book

The Kubernetes Bible

Name: The Kubernetes Bible
ISBN: 9781838827694

by Nassim Kebbani, Piotr Tylenda, Russ McKendrick

February 2022

Intermediate to advanced

680 pages

14h 22m

English

Packt Publishing

Read now

Unlock full access

THE KUBERNETES BIBLE
ContributorsAbout the authorsAbout the reviewer
Preface
Who this book is forWhat this book coversTo get the most out of this bookDownload the example code filesDownload the color imagesConventions usedGet in touchShare Your Thoughts
Section 1: Introducing Kubernetes
Chapter 1: Kubernetes Fundamentals
Understanding monoliths and microservicesUnderstanding the growth of the internet since the late 1990sUnderstanding the need for more frequent software releasesUnderstanding the organizational shift to agile methodologiesUnderstanding the shift from on-premises to the cloudUnderstanding why the cloud is well suited for scalabilityExploring the monolithic architectureExploring the microservices architectureChoosing between monolithic and microservices architecturesUnderstanding containers and DockerUnderstanding why Docker is good for microservicesUnderstanding the benefit of Docker container isolationHow can Kubernetes help you to manage your Docker containers?Understanding that Kubernetes is meant to use Docker in productionExploring the problems that Kubernetes solvesEnsuring high availabilityRelease management and container deploymentAutoscaling containersWhen and where is Kubernetes not the solution?Understanding the history of KubernetesUnderstanding how and where Kubernetes startedWho manages Kubernetes today?Where is Kubernetes today?Summary
Chapter 2: Kubernetes Architecture – From Docker Images to Running Pods
Understanding the difference between the master and worker nodesThe kube-apiserver componentThe role of kube-apiserverHow do you install kube-apiserver?Where do you install kube-apiserver?Exploring the kubectl command-line tool and YAML syntaxThe role of kubectl How does kubectl work?The YAML syntaxkubectl should be installed on any machine that needs to interact with the clusterThe Etcd datastoreThe role of the Etcd datastoreWhere do you install Etcd?The Kubelet and worker node componentsThe Kubelet agentThe kube-proxy componentThe kube-scheduler componentThe role of the kube-scheduler componentWhere do you install kube-scheduler?The kube-controller-manager componentThe role of the kube-controller-manager componentWhere do you install kube-controller-manager?How to make Kubernetes highly availableThe single-node clusterThe single-master clusterThe multi-master multi-node clusterSummary
Chapter 3: Installing Your First Kubernetes Cluster
Technical requirements Installing a single-node cluster with MinikubeLaunching a single-node Kubernetes cluster using MinikubeStopping and deleting the local Minikube clusterLaunching a multi-node Kubernetes cluster with KindInstalling Kind onto your local systemStopping and deleting the local Kind clusterInstalling a Kubernetes cluster using Google GKELaunching a multi-node Kubernetes cluster on Google GKEStopping and deleting a Kubernetes cluster on Google GKEInstalling a Kubernetes cluster using Amazon EKSLaunching a multi-node Kubernetes cluster on Amazon EKSDeleting the Kubernetes cluster on Amazon EKSInstalling a Kubernetes cluster using Azure AKSLaunching a multi-node Kubernetes cluster on Azure AKSStopping and deleting a Kubernetes cluster on Azure AKSSummary
Section 2: Diving into Kubernetes Core Concepts
Chapter 4: Running Your Docker Containers
Technical requirementsLet's explain the notion of PodsEach Pod gets an IP addressHow you should design your PodsLaunching your first PodsCreating a Pod with imperative syntaxCreating a Pod with declarative syntaxReading the Pod's information and metadataListing the objects in JSON or YAML Backing up your resource using the list operationGetting more information from the list operationAccessing a Pod from the outside worldEntering a container inside a PodDeleting a PodLabeling and annotating the PodsWhat are labels and why do we need them?What are annotations and how do they differ from labels?Adding a label Listing labels attached to a PodAdding or updating a label to/of a running PodDeleting a label attached to a running PodAdding an annotation Launching your first jobWhat are jobs?Creating a job with restartPolicyUnderstanding the job's backoffLimitRunning a task multiple times using completionsRunning a task multiple times in parallelTerminating a job after a specific amount of timeWhat happens if a job succeeds?Deleting a jobLaunching your first CronjobWhat are Cronjobs?Creating your first CronjobUnderstanding the scheduleUnderstanding the role of the jobTemplate sectionControlling the Cronjob execution deadlineManaging the history limits of jobsCreating a CronjobDeleting a CronjobSummary
Chapter 5: Using Multi-Container Pods and Design Patterns
Technical requirementsUnderstanding what multi-container Pods areConcrete scenarios where you need multi-container PodsWhen not to create a multi-container PodCreating a Pod made up of two containersWhat happens when Kubernetes fails to launch one container in a Pod?Deleting a multi-container PodUnderstanding the Pod deletion grace periodAccessing a specific container inside a multi-container PodRunning commands in containersOverriding the default commands run by your containersIntroducing initContainersAccessing the logs of a specific containerSharing volumes between containers in the same PodWhat are Kubernetes volumes?Creating and mounting an emptyDir volumeCreating and mounting a hostPath volumeThe ambassador design patternWhat is the ambassador design pattern?A simple example of an ambassador multi-container PodThe sidecar design patternWhat is the sidecar design pattern?A simple example of a sidecar multi-container PodThe adapter design patternWhat is the adapter design pattern?A simple example of an adapter multi-container PodSummary
Chapter 6: Configuring Your Pods Using ConfigMaps and Secrets
Technical requirementsUnderstanding what ConfigMaps and Secrets areDecoupling your application and your configurationUnderstanding how Pods consume ConfigMaps and Secrets Configuring your Pods using ConfigMapsListing ConfigMapsCreating a ConfigMapCreating a ConfigMap from literal values Storing entire configuration files in a ConfigMap Creating a ConfigMap from an env file Reading values inside a ConfigMapLinking ConfigMaps as environment variablesMounting a ConfigMap as a volume mountDeleting a ConfigMapUpdating a ConfigMapManaging sensitive configuration with the Secret objectListing Secrets Creating a Secret imperatively with --from-literalCreating a Secret declaratively with a YAML fileCreating a Secret with content from a fileReading a SecretConsuming a Secret as an environment variableConsuming a Secret as a volume mountDeleting a SecretUpdating a SecretSummary

Chapter 7: Exposing Your Pods with Services
Technical requirementsWhy would you want to expose your Pods? Understanding Pod IP assignmentUnderstanding Pod IP assignment is dynamicNever hardcode a pod's IP addresses in your application codeUnderstanding how services route traffic to Pods Understanding round-robin load balancing in Kubernetes Understanding how to call a service in Kubernetes Understanding how DNS names are generated for servicesHow services get a list of the Pods they service traffic toUsing the dnsutils Docker image to debug your servicesWhy you shouldn't use the --expose flagUnderstanding how DNS names are generated for servicesUnderstanding the different types of services The NodePort serviceWhy do you need NodePort services?Creating two containous/whoami PodsUnderstanding NodePort YAML definitionMaking sure NodePort works as expected Is this setup production-ready?Listing NodePort servicesAdding more Pods to NodePort servicesDescribing NodePort servicesDeleting NodePort servicesNodePort or kubectl port-forward?The ClusterIP serviceWhy do you need ClusterIP services?How do I know if I need NodePort or ClusterIP services to expose my Pods?Listing ClusterIP servicesCreating ClusterIP services using the imperative wayDescribing ClusterIP servicesCreating ClusterIP services using the declarative wayDeleting ClusterIP servicesUnderstanding headless servicesThe LoadBalancer serviceExplaining the LoadBalancer servicesShould I use the LoadBalancer service type?Implementing ReadinessProbeWhy do you need ReadinessProbe?Implementing ReadinessProbeWhat is LivenessProbe and why do you need it?Implementing LivenessProbeUsing ReadinessProbe and LivenessProbe togetherSecuring your Pods using the NetworkPolicy object Why do you need NetworkPolicy?Understanding Pods are not isolated by defaultConfiguring NetworkPolicy with labels and selectors Summary
Chapter 8: Managing Namespaces in Kubernetes
Technical requirementsIntroduction to Kubernetes namespacesWhy do you need namespaces?How namespaces are used to split resources into chunksUnderstanding default namespacesHow namespaces impact your resources and servicesListing namespaces inside your clusterRetrieving the data of a specific namespaceCreating a namespace using imperative syntaxCreating a namespace using declarative syntaxDeleting a namespaceCreating a resource inside a namespace with the -n optionListing resources inside a specific namespaceListing all the resources inside a specific namespaceUnderstanding that names are scoped to a namespaceUnderstanding that not all resources are in a namespaceResolving a service using namespacesSwitching between namespaces with kubectlDisplaying the current namespace with kubectlConfiguring ResourceQuota and Limit at the namespace levelUnderstanding why you should set ResourceQuota Understanding how Pods consume these resourcesUnderstanding how Pods can require computing resourcesUnderstanding how you can limit resource consumptionUnderstanding why you need ResourceQuota Creating a ResourceQuotaListing ResourceQuotaDeleting ResourceQuotaIntroducing LimitRangeListing LimitRangeDeleting LimitRangeSummary
Chapter 9: Persistent Storage in Kubernetes
Technical requirementsWhy you would want to use PersistentVolumeIntroducing PersistentVolumesIntroducing PersistentVolume typesThe benefits brought by PersistentVolume Introducing access modesUnderstanding that not all access modes are available to all PersistentVolume typesCreating our first PersistentVolumeHow does Kubernetes PersistentVolumes handle cloud-based storage? Amazon EBS PersistentVolume YAML GCE PersistentDisk PersistentVolume YAML NFS PersistentVolume YAML Can Kubernetes handle the provisioning or creation of the resource itself?Understanding how to mount a PersistentVolume to your Pod claimsIntroducing PersistentVolumeClaimSplitting storage creation and storage consumptionThe summarized PersistentVolume workflowCreating a Pod with a PersistentVolumeClaim objectUnderstanding the life cycle of a PersistentVolume object in Kubernetes Understanding that PersistentVolume objects are not bound to namespacesReclaiming a PersistentVolume objectUpdating a reclaim policyUnderstanding PersistentVolume and PersistentVolumeClaims statusesStatic and dynamic PersistentVolume provisioningStatic versus dynamic provisioningIntroducing dynamic provisioningIntroducing StorageClassesUnderstanding the role of PersistentVolumeClaim for dynamic storage provisioningSummary
Section 3: Using Managed Pods with Controllers
Chapter 10: Running Production-Grade Kubernetes Workloads
Technical requirements Ensuring HA and FT on KubernetesHigh AvailabilityFault ToleranceHA and FT for Kubernetes applicationsWhat is ReplicationController?Creating a ReplicationController objectTesting the behavior of ReplicationControllerScaling ReplicationControllerDeleting ReplicationControllerWhat is ReplicaSet and how does it differ from ReplicationController?Creating a ReplicaSet objectTesting the behavior of ReplicaSetScaling ReplicaSetUsing Pod liveness probes together with ReplicaSetDeleting a ReplicaSet objectSummaryFurther reading
Chapter 11: Deployment – Deploying Stateless Applications
Technical requirements Introducing the Deployment objectCreating a Deployment objectExposing Deployment Pods using Service objectsScaling a Deployment objectDeleting a Deployment objectHow does a Deployment object manage revisions and version rollout?Updating a Deployment objectRolling back a Deployment objectDeployment object best practicesUse declarative object management for DeploymentsDo not use the Recreate strategy for production workloadsDo not create Pods that match an existing Deployment label selectorCarefully set up your container probesUse meaningful and semantic image tagsMigrating from older versions of KubernetesSummaryFurther reading
Chapter 12: StatefulSet – Deploying Stateful Applications
Technical requirementsIntroducing the StatefulSet objectManaging state in containersManaging state in Kubernetes PodsStatefulSet and how it differs from a Deployment objectManaging StatefulSetCreating a StatefulSetUsing the headless Service and stable network identitiesState persistenceScaling StatefulSetDeleting a StatefulSetReleasing a new version of an app deployed as a StatefulSetUpdating StatefulSetRolling back StatefulSetStatefulSet best practicesUse declarative object management for StatefulSetsDo not use the TerminationGracePeriodSeconds Pod with a 0 value for StatefulSetsScale down StatefulSets before deletingEnsure state compatibility during StatefulSet rollbacksDo not create Pods that match an existing StatefulSet label selectorSummaryFurther reading
Chapter 13: DaemonSet – Maintaining Pod Singletons on Nodes
Technical requirements Introducing the DaemonSet objectCreating and managing DaemonSetsCreating a DaemonSetModifying a DaemonSetDeleting a DaemonSetCommon use cases for DaemonSetsAlternatives to DaemonSetsSummaryFurther reading
Section 4: Deploying Kubernetes on the Cloud
Chapter 14: Kubernetes Clusters on Google Kubernetes Engine
Technical requirementsWhat are GCP and GKE?Google Cloud PlatformGoogle Kubernetes EnginePreparing your environmentSigning up for a GCP accountCreating a projectInstalling the GCP command-line interfaceLaunching your first GKE clusterDeploying a workload and interacting with your clusterConfiguring your local clientLaunching an example workloadExploring Google Cloud ConsoleDeleting your clusterMore about cluster nodesSummaryFurther reading
Chapter 15: Launching a Kubernetes Cluster on Amazon Web Services with Amazon Elastic Kubernetes Service
Technical requirementsWhat are AWS and Amazon EKS?AWSAmazon EKSPreparing your local environmentSigning up for an AWS accountInstalling the AWS command-line interface Installing eksctl, the official CLI for Amazon EKSLaunching your Amazon EKS clusterDeploying a workload and interacting with your clusterDeploying the workloadExploring the AWS consoleDeleting your Amazon EKS clusterSummaryFurther reading
Chapter 16: Kubernetes Clusters on Microsoft Azure with Azure Kubernetes Service
Technical requirementsWhat are Microsoft Azure and AKS?Microsoft AzureAKSPreparing your local environmentThe Azure CLILaunching your AKS clusterDeploying a workload and interacting with your clusterLaunching the workloadExploring the Azure portalDeleting your AKS clusterSummaryFurther reading
Section 5: Advanced Kubernetes
Chapter 17: Working with Helm Charts
Technical requirements Understanding HelmReleasing software to Kubernetes using HelmInstalling Helm on UbuntuInstalling Helm on WindowsInstalling Helm on macOSDeploying an example chartHelm chart anatomyInstalling popular solutions using Helm chartsKubernetes DashboardElasticsearch with KibanaPrometheus with GrafanaSummaryFurther reading
Chapter 18: Authentication and Authorization on Kubernetes
Technical requirements Authentication and user managementStatic token filesServiceAccount tokensX.509 client certificatesOpenID Connect tokensOther methodsAuthorization and introduction to RBACRBAC mode in KubernetesAzure Kubernetes Service and Azure Active Directory integrationPrerequisitesDeploying a managed AKS cluster with AAD and Azure RBAC integrationAccessing the AKS cluster with AAD integration enabledUsing Azure RBAC for an AKS clusterSummaryFurther reading
Chapter 19: Advanced Techniques for Scheduling Pods
Technical requirements Refresher – What is kube-scheduler?Managing Node affinityPod Node namePod Node selectorNode affinity configuration for PodsUsing Node taints and tolerationsScheduling policiesSummaryFurther reading
Chapter 20: Autoscaling Kubernetes Pods and Nodes
Technical requirements Pod resource requests and limitsAutoscaling Pods vertically using a Vertical Pod AutoscalerEnabling a VPA in GKEEnabling a VPA for other Kubernetes clustersUsing a VPAAutoscaling Pods horizontally using a Horizontal Pod AutoscalerUsing an HPAAutoscaling Kubernetes Nodes using a Cluster AutoscalerEnabling the cluster autoscaler in GKEEnabling the cluster autoscaler in the Amazon Elastic Kubernetes ServiceEnabling the cluster autoscaler in the Azure Kubernetes ServiceUsing the cluster autoscalerSummaryFurther reading
Chapter 21: Advanced Traffic Routing with Ingress
Technical requirements Refresher: Kubernetes servicesThe ClusterIP ServiceNodePort serviceThe LoadBalancer serviceIntroducing the Ingress objectUsing nginx as an Ingress ControllerAzure Application Gateway Ingress Controller for AKSSummaryFurther reading
Why subscribe?
Other Books You May EnjoyPackt is searching for authors like youShare Your Thoughts

Content preview from The Kubernetes Bible

Chapter 18: Authentication and Authorization on Kubernetes

In software systems, authentication and authorization play a significant role in providing security. These terms may seem similar but they are very different security processes that work together to provide identity and access management. In short, authentication determines whether a given user of a system is indeed who they claim to be – the easiest way to visualize this is using a username and password to complete an authentication process. Authorization, on the other hand, determines what the user can and cannot do or access in the system. This also means that in secure systems, authentication is the first step and authorization must always follow authentication. One of the approaches ...

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.

Read now

Unlock full access

More than 5,000 organizations count on O’Reilly

O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.

Julian F.

Head of Cybersecurity

I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.

Addison B.

Field Engineer

I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.

Amir M.

Data Platform Tech Lead

I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.

Mark W.

Embedded Software Engineer

Publisher Resources

ISBN: 9781838827694

Cloud Computing

Data Engineering

Data Science

AI & ML

Programming Languages

Software Architecture

IT/Ops

Security

Design

Business

Soft Skills

The Kubernetes Bible

by Nassim Kebbani, Piotr Tylenda, Russ McKendrick

Chapter 18: Authentication and Authorization on Kubernetes

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.