Kubernetes in Action (Marko Lukša)（Z-Library）

Page 1

M A N N I N G Marko Lukša

Page 2

Kubernetes resources covered in the book * Cluster-level resource (not namespaced) ** Also in other API versions; listed version is the one used in this book (continues on inside back cover) Resource (abbr.) [API version] Description Section Namespace* (ns) [v1] Enables organizing resources into non-overlapping groups (for example, per tenant) 3.7 D ep lo yi ng w or kl oa ds Pod (po) [v1] The basic deployable unit containing one or more processes in co-located containers 3.1 ReplicaSet (rs) [apps/v1beta2**] Keeps one or more pod replicas running 4.3 ReplicationController (rc) [v1] The older, less-powerful equivalent of a ReplicaSet 4.2 Job [batch/v1] Runs pods that perform a completable task 4.5 CronJob [batch/v1beta1] Runs a scheduled job once or periodically 4.6 DaemonSet (ds) [apps/v1beta2**] Runs one pod replica per node (on all nodes or only on those matching a node selector) 4.4 StatefulSet (sts) [apps/v1beta1**] Runs stateful pods with a stable identity 10.2 Deployment (deploy) [apps/v1beta1**] Declarative deployment and updates of pods 9.3 S er vi ce s Service (svc) [v1] Exposes one or more pods at a single and stable IP address and port pair 5.1 Endpoints (ep) [v1] Defines which pods (or other servers) are exposed through a service 5.2.1 Ingress (ing) [extensions/v1beta1] Exposes one or more services to external clients through a single externally reachable IP address 5.4 C on fig ConfigMap (cm) [v1] A key-value map for storing non-sensitive config options for apps and exposing it to them 7.4 Secret [v1] Like a ConfigMap, but for sensitive data 7.5 S to ra ge PersistentVolume* (pv) [v1] Points to persistent storage that can be mounted into a pod through a PersistentVolumeClaim 6.5 PersistentVolumeClaim (pvc) [v1] A request for and claim to a PersistentVolume 6.5 StorageClass* (sc) [storage.k8s.io/v1] Defines the type of dynamically-provisioned stor- age claimable in a PersistentVolumeClaim 6.6

Page 3

Kubernetes in Action

Page 4

(This page has no text content)

Page 5

Kubernetes in Action MARKO LUKŠA M A N N I N G SHELTER ISLAND

Page 6

For online information and ordering of this and other Manning books, please visit www.manning.com. The publisher offers discounts on this book when ordered in quantity. For more information, please contact Special Sales Department Manning Publications Co. 20 Baldwin Road PO Box 761 Shelter Island, NY 11964 Email: orders@manning.com ©2018 by Manning Publications Co. All rights reserved. No part of this publication may be reproduced, stored in a retrieval system, or transmitted, in any form or by means electronic, mechanical, photocopying, or otherwise, without prior written permission of the publisher. Many of the designations used by manufacturers and sellers to distinguish their products are claimed as trademarks. Where those designations appear in the book, and Manning Publications was aware of a trademark claim, the designations have been printed in initial caps or all caps. Recognizing the importance of preserving what has been written, it is Manning’s policy to have the books we publish printed on acid-free paper, and we exert our best efforts to that end. Recognizing also our responsibility to conserve the resources of our planet, Manning books are printed on paper that is at least 15 percent recycled and processed without the use of elemental chlorine. Manning Publications Co. Development editor: Elesha Hyde 20 Baldwin Road Review editor: Aleksandar Dragosavljević PO Box 761 Technical development editor: Jeanne Boyarsky Shelter Island, NY 11964 Project editor: Kevin Sullivan Copyeditor: Katie Petito Proofreader: Melody Dolab Technical proofreader: Antonio Magnaghi Illustrator: Chuck Larson Typesetter: Dennis Dalinnik Cover designer: Marija Tudor ISBN: 9781617293726 Printed in the United States of America 1 2 3 4 5 6 7 8 9 10 – EBM – 22 21 20 19 18 17

Page 7

To my parents, who have always put their children’s needs above their own

Page 8

(This page has no text content)

Page 9

brief contents PART 1 OVERVIEW 1 ■ Introducing Kubernetes 1 2 ■ First steps with Docker and Kubernetes 25 PART 2 CORE CONCEPTS 3 ■ Pods: running containers in Kubernetes 55 4 ■ Replication and other controllers: deploying managed pods 84 5 ■ Services: enabling clients to discover and talk to pods 120 6 ■ Volumes: attaching disk storage to containers 159 7 ■ ConfigMaps and Secrets: configuring applications 191 8 ■ Accessing pod metadata and other resources from applications 225 9 ■ Deployments: updating applications declaratively 250 10 ■ StatefulSets: deploying replicated stateful applications 280vii

Page 10

BRIEF CONTENTSviiiPART 3 BEYOND THE BASICS 11 ■ Understanding Kubernetes internals 309 12 ■ Securing the Kubernetes API server 346 13 ■ Securing cluster nodes and the network 375 14 ■ Managing pods’ computational resources 404 15 ■ Automatic scaling of pods and cluster nodes 437 16 ■ Advanced scheduling 457 17 ■ Best practices for developing apps 477 18 ■ Extending Kubernetes 508

Page 11

contents preface xxi acknowledgments xxiii about this book xxv about the author xxix about the cover illustration xxx PART 1 OVERVIEW 1 Introducing Kubernetes 1 1.1 Understanding the need for a system like Kubernetes 2 Moving from monolithic apps to microservices 3 ■ Providing a consistent environment to applications 6 ■ Moving to continuous delivery: DevOps and NoOps 6 1.2 Introducing container technologies 7 Understanding what containers are 8 ■ Introducing the Docker container platform 12 ■ Introducing rkt—an alternative to Docker 15 1.3 Introducing Kubernetes 16 Understanding its origins 16 ■ Looking at Kubernetes from the top of a mountain 16 ■ Understanding the architecture of a Kubernetes cluster 18 ■ Running an application in Kubernetes 19 Understanding the benefits of using Kubernetes 21 1.4 Summary 23ix

Page 12

CONTENTSx2 First steps with Docker and Kubernetes 25 2.1 Creating, running, and sharing a container image 26 Installing Docker and running a Hello World container 26 Creating a trivial Node.js app 28 ■ Creating a Dockerfile for the image 29 ■ Building the container image 29 Running the container image 32 ■ Exploring the inside of a running container 33 ■ Stopping and removing a container 34 ■ Pushing the image to an image registry 35 2.2 Setting up a Kubernetes cluster 36 Running a local single-node Kubernetes cluster with Minikube 37 Using a hosted Kubernetes cluster with Google Kubernetes Engine 38 ■ Setting up an alias and command-line completion for kubectl 41 2.3 Running your first app on Kubernetes 42 Deploying your Node.js app 42 ■ Accessing your web application 45 ■ The logical parts of your system 47 Horizontally scaling the application 48 ■ Examining what nodes your app is running on 51 ■ Introducing the Kubernetes dashboard 52 2.4 Summary 53 PART 2 CORE CONCEPTS 3 Pods: running containers in Kubernetes 55 3.1 Introducing pods 56 Understanding why we need pods 56 ■ Understanding pods 57 Organizing containers across pods properly 58 3.2 Creating pods from YAML or JSON descriptors 61 Examining a YAML descriptor of an existing pod 61 ■ Creating a simple YAML descriptor for a pod 63 ■ Using kubectl create to create the pod 65 ■ Viewing application logs 65 ■ Sending requests to the pod 66 3.3 Organizing pods with labels 67 Introducing labels 68 ■ Specifying labels when creating a pod 69 Modifying labels of existing pods 70 3.4 Listing subsets of pods through label selectors 71 Listing pods using a label selector 71 ■ Using multiple conditions in a label selector 72

Page 13

CONTENTS xi3.5 Using labels and selectors to constrain pod scheduling 73 Using labels for categorizing worker nodes 74 ■ Scheduling pods to specific nodes 74 ■ Scheduling to one specific node 75 3.6 Annotating pods 75 Looking up an object’s annotations 75 ■ Adding and modifying annotations 76 3.7 Using namespaces to group resources 76 Understanding the need for namespaces 77 ■ Discovering other namespaces and their pods 77 ■ Creating a namespace 78 Managing objects in other namespaces 79 ■ Understanding the isolation provided by namespaces 79 3.8 Stopping and removing pods 80 Deleting a pod by name 80 ■ Deleting pods using label selectors 80 ■ Deleting pods by deleting the whole namespace 80 ■ Deleting all pods in a namespace, while keeping the namespace 81 ■ Deleting (almost) all resources in a namespace 82 3.9 Summary 82 4 Replication and other controllers: deploying managed pods 84 4.1 Keeping pods healthy 85 Introducing liveness probes 85 ■ Creating an HTTP-based liveness probe 86 ■ Seeing a liveness probe in action 87 Configuring additional properties of the liveness probe 88 Creating effective liveness probes 89 4.2 Introducing ReplicationControllers 90 The operation of a ReplicationController 91 ■ Creating a ReplicationController 93 ■ Seeing the ReplicationController in action 94 ■ Moving pods in and out of the scope of a ReplicationController 98 ■ Changing the pod template 101 Horizontally scaling pods 102 ■ Deleting a ReplicationController 103 4.3 Using ReplicaSets instead of ReplicationControllers 104 Comparing a ReplicaSet to a ReplicationController 105 Defining a ReplicaSet 105 ■ Creating and examining a ReplicaSet 106 ■ Using the ReplicaSet’s more expressive label selectors 107 ■ Wrapping up ReplicaSets 108

Page 14

CONTENTSxii4.4 Running exactly one pod on each node with DaemonSets 108 Using a DaemonSet to run a pod on every node 109 Using a DaemonSet to run pods only on certain nodes 109 4.5 Running pods that perform a single completable task 112 Introducing the Job resource 112 ■ Defining a Job resource 113 Seeing a Job run a pod 114 ■ Running multiple pod instances in a Job 114 ■ Limiting the time allowed for a Job pod to complete 116 4.6 Scheduling Jobs to run periodically or once in the future 116 Creating a CronJob 116 ■ Understanding how scheduled jobs are run 117 4.7 Summary 118 5 Services: enabling clients to discover and talk to pods 120 5.1 Introducing services 121 Creating services 122 ■ Discovering services 128 5.2 Connecting to services living outside the cluster 131 Introducing service endpoints 131 ■ Manually configuring service endpoints 132 ■ Creating an alias for an external service 134 5.3 Exposing services to external clients 134 Using a NodePort service 135 ■ Exposing a service through an external load balancer 138 ■ Understanding the peculiarities of external connections 141 5.4 Exposing services externally through an Ingress resource 142 Creating an Ingress resource 144 ■ Accessing the service through the Ingress 145 ■ Exposing multiple services through the same Ingress 146 ■ Configuring Ingress to handle TLS traffic 147 5.5 Signaling when a pod is ready to accept connections 149 Introducing readiness probes 149 ■ Adding a readiness probe to a pod 151 ■ Understanding what real-world readiness probes should do 153

Page 15

CONTENTS xiii5.6 Using a headless service for discovering individual pods 154 Creating a headless service 154 ■ Discovering pods through DNS 155 ■ Discovering all pods—even those that aren’t ready 156 5.7 Troubleshooting services 156 5.8 Summary 157 6 Volumes: attaching disk storage to containers 159 6.1 Introducing volumes 160 Explaining volumes in an example 160 ■ Introducing available volume types 162 6.2 Using volumes to share data between containers 163 Using an emptyDir volume 163 ■ Using a Git repository as the starting point for a volume 166 6.3 Accessing files on the worker node’s filesystem 169 Introducing the hostPath volume 169 ■ Examining system pods that use hostPath volumes 170 6.4 Using persistent storage 171 Using a GCE Persistent Disk in a pod volume 171 ■ Using other types of volumes with underlying persistent storage 174 6.5 Decoupling pods from the underlying storage technology 176 Introducing PersistentVolumes and PersistentVolumeClaims 176 Creating a PersistentVolume 177 ■ Claiming a PersistentVolume by creating a PersistentVolumeClaim 179 ■ Using a PersistentVolumeClaim in a pod 181 ■ Understanding the benefits of using PersistentVolumes and claims 182 ■ Recycling PersistentVolumes 183 6.6 Dynamic provisioning of PersistentVolumes 184 Defining the available storage types through StorageClass resources 185 ■ Requesting the storage class in a PersistentVolumeClaim 185 ■ Dynamic provisioning without specifying a storage class 187 6.7 Summary 190

Page 16

CONTENTSxiv7 ConfigMaps and Secrets: configuring applications 191 7.1 Configuring containerized applications 191 7.2 Passing command-line arguments to containers 192 Defining the command and arguments in Docker 193 Overriding the command and arguments in Kubernetes 195 7.3 Setting environment variables for a container 196 Specifying environment variables in a container definition 197 Referring to other environment variables in a variable’s value 198 Understanding the drawback of hardcoding environment variables 198 7.4 Decoupling configuration with a ConfigMap 198 Introducing ConfigMaps 198 ■ Creating a ConfigMap 200 Passing a ConfigMap entry to a container as an environment variable 202 ■ Passing all entries of a ConfigMap as environment variables at once 204 ■ Passing a ConfigMap entry as a command-line argument 204 ■ Using a configMap volume to expose ConfigMap entries as files 205 ■ Updating an app’s config without having to restart the app 211 7.5 Using Secrets to pass sensitive data to containers 213 Introducing Secrets 214 ■ Introducing the default token Secret 214 ■ Creating a Secret 216 ■ Comparing ConfigMaps and Secrets 217 ■ Using the Secret in a pod 218 Understanding image pull Secrets 222 7.6 Summary 224 8 Accessing pod metadata and other resources from applications 225 8.1 Passing metadata through the Downward API 226 Understanding the available metadata 226 ■ Exposing metadata through environment variables 227 ■ Passing metadata through files in a downwardAPI volume 230 8.2 Talking to the Kubernetes API server 233 Exploring the Kubernetes REST API 234 ■ Talking to the API server from within a pod 238 ■ Simplifying API server communication with ambassador containers 243 ■ Using client libraries to talk to the API server 246 8.3 Summary 249

Page 17

CONTENTS xv9 Deployments: updating applications declaratively 250 9.1 Updating applications running in pods 251 Deleting old pods and replacing them with new ones 252 Spinning up new pods and then deleting the old ones 252 9.2 Performing an automatic rolling update with a ReplicationController 254 Running the initial version of the app 254 ■ Performing a rolling update with kubectl 256 ■ Understanding why kubectl rolling- update is now obsolete 260 9.3 Using Deployments for updating apps declaratively 261 Creating a Deployment 262 ■ Updating a Deployment 264 Rolling back a deployment 268 ■ Controlling the rate of the rollout 271 ■ Pausing the rollout process 273 ■ Blocking rollouts of bad versions 274 9.4 Summary 279 10 StatefulSets: deploying replicated stateful applications 280 10.1 Replicating stateful pods 281 Running multiple replicas with separate storage for each 281 Providing a stable identity for each pod 282 10.2 Understanding StatefulSets 284 Comparing StatefulSets with ReplicaSets 284 ■ Providing a stable network identity 285 ■ Providing stable dedicated storage to each stateful instance 287 ■ Understanding StatefulSet guarantees 289 10.3 Using a StatefulSet 290 Creating the app and container image 290 ■ Deploying the app through a StatefulSet 291 ■ Playing with your pods 295 10.4 Discovering peers in a StatefulSet 299 Implementing peer discovery through DNS 301 ■ Updating a StatefulSet 302 ■ Trying out your clustered data store 303 10.5 Understanding how StatefulSets deal with node failures 304 Simulating a node’s disconnection from the network 304 Deleting the pod manually 306 10.6 Summary 307

Page 18

CONTENTSxviPART 3 BEYOND THE BASICS 11 Understanding Kubernetes internals 309 11.1 Understanding the architecture 310 The distributed nature of Kubernetes components 310 How Kubernetes uses etcd 312 ■ What the API server does 316 Understanding how the API server notifies clients of resource changes 318 ■ Understanding the Scheduler 319 Introducing the controllers running in the Controller Manager 321 What the Kubelet does 326 ■ The role of the Kubernetes Service Proxy 327 ■ Introducing Kubernetes add-ons 328 ■ Bringing it all together 330 11.2 How controllers cooperate 330 Understanding which components are involved 330 ■ The chain of events 331 ■ Observing cluster events 332 11.3 Understanding what a running pod is 333 11.4 Inter-pod networking 335 What the network must be like 335 ■ Diving deeper into how networking works 336 ■ Introducing the Container Network Interface 338 11.5 How services are implemented 338 Introducing the kube-proxy 339 ■ How kube-proxy uses iptables 339 11.6 Running highly available clusters 341 Making your apps highly available 341 ■ Making Kubernetes Control Plane components highly available 342 11.7 Summary 345 12 Securing the Kubernetes API server 346 12.1 Understanding authentication 346 Users and groups 347 ■ Introducing ServiceAccounts 348 Creating ServiceAccounts 349 ■ Assigning a ServiceAccount to a pod 351 12.2 Securing the cluster with role-based access control 353 Introducing the RBAC authorization plugin 353 ■ Introducing RBAC resources 355 ■ Using Roles and RoleBindings 358 Using ClusterRoles and ClusterRoleBindings 362 Understanding default ClusterRoles and ClusterRoleBindings 371 Granting authorization permissions wisely 373 12.3 Summary 373

Page 19

CONTENTS xvii13 Securing cluster nodes and the network 375 13.1 Using the host node’s namespaces in a pod 376 Using the node’s network namespace in a pod 376 ■ Binding to a host port without using the host’s network namespace 377 Using the node’s PID and IPC namespaces 379 13.2 Configuring the container’s security context 380 Running a container as a specific user 381 ■ Preventing a container from running as root 382 ■ Running pods in privileged mode 382 ■ Adding individual kernel capabilities to a container 384 ■ Dropping capabilities from a container 385 Preventing processes from writing to the container’s filesystem 386 Sharing volumes when containers run as different users 387 13.3 Restricting the use of security-related features in pods 389 Introducing the PodSecurityPolicy resource 389 ■ Understanding runAsUser, fsGroup, and supplementalGroups policies 392 Configuring allowed, default, and disallowed capabilities 394 Constraining the types of volumes pods can use 395 ■ Assigning different PodSecurityPolicies to different users and groups 396 13.4 Isolating the pod network 399 Enabling network isolation in a namespace 399 ■ Allowing only some pods in the namespace to connect to a server pod 400 Isolating the network between Kubernetes namespaces 401 Isolating using CIDR notation 402 ■ Limiting the outbound traffic of a set of pods 403 13.5 Summary 403 14 Managing pods’ computational resources 404 14.1 Requesting resources for a pod’s containers 405 Creating pods with resource requests 405 ■ Understanding how resource requests affect scheduling 406 ■ Understanding how CPU requests affect CPU time sharing 411 ■ Defining and requesting custom resources 411 14.2 Limiting resources available to a container 412 Setting a hard limit for the amount of resources a container can use 412 ■ Exceeding the limits 414 ■ Understanding how apps in containers see limits 415 14.3 Understanding pod QoS classes 417 Defining the QoS class for a pod 417 ■ Understanding which process gets killed when memory is low 420

Page 20

CONTENTSxviii14.4 Setting default requests and limits for pods per namespace 421 Introducing the LimitRange resource 421 ■ Creating a LimitRange object 422 ■ Enforcing the limits 423 Applying default resource requests and limits 424 14.5 Limiting the total resources available in a namespace 425 Introducing the ResourceQuota object 425 ■ Specifying a quota for persistent storage 427 ■ Limiting the number of objects that can be created 427 ■ Specifying quotas for specific pod states and/or QoS classes 429 14.6 Monitoring pod resource usage 430 Collecting and retrieving actual resource usages 430 ■ Storing and analyzing historical resource consumption statistics 432 14.7 Summary 435 15 Automatic scaling of pods and cluster nodes 437 15.1 Horizontal pod autoscaling 438 Understanding the autoscaling process 438 ■ Scaling based on CPU utilization 441 ■ Scaling based on memory consumption 448 ■ Scaling based on other and custom metrics 448 ■ Determining which metrics are appropriate for autoscaling 450 ■ Scaling down to zero replicas 450 15.2 Vertical pod autoscaling 451 Automatically configuring resource requests 451 ■ Modifying resource requests while a pod is running 451 15.3 Horizontal scaling of cluster nodes 452 Introducing the Cluster Autoscaler 452 ■ Enabling the Cluster Autoscaler 454 ■ Limiting service disruption during cluster scale-down 454 15.4 Summary 456 16 Advanced scheduling 457 16.1 Using taints and tolerations to repel pods from certain nodes 457 Introducing taints and tolerations 458 ■ Adding custom taints to a node 460 ■ Adding tolerations to pods 460 ■ Understanding what taints and tolerations can be used for 461