Kubernetes is an open-source system for automating deployment, scaling, and management of containerized applications. It groups containers that make up an application into logical units for easy management and discovery called pods. Its core components include a master node that manages the cluster and worker nodes that run the applications. It uses labels to organize resources and selectors to group related objects. Common concepts include deployments for updating apps, services for network access, persistent volumes for storage, and roles/bindings for access control. The deployment process involves controllers reconciling desired and current states by creating pods, replica sets, and other resources that interact with the Kubernetes API and are scheduled on nodes.
Intro to cluster scheduler for Linux containersKumar Gaurav
Cluster schedulers help manage resources and schedule jobs across multiple nodes in a container cluster. The main types are monolithic, two-level, and shared-state schedulers. Popular cluster schedulers for containers include Mesos, Docker Swarm, and Kubernetes. Each takes a different approach to scheduling but aim to provide high resource utilization, placement constraints, rapid scheduling, and fairness.
Slides used for Orchestructure May 2018 workshop.
Labs:
https://github.com/mrbobbytables/k8s-intro-tutorials
Event Information:
https://www.meetup.com/orchestructure/events/250189685/
This document summarizes the overall architecture and flow of Openstack Neutron. It describes the main components, including the Neutron server, plugins, mechanism drivers, agents, and databases. It explains the initialization process and how requests are handled through the REST APIs to trigger communication between components and data/control flows. Tips are also provided for extensions to Neutron's functionality.
(Draft) Kubernetes - A Comprehensive OverviewBob Killen
Kubernetes is an open-source system for automating deployment, scaling, and management of containerized applications. It groups containers that make up an application into logical units for easy management and discovery called pods. Its main components include a master node that manages the cluster and worker nodes that run the applications. It uses labels to organize resources and selectors to group related objects. Common concepts include pods, services for discovery/load balancing, replica controllers for scaling, and namespaces for isolation. It provides mechanisms for configuration, storage, security, and networking out of the box to ensure containers can run reliably and be easily managed at scale.
A Comprehensive Introduction to Kubernetes. This slide deck serves as the lecture portion of a full-day Workshop covering the architecture, concepts and components of Kubernetes. For the interactive portion, please see the tutorials here:
https://github.com/mrbobbytables/k8s-intro-tutorials
Service Discovery in kubernetes is all about how services of kubernetes get discovered internally and externally. How does a single POD communicate to another POD the within the cluster and how does a user request reach to a specific POD in the cluster? These are some questions that are answered by this TOPIC.
Kubernetes is a container orchestration system that manages the deployment and scaling of containerized applications. It groups containers into Pods and coordinates multiple Pods across a cluster of nodes. The document provides an overview of Kubernetes architecture, including its use of master and worker nodes, controllers that manage components and respond to events, and how containers are scheduled and replicated across nodes for scalability. It also compares containers to traditional virtual machines and microservices to provide context on Kubernetes and containerization.
- Introduction to Kubernetes features
- A look at Kubernetes Networking and Service Discovery
- New features in Kubernetes 1.6
- Kubernetes Installation options
To know more about our Kubernetes expertise, visit our center of excellence at: http://www.opcito.com/kubernetes/
Kubernetes @ Squarespace: Kubernetes in the DatacenterKevin Lynch
The document discusses Kubernetes adoption at Squarespace as their engineering organization grew. It describes the challenges of a monolithic architecture and how microservices addressed these challenges. It then discusses how Kubernetes helped solve operational challenges of provisioning and scaling microservices. Key Kubernetes concepts like pods, deployments, services and namespaces are explained. Monitoring, networking and security with Kubernetes are also covered.
Devstack is an OpenStack development environment that allows for single node and multi-node setups. It uses a cell architecture with parent and child cells where the parent cell acts as the API node and child cells handle compute functions. The document demonstrates configuring a parent-child cell environment using Devstack by setting configuration options in localrc and nova.conf files on the parent and child nodes and registering the cells with each other using nova-manage commands.
Kubernetes @ Squarespace (SRE Portland Meetup October 2017)Kevin Lynch
In this presentation I talk about our motivation to converting our microservices to run on Kubernetes. I discuss many of the technical challenges we encountered along the way, including networking issues, Java issues, monitoring and alerting, and managing all of our resources!
OpenStack Neutron Havana Overview - Oct 2013Edgar Magana
Presentation about OpenStack Neutron Overview presented during three meet-ups in NYC, Connecticut and Philadelphia during October 2013 by Edgar Magana from PLUMgrid
Hacking on OpenStack\'s Nova source codeZhongyue Luo
Understanding the source code of an open source project is essential not only to developers, but also to operators.
Nova, being the main project of OpenStack, covers the core functionality in which OpenStack provides.
Therefore understanding the inner structure of Nova should be beneficial to people related in all aspects.
This talk is about the structure of Nova\'s source code with an example to help you to understand the overall process scheme of OpenStack.
At the end, I briefly introduce how you can contribute to the OpenStack community.
MidoNet is an open source network operating system that provides software-defined networking and network virtualization capabilities. It features distributed logical switching, routing, firewalling, load balancing and tunneling using protocols like GRE and VXLAN. MidoNet integrates with OpenStack Neutron and has a REST API for configuration and management. It uses a distributed architecture with agents on each host controlling the Open vSwitch datapath and communicating with a central database for topology and configuration information. The MidoNet community is active on Slack, mailing lists, code reviews and documentation to support the project.
Securing & Monitoring Your K8s Cluster with RBAC and Prometheus”.Opcito Technologies
Opcito Technologies is a proud partner with Kubernetes, an open-source system for container orchestration.
We will be talking about:
• Features of Kubernetes 1.6
• RBAC Configurations
• RBAC Use Cases
• Running Prometheus in Kubernetes
• Prometheus Operator - Deployment, Cluster & Service Monitoring
The document discusses Docker 1.5 and its new features including IPv6 support, read-only containers, Docker stats, and the Docker image specification. IPv6 can be enabled by running Docker with the --ipv6 flag. Read-only containers restrict writes to containers. Docker stats provides live metrics for containers. The Docker image specification defines the format for layered image files and metadata.
Kubernetes is an open-source system for automating deployment, scaling, and management of containerized applications. It was originally developed by Google based on years of experience running production workloads at scale. Kubernetes groups containers into logical units called pods and handles tasks like scheduling, health checking, scaling and rollbacks. The main components include a master node that manages the cluster and worker nodes that run application containers scheduled by the master.
This document discusses OpenStack Neutron and software defined networking. It provides an overview of Neutron and how it allows network as a service capabilities. It describes the packet flow for virtual machines accessing the external network or communicating between virtual machines on the same network. It explains how Neutron integrates with Open vSwitch on the compute nodes to provide networking and discusses the various Neutron agents.
Kubernetes is an open-source system for automating deployment, scaling, and management of containerized applications. It groups containers that make up an application into logical units for easy management and discovery called pods. Kubernetes masters manage the cluster and make scheduling decisions while nodes run the pods and containers. It uses labels and selectors to identify and group related application objects together. Services provide a single endpoint for pods, while deployments help manage replicated applications. Kubernetes provides mechanisms for storage, configuration, networking, security and other functionality to help run distributed systems reliably at scale.
Kubernetes is an open-source system for automating deployment, scaling, and management of containerized applications. It groups containers that make up an application into logical units for easy management and discovery called pods. Kubernetes masters manage pods and provide shared services through components like etcd (for shared storage) and controllers. Nodes run pods and agents like kubelet and kube-proxy. Kubernetes uses concepts like deployments, services, and labels to abstractly define applications and make them accessible. It provides tools for self-healing, scaling, and lifetime management of containerized applications.
This presentation covers how app deployment model evolved from bare metal servers to Kubernetes World.
In addition to theoretical information, you will find free KATACODA workshops url to perform practices to understand the details of the each topics.
This document provides an overview of Kubernetes concepts including:
- Kubernetes architecture with masters running control plane components like the API server, scheduler, and controller manager, and nodes running pods and node agents.
- Key Kubernetes objects like pods, services, deployments, statefulsets, jobs and cronjobs that define and manage workloads.
- Networking concepts like services for service discovery, and ingress for external access.
- Storage with volumes, persistentvolumes, persistentvolumeclaims and storageclasses.
- Configuration with configmaps and secrets.
- Authentication and authorization using roles, rolebindings and serviceaccounts.
It also discusses Kubernetes installation with minikube, and common networking and deployment
Kubernetes is an open-source tool for managing containerized applications across clusters of nodes. It provides capabilities for deployment, maintenance, and scaling of applications. The document discusses Kubernetes concepts like pods, deployments, services, namespaces and components like the API server, scheduler and kubelet. It also covers Kubernetes commands and configuration using objects like config maps, secrets, volumes and labels.
Kubernetes-introduction to kubernetes for beginers.pptxrathnavel194
Kubernetes is an open source tool that provides automation and management of containerized applications across a cluster of nodes. It handles tasks like scheduling, deployment, scaling, and healing of containers. The main components include a master node with controllers and an API server, and worker nodes running kubelet and kube-proxy. Core objects in Kubernetes include pods to group related containers, services for discovery and load balancing, and deployments to declaratively manage replicated applications.
Kubernetes Architecture with ComponentsAjeet Singh
This document provides an overview of Kubernetes architecture and components. It describes how to run a simple Kubernetes setup using a Docker container. The container launches all key Kubernetes components including the API server, scheduler, etcd and controller manager. Using kubectl, the document demonstrates deploying an nginx pod and exposing it as a service. This allows curling the nginx default page via the service IP to confirm the basic setup is functioning.
Kubernetes is an open-source container management platform. It has a master-node architecture with control plane components like the API server on the master and node components like kubelet and kube-proxy on nodes. Kubernetes uses pods as the basic building block, which can contain one or more containers. Services provide discovery and load balancing for pods. Deployments manage pods and replicasets and provide declarative updates. Key concepts include volumes for persistent storage, namespaces for tenant isolation, labels for object tagging, and selector matching.
This is the most basic presentation introducing to the concepts of kubernetes this presentation only solves the mundane purpose as a visual aid to the session
Kubernetes is an open-source system for automating deployment, scaling, and management of containerized applications. It groups containers that make up an application into logical units for easy management and discovery called Pods. ReplicaSets ensure that a specified number of pod replicas are running at any given time. Key components include Pods, Services for enabling network access to applications, and Deployments to update Pods and manage releases.
Visualpath provides top-quality Certified Kubernetes Security Specialist Training Worldwide led by real-time instructors. We offer daily recordings and presentations for reference. Enroll for a Free Demo. Call +91-9989971070.
Visit Blog: https://visualpathblogs.com/
WhatsApp: https://www.whatsapp.com/catalog/917032290546/
Visit: https://www.visualpath.in/DevOps-docker-kubernetes-training.html
A brief study on Kubernetes and its componentsRamit Surana
Kubernetes is an open source orchestration system for Docker containers. It handles scheduling onto nodes in a compute cluster and actively manages workloads to ensure that their state matches the users declared intentions. Using the concepts of "labels" and "pods", it groups the containers which make up an application into logical units for easy management and discovery.
Recent momentum around the evolution of Containers are gradually increase in last two years.Containers virtualize an OS and applications running in each container believe that they have full access to their very own copy of that OS. This is analogous to what VMs do when they virtualize at a lower level, the hardware. In the case of containers, it’s the OS that does the virtualization and maintains the illusion.
Recent past many software companies have quickly adopted container technologies, including Docker Containers, aware of the threat and advantage of the approach. For example, Linux companies have also jumped into the ground, seeing as this as an opportunity to grow the Linux market. Also Microsoft is going to add features to support containers and VMware have made efforts in integrating support for Docker into virtual machine technology.
Recent momentum around the evolution of Containers are gradually increase in last two years.Containers virtualize an OS and applications running in each container believe that they have full access to their very own copy of that OS. This is analogous to what VMs do when they virtualize at a lower level, the hardware. In the case of containers, it’s the OS that does the virtualization and maintains the illusion.
Recent past many software companies have quickly adopted container technologies, including Docker Containers, aware of the threat and advantage of the approach. For example, Linux companies have also jumped into the ground, seeing as this as an opportunity to grow the Linux market. Also Microsoft is going to add features to support containers and VMware have made efforts in integrating support for Docker into virtual machine technology.
These slides were used during a technical session for the Cloud-Native El Salvador community. It covers the basic Kubernetes components, some installers and main Kubernetes resources. For the demo, it was used the capabilites provided by the Horizontal Pod Autoscaler.
Recent momentum around the evolution of Containers are gradually increase in last two years.Containers virtualize an OS and applications running in each container believe that they have full access to their very own copy of that OS. This is analogous to what VMs do when they virtualize at a lower level, the hardware. In the case of containers, it’s the OS that does the virtualization and maintains the illusion.
In Apache Cassandra Lunch #41: Apache Cassandra Lunch #41: Cassandra on Kubernetes - Docker/Kubernetes/Helm Part 1, we discuss Cassandra on Kubernetes and give an introduction to Docker, Kubernetes, and Helm.
Accompanying Blog: https://blog.anant.us/apache-cassandra-lunch-41-cassandra-on-kubernetes-docker-kubernetes-helm-part-1/
Accompanying YouTube: https://youtu.be/-I8cKQO_Qr0
Sign Up For Our Newsletter: http://eepurl.com/grdMkn
Join Cassandra Lunch Weekly at 12 PM EST Every Wednesday: https://www.meetup.com/Cassandra-DataStax-DC/events/
Cassandra.Link:
https://cassandra.link/
Follow Us and Reach Us At:
Anant:
https://www.anant.us/
Awesome Cassandra:
https://github.com/Anant/awesome-cassandra
Cassandra.Lunch:
https://github.com/Anant/Cassandra.Lunch
Email:
solutions@anant.us
LinkedIn:
https://www.linkedin.com/company/anant/
Twitter:
https://twitter.com/anantcorp
Eventbrite:
https://www.eventbrite.com/o/anant-1072927283
Facebook:
https://www.facebook.com/AnantCorp/
Profiling of Cafe Business in Talavera, Nueva Ecija: A Basis for Development ...IJAEMSJORNAL
This study aimed to profile the coffee shops in Talavera, Nueva Ecija, to develop a standardized checklist for aspiring entrepreneurs. The researchers surveyed 10 coffee shop owners in the municipality of Talavera. Through surveys, the researchers delved into the Owner's Demographic, Business details, Financial Requirements, and other requirements needed to consider starting up a coffee shop. Furthermore, through accurate analysis, the data obtained from the coffee shop owners are arranged to derive key insights. By analyzing this data, the study identifies best practices associated with start-up coffee shops’ profitability in Talavera. These findings were translated into a standardized checklist outlining essential procedures including the lists of equipment needed, financial requirements, and the Traditional and Social Media Marketing techniques. This standardized checklist served as a valuable tool for aspiring and existing coffee shop owners in Talavera, streamlining operations, ensuring consistency, and contributing to business success.
Software Engineering and Project Management - Introduction to Project ManagementPrakhyath Rai
Introduction to Project Management: Introduction, Project and Importance of Project Management, Contract Management, Activities Covered by Software Project Management, Plans, Methods and Methodologies, some ways of categorizing Software Projects, Stakeholders, Setting Objectives, Business Case, Project Success and Failure, Management and Management Control, Project Management life cycle, Traditional versus Modern Project Management Practices.
An Internet Protocol address (IP address) is a logical numeric address that is assigned to every single computer, printer, switch, router, tablets, smartphones or any other device that is part of a TCP/IP-based network.
Types of IP address-
Dynamic means "constantly changing “ .dynamic IP addresses aren't more powerful, but they can change.
Static means staying the same. Static. Stand. Stable. Yes, static IP addresses don't change.
Most IP addresses assigned today by Internet Service Providers are dynamic IP addresses. It's more cost effective for the ISP and you.
Literature Reivew of Student Center DesignPriyankaKarn3
It was back in 2020, during the COVID-19 lockdown Period when we were introduced to an Online learning system and had to carry out our Design studio work. The students of the Institute of Engineering, Purwanchal Campus, Dharan did the literature study and research. The team was of Prakash Roka Magar, Priyanka Karn (me), Riwaz Upreti, Sandip Seth, and Ujjwal Dev from the Department of Architecture. It was just a scratch draft made out of the initial phase of study just after the topic was introduced. It was one of the best teams I had worked with, shared lots of memories, and learned a lot.
Understanding Cybersecurity Breaches: Causes, Consequences, and PreventionBert Blevins
Cybersecurity breaches are a growing threat in today’s interconnected digital landscape, affecting individuals, businesses, and governments alike. These breaches compromise sensitive information and erode trust in online services and systems. Understanding the causes, consequences, and prevention strategies of cybersecurity breaches is crucial to protect against these pervasive risks.
Cybersecurity breaches refer to unauthorized access, manipulation, or destruction of digital information or systems. They can occur through various means such as malware, phishing attacks, insider threats, and vulnerabilities in software or hardware. Once a breach happens, cybercriminals can exploit the compromised data for financial gain, espionage, or sabotage. Causes of breaches include software and hardware vulnerabilities, phishing attacks, insider threats, weak passwords, and a lack of security awareness.
The consequences of cybersecurity breaches are severe. Financial loss is a significant impact, as organizations face theft of funds, legal fees, and repair costs. Breaches also damage reputations, leading to a loss of trust among customers, partners, and stakeholders. Regulatory penalties are another consequence, with hefty fines imposed for non-compliance with data protection regulations. Intellectual property theft undermines innovation and competitiveness, while disruptions of critical services like healthcare and utilities impact public safety and well-being.
Encontro anual da comunidade Splunk, onde discutimos todas as novidades apresentadas na conferência anual da Spunk, a .conf24 realizada em junho deste ano em Las Vegas.
Neste vídeo, trago os pontos chave do encontro, como:
- AI Assistant para uso junto com a SPL
- SPL2 para uso em Data Pipelines
- Ingest Processor
- Enterprise Security 8.0 (Maior atualização deste seu release)
- Federated Analytics
- Integração com Cisco XDR e Cisto Talos
- E muito mais.
Deixo ainda, alguns links com relatórios e conteúdo interessantes que podem ajudar no esclarecimento dos produtos e funções.
https://www.splunk.com/en_us/campaigns/the-hidden-costs-of-downtime.html
https://www.splunk.com/en_us/pdfs/gated/ebooks/building-a-leading-observability-practice.pdf
https://www.splunk.com/en_us/pdfs/gated/ebooks/building-a-modern-security-program.pdf
Nosso grupo oficial da Splunk:
https://usergroups.splunk.com/sao-paulo-splunk-user-group/
Response & Safe AI at Summer School of AI at IIITHIIIT Hyderabad
Talk covering Guardrails , Jailbreak, What is an alignment problem? RLHF, EU AI Act, Machine & Graph unlearning, Bias, Inconsistency, Probing, Interpretability, Bias
OCS Training Institute is pleased to co-operate with
a Global provider of Rig Inspection/Audits,
Commission-ing, Compliance & Acceptance as well as
& Engineering for Offshore Drilling Rigs, to deliver
Drilling Rig Inspec-tion Workshops (RIW) which
teaches the inspection & maintenance procedures
required to ensure equipment integrity. Candidates
learn to implement the relevant standards &
understand industry requirements so that they can
verify the condition of a rig’s equipment & improve
safety, thus reducing the number of accidents and
protecting the asset.
4. Intro - Who am I?
Bob Killen / rkillen@umich.edu
Twitter / Github: @mrbobbytables
Senior Research Cloud Administrator @ ARC-TS
http://arc-ts.umich.edu
5. Intro - What is Kubernetes?
Kubernetes or K8s was a project spun out of Google as a open source
next-gen container scheduler designed with the lessons learned from
developing and managing Borg and Omega.
Kubernetes was designed from the ground-up as a loosely coupled collection
of components centered around deploying, maintaining, and scaling
applications.
6. Intro - What Does Kubernetes do?
Kubernetes is the linux kernel of distributed systems.
It abstracts away the underlying hardware of the nodes and provides a
uniform interface for applications to be both deployed and consume the
shared pool of resources.
8. Architecture Overview
Masters - Acts as the primary control plane for Kubernetes. Masters are
responsible at a minimum for running the API Server, scheduler, and cluster
controller. They commonly also manage storing cluster state, cloud-provider
specific components and other cluster essential services.
Nodes - Are the ‘workers’ of a Kubernetes cluster. They run a minimal agent
that manages the node itself, and are tasked with executing workloads as
designated by the master.
12. kube-apiserver
The apiserver provides a forward facing REST interface into the kubernetes
control plane and datastore. All clients, including nodes, users and other
applications interact with kubernetes strictly through the API Server.
It is the true core of Kubernetes acting as the gatekeeper to the cluster by
handling authentication and authorization, request validation, mutation, and
admission control in addition to being the front-end to the backing datastore.
13. etcd
Etcd acts as the cluster datastore; providing a strong, consistent and highly
available key-value store used for persisting cluster state.
14. kube-controller-manager
The controller-manager is the primary daemon that manages all core
component control loops. It monitors the cluster state via the apiserver and
steers the cluster towards the desired state.
List of core controllers:
https://github.com/kubernetes/kubernetes/blob/master/cmd/kube-controller-manager/app/controllermanager.go#L332
15. cloud-controller-manager
The cloud-controller-manager is a daemon that provides cloud-provider
specific knowledge and integration capability into the core control loop of
Kubernetes. The controllers include Node, Route, Service, and add an
additional controller to handle PersistentVolumeLabels .
16. kube-scheduler
Kube-scheduler is a verbose policy-rich engine that evaluates workload
requirements and attempts to place it on a matching resource. These
requirements can include such things as general hardware reqs, affinity,
anti-affinity, and other custom resource requirements.
19. kubelet
Acts as the node agent responsible for managing pod lifecycle on its host.
Kubelet understands YAML container manifests that it can read from several
sources:
● File path
● HTTP Endpoint
● Etcd watch acting on any changes
● HTTP Server mode accepting container manifests over a simple API.
20. kube-proxy
Manages the network rules on each node and performs connection
forwarding or load balancing for Kubernetes cluster services.
Available Proxy Modes:
● Userspace
● iptables
● ipvs (alpha in 1.8)
21. Container Runtime
With respect to Kubernetes, A container runtime is a CRI (Container Runtime Interface)
compatible application that executes and manages containers.
● Containerd (docker)
● Cri-o
● Rkt
● Kata (formerly clear and hyper)
● Virtlet (VM CRI compatible runtime)
22. Additional Services
Kube-dns - Provides cluster wide DNS Services. Services are resolvable to
<service>.<namespace>.svc.cluster.local.
Heapster - Metrics Collector for kubernetes cluster, used by some resources
such as the Horizontal Pod Autoscaler. (required for kubedashboard metrics)
Kube-dashboard - A general purpose web based UI for kubernetes.
24. Networking - Fundamental Rules
1) All Pods can communicate with all other Pods without NAT
2) All nodes can communicate with all Pods (and vice-versa) without NAT.
3) The IP that a Pod sees itself as is the same IP that others see it as.
25. Networking - Fundamentals Applied
Containers in a pod exist within the same network namespace and share an
IP; allowing for intrapod communication over localhost.
Pods are given a cluster unique IP for the duration of its lifecycle, but the pods
themselves are fundamentally ephemeral.
Services are given a persistent cluster unique IP that spans the Pods lifecycle.
External Connectivity is generally handed by an integrated cloud provider or
other external entity (load balancer)
26. Networking - CNI
Networking within Kubernetes is plumbed via the Container Network
Interface (CNI), an interface between a container runtime and a network
implementation plugin.
Compatible CNI Network Plugins:
● Calico
● Cillium
● Contiv
● Contrail
● Flannel
● GCE
● kube-router
● Multus
● OpenVSwitch
● OVN
● Romana
● Weave
28. Kubernetes Concepts - Core
Cluster - A collection of hosts that aggregate their available resources including cpu, ram, disk,
and their devices into a usable pool.
Master - The master(s) represent a collection of components that make up the control plane of
Kubernetes. These components are responsible for all cluster decisions including both
scheduling and responding to cluster events.
Node - A single host, physical or virtual capable of running pods. A node is managed by the
master(s), and at a minimum runs both kubelet and kube-proxy to be considered part of the
cluster.
Namespace - A logical cluster or environment. Primary method of dividing a cluster or
scoping access.
29. Concepts - Core (cont.)
Label - Key-value pairs that are used to identify, describe and group together related sets of
objects. Labels have a strict syntax and available character set. *
Annotation - Key-value pairs that contain non-identifying information or metadata.
Annotations do not have the the syntax limitations as labels and can contain structured or
unstructured data.
Selector - Selectors use labels to filter or select objects. Both equality-based (=, ==, !=) or
simple key-value matching selectors are supported.
* https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#syntax-and-character-set
32. Concepts - Workloads
Pod - A pod is the smallest unit of work or management resource within Kubernetes. It is
comprised of one or more containers that share their storage, network, and context
(namespace, cgroups etc).
ReplicationController - Method of managing pod replicas and their lifecycle. Their
scheduling, scaling, and deletion.
ReplicaSet - Next Generation ReplicationController. Supports set-based selectors.
Deployment - A declarative method of managing stateless Pods and ReplicaSets. Provides
rollback functionality in addition to more granular update control mechanisms.
34. Concepts - Workloads (cont.)
StatefulSet - A controller tailored to managing Pods that must persist or maintain state. Pod
identity including hostname, network, and storage will be persisted.
DaemonSet - Ensures that all nodes matching certain criteria will run an instance of a
supplied Pod. Ideal for cluster wide services such as log forwarding, or health monitoring.
35. StatefulSet
● Attaches to ‘headeless service’ (not shown) nginx.
● Pods given unique ordinal names using the pattern
<statefulset name>-<ordinal index>.
● Creates independent persistent volumes based on
the ‘volumeClaimTemplates’.
36. DaemonSet
● Bypasses default scheduler
● Schedules a single instance on every host while
adhering to tolerances and taints.
37. Concepts - Workloads (cont.)
Job - The job controller ensures one or more pods are executed and successfully terminates. It
will do this until it satisfies the completion and/or parallelism condition.
CronJob - An extension of the Job Controller, it provides a method of executing jobs on a
cron-like schedule.
38. Jobs
● Number of pod executions can be controlled
via spec.completions
● Jobs can be parallelized using spec.parallelism
● Jobs and Pods are NOT automatically
cleaned up after a job has completed.
40. Concepts - Network
Service - Services provide a method of exposing and consuming L4 Pod network accessible
resources. They use label selectors to map groups of pods and ports to a cluster-unique virtual
IP.
Ingress - An ingress controller is the primary method of exposing a cluster service (usually
http) to the outside world. These are load balancers or routers that usually offer SSL
termination, name-based virtual hosting etc.
41. Service
● Acts as the unified method of accessing replicated pods.
● Four major Service Types:
○ CluterIP - Exposes service on a strictly cluster-internal IP (default)
○ NodePort - Service is exposed on each node’s IP on a statically
defined port.
○ LoadBalancer - Works in combination with a cloud provider to
expose a service outside the cluster on a static external IP.
○ ExternalName - used to references endpoints OUTSIDE the cluster
by providing a static internally referenced DNS name.
42. Ingress Controller
● Deployed as a pod to one or more hosts
● Ingress controllers are an external
controller with multiple options.
○ Nginx
○ HAproxy
○ Contour
○ Traefik
● Specific features and controller specific
configuration is passed through
annotations.
43. Concepts - Storage
Volume - Storage that is tied to the Pod Lifecycle, consumable by one or more
containers within the pod.
PersistentVolume - A PersistentVolume (PV) represents a storage resource. PVs are
commonly linked to a backing storage resource, NFS, GCEPersistentDisk, RBD etc. and are
provisioned ahead of time. Their lifecycle is handled independently from a pod.
PersistentVolumeClaim - A PersistentVolumeClaim (PVC) is a request for storage that
satisfies a set of requirements instead of mapping to a storage resource directly. Commonly
used with dynamically provisioned storage.
StorageClass - Storage classes are an abstraction on top of an external storage resource.
These will include a provisioner, provisioner configuration parameters as well as a PV
reclaimPolicy.
45. Persistent Volumes
● PVs are a cluster-wide resource
● Not directly consumable by a Pod
● PV Parameters:
○ Capacity
○ accessModes
■ ReadOnlyMany (ROX)
■ ReadWriteOnce (RWO)
■ ReadWriteMany (RWX)
○ persistentVolumeReclaimPolicy
■ Retain
■ Recycle
■ Delete
○ StorageClass
46. Persistent Volume Claims
● PVCs are scoped to namespaces
● Supports accessModes like PVs
● Uses resource request model similar to Pods
● Claims will consume storage from matching PVs
or StorageClasses based on storageClass and
selectors.
47. Storage Classes
● Uses an external system defined by the
provisioner to dynamically consume and
allocate storage.
● Storage Class Fields
○ Provisioner
○ Parameters
○ reclaimPolicy
48. Concepts - Configuration
ConfigMap - Externalized data stored within kubernetes that can be referenced as a
commandline argument, environment variable, or injected as a file into a volume mount. Ideal
for separating containerized application from configuration.
Secret - Functionally identical to ConfigMaps, but stored encoded as base64, and encrypted at
rest (if configured).
49. ConfigMaps and Secrets
● Can be used in Pod Config:
○ Injected as a file
○ Passed as an environment variable
○ Used as a container command (requires passing as env var)
50. Concepts - Auth and Identity (RBAC)
[Cluster]Role - Roles contain rules that act as a set of permissions that apply verbs like “get”,
“list”, “watch” etc over resources that are scoped to apiGroups. Roles are scoped to namespaces,
and ClusterRoles are applied cluster-wide.
[Cluster]RoleBinding - Grant the permissions as defined in a [Cluster]Role to one or more
“subjects” which can be a user, group, or service account.
ServiceAccount- ServiceAccounts provide a consumable identity for pods or external
services that interact with the cluster directly and are scoped to namespaces.
51. [Cluster]Role
● Permissions translate to url
path. With “” defaulting to core
group.
● Resources act as items the role
should be granted access to.
● Verbs are the actions the role
can perform on the referenced
resources.
52. [Cluster]RoleBinding
● Can reference multiple subjects
● Subjects can be of kind:
○ User
○ Group
○ ServiceAccount
● roleRef targets a single role only.
57. Kubectl
1) Kubectl performs client side
validation on manifest (linting).
2) Manifest is prepared and serialized
creating a JSON payload.
58. APIserver Request Loop
3) Kubectl authenticates to apiserver via x509, jwt,
http auth proxy, other plugins, or http-basic auth.
4) Authorization iterates over available AuthZ
sources: Node, ABAC, RBAC, or webhook.
5) AdmissionControl checks resource quotas,
other security related checks etc.
6) Request is stored in etcd.
7) Initializers are given opportunity to mutate request before the object is published.
8) Request is published on apiserver.
59. Deployment Controller
9) Deployment Controller is notified of the new
Deployment via callback.
10) Deployment Controller evaluates cluster state and
reconciles the desired vs current state and forms a
request for the new ReplicaSet.
11) apiserver request loop evaluates Deployment
Controller request.
12) ReplicaSet is published.
60. ReplicaSet Controller
13) ReplicaSet Controller is notified of the new ReplicaSet
via callback.
14) ReplicaSet Controller evaluates cluster state and
reconciles the desired vs current state and forms a request
for the desired amount of pods.
15) apiserver request loop evaluates ReplicaSet
Controller request.
16) Pods published, and enter ‘Pending’ phase.
62. Scheduler
17) Scheduler monitors published pods with no
‘NodeName’ assigned.
18) Applies scheduling rules and filters to find a
suitable node to host the Pod.
19) Scheduler creates a binding of Pod to Node and
POSTs to apiserver.
20) apiserver request loop evaluates POST request.
21) Pod status is updated with node binding and sets
status to ‘PodScheduled’.
63. Kubelet - PodSync
22) The kubelet daemon on every node polls the apiserver filtering
for pods matching its own ‘NodeName’; checking its current state
with the desired state published through the apiserver.
23) Kubelet will then move through a series of internal processes to
prepare the pod environment. This includes pulling secrets,
provisioning storage, applying AppArmor profiles and other various
scaffolding. During this period, it will asynchronously be POST’ing
the ‘PodStatus’ to the apiserver through the standard apiserver
request loop.
64. Pause and Plumbing
24) Kubelet then provisions a ‘pause’ container via the
CRI (Container Runtime Interface). The pause container
acts as the parent container for the Pod.
25) The network is plumbed to the Pod via the CNI
(Container Network Interface), creating a veth pair
attached to the pause container and to a container
bridge (cbr0).
26) IPAM handled by the CNI plugin assigns an IP to the
pause container.
65. Kublet - Create Containers
24) Kubelet pulls the container Images.
25) Kubelet first creates and starts any init containers.
26) Once the optional init containers complete, the
primary pod containers are started.
66. Pod Status
27) If there are any liveless/readiness probes, these are executed before the
PodStatus is updated.
28) If all complete successfully, PodStatus is set to ready and the container
has started successfully.
The Pod is Deployed!