This document provides an overview of WSO2's reference architecture for deploying their middleware products on Kubernetes. It begins with introductions to containers and Kubernetes, explaining concepts like pods, services, deployments, etc. It then outlines WSO2's approach for container orchestration, service discovery, configuration management, load balancing, security, updates, and monitoring in a Kubernetes environment. Specific practices and Kubernetes resources are recommended for areas like pod security policies, horizontal pod autoscaling, ingress definitions, and more. Overall the document serves as a guide for architecting and operating WSO2 products on Kubernetes according to best practices.
This presentation includes information on Kubernetes Architecture, Container Orchestration, Internal Routing, External Routing, Configuration Management, Credentials Management, Persistent Volumes, Rolling Out Updates, Autoscaling, Package Management, and a Hello World example using Helm.
Slides from the talk given to the Startup Berlin Slack Group that demonstrates how TruckIN is implementing its continuous delivery workflow using technologies and open-source tools.
Topics that are covered: Automated Cloud Provisioning (Network, Subnets, VMs, Kubernetes Cluster, Firewall, Disks, Credentials, Private Docker Registry); Configuration Management (Salt Stack), Continuous Integration (Jenkins CI), Continuous Delivery/Deployment (Salt API/Reactor + Kubernetes) to a Google Cloud Kubernetes Cluster, Remote Application Debugging, Managing Google Cloud Kubernetes Cluster, Logging, Monitoring and ChatOps (Slack and operable.io)
This presentation includes information on Kubernetes Architecture, Container Orchestration, Internal Routing, External Routing, Configuration Management, Credentials Management, Persistent Volumes, Rolling Out Updates, Autoscaling, Package Management, and a Hello World example using Helm.
Slides from the talk given to the Startup Berlin Slack Group that demonstrates how TruckIN is implementing its continuous delivery workflow using technologies and open-source tools.
Topics that are covered: Automated Cloud Provisioning (Network, Subnets, VMs, Kubernetes Cluster, Firewall, Disks, Credentials, Private Docker Registry); Configuration Management (Salt Stack), Continuous Integration (Jenkins CI), Continuous Delivery/Deployment (Salt API/Reactor + Kubernetes) to a Google Cloud Kubernetes Cluster, Remote Application Debugging, Managing Google Cloud Kubernetes Cluster, Logging, Monitoring and ChatOps (Slack and operable.io)
An application path to production does not end with a deployment, even if you are using Kubernetes (K8s) as your application deployment platform. Reliable BCDR (backup and disaster recovery) plan and framework is a must for any production-ready system.
This presentation accompanies meetups and webinars in which Oleg Chunikhin, CTO at Kublr, shows how Velero BCDR framework works and demonstrates how it can be used to backup and recover realistic applications running on Kubernetes in different clouds and environments.
What is covered:
- general notions of Kubernetes applications BCDR
- Velero BCDR framework
- demo Velero BCDR for stateful applications running on AWS and Azure clouds
- demo Velero BCDR using Strimzi / Kafka cluster and ArgoCD CI/CD manager as example application
An overview of the Kubernetes architectureIgor Sfiligoi
Â
This talk provides a 101 introdution to Kubernetes from a user point of view.
Aimed at service providers, it was presented at the GPN Annual Meeting 2019. https://conferences.k-state.edu/gpn/
Arkena's video-on-demand platform is used as backend by major european channels (TF1 / beIN SPORTS / Elisa) to propose a non-linear experience to their customers.
Previously hosted on Heroku, the number of our users is increasing constantly. In order to optimize resources we decided to move on a bare metal infrastructure powered by Kubernetes.
We'll share thoughts, feedbacks and technical details about this successful transition.
Sched Link:
Diving Through The Layers: Investigating runc, containerd, and the Docker eng...Phil Estes
Â
A presentation given on Thursday, January 19th, 2017 at the Devops Remote Conf 2017. This talk details the history of the Docker engine architecture, focusing on the split in April 2016 into the containerd and runc layers, and talking through the December 2016 announcement of the *new containerd project and what it will bring for the Docker engine and other consumers.
In this session, we will discuss the architecture of a Kubernetes cluster. we will go through all the master and worker components of a kubernetes cluster. We will also discuss the basic terminology of Kubernetes cluster such as Pods, Deployments, Service etc. We will also cover networking inside Kuberneets. In the end, we will discuss options available for the setup of a Kubernetes cluster.
Slides from my talk that demonstrates the challenges, difficulties, discoveries and joys of building an CI/CD for staging environments using Docker, Kubernetes, Github, Slack, AWS, Terraform and SaltStack. From the opening of a pull request to a running environment, how our process at Autobutler is provisioning and running staging environments using containers.
Kubernetes 1.16 and rancher 2.3 enhancementsSaiyam Pathak
Â
This presentation talks about the recent kubernetes 1.16 enhancements and Rancher 2.3 new features. It also has the references section that was used as a motivation for this presentation.
Since last DockerCon, Kubernetes has been integrated into both the Desktop and Enterprise editions of the Docker Platform. In this deep dive session, we’ll showcase live demos and explore where Kubernetes fits in the architecture of both the Desktop and the Enterprise editions and which community tools make this integration possible. We’ll be covering topics ranging from hypervisor control, storage and networking all the way to the integration of a custom RBAC system, native Compose file support and providing a rich user interface for Kubernetes.
** Kubernetes Certification Training: https://www.edureka.co/kubernetes-certification **
This Edureka tutorial on "Kubernetes Architecture" will give you an introduction to popular DevOps tool - Kubernetes, and will deep dive into Kubernetes Architecture and its working. The following topics are covered in this training session:
1. What is Kubernetes
2. Features of Kubernetes
3. Kubernetes Architecture and Its Components
4. Components of Master Node and Worker Node
5. ETCD
6. Network Setup Requirements
​DevOps Tutorial Blog Series: https://goo.gl/P0zAfF
Kubernetes Helm makes application deployment easy, standardized and reusable. Use of Kubernetes Helm leads to better developer productivity, reduced Kubernetes deployment complexity and enhanced enterprise production readiness.
Enterprises using Kubernetes Helm can speed up the adoption of cloud native applications. These applications can be sourced from open-source community provided repositories, or from an organization’s internal repository of customized application blueprints.
Developers can use Kubernetes Helm as a vehicle for packaging their applications and sharing them with the Kubernetes community. Kubernetes Helm also allows software vendors to offer their containerized applications at “the push of a button.” Through a single command or a few mouse clicks, users can install Kubernetes apps for dev-test or production environments.
This presentation explains the basics of Kubernetes ingress traffic management functionality, and how it can be used to simplify managing applications across different environments - in the cloud or on premise.
These slides were used during a technical session for the Cloud-Native El Salvador community. It covers the basic Kubernetes components, some installers and main Kubernetes resources. For the demo, it was used the capabilites provided by the Horizontal Pod Autoscaler.
An application path to production does not end with a deployment, even if you are using Kubernetes (K8s) as your application deployment platform. Reliable BCDR (backup and disaster recovery) plan and framework is a must for any production-ready system.
This presentation accompanies meetups and webinars in which Oleg Chunikhin, CTO at Kublr, shows how Velero BCDR framework works and demonstrates how it can be used to backup and recover realistic applications running on Kubernetes in different clouds and environments.
What is covered:
- general notions of Kubernetes applications BCDR
- Velero BCDR framework
- demo Velero BCDR for stateful applications running on AWS and Azure clouds
- demo Velero BCDR using Strimzi / Kafka cluster and ArgoCD CI/CD manager as example application
An overview of the Kubernetes architectureIgor Sfiligoi
Â
This talk provides a 101 introdution to Kubernetes from a user point of view.
Aimed at service providers, it was presented at the GPN Annual Meeting 2019. https://conferences.k-state.edu/gpn/
Arkena's video-on-demand platform is used as backend by major european channels (TF1 / beIN SPORTS / Elisa) to propose a non-linear experience to their customers.
Previously hosted on Heroku, the number of our users is increasing constantly. In order to optimize resources we decided to move on a bare metal infrastructure powered by Kubernetes.
We'll share thoughts, feedbacks and technical details about this successful transition.
Sched Link:
Diving Through The Layers: Investigating runc, containerd, and the Docker eng...Phil Estes
Â
A presentation given on Thursday, January 19th, 2017 at the Devops Remote Conf 2017. This talk details the history of the Docker engine architecture, focusing on the split in April 2016 into the containerd and runc layers, and talking through the December 2016 announcement of the *new containerd project and what it will bring for the Docker engine and other consumers.
In this session, we will discuss the architecture of a Kubernetes cluster. we will go through all the master and worker components of a kubernetes cluster. We will also discuss the basic terminology of Kubernetes cluster such as Pods, Deployments, Service etc. We will also cover networking inside Kuberneets. In the end, we will discuss options available for the setup of a Kubernetes cluster.
Slides from my talk that demonstrates the challenges, difficulties, discoveries and joys of building an CI/CD for staging environments using Docker, Kubernetes, Github, Slack, AWS, Terraform and SaltStack. From the opening of a pull request to a running environment, how our process at Autobutler is provisioning and running staging environments using containers.
Kubernetes 1.16 and rancher 2.3 enhancementsSaiyam Pathak
Â
This presentation talks about the recent kubernetes 1.16 enhancements and Rancher 2.3 new features. It also has the references section that was used as a motivation for this presentation.
Since last DockerCon, Kubernetes has been integrated into both the Desktop and Enterprise editions of the Docker Platform. In this deep dive session, we’ll showcase live demos and explore where Kubernetes fits in the architecture of both the Desktop and the Enterprise editions and which community tools make this integration possible. We’ll be covering topics ranging from hypervisor control, storage and networking all the way to the integration of a custom RBAC system, native Compose file support and providing a rich user interface for Kubernetes.
** Kubernetes Certification Training: https://www.edureka.co/kubernetes-certification **
This Edureka tutorial on "Kubernetes Architecture" will give you an introduction to popular DevOps tool - Kubernetes, and will deep dive into Kubernetes Architecture and its working. The following topics are covered in this training session:
1. What is Kubernetes
2. Features of Kubernetes
3. Kubernetes Architecture and Its Components
4. Components of Master Node and Worker Node
5. ETCD
6. Network Setup Requirements
​DevOps Tutorial Blog Series: https://goo.gl/P0zAfF
Kubernetes Helm makes application deployment easy, standardized and reusable. Use of Kubernetes Helm leads to better developer productivity, reduced Kubernetes deployment complexity and enhanced enterprise production readiness.
Enterprises using Kubernetes Helm can speed up the adoption of cloud native applications. These applications can be sourced from open-source community provided repositories, or from an organization’s internal repository of customized application blueprints.
Developers can use Kubernetes Helm as a vehicle for packaging their applications and sharing them with the Kubernetes community. Kubernetes Helm also allows software vendors to offer their containerized applications at “the push of a button.” Through a single command or a few mouse clicks, users can install Kubernetes apps for dev-test or production environments.
This presentation explains the basics of Kubernetes ingress traffic management functionality, and how it can be used to simplify managing applications across different environments - in the cloud or on premise.
These slides were used during a technical session for the Cloud-Native El Salvador community. It covers the basic Kubernetes components, some installers and main Kubernetes resources. For the demo, it was used the capabilites provided by the Horizontal Pod Autoscaler.
Watch this Tech Talk: https://do.co/video_pgupta
An introduction into the world of containers and the orchestration ecosystem, and how Kubernetes can help software developers and cloud infrastructure engineers be more agile, efficient, and productive.
Containers and Kubernetes have changed the infra world for good, bringing agility, efficiency, and more productivity. Still thinking about how to get started with Kubernetes? This talk is designed to give you an introduction into the world of containers and the orchestration ecosystem.
What You'll Learn
- Introduction to containers and microservices
- Introduction to Kubernetes and how it can help
- Essential Kubernetes building blocks (“primitives”) for getting started
About the Presenter
Peeyush Gupta is a cloud enthusiast with 5+ years of experience in developing cloud platforms and helping customers migrate their legacy applications to cloud. He has also been a speaker at multiple meetups and serves the developer community as part of Kubernetes contributor experience group. He is currently working with DigitalOcean as a Senior Developer Advocate.
New to DigitalOcean? Get US $100 in credit when you sign up: https://do.co/deploytoday
To learn more about DigitalOcean: https://www.digitalocean.com/
Follow us on Twitter: https://twitter.com/digitalocean
Like us on Facebook: https://www.facebook.com/DigitalOcean
Follow us on Instagram: https://www.instagram.com/thedigitalocean/
We're hiring: http://do.co/careers
Recent momentum around the evolution of Containers are gradually increase in last two years.Containers virtualize an OS and applications running in each container believe that they have full access to their very own copy of that OS. This is analogous to what VMs do when they virtualize at a lower level, the hardware. In the case of containers, it’s the OS that does the virtualization and maintains the illusion.
Recent momentum around the evolution of Containers are gradually increase in last two years.Containers virtualize an OS and applications running in each container believe that they have full access to their very own copy of that OS. This is analogous to what VMs do when they virtualize at a lower level, the hardware. In the case of containers, it’s the OS that does the virtualization and maintains the illusion.
Recent past many software companies have quickly adopted container technologies, including Docker Containers, aware of the threat and advantage of the approach. For example, Linux companies have also jumped into the ground, seeing as this as an opportunity to grow the Linux market. Also Microsoft is going to add features to support containers and VMware have made efforts in integrating support for Docker into virtual machine technology.
Recent momentum around the evolution of Containers are gradually increase in last two years.Containers virtualize an OS and applications running in each container believe that they have full access to their very own copy of that OS. This is analogous to what VMs do when they virtualize at a lower level, the hardware. In the case of containers, it’s the OS that does the virtualization and maintains the illusion.
Recent past many software companies have quickly adopted container technologies, including Docker Containers, aware of the threat and advantage of the approach. For example, Linux companies have also jumped into the ground, seeing as this as an opportunity to grow the Linux market. Also Microsoft is going to add features to support containers and VMware have made efforts in integrating support for Docker into virtual machine technology.
Presentation by Alex Mavrogiannis from Docker Inc, during the Docker Athens Meetup, January 4th 2018, on the integration of Docker Swarm and Kubernetes as orchestrators of the Docker platform.
Kubernetes has been a key component for many companies to reduce technical debt in infrastructure by:
• Fostering the Adoption of Docker
• Simplifying Container Management
• Onboarding Developers On Infrastructure
• Unlocking Continuous Integration and Delivery
During this meetup we are going to discuss the following topics and share some best practices
• What's new with Kubernetes 1.3
• Generate Cluster Configuration using CloudFormation
• Deploy Kubernetes Clusters on AWS
• Scaling the Cluster
• Integrating Ingress with Elastic Load Balancer
• Using Internal ELB's as Kubernetes' Service
• Using EBS for persistent volumes
• Integrating Route53
QConSF18 - Disenchantment: Netflix Titus, its Feisty Team, and Daemonsaspyker
Â
Disenchantment is a Netflix show following the medieval misadventures of a hard-drinking princess, her feisty elf, and her personal demon. In this talk, we will follow the story of Netflix’s container management platform, Titus, which powers critical aspects of the Netflix business (video encoding & streaming, big data, recommendations & machine learning, and other workloads). We’ll cover the challenges growing Titus from 10’s to 1000’s of workloads. We’ll talk about our feisty team’s work across container runtimes, scheduling & control plane, and cloud infrastructure integration. We’ll talk about the demons we’ve found on this journey covering operability, security, reliability and performance.
DCSF19 How Docker Simplifies Kubernetes for the Masses Docker, Inc.
Â
Jean Rouge & David Yu, Docker
Kubernetes has taken the technology industry by storm these last few years. It delivers powerful orchestration and container management capabilities that have been leveraged by cloud-scale companies and small startups alike. But for many organizations, the learning curve for Kubernetes can be steep and organizations can't build up their skills fast enough. Luckily Docker has always had a history of making the complex easy - first with Linux containers and now with Kubernetes - both in our Desktop and Enterprise platform. In this session, we'll highlight some of the innovation Docker has added to Kubernetes to simplify configuration and ongoing operations while still providing a fully conformant Kubernetes environment. We'll cover areas like deploying applications on Kubernetes, managing access controls and multi-tenancy, end-to-end security and improved troubleshooting. Demos will highlight key comparisons to show you that you don't have to build it yourself.
This is the second session of Deep Dive into Kubernetes. It includes information on optimizing Docker image size, persistent volumes, container security, and different aspects of running Kubernetes on GKE and AWS.
WSO2 API Manager Reference Architecture for Pivotal Cloud FoundryImesh Gunaratne
Â
This presentation includes an introduction to Pivotal Cloud Foundry (PCF) and How WSO2 API Manager can be deployed on PCF using a PCF Tile, BOSH release and a Service Broker.
Traditional virtualization technologies have been used by cloud infrastructure providers for many years in providing isolated environments for hosting applications. These technologies make use of full-blown operating system images for creating virtual machines (VMs). According to this architecture, each VM needs its own guest operating system to run application processes. More recently, with the introduction of the Docker project, the Linux Container (LXC) virtualization technology became popular and attracted the attention. Unlike VMs, containers do not need a dedicated guest operating system for providing OS-level isolation, rather they can provide the same level of isolation on top of a single operating system instance.
An enterprise application may need to run a server cluster to handle high request volumes. Running an entire server cluster on Docker containers, on a single Docker host could introduce the risk of single point of failure. Google started a project called Kubernetes to solve this problem. Kubernetes provides a cluster of Docker hosts for managing Docker containers in a clustered environment. It provides an API on top of Docker API for managing docker containers on multiple Docker hosts with many more features.
Software Delivery At the Speed of AI: Inflectra Invests In AI-Powered QualityInflectra
Â
In this insightful webinar, Inflectra explores how artificial intelligence (AI) is transforming software development and testing. Discover how AI-powered tools are revolutionizing every stage of the software development lifecycle (SDLC), from design and prototyping to testing, deployment, and monitoring.
Learn about:
• The Future of Testing: How AI is shifting testing towards verification, analysis, and higher-level skills, while reducing repetitive tasks.
• Test Automation: How AI-powered test case generation, optimization, and self-healing tests are making testing more efficient and effective.
• Visual Testing: Explore the emerging capabilities of AI in visual testing and how it's set to revolutionize UI verification.
• Inflectra's AI Solutions: See demonstrations of Inflectra's cutting-edge AI tools like the ChatGPT plugin and Azure Open AI platform, designed to streamline your testing process.
Whether you're a developer, tester, or QA professional, this webinar will give you valuable insights into how AI is shaping the future of software delivery.
Essentials of Automations: Optimizing FME Workflows with ParametersSafe Software
Â
Are you looking to streamline your workflows and boost your projects’ efficiency? Do you find yourself searching for ways to add flexibility and control over your FME workflows? If so, you’re in the right place.
Join us for an insightful dive into the world of FME parameters, a critical element in optimizing workflow efficiency. This webinar marks the beginning of our three-part “Essentials of Automation” series. This first webinar is designed to equip you with the knowledge and skills to utilize parameters effectively: enhancing the flexibility, maintainability, and user control of your FME projects.
Here’s what you’ll gain:
- Essentials of FME Parameters: Understand the pivotal role of parameters, including Reader/Writer, Transformer, User, and FME Flow categories. Discover how they are the key to unlocking automation and optimization within your workflows.
- Practical Applications in FME Form: Delve into key user parameter types including choice, connections, and file URLs. Allow users to control how a workflow runs, making your workflows more reusable. Learn to import values and deliver the best user experience for your workflows while enhancing accuracy.
- Optimization Strategies in FME Flow: Explore the creation and strategic deployment of parameters in FME Flow, including the use of deployment and geometry parameters, to maximize workflow efficiency.
- Pro Tips for Success: Gain insights on parameterizing connections and leveraging new features like Conditional Visibility for clarity and simplicity.
We’ll wrap up with a glimpse into future webinars, followed by a Q&A session to address your specific questions surrounding this topic.
Don’t miss this opportunity to elevate your FME expertise and drive your projects to new heights of efficiency.
Kubernetes & AI - Beauty and the Beast !?! @KCD Istanbul 2024Tobias Schneck
Â
As AI technology is pushing into IT I was wondering myself, as an “infrastructure container kubernetes guy”, how get this fancy AI technology get managed from an infrastructure operational view? Is it possible to apply our lovely cloud native principals as well? What benefit’s both technologies could bring to each other?
Let me take this questions and provide you a short journey through existing deployment models and use cases for AI software. On practical examples, we discuss what cloud/on-premise strategy we may need for applying it to our own infrastructure to get it to work from an enterprise perspective. I want to give an overview about infrastructure requirements and technologies, what could be beneficial or limiting your AI use cases in an enterprise environment. An interactive Demo will give you some insides, what approaches I got already working for real.
DevOps and Testing slides at DASA ConnectKari Kakkonen
Â
My and Rik Marselis slides at 30.5.2024 DASA Connect conference. We discuss about what is testing, then what is agile testing and finally what is Testing in DevOps. Finally we had lovely workshop with the participants trying to find out different ways to think about quality and testing in different parts of the DevOps infinity loop.
Accelerate your Kubernetes clusters with Varnish CachingThijs Feryn
Â
A presentation about the usage and availability of Varnish on Kubernetes. This talk explores the capabilities of Varnish caching and shows how to use the Varnish Helm chart to deploy it to Kubernetes.
This presentation was delivered at K8SUG Singapore. See https://feryn.eu/presentations/accelerate-your-kubernetes-clusters-with-varnish-caching-k8sug-singapore-28-2024 for more details.
LF Energy Webinar: Electrical Grid Modelling and Simulation Through PowSyBl -...DanBrown980551
Â
Do you want to learn how to model and simulate an electrical network from scratch in under an hour?
Then welcome to this PowSyBl workshop, hosted by Rte, the French Transmission System Operator (TSO)!
During the webinar, you will discover the PowSyBl ecosystem as well as handle and study an electrical network through an interactive Python notebook.
PowSyBl is an open source project hosted by LF Energy, which offers a comprehensive set of features for electrical grid modelling and simulation. Among other advanced features, PowSyBl provides:
- A fully editable and extendable library for grid component modelling;
- Visualization tools to display your network;
- Grid simulation tools, such as power flows, security analyses (with or without remedial actions) and sensitivity analyses;
The framework is mostly written in Java, with a Python binding so that Python developers can access PowSyBl functionalities as well.
What you will learn during the webinar:
- For beginners: discover PowSyBl's functionalities through a quick general presentation and the notebook, without needing any expert coding skills;
- For advanced developers: master the skills to efficiently apply PowSyBl functionalities to your real-world scenarios.
5. Virtual Machines Vs Containers
Linux Container Brief for IEEE WG P2302, Boden Russell
Hardware
Hypervisor
Virtual Machine
Operating
System
Bin/Lib
App App
Virtual Machine
Operating
System
Bin/Lib
App App
Hardware
Operating System
Hypervisor
Virtual Machine
Operating
System
Bin/Lib
App App
Virtual Machine
Operating
System
Bin/Lib
App App
Type 1 Hypervisor
(Bare Metal)
Type 2 Hypervisor
Hardware
Operating System
Linux Containers
Container
Bin/Lib
App
Container
Bin/Lib
App
Container Runtime
10. An Introduction to Kubernetes
Borg
Google’s first container
cluster manager
Omega
Google’s second container
cluster manager
Kubernetes
Google’s initiative to build
a general purpose
container cluster manager
12. kube-apiserver
â—Ź kube-apiserver exposes the Kubernetes API. It is the front-end for the
Kubernetes control plane. It is designed to scale horizontally – that
is, it scales by deploying more instances.
https://kubernetes.io/docs/concepts/overview/components/
13. etcd
● etcd is used as Kubernetes’ backing store. All cluster data is stored
here. Always have a backup plan for etcd’s data for your Kubernetes
cluster.
https://kubernetes.io/docs/concepts/overview/components/
14. kube-controller-manager
â—Ź kube-controller-manager runs controllers, which are the background
threads that handle routine tasks in the cluster. Logically, each
controller is a separate process, but to reduce complexity, they are
all compiled into a single binary and run in a single process.
â—Ź These controllers include:
â—‹ Node Controller: Responsible for noticing and responding when nodes go down.
â—‹ Replication Controller: Responsible for maintaining the correct number of pods
for every replication controller object in the system.
â—‹ Endpoints Controller: Populates the Endpoints object (that is, joins Services &
Pods).
â—‹ Service Account & Token Controllers: Create default accounts and API access
tokens for new namespaces.
https://kubernetes.io/docs/concepts/overview/components/
15. cloud-controller-manager
â—Ź cloud-controller-manager runs controllers that interact with the
underlying cloud providers. The cloud-controller-manager binary is
an alpha feature introduced in Kubernetes release 1.6.
â—Ź Extension points:
â—‹ Node Controller: For checking the cloud provider to determine if a node has been
deleted in the cloud after it stops responding
â—‹ Route Controller: For setting up routes in the underlying cloud infrastructure
â—‹ Service Controller: For creating, updating and deleting cloud provider load
balancers
â—‹ Volume Controller: For creating, attaching, and mounting volumes, and
interacting with the cloud provider to orchestrate volumes
https://kubernetes.io/docs/concepts/overview/components/
16. kube-scheduler
â—Ź kube-scheduler watches newly created pods that have no node
assigned, and selects a node for them to run on.
https://kubernetes.io/docs/concepts/overview/components/
17. DNS
â—Ź While the other addons are not strictly required, all Kubernetes
clusters should have cluster DNS, as many examples rely on it.
â—Ź Cluster DNS is a DNS server, in addition to the other DNS server(s) in
your environment, which serves DNS records for Kubernetes
services.
â—Ź Containers started by Kubernetes automatically include this DNS
server in their DNS searches.
https://kubernetes.io/docs/concepts/overview/components/
18. Overlay Network Options
https://kubernetes.io/docs/concepts/cluster-administration/networking/
â—Ź Cilium
â—Ź Contiv
â—Ź Contrail
â—Ź Flannel
â—Ź Google Compute Engine (GCE)
â—Ź Kube-router
â—Ź L2 networks and linux bridging
â—Ź Multus (a Multi Network plugin)
â—Ź NSX-T
â—Ź Nuage Networks VCS
(Virtualized Cloud Services)
â—Ź OpenVSwitch
â—Ź OVN (Open Virtual Networking)
â—Ź Project Calico
â—Ź Romana
â—Ź Weave Net from Weaveworks
â—Ź CNI-Genie from Huawei
20. Reference Architecture
Overlay Network
Pod 1 Pod 2
Service 1
Pod 3 Pod 4 Pod m
Service n
Deployments
Load Balancer
DB 1 DB 2 DB X
Persistent Volumes
HPAs
Pod Security Policies
Ingresses
Container Registry
Node1
Node2
Noden
Ingress Controller
21. WSO2 Docker Images
â—Ź WSO2 Docker images are built using standard Dockerfiles
â—Ź Default base image used is Ubuntu Server LTS
â—Ź Will only include:
â—‹ Oracle JDK 1.8
â—‹ JDBC Driver
â—‹ Latest product distribution
â—‹ Extensions, and Customizations
â—Ź Will not include:
â—‹ Configurations (Passed via ConfigMaps)
â—‹ Credentials (Passed via Secrets)
â—‹ Deployable Artifacts (Passed via ConfigMaps)
22. Container Orchestration
â—Ź Deployments will be used for
container orchestration
â—Ź Deployments will create replca sets
â—Ź Replica sets will internally create
pods
â—Ź Deployments will define health
checks for autohealing
â—Ź Horizontal pod autoscalers (HPA) will
be used for autoscaling
https://kubernetes.io/docs/concepts/workloads/controllers/deployment/
Pod 1 Pod 2
Service
Deployments
Container Registry
23. Service Discovery
â—Ź Kubernetes services will be used
for service discovery
â—Ź Each service will have a domain
name
â—Ź WSO2 components will use
services to talk to each other
(inter-component communication)
https://kubernetes.io/docs/concepts/services-networking/service/
Pod 1 Pod 2
Service 1
Pod 3 Pod 4
Service n
24. Cluster Discovery
â—Ź Carbon clustering is required for some of
the WSO2 components such as Analytics,
CEP, and IS
â—Ź WSO2 Kubernetes membership scheme is
used for auto discoverying members in
the cluster via the Kubernetes API or DNS
Pod 1 Pod 2
Service 1
Pod 2
Kubernetes API DNS
25. Runtime Artifact Synchronization
â—Ź WSO2 components such as Integrator,
BPS, API Gateway would require
synchronizing runtime artifacts
â—Ź The recommended approach for this is to
use a Network File System (NFS) and
share the repository/deployment/server
folder of pods via a persistent volume
https://kubernetes.io/docs/concepts/storage/persistent-volumes/
Pod 1 Pod 2
Service
Persistent Volume
Pod n
26. Configuration Management
â—Ź Each configuration folder will be
converted in to a ConfigMap and passed
in to the pod using a volume mount
â—Ź This approach makes the configuration
update process simpler
â—Ź Would not require to re-build the Docker
images
https://kubernetes.io/docs/concepts/storage/persistent-volumes/
Pod 1 Pod 2
Service
VolumesConfigMaps
27. Load Balancing
â—Ź Internal routing will use Kubernetes
services.
â—Ź External routing will use a load balancer
â—Ź Ingress definitions will be used to
automatically configure load balancers
via Ingress controllers.
â—Ź If required standard load balancers can
also be used with manual configurations.
https://kubernetes.io/docs/concepts/services-networking/ingress/
Pod 1 Pod 2
Service 1
Pod 3 Pod 4
Service n
Load Balancer
Ingresses
Ingress Controller
28. Autoscaling
â—Ź Autoscaling can be applied at two levels:
â—‹ Pod autoscaling
â—‹ Kubernetes cluster autoscaling
â—Ź Horizontal pod autoscalers (HPA) will be
used for autoscaling pods.
â—Ź Kubernetes cluster autoscaler will scale
the number of Kubernetes nodes
according to the number of pods being
scheduled.
https://kubernetes.io/docs/tasks/run-application/horizontal-pod-autoscale/
https://kubernetes.io/docs/tasks/administer-cluster/cluster-management/#cluster-autoscaling
Pod 1 Pod n
Service
Deployments
HPAs
29. Kubernetes Package Management
https://docs.helm.sh/
â—Ź A chart is a collection of files that describe a related set of
Kubernetes resources.
â—Ź A single chart might be used to deploy a simple pod or a
complex application.
â—Ź WSO2 plans to implement charts for WSO2 middleware.
â—Ź Charts can be managed in Helm repositories.
31. Security Best Practices
â—Ź Ensure container images are free of vulnerabilities
â—‹ Implement continuous security vulnerability scanning
â—‹ Regularly apply security updates
â—Ź Ensure that only authorized images are used in your environment
â—Ź Limit direct access to kubernetes nodes
â—Ź Create administrative boundaries between resources (using
namespaces)
â—Ź Define resource quota for pods
â—Ź Implement network segmentation when necessary (using network
policies)
â—Ź Log everything
http://blog.kubernetes.io/2016/08/security-best-practices-kubernetes-deployment.html
32. Container Security
â—Ź WSO2 containers use a nonroot user for starting the server
processes
â—Ź The WSO2 server filesystem will only have required levels of
persmissions in each directory
â—Ź Permissions to volume mounts will be granted via Pod
Security Policies
33. Pod Security Policies
â—Ź A Pod Security Policy is a cluster-level resource that controls
the actions that a pod can perform and what it has the ability
to access.
https://kubernetes.io/docs/concepts/policy/pod-security-policy/
34. Control Aspects of a Pod Security Policy
https://kubernetes.io/docs/concepts/policy/pod-security-policy/
Control Aspect Field Name
Running of privileged containers privileged
Default set of capabilities that will be added to a
container
defaultAddCapabilities
Capabilities that will be dropped from a container requiredDropCapabilities
Capabilities a container can request to be added allowedCapabilities
Controlling the usage of volume types volumes
The use of host networking hostNetwork
The use of host ports hostPorts
The use of host’s PID namespace hostPID
35. Control Aspects of a Pod Security Policy Cont.
https://kubernetes.io/docs/concepts/policy/pod-security-policy/
Control Aspect Field Name
The use of host’s IPC namespace hostIPC
The SELinux context of the container seLinux
The user ID runAsUser
Configuring allowable supplemental groups supplementalGroups
Allocating an FSGroup that owns the pod’s volumes fsGroup
Requiring the use of a read only root file system readOnlyRootFilesystem
Running of a container that allow privilege escalation
from its parent
allowPrivilegeEscalation
Control whether a process can gain more privileges than
its parent process
defaultAllowPrivilegeEscalation
40. Rolling Out Updates
â—Ź Execute a Kubernetes rollout for:
â—‹ WSO2 product updates
â—‹ WSO2 resource updates
â—‹ Or WSO2 configuration changes which are backward
compatible
â—Ź If the changes are not backward compatible:
â—‹ Execute a blue/green deployment
https://kubernetes.io/docs/concepts/workloads/controllers/deployment/
#rolling-update-deployment