DEVOPS IN ADVANCE

Kubernetes administration
 Kubernetes administration
Docker infrastructure in advance

Core concepts

Scheduling

Cluster Monitoring

Agenda Cluster Security

Storage

Networking

Design and Install

Troubleshooting
Docker infrastructure in Kubernetes administration
advance:
Docker network
4 Network types:
• Bridge (default)
• Host
• Overlay
• ipvlan
Docker infrastructure in Kubernetes administration
advance:
Docker network
bridge:
Docker infrastructure in Kubernetes administration
advance:
Docker network

host:
Docker infrastructure in Kubernetes administration
advance:
Docker network
Overlay:
Docker infrastructure in Kubernetes administration
advance:
Docker network

ipvlan:
Docker infrastructure in Kubernetes administration
advance:
Docker storage
Docker infrastructure in Kubernetes administration
advance:
Docker storage
Docker infrastructure in Kubernetes administration
advance:
Docker storage
Docker infrastructure in Kubernetes administration
advance:
Docker storage
Core concepts: Kubernetes administration
 Core concepts: Kubernetes administration

Resources:
Foundations: Workloads: Networking:
• Namespace • Deployment/replicaset • Service
• Pod • StatefulSet • DNS record
• DaemonSet • Ingress/Ingress Controllers
• Job/CronJob • Network policy

Storage: Others
• Volume • ConfigMaps
• Storage class • Secret
• Persistent volume • Resource quotas
• Persistent volume claim • Custom resources definition
 Scheduling: Kubernetes administration

Scheduling refers to making sure that Pods are matched to Nodes so that Kubelet can run
them
Kube-scheduler is the default scheduler for Kubernetes and runs as part of the control-
plane. Kube-scheduler is designed so that, if you want and need to, you can write your
own scheduling component and use that instead

Kube-scheduler selects a node for the pod in a 2-step operation:

1.Filtering - finds the set of Nodes where it's feasible to schedule the Pod
2.Scoring - ranks the remaining nodes to choose the most suitable Pod
placement
 Scheduling: Kubernetes administration

Scheduling profile
• Can customize the behavior of the kube-scheduler by writing a
configuration file and passing its path as a command line
argument.
• A scheduling Profile allows you to configure the different stages of
scheduling in the kube-scheduler.
 Scheduling: Kubernetes administration

Labels and Selector:

• Labels are key/value pairs that are attached to objects
• Many objects can carry the same label(s).
• Via a label selector, the client/user can identify a set of objects
 Scheduling: Kubernetes administration

Labels and Selector:

2 types of selectors:

equality-based set-based
Scheduling: Kubernetes administration

NodeName:

No scheduling Scheduling with selecting a node name

 Scheduling: Kubernetes administration

NodeSelector:
Scheduling with selecting node(s) by using label(s)
 Scheduling: Kubernetes administration

Affinity and anti-affinity:

Expands the types of constraints you can define:
• More control over the selection logic with labels.
• A rule can be soft or preferred, so that the scheduler still schedules the Pod even if it
can't find a matching node.
• Can constrain a Pod using labels on other Pods running on the node (or other
topological domain), instead of just node labels, which allows you to define rules for
which Pods can be co-located on a node.
 Scheduling: Kubernetes administration

Affinity and anti-affinity:

2 types:
• Node affinity:
 requiredDuringSchedulingIgnoredDuringExecution for node
 preferredDuringSchedulingIgnoredDuringExecution for node
• Inter-pod affinity/anti-affinity
 requiredDuringSchedulingIgnoredDuringExecution for pod
 preferredDuringSchedulingIgnoredDuringExecution for pod
 Scheduling: Kubernetes administration

Affinity and anti-affinity:

2 types:
• Node affinity:
 requiredDuringSchedulingIgnoredDuringExecution for node
 preferredDuringSchedulingIgnoredDuringExecution for node
• Inter-pod affinity/anti-affinity
 requiredDuringSchedulingIgnoredDuringExecution for pod
 preferredDuringSchedulingIgnoredDuringExecution for pod
 Scheduling: Kubernetes administration

Taints and tolerations :

Taints - allow a node to repel a set of pods.
Tolerations - allow the scheduler to schedule
pods with matching taints but don't
guarantee scheduling
Taints and tolerations work together to
ensure that pods are not scheduled onto
inappropriate nodes. One or more taints are
applied to a node; this marks that the node
should not accept any pods that do not
tolerate the taints
 Scheduling: Kubernetes administration

Taints and tolerations :

Use cases:
• Dedicated Nodes
• Nodes with Special Hardware
• Taint based Evictions
Scheduling: Kubernetes administration

Pod topology spread constraints:

 Scheduling: Kubernetes administration

Resources management:
• CPU ( Request and limits - Burstable)
• RAM ( Request and limits - Burstable)
 Scheduling: Kubernetes administration

Resources management:

• Storage (ephemeral / Request and limits)

 Scheduling: Kubernetes administration

Static PODs:
• Managed directly by the kubelet daemon on a specific
node, without the API server observing them. The
kubelet watches each static Pod (and restarts it if it
fails).
• Static Pods are always bound to one kubelet on a
specific node
 Kubernetes administration
Cluster maintenance:

OS Upgrades and Patching

Manual for each node:
• Cordon node
• Drain node
• Upgrade or patch it
• Un-cordon node
 Kubernetes administration
Cluster maintenance:
Kubernetes version
 Kubernetes administration
Cluster maintenance:
Cluster Upgrade Process

Manual for each cluster:

• Upgrade masters (control plane)
• Upgrade the nodes
• Upgrade clients such as kubectl
• Adjust manifests and other resources
 Kubernetes administration
Cluster maintenance:
Backup and Restore
Resource candidate
 Kubernetes administration
Cluster Security:

Security basics
• Password based authentication disabled and use SSH Key based authentication instead

Who can access What can they do

• Files – Username and Passwords • RBAC Authorization
• Files – Username and Tokens • ABAC Authorization
• Certificates • Node Authorization
• External Authentication providers - LDAP • Webhook Mode
• Service Accounts
 Kubernetes administration
Cluster Security:
TLS in Kubernetes
 Kubernetes administration
Cluster Security:
TLS in Kubernetes
 Kubernetes administration
Cluster Security:
TLS in Kubernetes
 Kubernetes administration
Cluster Security:
KubeConfig File
 Cluster Security: Kubernetes administration

RBAC in Kubernetes
 Cluster Security: Kubernetes administration

RBAC in Kubernetes
 Cluster Security: Kubernetes administration

RBAC in Kubernetes
Role and ClusterRole

An RBAC Role or ClusterRole contains rules that represent a set of

permissions. Permissions are purely additive (there are no "deny" rules).
A Role always sets permissions within a particular namespace; when you create a
Role, you have to specify the namespace it belongs in.
ClusterRole, by contrast, is a non-namespaced resource. The resources have
different names (Role and ClusterRole) because a Kubernetes object always has to be
either namespaced or not namespaced; it can't be both.
 Cluster Security: Kubernetes administration

RBAC in Kubernetes
Role
 Cluster Security: Kubernetes administration

RBAC in Kubernetes
Namespaced
 Cluster Security: Kubernetes administration

RBAC in Kubernetes
Namespaced
 Cluster Security: Kubernetes administration

RBAC in Kubernetes
ClusterRole
 Cluster Security: Kubernetes administration

RBAC in Kubernetes
ClusterRoleBinding
 Cluster Security: Kubernetes administration

RBAC in Kubernetes
RoleBinding and ClusterRoleBinding

• A role binding grants the permissions defined in a role to a user or set of

users
• A ClusterRoleBinding grant permissions across a whole cluster
 Cluster Security: Kubernetes administration

RBAC in Kubernetes
Check access method
 Kubernetes administration
Cluster Security:
Image Security
 Kubernetes administration
Networking:

• DNS in Kubernetes
• Ingress
 Kubernetes administration
Networking:

Cluster Networking
 Kubernetes administration
Networking:

Cluster Networking
 Kubernetes administration
Networking:

Cluster Networking
 Kubernetes administration
Networking:
POD Networking
• Every POD should have an IP Address
• Every POD should be able to communicate with every other POD in the same node.
• Every POD should be able to communicate with every other POD on other nodes without NAT.
 Kubernetes administration
Networking:

Service Networking
ClusterIP
 Kubernetes administration
Networking:

Service Networking
NodePort
 Kubernetes administration
Networking:

Service Networking
LoadBalancer
 Kubernetes administration
Networking:

Service Networking
ExternalName
 Kubernetes administration
Networking:

Ingress

An API object that manages external

access to the services in a cluster, typically
HTTP that may provide load balancing, SSL
termination and name-based virtual
hosting.
 Kubernetes administration
Networking:
Ingress
 Kubernetes administration
Networking:
Ingress
 Kubernetes administration
Networking:

DNS in Kubernetes
 Kubernetes administration
Design and Install:
How-to design a Kubernetes cluster

Objective
• Node Considerations
• Resource Requirements
• Network Considerations
 Kubernetes administration
Design and Install:
How-to design a Kubernetes cluster

Objective
• Node Considerations
• Resource Requirements
• Network Considerations
 Kubernetes administration
Design and Install:
How-to design a Kubernetes cluster
Ask
 Kubernetes administration
Design and Install:
How-to design a Kubernetes cluster
Kubernetes limits

• Upto 5000 nodes

• Upto 150,000 PODs in the cluster
• Upto 300,000 Total Containers
• Upto 100 PODs per Node
 Kubernetes administration
Design and Install:
How-to design a Kubernetes cluster
Storage

• High Performance – SSD Backed Storage

• Multiple Concurrent connections – Network based storage
• Persistent shared volumes for shared access across multiple PODs
• Label nodes with specific disk types
• Use Node Selectors to assign applications to nodes with specific disk types
 Kubernetes administration
Design and Install:
How-to design a Kubernetes cluster
Network
 Kubernetes administration
Design and Install:
How-to design a Kubernetes cluster
Nodes
• Sizing and template
• Based on technical stacks
• Linux X86_64 Architecture
• No host workloads on Master nodes
 Kubernetes administration
Troubleshooting:
Application failure
Check Service
 Kubernetes administration
Troubleshooting:
Application failure
Check POD
 Kubernetes administration
Troubleshooting:
Application failure
Others
• Check dependent service
• Check dependent application
 Kubernetes administration
Troubleshooting:

Control plane failure

Check Nodes and PODs
 Kubernetes administration
Troubleshooting:

Control plane failure

Check Control plane PODs
 Kubernetes administration
Troubleshooting:

Control plane failure

Check Control plane services
 Kubernetes administration
Troubleshooting:

Control plane failure

Check Control plane services logs
 Kubernetes administration
Troubleshooting:
Worker Node failure
Check Nodes status
 Kubernetes administration
Troubleshooting:
Worker Node failure
Check Nodes
 Kubernetes administration
Troubleshooting:
Worker Node failure
Check kubelet
 Kubernetes administration
Troubleshooting:
Worker Node failure
Check certificates
 Kubernetes administration
Troubleshooting:

Network troubleshooting

• Check Network Plugin

• Check DNS
• Check KubeProxy
 Kubernetes administration

Q&
A