Mastering Kubernetes: Dive into Kubernetes and learn how to create and operate world-class cloud-native systems

Description

Go beyond the basics of Kubernetes and explore more advanced concepts, including Kubernetes in production, governance, serverless computing, and service meshes. Purchase of the print or Kindle book includes a free eBook in PDF format. Key FeaturesMaster Kubernetes architecture and design to build, deploy, and secure large-scale distributed systemsLearn advanced concepts like autoscaling, multi-cluster management, serverless computing, service meshes and policy enginesExplore Kubernetes 1.25 and its rich ecosystem of tools like Kubectl, Krew, K9s, Lens, and HelmBook Description The fourth edition of the bestseller Mastering Kubernetes includes the most recent tools and code to enable you to learn the latest features of Kubernetes 1.25. This book contains a thorough exploration of complex concepts and best practices to help you master the skills of designing and deploying large-scale distributed systems on Kubernetes clusters. You'll learn how to run complex stateless and stateful microservices on Kubernetes, including advanced features such as horizontal pod autoscaling, rolling updates, resource quotas, and persistent storage backends. In addition, you'll understand how to utilize serverless computing and service meshes. Further, two new chapters have been added. “Governing Kubernetes” covers the problem of policy management, how admission control addresses it, and how policy engines provide a powerful governance solution. “Running Kubernetes in Production” shows you what it takes to run Kubernetes at scale across multiple cloud providers, multiple geographical regions, and multiple clusters, and it also explains how to handle topics such as upgrades, capacity planning, dealing with cloud provider limits/quotas, and cost management. By the end of this Kubernetes book, you'll have a strong understanding of, and hands-on experience with, a wide range of Kubernetes capabilities. What you will learnLearn how to govern Kubernetes using policy enginesLearn what it takes to run Kubernetes in production and at scaleBuild and run stateful applications and complex microservicesMaster Kubernetes networking with services, Ingress objects, load balancers, and service meshesAchieve high availability for your Kubernetes clustersImprove Kubernetes observability with tools such as Prometheus, Grafana, and JaegerExtend Kubernetes with the Kubernetes API, plugins, and webhooksWho this book is for If you're a system administrator or cloud developer who wants to become comfortable with Kubernetes and would like to master its advanced features, then this book is for you. Sofware and DevOps engineers with a working knowledge of Kubernetes, as well as technical managers of Kubernetes-based systems, will also find this book useful. Those deciding on whether to migrate to Kubernetes and are curious about its inner workings will find plenty of answers here as well. Basic familiarity with networking concepts will prove beneficial. Table of ContentsUnderstanding Kubernetes ArchitectureCreating Kubernetes ClustersHigh Availability and ReliabilitySecuring KubernetesUsing Kubernetes Resources in PracticeManaging StorageRunning Stateful Applications with KubernetesDeploying and Updating ApplicationsPackaging ApplicationsExploring Kubernetes NetworkingRunning Kubernetes on Multiple ClustersServerless Computing on KubernetesMonitoring Kubernetes ClustersUtilizing Service MeshesExtending KubernetesGoverning KubernetesRunning Kubernetes in ProductionThe Future of Kubernetes Cover Copyright Foreword Contributors Table of Contents Preface Chapter 1: Understanding Kubernetes Architecture What is Kubernetes? What Kubernetes is not Understanding container orchestration Physical machines, virtual machines, and containers The benefits of containers Containers in the cloud Cattle versus pets Kubernetes concepts Node Cluster Control plane Pod Label Label selector Annotation Service Volume Replication controller and replica set StatefulSet Secret Name Namespace Diving into Kubernetes architecture in depth Distributed systems design patterns Sidecar pattern Ambassador pattern Adapter pattern Multi-node patterns Level-triggered infrastructure and reconciliation The Kubernetes APIs Resource categories Kubernetes components Control plane components Node components Kubernetes container runtimes The Container Runtime Interface (CRI) Docker containerd CRI-O Lightweight VMs Summary Chapter 2: Creating Kubernetes Clusters Getting ready for your first cluster Installing Rancher Desktop Installation on macOS Installation on Windows Additional installation methods Meet kubectl Kubectl alternatives – K9S, KUI, and Lens K9S KUI Lens Creating a single-node cluster with Minikube Quick introduction to Minikube Installing Minikube Installing Minikube on Windows Installing Minikube on macOS Troubleshooting the Minikube installation Checking out the cluster Doing work Examining the cluster with the dashboard Creating a multi-node cluster with KinD Quick introduction to KinD Installing KinD Dealing with Docker contexts Creating a cluster with KinD Doing work with KinD Accessing Kubernetes services locally through a proxy Creating a multi-node cluster with k3d Quick introduction to k3s and k3d Installing k3d Creating the cluster with k3d Comparing Minikube, KinD, and k3d Honorable mention – Rancher Desktop Kubernetes cluster Creating clusters in the cloud (GCP, AWS, Azure, and Digital Ocean) The cloud-provider interface Creating Kubernetes clusters in the cloud GCP GKE Autopilot AWS Kubernetes on EC2 Amazon EKS Fargate Azure Digital Ocean Other cloud providers Once upon a time in China IBM Kubernetes service Oracle Container Service Creating a bare-metal cluster from scratch Use cases for bare metal When should you consider creating a bare-metal cluster? Understanding the process Using the Cluster API for managing bare-metal clusters Using virtual private cloud infrastructure Building your own cluster with Kubespray Building your cluster with Rancher RKE Running managed Kubernetes on bare metal or VMs GKE Anthos EKS Anywhere AKS Arc Summary Chapter 3: High Availability and Reliability High availability concepts Redundancy Hot swapping Leader election Smart load balancing Idempotency Self-healing High availability best practices Creating highly available clusters Making your nodes reliable Protecting your cluster state Clustering etcd Protecting your data Running redundant API servers Running leader election with Kubernetes Making your staging environment highly available Testing high availability High availability, scalability, and capacity planning Installing the cluster autoscaler Considering the vertical pod autoscaler Autoscaling based on custom metrics Large cluster performance, cost, and design trade-offs Best effort Maintenance windows Quick recovery Zero downtime Site reliability engineering Performance and data consistency Choosing and managing the cluster capacity Choosing your node types Choosing your storage solutions Trading off cost and response time Using multiple node configurations effectively Benefiting from elastic cloud resources Autoscaling instances Mind your cloud quotas Manage regions carefully Considering container-native solutions Pushing the envelope with Kubernetes Improving the performance and scalability of Kubernetes Caching reads in the API server The pod lifecycle event generator Serializing API objects with protocol buffers etcd3 gRPC instead of REST Leases instead of TTLs Watch implementation State storage Other optimizations Measuring the performance and scalability of Kubernetes The Kubernetes SLOs Measuring API responsiveness Measuring end-to-end pod startup time Testing Kubernetes at scale Introducing the Kubemark tool Setting up a Kubemark cluster Comparing a Kubemark cluster to a real-world cluster Summary Chapter 4: Securing Kubernetes Understanding Kubernetes security challenges Node challenges Network challenges Image challenges Configuration and deployment challenges Pod and container challenges Organizational, cultural, and process challenges Hardening Kubernetes Understanding service accounts in Kubernetes How does Kubernetes manage service accounts? Accessing the API server Authenticating users Impersonation Authorizing requests Using admission control plugins Securing pods Using a private image repository ImagePullSecrets Specifying a security context for pods and containers Pod security standards Protecting your cluster with AppArmor Writing AppArmor profiles Pod Security Admission Managing network policies Choosing a supported networking solution Defining a network policy Limiting egress to external networks Cross-namespace policies The costs of network policies Using secrets Storing secrets in Kubernetes Configuring encryption at rest Creating secrets Decoding secrets Using secrets in a container Managing secrets with Vault Running a multi-tenant cluster The case for multi-tenant clusters Using namespaces for safe multi-tenancy Avoiding namespace pitfalls Using virtual clusters for strong multi-tenancy Summary Chapter 5: Using Kubernetes Resources in Practice Designing the Hue platform Defining the scope of Hue Smart reminders and notifications Security, identity, and privacy Hue components User profile User graph Identity Authorizer External services Generic sensor Generic actuator User learner Hue microservices Plugins Data stores Stateless microservices Serverless functions Event-driven interactions Planning workflows Automatic workflows Human workflows Budget-aware workflows Using Kubernetes to build the Hue platform Using kubectl effectively Understanding kubectl manifest files apiVersion kind metadata spec Deploying long-running microservices in pods Creating pods Decorating pods with labels Deploying long-running processes with deployments Updating a deployment Separating internal and external services Deploying an internal service Creating the hue-reminders service Exposing a service externally Ingress Advanced scheduling Node selector Taints and tolerations Node affinity and anti-affinity Pod affinity and anti-affinity Pod topology spread constraints The descheduler Using namespaces to limit access Using Kustomization for hierarchical cluster structures Understanding the basics of Kustomize Configuring the directory structure Applying Kustomizations Patching Kustomizing the entire staging namespace Launching jobs Running jobs in parallel Cleaning up completed jobs Scheduling cron jobs Mixing non-cluster components Outside-the-cluster-network components Inside-the-cluster-network components Managing the Hue platform with Kubernetes Using liveness probes to ensure your containers are alive Using readiness probes to manage dependencies Using startup probes Employing init containers for orderly pod bring-up Pod readiness and readiness gates Sharing with DaemonSet pods Evolving the Hue platform with Kubernetes Utilizing Hue in an enterprise Advancing science with Hue Educating the kids of the future with Hue Summary Chapter 6: Managing Storage Persistent volumes walk-through Understanding volumes Using emptyDir for intra-pod communication Using HostPath for intra-node communication Using local volumes for durable node storage Provisioning persistent volumes Creating persistent volumes Capacity Volume mode Access modes Reclaim policy Storage class Volume type Mount options Projected volumes serviceAccountToken projected volumes Creating a local volume Making persistent volume claims Mounting claims as volumes Raw block volumes CSI ephemeral volumes Generic ephemeral volumes Storage classes Default storage class Demonstrating persistent volume storage end to end Public cloud storage volume types – GCE, AWS, and Azure AWS Elastic Block Store (EBS) AWS Elastic File System (EFS) GCE persistent disk Google Cloud Filestore Azure data disk Azure file GlusterFS and Ceph volumes in Kubernetes Using GlusterFS Creating endpoints Adding a GlusterFS Kubernetes service Creating pods Using Ceph Connecting to Ceph using RBD Rook Integrating enterprise storage into Kubernetes Other storage providers The Container Storage Interface Advanced storage features Volume snapshots CSI volume cloning Storage capacity tracking Volume health monitoring Summary Chapter 7: Running Stateful Applications with Kubernetes Stateful versus stateless applications in Kubernetes Understanding the nature of distributed data-intensive apps Why manage the state in Kubernetes? Why manage the state outside of Kubernetes? Shared environment variables versus DNS records for discovery Accessing external data stores via DNS Accessing external data stores via environment variables Consuming a ConfigMap as an environment variable Using a redundant in-memory state Using DaemonSet for redundant persistent storage Applying persistent volume claims Utilizing StatefulSet Working with StatefulSets Running a Cassandra cluster in Kubernetes A quick introduction to Cassandra The Cassandra Docker image Exploring the build.sh script Exploring the run.sh script Hooking up Kubernetes and Cassandra Digging into the Cassandra configuration file The custom seed provider Creating a Cassandra headless service Using StatefulSet to create the Cassandra cluster Dissecting the StatefulSet YAML file Summary Chapter 8: Deploying and Updating Applications Live cluster updates Rolling updates Complex deployments Blue-green deployments Canary deployments Managing data-contract changes Migrating data Deprecating APIs Horizontal pod autoscaling Creating a horizontal pod autoscaler Custom metrics Keda Autoscaling with kubectl Performing rolling updates with autoscaling Handling scarce resources with limits and quotas Enabling resource quotas Resource quota types Compute resource quota Storage resource quota Object count quota Quota scopes Resource quotas and priority classes Requests and limits Working with quotas Using namespace-specific context Creating quotas Using limit ranges for default compute quotas Continuous integration and deployment What is a CI/CD pipeline? Designing a CI/CD pipeline for Kubernetes Provisioning infrastructure for your applications Cloud provider APIs and tooling Terraform Pulumi Custom operators Using Crossplane Summary Chapter 9: Packaging Applications Understanding Helm The motivation for Helm The Helm 3 architecture Helm release secrets The Helm client The Helm library Helm 2 vs Helm 3 Using Helm Installing Helm Installing the Helm client Finding charts Adding repositories Installing packages Checking the installation status Customizing a chart Additional installation options Upgrading and rolling back a release Deleting a release Working with repositories Managing charts with Helm Taking advantage of starter packs Creating your own charts The Chart.yaml file Versioning charts The appVersion field Deprecating charts Chart metadata files Managing chart dependencies Utilizing additional subfields of the dependencies field Using templates and values Writing template files Testing and troubleshooting your charts Embedding built-in objects Feeding values from a file Helm alternatives Kustomize Cue kapp-controller Summary Chapter 10: Exploring Kubernetes Networking Understanding the Kubernetes networking model Intra-pod communication (container to container) Inter-pod communication (pod to pod) Pod-to-service communication Lookup and discovery Self-registration Services and endpoints Loosely coupled connectivity with queues Loosely coupled connectivity with data stores Kubernetes ingress DNS in Kubernetes CoreDNS Kubernetes network plugins Basic Linux networking IP addresses and ports Network namespaces Subnets, netmasks, and CIDRs Virtual Ethernet devices Bridges Routing Maximum transmission unit Pod networking Kubenet Requirements Setting the MTU The CNI The container runtime The CNI plugin Kubernetes and eBPF Kubernetes networking solutions Bridging on bare-metal clusters The Calico project Weave Net Cilium Efficient IP allocation and routing Identity-based service-to-service communication Load balancing Bandwidth management Observability Using network policies effectively Understanding the Kubernetes network policy design Network policies and CNI plugins Configuring network policies Implementing network policies Load balancing options External load balancers Configuring an external load balancer Finding the load balancer IP addresses Preserving client IP addresses Understanding even external load balancing Service load balancers Ingress HAProxy MetalLB Traefik Kubernetes Gateway API Gateway API resources Attaching routes to gateways Gateway API in action Writing your own CNI plugin First look at the loopback plugin Building on the CNI plugin skeleton Reviewing the bridge plugin Summary Chapter 11: Running Kubernetes on Multiple Clusters Stretched Kubernetes clusters versus multi-cluster Kubernetes Understanding stretched Kubernetes clusters Pros of a stretched cluster Cons of a stretched cluster Understanding multi-cluster Kubernetes Pros of multi-cluster Kubernetes Cons of multi-cluster Kubernetes The history of cluster federation in Kubernetes Cluster API Cluster API architecture Management cluster Work cluster Bootstrap provider Infrastructure provider Control plane Custom resources Karmada Karmada architecture Karmada concepts ResourceTemplate PropagationPolicy OverridePolicy Additional capabilities Clusternet Clusternet architecture Clusternet hub Clusternet scheduler Clusternet agent Multi-cluster deployment Clusterpedia Clusterpedia architecture Clusterpedia API server ClusterSynchro manager Storage layer Storage component Importing clusters Advanced multi-cluster search Resource collections Open Cluster Management OCM architecture OCM cluster lifecycle OCM application lifecycle OCM governance, risk, and compliance Virtual Kubelet Tensile-kube Admiralty Liqo Introducing the Gardener project Understanding the terminology of Gardener Understanding the conceptual model of Gardener Diving into the Gardener architecture Managing the cluster state Managing the control plane Preparing the infrastructure Using the Machine controller manager Networking across clusters Monitoring clusters The gardenctl CLI Extending Gardener Summary Chapter 12: Serverless Computing on Kubernetes Understanding serverless computing Running long-running services on “serverless” infrastructure Running functions as a service on “serverless” infrastructure Serverless Kubernetes in the cloud Azure AKS and Azure Container Instances AWS EKS and Fargate Google Cloud Run Knative Knative serving Install a quickstart environment The Knative Service object Creating new revisions The Knative Route object The Knative Configuration object Knative eventing Getting familiar with Knative eventing terminology The architecture of Knative eventing Checking the scale to zero option of Knative Kubernetes Function-as-a-Service frameworks OpenFaaS Delivery pipeline OpenFaaS features OpenFaaS architecture Taking OpenFaaS for a ride Fission Fission executor Fission workflows Experimenting with Fission Summary Chapter 13: Monitoring Kubernetes Clusters Understanding observability Logging Log format Log storage Log aggregation Metrics Distributed tracing Application error reporting Dashboards and visualization Alerting Logging with Kubernetes Container logs Kubernetes component logs Centralized logging Choosing a log collection strategy Cluster-level central logging Remote central logging Dealing with sensitive log information Using Fluentd for log collection Collecting metrics with Kubernetes Monitoring with the Metrics Server The rise of Prometheus Installing Prometheus Interacting with Prometheus Incorporating kube-state-metrics Utilizing the node exporter Incorporating custom metrics Alerting with Alertmanager Visualizing your metrics with Grafana Considering Loki Distributed tracing with Kubernetes What is OpenTelemetry? OpenTelemetry tracing concepts Introducing Jaeger Jaeger architecture Installing Jaeger Troubleshooting problems Taking advantage of staging environments Detecting problems at the node level Problem daemons Dashboards vs. alerts Logs vs metrics vs. error reports Detecting performance and root cause with distributed tracing Summary Chapter 14: Utilizing Service Meshes What is a service mesh? Choosing a service mesh Envoy Linkerd 2 Kuma AWS App Mesh Mæsh Istio OSM (Open Service Mesh) Cilium Service Mesh Understanding the Istio architecture Envoy Pilot Citadel Galley Incorporating Istio into your Kubernetes cluster Preparing a minikube cluster for Istio Installing Istio Installing BookInfo Working with Istio Traffic management Security Istio identity Istio certificate management Istio authentication Istio authorization Monitoring and observability Istio access logs Metrics Distributed tracing Visualizing your service mesh with Kiali Summary Chapter 15: Extending Kubernetes Working with the Kubernetes API Understanding OpenAPI Setting up a proxy Exploring the Kubernetes API directly Using Postman to explore the Kubernetes API Filtering the output with HTTPie and jq Accessing the Kubernetes API via the Python client Dissecting the CoreV1Api group Listing objects Creating objects Watching objects Creating a pod via the Kubernetes API Controlling Kubernetes using Go and controller-runtime Using controller-runtime via go-k8s Invoking kubectl programmatically from Python and Go Using Python subprocess to run kubectl Extending the Kubernetes API Understanding Kubernetes extension points and patterns Extending Kubernetes with plugins Extending Kubernetes with the cloud controller manager Extending Kubernetes with webhooks Extending Kubernetes with controllers and operators Extending Kubernetes scheduling Extending Kubernetes with custom container runtimes Introducing custom resources Developing custom resource definitions Integrating custom resources Dealing with unknown fields Finalizing custom resources Adding custom printer columns Understanding API server aggregation Building Kubernetes-like control planes Writing Kubernetes plugins Writing a custom scheduler Understanding the design of the Kubernetes scheduler Scheduling pods manually Preparing our own scheduler Assigning pods to the custom scheduler Writing kubectl plugins Understanding kubectl plugins Managing kubectl plugins with Krew Creating your own kubectl plugin Employing access control webhooks Using an authentication webhook Using an authorization webhook Using an admission control webhook Configuring a webhook admission controller on the fly Additional extension points Providing custom metrics for horizontal pod autoscaling Extending Kubernetes with custom storage Summary Chapter 16: Governing Kubernetes Kubernetes in the enterprise Requirements of enterprise software Kubernetes and enterprise software What is Kubernetes governance? Image management Pod security Network policy Configuration constraints RBAC and admission control Policy management Policy validation and enforcement Reporting Audit Policy engines Admission control as the foundation of policy engines Responsibilities of a policy engine Quick review of open source policy engines OPA/Gatekeeper Kyverno jsPolicy Kubewarden Kyverno deep dive Quick intro to Kyverno Installing and configuring Kyverno Installing pod security policies Configuring Kyverno Applying Kyverno policies Kyverno policies in depth Understanding policy settings Understanding Kyverno policy rules Validating requests Mutating resources Generating resources Advanced policy rules Writing and testing Kyverno policies Writing validating policies Writing mutating policies Writing generating policies Testing policies The Kyverno CLI Understanding Kyverno tests Writing Kyverno tests Running Kyverno tests Viewing Kyverno reports Summary Chapter 17: Running Kubernetes in Production Understanding Managed Kubernetes in the cloud Deep integration Quotas and limits Real-world examples of quotas and limits Capacity planning When should you not use Managed Kubernetes? Managing multiple clusters Geo-distributed clusters Multi-cloud Hybrid Kubernetes on the edge Building effective processes for large-scale Kubernetes deployments The development lifecycle Environments Separated environments Staging environment fidelity Resource quotas Promotion process Permissions and access control The principle of least privilege Assign permissions to groups Fine-tune your permission model Break glass Observability One-stop shop observability Troubleshooting your observability stack Handling infrastructure at scale Cloud-level considerations Compute Design your cluster breakdown Design your node pool breakdown Networking IP address space management Network topology Network segmentation Cross-cluster communication Cross-cloud communication Cross-cluster service meshes Managing egress at scale Managing the DNS at the cluster level Storage Choose the right storage solutions Data backup and recovery Storage monitoring Data security Optimize storage usage Test and validate storage performance Managing clusters and node pools Provisioning managed clusters and node pools The Cluster API Terraform/Pulumi Kubernetes operators Utilizing managed nodes Bin packing and utilization Understanding workload shape Setting requests and limits Utilizing init containers Shared nodes vs. dedicated nodes Large nodes vs, small nodes Small and short-lived workloads Pod density Fallback node pools Upgrading Kubernetes Know the lifecycle of your cloud provider Upgrading clusters Planning an upgrade Detecting incompatible resources Updating incompatible resources Dealing with removed features Upgrading node pools Syncing with control plane upgrades How to perform node pool upgrades Concurrent draining Dealing with workloads with no PDB Dealing with workloads with PDB zero Troubleshooting Handling pending pods Handling scheduled pods that are not running Handling running pods that are not ready Cost management Cost mindset Cost observability Tagging Policies and budgets Alerting Tools The smart selection of resources Efficient usage of resources Discounts, reserved instances, and spot instances Discounts and credits Reserved instances Spot instances Invest in local environments Summary Chapter 18: The Future of Kubernetes The Kubernetes momentum The importance of the CNCF Project curation Certification Training Community and education Tooling The rise of managed Kubernetes platforms Public cloud Kubernetes platforms Bare metal, private clouds, and Kubernetes on the edge Kubernetes PaaS (Platform as a Service) Upcoming trends Security Networking Custom hardware and devices Service mesh Serverless computing Kubernetes on the edge Native CI/CD Operators Kubernetes and AI Kubernetes and AI synergy Training AI models on Kubernetes Running AI-based systems on Kubernetes Kubernetes and AIOps Kubernetes challenges Kubernetes complexity Serverless function platforms Summary Other Books You May Enjoy Index