mirror of
https://github.com/jpetazzo/container.training.git
synced 2026-07-19 21:09:27 +00:00
Something like last push for day 3
This commit is contained in:
Julien Girardin
24
slides/3.yml
24
slides/3.yml
@@ -11,6 +11,7 @@ slides: http://2020-02-enix.container.training/
|
||||
|
||||
exclude:
|
||||
- self-paced
|
||||
- hide-exercise
|
||||
|
||||
chapters:
|
||||
- shared/title.md
|
||||
@@ -19,29 +20,26 @@ chapters:
|
||||
- shared/about-slides.md
|
||||
- shared/toc.md
|
||||
-
|
||||
# Bien démarrer en local (minikube, kind)
|
||||
# - k8s/kube-coin-intro.md
|
||||
- k8s/software-dev-banalities.md
|
||||
- k8s/on-desktop.md
|
||||
- k8s/namespaces.md
|
||||
- k8s/accessinternal.md
|
||||
- k8s/localkubeconfig.md
|
||||
- k8s/kubectlproxy.md
|
||||
- k8s/testing.md
|
||||
# Bien démarrer en local (minikube, kind)
|
||||
- shared/sampleapp.md
|
||||
- k8s/software-dev-banalities.md
|
||||
- k8s/on-desktop.md
|
||||
- k8s/volumes.md
|
||||
- k8s/namespaces.md
|
||||
- k8s/localkubeconfig.md
|
||||
- k8s/accessinternal.md
|
||||
- k8s/testing.md
|
||||
|
||||
-
|
||||
- k8s/configuration.md
|
||||
- k8s/sealed-secrets.md
|
||||
#- k8s/volumes.md
|
||||
- k8s/kustomize.md
|
||||
- k8s/helm-intro.md
|
||||
- k8s/helm-chart-format.md
|
||||
- k8s/helm-create-basic-chart.md
|
||||
- k8s/helm-create-better-chart.md
|
||||
- k8s/helm-secrets.md
|
||||
|
||||
-
|
||||
# - k8s/shippingimages.md # some overlap
|
||||
- k8s/shippingimages.md
|
||||
- k8s/registries.md
|
||||
- k8s/stop-manual.md
|
||||
- k8s/ci-cd.md
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
## Exercice - monitor with prometheus
|
||||
## Exercice - monitor with opentelemetry
|
||||
|
||||
Complete exercise #5, (again code at: https://github.com/enix/kubecoin )
|
||||
|
||||
|
||||
@@ -170,9 +170,9 @@ Can we do better?
|
||||
- install with pure yaml manifests, kustomize, helm
|
||||
|
||||
- Tilt (https://tilt.dev/)
|
||||
- Titfile is programmatic format (python ?)
|
||||
- Tiltfile is programmatic format (python ?)
|
||||
- Primitive for building with docker
|
||||
- Primitive for deploying with pure yaml manifestsn kustomize, helm
|
||||
- Primitive for deploying with pure yaml manifests, kustomize, helm
|
||||
|
||||
- Garden (https://garden.io/)
|
||||
|
||||
|
||||
@@ -79,8 +79,8 @@
|
||||
|
||||
- Rolling updates can be monitored with the `kubectl rollout` subcommand
|
||||
|
||||
<!--
|
||||
/---
|
||||
---
|
||||
class: hide-exercise
|
||||
|
||||
## Rolling out the new `worker` service
|
||||
|
||||
@@ -109,7 +109,8 @@
|
||||
|
||||
That rollout should be pretty quick. What shows in the web UI?
|
||||
|
||||
/---
|
||||
---
|
||||
class: hide-exercise
|
||||
|
||||
## Give it some time
|
||||
|
||||
@@ -131,7 +132,8 @@ That rollout should be pretty quick. What shows in the web UI?
|
||||
|
||||
(The grace period is 30 seconds, but [can be changed](https://kubernetes.io/docs/concepts/workloads/pods/pod/#termination-of-pods) if needed)
|
||||
|
||||
/---
|
||||
---
|
||||
class: hide-exercise
|
||||
|
||||
## Rolling out something invalid
|
||||
|
||||
@@ -162,7 +164,8 @@ Our rollout is stuck. However, the app is not dead.
|
||||
|
||||
(After a minute, it will stabilize to be 20-25% slower.)
|
||||
|
||||
/---
|
||||
---
|
||||
class: hide-exercise
|
||||
|
||||
## What's going on with our rollout?
|
||||
|
||||
@@ -182,7 +185,7 @@ Our rollout is stuck. However, the app is not dead.
|
||||
<br/>
|
||||
but the total number of pods being rolled out is allowed to be 25+25=50%
|
||||
|
||||
/---
|
||||
---
|
||||
|
||||
class: extra-details
|
||||
|
||||
@@ -202,7 +205,8 @@ class: extra-details
|
||||
|
||||
- Our rollout is stuck at this point!
|
||||
|
||||
/---
|
||||
---
|
||||
class: hide-exercise
|
||||
|
||||
## Checking the dashboard during the bad rollout
|
||||
|
||||
@@ -218,7 +222,8 @@ If you didn't deploy the Kubernetes dashboard earlier, just skip this slide.
|
||||
|
||||
]
|
||||
|
||||
/---
|
||||
---
|
||||
class: hide-exercise
|
||||
|
||||
## Recovering from a bad rollout
|
||||
|
||||
@@ -240,7 +245,8 @@ If you didn't deploy the Kubernetes dashboard earlier, just skip this slide.
|
||||
|
||||
]
|
||||
|
||||
/---
|
||||
---
|
||||
class: hide-exercise
|
||||
|
||||
## Rolling back to an older version
|
||||
|
||||
@@ -250,7 +256,8 @@ If you didn't deploy the Kubernetes dashboard earlier, just skip this slide.
|
||||
|
||||
- How can we get back to the previous version?
|
||||
|
||||
/---
|
||||
---
|
||||
class: hide-exercise
|
||||
|
||||
## Multiple "undos"
|
||||
|
||||
@@ -269,7 +276,8 @@ If you didn't deploy the Kubernetes dashboard earlier, just skip this slide.
|
||||
|
||||
🤔 That didn't work.
|
||||
|
||||
/---
|
||||
---
|
||||
class: hide-exercise
|
||||
|
||||
## Multiple "undos" don't work
|
||||
|
||||
@@ -290,7 +298,9 @@ If you didn't deploy the Kubernetes dashboard earlier, just skip this slide.
|
||||
|
||||
]
|
||||
|
||||
/---
|
||||
---
|
||||
|
||||
class: hide-exercise
|
||||
|
||||
## In this specific scenario
|
||||
|
||||
@@ -300,7 +310,9 @@ If you didn't deploy the Kubernetes dashboard earlier, just skip this slide.
|
||||
|
||||
- What if we had changed other parameters in the Pod spec?
|
||||
|
||||
/---
|
||||
---
|
||||
|
||||
class: hide-exercise
|
||||
|
||||
## Listing versions
|
||||
|
||||
@@ -321,7 +333,8 @@ We might see something like 1, 4, 5.
|
||||
|
||||
(Depending on how many "undos" we did before.)
|
||||
|
||||
/---
|
||||
---
|
||||
class: hide-exercise
|
||||
|
||||
## Explaining deployment revisions
|
||||
|
||||
@@ -338,9 +351,10 @@ We might see something like 1, 4, 5.
|
||||
|
||||
]
|
||||
|
||||
/---
|
||||
---
|
||||
|
||||
class: extra-details
|
||||
class: hide-exercise
|
||||
|
||||
## What about the missing revisions?
|
||||
|
||||
@@ -354,7 +368,8 @@ class: extra-details
|
||||
|
||||
(if we wanted to!)
|
||||
|
||||
/---
|
||||
---
|
||||
class: hide-exercise
|
||||
|
||||
## Rolling back to an older version
|
||||
|
||||
@@ -371,9 +386,10 @@ class: extra-details
|
||||
|
||||
]
|
||||
|
||||
/---
|
||||
---
|
||||
|
||||
class: extra-details
|
||||
class: hide-exercise
|
||||
|
||||
## Changing rollout parameters
|
||||
|
||||
@@ -381,7 +397,7 @@ class: extra-details
|
||||
|
||||
- revert to `v0.1`
|
||||
- be conservative on availability (always have desired number of available workers)
|
||||
- go slow on rollout speed (update only one pod at a time)
|
||||
- go slow on rollout speed (update only one pod at a time)
|
||||
- give some time to our workers to "warm up" before starting more
|
||||
|
||||
The corresponding changes can be expressed in the following YAML snippet:
|
||||
@@ -402,9 +418,10 @@ spec:
|
||||
```
|
||||
]
|
||||
|
||||
/---
|
||||
---
|
||||
|
||||
class: extra-details
|
||||
class: hide-exercise
|
||||
|
||||
## Applying changes through a YAML patch
|
||||
|
||||
@@ -435,8 +452,6 @@ class: extra-details
|
||||
kubectl get deploy -o json worker |
|
||||
jq "{name:.metadata.name} + .spec.strategy.rollingUpdate"
|
||||
```
|
||||
]
|
||||
]
|
||||
|
||||
]
|
||||
|
||||
-->
|
||||
|
||||
@@ -23,12 +23,50 @@
|
||||
- since version 0.9 key rotation are enable by default, so remember to backup private keys regularly.
|
||||
</br> (or you won't be able to decrypt all you keys, in a case of *disaster recovery*)
|
||||
|
||||
|
||||
---
|
||||
|
||||
# Alternative: sops / git crypt
|
||||
## First "sealed-secret"
|
||||
|
||||
|
||||
.exercise[
|
||||
- Install *kubeseal*
|
||||
```bash
|
||||
wget https://github.com/bitnami-labs/sealed-secrets/releases/download/v0.9.7/kubeseal-linux-amd64 -O kubeseal
|
||||
sudo install -m 755 kubeseal /usr/local/bin/kubeseal
|
||||
```
|
||||
|
||||
- Install controller
|
||||
```bash
|
||||
helm install -n kube-system stable/sealed-secrets sealed-secrets-controller
|
||||
```
|
||||
|
||||
- Create a secret you don't want to leak
|
||||
```bash
|
||||
kubectl create secret generic --from-literal=foo=bar my-secret -o yaml --dry-run \
|
||||
| kubeseal > mysecret.yaml
|
||||
kubectl apply -f mysecret.yaml
|
||||
```
|
||||
]
|
||||
|
||||
---
|
||||
|
||||
## Alternative: sops / git crypt
|
||||
|
||||
- You can work a VCS level (ie totally abstracted from kubernetess)
|
||||
|
||||
- sops (https://github.com/mozilla/sops), VCS agnostic, encrypt portion of files
|
||||
|
||||
- git-crypt that work with git to transparently encrypt (some) files in git
|
||||
|
||||
---
|
||||
|
||||
## Other alternative
|
||||
|
||||
- You can delegate secret management to another component like *hashicorp vault*
|
||||
|
||||
- Can work in multiple ways:
|
||||
|
||||
- encrypt secret from API-server (instead of the much secure *base64*)
|
||||
- encrypt secret before sending it in kubernetes (avoid git in plain text)
|
||||
- manager secret entirely in vault and expose to the container via volume
|
||||
|
||||
Reference in New Issue
Block a user