0 Treffer
◀◀

Kubernetes

Warum Kubernetes

Herausforderungen

Cloud-Native-Applikationen

Aufgaben von Kubernetes

Nodes

N|Solid

Master Nodes

Aufgaben
Komponenten

Woker Nodes (ehemals Minions)

Aufgaben
Komponenten

Applikationen

Pods

beispielhafte Pod-Spezifikation
apiVersion: v1
kind: Pod
metadata:
  name: myapp-pod
  labels:
   app: myapp
spec:
  containers:
  - name: myapp-container
    image: busybox
    command: ['sh', '-c', 'echo Hello Kubernetes! && sleep 3600']

Deployments

DaemonSets

StatefulSets

Cronjobs

Labels

Annotationen

# Lables 
"metadata": {
	"labels": {
		"key1" : "value1",
		"key2" : "value2"
	}
}
# Metadata
"metadata": {
	"annotations": {
		"key1" : "value1",
		"key2" : "value2"
	}
}

Label Selektoren

Wertbasierende Selektoren (Beispiel)
Set-Selektoren (Beispiel)
selector:
matchLabels:
	component: nginx
matchExpressions:
	- {key: tier, operator: In, values: [cache]}
	- {key: environment, operator: NotIn, values: [dev]}

Services

kind: Service
apiVersion: v1
metadata:
	name: prod-service
spec:
	selector:
	mode: prod
ports:
	- protocol: TCP
	  port: 80
	  targetPort: 9376

Pods vs. Services

Pods

Services

Ingress

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
	name: simple-fanout-example
spec:
	rules:
	- host: foo.bar.com
	  ttp:
		paths:
		- path: /foo
		backend:
			serviceName: service1
			servicePort: 4200
		- path: /bar
		backend:
			serviceName: service2
			servicePort: 8080

Storage

Volumes

PersistentVolumes

Volume definieren

spec:
	containers:
	- image: k8s.gcr.io/test-webserver
	  name: test-container
	  volumeMounts:
	 - mountPath: /test-pd
	   name: test-volume
	volumes:
	- name: test-volume
	  	hostPath:
		path: /data

Persistenter Speicher

aufwendiger zu definieren

typische Use-Cases

StorageClass definieren

kind: StorageClass
apiVersion: storage.k8s.io/v1
metadata:
	name: standard
provisioner: kubernetes.io/aws-ebs
parameters:
	type: gp2
reclaimPolicy: Retain
mountOptions:
	- debug
volumeBindingMode: Immediate

PersistentVolume definieren

kind: PersistentVolume
apiVersion: v1
metadata:
	name: persistent-volume-definition
	labels:
		type: local
spec:
	storageClassName: standard
	capacity:
		storage: 10Gi
	accessModes:
	- ReadWriteOnce

PersistentVolumeClaim definieren

kind: PersistentVolumeClaim
apiVersion: v1
metadata:
	name: persistent-standard-claim
spec:
	storageClassName: standard
	accessModes:
	- ReadWriteOnce
	resources:
		requests:
			storage: 3Gi

PVC in Pod verwenden

kind: Pod
apiVersion: v1
metadata:
	name: mypod
spec:
	containers:
		[...]
	volumes:
		- name: persistentVolume
		persistentVolumeClaim:
			claimName: persistent-standard-claim

Wo betreibt man Kubernetes?

Anbieter

Azure Kubernetes Service (AKS)

Amazon Elastic Container Service for Kubernetes (EKS)

Google Kubernetes Engine (GKE)

PaaS vs. selbst aufgesetzt/gehostet

PaaS

Eigene Installation

Weitere Lösungen/Testumgebungen

Kubernetes in Docker

Minikube

Play with Kubernetes

kubeadm

Administrationstool für Kubernetes

Aufgaben:

Installation

kubectl

Management-Tool für Kubernetes Wrapper um REST-API erlaubt Scripting und Versionierung

Typische Tasks

Installation

Play with Kubernetes

Cluster initialisieren
kubeadm init --apiserver-advertise-address $(hostname -i)
Nodes anzeigen
kubectl get nodes
internes Netzwerk anlegen
kubectl apply -n kube-system -f "https://cloud.weave.works/k8s/net?k8s-version=$(kubectl version | base64 | tr -d '\n')"

Joinen der Worker Node

kubeadm join 192.168.0.18:6443 --token 7r768t.jl4v6kqri43tebm0 --discovery-token-ca-cert-hash sha256:f1aafb9cff7fdf43d41a8dddf18bca94edf3b2664cfeb8ada2e58133c701cc2e

Deployment durchführen

kubectl apply -f https://raw.githubusercontent.com/kubernetes/website/master/content/en/examples/application/nginx-app.yaml

Azure Kubernetes Service (AKS)

Requirements:

Ressourcengruppe erstellen

az group create --name <Ressourcengruppe> --location <Standort>

Cluster erstellen

az aks create --resource-group <Ressourcengruppe> --name <Clustername> --node-count <Anzahl Worker> 
--enable-addons monitoring --generate-ssh-keys [--node-vm-size <Art der VMs>]

kubectl installieren, falls noch nicht vorhanden

az aks install-cli

kubectl konfigurieren lassen

az aks get-credentials --resource-group <Ressourcengruppe> --name <CLUSTERNME>

Dashboard aufrufen

(ist standardmäßig installiert)

az aks browse --resource-group <Ressourcengruppe> --name <Clustername>

Anzahl Nodes anpassen

az aks scale --name <Clustername> --resource-group <Ressourcengruppe> --node-count <Anzahl Worker>

Cluster entfernen:

az aks delete --resource-group <Ressourcengruppe> --resource-name <Clustername>

Amazon Elastic Container Service for Kubernetes (EKS)

Requirements:

Cluster anlegen

EKS-Service-Rolle in AWS-Konsole erstellen:
Cluster VPC erstellen
kubectl installieren, falls noch nicht vorhanden
aws-iam-authenticator for Amazon EKS installieren
EKS-Cluster anlegen
aws eks create-cluster --name <Name> --role-arn <Rollen-ARN> --resources-vpc-config subnetIds=<Subnet-IDs>,securityGroupIds=<Security-Group-IDs>

Cluster verbinden

Cluster-Status abfragen
aws eks describe-cluster --name <Name> --query cluster.status
kubectl konfigurieren
aws eks update-kubeconfig --name <Name>
Cluster-Status abfragen
kubectl get svc

Woker-Nodes anlegen

Worker-Nodes zum Cluster hinzufügen

ConfigurationMap-Datei herunterladen:
Zum Cluster übertragen

Dashboard installieren

(Dashboard ist nicht per default installiert)

kubectl apply -f https://raw.githubusercontent.com/kubernetes/dashboard/master/src/deploy/recommended/kubernetes-dashboard.yaml

Dashboard aufrufen

Proxy starten
kubectl proxy

Dashboard aufrufen

Service Account anlegen

apiVersion: v1
kind: ServiceAccount
metadata:
	name: eks-admin
	namespace: kube-system

Cluster-Admin-Rolle verknüpfen

apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRoleBinding
metadata:
	name: eks-admin
roleRef:
	apiGroup: rbac.authorization.k8s.io
	kind: ClusterRole
	name: cluster-admin
subjects:
	- kind: ServiceAccount
	name: eks-admin
	namespace: kube-system

Token abrufen

Liste aller User-Objekte abrufen
kubectl get secret -n kube-system
Token für das eks-admin-Token-Objekt abrufen
kubectl describe secret <ID des Objekts> -n kube-system
Linux
kubectl -n kube-system describe secret $(kubectl -n kube-system get secret | grep eks-admin | awk '{print $1}')
Proxy starten
kubectl proxy
Dashboard aufrufen

Cluster löschen

Namensräume

vordefinierte Namensräume

Namesraum definieren

apiVersion: v1
kind: Namespace
metadata:
	name: development
    labels:
    	"name":  "dev"

kubectl create -f create-namespace.yaml (empfohlen)
kubectl create namespace <NAMESPACE>

Namesraum benutzen

kubectl get pods -n <NAMESPACE>

Namensraumconfig anzeigen

kubectl config view

Namensraumkontext definieren

kubectl config set-context <NAME> --namespace=<NAMESPACE> --cluster=<CLUSTERNAME> --user=<USER-ID>

Namensraumkontext aktivieren

kubectl config use-context <NAME>

Namesräume anzeigen

kubectl get namespaces
kubectl get namespaces --show-labels

Namensräume löschen

kubectl delete namespaces <NAME>
kubectl get namespaces --show-labels

Sicherheit

RBAC = Role Based Access Control

RBAC Verwendung

Ressourcen

API Groups

Verbs

Rollen

Role

ClusterRole

Standard-Clusterrollen

Rollen abrufen

# Status anzeigen
kubectl describe clusterrole <NAME>
# YAML Definition
kubectl get clusterrole <NAME> -o yaml > <FILENAME>

Rollen anlegen oder ändern

kind: Role
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  name: jenkins
rules:
- apiGroups: [""]
  resources: ["pods"]
  verbs: ["create","delete","get","list","patch","update","watch"]
- apiGroups: [""]
  resources: ["pods/exec"]
  verbs: ["create","delete","get","list","patch","update","watch"]
- apiGroups: [""]
  resources: ["pods/log"]
  verbs: ["get","list","watch"]
- apiGroups: [""]
  resources: ["secrets"]
  verbs: ["get"]

# Rolle anlegen
kubectl create -f <YAMLFILE> -n <NAMESPACE>

# Rolle anzeigen 
kubectl describe roles -n <NAMESPACE>

Accounts

User Accounts

Service-Accounts

Service-Account anlegen

# Account anlegen
kubectl create -f <YAMLFILE> -n <NAMESPACE>
# Account anzeigen
kubectl describe serviceaccounts -n <NAMESPACE>

Verknüpfung Rolle und Subject

apiVersion: rbac.authorization.k8s.io/v1
  kind: RoleBinding
  metadata:
    name : NAME
    namespace: NAMESPACE
  roleRef:
    apiGroup: rbac.authorization.k8s.io
    kind: ClusterRole
    name: system:aws-cloud-provider
  subjects:
  - kind: ServiceAccount
    name: aws-cloud-provider
    namespace: kube-system

Role-Binding anlegen

# Binding anlegen
kubectl create -f <YAMLFILE> -n <NAMESPACE>
# Binding anzeigen
kubectl describe rolebinding -n <NAMESPACE>

Role-Binding ändern

# im YAML File
kubectl applye -f <YAMLFILE> -n <NAMESPACE>
# mittels kubectl
kubectl edit <ART> <NAME> -n <NAMESPACE>
# Rolle anzeigen
kubectl describe role -n <NAMESPACE>

Role-Binding ändern

kubectl delete <ART> <NAME> -n <NAMESPACE>

kubectl delete role <ROLLE> -n <NAMESPACE>
kubectl delete rolebinding <ROLLE> -n <NAMESPACE>
kubectl delete serviceaccount <ROLLE> -n <NAMESPACE>

Applikationen bereitstellen

Container-Image erzeugen

Deployment

apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx-deployment
  labels:
    app: nginx
spec:
  replicas: 3
  selector:
    matchLabels:
      app: nginx
  template:
    metadata:
      labels:
        app: nginx
    spec:
      containers:
      - name: nginx
        image: nginx:1.7.9
        ports:
        - containerPort: 80

# Deployment anlegen
kubectl create -f <YAMLFILE> -n <NAMESPACE>
# Deployment anzeigen
kubectl describe deployment -n <NAMESPACE>
kubectl get pods  -n <NAMESPACE>
kubectl describe pod <PODNAME> -n <NAMESPACE>

Verbindung testen

kubectl exec -n <NAMESPACE> -it <PODNAME> -- /bin/bash

Deployment löschen

kubectl delete -f <YAMLFILE> -n <NAMESPACE>
kubectl delete deployment <NAME> -n <NAMESPACE>
kubectl get deployments -n <NAMESPACE>

Mysql-Deployment mit persistenten Speicher

kubectl create secret generic <NAME> --from-literal=password=<PASSWORD>
kubectl create secret generic mysql-pass --from-literal=password=start123

stratedy: 
type: Recrreate
env:
- name: MYSQL_ROOT_PASSWORD
 valueFrom:
   secretkeyRef:
     name: mysql-pass
     key: password

stratedy: 
type: Recrreate
env:
- name: MYSQL_ROOT_PASSWORD
 valueFrom:
   secretkeyRef:
     name: mysql-pass
     key: password

Mysql/Wordpress Deployment

selector:
  app: wordpress
  tier: frontend 
type: NodePort

kubectl get deployments
kubectl get services

Komponenten kombinieren

Ingress

Ingress-Arten

Ingress-Controller

--> https://nextcloud.z4k.de/index.php/s/c7MqqrQwK8Q6ymo

HELM und Tiller

Aufsetzen HELM und Tiller

Installation Tiller

helm init --service-account tiller

Applikationen mit HELM deployen

helm update repo
helm search 
helm install <CHARTNAME>
helm install stable/phpmyadmin --name phpmyadmin

helm list 
helm delete <NAME>
helm rollback <NAME> <REVISION>

kubectl get deployments
kubectl get services

kubectl port-forward --namespace default svc/phpmyadmin 8080:80

Applikation betreiben/updaten

Update Strategien

Ramped

  1. neuer POD wird gestartet
  2. alter POD fährt herunter

keine Downtime

Recreate

  1. Alter Pod fährt herunter
  2. neuer Pod wird gestartet

Downtime vorhanden!

Blue/Green

Canary

Deployments updaten

# INLINE
kubectl set image deployment <NAME> <PODNAME>=<IMAGE>:<TAG> --record=true
# für Rollback nötig: --record=true

# per Editor 
kubectl edit deployment <NAME>

Rollout Status ansehen

kubectl rollout status deployment <NAME>
kubectl get replicasets

History ansehen

kubectl rollout history deployment <NAME>
kubectl rollout history deployment <NAME> <REVISION>

Rollback

kubectl rollout undo deployment <NAME> --to-revision=<REVISION>

Scaling

spec:
  replicas: 2

kubectl edit deployment <NAME>
kubectl get deployment <NAME>

kubectl scale deployment <NAME> --replicas=<ANZAHL>
kubectl get deployment <NAME>

Autoscaling

kubectl autoscale deployment <NAME> --min=<MIN> --max=<MAX> --cpu-percent=<SCHWELLWERT>

Healthcheck

Liveness und Readiness-Checks

Readiness-Check

Liveness-Check

Probes

Beispiel Mysql
livenessProbe:
	exec:
		command: ["mysqladmin", "ping"]
	initialDelaySeconds: 30
	periodSeconds: 10
	timeoutSeconds: 5
readinessProbe:
	exec:
		# Check we can execute queries over TCP (skip-networking is off).
		command: ["mysql", "-h", "127.0.0.1", "-e", "SELECT 1"]
	initialDelaySeconds: 5
	periodSeconds: 2
	timeoutSeconds: 1

kubectl get pod liveness-http
kubectl get pod readyness-http
kubectl describe pod

Links

Allgemeines

Kubernetes Tutorial: Installation & Konfiguration eines Kubernetes Clusters https://itsecblog.de/kubernetes-tutorial-installation-konfiguration-eines-kubernetes-clusters/

CaaS | Container as a Service Anbieter im Vergleich - 1&1 IONOS https://www.ionos.de/digitalguide/server/knowhow/caas-container-as-a-service-anbieter-im-vergleich/

Kubernetes vs Docker Compose vs Docker Swarm 2019 Comparison of Container Tools | StackShare https://stackshare.io/stackups/docker-compose-vs-docker-swarm-vs-kubernetes

Kostenlose GCP-Stufe – großzügige kostenlose Testphasen und "Immer kostenlos"-Produkte | Google Cloud https://cloud.google.com/free/

AMAZON EKS

How to Deploy a Kubernetes Application with Amazon Elastic Container Service for Kubernetes | AWS https://aws.amazon.com/de/getting-started/projects/deploy-kubernetes-app-amazon-eks/

Erste Schritte mit Amazon EKS - Amazon EKS https://docs.aws.amazon.com/de_de/eks/latest/userguide/getting-started.html

Microsoft AKS

Tutorial zu Kubernetes in Azure: Bereitstellen eines Clusters | Microsoft Docs https://docs.microsoft.com/de-de/azure/aks/tutorial-kubernetes-deploy-cluster

Dokumentation für Azure Kubernetes Service (AKS) – Tutorials, API-Referenz | Microsoft Docs https://docs.microsoft.com/de-de/azure/aks/

Google GKE

Hello Node Kubernetes Codelab https://codelabs.developers.google.com/codelabs/cloud-hello-kubernetes/index.html?index=../..index#0

Compute Engine & Kubernetes (Container Engine) https://codelabs.developers.google.com/codelabs/cloud-compute-kubernetes/#0

Preise für die Google Compute Engine | Compute Engine-Dokumentation | Google Cloud https://cloud.google.com/compute/pricing?hl=de

Preise | Dokumentation zu Kubernetes Engine | Google Cloud https://cloud.google.com/kubernetes-engine/pricing

HELM

Installing Helm in Google Kubernetes Engine (GKE) – Google Cloud Platform - Community – Medium https://medium.com/google-cloud/installing-helm-in-google-kubernetes-engine-7f07f43c536e

charts/stable/percona-xtradb-cluster at master · helm/charts · GitHub https://github.com/helm/charts/tree/master/stable/percona-xtradb-cluster

GitHub - ypenglyn/solr-k8s: create solr on k8s with helm https://github.com/ypenglyn/solr-k8s

charts/stable/redis-ha at master · helm/charts · GitHub https://github.com/helm/charts/tree/master/stable/redis-ha

GitHub - hybris-jenkins-x-demo/setup-jx-cluster: How to setup your own GKE cluster for SAP (Hybris) Commerce + Jenkins-X and try it the full CI/CD pipeline https://github.com/hybris-jenkins-x-demo/setup-jx-cluster

Deployment

Die Werkzeugkiste #1: Helm – Kubernetes-Deployments richtig gemacht | heise Developer https://www.heise.de/developer/artikel/Die-Werkzeugkiste-1-Helm-Kubernetes-Deployments-richtig-gemacht-4219375.html

Kontinuierliches Deployment in Kubernetes Engine mit Jenkins | Lösungen | Google Cloud https://cloud.google.com/solutions/continuous-delivery-jenkins-kubernetes-engine?hl=de

Kubernetes Ugly Commands

List ImagePullBackOff Events and Test Path and Tags

https://itnext.io/kubernetes-ugly-commands-list-imagepullbackoff-events-and-test-path-and-tags-b12d8fded6de

Troubleshoot Unready CertManager Certificates

https://itnext.io/kubernetes-ugly-commands-troubleshoot-unready-certmanager-certificates-1d9c861a45c

Fetch Ingress Object Health in Namespace

https://itnext.io/kubernetes-ugly-commands-fetch-ingress-object-health-in-namespace-4d8e4f17145d

Check for RWO Persistent Volume Node Attachment Issues

https://itnext.io/kubernetes-ugly-commands-check-for-rwo-persistent-volume-node-attachment-issues-980b1ad922a3

Troubleshoot Pending Pods in a Namespace

https://itnext.io/kubernetes-ugly-commands-troubleshoot-pending-pods-in-namespace-c4b2273a1014

List Images and Tags for Every Container in Running Pods

https://itnext.io/kubernetes-ugly-commands-list-images-and-tags-for-every-container-in-running-pods-4aa2e381522f

Test Service Account Access to Kubernetes API Server

https://itnext.io/kubernetes-ugly-commands-test-service-account-access-to-kubernetes-api-server-529c50ab7b43

Troubleshoot Unready Kustomizations with FluxCD and GitOps

https://itnext.io/kubernetes-ugly-commands-troubleshoot-unready-kustomizations-with-fluxcd-and-gitops-21ba3b63b39