Kubernetes

In the world of computer networks, communication between devices is crucial. To facilitate this communication, various protocols are used at different layers of the networking stack.

If you have seen errors like these when deploying using a serviceAccount

Deploying Jenkins on K8S cluster is as simple as

In this blog, I will try add a new node to the already running cluster. My Cluster # root@master>k get nodes NAME STATUS ROLES AGE VERSION mydevmachine001830.samarthya.me Ready <none> 22h v1.23.1 mydevmachine002687.samarthya.me Ready <none> 41d v1.23.1 mydevmachine003277.samarthya.me Ready <none> 131d v1.23.1 mydevmachine003278.samarthya.me Ready <none> 131d v1.23.1 mydevmachine003417.samarthya.me Ready <none> 4m55s v1.23.1 mydevmachine003968.samarthya.me Ready <none> 131d v1.23.1 mydevmachine003969.samarthya.me Ready control-plane,master 131d v1.23.1 mydevmachine003970.samarthya.me Ready <none> 131d v1.23.1 mydevmachine003979.samarthya.me Ready <none> 29m v1.23.1 Steps to follow # Install docker Install kubeadm, kubectl & kubelet Join the cluster using the token Check the node has joined the cluster Step 1: Install docker # sudo yum install -y yum-utils sudo yum-config-manager \ --add-repo \ https://download.docker.com/linux/centos/docker-ce.repo When adding repo make sure the repo has been added successfully to the machine

In this blog I will talk about how you can upgrade a node and the kubernetes cluster version to a specific version. I have a 6 node local Kubernetes cluster like below

What? # Role Based Access Control(s) is a way of regulating access to entities like storage, network etc. RBAC authorization uses rbac.authorization.k8s.io API group. API Objects # There are 4 kind of kubernetes object

In my cluster things went haywire all of a sudden without a proper showcase, I tried multiple things but it was just not working. Specifically my core-dns and calico-kube-controllers were not coming up and were constantly showing not ready and CrashLoop respectively

All right, it has been sometime since I last wrote my blog, and it has been disappointing not to have found enough time to collate and put my thoughts in a simple worded doc; better late then never. So, here I am trying to reignite the pursuit of writing at least once a week.

To manage sensitive information you create secrets k create secret --help Create a secret using specified subcommand. Available Commands: docker-registry Create a secret for use with a Docker registry generic Create a secret from a local file, directory or literal value tls Create a TLS secret Usage: kubectl create secret [flags] [options] Use "kubectl <command> --help" for more information about a given command. Use "kubectl options" for a list of global command-line options (applies to all commands). type specifies the type of secret you are creating (options are as shown above). As I need to create only key value pairs for my dummy secret file I need to know a way of how to facilitate that, and the option -h helped me there

Everything in the same file apiVersion: v1 kind: Pod metadata: name: redispod spec: containers: - image: redis name: redisdb volumeMounts: - name: redis-data mountPath: /data ports: - containerPort: 6379 protocol: TCP volumes: - name: redis-data persistentVolumeClaim: claimName: redisdb-pvc --- apiVersion: v1 kind: PersistentVolume metadata: name: redis-pv spec: storageClassName: "" capacity: storage: 1Gi accessModes: - ReadWriteOnce hostPath: path: "/mnt/data" --- apiVersion: v1 kind: PersistentVolumeClaim metadata: name: redisdb-pvc spec: storageClassName: "" accessModes: - ReadWriteOnce resources: requests: storage: 1Gi If you deploy you will get something like

Reference # https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/ https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/#example-use-cases Before we understand the tainting we should know about the Node Affinity. It the by the virtue of Affinity that pods attracts nodes as a preference or as a basic requirement.

A cheat sheet for Installing K8S cluster. Step1: # Check your OS? cat /etc/issue lsb_release -a Step 2: # Add the GPG key as described here

Time to re-test how to create deployments. It has been sometime, I created some deployments so just checking on how much I remember. The quick way to always get started is to check the HELP.

Step by step: installing Docker, kubeadm, kubelet and kubectl on Ubuntu 18.04, initialising the control plane and joining worker nodes.

For my local K8S cluster of 4 nodes I wanted to get the resource usage metrics. From the official documentation of kubernetes.io These metrics can be accessed either directly by the user with the kubectl top command, or by a controller in the cluster, for example Horizontal Pod Autoscaler, to make decisions. https://kubernetes.io

In my K8S cluster when I was looking at component status I was observing an error. Please note componentstatus is deprecated in 1.19+ but the steps will still at least help out the OCD’s like me.

Helm is a dedicated package manager for Kubernetes. Although the Kubernetes objects are deployed in YAML’s there was a need to package and club them together and customise the deployment (not the K8S deployment).

OS version cat /etc/issue Ubuntu 18.04.2 LTS \n \l curl https://storage.googleapis.com/kubernetes-helm/helm-v2.12.3-linux-amd64.tar.gz > ./helm.tar.gz

A Kubernetes NetworkPolicy demo: deny all traffic in a namespace, then allow only labelled pods to reach nginx.

Every software cycle includes packaging; which essentially describes how the software written is packaged and shared. For the software built for Containers Helm is a popular choice of packaging the scripts.

I have been working on Kubernetes cluster and will soon plan to give a Kubernetes Certified Developer exam. In my quest, I will just record some commands that I found helpful or useful in this blog. It may be multi-part, as I will keep adding on a daily basis the commands that I will be learning.

POD # Smallest deployment unit you can manage in K8S, is a Pod. A pod may have one or more containers.

Always remember to refer the API and elements for the YAML structure API Overview — official K8S documentation The Kuberenetes documentation that has text descriptions and good explanatory examples.

A declarative way of maintaining the desired state. Continuing my example from the last blog --- # Pod deployment apiVersion: apps/v1 kind: Deployment metadata: name: go-server-deployment spec: replicas: 2 selector: matchLabels: app: my-go-server template: metadata: labels: app: my-go-server spec: containers: - name: go-server image: samarthya/epserver:2.0 resources: limits: memory: "256Mi" cpu: "1024m" env: - name: SERVERPORT value: "9090" ports: - containerPort: 9090 # Reference - https://kubernetes.io/docs/concepts/workloads/controllers/deployment/ In my deployment, I have two replicas configured, which can be increased to three using the command like the one below.

How can a pod communicate with the other pod? The answer to this question is through a network policy. Network Policy is a specification of how groups of pods are allowed to communicate with each other and other network endpoints.

In this blog we will be talking about Liveness, Readiness and Startup probes of a container. A Service in Kubernetes is an abstraction which defines a logical set of Pods and a policy by which to access them. — - Life without a service What is Kubelet? # Kubelet is a primary node agent that runs on every node. Works in term of PodSpec, that describes a POD (JSON or Yaml). Liveness Probe # It is used by kubelet to decide when to restart the container. periodSeconds defines when the kubelet check periodically. initialDelaySeconds specifies the initial wait before checking. I just created a single container pod that will run touch command to create a file and then it deletes that specific file after a delay, on which the livenessProbe is listening on and then once liveness fails we can check the container.

There are multiple Kubernetes objects we will be talking about in this blog. Mainly Services, Selectors and Labels. Service is an abstraction which defines a logical set of Pods and a policy by which to access them. A Service in Kubernetes is a REST object, similar to a Pod. Service tags the pods, logically grouping them using selectors. Pods have a lifecycle, they are born, they live, process and then they die. The pods (desired state) can be managed using deployment. A label is an identifying attribute of an object, and can be defined at the creation time, and subsequently modified and added at any time. Label selector is a grouping primitive in Kubernetes and allows client/user to identify a set of objects. There are two sets of selectors equality-based and set-based. An abstract way to expose an application running on a set of Pods as a network service. The set of Pods targeted by a Service is usually determined by a selector.

We looked at using the environment variables using the configmap in the last blog. The config map remains the same but now in YAML. apiVersion: v1 kind: ConfigMap metadata: name: happy-faces-mnt data: data.values: |- my.name=samarthya my.profession=engineer I will use this to mount it to a container and then see the contents of the file.

What is K8S? # To manage distributed containerised workloads, you use Kubernetes. It is resilient declarative configuration. It is open source platform. It allows you to bundle and run your application. From the official Kubernetes documentation. Kubernetes objects # K8S objects are the persistent entities in the K8S system and thee entities are used to represent the state of the cluster.

Learn by example # In this blog let’s learn how to create a bridge network. By definition - Bridge networks are usually used when your applications run in standalone containers that need to communicate

PV and PVC: PersistentVolume and PersistentVolumeClaim # PV - Defines the structure for provisioning storage for use. They have a defined lifecycle, independent of any individual Pod that uses the PV.

It is always fun learning and trying out some new tech. In this blog, I will try and capture my experience of running my first pod using kubectl. If you wish to learn how to install a typical master, worker cluster of K8S I recommend going through this blog.

Kubernetes cloud_user@ip-10-0-1-101:~$ kubectl version Client Version: version.Info{Major:"1", Minor:"13", GitVersion:"v1.13.3", GitCommit:"721bfa751924da8d1680787490c54b9179b1fed0", GitTreeState:"clean", BuildDate:"2019-02-01T20:08:12Z", GoVersion:"go1.11.5", Compiler:"gc", Platform:"linux/amd64"} Server Version: version.Info{Major:"1", Minor:"13", GitVersion:"v1.13.11", GitCommit:"25074a190ef2a07d8b0ed38734f2cb373edfb868", GitTreeState:"clean", BuildDate:"2019-09-18T14:34:46Z", GoVersion:"go1.11.13", Compiler:"gc", Platform:"linux/amd64"} cloud_user@ip-10-0-1-101:~$ kubectl api-resources NAME SHORTNAMES APIGROUP NAMESPACED KIND bindings true Binding componentstatuses cs false ComponentStatus configmaps cm true ConfigMap endpoints ep true Endpoints events ev true Event limitranges limits true LimitRange namespaces ns false Namespace nodes no false Node persistentvolumeclaims pvc true PersistentVolumeClaim persistentvolumes pv false PersistentVolume pods po true Pod podtemplates true PodTemplate replicationcontrollers rc true ReplicationController resourcequotas quota true ResourceQuota secrets true Secret serviceaccounts sa true ServiceAccount services svc true Service mutatingwebhookconfigurations admissionregistration.k8s.io false MutatingWebhookConfiguration validatingwebhookconfigurations admissionregistration.k8s.io false ValidatingWebhookConfiguration customresourcedefinitions crd,crds apiextensions.k8s.io false CustomResourceDefinition apiservices apiregistration.k8s.io false APIService controllerrevisions apps true ControllerRevision daemonsets ds apps true DaemonSet deployments deploy apps true Deployment replicasets rs apps true ReplicaSet statefulsets sts apps true StatefulSet tokenreviews authentication.k8s.io false TokenReview localsubjectaccessreviews authorization.k8s.io true LocalSubjectAccessReview selfsubjectaccessreviews authorization.k8s.io false SelfSubjectAccessReview selfsubjectrulesreviews authorization.k8s.io false SelfSubjectRulesReview subjectaccessreviews authorization.k8s.io false SubjectAccessReview horizontalpodautoscalers hpa autoscaling true HorizontalPodAutoscaler cronjobs cj batch true CronJob jobs batch true Job certificatesigningrequests csr certificates.k8s.io false CertificateSigningRequest leases coordination.k8s.io true Lease events ev events.k8s.io true Event daemonsets ds extensions true DaemonSet deployments deploy extensions true Deployment ingresses ing extensions true Ingress networkpolicies netpol extensions true NetworkPolicy podsecuritypolicies psp extensions false PodSecurityPolicy replicasets rs extensions true ReplicaSet networkpolicies netpol networking.k8s.io true NetworkPolicy poddisruptionbudgets pdb policy true PodDisruptionBudget podsecuritypolicies psp policy false PodSecurityPolicy clusterrolebindings rbac.authorization.k8s.io false ClusterRoleBinding clusterroles rbac.authorization.k8s.io false ClusterRole rolebindings rbac.authorization.k8s.io true RoleBinding roles rbac.authorization.k8s.io true Role priorityclasses pc scheduling.k8s.io false PriorityClass storageclasses sc storage.k8s.io false StorageClass volumeattachments storage.k8s.io false VolumeAttachment cloud_user@ip-10-0-1-101:~$ kubectl get cm NAME DATA AGE fruit-service-ambassador-config 1 5m49s Basic Commands (Beginner): create Create a resource from a file or from stdin. expose Take a replication controller, service, deployment or pod and expose it as a new Kubernetes Service run Run a particular image on the cluster set Set specific features on objects Basic Commands (Intermediate): explain Documentation of resources get Display one or many resources edit Edit a resource on the server delete Delete resources by filenames, stdin, resources and names, or by resources and label selector Deploy Commands: rollout Manage the rollout of a resource scale Set a new size for a Deployment, ReplicaSet, Replication Controller, or Job autoscale Auto-scale a Deployment, ReplicaSet, or ReplicationController Cluster Management Commands: certificate Modify certificate resources. cluster-info Display cluster info top Display Resource (CPU/Memory/Storage) usage. cordon Mark node as unschedulable uncordon Mark node as schedulable drain Drain node in preparation for maintenance taint Update the taints on one or more nodes Troubleshooting and Debugging Commands: describe Show details of a specific resource or group of resources logs Print the logs for a container in a pod attach Attach to a running container exec Execute a command in a container port-forward Forward one or more local ports to a pod proxy Run a proxy to the Kubernetes API server cp Copy files and directories to and from containers. auth Inspect authorization Advanced Commands: diff Diff live version against would-be applied version apply Apply a configuration to a resource by filename or stdin patch Update field(s) of a resource using strategic merge patch replace Replace a resource by filename or stdin wait Experimental: Wait for a specific condition on one or many resources. convert Convert config files between different API versions Settings Commands: label Update the labels on a resource annotate Update the annotations on a resource completion Output shell completion code for the specified shell (bash or zsh) Other Commands: api-resources Print the supported API resources on the server api-versions Print the supported API versions on the server, in the form of "group/version" config Modify kubeconfig files plugin Provides utilities for interacting with plugins. version Print the client and server version information Usage: kubectl [flags] [options]