Name: Kubernetes – An Enterprise Guide
Author: Marc Boorshtein Scott Surovich Ed Price
ISBN: 9781835081754

微信读书书城Kubernetes – An Enterprise Guide

首页我的书架登录

翻译完成

切换

Kubernetes – An Enterprise Guide

Marc Boorshtein Scott Surovich Ed Price

扉页
版权信息
+书签
Foreword
Contributors
About the authors
About the reviewers
Join our book’s Discord space
Preface
Who this book is for
What this book covers
To get the most out of this book
Download the example code files
Download the color images
Supplementary content
Conventions used
Get in touch
Share your thoughts
Download a free PDF copy of this book
1 Docker and Container Essentials
Technical requirements
Understanding the need for containerization
Understanding why Kubernetes removed Docker
Introducing Docker
Docker versus Moby
Understanding Docker
Containers are ephemeral
Docker images
Image layers
Persistent data
Accessing services running in containers
Installing Docker
Preparing to install Docker
Installing Docker on Ubuntu
Granting Docker permissions
Using the Docker CLI
docker help
docker run
docker ps
docker start and stop
docker attach
docker exec
docker logs
docker rm
docker pull/run
docker build
Summary
Questions
Join our book’s Discord space
2 Deploying Kubernetes Using KinD
Technical requirements
Introducing Kubernetes components and objects
Interacting with a cluster
Using development clusters
Why did we select KinD for this book?
Working with a basic KinD Kubernetes cluster
Understanding the node image
KinD and Docker networking
Installing KinD
Installing KinD – prerequisites
Installing the KinD binary
Creating a KinD cluster
Creating a simple cluster
Deleting a cluster
Creating a cluster config file
Multi-node cluster configuration
Customizing the control plane and Kubelet options
Creating a custom KinD cluster
Reviewing your KinD cluster
KinD storage objects
Storage drivers
KinD storage classes
Using KinD’s Storage Provisioner
Adding a custom load balancer for Ingress
Creating the KinD cluster configuration
The HAProxy configuration file
Understanding HAProxy traffic flow
Simulating a kubelet failure
Summary
Questions
3 Kubernetes Bootcamp
Technical requirements
An overview of Kubernetes components
Exploring the control plane
The Kubernetes API server
The etcd database
kube-scheduler
kube-controller-manager
cloud-controller-manager
Understanding the worker node components
kubelet
kube-proxy
Container runtime
Interacting with the API server
Using the Kubernetes kubectl utility
Understanding the verbose option
General kubectl commands
Introducing Kubernetes resources
Kubernetes manifests
What are Kubernetes resources?
Reviewing Kubernetes resources
Summary
Questions
Join our book’s Discord space
4 Services, Load Balancing, and Network Policies
Technical requirements
Exposing workloads to requests
Understanding how Services work
Understanding different service types
Introduction to load balancers
Understanding the OSI model
Layer 7 load balancers
Name resolution and layer 7 load balancers
Using nip.io for name resolution
Creating Ingress rules
Resolving Names in Ingress Controllers
Using Ingress Controllers for non-HTTP traffic
Layer 4 load balancers
Layer 4 load balancer options
Using MetalLB as a layer 4 load balancer
Creating a LoadBalancer service
Advanced pool configurations
Using multiple protocols
Introducing Network Policies
Network policy object overview
Creating a Network Policy
Tools to create network policies
Summary
Questions
5 External DNS and Global Load Balancing
Technical requirements
Making service names available externally
Setting up ExternalDNS
Integrating ExternalDNS and CoreDNS
Adding an ETCD zone to CoreDNS
ExternalDNS configuration options
Creating a LoadBalancer service with ExternalDNS integration
Exposing CoreDNS to external requests
Configuring the primary DNS server
Testing DNS forwarding to CoreDNS
Load balancing between multiple clusters
Introducing the Kubernetes Global Balancer
Requirements for K8GB
Deploying K8GB to a cluster
Deploying a highly available application using K8GB
Understanding how K8GB provides global load balancing
Summary
Questions
Join our book’s Discord space
6 Integrating Authentication into Your Cluster
Technical requirements
Getting Help
Understanding how Kubernetes knows who you are
External users
Groups in Kubernetes
Service accounts
Understanding OpenID Connect
The OpenID Connect protocol
Following OIDC and the API’s interaction
Other authentication options
Configuring KinD for OpenID Connect
Addressing the requirements
Introducing impersonation to integrate authentication with cloud-managed clusters
What is Impersonation?
Security considerations
Configuring your cluster for impersonation
Testing Impersonation
Using Impersonation for Debugging
Configuring Impersonation without OpenUnison
Impersonation RBAC policies
Default groups
Inbound Impersonation
Privileged Access to Clusters
Using a Privileged User Account
Impersonating a Privileged User
Temporarily Authorizing Privilege
Authenticating from pipelines
Using tokens
Using certificates
Using a pipeline’s identity
Avoiding anti-patterns
Summary
Questions
Answers
7 RBAC Policies and Auditing
Technical requirements
Introduction to RBAC
What’s a Role?
Identifying a Role
Roles versus ClusterRoles
Negative Roles
Aggregated ClusterRoles
RoleBindings and ClusterRoleBindings
Mapping enterprise identities to Kubernetes to authorize access to resources
Implementing namespace multi-tenancy
Kubernetes auditing
Creating an audit policy
Enabling auditing on a cluster
Using audit2rbac to debug policies
Summary
Questions
Answers
Join our book’s Discord space
8 Managing Secrets
Technical Requirements
Getting Help
Examining the difference between Secrets and Configuration Data
Managing Secrets in an Enterprise
Understanding Secrets Managers
Storing Secrets as Secret Objects
Integrating Secrets into Your Deployments
Volume Mounts
Environment Variables
Using the Kubernetes Secrets API
Using the Vault API
Summary
Questions
Answers
9 Building Multitenant Clusters with vClusters
Technical requirements
Getting Help
The Benefits and Challenges of Multitenancy
Exploring the Benefits of Multitenancy
The Challenges of Multitenant Kubernetes
Using vClusters for Tenants
Deploying vClusters
Securely Accessing vClusters
Accessing External Services from a vCluster
Creating and Operating High-Availability vClusters
Building a Multitenant Cluster with Self Service
Analyzing Requirements
Designing the Multitenant Platform
Deploying Our Multitenant Platform
Summary
Questions
Answers
Join our book’s Discord space
10 Deploying a Secured Kubernetes Dashboard
Technical requirements
Getting help
How does the dashboard know who you are?
Dashboard architecture
Authentication methods
Understanding dashboard security risks
Exploring Dashboard Security Issues
Using a token to log in
Unencrypted Connections
Deploying the dashboard with a reverse proxy
Local dashboards
Other cluster-level applications
Integrating the dashboard with OpenUnison
What’s changed in the Kubernetes Dashboard 7.0
Summary
Questions
Answers
11 Extending Security Using Open Policy Agent
Technical requirements
Introduction to dynamic admission controllers
What is OPA and how does it work?
OPA architecture
Rego, the OPA policy language
Gatekeeper
Automated testing framework
Using Rego to write policies
Developing an OPA policy
Testing an OPA policy
Deploying policies to Gatekeeper
Building dynamic policies
Debugging Rego
Using existing policies
Enforcing Ingress policies
Enabling the Gatekeeper cache
Mocking up test data
Building and deploying our policy
Mutating objects and default values
Creating policies without Rego
Using Kubernetes’ validating admission policies
Summary
Questions
Answers
Join our book’s Discord space
12 Node Security with Gatekeeper
Technical requirements
What is node security?
Understanding the difference between containers and VMs
Container breakouts
Properly designing containers
Using and Debugging Distroless Images
Scanning Images for Known Exploits
Enforcing node security with Gatekeeper
What about Pod Security Policies?
What are the differences between PSPs, PSA, and Gatekeeper?
Authorizing node security policies
Deploying and debugging node security policies
Using Pod Security Standards to enforce Node Security
Summary
Questions
Answers
13 KubeArmor Securing Your Runtime
Technical requirements
What is runtime security?
Introducing KubeArmor
Introduction to Linux Security
Welcome to KubeArmor
Cluster requirements for the exercises
Deploying KubeArmor
Enabling KubeArmor logging
KubeArmor and LSM policies
Creating a KubeArmorSecurityPolicy
Using karmor to interact with KubeArmor
karmor install and uninstall
karmor probe
karmor profile
karmor recommend
karmor logs
karmor vm
Summary
Questions
Answers
Join our book’s Discord space
14 Backing Up Workloads
Technical requirements
Understanding Kubernetes backups
Performing an etcd backup
Backing up the required certificates
Backing up the etcd database
Introducing and setting up VMware’s Velero
Velero requirements
Installing the Velero CLI
Installing Velero
Using Velero to back up workloads and PVCs
Backing up PVCs
Running a one-time cluster backup
Scheduling a cluster backup
Creating a custom backup
Managing Velero using the CLI
Using common Velero commands
Restoring from a backup
Restoring in action
Restoring a namespace
Using a backup to create workloads in a new cluster
Restoring a backup to the new cluster
Summary
Questions
Answers
15 Monitoring Clusters and Workloads
Technical Requirements
Getting Help
Managing Metrics in Kubernetes
How Kubernetes Provides Metrics
Deploying the Prometheus Stack
Introduction to Prometheus
Alerting with Alertmanager
Visualizing Data with Grafana
Monitoring Applications
Securing Access to Your Monitoring Stack
Log Management in Kubernetes
Understanding Container Logs
Introducing OpenSearch
Deploying OpenSearch
Tracing Logs from Your Container to Your Console
Viewing Log Data in Kibana
Summary
Questions
Answers
Join our book’s Discord space
16 An Introduction to Istio
Technical requirements
Understanding the Control Plane and Data Plane
The Control Plane
The Data Plane
Why should you care about a Service mesh?
Workload observability
Traffic management
Finding issues before they happen
Security
Introduction to Istio concepts
Understanding the Istio components
Installing Istio
Downloading Istio
Installing Istio using a profile
Exposing Istio in a KinD cluster
Introducing Istio resources
Authorization policies
Destination rules
Deploying add-on components to provide observability
Installing Istio add-ons
Installing Kiali
Deploying an application into the Service mesh
Deploying your first application into the mesh
Using Kiali to observe mesh workloads
The future: Ambient mesh
Summary
Questions
Answers
17 Building and Deploying Applications on Istio
Technical requirements
Comparing microservices and monoliths
My history with microservices versus monolithic architecture
Comparing architectures in an application
Deploying a monolith
Exposing our monolith outside our cluster
Configuring sticky sessions
Integrating Kiali and OpenUnison
Building a microservice
Deploying Hello World
Integrating authentication into our service
Authorizing access to our service
Telling your service who’s using it
Authorizing user entitlements
Calling other services
Do I need an API gateway?
Summary
Questions
Join our book’s Discord space
18 Provisioning a Multitenant Platform
Technical requirements
Designing a pipeline
Opinionated platforms
Securing your pipeline
Building our platform’s requirements
Choosing our technology stack
Designing our platform architecture
Securely managing a remote Kubernetes cluster
Securely pushing and pulling images
Using Infrastructure as Code for deployment
Automating tenant onboarding
Designing a GitOps strategy
Considerations for building an Internal Developer Platform
Summary
Questions
Answers
19 Building a Developer Portal
Technical Requirements
Fulfilling Compute Requirements
Customizing Nodes
Accessing Services on Your Nodes
Deploying Pulumi
Deploying our IDP
Setting Up Pulumi
Initial Deployment
Unsealing Vault
Completing the Harbor Configuration
Completing the GitLab Configuration
Finishing the Control Plane Rollout
Integrating Development and Production
Bootstrapping GitOps with OpenUnison
Onboarding a Tenant
Deploying an Application
Promoting to Production
Adding Users to a Tenant
Expanding Our Platform
Different Sources of Identity
Integrating Monitoring and Logging
Integrating Policy Management
Replacing Components
Summary
Questions
Answers
Join our book’s Discord space
Why subscribe?
Other Books You May Enjoy
Packt is searching for authors like you
Share your thohughts
Index
Download a free PDF copy of this book

简介

版权

Kubernetes – An Enterprise Guide