Kubernetes presentation
1 like877 views
This document provides an overview of Kubernetes, including its architecture, components, concepts, and configuration. It describes that Kubernetes is an open-source container orchestration system designed by Google to manage containerized applications across multiple hosts. The key components include the master nodes which run control plane components like the API server, scheduler, and controller manager, and worker nodes which run the kubelet and containers. It also explains concepts like pods, services, deployments, networking, storage, and role-based access control (RBAC).
![Concepts - Auth and Identity (RBAC)
[Cluster]Role - Roles contain rules that act as a set of permissions that
apply verbs like “get”, “list”, “watch” etc over resources that are scoped
to apiGroups. Roles are scoped to namespaces, and ClusterRoles are
applied cluster-wide.
[Cluster]RoleBinding - Grant the permissions as defined in a
[Cluster]Role to one or more “subjects” which can be a user, group, or
service account.
ServiceAccount- ServiceAccounts provide a consumable identity for
pods or external services that interact with the cluster directly and are
scoped to namespaces.](https://image.slidesharecdn.com/gkepresentation-200404061633/85/Kubernetes-presentation-36-320.jpg)
![[Cluster]Role
● Permissions translate to url path. With “” defaulting to core group.
● Resources act as items the role should be granted access to.
● Verbs are the actions the role can perform on the referenced resources.](https://image.slidesharecdn.com/gkepresentation-200404061633/85/Kubernetes-presentation-37-320.jpg)
Ad
More Related Content
What's hot (20)
Similar to Kubernetes presentation (20)
Ad
Recently uploaded (20)
Ad
Kubernetes presentation
- 1. Kubernete s A Comprehensive Overview Gaurang Bajpai Lead Performance Engineer
- 2. Agenda • Introduction • What is Kubernetes • What does Kubernetes do? • Architecture • Master Component • Node Component • Additional Services • Networking • Concepts • Core • Workloads • Network • Storage • Configuration • Auth & Identity
- 3. Introduction What is Kubernetes? Kubernetes or K8s was a project spun out of Google as a open source next-gen container scheduler designed with the lessons learned from developing and managing Borg and Omega. Kubernetes was designed from the ground-up as a loosely coupled collection of components centered around deploying, maintaining, and scaling applications.
- 4. Introduction What does Kubernetes do? Kubernetes is the linux kernel of distributed systems. It abstracts away the underlying hardware of the nodes and provides a uniform interface for applications to be both deployed and consume the shared pool of resources.
- 6. Architecture Overview Architecture Overview Masters - Acts as the primary control plane for Kubernetes. Masters are responsible at a minimum for running the API Server, scheduler, and cluster controller. They commonly also manage storing cluster state, cloud- provider specific components and other cluster essential services. Nodes - Are the ‘workers’ of a Kubernetes cluster. They run a minimal
- 7. Architecture... Master Components: ● Kube-api server ● Etcd ● Kube-scheduler ● Kube-controller-manager ● Cloud-controller-manager ● Kubectl
- 8. Master Components: ● Kube-api Server The apiserver provides a forward facing REST interface into the kubernetes control plane and datastore. All clients, including nodes, users and other applications interact with kubernetes strictly through the API Server.It is the true core of Kubernetes acting as the gatekeeper to the cluster by handling authentication and authorization, request validation, mutation, and admission control in addition to being the front-end to the backing datastore.
- 9. Master Components: ● Etcd Etcd acts as the cluster datastore; providing a strong, consistent and highly available key-value store used for persisting cluster state. ● Kube-scheduler Kube-scheduler is a verbose policy-rich engine that evaluates workload requirements and attempts to place it on a matching resource. These requirements can include such things as general hardware reqs, affinity, anti-affinity, and other custom resource requirements.
- 10. Master Components: ● Kube-controller-manager The controller-manager is the primary daemon that manages all core component control loops. It monitors the cluster state via the apiserver and steers the cluster towards the desired state. ● Cloud-controller-manager The cloud-controller-manager is a daemon that provides cloud-provider specific knowledge and integration capability into the core control loop of Kubernetes. The controllers include Node, Route, Service, and add an additional controller to handle PersistentVolumeLabels .
- 11. Architecture... • Node Component ● Kubelet ● Kube-Proxy ●Container Runtime Engine
- 12. Node Component... ● Kubelet Acts as the node agent responsible for managing pod lifecycle on its host. Kubelet understands YAML container manifests that it can read from several sources: ● File path ● HTTP Endpoint ● Etcd watch acting on any changes ● HTTP Server mode accepting container manifests over a simple API.
- 13. Node Component... ● Kube-Proxy Manages the network rules on each node and performs connection forwarding or load balancing for Kubernetes cluster services. Available Proxy Modes: ● Userspace ● iptables ● ipvs (alpha in 1.8)
- 14. Node Component... ●Container Runtime Engine With respect to Kubernetes, A container runtime is a CRI (Container Runtime Interface) compatible application that executes and manages containers. ● Containerd (docker) ● Cri-o ● Rkt ● Kata (formerly clear and hyper)
- 15. Additional Services Kube-dns - Provides cluster wide DNS Services. Services are resolvable to <service>.<namespace>.svc.cluster.local. Heapster - Metrics Collector for kubernetes cluster, used by some resources. such as the Horizontal Pod Autoscaler. (required for kubedashboard metrics) Kube-dashboard - A general purpose web based UI for kubernetes.
- 16. Networking Networking - Fundamental Rules: All Pods can communicate with all other Pods without NAT All nodes can communicate with all Pods (and vice-versa) without NAT. The IP that a Pod sees itself as is the same IP that others see it as.
- 17. Networking... Networking - Fundamentals Applied Containers in a pod exist within the same network namespace and share an IP; allowing for intrapod communication over localhost. Pods are given a cluster unique IP for the duration of its lifecycle, but the pods themselves are fundamentally ephemeral. Services are given a persistent cluster unique IP that spans the Pods lifecycle.
- 18. Networking... Networking - CNI Networking within Kubernetes is plumbed via the Container Network Interface (CNI), an interface between a container runtime and a network implementation plugin. Compatible CNI Network Plugins: Calico Kube-router Cillium Multus Contiv OpenVSwitch Contrail OVN Flannel Romana GCE Weave
- 19. Kubernetes Concept Kubernetes Core Concepts- Cluster - A collection of hosts that aggregate their available resources including cpu, ram, disk, and their devices into a usable pool. Master - The master(s) represent a collection of components that make up the control plane of Kubernetes. These components are responsible for all cluster decisions including both scheduling and responding to cluster events. Node - A single host, physical or virtual capable of running pods. A node is managed by the master(s), and at a minimum runs both kubelet
- 20. Kubernetes Concept... Label - Key-value pairs that are used to identify, describe and group together related sets of objects. Labels have a strict syntax and available character set. * Annotation - Key-value pairs that contain non-identifying information or metadata. Annotations do not have the the syntax limitations as labels and can contain structured or unstructured data. Selector - Selectors use labels to filter or select objects. Both equality- based (=, ==, !=) or simple key-value matching selectors are supported.
- 21. Labels, Annotations & Selectors Labels: app: nginx tier: frontned Annotations description: “nginx frontend” Selector: app: nginx tier: frontend
- 23. Concepts - Workloads Pod - A pod is the smallest unit of work or management resource within Kubernetes. It is comprised of one or more containers that share their storage, network, and context (namespace, cgroups etc). ReplicationController - Method of managing pod replicas and their lifecycle. Their scheduling, scaling, and deletion. ReplicaSet- Next Generation ReplicationController. Supports set-based
- 24. Deployment It Contains configuration of how updates or Deployment spec. ‘deployments’ should be managed in addition to the pod template used to generate the ReplicaSet. ReplicaSet Generated ReplicaSet from Deployment spec
- 25. Concepts - Workloads... StatefulSet - A controller tailored to managing Pods that must persist or maintain state. Pod identity including hostname, network, and storage will be persisted. ● Attaches to ‘headeless service’ (not shown) nginx. ● Pods given unique ordinal names using the pattern <statefulset name>-<ordinal index>. ● Creates independent persistent volumes based on the ‘volumeClaimTemplates’.
- 26. Concepts - Workloads... DaemonSet - Ensures that all nodes matching certain criteria will run an instance of a supplied Pod. Ideal for cluster wide services such as log forwarding, or health monitoring. ● Bypasses default scheduler ● Schedules a single instance on every host while adhering to tolerances and taints.
- 27. Concepts - Workloads... Job - The job controller ensures one or more pods are executed and successfully terminates. It will do this until it satisfies the completion and/or parallelism condition. ● Number of pod executions can be controlled via spec.completions. ● Jobs can be parallelized using spec.parallelism. ● Jobs and Pods are NOT automatically cleaned up after a job has completed.
- 28. Concepts - Workloads... CronJob - An extension of the Job Controller, it provides a method of executing jobs on a cron-like schedule. ● Adds cron schedule to job template
- 29. Concepts - Network Service - Services provide a method of exposing and consuming L4
- 30. Concepts - Network... Ingress - An ingress controller is the
- 31. Concepts - Storage • Volume - Storage that is tied to the Pod Lifecycle, consumable by one or more containers within the pod. • PersistentVolume - A PersistentVolume (PV) represents a storage resource. PVs are commonly linked to a backing storage resource, NFS, GCEPersistentDisk, RBD etc. and are provisioned ahead of time. Their lifecycle is handled independently from a pod. • PersistentVolumeClaim - A PersistentVolumeClaim (PVC) is a request for storage that satisfies a set of requirements instead of mapping to a storage resource directly. Commonly used with dynamically provisioned storage. • StorageClass - Storage classes are an abstraction on top of an external storage resource. These will include a provisioner, provisioner
- 32. Volumes
- 33. Persistent Volumes ● PVs are a cluster-wide resource ● Not directly consumable by a Pod ● PV Parameters: ○ Capacity ○ accessModes ■ ReadOnlyMany (ROX) ■ ReadWriteOnce (RWO) ■ ReadWriteMany (RWX) ○ persistentVolumeReclaimPolicy ■ Retain ■ Recycle ■ Delete ○ StorageClass
- 34. Persistent Volume Claims ● PVCs are scoped to namespaces ● Supports accessModes like PVs ● Uses resource request model similar to Pods. ● Claims will consume storage from matching PVs or StorageClasses based on storageClass and selectors.
- 35. Storage Classes ● Uses an external system defined by the provisioner to dynamically consume and allocate storage. ● Storage Class Fields ○ Provisioner ○ Parameters ○ reclaimPolicy
- 36. Concepts - Auth and Identity (RBAC) [Cluster]Role - Roles contain rules that act as a set of permissions that apply verbs like “get”, “list”, “watch” etc over resources that are scoped to apiGroups. Roles are scoped to namespaces, and ClusterRoles are applied cluster-wide. [Cluster]RoleBinding - Grant the permissions as defined in a [Cluster]Role to one or more “subjects” which can be a user, group, or service account. ServiceAccount- ServiceAccounts provide a consumable identity for pods or external services that interact with the cluster directly and are scoped to namespaces.
- 37. [Cluster]Role ● Permissions translate to url path. With “” defaulting to core group. ● Resources act as items the role should be granted access to. ● Verbs are the actions the role can perform on the referenced resources.
- 38. Deployment FromBeginning to End
- 39. Kubectl 1) Kubectl performs client side validation on manifest (linting). 2) Manifest is prepared and serialized creating a JSON payload.
- 40. APIserver Request Loop 3) Kubectl authenticates to apiserver via x509, jwt, http auth proxy, other plugins, or http-basic auth. 4) Authorization iterates over available AuthZ sources: Node, ABAC, RBAC, or webhook. 5) AdmissionControl checks resource quotas, other security related checks etc.
- 41. Deployment Controller 9) Deployment Controller is notified of the new Deployment via callback. 10) Deployment Controller evaluates cluster state and reconciles the desired vs current state and forms a request for the new ReplicaSet. 11) apiserver request loop
- 42. ReplicaSet Controller 13) ReplicaSet Controller is notified of the new ReplicaSet via callback. 14) ReplicaSet Controller evaluates cluster state and reconciles the desired vs current state and forms a request for the desired amount of pods. 15) apiserver request loop evaluates ReplicaSet Controller request.
- 44. Scheduler 17) Scheduler monitors published pods with no ‘NodeName’ assigned. 18) Applies scheduling rules and filters to find a suitable node to host the Pod. 19) Scheduler creates a binding of Pod to Node and POSTs to apiserver. 20) apiserver request loop evaluates POST request. 21) Pod status is updated with node binding and sets status to ‘PodScheduled’.
- 45. Kubelet - PodSync 22) The kubelet daemon on every node polls the apiserver filtering for pods matching its own ‘NodeName’; checking its current state with the desired state published through the apiserver. 23) Kubelet will then move through a series of internal processes to prepare the pod environment. This includes pulling secrets, provisioning storage, applying AppArmor profiles and other various scaffolding. During this period, it will asynchronously be POST’ing the ‘PodStatus’ to the apiserver through the standard apiserver request loop.
- 46. Kublet - Create Containers 24) Kubelet pulls the container Images. 25) Kubelet first creates and starts any init containers. 26) Once the optional init containers complete, the primary pod containers are started.
- 47. Pod Status 27) If there are any liveless/readiness probes, these are executed before the PodStatus is updated. 28) If all complete successfully, PodStatus is set to ready and the container has started successfully. The Pod is Deployed!
- 48. Thank U