumeClaimTemplates’.
  • 36. DaemonSet ● Bypasses default scheduler ● Schedules a single instance on every host while adhering to tolerances and taints.
  • 37. Concepts - Workloads (cont.) Job - The job controller ensures one or more pods are executed and successfully terminates. It will do this until it satisfies the completion and/or parallelism condition. CronJob - An extension of the Job Controller, it provides a method of executing jobs on a cron-like schedule.
  • 38. Jobs ● Number of pod executions can be controlled via spec.completions ● Jobs can be parallelized using spec.parallelism ● Jobs and Pods are NOT automatically cleaned up after a job has completed.
  • 39. CronJob ● Adds cron schedule to job template
  • 40. Concepts - Network Service - Services provide a method of exposing and consuming L4 Pod network accessible resources. They use label selectors to map groups of pods and ports to a cluster-unique virtual IP. Ingress - An ingress controller is the primary method of exposing a cluster service (usually http) to the outside world. These are load balancers or routers that usually offer SSL termination, name-based virtual hosting etc.
  • 41. Service ● Acts as the unified method of accessing replicated pods. ● Four major Service Types: ○ CluterIP - Exposes service on a strictly cluster-internal IP (default) ○ NodePort - Service is exposed on each node’s IP on a statically defined port. ○ LoadBalancer - Works in combination with a cloud provider to expose a service outside the cluster on a static external IP. ○ ExternalName - used to references endpoints OUTSIDE the cluster by providing a static internally referenced DNS name.
  • 42. Ingress Controller ● Deployed as a pod to one or more hosts ● Ingress controllers are an external controller with multiple options. ○ Nginx ○ HAproxy ○ Contour ○ Traefik ● Specific features and controller specific configuration is passed through annotations.
  • 43. Concepts - Storage Volume - Storage that is tied to the Pod Lifecycle, consumable by one or more containers within the pod. PersistentVolume - A PersistentVolume (PV) represents a storage resource. PVs are commonly linked to a backing storage resource, NFS, GCEPersistentDisk, RBD etc. and are provisioned ahead of time. Their lifecycle is handled independently from a pod. PersistentVolumeClaim - A PersistentVolumeClaim (PVC) is a request for storage that satisfies a set of requirements instead of mapping to a storage resource directly. Commonly used with dynamically provisioned storage. StorageClass - Storage classes are an abstraction on top of an external storage resource. These will include a provisioner, provisioner configuration parameters as well as a PV reclaimPolicy.
  • 45. Persistent Volumes ● PVs are a cluster-wide resource ● Not directly consumable by a Pod ● PV Parameters: ○ Capacity ○ accessModes ■ ReadOnlyMany (ROX) ■ ReadWriteOnce (RWO) ■ ReadWriteMany (RWX) ○ persistentVolumeReclaimPolicy ■ Retain ■ Recycle ■ Delete ○ StorageClass
  • 46. Persistent Volume Claims ● PVCs are scoped to namespaces ● Supports accessModes like PVs ● Uses resource request model similar to Pods ● Claims will consume storage from matching PVs or StorageClasses based on storageClass and selectors.
  • 47. Storage Classes ● Uses an external system defined by the provisioner to dynamically consume and allocate storage. ● Storage Class Fields ○ Provisioner ○ Parameters ○ reclaimPolicy
  • 48. Concepts - Configuration ConfigMap - Externalized data stored within kubernetes that can be referenced as a commandline argument, environment variable, or injected as a file into a volume mount. Ideal for separating containerized application from configuration. Secret - Functionally identical to ConfigMaps, but stored encoded as base64, and encrypted at rest (if configured).
  • 49. ConfigMaps and Secrets ● Can be used in Pod Config: ○ Injected as a file ○ Passed as an environment variable ○ Used as a container command (requires passing as env var)
  • 50. Concepts - Auth and Identity (RBAC) [Cluster]Role - Roles contain rules that act as a set of permissions that apply verbs like “get”, “list”, “watch” etc over resources that are scoped to apiGroups. Roles are scoped to namespaces, and ClusterRoles are applied cluster-wide. [Cluster]RoleBinding - Grant the permissions as defined in a [Cluster]Role to one or more “subjects” which can be a user, group, or service account. ServiceAccount- ServiceAccounts provide a consumable identity for pods or external services that interact with the cluster directly and are scoped to namespaces.
  • 51. [Cluster]Role ● Permissions translate to url path. With “” defaulting to core group. ● Resources act as items the role should be granted access to. ● Verbs are the actions the role can perform on the referenced resources.
  • 52. [Cluster]RoleBinding ● Can reference multiple subjects ● Subjects can be of kind: ○ User ○ Group ○ ServiceAccount ● roleRef targets a single role only.
  • 57. Kubectl 1) Kubectl performs client side validation on manifest (linting). 2) Manifest is prepared and serialized creating a JSON payload.
  • 58. APIserver Request Loop 3) Kubectl authenticates to apiserver via x509, jwt, http auth proxy, other plugins, or http-basic auth. 4) Authorization iterates over available AuthZ sources: Node, ABAC, RBAC, or webhook. 5) AdmissionControl checks resource quotas, other security related checks etc. 6) Request is stored in etcd. 7) Initializers are given opportunity to mutate request before the object is published. 8) Request is published on apiserver.
  • 59. Deployment Controller 9) Deployment Controller is notified of the new Deployment via callback. 10) Deployment Controller evaluates cluster state and reconciles the desired vs current state and forms a request for the new ReplicaSet. 11) apiserver request loop evaluates Deployment Controller request. 12) ReplicaSet is published.
  • 60. ReplicaSet Controller 13) ReplicaSet Controller is notified of the new ReplicaSet via callback. 14) ReplicaSet Controller evaluates cluster state and reconciles the desired vs current state and forms a request for the desired amount of pods. 15) apiserver request loop evaluates ReplicaSet Controller request. 16) Pods published, and enter ‘Pending’ phase.
  • 62. Scheduler 17) Scheduler monitors published pods with no ‘NodeName’ assigned. 18) Applies scheduling rules and filters to find a suitable node to host the Pod. 19) Scheduler creates a binding of Pod to Node and POSTs to apiserver. 20) apiserver request loop evaluates POST request. 21) Pod status is updated with node binding and sets status to ‘PodScheduled’.
  • 63. Kubelet - PodSync 22) The kubelet daemon on every node polls the apiserver filtering for pods matching its own ‘NodeName’; checking its current state with the desired state published through the apiserver. 23) Kubelet will then move through a series of internal processes to prepare the pod environment. This includes pulling secrets, provisioning storage, applying AppArmor profiles and other various scaffolding. During this period, it will asynchronously be POST’ing the ‘PodStatus’ to the apiserver through the standard apiserver request loop.
  • 64. Pause and Plumbing 24) Kubelet then provisions a ‘pause’ container via the CRI (Container Runtime Interface). The pause container acts as the parent container for the Pod. 25) The network is plumbed to the Pod via the CNI (Container Network Interface), creating a veth pair attached to the pause container and to a container bridge (cbr0). 26) IPAM handled by the CNI plugin assigns an IP to the pause container.
  • 65. Kublet - Create Containers 24) Kubelet pulls the container Images. 25) Kubelet first creates and starts any init containers. 26) Once the optional init containers complete, the primary pod containers are started.
  • 66. Pod Status 27) If there are any liveless/readiness probes, these are executed before the PodStatus is updated. 28) If all complete successfully, PodStatus is set to ready and the container has started successfully. The Pod is Deployed!