| Preface |
|
xv | |
| Acknowledgments |
|
xvi | |
| About this book |
|
xviii | |
| About the authors |
|
xxi | |
| About the cover illustration |
|
xxiii | |
| 1 Why Kubernetes exists |
|
1 | (13) |
|
1.1 Reviewing a few key terms before we get started |
|
|
2 | (1) |
|
1.2 The infrastructure drift problem and Kubernetes |
|
|
2 | (1) |
|
1.3 Containers and images |
|
|
3 | (2) |
|
1.4 Core foundation of Kubernetes |
|
|
5 | (2) |
|
All infrastructure rules in Kubernetes are managed as plain YAML |
|
|
7 | (1) |
|
|
|
7 | (2) |
|
1.6 Kubernetes components and architecture |
|
|
9 | (3) |
|
|
|
9 | (2) |
|
Example one: An online retailer |
|
|
11 | (1) |
|
Example two: An online giving solution |
|
|
11 | (1) |
|
1.7 When not to use Kubernetes |
|
|
12 | (2) |
| 2 Why the Pod? |
|
14 | (25) |
|
2.1 An example web application |
|
|
16 | (3) |
|
Infrastructure for our web application |
|
|
18 | (1) |
|
|
|
18 | (1) |
|
|
|
19 | (10) |
|
A bunch of Linux namespaces |
|
|
22 | (1) |
|
Kubernetes, infrastructure, and the Pod |
|
|
22 | (2) |
|
|
|
24 | (4) |
|
Our web application and the control plane |
|
|
28 | (1) |
|
2.3 Creating a web application with kubectl |
|
|
29 | (6) |
|
The Kubernetes API server: kube-apiserver |
|
|
30 | (1) |
|
The Kubernetes scheduler: kube-scheduler |
|
|
31 | (1) |
|
Infrastructure controllers |
|
|
31 | (4) |
|
2.4 Scaling, highly available applications, and the control plane |
|
|
35 | (4) |
|
|
|
37 | (1) |
|
|
|
37 | (2) |
| 3 Let's build a Pod |
|
39 | (30) |
|
3.1 Looking at Kubernetes primitives with kind |
|
|
42 | (1) |
|
3.2 What is a Linux primitive? |
|
|
43 | (5) |
|
Linux primitives are resource management tools |
|
|
44 | (1) |
|
Everything is a file (or a file descriptor) |
|
|
45 | (1) |
|
|
|
45 | (1) |
|
|
|
46 | (2) |
|
3.3 Using Linux primitives in Kubernetes |
|
|
48 | (7) |
|
The prerequisites for running a Pod |
|
|
48 | (1) |
|
|
|
49 | (2) |
|
Exploring the Pod's Linux dependencies |
|
|
51 | (4) |
|
3.4 Building a Pod from scratch |
|
|
55 | (9) |
|
Creating an isolated process with chroot |
|
|
56 | (2) |
|
Using mount to give our process data to work with |
|
|
58 | (1) |
|
Securing our process with unshare |
|
|
59 | (1) |
|
Creating a network namespace |
|
|
60 | (1) |
|
Checking whether a process is healthy |
|
|
61 | (1) |
|
Adjusting CPU with cgroups |
|
|
62 | (1) |
|
Creating a resources stanza |
|
|
63 | (1) |
|
3.5 Using our Pod in the real world |
|
|
64 | (5) |
|
|
|
64 | (1) |
|
Utilizing iptables to understand how kube-proxy implements Kubernetes services |
|
|
65 | (1) |
|
|
|
66 | (1) |
|
|
|
67 | (2) |
| 4 Using cgroups for processes in our Pods |
|
69 | (25) |
|
4.1 Pods are idle until the prep work completes |
|
|
70 | (2) |
|
4.2 Processes and threads in Linux |
|
|
72 | (6) |
|
systemd and the init process |
|
|
73 | (1) |
|
|
|
74 | (3) |
|
Implementing cgroups for a normal Pod |
|
|
77 | (1) |
|
|
|
78 | (1) |
|
4.4 How the kubelet manages cgroups |
|
|
79 | (1) |
|
4.5 Diving into how the kubelet manages resources |
|
|
80 | (5) |
|
Why can't the OS use swap in Kubernetes? |
|
|
81 | (1) |
|
Hack: The poor man's priority knob |
|
|
82 | (1) |
|
Hack: Editing Huge Pages with init containers |
|
|
83 | (1) |
|
QoS classes: Why they matter and how they work |
|
|
83 | (1) |
|
Creating QoS classes by setting resources |
|
|
84 | (1) |
|
4.6 Monitoring the Linux kernel with Prometheus, cAdvisor, and the API server |
|
|
85 | (9) |
|
Metrics are cheap to publish and extremely valuable |
|
|
87 | (1) |
|
Why do I need Prometheus? |
|
|
88 | (1) |
|
Creating a local Prometheus monitoring service |
|
|
89 | (3) |
|
Characterizing an outage in Prometheus |
|
|
92 | (2) |
| 5 CNIS and providing the Pod with a network |
|
94 | (19) |
|
5.1 Why we need software-defined networks in Kubernetes |
|
|
96 | (1) |
|
5.2 Implementing the service side of the Kubernetes SDN: The kube-proxy |
|
|
97 | (5) |
|
The kube-proxy's data plane |
|
|
99 | (2) |
|
|
|
101 | (1) |
|
|
|
102 | (1) |
|
5.4 Diving into two CNI networking plugins: Calico and Antrea |
|
|
103 | (10) |
|
The architecture of a CNI plugin |
|
|
104 | (1) |
|
Let's play with some CNIs |
|
|
105 | (1) |
|
Installing the Calico CNI provider |
|
|
106 | (3) |
|
Kubernetes networking with OVS and Antrea |
|
|
109 | (3) |
|
A note on CNI providers and kube-proxy on different OSs |
|
|
112 | (1) |
| 6 Troubleshooting large-scale network errors |
|
113 | (22) |
|
6.1 Sonobuoy: A tool for confirming your cluster is functioning |
|
|
114 | (3) |
|
Tracing data paths for Pods in a real cluster |
|
|
115 | (1) |
|
Setting up a cluster with the Antrea CNI provider |
|
|
116 | (1) |
|
6.2 Inspecting CNI routing on different providers with the arp and ip commands |
|
|
117 | (6) |
|
What is an IP tunnel and why do CNI providers use them? |
|
|
118 | (1) |
|
How many packets are flowing through the network interfaces for our CNI? |
|
|
118 | (1) |
|
|
|
119 | (2) |
|
CNI-specific tooling: Open vSwitch (OVS) |
|
|
121 | (1) |
|
Tracing the data path of active containers with tcpdump |
|
|
121 | (2) |
|
6.3 The kube-proxy and iptables |
|
|
123 | (6) |
|
iptables-save and the diff tool |
|
|
123 | (1) |
|
Looking at how network policies modify CNI rules |
|
|
124 | (3) |
|
How are these policies implemented? |
|
|
127 | (2) |
|
|
|
129 | (6) |
|
Setting up Contour and kind to explore ingress controllers |
|
|
129 | (1) |
|
Setting up a simple web server Pod |
|
|
130 | (5) |
| 7 Pod storage and the CSI |
|
135 | (17) |
|
7.1 A quick detour: The virtual filesystem (VFS) in Linux |
|
|
137 | (1) |
|
7.2 Three types of storage requirements for Kubernetes |
|
|
138 | (2) |
|
7.3 Let's create a PVC in our kind cluster |
|
|
140 | (4) |
|
7.4 The container storage interface (CSI) |
|
|
144 | (4) |
|
The in-tree provider problem |
|
|
145 | (1) |
|
CSI as a specification that works inside of Kubernetes |
|
|
146 | (1) |
|
CSI: How a storage driver works |
|
|
147 | (1) |
|
|
|
148 | (1) |
|
7.5 A quick look at a few running CSI drivers |
|
|
148 | (4) |
|
|
|
149 | (1) |
|
|
|
149 | (1) |
|
|
|
150 | (2) |
| 8 Storage implementation and modeling |
|
152 | (20) |
|
8.1 A microcosm of the broader Kubernetes ecosystem: Dynamic storage |
|
|
153 | (5) |
|
Managing storage on the fly: Dynamic provisioning |
|
|
154 | (1) |
|
Local storage compared with emptyDir |
|
|
154 | (2) |
|
|
|
156 | (1) |
|
CSI (container storage interface) |
|
|
157 | (1) |
|
8.2 Dynamic provisioning benefits from CSI but is orthogonal |
|
|
158 | (3) |
|
|
|
159 | (1) |
|
Back to the data center stuff |
|
|
160 | (1) |
|
8.3 Kubernetes use cases for storage |
|
|
161 | (3) |
|
Secrets: Sharing files ephemerally |
|
|
161 | (3) |
|
8.4 What does a dynamic storage provider typically look like? |
|
|
164 | (2) |
|
8.5 hostPath for system control and/or data access |
|
|
166 | (4) |
|
hostPaths, CSI, and CNI: A canonical use case |
|
|
166 | (2) |
|
Cassandra: An example of real-world Kubernetes application storage |
|
|
168 | (1) |
|
Advanced storage functionality and the Kubernetes storage model |
|
|
169 | (1) |
|
|
|
170 | (2) |
| 9 Running Pods: How the kubelet works |
|
172 | (20) |
|
9.1 The kubelet and the node |
|
|
173 | (1) |
|
|
|
174 | (4) |
|
Container runtimes: Standards and conventions |
|
|
175 | (1) |
|
The kubelet configurations and its API |
|
|
176 | (2) |
|
9.3 Creating a Pod and seeing it in action |
|
|
178 | (7) |
|
Starting the kubelet binary |
|
|
179 | (1) |
|
After startup: Node life cycle |
|
|
180 | (1) |
|
Leasing and locking in etcd and the evolution of the node lease |
|
|
180 | (1) |
|
The kubelet's management of the Pod life cycle |
|
|
181 | (1) |
|
CRI, containers, and images: How they are related |
|
|
182 | (1) |
|
The kubelet doesn't run containers: That's the CRT's job |
|
|
182 | (2) |
|
Pause container: An "aha" moment |
|
|
184 | (1) |
|
9.4 The Container Runtime Interface (CRI) |
|
|
185 | (2) |
|
Telling Kubernetes where our container runtime lives |
|
|
185 | (1) |
|
|
|
186 | (1) |
|
The kubelet's abstraction around CRI: The GenericRuntimeManager |
|
|
186 | (1) |
|
|
|
186 | (1) |
|
9.5 The kubelet's interfaces |
|
|
187 | (3) |
|
The Runtime internal interface |
|
|
187 | (1) |
|
How the kubelet pulls images: The ImageService intelface |
|
|
188 | (1) |
|
Giving ImagePullSecrets to the kubelet |
|
|
189 | (1) |
|
|
|
190 | (2) |
| 10 DNS in Kubernetes |
|
192 | (13) |
|
10.1 A brief intro to DNS (and CoreDNS) |
|
|
192 | (4) |
|
NXDOMAINs, A records, and CNAME records |
|
|
193 | (2) |
|
|
|
195 | (1) |
|
10.2 Why StatefulSets instead of Deployments? |
|
|
196 | (4) |
|
DNS with headless services |
|
|
197 | (1) |
|
Persistent DNS records in StatefulSets |
|
|
198 | (1) |
|
Using a polyglot deployment to explore Pod DNS properties |
|
|
198 | (2) |
|
10.3 The resolv.conf file |
|
|
200 | (5) |
|
A quick note about routing |
|
|
200 | (2) |
|
CoreDNS: The upstream resolver for the ClusterFirst Pod DNS |
|
|
202 | (1) |
|
Hacking the CoreDNS plugin configuration |
|
|
203 | (2) |
| 11 The core of the control plane |
|
205 | (14) |
|
11.1 Investigating the control plane |
|
|
206 | (1) |
|
|
|
207 | (7) |
|
API objects and custom API objects |
|
|
207 | (1) |
|
Custom resource definitions (CRDs) |
|
|
208 | (1) |
|
|
|
209 | (5) |
|
|
|
214 | (1) |
|
11.3 The controller manager |
|
|
214 | (2) |
|
|
|
214 | (1) |
|
Service accounts and tokens |
|
|
215 | (1) |
|
11.4 Kubernetes cloud controller managers (CCMs) |
|
|
216 | (1) |
|
|
|
217 | (2) |
| 12 etcd and the control plane |
|
219 | (21) |
|
12.1 Notes for the impatient |
|
|
220 | (7) |
|
Visualizing etcd performance with Prometheus |
|
|
221 | (4) |
|
Knowing when to tune etcd |
|
|
225 | (1) |
|
Example: A quick health check of etcd |
|
|
226 | (1) |
|
|
|
227 | (1) |
|
12.2 etcd as a data store |
|
|
227 | (4) |
|
The watch: Can you run Kubernetes on other databases? |
|
|
228 | (1) |
|
|
|
229 | (1) |
|
fsync operations make etcd consistent |
|
|
230 | (1) |
|
12.3 Looking at the interface for Kubernetes to etcd |
|
|
231 | (1) |
|
12.4 etcd's job is to keep the facts straight |
|
|
231 | (2) |
|
|
|
232 | (1) |
|
|
|
233 | (1) |
|
|
|
233 | (1) |
|
12.6 Load balancing at the client level and etcd |
|
|
234 | (2) |
|
Size limitations: What (not) to worry about |
|
|
235 | (1) |
|
12.7 etcd encryption at rest |
|
|
236 | (1) |
|
12.8 Performance and fault tolerance of etcd at a global scale |
|
|
237 | (1) |
|
12.9 Heartbeat times for a highly distributed etcd |
|
|
237 | (1) |
|
12.10 Setting an etcd client up on a kind cluster |
|
|
237 | (3) |
|
Running etcd in non-Linux environments |
|
|
238 | (2) |
| 13 Container and Pod security |
|
240 | (14) |
|
|
|
241 | (1) |
|
|
|
242 | (1) |
|
|
|
242 | (1) |
|
|
|
242 | (3) |
|
Plan to update containers and custom software |
|
|
242 | (1) |
|
|
|
243 | (1) |
|
Container users-do not run as root |
|
|
243 | (1) |
|
Use the smallest container |
|
|
244 | (1) |
|
|
|
244 | (1) |
|
|
|
245 | (1) |
|
|
|
245 | (9) |
|
|
|
245 | (3) |
|
Escalated permissions and capabilities |
|
|
248 | (1) |
|
Pod Security Policies (PSPs) |
|
|
249 | (2) |
|
Do not automount the service account token |
|
|
251 | (1) |
|
|
|
251 | (1) |
|
|
|
252 | (2) |
| 14 Nodes and Kubernetes security |
|
254 | (27) |
|
|
|
254 | (7) |
|
|
|
255 | (1) |
|
Immutable OSs vs. patching nodes |
|
|
256 | (1) |
|
Isolated container runtimes |
|
|
257 | (1) |
|
|
|
257 | (1) |
|
|
|
258 | (1) |
|
|
|
259 | (1) |
|
|
|
259 | (1) |
|
Host networks vs. Pod networks |
|
|
259 | (1) |
|
|
|
260 | (1) |
|
|
|
261 | (6) |
|
Role-based access control (RBAC) |
|
|
261 | (1) |
|
|
|
261 | (3) |
|
Resources and subresources |
|
|
264 | (1) |
|
|
|
265 | (1) |
|
|
|
266 | (1) |
|
14.3 Authn, Authz, and Secrets |
|
|
267 | (2) |
|
IAM service accounts: Securing your cloud APIs |
|
|
267 | (1) |
|
Access to cloud resources |
|
|
268 | (1) |
|
|
|
269 | (1) |
|
|
|
269 | (10) |
|
|
|
269 | (4) |
|
|
|
273 | (1) |
|
|
|
274 | (3) |
|
|
|
277 | (2) |
|
|
|
279 | (2) |
| 15 Installing applications |
|
281 | (20) |
|
15.1 Thinking about apps in Kubernetes |
|
|
282 | (1) |
|
Application scope influences what tools you should use |
|
|
283 | (1) |
|
15.2 Microservice apps typically require thousands of lines of configuration code |
|
|
283 | (1) |
|
15.3 Rethinking our Guestbook app installation for the real world |
|
|
284 | (1) |
|
15.4 Installing the Carvel toolkit |
|
|
284 | (11) |
|
Part 1: Modularizing our resources into separate files |
|
|
285 | (1) |
|
Part 2: Patching our application files with ytt |
|
|
286 | (3) |
|
Part 3: Managing and deploying Guestbook as a single application |
|
|
289 | (3) |
|
Part 4: Constructing a kapp Operator to package and manage our application |
|
|
292 | (3) |
|
15.5 Revisiting the Kubernetes Operator |
|
|
295 | (4) |
|
15.6 Tanzu Community Edition: An end-to-end example of the Carvel toolkit |
|
|
299 | (2) |
| Index |
|
301 | |
