10 Kube Commandments

Size: px

Start display at page:

Download "10 Kube Commandments"

Godfrey Johns
5 years ago
Views:

1 10 Kube Commandments

2 We've been in the game for years

3 That in itself is admirable

4 There's rules to this biz

5 We wrote y'all a manual

6 A step-by-step conf talk for you to get...

7 Your clusters on track

8 And not your releases pushed back

9 Bryan Liles Staff Software Engineer Heptio Lots of years Years of

10 Carlos Amedee Senior Software Engineer DigitalOcean Observability Cloud Compute Services Systems

11 Rule Number Uno To go fast, you must start slow

12 Rule Number Uno To go fast, you must start deliberately

13 Public Cloud Datacenter Your Desktop

14 Public Cloud Datacenter Your Desktop GKE on Google Cloud AKS on Azure *lots of vendors* kubeadm *lots of vendors* Minikube Minik8s Docker for Mac or Windows

15 Not Declarative Public Cloud Datacenter X GKE on Google Cloud AKS on Azure *lots of vendors* X kubeadm *lots of vendors*

16 Cluster API

17 Number Two Always let them know your next move

18 Your next move is the images you'll deploy to your cluster

19 Build Image Host Image

20 docker build

21 docker build buildah img GCP Container Builder

22 Why are you still building your containers with root privileges?

23 Rule Number Three Never trust nobody: Hookup up that Pod Security Policy

24 apiversion: extensions/v1beta1 kind: PodSecurityPolicy metadata: name: how-not-to-get-robbed spec: privileged: false runasuser: rule: MustRunAsNonRoot selinux: rule: RunAsAny fsgroup: rule: RunAsAny supplementalgroups: rule: RunAsAny volumes: - nfs

25 Number Four I know you heard this before: Never get high off what Kube supplies

26 Custom Resource Definition CRD Custom Controller

27 Custom Resources Pattern K8s External Resource CRD Custom Controller Native Resource

28 Custom Resources Pattern CRD Custom Controller Operator

29 Custom Resources Pattern Native Resource CRD Custom Controller Native Resource Native Resource

30 Rule Number Five Communicating With Pods Never Mix Internal and External Traffic

31 Ingress Traffic

32 Cluster IP apiversion: v1 kind: Service metadata: name: sample-service spec: selector: app: sample-app type: ClusterIP ports: - name: http port: 80 targetport: 80 protocol: TCP Pod Proxy Service Pod Pod

33 Node Port Service apiversion: v1 kind: Service metadata: name: my-nodeport-service spec: selector: app: my-app type: NodePort ports: - name: http port: 80 targetport: 80 nodeport: protocol: TCP Pod Pod Pod Pod

34 Load Balancer Load Balancer apiversion: v1 kind: Service metadata: name: sample-lb spec: selector: app: some-app type: LoadBalancer ports: - name: http port: 80 targetport: 80 protocol: TCP Pod Service Pod Pod

35 Ingress apiversion: extensions/v1beta1 kind: Ingress metadata: name: my-ingress spec: backend: servicename: other serviceport: 8080 rules: - host: foo.mydomain.com http: paths: - backend: servicename: foo serviceport: host: mydomain.com http: paths: - path: /bar/* backend: servicename: bar serviceport: 8080 Pod Service Pod Pod Ingress Pod Service Pod Pod

36 Egress Traffic

37 Egress apiversion: networking.k8s.io/v1 kind: NetworkPolicy metadata: name: sample-network-policy spec: podselector: matchlabels: role: my-app policytypes: - Egress egress: - to: - ipblock: cidr: /24

38 Service Mesh

39 Rule Number Six If You Think You Know What s Happening In Your Cluster Forget it.

40 Observability What s happening in your cluster?

41 What s happening on your cluster?

42 Metrics and Alerting

43 Logging

44 Distributed Tracing

45 Observability Dashboard

46 Horizontal Pod Autoscaler

47 Rule Number Seven Keep your storage and the business rules to manage it completely separated.

48 Storage

49 Easily create your own storage implementation

50 Persistent Volume Snapshots

51 Number 8: Using Tools

52 Package Management Configuration Management

53 Package Management Helm 2 Bounds of YAML

54 Configuration Management ksonnet Pulumi Ballerina

56 Other types of tools? skaffold kustomize

57 Number 9: Extending Kubernetes

58 What happens if you get an API for free?

59 What happens when you outgrow the Kubernetes API?

60 Number 10: A live word called refinement -- Building On Kubernetes

61 App 1 App 2 App 3 Cluster "On top of Kubernetes"

62 App 1 App 2 App 3 Cluster "On Kubernetes"

63 Follow these rules

64 You'll have mad bread to break up

65 If not, 24 hours of on-call with constant wake ups.

Life of a Packet. KubeCon Europe Michael Rubin TL/TLM in GKE/Kubernetes github.com/matchstick. logo. Google Cloud Platform

Life of a Packet. KubeCon Europe Michael Rubin TL/TLM in GKE/Kubernetes github.com/matchstick. logo. Google Cloud Platform logo Life of a Packet KubeCon Europe 2017 Michael Rubin TL/TLM in GKE/Kubernetes github.com/matchstick Google Cloud Platform Kubernetes is about clusters Because of that, networking