Oracle Cloud Infrastructure - A Guide to Building Cloud Native Applications

Oracle Cloud Infrastructure: A Guide to Building Cloud Native Applications Cloud native development is a modern approach to designing, building, deploying, and managing applications. This approach takes advantage of the benefits of utility computing from providers, such as Oracle Cloud Infrastructure (OCI), and emphasizes automation, elasticity, and resilience. OCI is a next-generation cloud designed to run any application faster and more securely for less. It includes the tools used to build new cloud native applications and to run existing enterprise applications without rearchitecting them. Whether you are new to the cloud or just new to OCI, this book provides an overview of the OCI services needed to build cloud native applications. You will learn OCI concepts and terminology How to manage Infrastructure as Code using modern tools and platforms OCI's breadth of cloud native services How to operate the managed Kubernetes service (Container Engine for Kubernetes) at scale How to configure a cluster for advanced use cases, and use specialized hardware capabilities How to use cloud native application deployment platforms and observability tools How to secure applications, data, and the underlying infrastructure using open-source and OCI native security tools and processes The culmination of the book is an open-source sample application composed of microservices that incorporates the tools and concepts shared throughout the book and is available on GitHub. Cover Half Title Title Page Copyright Page Contents Contents at a Glance 1 Introduction to Oracle Cloud Infrastructure Realms, Regions, and Availability Domains Tenancies and Compartments Controlling Access to Resources Cloud Guard and Security Zones Service Limits and Cost Management Getting Started with Your Tenancy Setting Up Users and Groups Setting Up API Keys and Auth Tokens Planning How Your Teams Will Use OCI Summary References 2 Infrastructure Automation and Management One Set of APIs, Different Ways to Call Them A Quick Terraform Primer A Basic Introduction to the Terraform Language Terraform State Tracking The OCI Terraform Provider Setting Up the OCI Terraform Provider Managing OCI Resources with Terraform Simplifying Infrastructure Management with the Resource Manager Service Helm and Kubernetes Providers Generating Resource Manager Stacks Resource Discovery Drift Detection Generating a User Interface from Terraform Configurations with a Custom Schema Publishing Your Stacks with Deploy Buttons Managing Multiregion and Multicloud Configurations Summary References 3 Cloud Native Services on Oracle Cloud Infrastructure Oracle Container Image Registry Working with OCIR Image Signing Image Scanning Creating Containers from Images Compute Instances Container Instances Container Engine for Kubernetes Service Mesh Serverless Functions API Gateways Components of an API Gateway Working with the API Gateway Service Messaging Systems Streaming Understanding the Streaming Service Working with the OCI Streaming Service OCI Events Service Summary References 4 Understanding Container Engine for Kubernetes Monoliths and Microservices Containers Container Orchestration and Kubernetes Oracle Container Engine for Kubernetes OCI-Managed Components and Customer-Managed Components Control Plane Data Plane Billable Components Kubernetes Concepts Cloud Controller Manager Nodes and Node Pools Node Pool Properties Worker Node Images and Shapes Kubernetes Labels SSH Keys Tagging Your Resources Creating a Cluster Quick Create Cluster Workflow Custom Create Cluster Workflow Using the OCI Command-Line Interface Using the Terraform Provider and Modules Automation and Terraform Code Generation Asynchronous Cluster Creation Cluster Topology Considerations Using Multiple Node Pools Scheduling Workloads on Specific Nodes Kubernetes Networking Container Network Interface (CNI) OCI VCN-Native Pod Networking CNI Flannel CNI Kubernetes Storage StorageClass: Flex Volume and CSI Plug-ins Updating the Default Storage Class File System Storage Kubernetes Load Balancer Support Working with the OCI Load Balancer Service SSL Termination with OCI Load Balancer Working with the OCI Network Load Balancer Service Specifying Reserved Public IP Addresses Commonly Used Annotations Understanding Security List Management Modes Using Node Label Selectors Security Considerations for Your Cluster Cluster Topology and Configuration Security Considerations Authorization Using Workload Identity and Instance Principls Securing Access to the Cluster OCI IAM and Kubernetes RBAC Federation with an IDP Summary References 5 Container Engine for Kubernetes in Practice Kubernetes Version Support Upgrading the Control Plane Upgrading the Data Plane Upgrading an Existing Node Pool Upgrading by Adding a Node Pool Alternative Host OS (Not Kubernetes Version) Upgrade Options Scaling a Cluster Manual Scaling Autoscaling Scaling Workloads and Infrastructure Together Autoscaler Best Practices Cluster Access and Token Generation Service Account Authentication Configuring DNS Configuring Node Local DNS Cache Configuring ExternalDNS Cluster Add-ons Configuring Add-ons Disabling Add-ons Observability: Prometheus and Grafana Monitoring Stack Components Installing the kube-prometheus-stack Operators and OCI Service Operator for Kubernetes Getting Started with Operators on OKE Operators for OCI, Oracle Database, and Oracle WebLogic Troubleshooting Nodes with Node Doctor Configuring SR-IOV Interfaces for Pods on OKE Using Multus Using Bare Metal Nodes Using Virtual Machine Nodes Summary References 6 Securing Your Workloads and Infrastructure Kubernetes Security Challenges Concepts of Kubernetes Security 4Cs of Kubernetes Security Securing Oracle Cloud Infrastructure Container Engine for Kubernetes (OKE) Private Clusters Kubernetes Role-Based Access Control (RBAC) with OCI IAM Groups Data Encryption and Key Management Service Audit Logging Security Zones Network Security Groups (NSGs) Web Application Firewall (WAF) Network Firewall Allowed Registries Cloud Guard Hardening Containers and OKE Worker Nodes Container Scanning Container Image Signing Center for Internet Security (CIS) Kubernetes Benchmarks Using SELinux with OKE Worker Nodes Limited Access Securing Your Workloads Security Context syscalls and seccomp Open Policy Agent (OPA) OPA Gatekeeper Open Web Application Security Project (OWASP) Supporting Tools External Container Scanning Tools CIS-CAT Pro Assessor Kube-bench AppArmor Falco Tracee Trivy National Institute of Standards and Technology (NIST) Kubernetes Benchmarks NIST Kubernetes Benchmarks National Checklist Program Repository National Vulnerability Database NIST SP 800-190 Application Container Security Guide Summary References 7 Serverless Platforms and Applications Container Instances Architecture Using Container Instances Serverless Functions OCI Functions Using OCI Functions Building Your First Function Adding an API Gateway Function Logs and Distributed Tracing Service Mesh Using the Service Mesh Adding a Service Mesh to an Application Summary References 8 Observability OCI Monitoring Alarms OCI Logging Service Logs Custom Logs Audit Logs Auditing OKE Activity Advanced Observability in OCI Logging Analytics Enabling and Using Logging Analytics Prometheus and Grafana with OKE Using the OCI DataSource Plug-ins for Grafana eBPF-Based Monitoring with Tetragon on OKE Tetragon: eBPF-Based Security Observability and Enforcement Running Tetragon on Oracle Container Engine for Kubernetes (OKE) Summary References 9 DevOps and Deployment Automation OCI DevOps Service Code Repositories Triggers Build Pipelines Artifacts Environments Deployment Pipelines Elastically Scaling Jenkins on Kubernetes Setting Up Jenkins on OKE GitOps with ArgoCD Setting Up Argo CD on OKE Summary References 10 Bringing It Together: MuShop Architecture Source Code Structure Services Storefront API Catalog Carts User Orders Fulfillment Payment Assets DBTools Edge Router Events Newsletter Subscription Load Building the Services Infrastructure Automation Helm Charts Utilities and Supporting Components Deploying MuShop Summary References Index A B C D E F G H I J K L M N O P Q R S T U V W X Y Z