Containerization has changed the DevOps game completely, with Docker and Kubernetes playing important roles in altering the flow of app creation and deployment. This book will help you acquire the knowledge and tools required to integrate Kubernetes clusters in an enterprise environment.
The book begins by introducing you to Docker and Kubernetes fundamentals, including a review of basic Kubernetes objects. You'll then get to grips with containerization and understand its core functionalities, including how to create ephemeral multinode clusters using kind. As you make progress, you'll learn about cluster architecture, Kubernetes cluster deployment, and cluster management, and get started with application deployment. Moving on, you'll find out how to integrate your container to a cloud platform and integrate tools including MetalLB, externalDNS, OpenID connect (OIDC), pod security policies (PSPs), Open Policy Agent (OPA), Falco, and Velero. Finally, you will discover how to deploy an entire platform to the cloud using continuous integration and continuous delivery (CI/CD).
By the end of this Kubernetes book, you will have learned how to create development clusters for testing applications and Kubernetes components, and be able to secure and audit a cluster by implementing various open-source solutions including OpenUnison, OPA, Falco, Kibana, and Velero.
What you will learn
* Create a multinode Kubernetes cluster using kind
* Implement Ingress, MetalLB, and ExternalDNS
* Configure a cluster OIDC using impersonation
* Map enterprise authorization to Kubernetes
* Secure clusters using PSPs and OPA
* Enhance auditing using Falco and EFK
* Back up your workload for disaster recovery and cluster migration
* Deploy to a platform using Tekton, GitLab, and ArgoCD
Who this book is for
This book is for anyone interested in DevOps, containerization, and going beyond basic Kubernetes cluster deployments. DevOps engineers, developers, and system administrators looking to enhance their IT career paths will also find this book helpful. Although some prior experience with Docker and Kubernetes is recommended, this book includes a Kubernetes bootcamp that provides a description of Kubernetes objects to help you if you are new to the topic or need a refresher.
Author(s): Scott Surovich, Marc Boorshtein
Publisher: Packt Publishing
Year: 2020
Language: English
Pages: 526
Cover
Title Page
Copyright and Credits
Dedication
About Packt
Foreword
Contributors
Table of Contents
Preface
Section 1: Docker and Container Fundamentals
Chapter 1: Docker and Container Essentials
Technical requirements
Understanding the need for containerization
Introducing Docker
Understanding Docker
Containers are ephemeral
Docker images
Image layers
Persistent data
Accessing services running in containers
Installing Docker
Preparing to install Docker
Installing Docker on Ubuntu
Granting Docker permissions
Using the Docker CLI
docker help
docker run
docker ps
docker start and stop
docker attach
docker exec
docker logs
docker rm
Summary
Questions
Chapter 2: Working with Docker Data
Technical requirements
Why you need persistent data
Docker volumes
Creating a volume using the CLI
Mounting a volume in a container
Mounting an existing volume
Mounting a volume in multiple containers
Listing Docker volumes
Cleaning up volumes
Docker bind mounts
Docker tmpfs mounts
Using a tmpfs mount in a container
Summary
Questions
Chapter 3: Understanding Docker Networking
Technical requirements
Exploring Docker networking
A quick TCP/IP port refresher
Binding a port to a service
Docker networking drivers
The default bridge network
Viewing the available networks
Retrieving details on a network
Creating user-defined bridge networks
Connecting a container to a user-defined network
Changing the network on a running container
Removing a network
Running a container without networking
Exposing container services
Exposing ports using a host network
Exposing ports using a bridge network
Summary
Questions
Section 2: Creating Kubernetes Development Clusters, Understanding objects, and Exposing Services
Chapter 4: Deploying Kubernetes Using KinD
Technical requirements
Introducing Kubernetes components and objects
Interacting with a cluster
Using development clusters
Why did we select KinD for this book?
Working with a base KinD Kubernetes cluster
Understanding the node image
KinD and Docker networking
Installing KinD
Installing KinD – prerequisites
Installing the KinD binary
Creating a KinD cluster
Creating a simple cluster
Deleting a cluster
Creating a cluster config file
Multi-node cluster configuration
Customizing the control plane and Kubelet options
Creating a custom KinD cluster
Installing Calico
Installing an Ingress controller
Reviewing your KinD cluster
KinD storage objects
Storage drivers
KinD storage classes
Using KinD's storage provisioner
Adding a custom load balancer for Ingress
Installation prerequisites
Creating the KinD cluster configuration
Deploying a custom HAProxy container
Understanding HAProxy traffic flow
Simulating a Kubelet failure
Deleting the HAProxy container
Summary
Questions
Chapter 5: Kubernetes Bootcamp
Technical requirements
An overview of Kubernetes components
Exploring the control plane
The Kubernetes API server
The Etcd database
kube-scheduler
kube-controller-manager
cloud-controller-manager
Understanding the worker node components
kubelet
kube-proxy
Container runtime
Interacting with the API server
Using the Kubernetes kubectl utility
Understanding the verbose option
General kubectl commands
Introducing Kubernetes objects
Kubernetes manifests
What are Kubernetes objects?
Reviewing Kubernetes objects
Summary
Questions
Chapter 6: Services, Load Balancing, and External DNS
Technical requirements
Exposing workloads to requests
Understanding how services work
Understanding different service types
Introduction to load balancers
Understanding the OSI model
Layer 7 load balancers
Name resolution and layer 7 load balancers
Using nip.io for name resolution
Creating an Ingress rules
Layer 4 load balancers
Layer 4 load balancer options
Using MetalLB as a layer 4 load balancer
Creating a LoadBalancer service
Adding multiple IP pools to MetalLB
Multiple protocol issues
Using multiple protocols with MetalLB
Using shared-IPs
Making service names available externally
Setting up external-dns
Integrating external-dns and CoreDNS
Adding an ETCD zone to CoreDNS
Creating a LoadBalancer service with external-dns integration
Summary
Questions
Section 3: Running Kubernetes in the Enterprise
Chapter 7: Integrating Authentication into Your Cluster
Technical requirements
Understanding how Kubernetes knows who you are
External users
Groups in Kubernetes
Service accounts
Understanding OpenID Connect
The OpenID Connect protocol
Following OIDC and the API's interaction
Other authentication options
Configuring KinD for OpenID Connect
Addressing the requirements
Deploying OIDC
Introducing impersonation to integrate authentication with cloud-managed clusters
What is Impersonation?
Security considerations
Configuring your cluster for impersonation
Testing impersonation
Configuring Impersonation without OpenUnison
Impersonation RBAC policies
Default groups
Summary
Questions
Chapter 8: RBAC Policies and Auditing
Technical requirements
Introduction to RBAC
What's a Role?
Identifying a Role
Roles versus ClusterRoles
Negative Roles
Aggregated ClusterRoles
RoleBindings and ClusterRoleBindings
Mapping enterprise identities to Kubernetes to authorize access to resources
Implementing namespace multi-tenancy
Kubernetes auditing
Creating an audit policy
Enabling auditing on a cluster
Using audit2rbac to debug policies
Summary
Questions
Chapter 9: Deploying a Secured Kubernetes Dashboard
Technical requirements
How does the dashboard know who you are?
Dashboard architecture
Authentication methods
Understanding dashboard security risks
Deploying an insecure dashboard
Using a token to log in
Deploying the dashboard with a reverse proxy
Local dashboards
Other cluster-level applications
Integrating the dashboard with OpenUnison
Summary
Questions
Chapter 10: Creating PodSecurityPolicies
Technical requirements
What is a PodSecurityPolicy?
Understanding the difference between containers and VMs
Container breakouts
Properly designing containers
Aren't they going away?
Enabling PSPs
Alternatives to PSPs
Summary
Questions
Chapter 11: Extending Security Using Open Policy Agent
Technical requirements
Introduction to dynamic admission controllers
What is OPA and how does it work?
OPA architecture
Rego, the OPA policy language
GateKeeper
Automated testing framework
Using Rego to write policies
Developing an OPA policy
Testing an OPA policy
Deploying policies to GateKeeper
Building dynamic policies
Debugging Rego
Using existing policies
Enforcing memory constraints
Enabling the GateKeeper cache
Mocking up test data
Building and deploying our policy
Enforcing Pod Security Policies using OPA
Summary
Questions
Chapter 12: Auditing using Falco and EFK
Technical requirements
Exploring auditing
Introducing Falco
Exploring Falco's configuration files
The falco.yaml configuration file
Falco rules config files
Creating and appending to custom rules
Deploying Falco
Falco kernel module
Creating a kernel module using installed kernel headers
Using headers to create the Falco module
Creating a kernel module using driverkit
Using the module on a cluster
Using the module in KinD
Deploying the Falco Daemonset
Deploying EFK
Summary
Questions
Chapter 13: Backing Up Workloads
Technical requirements
Understanding Kubernetes backups
Performing an etcd backup
Backing up the required certificates
Backing up the etcd database
Introducing and setting up Heptio's Velero
Velero requirements
Installing the Velero CLI
Installing Velero
Using Velero to back up workloads
Running a one-time cluster backup
Scheduling a cluster backup
Creating a custom backup
Managing Velero using the CLI
Using common Velero commands
Restoring from a backup
Restoring in action
Restoring a namespace
Using a backup to create workloads in a new cluster
Restoring a backup to the new cluster
Summary
Questions
Chapter 14: Provisioning a Platform
Technical requirements
Designing a pipeline
Opinionated platforms
Securing your pipeline
Building our platform's requirements
Choosing our technology stack
Preparing our cluster
Deploying cert-manager
Deploying the Docker container registry
Deploying OpenUnison
Deploying GitLab
Creating example projects
Deploying Tekton
Building Hello World
Building automatically
Deploying ArgoCD
Automating project onboarding using OpenUnison
Integrating GitLab
Integrating ArgoCD
Updating OpenUnison
Summary
Questions
Assessments
Other Books You May Enjoy
Index
