From faa420f9fd9270b7b944211bb3196461f925ecf9 Mon Sep 17 00:00:00 2001 From: Bridget Kromhout Date: Mon, 26 Feb 2018 16:41:21 -0600 Subject: [PATCH 1/9] Clarify language and explain https use --- slides/kube/dashboard.md | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/slides/kube/dashboard.md b/slides/kube/dashboard.md index 21ef54b6..6ca02517 100644 --- a/slides/kube/dashboard.md +++ b/slides/kube/dashboard.md @@ -89,7 +89,13 @@ The goo.gl URL expands to: - Connect to https://oneofournodes:3xxxx/ - (You will have to work around the TLS certificate validation warning) + - Yes, https. If you use http it will say: + + This page isn’t working + sent an invalid response. + ERR_INVALID_HTTP_RESPONSE + + - You will have to work around the TLS certificate validation warning @@ -109,7 +115,7 @@ The goo.gl URL expands to: ## Granting more rights to the dashboard -- The dashboard documentation [explains how to do](https://github.com/kubernetes/dashboard/wiki/Access-control#admin-privileges) +- The dashboard documentation [explains how to do this](https://github.com/kubernetes/dashboard/wiki/Access-control#admin-privileges) - We just need to load another YAML file! From ce0f79af16e0bfda1ac343aef0d6f392744967dc Mon Sep 17 00:00:00 2001 From: Bridget Kromhout Date: Mon, 26 Feb 2018 16:46:49 -0600 Subject: [PATCH 2/9] Updates & links for all cloud-provided k8s --- slides/kube/setup-k8s.md | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-) diff --git a/slides/kube/setup-k8s.md b/slides/kube/setup-k8s.md index 1bccce18..2e5d540a 100644 --- a/slides/kube/setup-k8s.md +++ b/slides/kube/setup-k8s.md @@ -42,20 +42,19 @@ ## Other deployment options -- If you are on Google Cloud: - [GKE](https://cloud.google.com/container-engine/) +- If you are on Azure: + [AKS](https://azure.microsoft.com/services/container-service/) - Empirically the best Kubernetes deployment out there +- If you are on Google Cloud: + [GKE](https://cloud.google.com/kubernetes-engine/) - If you are on AWS: - [kops](https://github.com/kubernetes/kops) - - ... But with AWS re:invent just around the corner, expect some changes + [EKS](https://aws.amazon.com/eks/) - On a local machine: [minikube](https://kubernetes.io/docs/getting-started-guides/minikube/), [kubespawn](https://github.com/kinvolk/kube-spawn), - [Docker4Mac (coming soon)](https://beta.docker.com/) + [Docker4Mac](https://docs.docker.com/docker-for-mac/kubernetes/) - If you want something customizable: [kubicorn](https://github.com/kris-nova/kubicorn) From 8faaf35da036e04ea5a7e66195b2ff3323fc28af Mon Sep 17 00:00:00 2001 From: Bridget Kromhout Date: Mon, 26 Feb 2018 16:48:52 -0600 Subject: [PATCH 3/9] Clarify we didn't tag the v1 release --- slides/kube/rollout.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/slides/kube/rollout.md b/slides/kube/rollout.md index 10a49913..21e25898 100644 --- a/slides/kube/rollout.md +++ b/slides/kube/rollout.md @@ -149,7 +149,7 @@ Our rollout is stuck. However, the app is not dead (just 10% slower). - We want to: - - revert to `v0.1` + - revert to `v0.1` (which we now realize we didn't tag - yikes!) - be conservative on availability (always have desired number of available workers) - be aggressive on rollout speed (update more than one pod at a time) - give some time to our workers to "warm up" before starting more @@ -163,7 +163,7 @@ spec: spec: containers: - name: worker - image: $REGISTRY/worker:v0.1 + image: $REGISTRY/worker:latest strategy: rollingUpdate: maxUnavailable: 0 @@ -192,7 +192,7 @@ spec: spec: containers: - name: worker - image: $REGISTRY/worker:v0.1 + image: $REGISTRY/worker:latest strategy: rollingUpdate: maxUnavailable: 0 From b40fa45fd3a498e124fee92b05acde403499bb27 Mon Sep 17 00:00:00 2001 From: Bridget Kromhout Date: Mon, 26 Feb 2018 16:50:31 -0600 Subject: [PATCH 4/9] Clarifications --- slides/kube/kubectlget.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/slides/kube/kubectlget.md b/slides/kube/kubectlget.md index c29744fb..c3087d98 100644 --- a/slides/kube/kubectlget.md +++ b/slides/kube/kubectlget.md @@ -48,7 +48,7 @@ .exercise[ -- Give us more info about them nodes: +- Give us more info about the nodes: ```bash kubectl get nodes -o wide ``` @@ -136,7 +136,7 @@ There is already one service on our cluster: the Kubernetes API itself. ``` - `-k` is used to skip certificate verification - - Make sure to replace 10.96.0.1 with the CLUSTER-IP shown earlier + - Make sure to replace 10.96.0.1 with the CLUSTER-IP shown by `$ kubectl get svc` ] @@ -173,7 +173,7 @@ The error that we see is expected: the Kubernetes API requires authentication. ## Namespaces -- Namespaces allow to segregate resources +- Namespaces allow us to segregate resources .exercise[ From 0f5f48121356ff86ef1ccdf1d2106e63a9b6d1fe Mon Sep 17 00:00:00 2001 From: Bridget Kromhout Date: Mon, 26 Feb 2018 16:52:23 -0600 Subject: [PATCH 5/9] Typo fix --- slides/kube/whatsnext.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/slides/kube/whatsnext.md b/slides/kube/whatsnext.md index e33a658d..b2123e33 100644 --- a/slides/kube/whatsnext.md +++ b/slides/kube/whatsnext.md @@ -160,7 +160,7 @@ Sorry Star Trek fans, this is not the federation you're looking for! - Raft recommends low latency between nodes -- What if our cluster spreads multiple regions? +- What if our cluster spreads to multiple regions? -- From c59510f9211f4339521e90a90003df9d78f6a97b Mon Sep 17 00:00:00 2001 From: Bridget Kromhout Date: Mon, 26 Feb 2018 16:54:41 -0600 Subject: [PATCH 6/9] Updates & clarifications --- slides/kube/daemonset.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/slides/kube/daemonset.md b/slides/kube/daemonset.md index c878c6da..5d8be5e8 100644 --- a/slides/kube/daemonset.md +++ b/slides/kube/daemonset.md @@ -4,7 +4,7 @@ - We want one (and exactly one) instance of `rng` per node -- If we just scale `deploy/rng` to 4, nothing guarantees that they spread +- If we just scale `deploy/rng` to the number of worker nodes in our cluster, nothing guarantees that the rng processes will be distributed evenly across the cluster - Instead of a `deployment`, we will use a `daemonset` @@ -22,7 +22,7 @@ ## Creating a daemon set -- Unfortunately, as of Kubernetes 1.8, the CLI cannot create daemon sets +- Unfortunately, as of Kubernetes 1.9, the CLI cannot create daemon sets -- @@ -406,4 +406,4 @@ The timestamps should give us a hint about how many pods are currently receiving - Bonus exercise 1: clean up the pods of the "old" daemon set -- Bonus exercise 2: how could we have done to avoid creating new pods? +- Bonus exercise 2: how could we have done this to avoid creating new pods? From ec55cd2465be7ab4903ed1214488c9ea05d4e12f Mon Sep 17 00:00:00 2001 From: Bridget Kromhout Date: Mon, 26 Feb 2018 16:55:56 -0600 Subject: [PATCH 7/9] Including ACR as one of the cloud k8s offerings --- slides/kube/ourapponkube.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/slides/kube/ourapponkube.md b/slides/kube/ourapponkube.md index f50d28e4..f2ec887d 100644 --- a/slides/kube/ourapponkube.md +++ b/slides/kube/ourapponkube.md @@ -40,7 +40,7 @@ In this part, we will: - We could use the Docker Hub -- Or a service offered by our cloud provider (GCR, ECR...) +- Or a service offered by our cloud provider (ACR, GCR, ECR...) - Or we could just self-host that registry From 223b5e152b7426494cd2c8d796dd7cb2c070279e Mon Sep 17 00:00:00 2001 From: Bridget Kromhout Date: Mon, 26 Feb 2018 16:56:45 -0600 Subject: [PATCH 8/9] Version updates --- slides/kube/versions-k8s.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/slides/kube/versions-k8s.md b/slides/kube/versions-k8s.md index d2b0a68c..0b946f72 100644 --- a/slides/kube/versions-k8s.md +++ b/slides/kube/versions-k8s.md @@ -1,8 +1,8 @@ ## Brand new versions! -- Kubernetes 1.8 -- Docker Engine 17.11 -- Docker Compose 1.17 +- Kubernetes 1.9.3 +- Docker Engine 18.02.0-ce +- Docker Compose 1.18.0 .exercise[ From 614f10432e3fbe5b7f1ef2b7333ef759fc3baeea Mon Sep 17 00:00:00 2001 From: Jerome Petazzoni Date: Mon, 26 Feb 2018 17:52:06 -0600 Subject: [PATCH 9/9] Mostly reformatting so that slides are nice and tidy --- slides/kube/daemonset.md | 16 +++++++++++++++- slides/kube/dashboard.md | 26 +++++++++++++++++++------- slides/kube/kubectlget.md | 3 ++- slides/kube/setup-k8s.md | 2 ++ 4 files changed, 38 insertions(+), 9 deletions(-) diff --git a/slides/kube/daemonset.md b/slides/kube/daemonset.md index 5d8be5e8..fbb3b9d2 100644 --- a/slides/kube/daemonset.md +++ b/slides/kube/daemonset.md @@ -4,16 +4,30 @@ - We want one (and exactly one) instance of `rng` per node -- If we just scale `deploy/rng` to the number of worker nodes in our cluster, nothing guarantees that the rng processes will be distributed evenly across the cluster +- What if we just scale up `deploy/rng` to the number of nodes? + + - nothing guarantees that the `rng` containers will be distributed evenly + + - if we add nodes later, they will not automatically run a copy of `rng` + + - if we remove (or reboot) a node, one `rng` container will restart elsewhere - Instead of a `deployment`, we will use a `daemonset` +--- + +## Daemon sets in practice + - Daemon sets are great for cluster-wide, per-node processes: - `kube-proxy` + - `weave` (our overlay network) + - monitoring agents + - hardware management tools (e.g. SCSI/FC HBA agents) + - etc. - They can also be restricted to run [only on some nodes](https://kubernetes.io/docs/concepts/workloads/controllers/daemonset/#running-pods-on-only-some-nodes) diff --git a/slides/kube/dashboard.md b/slides/kube/dashboard.md index 6ca02517..4a8aae67 100644 --- a/slides/kube/dashboard.md +++ b/slides/kube/dashboard.md @@ -89,18 +89,30 @@ The goo.gl URL expands to: - Connect to https://oneofournodes:3xxxx/ - - Yes, https. If you use http it will say: - - This page isn’t working - sent an invalid response. - ERR_INVALID_HTTP_RESPONSE - - - You will have to work around the TLS certificate validation warning +- You will have to work around the TLS certificate validation warning ] +The dashboard will then ask you which authentication you want to use. + +.warning[Make sure that you use `https`! Otherwise, you'll get this error:] + +``` +This page isn’t working + sent an invalid response. +ERR_INVALID_HTTP_RESPONSE +``` + +.warning[Chrome 63 (and later) as well as recent versions of Edge will refuse to connect.] + +We do not know how to work around that issue for the moment. + +--- + +## Dashboard authentication + - We have three authentication options at this point: - token (associated with a role that has appropriate permissions) diff --git a/slides/kube/kubectlget.md b/slides/kube/kubectlget.md index c3087d98..11424db9 100644 --- a/slides/kube/kubectlget.md +++ b/slides/kube/kubectlget.md @@ -136,7 +136,8 @@ There is already one service on our cluster: the Kubernetes API itself. ``` - `-k` is used to skip certificate verification - - Make sure to replace 10.96.0.1 with the CLUSTER-IP shown by `$ kubectl get svc` + + - Make sure to replace 10.96.0.1 with the CLUSTER-IP shown by `kubectl get svc` ] diff --git a/slides/kube/setup-k8s.md b/slides/kube/setup-k8s.md index 2e5d540a..cb296bd6 100644 --- a/slides/kube/setup-k8s.md +++ b/slides/kube/setup-k8s.md @@ -50,6 +50,8 @@ - If you are on AWS: [EKS](https://aws.amazon.com/eks/) + or + [kops](https://github.com/kubernetes/kops) - On a local machine: [minikube](https://kubernetes.io/docs/getting-started-guides/minikube/),