Kubernetes : Preparing for the CKA and CKAD Certifications

part of the material is concerned, specifically the rights of translation, reprinting, reuse of illustrations, recitation, broadcasting, reproduction on microfilms or in any other physical way, and transmission or information storage and retrieval, electronic adaptation, computer software, or by similar or dissimilar methodology now known or hereafter developed.Trademarked names, logos, and images may appear in this book. Rather than use a trademark symbol with every occurrence of a trademarked name, logo, or image we use the names, logos, and images only in an editorial fashion and to the benefit of the trademark owner, with no intention of infringement of the trademark.xiii About the Author Philippe Martin has been working with Kubernetes for three years, first by creating an operator to deploy video CDNs into the cloud and later helping companies deploy their applications into Kubernetes. Philippe passed CKAD certification about a year ago and CKA certification recently.He has long experience with distributed systems and open source software; he started his career 20 years ago creating thin clients based on the Linux kernel and open source components.Philippe is active in the development of the Kubernetes community, especially its documentation, and participates in the translation of the official documentation in French, has edited two reference books about Kubernetes API and kubectl, and is responsible for French translation of the Kubernetes Dashboard. xv About the Technical Reviewer Prasanth Sahoo is a thought leader, an adjunct professor, a technical speaker, and a full-time practitioner in Blockchain, Cloud, and Scrum working for Tata Consultancy Services. He has implemented solution architectures with automating and orchestrating workloads on cloud service providers like Microsoft Azure and Google Cloud and also led cross-functional teams to achieve their goals using agile methodologies. He is passionate about driving digital technology initiatives by handling various community initiatives through coaching, mentoring, and grooming techniques.He is a working group member in the Blockchain Council, Table of Contents 5 About the Author 13 About the Technical Reviewer 14 Introduction 15 Chapter 1: Creating a Cluster with kubeadm 18 Provisioning Compute Resources 18 Install Docker on the Hosts 21 Install kubeadm, kubelet, and kubectl on the Hosts 23 Initialize the Control Plane Node 24 Join the Workers 25 Chapter 2: Control Plane Components 27 Explore the Control Plane Services 28 Chapter 3: Accessing the Cluster 30 Install kubectl on Your dev Machine 30 Linux 30 macOS 31 Windows 31 Access the Cluster from the dev Machine 31 Chapter 4: Kubernetes Resources 34 Namespaces 34 Labels and Selectors 35 Annotations 37 Chapter 5: The Workloads 38 Pod Specs 39 Container Specs 41 Pod Controllers 42 ReplicaSet Controller 43 Deployment Controller 44 Update and Rollback 46 Deployment Strategies 51 The Recreate Strategy 51 The RollingUpdate Strategy 51 Running Jobs 53 Job Controller 53 Run One Pod to Its Completion 53 Run Several Pods Until One Completes 56 Run Several Pods Until Several Pods Complete 57 CronJob Controller 59 Schedule Format 60 Chapter 6: Configuring Applications 62 Arguments to the Command 62 Environment Variables 63 Declaring Values Directly 64 In Declarative Form 64 In Imperative Form 65 Referencing Specific Values from ConfigMaps and Secrets 65 In Declarative Form 65 In Imperative Form 68 Referencing All Values from ConfigMaps and Secrets 69 In Declarative Form 69 In Imperative Form 70 Referencing Values from Pod Fields 71 Referencing Values from Container Resources Fields 73 Configuration File from ConfigMap 75 Configuration File from Secret 77 Configuration File from Pod Fields 79 Configuration File from Container Resources Fields 81 Configuration File from Different Sources 83 Chapter 7: Scaling an Application 87 Manual Scaling 87 Auto-scaling 88 Chapter 8: Application Self-Healing 93 Controller to the Rescue 94 Liveness Probes 95 A Note About Readiness Probes 96 HTTP Request Liveness Probe 96 Command Liveness Probe 98 TCP Connection Liveness Probe 99 Resource Limits and Quality of Service (QoS) Classes 100 Chapter 9: Scheduling Pods 102 Using Label Selectors to Schedule Pods on Specific Nodes 102 Adding Labels to Nodes 103 Adding Node Selectors to Pods 103 Manual Scheduling 105 DaemonSets 105 Static Pods 107 Resource Requests 109 In Imperative Form 109 In Declarative Form 110 Running Multiple Schedulers 111 Examine Scheduler Events 112 Chapter 10: Discovery and Load Balancing 114 Services 114 Selectors 116 Readiness Probes 116 Endpoints 116 Service Types 118 ClusterIP 118 NodePort 119 LoadBalancer 119 ExternalName 119 Ingress 119 Install nginx Ingress Controller 120 Accessing Applications 122 HTTPS and Ingress 124 Chapter 11: Security 128 Authentication 128 Normal User Authentication 128 Client Certificate Authentication 129 HTTP Basic Auth 134 Bearer Token Authentication 137 Service Account Authentication 140 Service Account Outside the Cluster 142 Authorization 144 Anatomy of an API Server Request 145 Resource Requests 145 Non-resource Requests 146 Request Attributes for Authorization 146 RBAC Mode 147 Role and ClusterRole 147 RoleBinding and ClusterRoleBinding 149 Examples 150 Security Contexts 156 At Pod Level 156 User and Groups 156 SELinux Options 158 Sysctls 158 At Container Level 159 User and Groups 159 SELinux Options 159 Capabilities 160 Others 160 Network Policies 160 Working with Private Docker Registries 165 Using imagePullSecrets 165 Pre-pulling Images on Nodes 168 Giving Credentials to kubelet 169 Chapter 12: Persistent Volumes 170 Creating an NFS Persistent Volume 170 Access Modes 173 Claiming a Persistent Volume 173 Cleanup 178 Using Auto-provisioned Persistent Volumes 178 Cleanup 181 Chapter 13: Multi-container Pod Design Patterns 182 Init Container 182 Initialize a Storage 183 Wait for Availability of Another Service 184 Sidecar Container 185 Adapter Container 186 Ambassador Container 186 Chapter 14: Observability 187 Debugging at the Kubernetes Level 187 Debugging Inside Containers 190 Debugging Services 190 Logging 192 Logging at the Node Level 193 Cluster-Level Logging with a Node Logging Agent 193 Using a Sidecar to Redirect Logs to stdout 194 Monitoring 194 Monitoring with Prometheus 195 Chapter 15: Upgrading the Cluster 196 Upgrade the Controller 196 Upgrade the Workers 199 Upgrading the Operating System 200 Back Up a Cluster 201 Restore a Cluster 201 Chapter 16: Command-Line Tools 203 kubectl 203 Managing the kubeconfig File 204 Generic Commands 205 Creating Application Resources 206 Creating and Parameterizing Workloads 206 Configuring Workloads 208 Exposing Pods 210 Authorization 211 Annotate and Label 211 Interacting with the Application 212 Managing Clusters 213 Getting Documentation 214 Helm 214 Install Helm on Your dev Machine 215 Linux 215 macOS 215 Windows 216 Install Charts 216 Create Your Own Charts 218 Kustomize 219 Dev and Production Environments Example 220 Rolling Configuration Update 224 Appendix A: Curriculum CKA 1.19: September 2020 228 Cluster Architecture, Installation, and Configuration (25%) 228 Workloads and Scheduling (15%) 229 Services and Networking (20%) 229 Storage (10%) 230 Troubleshooting (30%) 230 Appendix B: Curriculum CKAD 1.18: April 2020 231 Core Concepts (13%) 231 Configuration (18%) 231 Multi-container Pods (10%) 232 Observability (18%) 232 Pod Design (20%) 232 Services and Networking (13%) 233 State Persistence (8%) 233 Index 234 Master all the concepts and tools necessary to start administering a Kubernetes cluster and deploying applications to production. You will cover the entire curricula of the two Kubernetes certifications (for application developers and administrators). The initial chapters guide you through deployment of a Kubernetes cluster on virtual machines and explore the different components of the control plane. Next, you will work with the kubectl command-line tool; namespaces, labels, selectors, and annotations—common resources used through the Kubernetes API. The following chapters describe the principle of controllers and detail how workload controllers work as well as the possibilities for configuring deployed applications. You will also learn how to deploy a scalable and self-healing application, how pods are scheduled to nodes, how parts of the application can communicate, and how the application is discoverable from the outside. Next, you will cover security concerns describing the different authentication methods, the RBAC authorization mode, security contexts, network policies, and how to secure container images. You will also cover using persistent volumes for your containers to store long-term data, monitoring your clusters and applications and implementing design patterns for multi-container pods. The concluding chapters guide you through the upgrade of your deployed cluster. After reading this book, you will have enough knowledge to deploy a complex application using a Kubernetes cluster and be ready for the certification exams. What You Will Learn Deploy a Kubernetes cluster with kubeadm and learn how the control plane works Discover how the Kubernetes API is structured Deploy secure, auto-scaled, and self-healing applications Master the kubectl command-line tool Who This Book Is For Administrators and application developers with good knowledge of micro-services development and deployment.