Kubernetes in action

With Kubernetes, users don't have to worry about which specific machine in their data center their application is running on. Each layer in their application is decoupled from other layers so they can scale, update, and maintain them independently. Kubernetes in Action teaches developers how to use Kubernetes to deploy self-healing scalable distributed applications. By the end, readers will be able to build and deploy applications in a proper way to take full advantage of the Kubernetes platform. Purchase of the print book includes a free eBook in PDF, Kindle, and ePub formats from Manning Publications. Kubernetes in Action......Page 1 brief contents......Page 9 contents......Page 11 preface......Page 23 acknowledgments......Page 25 Who should read this book......Page 27 How this book is organized: a roadmap......Page 28 About the code......Page 29 Other online resources......Page 30 about the author......Page 31 about the cover illustration......Page 32 1 Introducing Kubernetes......Page 33 1.1 Understanding the need for a system like Kubernetes......Page 34 1.1.1 Moving from monolithic apps to microservices......Page 35 1.1.3 Moving to continuous delivery: DevOps and NoOps......Page 38 1.2 Introducing container technologies......Page 39 1.2.1 Understanding what containers are......Page 40 1.2.2 Introducing the Docker container platform......Page 44 1.2.3 Introducing rkt—an alternative to Docker......Page 47 1.3.2 Looking at Kubernetes from the top of a mountain......Page 48 1.3.3 Understanding the architecture of a Kubernetes cluster......Page 50 1.3.4 Running an application in Kubernetes......Page 51 1.3.5 Understanding the benefits of using Kubernetes......Page 53 1.4 Summary......Page 55 2 First steps with Docker and Kubernetes......Page 57 2.1.1 Installing Docker and running a Hello World container......Page 58 2.1.2 Creating a trivial Node.js app......Page 60 2.1.4 Building the container image......Page 61 2.1.5 Running the container image......Page 64 2.1.6 Exploring the inside of a running container......Page 65 2.1.7 Stopping and removing a container......Page 66 2.1.8 Pushing the image to an image registry......Page 67 2.2 Setting up a Kubernetes cluster......Page 68 2.2.1 Running a local single-node Kubernetes cluster with Minikube......Page 69 2.2.2 Using a hosted Kubernetes cluster with Google Kubernetes Engine......Page 70 2.2.3 Setting up an alias and command-line completion for kubectl......Page 73 2.3.1 Deploying your Node.js app......Page 74 2.3.2 Accessing your web application......Page 77 2.3.3 The logical parts of your system......Page 79 2.3.4 Horizontally scaling the application......Page 80 2.3.5 Examining what nodes your app is running on......Page 83 2.3.6 Introducing the Kubernetes dashboard......Page 84 2.4 Summary......Page 85 3 Pods: running containers in Kubernetes......Page 87 3.1.1 Understanding why we need pods......Page 88 3.1.2 Understanding pods......Page 89 3.1.3 Organizing containers across pods properly......Page 90 3.2.1 Examining a YAML descriptor of an existing pod......Page 93 3.2.2 Creating a simple YAML descriptor for a pod......Page 95 3.2.4 Viewing application logs......Page 97 3.2.5 Sending requests to the pod......Page 98 3.3 Organizing pods with labels......Page 99 3.3.1 Introducing labels......Page 100 3.3.2 Specifying labels when creating a pod......Page 101 3.3.3 Modifying labels of existing pods......Page 102 3.4.1 Listing pods using a label selector......Page 103 3.4.2 Using multiple conditions in a label selector......Page 104 3.5 Using labels and selectors to constrain pod scheduling......Page 105 3.5.2 Scheduling pods to specific nodes......Page 106 3.6.1 Looking up an object’s annotations......Page 107 3.7 Using namespaces to group resources......Page 108 3.7.2 Discovering other namespaces and their pods......Page 109 3.7.3 Creating a namespace......Page 110 3.7.5 Understanding the isolation provided by namespaces......Page 111 3.8.3 Deleting pods by deleting the whole namespace......Page 112 3.8.4 Deleting all pods in a namespace, while keeping the namespace......Page 113 3.9 Summary......Page 114 4 Replication and other controllers: deploying managed pods......Page 116 4.1.1 Introducing liveness probes......Page 117 4.1.2 Creating an HTTP-based liveness probe......Page 118 4.1.3 Seeing a liveness probe in action......Page 119 4.1.4 Configuring additional properties of the liveness probe......Page 120 4.1.5 Creating effective liveness probes......Page 121 4.2 Introducing ReplicationControllers......Page 122 4.2.1 The operation of a ReplicationController......Page 123 4.2.2 Creating a ReplicationController......Page 125 4.2.3 Seeing the ReplicationController in action......Page 126 4.2.4 Moving pods in and out of the scope of a ReplicationController......Page 130 4.2.5 Changing the pod template......Page 133 4.2.6 Horizontally scaling pods......Page 134 4.2.7 Deleting a ReplicationController......Page 135 4.3 Using ReplicaSets instead of ReplicationControllers......Page 136 4.3.2 Defining a ReplicaSet......Page 137 4.3.3 Creating and examining a ReplicaSet......Page 138 4.3.4 Using the ReplicaSet’s more expressive label selectors......Page 139 4.4 Running exactly one pod on each node with DaemonSets......Page 140 4.4.2 Using a DaemonSet to run pods only on certain nodes......Page 141 4.5.1 Introducing the Job resource......Page 144 4.5.2 Defining a Job resource......Page 145 4.5.4 Running multiple pod instances in a Job......Page 146 4.6.1 Creating a CronJob......Page 148 4.6.2 Understanding how scheduled jobs are run......Page 149 4.7 Summary......Page 150 5 Services: enabling clients to discover and talk to pods......Page 152 5.1 Introducing services......Page 153 5.1.1 Creating services......Page 154 5.1.2 Discovering services......Page 160 5.2.1 Introducing service endpoints......Page 163 5.2.2 Manually configuring service endpoints......Page 164 5.3 Exposing services to external clients......Page 166 5.3.1 Using a NodePort service......Page 167 5.3.2 Exposing a service through an external load balancer......Page 170 5.3.3 Understanding the peculiarities of external connections......Page 173 5.4 Exposing services externally through an Ingress resource......Page 174 5.4.1 Creating an Ingress resource......Page 176 5.4.2 Accessing the service through the Ingress......Page 177 5.4.3 Exposing multiple services through the same Ingress......Page 178 5.4.4 Configuring Ingress to handle TLS traffic......Page 179 5.5.1 Introducing readiness probes......Page 181 5.5.2 Adding a readiness probe to a pod......Page 183 5.5.3 Understanding what real-world readiness probes should do......Page 185 5.6.1 Creating a headless service......Page 186 5.6.2 Discovering pods through DNS......Page 187 5.7 Troubleshooting services......Page 188 5.8 Summary......Page 189 6 Volumes: attaching disk storage to containers......Page 191 6.1.1 Explaining volumes in an example......Page 192 6.1.2 Introducing available volume types......Page 194 6.2.1 Using an emptyDir volume......Page 195 6.2.2 Using a Git repository as the starting point for a volume......Page 198 6.3.1 Introducing the hostPath volume......Page 201 6.3.2 Examining system pods that use hostPath volumes......Page 202 6.4.1 Using a GCE Persistent Disk in a pod volume......Page 203 6.4.2 Using other types of volumes with underlying persistent storage......Page 206 6.5.1 Introducing PersistentVolumes and PersistentVolumeClaims......Page 208 6.5.2 Creating a PersistentVolume......Page 209 6.5.3 Claiming a PersistentVolume by creating a PersistentVolumeClaim......Page 211 6.5.4 Using a PersistentVolumeClaim in a pod......Page 213 6.5.5 Understanding the benefits of using PersistentVolumes and claims......Page 214 6.5.6 Recycling PersistentVolumes......Page 215 6.6 Dynamic provisioning of PersistentVolumes......Page 216 6.6.2 Requesting the storage class in a PersistentVolumeClaim......Page 217 6.6.3 Dynamic provisioning without specifying a storage class......Page 219 6.7 Summary......Page 222 7.1 Configuring containerized applications......Page 223 7.2 Passing command-line arguments to containers......Page 224 7.2.1 Defining the command and arguments in Docker......Page 225 7.2.2 Overriding the command and arguments in Kubernetes......Page 227 7.3 Setting environment variables for a container......Page 228 7.3.1 Specifying environment variables in a container definition......Page 229 7.4.1 Introducing ConfigMaps......Page 230 7.4.2 Creating a ConfigMap......Page 232 7.4.3 Passing a ConfigMap entry to a container as an environment variable......Page 234 7.4.5 Passing a ConfigMap entry as a command-line argument......Page 236 7.4.6 Using a configMap volume to expose ConfigMap entries as files......Page 237 7.4.7 Updating an app’s config without having to restart the app......Page 243 7.5 Using Secrets to pass sensitive data to containers......Page 245 7.5.2 Introducing the default token Secret......Page 246 7.5.3 Creating a Secret......Page 248 7.5.4 Comparing ConfigMaps and Secrets......Page 249 7.5.5 Using the Secret in a pod......Page 250 7.5.6 Understanding image pull Secrets......Page 254 7.6 Summary......Page 256 8 Accessing pod metadata and other resources from applications......Page 257 8.1.1 Understanding the available metadata......Page 258 8.1.2 Exposing metadata through environment variables......Page 259 8.1.3 Passing metadata through files in a downwardAPI volume......Page 262 8.2 Talking to the Kubernetes API server......Page 265 8.2.1 Exploring the Kubernetes REST API......Page 266 8.2.2 Talking to the API server from within a pod......Page 270 8.2.3 Simplifying API server communication with ambassador containers......Page 275 8.2.4 Using client libraries to talk to the API server......Page 278 8.3 Summary......Page 281 9 Deployments: updating applications declaratively......Page 282 9.1 Updating applications running in pods......Page 283 9.1.2 Spinning up new pods and then deleting the old ones......Page 284 9.2.1 Running the initial version of the app......Page 286 9.2.2 Performing a rolling update with kubectl......Page 288 9.2.3 Understanding why kubectl rolling-update is now obsolete......Page 292 9.3 Using Deployments for updating apps declaratively......Page 293 9.3.1 Creating a Deployment......Page 294 9.3.2 Updating a Deployment......Page 296 9.3.3 Rolling back a deployment......Page 300 9.3.4 Controlling the rate of the rollout......Page 303 9.3.5 Pausing the rollout process......Page 305 9.3.6 Blocking rollouts of bad versions......Page 306 9.4 Summary......Page 311 10 StatefulSets: deploying replicated stateful applications......Page 312 10.1.1 Running multiple replicas with separate storage for each......Page 313 10.1.2 Providing a stable identity for each pod......Page 314 10.2.1 Comparing StatefulSets with ReplicaSets......Page 316 10.2.2 Providing a stable network identity......Page 317 10.2.3 Providing stable dedicated storage to each stateful instance......Page 319 10.2.4 Understanding StatefulSet guarantees......Page 321 10.3.1 Creating the app and container image......Page 322 10.3.2 Deploying the app through a StatefulSet......Page 323 10.3.3 Playing with your pods......Page 327 10.4 Discovering peers in a StatefulSet......Page 331 10.4.1 Implementing peer discovery through DNS......Page 333 10.4.2 Updating a StatefulSet......Page 334 10.4.3 Trying out your clustered data store......Page 335 10.5.1 Simulating a node’s disconnection from the network......Page 336 10.5.2 Deleting the pod manually......Page 338 10.6 Summary......Page 339 11 Understanding Kubernetes internals......Page 341 11.1.1 The distributed nature of Kubernetes components......Page 342 11.1.2 How Kubernetes uses etcd......Page 344 11.1.3 What the API server does......Page 348 11.1.4 Understanding how the API server notifies clients of resource changes......Page 350 11.1.5 Understanding the Scheduler......Page 351 11.1.6 Introducing the controllers running in the Controller Manager......Page 353 11.1.7 What the Kubelet does......Page 358 11.1.8 The role of the Kubernetes Service Proxy......Page 359 11.1.9 Introducing Kubernetes add-ons......Page 360 11.2.1 Understanding which components are involved......Page 362 11.2.2 The chain of events......Page 363 11.2.3 Observing cluster events......Page 364 11.3 Understanding what a running pod is......Page 365 11.4.1 What the network must be like......Page 367 11.4.2 Diving deeper into how networking works......Page 368 11.5 How services are implemented......Page 370 11.5.2 How kube-proxy uses iptables......Page 371 11.6.1 Making your apps highly available......Page 373 11.6.2 Making Kubernetes Control Plane components highly available......Page 374 11.7 Summary......Page 377 12.1 Understanding authentication......Page 378 12.1.1 Users and groups......Page 379 12.1.2 Introducing ServiceAccounts......Page 380 12.1.3 Creating ServiceAccounts......Page 381 12.1.4 Assigning a ServiceAccount to a pod......Page 383 12.2.1 Introducing the RBAC authorization plugin......Page 385 12.2.2 Introducing RBAC resources......Page 387 12.2.3 Using Roles and RoleBindings......Page 390 12.2.4 Using ClusterRoles and ClusterRoleBindings......Page 394 12.2.5 Understanding default ClusterRoles and ClusterRoleBindings......Page 403 12.3 Summary......Page 405 13 Securing cluster nodes and the network......Page 407 13.1.1 Using the node’s network namespace in a pod......Page 408 13.1.2 Binding to a host port without using the host’s network namespace......Page 409 13.1.3 Using the node’s PID and IPC namespaces......Page 411 13.2 Configuring the container’s security context......Page 412 13.2.1 Running a container as a specific user......Page 413 13.2.3 Running pods in privileged mode......Page 414 13.2.4 Adding individual kernel capabilities to a container......Page 416 13.2.5 Dropping capabilities from a container......Page 417 13.2.6 Preventing processes from writing to the container’s filesystem......Page 418 13.2.7 Sharing volumes when containers run as different users......Page 419 13.3.1 Introducing the PodSecurityPolicy resource......Page 421 13.3.2 Understanding runAsUser, fsGroup, and supplementalGroups policies......Page 424 13.3.3 Configuring allowed, default, and disallowed capabilities......Page 426 13.3.4 Constraining the types of volumes pods can use......Page 427 13.3.5 Assigning different PodSecurityPolicies to different users and groups......Page 428 13.4.1 Enabling network isolation in a namespace......Page 431 13.4.2 Allowing only some pods in the namespace to connect to a server pod......Page 432 13.4.3 Isolating the network between Kubernetes namespaces......Page 433 13.4.4 Isolating using CIDR notation......Page 434 13.5 Summary......Page 435 14 Managing pods’ computational resources......Page 436 14.1.1 Creating pods with resource requests......Page 437 14.1.2 Understanding how resource requests affect scheduling......Page 438 14.1.4 Defining and requesting custom resources......Page 443 14.2.1 Setting a hard limit for the amount of resources a container can use......Page 444 14.2.2 Exceeding the limits......Page 446 14.2.3 Understanding how apps in containers see limits......Page 447 14.3.1 Defining the QoS class for a pod......Page 449 14.3.2 Understanding which process gets killed when memory is low......Page 452 14.4.1 Introducing the LimitRange resource......Page 453 14.4.2 Creating a LimitRange object......Page 454 14.4.3 Enforcing the limits......Page 455 14.4.4 Applying default resource requests and limits......Page 456 14.5.1 Introducing the ResourceQuota object......Page 457 14.5.3 Limiting the number of objects that can be created......Page 459 14.5.4 Specifying quotas for specific pod states and/or QoS classes......Page 461 14.6.1 Collecting and retrieving actual resource usages......Page 462 14.6.2 Storing and analyzing historical resource consumption statistics......Page 464 14.7 Summary......Page 467 15 Automatic scaling of pods and cluster nodes......Page 469 15.1.1 Understanding the autoscaling process......Page 470 15.1.2 Scaling based on CPU utilization......Page 473 15.1.4 Scaling based on other and custom metrics......Page 480 15.1.6 Scaling down to zero replicas......Page 482 15.2.2 Modifying resource requests while a pod is running......Page 483 15.3.1 Introducing the Cluster Autoscaler......Page 484 15.3.3 Limiting service disruption during cluster scale-down......Page 486 15.4 Summary......Page 488 16.1 Using taints and tolerations to repel pods from certain nodes......Page 489 16.1.1 Introducing taints and tolerations......Page 490 16.1.3 Adding tolerations to pods......Page 492 16.1.4 Understanding what taints and tolerations can be used for......Page 493 16.2 Using node affinity to attract pods to certain nodes......Page 494 16.2.1 Specifying hard node affinity rules......Page 495 16.2.2 Prioritizing nodes when scheduling a pod......Page 497 16.3.1 Using inter-pod affinity to deploy pods on the same node......Page 500 16.3.2 Deploying pods in the same rack, availability zone, or geographic region......Page 503 16.3.3 Expressing pod affinity preferences instead of hard requirements......Page 504 16.3.4 Scheduling pods away from each other with pod anti-affinity......Page 506 16.4 Summary......Page 508 17 Best practices for developing apps......Page 509 17.1 Bringing everything together......Page 510 17.2.1 Applications must expect to be killed and relocated......Page 511 17.2.2 Rescheduling of dead or partially dead pods......Page 514 17.2.3 Starting pods in a specific order......Page 515 17.2.4 Adding lifecycle hooks......Page 517 17.2.5 Understanding pod shutdown......Page 521 17.3.1 Preventing broken client connections when a pod is starting up......Page 524 17.3.2 Preventing broken connections during pod shut-down......Page 525 17.4.2 Properly tagging your images and using imagePullPolicy wisely......Page 529 17.4.5 Providing information on why the process terminated......Page 530 17.4.6 Handling application logs......Page 532 17.5.1 Running apps outside of Kubernetes during development......Page 534 17.5.2 Using Minikube in development......Page 535 17.5.3 Versioning and auto-deploying resource manifests......Page 536 17.5.4 Introducing Ksonnet as an alternative to writing YAML/JSON manifests......Page 537 17.6 Summary......Page 538 18.1 Defining custom API objects......Page 540 18.1.1 Introducing CustomResourceDefinitions......Page 541 18.1.2 Automating custom resources with custom controllers......Page 545 18.1.3 Validating custom objects......Page 549 18.1.4 Providing a custom API server for your custom objects......Page 550 18.2 Extending Kubernetes with the Kubernetes Service Catalog......Page 551 18.2.1 Introducing the Service Catalog......Page 552 18.2.2 Introducing the Service Catalog API server and Controller Manager......Page 553 18.2.3 Introducing Service Brokers and the OpenServiceBroker API......Page 554 18.2.4 Provisioning and using a service......Page 556 18.2.6 Understanding what the Service Catalog brings......Page 558 18.3.1 Red Hat OpenShift Container Platform......Page 559 18.3.2 Deis Workflow and Helm......Page 562 18.4 Summary......Page 565 A.1 Switching between Minikube and Google Kubernetes Engine......Page 566 A.2.2 Understanding the contents of the kubeconfig file......Page 567 A.2.3 Listing, adding, and modifying kube config entries......Page 568 A.2.4 Using kubectl with different clusters, users, and contexts......Page 569 A.2.7 Deleting contexts and clusters......Page 570 B.1.1 Creating the virtual machine......Page 571 B.1.2 Configuring the network adapter for the VM......Page 572 B.1.3 Installing the operating system......Page 573 B.1.4 Installing Docker and Kubernetes......Page 576 B.1.5 Cloning the VM......Page 577 B.2 Configuring the master with kubeadm......Page 579 B.2.1 Understanding how kubeadm runs the components......Page 580 B.3 Configuring worker nodes with kubeadm......Page 581 B.4 Using the cluster from your local machine......Page 582 C.1.1 Configuring Kubernetes to use rkt......Page 584 C.1.2 Trying out rkt with Minikube......Page 585 C.2.2 Running apps in virtual machines instead of containers......Page 587 D.1 Introducing Kubernetes Cluster Federation......Page 588 D.2 Understanding the architecture......Page 589 D.3.1 Introducing federated versions of Kubernetes resources......Page 590 D.3.2 Understanding what federated resources do......Page 591 A......Page 593 C......Page 595 D......Page 600 E......Page 603 G......Page 604 I......Page 605 K......Page 606 L......Page 608 M......Page 609 N......Page 610 P......Page 612 Q......Page 616 R......Page 617 S......Page 620 T......Page 624 V......Page 625 Y......Page 626 Kubernetes in Action–back......Page 628 SummaryKubernetes in Action is a comprehensive guide to effectively developing and running applications in a Kubernetes environment. Before diving into Kubernetes, the book gives an overview of container technologies like Docker, including how to build containers, so that even readers who haven't used these technologies before can get up and running.Purchase of the print book includes a free eBook in PDF, Kindle, and ePub formats from Manning Publications.About the TechnologyKubernetes is Greek for'helmsman,'your guide through unknown waters. The Kubernetes container orchestration system safely manages the structure and flow of a distributed application, organizing containers and services for maximum efficiency. Kubernetes serves as an operating system for your clusters, eliminating the need to factor the underlying network and server infrastructure into your designs.About the BookKubernetes in Action teaches you to use Kubernetes to deploy container-based distributed applications. You'll start with an overview of Docker and Kubernetes before building your first Kubernetes cluster. You'll gradually expand your initial application, adding features and deepening your knowledge of Kubernetes architecture and operation. As you navigate this comprehensive guide, you'll explore high-value topics like monitoring, tuning, and scaling. What's InsideKubernetes'internalsDeploying containers across a clusterSecuring clustersUpdating applications with zero downtimeAbout the ReaderWritten for intermediate software developers with little or no familiarity with Docker or container orchestration systems.About the AuthorMarko Luksa is an engineer at Red Hat working on Kubernetes and OpenShift.Table of ContentsPART 1 - OVERVIEWIntroducing Kubernetes First steps with Docker and Kubernetes PART 2 - CORE CONCEPTSPods: running containers in Kubernetes Replication and other controllers: deploying managed pods Services: enabling clients to discover and talk to pods Volumes: attaching disk storage to containers ConfigMaps and Secrets: configuring applications Accessing pod metadata and other resources from applications Deployments: updating applications declaratively StatefulSets: deploying replicated stateful applicationsPART 3 - BEYOND THE BASICSUnderstanding Kubernetes internals Securing the Kubernetes API server Securing cluster nodes and the network Managing pods'computational resources Automatic scaling of pods and cluster nodes Advanced scheduling Best practices for developing apps Extending Kubernetes