book

Kubernetes – An Enterprise Guide - Second Edition

by Marc Boorshtein, Scott Surovich

December 2021

Intermediate to advanced

578 pages

14h 12m

English

Packt Publishing

Read now

Unlock full access

Who this book is forWhat this book coversTo get the most out of this bookGet in touch
Technical requirementsUnderstanding the need for containerizationUnderstanding why Kubernetes is deprecating DockerIntroducing DockerUnderstanding DockerContainers are ephemeralDocker imagesImage layersPersistent dataAccessing services running in containersInstalling DockerPreparing to install DockerInstalling Docker on UbuntuGranting Docker permissionsUsing the Docker CLIdocker helpdocker rundocker psdocker start and stopdocker attachdocker execdocker logsdocker rmSummaryQuestions
Technical requirementsIntroducing Kubernetes components and objectsInteracting with a clusterUsing development clustersWhy did we select KinD for this book?Working with a base KinD Kubernetes clusterUnderstanding the node imageKinD and Docker networkingKeeping track of the nesting dollsInstalling KinDInstalling KinD – prerequisitesInstalling kubectlInstalling the KinD binaryCreating a KinD clusterCreating a simple clusterDeleting a clusterCreating a cluster config fileMulti-node cluster configurationCustomizing the control plane and Kubelet optionsCreating a custom KinD clusterInstalling CalicoInstalling an Ingress controllerReviewing your KinD clusterKinD storage objectsStorage driversKinD storage classesUsing KinD's storage provisionerAdding a custom load balancer for IngressInstallation prerequisitesCreating the KinD cluster configurationDeploying a custom HAProxy containerUnderstanding HAProxy traffic flowSimulating a kubelet failureSummaryQuestions
Technical requirementsAn overview of Kubernetes componentsExploring the control planeThe Kubernetes API serverThe Etcd databasekube-schedulerkube-controller-managercloud-controller-managerUnderstanding the worker node componentskubeletkube-proxyContainer runtimeInteracting with the API serverUsing the Kubernetes kubectl utilityUnderstanding the verbose optionGeneral kubectl commandsIntroducing Kubernetes resourcesKubernetes manifestsWhat are Kubernetes resources?Reviewing Kubernetes resourcesConfigMapsEndpointsEventsNamespacesNodesPersistent Volume ClaimsPVsPodsReplication controllersResourceQuotasSecretsService accountsServicesCustomResourceDefinitionsDaemonSetsDeploymentsReplicaSetsStatefulSetsHorizontalPodAutoscalersCronJobsJobsIngressNetworkPoliciesPodSecurityPoliciesClusterRoleBindingsClusterRolesRoleBindingsRolesCSI driversCSI nodesStorage classesSummaryQuestions
Technical requirementsExposing workloads to requestsUnderstanding how services workCreating a serviceUsing DNS to resolve servicesUnderstanding different service typesThe ClusterIP serviceThe NodePort serviceThe LoadBalancer serviceThe ExternalName serviceIntroduction to load balancersUnderstanding the OSI modelLayer 7 load balancersName resolution and layer 7 load balancersUsing nip.io for name resolutionCreating Ingress rulesLayer 4 load balancersLayer 4 load balancer optionsUsing MetalLB as a layer 4 load balancerInstalling MetalLBUnderstanding MetalLB's configuration fileMetalLB componentsCreating a LoadBalancer serviceAdding multiple IP pools to MetalLBUsing multiple protocolsMultiple protocol issuesUsing multiple protocols with MetalLBUsing shared-IPsEnhancing load balancers for the enterpriseMaking service names available externallySetting up external-dnsIntegrating external-dns and CoreDNSAdding an ETCD zone to CoreDNSCreating a LoadBalancer service with external-dns integrationIntegrating CoreDNS with an enterprise DNSLoad balancing between multiple clustersIntroducing the Kubernetes Global BalancerRequirements for K8GBDeploying K8GB to a clusterUnderstanding K8GB load balancing optionsCustomizing the Helm chart valuesUsing Helm to install K8GBDeploying a highly available application using K8GBAdding an application to K8GB using custom resourcesAdding an application to K8GB using Ingress annotationsUnderstanding how K8GB provides global load balancingKeeping the K8GB CoreDNS servers in syncSummaryQuestions
Technical requirementsUnderstanding how Kubernetes knows who you areExternal usersGroups in KubernetesService accountsUnderstanding OpenID ConnectThe OpenID Connect protocolFollowing OIDC and the API's interactionid_tokenOther authentication optionsCertificatesService accountsTokenRequest APICustom authentication webhooksKeystoneConfiguring KinD for OpenID ConnectAddressing the requirementsUsing LDAP and Active Directory with KubernetesMapping Active Directory groups to RBAC RoleBindingsKubernetes Dashboard accessKubernetes CLI accessEnterprise compliance requirementsPulling it all togetherDeploying OpenUnisonConfiguring the Kubernetes API to use OIDCVerifying OIDC integrationUsing your tokens with kubectlIntroducing impersonation to integrate authentication with cloud-managed clustersWhat is Impersonation?Security considerationsConfiguring your cluster for impersonationTesting ImpersonationConfiguring Impersonation without OpenUnisonImpersonation RBAC policiesDefault groupsAuthenticating from pipelinesUsing tokensUsing certificatesAvoiding anti-patternsSummaryQuestions
Technical requirementsIntroduction to RBACWhat's a Role?Identifying a RoleRoles versus ClusterRolesNegative RolesAggregated ClusterRolesRoleBindings and ClusterRoleBindingsCombining ClusterRoles and RoleBindingsMapping enterprise identities to Kubernetes to authorize access to resourcesImplementing namespace multi-tenancyKubernetes auditingCreating an audit policyEnabling auditing on a clusterUsing audit2rbac to debug policiesSummaryQuestions
Technical requirementsHow does the dashboard know who you are?Dashboard architectureAuthentication methodsUnderstanding dashboard security risksDeploying an insecure dashboardUsing a token to log inDeploying the dashboard with a reverse proxyLocal dashboardsOther cluster-level applicationsIntegrating the dashboard with OpenUnisonSummaryQuestions
Technical requirementsIntroduction to dynamic admission controllersWhat is OPA and how does it work?OPA architectureRego, the OPA policy languageGatekeeperDeploying GatekeeperAutomated testing frameworkUsing Rego to write policiesDeveloping an OPA policyTesting an OPA policyDeploying policies to GatekeeperBuilding dynamic policiesDebugging RegoUsing existing policiesEnforcing memory constraintsEnabling the Gatekeeper cacheMocking up test dataBuilding and deploying our policyMutating objects and default valuesSummaryQuestions
Technical requirementsWhat is node security?Understanding the difference between containers and VMsContainer breakoutsProperly designing containersEnforcing node security with GateKeeperWhat about Pod security policies?What are the differences between PSPs and GateKeeper?Authorizing node security policiesDeploying and debugging node security policiesGenerating security context defaultsEnforcing cluster policiesDebugging constraint violationsScaling policy deployment in multi-tenant clustersSummaryQuestions

Technical requirementsExploring auditingIntroducing FalcoExploring Falco's configuration filesThe Helm Values fileCustomizing the Helm ValuesFalco rules config filesUnderstanding rulesUnderstanding conditions (fields and values)Using macrosUnderstanding listsCreating and appending to custom rulesEditing an existing ruleCreating a new ruleDeploying FalcoIntroducing FalcosidekickInstalling FalcosidekickUnderstanding KubelessInstalling KubelessDeploying a function using KubelessIntroducing DevOPs AIUnderstand automatic responses to eventsDeploy the NGINX server and test connectivitySimulating an attack on the PodObserving Falco eventsUsing Falcosidekick-uiDeploying our logging systemCreating a new namespaceDeploying the ECK operatorDeploying Elasticsearch, Filebeat, and KibanaUsing the components ECK to view logsCreating a Kibana indexBrowsing for eventsVisualizationsCreating a dashboardCreating a visualization for Falco event typesSummaryQuestions
Technical requirementsUnderstanding Kubernetes backupsPerforming an etcd backupBacking up the required certificatesBacking up the etcd databaseIntroducing and setting up VMware's VeleroVelero requirementsInstalling the Velero CLIInstalling VeleroBackup storage locationDeploying MinIOExposing MinIO and the consoleCreating the S3 target configurationUsing Velero to back up workloadsRunning a one-time cluster backupScheduling a cluster backupCreating a custom backupManaging Velero using the CLIUsing common Velero commandsListing Velero objectsRetrieving details for a Velero objectCreating and deleting objectsRestoring from a backupRestoring in actionRestoring a deployment from a backupBacking up the namespaceSimulating a failureRestoring a namespaceUsing a backup to create workloads in a new clusterBacking up the clusterBuilding a new clusterRestoring a backup to the new clusterInstalling Velero in the new clusterRestoring a backup in a new clusterDeleting the new clusterSummaryQuestions
Technical requirementsWhy should you care about a service mesh?Workload observabilityTraffic managementBlue/Green DeploymentsCanary DeploymentsFinding issues before they happenSecurityIntroduction to Istio conceptsUnderstanding the Istio componentsMaking the Control Plane Simple with IstiodBreaking down the istiod podUnderstanding the istio-ingressgatewayUnderstanding the istio-egressgatewayInstalling IstioDownloading IstioInstalling Istio using a ProfileIntroducing Istio resourcesAuthorization policiesExample 1: Denying and allowing all accessExample 2: Allowing only GET methods to a workloadExample 3: Allowing requests from a specific sourceGatewaysVirtual ServicesDestination rulesPeer authenticationsRequest authenticationService entriesSidecarsEnvoy filtersDeploying add-on components to provide observabilityInstalling PrometheusInstalling JaegerInstalling KialiDeploying an application into the service meshDeploying your first application into the meshUsing Kiali to observe mesh workloadsThe Kiali overview screenUsing the Graph viewUsing the Application viewUsing the Workloads viewUsing the Services viewThe Istio config viewSummaryQuestions
Technical requirementsComparing microservices and monolithsMy history with microservices versus monolithic architectureComparing architectures in an applicationMonolithic application designMicroservices designChoosing between monoliths and microservicesUsing Istio to help manage microservicesDeploying a monolithExposing our monolith outside our clusterConfiguring sticky sessionsIntegrating Kiali and OpenUnisonBuilding a microserviceDeploying Hello WorldIntegrating authentication into our serviceAuthorizing access to our serviceTelling your service who's using itAuthorizing user entitlementsAuthorizing in serviceUsing OPA with IstioCalling other servicesUsing OAuth2 Token ExchangePassing tokens between servicesUsing simple impersonationDo I need an API gateway?SummaryQuestions
Technical requirementsDesigning a pipelineOpinionated platformsSecuring your pipelineBuilding our platform's requirementsChoosing our technology stackPreparing our clusterDeploying cert-managerDeploying the Docker container registryDeploying OpenUnison and GateKeeperDeploying GitLabCreating example projectsDeploying TektonBuilding Hello WorldBuilding automaticallyDeploying ArgoCDAutomating project onboarding using OpenUnisonDesigning a GitOps strategyIntegrating GitLabIntegrating the TektonCD dashboardIntegrating ArgoCDUpdating OpenUnisonDeploying an applicationCreating the application in KubernetesGetting access to developersDeploying dev manifestsDeploying a Tekton pipelineRunning our pipelinePromoting to productionSummaryQuestions

Content preview from Kubernetes – An Enterprise Guide - Second Edition

14 Provisioning a Platform

Every chapter in this book, up until this point, has focused on the infrastructure of your cluster. We have explored how to deploy Kubernetes, how to secure it, and how to monitor it. What we haven't talked about is how to deploy applications.

In this, our final chapter, we're going to work on building an application deployment platform using what we've learned about Kubernetes. We're going to build our platform based on some common enterprise requirements. Where we can't directly implement a requirement, because building a platform on Kubernetes can fill its own book, we'll call it out and provide some insights.

In this chapter, we will cover the following topics: