From 45ea521acd6bc13115f01dc3a4dc33fda03ac7e5 Mon Sep 17 00:00:00 2001 From: Jerome Petazzoni Date: Fri, 12 Jul 2019 14:16:20 -0500 Subject: [PATCH 01/19] COPY --chown --- slides/containers/Dockerfile_Tips.md | 72 ++++++++++++++++++++++++++++ 1 file changed, 72 insertions(+) diff --git a/slides/containers/Dockerfile_Tips.md b/slides/containers/Dockerfile_Tips.md index f30e55d1..fed55f49 100644 --- a/slides/containers/Dockerfile_Tips.md +++ b/slides/containers/Dockerfile_Tips.md @@ -76,6 +76,78 @@ CMD ["python", "app.py"] --- +## Be careful with `chown`, `chmod`, `mv` + +* Layers cannot store efficiently changes in permissions or ownership. + +* Layers cannot represent efficiently when a file is moved either. + +* As a result, operations like `chown`, `chown`, `mv` can be expensive. + +* For instance, in the Dockerfile snippet below, each `RUN` line + creates a layer with an entire copy of `some-file`. + + ```dockerfile + COPY some-file . + RUN chown www-data:www-data some-file + RUN chmod 644 some-file + RUN mv some-file /var/www + ``` + +* How can we avoid that? + +--- + +## Put files on the right place + +* Instead of using `mv`, directly put files at the right place. + +* When extracting archives (tar, zip...), merge operations in a single layer. + + Example: + + ```dockerfile + ... + RUN wget http://.../foo.tar.gz \ + && tar -zxf foo.tar.gz \ + && mv foo/fooctl /usr/local/bin \ + && rm -rf foo + ... + ``` + +--- + +## Use `COPY --chown` + +* The Dockerfile instruction `COPY` can take a `--chown` parameter. + + Examples: + + ```dockerfile + ... + COPY --chown=1000 some-file . + COPY --chown=1000:1000 some-file . + COPY --chown=www-data:www-data some-file . + ``` + +* The `--chown` flag can specify a user, or a user:group pair. + +* The user and group can be specified as names or numbers. + +* When using names, the names must exist in `/etc/passwd` or `/etc/group`. + + *(In the container, not on the host!)* + +--- + +## Set correct permissions locally + +* Instead of using `chmod`, set the right file permissions locally. + +* When files are copied with `COPY`, permissions are preserved. + +--- + ## Embedding unit tests in the build process ```dockerfile From 947ab97b14cd0330dad72eddc2085b9831c01064 Mon Sep 17 00:00:00 2001 From: Jerome Petazzoni Date: Sat, 13 Jul 2019 11:12:18 -0500 Subject: [PATCH 02/19] Add information about --record --- slides/k8s/record.md | 169 ++++++++++++++++++++++++++++++++++++++ slides/k8s/rollout.md | 4 + slides/kube-fullday.yml | 1 + slides/kube-halfday.yml | 1 + slides/kube-selfpaced.yml | 1 + slides/kube-twodays.yml | 1 + 6 files changed, 177 insertions(+) create mode 100644 slides/k8s/record.md diff --git a/slides/k8s/record.md b/slides/k8s/record.md new file mode 100644 index 00000000..a76fc903 --- /dev/null +++ b/slides/k8s/record.md @@ -0,0 +1,169 @@ +# Recording deployment actions + +- Some commands that modify a Deployment accept an optional `--record` flag + + (Example: `kubectl set image deployment worker worker=alpine --record`) + +- That flag will store the command line in the Deployment + + (Technically, using the annotation `kubernetes.io/change-cause`) + +- It gets copied to the corresponding ReplicaSet + + (Allowing to keep track of which command created or promoted this ReplicaSet) + +- We can view this information with `kubectl rollout history` + +--- + +## Using `--record` + +- Let's make a couple of changes to a Deployment and record them + +.exercise[ + +- Roll back `worker` to image version 0.1: + ```bash + kubectl set image deployment worker worker=dockercoins/worker:v0.1 --record + ``` + +- Promote it to version 0.2 again: + ```bash + kubectl set image deployment worker worker=dockercoins/worker:v0.2 --record + ``` + +- View the change history: + ```bash + kubectl rollout history deployment worker + ``` + +] + +--- + +## Pitfall #1: forgetting `--record` + +- What happens if we don't specify `--record`? + +.exercise[ + +- Promote `worker` to image version 0.3: + ```bash + kubectl set image deployment worker worker=dockercoins/worker:v0.3 + ``` + +- View the change history: + ```bash + kubectl rollout history deployment worker + ``` + +] + +-- + +It recorded version 0.2 instead of 0.3! Why? + +--- + +## How `--record` really works + +- `kubectl` adds the annotation `kubernetes.io/change-cause` to the Deployment + +- The Deployment controller copies that annotation to the ReplicaSet + +- `kubectl rollout history` shows the ReplicaSets' annotations + +- If we don't specify `--record`, the annotation is not updated + +- The previous value of that annotation is copied to the new ReplicaSet + +- In that case, the ReplicaSet annotation does not reflect reality! + +--- + +## Pitfall #2: recording `scale` commands + +- What happens if we use `kubectl scale --record`? + +.exercise[ + +- Check the current history: + ```bash + kubectl rollout history deployment worker + ``` + +- Scale the deployment: + ```bash + kubectl scale deployment worker --replicas=3 --record + ``` + +- Check the change history again: + ```bash + kubectl rollout history deployment worker + ``` + +] + +-- + +The last entry in the history was overwritten by the `scale` command! Why? + +--- + +## Actions that don't create a new ReplicaSet + +- The `scale` command updates the Deployment definition + +- But it doesn't create a new ReplicaSet + +- Using the `--record` flag sets the annotation like before + +- The annotation gets copied to the existing ReplicaSet + +- This overwrites the previous annotation that was there + +- In that case, we lose the previous change cause! + +--- + +## Updating the annotation directly + +- Let's see what happens if we set the annotation manually + +.exercise[ + +- Annotate the Deployment: + ```bash + kubectl annotate deployment worker kubernetes.io/change-cause="Just for fun" + ``` + +- Check that our annotation shows up in the change history: + ```bash + kubectl rollout history deployment worker + ``` + +] + +-- + +Our annotation shows up (and overwrote whatever was there before). + +--- + +## Using change cause + +- It sounds like a good idea to use `--record`, but: + + *"Incorrect documentation is often worse than no documentation."* +
+ (Bertrand Meyer) + +- If we use `--record` once, we need to either: + + - use it every single time after that + + - or clear the Deployment annotation after using `--record` +
+ (subsequent changes will show up with a `` change cause) + +- A safer way is to set it through our tooling diff --git a/slides/k8s/rollout.md b/slides/k8s/rollout.md index 958ad5e2..5783c020 100644 --- a/slides/k8s/rollout.md +++ b/slides/k8s/rollout.md @@ -265,6 +265,8 @@ Note the `3xxxx` port. --- +class: extra-details + ## Changing rollout parameters - We want to: @@ -294,6 +296,8 @@ spec: --- +class: extra-details + ## Applying changes through a YAML patch - We could use `kubectl edit deployment worker` diff --git a/slides/kube-fullday.yml b/slides/kube-fullday.yml index e60f6184..0c60c85b 100644 --- a/slides/kube-fullday.yml +++ b/slides/kube-fullday.yml @@ -48,6 +48,7 @@ chapters: - shared/hastyconclusions.md - k8s/daemonset.md - - k8s/rollout.md + #- k8s/record.md - k8s/namespaces.md #- k8s/kustomize.md #- k8s/helm.md diff --git a/slides/kube-halfday.yml b/slides/kube-halfday.yml index 53bc677b..8d86a65e 100644 --- a/slides/kube-halfday.yml +++ b/slides/kube-halfday.yml @@ -51,6 +51,7 @@ chapters: - shared/hastyconclusions.md - k8s/daemonset.md - k8s/rollout.md + #- k8s/record.md - - k8s/logs-cli.md # Bridget hasn't added EFK yet #- k8s/logs-centralized.md diff --git a/slides/kube-selfpaced.yml b/slides/kube-selfpaced.yml index fc178e46..2c23b1d7 100644 --- a/slides/kube-selfpaced.yml +++ b/slides/kube-selfpaced.yml @@ -48,6 +48,7 @@ chapters: # - shared/hastyconclusions.md - k8s/daemonset.md - k8s/rollout.md + - k8s/record.md - k8s/namespaces.md - - k8s/kustomize.md - k8s/helm.md diff --git a/slides/kube-twodays.yml b/slides/kube-twodays.yml index 09c236d7..134eeb2a 100644 --- a/slides/kube-twodays.yml +++ b/slides/kube-twodays.yml @@ -48,6 +48,7 @@ chapters: - shared/hastyconclusions.md - - k8s/daemonset.md - k8s/rollout.md + - k8s/record.md - k8s/namespaces.md - k8s/kustomize.md #- k8s/helm.md From 44e84c5f230b3855ebd986cf0ea46d860c4a8ae1 Mon Sep 17 00:00:00 2001 From: Bridget Kromhout Date: Sun, 14 Jul 2019 17:33:54 -0700 Subject: [PATCH 03/19] Typo fix --- slides/k8s/operators.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/slides/k8s/operators.md b/slides/k8s/operators.md index fdf6bbf6..46eb526d 100644 --- a/slides/k8s/operators.md +++ b/slides/k8s/operators.md @@ -302,7 +302,7 @@ Now, the StorageClass should have `(default)` next to its name. - Retrieve the NodePort that was allocated: ```bash - kubectl get svc cerebreo-es + kubectl get svc cerebro-es ``` - Connect to that port with a browser From cede1a4c12a6bd2857177062719cb077722deb1f Mon Sep 17 00:00:00 2001 From: Aaron Wislang Date: Tue, 16 Jul 2019 13:31:24 -0700 Subject: [PATCH 04/19] Add oscon2019.container.training --- slides/index.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/slides/index.yaml b/slides/index.yaml index 75d18bc2..cfb32b87 100644 --- a/slides/index.yaml +++ b/slides/index.yaml @@ -31,6 +31,7 @@ speaker: bridgetkromhout title: "Kubernetes 201: Production tooling" attend: https://conferences.oreilly.com/oscon/oscon-or/public/schedule/detail/76390 + slides: https://oscon2019.container.training - date: 2019-06-17 country: ca From c690a02d37397762ece0c764a1e56acc4f0d42a4 Mon Sep 17 00:00:00 2001 From: Jerome Petazzoni Date: Wed, 17 Jul 2019 05:41:07 -0500 Subject: [PATCH 05/19] Add webssh command to deploy webssh on all machines --- prepare-vms/lib/commands.sh | 32 ++++++++++++++++++++++++++++++++ 1 file changed, 32 insertions(+) diff --git a/prepare-vms/lib/commands.sh b/prepare-vms/lib/commands.sh index dba89594..807120ac 100644 --- a/prepare-vms/lib/commands.sh +++ b/prepare-vms/lib/commands.sh @@ -536,6 +536,38 @@ _cmd_weavetest() { sh -c \"./weave --local status | grep Connections | grep -q ' 1 failed' || ! echo POD \"" } +_cmd webssh "Install a WEB SSH server on the machines (port 1080)" +_cmd_webssh() { + TAG=$1 + need_tag + pssh " + sudo apt-get update && + sudo apt-get install python-tornado python-paramiko -y" + pssh " + [ -d webssh ] || git clone https://github.com/jpetazzo/webssh" + pssh " + for KEYFILE in /etc/ssh/*.pub; do + read a b c < \$KEYFILE; echo localhost \$a \$b + done > webssh/known_hosts" + pssh "cat >webssh.service < Date: Thu, 25 Jul 2019 06:22:29 -0500 Subject: [PATCH 06/19] Update README.md --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index 7bac0675..7a16bcdb 100644 --- a/README.md +++ b/README.md @@ -39,7 +39,7 @@ your own tutorials. All these materials have been gathered in a single repository because they have a few things in common: -- some [common slides](slides/common/) that are re-used +- some [shared slides](slides/shared/) that are re-used (and updated) identically between different decks; - a [build system](slides/) generating HTML slides from Markdown source files; From 9a184c6d4442bd8eddf32c285174294c9d136046 Mon Sep 17 00:00:00 2001 From: Jerome Petazzoni Date: Thu, 25 Jul 2019 11:47:43 -0500 Subject: [PATCH 07/19] Clarify daemon sets (fixes #471) --- slides/k8s/daemonset.md | 24 +++++++++++++++++++----- 1 file changed, 19 insertions(+), 5 deletions(-) diff --git a/slides/k8s/daemonset.md b/slides/k8s/daemonset.md index 91cd2563..44e071f6 100644 --- a/slides/k8s/daemonset.md +++ b/slides/k8s/daemonset.md @@ -4,15 +4,29 @@ - We want one (and exactly one) instance of `rng` per node -- What if we just scale up `deploy/rng` to the number of nodes? +- We *do not want* two instances of `rng` on the same node - - nothing guarantees that the `rng` containers will be distributed evenly +- We will do that with a *daemon set* - - if we add nodes later, they will not automatically run a copy of `rng` +--- - - if we remove (or reboot) a node, one `rng` container will restart elsewhere +## Why not a deployment? -- Instead of a `deployment`, we will use a `daemonset` +- Can't we just do `kubectl scale deployment rng --replicas=...`? + +-- + +- Nothing guarantees that the `rng` containers will be distributed evenly + +- If we add nodes later, they will not automatically run a copy of `rng` + +- If we remove (or reboot) a node, one `rng` container will restart elsewhere + + (and we will end up with two instances `rng` on the same node) + +- By contrast, a daemon set will start one pod per node and keep it that way + + (as nodes are added or removed) --- From 3a816568da7da8582419742efb8d0445b4e4a8ee Mon Sep 17 00:00:00 2001 From: Anton Weiss Date: Sun, 28 Jul 2019 14:21:20 +0300 Subject: [PATCH 08/19] Fix 2 typos in k8s/operators.md and k8s/operators-design.md --- slides/k8s/operators-design.md | 2 +- slides/k8s/operators.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/slides/k8s/operators-design.md b/slides/k8s/operators-design.md index c7b31d18..9af804ce 100644 --- a/slides/k8s/operators-design.md +++ b/slides/k8s/operators-design.md @@ -32,7 +32,7 @@ - must be able to anticipate all the events that might happen - - design will be better only to the extend of what we anticipated + - design will be better only to the extent of what we anticipated - hard to anticipate if we don't have production experience diff --git a/slides/k8s/operators.md b/slides/k8s/operators.md index 46eb526d..0c841865 100644 --- a/slides/k8s/operators.md +++ b/slides/k8s/operators.md @@ -386,4 +386,4 @@ We should see at least one index being created in cerebro. - What if we want different images or parameters for the different nodes? -*Operators can be very powerful, iff we know exactly the scenarios that they can handle.* +*Operators can be very powerful, if we know exactly the scenarios that they can handle.* From 02dcb58f775c36b8490c53be9ece6fc3a2ae758e Mon Sep 17 00:00:00 2001 From: Anton Weiss Date: Sun, 28 Jul 2019 16:05:48 +0300 Subject: [PATCH 09/19] Fix typo in consul startup command --- slides/k8s/statefulsets.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/slides/k8s/statefulsets.md b/slides/k8s/statefulsets.md index 9692eef0..6c7c15a9 100644 --- a/slides/k8s/statefulsets.md +++ b/slides/k8s/statefulsets.md @@ -345,7 +345,7 @@ spec: we figure out the minimal command-line to run our Consul cluster.* ``` -consul agent -data=dir=/consul/data -client=0.0.0.0 -server -ui \ +consul agent -data-dir=/consul/data -client=0.0.0.0 -server -ui \ -bootstrap-expect=3 \ -retry-join=`X.X.X.X` \ -retry-join=`Y.Y.Y.Y` From 91fb2f167c71629a0f17f97d6fb4f5304b15ef29 Mon Sep 17 00:00:00 2001 From: Anton Weiss Date: Sun, 28 Jul 2019 16:27:53 +0300 Subject: [PATCH 10/19] Update Flux github url --- slides/k8s/gitworkflows.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/slides/k8s/gitworkflows.md b/slides/k8s/gitworkflows.md index 4bccea72..c1ebdf6e 100644 --- a/slides/k8s/gitworkflows.md +++ b/slides/k8s/gitworkflows.md @@ -87,7 +87,7 @@ - Clone the Flux repository: ``` - git clone https://github.com/weaveworks/flux + git clone https://github.com/fluxcd/flux ``` - Edit `deploy/flux-deployment.yaml` From f7fbe1b056a6360fbdc7350c515b9274b6822f37 Mon Sep 17 00:00:00 2001 From: Jerome Petazzoni Date: Wed, 7 Aug 2019 05:25:49 -0500 Subject: [PATCH 11/19] Add example blog post about Operator Framework --- slides/k8s/operators-design.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/slides/k8s/operators-design.md b/slides/k8s/operators-design.md index c7b31d18..6540f4c5 100644 --- a/slides/k8s/operators-design.md +++ b/slides/k8s/operators-design.md @@ -187,6 +187,8 @@ class: extra-details [Intro talk](https://www.youtube.com/watch?v=8k_ayO1VRXE) | [Deep dive talk](https://www.youtube.com/watch?v=fu7ecA2rXmc) + | + [Simple example](https://medium.com/faun/writing-your-first-kubernetes-operator-8f3df4453234) - Zalando Kubernetes Operator Pythonic Framework (KOPF) From c7a504dcb46f720019b979ea6849c5ce74b5d7b2 Mon Sep 17 00:00:00 2001 From: Jerome Petazzoni Date: Wed, 7 Aug 2019 07:50:11 -0500 Subject: [PATCH 12/19] Replace 'iff' with something more understandable --- slides/k8s/operators.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/slides/k8s/operators.md b/slides/k8s/operators.md index 0c841865..b43f275f 100644 --- a/slides/k8s/operators.md +++ b/slides/k8s/operators.md @@ -386,4 +386,6 @@ We should see at least one index being created in cerebro. - What if we want different images or parameters for the different nodes? -*Operators can be very powerful, if we know exactly the scenarios that they can handle.* +*Operators can be very powerful. +
+But we need to know exactly the scenarios that they can handle.* From 2365b8f460d888a6728f6f557e1e1e3cacddc15e Mon Sep 17 00:00:00 2001 From: Jerome Petazzoni Date: Thu, 8 Aug 2019 07:37:05 -0500 Subject: [PATCH 13/19] Add web server to make it easier to generate cards from CNC node --- .gitignore | 1 + prepare-vms/lib/commands.sh | 17 +++++++++++++++++ prepare-vms/www/README | 4 ++++ prepare-vms/www/index.html | 0 4 files changed, 22 insertions(+) create mode 100644 prepare-vms/www/README create mode 100644 prepare-vms/www/index.html diff --git a/.gitignore b/.gitignore index 21ae9d25..29ad9ad8 100644 --- a/.gitignore +++ b/.gitignore @@ -3,6 +3,7 @@ *~ prepare-vms/tags prepare-vms/infra +prepare-vms/www slides/*.yml.html slides/autopilot/state.yaml slides/index.html diff --git a/prepare-vms/lib/commands.sh b/prepare-vms/lib/commands.sh index 807120ac..5fb3ed76 100644 --- a/prepare-vms/lib/commands.sh +++ b/prepare-vms/lib/commands.sh @@ -33,9 +33,14 @@ _cmd_cards() { ../../lib/ips-txt-to-html.py settings.yaml ) + ln -sf ../tags/$TAG/ips.html www/$TAG.html + ln -sf ../tags/$TAG/ips.pdf www/$TAG.pdf + info "Cards created. You can view them with:" info "xdg-open tags/$TAG/ips.html tags/$TAG/ips.pdf (on Linux)" info "open tags/$TAG/ips.html (on macOS)" + info "Or you can start a web server with:" + info "$0 www" } _cmd deploy "Install Docker on a bunch of running VMs" @@ -568,6 +573,18 @@ EOF" sudo systemctl start webssh.service" } +_cmd www "Run a web server to access card HTML and PDF" +_cmd_www() { + cd www + IPADDR=$(curl -sL canihazip.com/s) + info "The following files are available:" + for F in *; do + echo "http://$IPADDR:8000/$F" + done + info "Press Ctrl-C to stop server." + python -m http.server +} + greet() { IAMUSER=$(aws iam get-user --query 'User.UserName') info "Hello! You seem to be UNIX user $USER, and IAM user $IAMUSER." diff --git a/prepare-vms/www/README b/prepare-vms/www/README new file mode 100644 index 00000000..1499f3a6 --- /dev/null +++ b/prepare-vms/www/README @@ -0,0 +1,4 @@ +This directory will contain symlinks to HTML and PDF files for the cards +with the IP address, login, and password for the training environments. + +The file "index.html" is empty on purpose: it prevents listing the files. diff --git a/prepare-vms/www/index.html b/prepare-vms/www/index.html new file mode 100644 index 00000000..e69de29b From edd2f749c03788d36268a91d6a6af933fe170a1a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=BCray=20Y=C4=B1ld=C4=B1r=C4=B1m?= Date: Mon, 12 Aug 2019 15:16:11 +0300 Subject: [PATCH 14/19] Add HacknBreak 2019 workshops to website --- slides/index.yaml | 27 +++++++++++++++++++++++++++ 1 file changed, 27 insertions(+) diff --git a/slides/index.yaml b/slides/index.yaml index cfb32b87..f180cd51 100644 --- a/slides/index.yaml +++ b/slides/index.yaml @@ -24,6 +24,33 @@ lang: fr attend: https://enix.io/fr/services/formation/deployer-ses-applications-avec-kubernetes/ +- date: 2019-27-08 + country: tr + city: Izmir + event: HacknBreak + speaker: gurayyildirim + title: Deploying and scaling applications with Kubernetes (in Turkish) + lang: tr + attend: https://hacknbreak.com + +- date: 2019-26-08 + country: tr + city: Izmir + event: HacknBreak + speaker: gurayyildirim + title: Container Orchestration with Docker and Swarm (in Turkish) + lang: tr + attend: https://hacknbreak.com + +- date: 2019-25-08 + country: tr + city: Izmir + event: HackBreak + speaker: gurayyildirim + title: Introduction to Docker and Containers (in Turkish) + lang: tr + attend: https://hacknbreak.com + - date: 2019-07-16 country: us city: Portland, OR From 1abfac419bc7e553b5735fa56698726cdc88a8a9 Mon Sep 17 00:00:00 2001 From: gurayyildirim Date: Mon, 12 Aug 2019 15:21:53 +0300 Subject: [PATCH 15/19] Fix date format --- slides/index.yaml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/slides/index.yaml b/slides/index.yaml index f180cd51..4c69e4b6 100644 --- a/slides/index.yaml +++ b/slides/index.yaml @@ -24,7 +24,7 @@ lang: fr attend: https://enix.io/fr/services/formation/deployer-ses-applications-avec-kubernetes/ -- date: 2019-27-08 +- date: 2019-08-27 country: tr city: Izmir event: HacknBreak @@ -33,7 +33,7 @@ lang: tr attend: https://hacknbreak.com -- date: 2019-26-08 +- date: 2019-08-26 country: tr city: Izmir event: HacknBreak @@ -42,7 +42,7 @@ lang: tr attend: https://hacknbreak.com -- date: 2019-25-08 +- date: 2019-08-25 country: tr city: Izmir event: HackBreak From af18c5ab9ffed35ce12571b1c907c4cb373f804c Mon Sep 17 00:00:00 2001 From: Jerome Petazzoni Date: Tue, 13 Aug 2019 06:04:24 -0500 Subject: [PATCH 16/19] Bump versions --- slides/k8s/localkubeconfig.md | 6 +++--- slides/k8s/versions-k8s.md | 4 ++-- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/slides/k8s/localkubeconfig.md b/slides/k8s/localkubeconfig.md index d5bff3d8..ce58b889 100644 --- a/slides/k8s/localkubeconfig.md +++ b/slides/k8s/localkubeconfig.md @@ -34,11 +34,11 @@ - Download the `kubectl` binary from one of these links: - [Linux](https://storage.googleapis.com/kubernetes-release/release/v1.15.0/bin/linux/amd64/kubectl) + [Linux](https://storage.googleapis.com/kubernetes-release/release/v1.15.2/bin/linux/amd64/kubectl) | - [macOS](https://storage.googleapis.com/kubernetes-release/release/v1.15.0/bin/darwin/amd64/kubectl) + [macOS](https://storage.googleapis.com/kubernetes-release/release/v1.15.2/bin/darwin/amd64/kubectl) | - [Windows](https://storage.googleapis.com/kubernetes-release/release/v1.15.0/bin/windows/amd64/kubectl.exe) + [Windows](https://storage.googleapis.com/kubernetes-release/release/v1.15.2/bin/windows/amd64/kubectl.exe) - On Linux and macOS, make the binary executable with `chmod +x kubectl` diff --git a/slides/k8s/versions-k8s.md b/slides/k8s/versions-k8s.md index 6eda0bb2..e939876f 100644 --- a/slides/k8s/versions-k8s.md +++ b/slides/k8s/versions-k8s.md @@ -1,7 +1,7 @@ ## Versions installed -- Kubernetes 1.15.0 -- Docker Engine 18.09.7 +- Kubernetes 1.15.2 +- Docker Engine 19.03.1 - Docker Compose 1.24.1 From 34fca341bc71d359aa7cc1ec41c1d11a195a49e7 Mon Sep 17 00:00:00 2001 From: Jerome Petazzoni Date: Tue, 13 Aug 2019 08:05:39 -0500 Subject: [PATCH 17/19] Bump k8s YAML versions --- k8s/consul.yaml | 2 +- k8s/efk.yaml | 2 +- k8s/ingress.yaml | 6 +- k8s/insecure-dashboard.yaml | 10 +- k8s/kubernetes-dashboard.yaml | 9 +- k8s/metrics-server.yaml | 2 +- k8s/persistent-consul.yaml | 2 +- k8s/portworx.yaml | 629 ++++++++++++++++++++++------------ k8s/postgres.yaml | 2 +- 9 files changed, 414 insertions(+), 250 deletions(-) diff --git a/k8s/consul.yaml b/k8s/consul.yaml index a0454bb0..8b254adb 100644 --- a/k8s/consul.yaml +++ b/k8s/consul.yaml @@ -72,7 +72,7 @@ spec: terminationGracePeriodSeconds: 10 containers: - name: consul - image: "consul:1.4.4" + image: "consul:1.5" args: - "agent" - "-bootstrap-expect=3" diff --git a/k8s/efk.yaml b/k8s/efk.yaml index a3204f5b..48d6c1ce 100644 --- a/k8s/efk.yaml +++ b/k8s/efk.yaml @@ -51,7 +51,7 @@ spec: effect: NoSchedule containers: - name: fluentd - image: fluent/fluentd-kubernetes-daemonset:v1.3-debian-elasticsearch-1 + image: fluent/fluentd-kubernetes-daemonset:v1.4-debian-elasticsearch-1 env: - name: FLUENT_ELASTICSEARCH_HOST value: "elasticsearch" diff --git a/k8s/ingress.yaml b/k8s/ingress.yaml index 65639357..e322bc10 100644 --- a/k8s/ingress.yaml +++ b/k8s/ingress.yaml @@ -1,14 +1,14 @@ -apiVersion: extensions/v1beta1 +apiVersion: networking.k8s.io/v1beta1 kind: Ingress metadata: name: cheddar spec: rules: - - host: cheddar.A.B.C.D.nip.io + - host: px.3.123.33.38.nip.io http: paths: - path: / backend: - serviceName: cheddar + serviceName: px-lighthouse servicePort: 80 diff --git a/k8s/insecure-dashboard.yaml b/k8s/insecure-dashboard.yaml index 5ced8947..44ec1d65 100644 --- a/k8s/insecure-dashboard.yaml +++ b/k8s/insecure-dashboard.yaml @@ -12,11 +12,6 @@ # See the License for the specific language governing permissions and # limitations under the License. -# Configuration to deploy release version of the Dashboard UI compatible with -# Kubernetes 1.8. -# -# Example usage: kubectl create -f - # ------------------- Dashboard Secret ------------------- # apiVersion: v1 @@ -95,7 +90,7 @@ subjects: # ------------------- Dashboard Deployment ------------------- # kind: Deployment -apiVersion: apps/v1beta2 +apiVersion: apps/v1 metadata: labels: k8s-app: kubernetes-dashboard @@ -114,12 +109,13 @@ spec: spec: containers: - name: kubernetes-dashboard - image: k8s.gcr.io/kubernetes-dashboard-amd64:v1.8.3 + image: k8s.gcr.io/kubernetes-dashboard-amd64:v1.10.1 ports: - containerPort: 8443 protocol: TCP args: - --auto-generate-certificates + - --enable-skip-login # Uncomment the following line to manually specify Kubernetes API server Host # If not specified, Dashboard will attempt to auto discover the API server and connect # to it. Uncomment only if the default does not work. diff --git a/k8s/kubernetes-dashboard.yaml b/k8s/kubernetes-dashboard.yaml index 73fcc239..ee6977bf 100644 --- a/k8s/kubernetes-dashboard.yaml +++ b/k8s/kubernetes-dashboard.yaml @@ -12,11 +12,6 @@ # See the License for the specific language governing permissions and # limitations under the License. -# Configuration to deploy release version of the Dashboard UI compatible with -# Kubernetes 1.8. -# -# Example usage: kubectl create -f - # ------------------- Dashboard Secret ------------------- # apiVersion: v1 @@ -95,7 +90,7 @@ subjects: # ------------------- Dashboard Deployment ------------------- # kind: Deployment -apiVersion: apps/v1beta2 +apiVersion: apps/v1 metadata: labels: k8s-app: kubernetes-dashboard @@ -114,7 +109,7 @@ spec: spec: containers: - name: kubernetes-dashboard - image: k8s.gcr.io/kubernetes-dashboard-amd64:v1.8.3 + image: k8s.gcr.io/kubernetes-dashboard-amd64:v1.10.1 ports: - containerPort: 8443 protocol: TCP diff --git a/k8s/metrics-server.yaml b/k8s/metrics-server.yaml index 5ca8441d..5864e25d 100644 --- a/k8s/metrics-server.yaml +++ b/k8s/metrics-server.yaml @@ -82,7 +82,7 @@ spec: emptyDir: {} containers: - name: metrics-server - image: k8s.gcr.io/metrics-server-amd64:v0.3.1 + image: k8s.gcr.io/metrics-server-amd64:v0.3.3 imagePullPolicy: Always volumeMounts: - name: tmp-dir diff --git a/k8s/persistent-consul.yaml b/k8s/persistent-consul.yaml index ff9d5955..64c35065 100644 --- a/k8s/persistent-consul.yaml +++ b/k8s/persistent-consul.yaml @@ -74,7 +74,7 @@ spec: terminationGracePeriodSeconds: 10 containers: - name: consul - image: "consul:1.4.4" + image: "consul:1.5" volumeMounts: - name: data mountPath: /consul/data diff --git a/k8s/portworx.yaml b/k8s/portworx.yaml index e968b5fe..4a196441 100644 --- a/k8s/portworx.yaml +++ b/k8s/portworx.yaml @@ -1,4 +1,340 @@ -# SOURCE: https://install.portworx.com/?kbver=1.11.2&b=true&s=/dev/loop4&c=px-workshop&stork=true&lh=true +# SOURCE: https://install.portworx.com/?kbver=1.15.2&b=true&s=/dev/loop4&c=px-workshop&stork=true&lh=true&st=k8s&mc=false +# SOURCE: https://install.portworx.com/?kbver=1.15.2&b=true&s=/dev/loop4&c=px-workshop&stork=true&lh=true&st=k8s&mc=false +--- +kind: Service +apiVersion: v1 +metadata: + name: portworx-service + namespace: kube-system + labels: + name: portworx +spec: + selector: + name: portworx + type: NodePort + ports: + - name: px-api + protocol: TCP + port: 9001 + targetPort: 9001 + - name: px-kvdb + protocol: TCP + port: 9019 + targetPort: 9019 + - name: px-sdk + protocol: TCP + port: 9020 + targetPort: 9020 + - name: px-rest-gateway + protocol: TCP + port: 9021 + targetPort: 9021 +--- +apiVersion: apiextensions.k8s.io/v1beta1 +kind: CustomResourceDefinition +metadata: + name: volumeplacementstrategies.portworx.io +spec: + group: portworx.io + versions: + - name: v1beta2 + served: true + storage: true + - name: v1beta1 + served: false + storage: false + scope: Cluster + names: + plural: volumeplacementstrategies + singular: volumeplacementstrategy + kind: VolumePlacementStrategy + shortNames: + - vps + - vp +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + name: px-account + namespace: kube-system +--- +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: node-get-put-list-role +rules: +- apiGroups: [""] + resources: ["secrets"] + verbs: ["get", "list"] +- apiGroups: [""] + resources: ["nodes"] + verbs: ["watch", "get", "update", "list"] +- apiGroups: [""] + resources: ["pods"] + verbs: ["delete", "get", "list", "watch", "update"] +- apiGroups: [""] + resources: ["persistentvolumeclaims", "persistentvolumes"] + verbs: ["get", "list"] +- apiGroups: [""] + resources: ["configmaps"] + verbs: ["get", "list", "update", "create"] +- apiGroups: ["extensions"] + resources: ["podsecuritypolicies"] + resourceNames: ["privileged"] + verbs: ["use"] +- apiGroups: ["portworx.io"] + resources: ["volumeplacementstrategies"] + verbs: ["get", "list"] +--- +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: node-role-binding +subjects: +- kind: ServiceAccount + name: px-account + namespace: kube-system +roleRef: + kind: ClusterRole + name: node-get-put-list-role + apiGroup: rbac.authorization.k8s.io +--- +apiVersion: v1 +kind: Namespace +metadata: + name: portworx +--- +kind: Role +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: px-role + namespace: portworx +rules: +- apiGroups: [""] + resources: ["secrets"] + verbs: ["get", "list", "create", "update", "patch"] +--- +kind: RoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: px-role-binding + namespace: portworx +subjects: +- kind: ServiceAccount + name: px-account + namespace: kube-system +roleRef: + kind: Role + name: px-role + apiGroup: rbac.authorization.k8s.io +--- +apiVersion: extensions/v1beta1 +kind: DaemonSet +metadata: + name: portworx + namespace: kube-system + annotations: + portworx.com/install-source: "https://install.portworx.com/?kbver=1.15.2&b=true&s=/dev/loop4&c=px-workshop&stork=true&lh=true&st=k8s&mc=false" +spec: + minReadySeconds: 0 + updateStrategy: + type: RollingUpdate + rollingUpdate: + maxUnavailable: 1 + template: + metadata: + labels: + name: portworx + spec: + affinity: + nodeAffinity: + requiredDuringSchedulingIgnoredDuringExecution: + nodeSelectorTerms: + - matchExpressions: + - key: px/enabled + operator: NotIn + values: + - "false" + - key: node-role.kubernetes.io/master + operator: DoesNotExist + hostNetwork: true + hostPID: false + initContainers: + - name: checkloop + image: alpine + command: [ "sh", "-c" ] + args: + - | + if ! grep -q loop4 /proc/partitions; then + echo 'Could not find "loop4" in /proc/partitions. Please create it first.' + exit 1 + fi + containers: + - name: portworx + image: portworx/oci-monitor:2.1.3 + imagePullPolicy: Always + args: + ["-c", "px-workshop", "-s", "/dev/loop4", "-secret_type", "k8s", "-b", + "-x", "kubernetes"] + env: + - name: "AUTO_NODE_RECOVERY_TIMEOUT_IN_SECS" + value: "1500" + - name: "PX_TEMPLATE_VERSION" + value: "v4" + + livenessProbe: + periodSeconds: 30 + initialDelaySeconds: 840 # allow image pull in slow networks + httpGet: + host: 127.0.0.1 + path: /status + port: 9001 + readinessProbe: + periodSeconds: 10 + httpGet: + host: 127.0.0.1 + path: /health + port: 9015 + terminationMessagePath: "/tmp/px-termination-log" + securityContext: + privileged: true + volumeMounts: + - name: diagsdump + mountPath: /var/cores + - name: dockersock + mountPath: /var/run/docker.sock + - name: containerdsock + mountPath: /run/containerd + - name: criosock + mountPath: /var/run/crio + - name: crioconf + mountPath: /etc/crictl.yaml + - name: etcpwx + mountPath: /etc/pwx + - name: optpwx + mountPath: /opt/pwx + - name: procmount + mountPath: /host_proc + - name: sysdmount + mountPath: /etc/systemd/system + - name: journalmount1 + mountPath: /var/run/log + readOnly: true + - name: journalmount2 + mountPath: /var/log + readOnly: true + - name: dbusmount + mountPath: /var/run/dbus + restartPolicy: Always + serviceAccountName: px-account + volumes: + - name: diagsdump + hostPath: + path: /var/cores + - name: dockersock + hostPath: + path: /var/run/docker.sock + - name: containerdsock + hostPath: + path: /run/containerd + - name: criosock + hostPath: + path: /var/run/crio + - name: crioconf + hostPath: + path: /etc/crictl.yaml + type: FileOrCreate + - name: etcpwx + hostPath: + path: /etc/pwx + - name: optpwx + hostPath: + path: /opt/pwx + - name: procmount + hostPath: + path: /proc + - name: sysdmount + hostPath: + path: /etc/systemd/system + - name: journalmount1 + hostPath: + path: /var/run/log + - name: journalmount2 + hostPath: + path: /var/log + - name: dbusmount + hostPath: + path: /var/run/dbus +--- +kind: Service +apiVersion: v1 +metadata: + name: portworx-api + namespace: kube-system + labels: + name: portworx-api +spec: + selector: + name: portworx-api + type: NodePort + ports: + - name: px-api + protocol: TCP + port: 9001 + targetPort: 9001 + - name: px-sdk + protocol: TCP + port: 9020 + targetPort: 9020 + - name: px-rest-gateway + protocol: TCP + port: 9021 + targetPort: 9021 +--- +apiVersion: extensions/v1beta1 +kind: DaemonSet +metadata: + name: portworx-api + namespace: kube-system +spec: + minReadySeconds: 0 + updateStrategy: + type: RollingUpdate + rollingUpdate: + maxUnavailable: 100% + template: + metadata: + labels: + name: portworx-api + spec: + affinity: + nodeAffinity: + requiredDuringSchedulingIgnoredDuringExecution: + nodeSelectorTerms: + - matchExpressions: + - key: px/enabled + operator: NotIn + values: + - "false" + - key: node-role.kubernetes.io/master + operator: DoesNotExist + hostNetwork: true + hostPID: false + containers: + - name: portworx-api + image: k8s.gcr.io/pause:3.1 + imagePullPolicy: Always + readinessProbe: + periodSeconds: 10 + httpGet: + host: 127.0.0.1 + path: /status + port: 9001 + restartPolicy: Always + serviceAccountName: px-account + + +--- apiVersion: v1 kind: ConfigMap metadata: @@ -11,7 +347,7 @@ data: "apiVersion": "v1", "extenders": [ { - "urlPrefix": "http://stork-service.kube-system.svc:8099", + "urlPrefix": "http://stork-service.kube-system:8099", "apiVersion": "v1beta1", "filterVerb": "filter", "prioritizeVerb": "prioritize", @@ -34,8 +370,8 @@ metadata: name: stork-role rules: - apiGroups: [""] - resources: ["pods"] - verbs: ["get", "list", "delete"] + resources: ["pods", "pods/exec"] + verbs: ["get", "list", "delete", "create", "watch"] - apiGroups: [""] resources: ["persistentvolumes"] verbs: ["get", "list", "watch", "create", "delete"] @@ -48,14 +384,14 @@ rules: - apiGroups: [""] resources: ["events"] verbs: ["list", "watch", "create", "update", "patch"] + - apiGroups: ["stork.libopenstorage.org"] + resources: ["*"] + verbs: ["get", "list", "watch", "update", "patch", "create", "delete"] - apiGroups: ["apiextensions.k8s.io"] resources: ["customresourcedefinitions"] - verbs: ["create", "list", "watch", "delete"] + verbs: ["create", "get"] - apiGroups: ["volumesnapshot.external-storage.k8s.io"] - resources: ["volumesnapshots"] - verbs: ["get", "list", "watch", "create", "update", "patch", "delete"] - - apiGroups: ["volumesnapshot.external-storage.k8s.io"] - resources: ["volumesnapshotdatas"] + resources: ["volumesnapshots", "volumesnapshotdatas"] verbs: ["get", "list", "watch", "create", "update", "patch", "delete"] - apiGroups: [""] resources: ["configmaps"] @@ -72,6 +408,9 @@ rules: - apiGroups: ["*"] resources: ["statefulsets", "statefulsets/extensions"] verbs: ["list", "get", "watch", "patch", "update", "initialize"] + - apiGroups: ["*"] + resources: ["*"] + verbs: ["list", "get"] --- kind: ClusterRoleBinding apiVersion: rbac.authorization.k8s.io/v1 @@ -131,7 +470,10 @@ spec: - --leader-elect=true - --health-monitor-interval=120 imagePullPolicy: Always - image: openstorage/stork:1.1.3 + image: openstorage/stork:2.2.4 + env: + - name: "PX_SERVICE_NAME" + value: "portworx-api" resources: requests: cpu: '0.1' @@ -168,16 +510,13 @@ metadata: rules: - apiGroups: [""] resources: ["endpoints"] - verbs: ["get", "update"] + verbs: ["get", "create", "update"] - apiGroups: [""] resources: ["configmaps"] verbs: ["get"] - apiGroups: [""] resources: ["events"] verbs: ["create", "patch", "update"] - - apiGroups: [""] - resources: ["endpoints"] - verbs: ["create"] - apiGroups: [""] resourceNames: ["kube-scheduler"] resources: ["endpoints"] @@ -197,7 +536,7 @@ rules: - apiGroups: [""] resources: ["replicationcontrollers", "services"] verbs: ["get", "list", "watch"] - - apiGroups: ["app", "extensions"] + - apiGroups: ["apps", "extensions"] resources: ["replicasets"] verbs: ["get", "list", "watch"] - apiGroups: ["apps"] @@ -253,7 +592,7 @@ spec: - --policy-configmap=stork-config - --policy-configmap-namespace=kube-system - --lock-object-name=stork-scheduler - image: gcr.io/google_containers/kube-scheduler-amd64:v1.11.2 + image: gcr.io/google_containers/kube-scheduler-amd64:v1.15.2 livenessProbe: httpGet: path: /healthz @@ -280,229 +619,61 @@ spec: hostPID: false serviceAccountName: stork-scheduler-account --- -kind: Service -apiVersion: v1 -metadata: - name: portworx-service - namespace: kube-system - labels: - name: portworx -spec: - selector: - name: portworx - ports: - - name: px-api - protocol: TCP - port: 9001 - targetPort: 9001 ---- apiVersion: v1 kind: ServiceAccount metadata: - name: px-account + name: px-lh-account namespace: kube-system --- kind: ClusterRole apiVersion: rbac.authorization.k8s.io/v1 metadata: - name: node-get-put-list-role + name: px-lh-role + namespace: kube-system rules: -- apiGroups: [""] - resources: ["nodes"] - verbs: ["watch", "get", "update", "list"] -- apiGroups: [""] - resources: ["pods"] - verbs: ["delete", "get", "list"] -- apiGroups: [""] - resources: ["persistentvolumeclaims", "persistentvolumes"] - verbs: ["get", "list"] -- apiGroups: [""] - resources: ["configmaps"] - verbs: ["get", "list", "update", "create"] -- apiGroups: ["extensions"] - resources: ["podsecuritypolicies"] - resourceNames: ["privileged"] - verbs: ["use"] + - apiGroups: [""] + resources: ["pods"] + verbs: ["list", "get"] + - apiGroups: + - extensions + - apps + resources: + - deployments + verbs: ["get", "list"] + - apiGroups: [""] + resources: ["secrets"] + verbs: ["get", "create", "update"] + - apiGroups: [""] + resources: ["configmaps"] + verbs: ["get", "create", "update"] + - apiGroups: [""] + resources: ["nodes"] + verbs: ["get", "list", "watch"] + - apiGroups: [""] + resources: ["services"] + verbs: ["create", "get", "list", "watch"] + - apiGroups: ["stork.libopenstorage.org"] + resources: ["clusterpairs","migrations","groupvolumesnapshots"] + verbs: ["get", "list", "create", "update", "delete"] + - apiGroups: ["monitoring.coreos.com"] + resources: + - alertmanagers + - prometheuses + - prometheuses/finalizers + - servicemonitors + verbs: ["*"] --- kind: ClusterRoleBinding apiVersion: rbac.authorization.k8s.io/v1 -metadata: - name: node-role-binding -subjects: -- kind: ServiceAccount - name: px-account - namespace: kube-system -roleRef: - kind: ClusterRole - name: node-get-put-list-role - apiGroup: rbac.authorization.k8s.io ---- -apiVersion: v1 -kind: Namespace -metadata: - name: portworx ---- -kind: Role -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - name: px-role - namespace: portworx -rules: -- apiGroups: [""] - resources: ["secrets"] - verbs: ["get", "list", "create", "update", "patch"] ---- -kind: RoleBinding -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - name: px-role-binding - namespace: portworx -subjects: -- kind: ServiceAccount - name: px-account - namespace: kube-system -roleRef: - kind: Role - name: px-role - apiGroup: rbac.authorization.k8s.io ---- -apiVersion: extensions/v1beta1 -kind: DaemonSet -metadata: - name: portworx - namespace: kube-system - annotations: - portworx.com/install-source: "https://install.portworx.com/?kbver=1.11.2&b=true&s=/dev/loop4&c=px-workshop&stork=true&lh=true" -spec: - minReadySeconds: 0 - updateStrategy: - type: RollingUpdate - rollingUpdate: - maxUnavailable: 1 - template: - metadata: - labels: - name: portworx - spec: - affinity: - nodeAffinity: - requiredDuringSchedulingIgnoredDuringExecution: - nodeSelectorTerms: - - matchExpressions: - - key: px/enabled - operator: NotIn - values: - - "false" - - key: node-role.kubernetes.io/master - operator: DoesNotExist - hostNetwork: true - hostPID: false - containers: - - name: portworx - image: portworx/oci-monitor:1.4.2.2 - imagePullPolicy: Always - args: - ["-c", "px-workshop", "-s", "/dev/loop4", "-b", - "-x", "kubernetes"] - env: - - name: "PX_TEMPLATE_VERSION" - value: "v4" - - livenessProbe: - periodSeconds: 30 - initialDelaySeconds: 840 # allow image pull in slow networks - httpGet: - host: 127.0.0.1 - path: /status - port: 9001 - readinessProbe: - periodSeconds: 10 - httpGet: - host: 127.0.0.1 - path: /health - port: 9015 - terminationMessagePath: "/tmp/px-termination-log" - securityContext: - privileged: true - volumeMounts: - - name: dockersock - mountPath: /var/run/docker.sock - - name: etcpwx - mountPath: /etc/pwx - - name: optpwx - mountPath: /opt/pwx - - name: proc1nsmount - mountPath: /host_proc/1/ns - - name: sysdmount - mountPath: /etc/systemd/system - - name: diagsdump - mountPath: /var/cores - - name: journalmount1 - mountPath: /var/run/log - readOnly: true - - name: journalmount2 - mountPath: /var/log - readOnly: true - - name: dbusmount - mountPath: /var/run/dbus - restartPolicy: Always - serviceAccountName: px-account - volumes: - - name: dockersock - hostPath: - path: /var/run/docker.sock - - name: etcpwx - hostPath: - path: /etc/pwx - - name: optpwx - hostPath: - path: /opt/pwx - - name: proc1nsmount - hostPath: - path: /proc/1/ns - - name: sysdmount - hostPath: - path: /etc/systemd/system - - name: diagsdump - hostPath: - path: /var/cores - - name: journalmount1 - hostPath: - path: /var/run/log - - name: journalmount2 - hostPath: - path: /var/log - - name: dbusmount - hostPath: - path: /var/run/dbus ---- -apiVersion: v1 -kind: ServiceAccount -metadata: - name: px-lh-account - namespace: kube-system ---- -kind: Role -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - name: px-lh-role - namespace: kube-system -rules: -- apiGroups: [""] - resources: ["configmaps"] - verbs: ["get", "create", "update"] ---- -kind: RoleBinding -apiVersion: rbac.authorization.k8s.io/v1 metadata: name: px-lh-role-binding namespace: kube-system subjects: -- kind: ServiceAccount - name: px-lh-account - namespace: kube-system + - kind: ServiceAccount + name: px-lh-account + namespace: kube-system roleRef: - kind: Role + kind: ClusterRole name: px-lh-role apiGroup: rbac.authorization.k8s.io --- @@ -518,14 +689,12 @@ spec: ports: - name: http port: 80 - nodePort: 32678 - name: https port: 443 - nodePort: 32679 selector: tier: px-web-console --- -apiVersion: apps/v1beta2 +apiVersion: apps/v1beta1 kind: Deployment metadata: name: px-lighthouse @@ -549,7 +718,7 @@ spec: spec: initContainers: - name: config-init - image: portworx/lh-config-sync:0.2 + image: portworx/lh-config-sync:0.4 imagePullPolicy: Always args: - "init" @@ -558,8 +727,9 @@ spec: mountPath: /config/lh containers: - name: px-lighthouse - image: portworx/px-lighthouse:1.5.0 + image: portworx/px-lighthouse:2.0.4 imagePullPolicy: Always + args: [ "-kubernetes", "true" ] ports: - containerPort: 80 - containerPort: 443 @@ -567,13 +737,16 @@ spec: - name: config mountPath: /config/lh - name: config-sync - image: portworx/lh-config-sync:0.2 + image: portworx/lh-config-sync:0.4 imagePullPolicy: Always args: - "sync" volumeMounts: - name: config mountPath: /config/lh + - name: stork-connector + image: portworx/lh-stork-connector:0.2 + imagePullPolicy: Always serviceAccountName: px-lh-account volumes: - name: config diff --git a/k8s/postgres.yaml b/k8s/postgres.yaml index d2868cd9..75ac4b8e 100644 --- a/k8s/postgres.yaml +++ b/k8s/postgres.yaml @@ -15,7 +15,7 @@ spec: schedulerName: stork containers: - name: postgres - image: postgres:10.5 + image: postgres:11 volumeMounts: - mountPath: /var/lib/postgresql/data name: postgres From 09c832031bdd07f3aa8d8d9d84219f3755d8e82a Mon Sep 17 00:00:00 2001 From: Jerome Petazzoni Date: Tue, 13 Aug 2019 08:13:37 -0500 Subject: [PATCH 18/19] Bump up ingress version in slides too --- slides/k8s/ingress.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/slides/k8s/ingress.md b/slides/k8s/ingress.md index 9ccfdd8c..7b12100a 100644 --- a/slides/k8s/ingress.md +++ b/slides/k8s/ingress.md @@ -415,7 +415,7 @@ This is normal: we haven't provided any ingress rule yet. Here is a minimal host-based ingress resource: ```yaml -apiVersion: extensions/v1beta1 +apiVersion: networking.k8s.io/v1beta1 kind: Ingress metadata: name: cheddar @@ -523,4 +523,4 @@ spec: - This should eventually stabilize - (remember that ingresses are currently `apiVersion: extensions/v1beta1`) + (remember that ingresses are currently `apiVersion: networking.k8s.io/v1beta1`) From ead027a62eb844b685f32d94aa2af982a8888956 Mon Sep 17 00:00:00 2001 From: Jerome Petazzoni Date: Tue, 13 Aug 2019 09:37:14 -0500 Subject: [PATCH 19/19] Reorganize content flow This introduces concepts more progressively (instead of front-loading most of the theory before tackling first useful commands). It was successfully testsed at PyCon and at a few 1-day engagements and works really well. I'm now making it the official flow. I'm also reformatting the YAML a little bit to facilitate content suffling. --- slides/kube-fullday.yml | 55 +++++++++++++++++-------------- slides/kube-selfpaced.yml | 68 +++++++++++++++++++++++---------------- slides/kube-twodays.yml | 67 +++++++++++++++++++++----------------- 3 files changed, 108 insertions(+), 82 deletions(-) diff --git a/slides/kube-fullday.yml b/slides/kube-fullday.yml index 0c60c85b..c521e707 100644 --- a/slides/kube-fullday.yml +++ b/slides/kube-fullday.yml @@ -19,7 +19,8 @@ chapters: - k8s/intro.md - shared/about-slides.md - shared/toc.md -- - shared/prereqs.md +- + - shared/prereqs.md - shared/connecting.md - k8s/versions-k8s.md - shared/sampleapp.md @@ -27,56 +28,60 @@ chapters: #- shared/hastyconclusions.md - shared/composedown.md - k8s/concepts-k8s.md + - k8s/kubectlget.md +- + - k8s/kubectlrun.md + - k8s/logs-cli.md - shared/declarative.md - k8s/declarative.md - - k8s/kubenet.md -- - k8s/kubectlget.md - - k8s/setup-k8s.md - - k8s/kubectlrun.md - k8s/deploymentslideshow.md + - k8s/kubenet.md - k8s/kubectlexpose.md -- - k8s/shippingimages.md + - k8s/shippingimages.md #- k8s/buildshiprun-selfhosted.md - k8s/buildshiprun-dockerhub.md - k8s/ourapponkube.md #- k8s/kubectlproxy.md #- k8s/localkubeconfig.md #- k8s/accessinternal.md +- + - k8s/setup-k8s.md - k8s/dashboard.md #- k8s/kubectlscale.md - k8s/scalingdockercoins.md - shared/hastyconclusions.md - k8s/daemonset.md -- - k8s/rollout.md + - k8s/rollout.md + #- k8s/healthchecks.md + #- k8s/healthchecks-more.md #- k8s/record.md +- - k8s/namespaces.md + - k8s/ingress.md #- k8s/kustomize.md #- k8s/helm.md #- k8s/create-chart.md -# - k8s/healthchecks.md -# - k8s/healthchecks-more.md - - k8s/logs-cli.md - - k8s/logs-centralized.md #- k8s/netpol.md #- k8s/authn-authz.md #- k8s/csr-api.md #- k8s/openid-connect.md #- k8s/podsecuritypolicy.md - #- k8s/ingress.md - #- k8s/gitworkflows.md - - k8s/prometheus.md -#- - k8s/volumes.md -# - k8s/build-with-docker.md -# - k8s/build-with-kaniko.md -# - k8s/configuration.md -#- - k8s/owners-and-dependents.md -# - k8s/extending-api.md -# - k8s/operators.md -# - k8s/operators-design.md -# - k8s/statefulsets.md + - k8s/volumes.md + #- k8s/build-with-docker.md + #- k8s/build-with-kaniko.md + - k8s/configuration.md + #- k8s/logs-centralized.md + #- k8s/prometheus.md + #- k8s/statefulsets.md #- k8s/local-persistent-volumes.md + #- k8s/portworx.md + #- k8s/extending-api.md + #- k8s/operators.md + #- k8s/operators-design.md #- k8s/staticpods.md -# - k8s/portworx.md -- - k8s/whatsnext.md + #- k8s/owners-and-dependents.md + #- k8s/gitworkflows.md +- + - k8s/whatsnext.md - k8s/links.md - shared/thankyou.md diff --git a/slides/kube-selfpaced.yml b/slides/kube-selfpaced.yml index 2c23b1d7..f43e80cc 100644 --- a/slides/kube-selfpaced.yml +++ b/slides/kube-selfpaced.yml @@ -19,64 +19,76 @@ chapters: - k8s/intro.md - shared/about-slides.md - shared/toc.md -- - shared/prereqs.md +- + - shared/prereqs.md - shared/connecting.md - k8s/versions-k8s.md - shared/sampleapp.md - - shared/composescale.md - - shared/hastyconclusions.md + #- shared/composescale.md + #- shared/hastyconclusions.md - shared/composedown.md - k8s/concepts-k8s.md + - k8s/kubectlget.md +- + - k8s/kubectlrun.md + - k8s/logs-cli.md - shared/declarative.md - k8s/declarative.md -- - k8s/kubenet.md - - k8s/kubectlget.md - - k8s/setup-k8s.md - - k8s/kubectlrun.md - k8s/deploymentslideshow.md -- - k8s/kubectlexpose.md + - k8s/kubenet.md + - k8s/kubectlexpose.md - k8s/shippingimages.md - k8s/buildshiprun-selfhosted.md - k8s/buildshiprun-dockerhub.md - k8s/ourapponkube.md +- - k8s/kubectlproxy.md - k8s/localkubeconfig.md - k8s/accessinternal.md + - k8s/setup-k8s.md - k8s/dashboard.md -- - k8s/kubectlscale.md -# - k8s/scalingdockercoins.md -# - shared/hastyconclusions.md + #- k8s/kubectlscale.md + - k8s/scalingdockercoins.md + - shared/hastyconclusions.md - k8s/daemonset.md +- - k8s/rollout.md - - k8s/record.md - - k8s/namespaces.md -- - k8s/kustomize.md - - k8s/helm.md - - k8s/create-chart.md - k8s/healthchecks.md - k8s/healthchecks-more.md - - k8s/logs-cli.md - - k8s/logs-centralized.md -- - k8s/netpol.md + - k8s/record.md +- + - k8s/namespaces.md + - k8s/ingress.md + - k8s/kustomize.md + - k8s/helm.md + - k8s/create-chart.md +- + - k8s/netpol.md - k8s/authn-authz.md +- - k8s/csr-api.md - k8s/openid-connect.md - k8s/podsecuritypolicy.md -- - k8s/ingress.md - - k8s/gitworkflows.md - - k8s/prometheus.md -- - k8s/volumes.md +- + - k8s/volumes.md - k8s/build-with-docker.md - k8s/build-with-kaniko.md - k8s/configuration.md -- - k8s/owners-and-dependents.md +- + - k8s/logs-centralized.md + - k8s/prometheus.md +- + - k8s/statefulsets.md + - k8s/local-persistent-volumes.md + - k8s/portworx.md +- - k8s/extending-api.md - k8s/operators.md - k8s/operators-design.md -- - k8s/statefulsets.md - - k8s/local-persistent-volumes.md - - k8s/portworx.md - k8s/staticpods.md -- - k8s/whatsnext.md + - k8s/owners-and-dependents.md + - k8s/gitworkflows.md +- + - k8s/whatsnext.md - k8s/links.md - shared/thankyou.md diff --git a/slides/kube-twodays.yml b/slides/kube-twodays.yml index 134eeb2a..0c1ef38a 100644 --- a/slides/kube-twodays.yml +++ b/slides/kube-twodays.yml @@ -19,7 +19,8 @@ chapters: - k8s/intro.md - shared/about-slides.md - shared/toc.md -- - shared/prereqs.md +- + - shared/prereqs.md - shared/connecting.md - k8s/versions-k8s.md - shared/sampleapp.md @@ -27,56 +28,64 @@ chapters: #- shared/hastyconclusions.md - shared/composedown.md - k8s/concepts-k8s.md + - k8s/kubectlget.md +- + - k8s/kubectlrun.md + - k8s/logs-cli.md - shared/declarative.md - k8s/declarative.md - - k8s/kubenet.md -- - k8s/kubectlget.md - - k8s/setup-k8s.md - - k8s/kubectlrun.md - k8s/deploymentslideshow.md + - k8s/kubenet.md - k8s/kubectlexpose.md -- - k8s/shippingimages.md + - k8s/shippingimages.md #- k8s/buildshiprun-selfhosted.md - k8s/buildshiprun-dockerhub.md - k8s/ourapponkube.md +- - k8s/kubectlproxy.md - k8s/localkubeconfig.md - k8s/accessinternal.md + - k8s/setup-k8s.md - k8s/dashboard.md #- k8s/kubectlscale.md - k8s/scalingdockercoins.md - shared/hastyconclusions.md -- - k8s/daemonset.md - - k8s/rollout.md - - k8s/record.md - - k8s/namespaces.md - - k8s/kustomize.md - #- k8s/helm.md - #- k8s/create-chart.md + - k8s/daemonset.md +- + - k8s/rollout.md - k8s/healthchecks.md - k8s/healthchecks-more.md - - k8s/logs-cli.md - - k8s/logs-centralized.md - #- k8s/netpol.md + - k8s/record.md +- + - k8s/namespaces.md + - k8s/ingress.md + - k8s/kustomize.md + - k8s/helm.md + - k8s/create-chart.md +- + - k8s/netpol.md - k8s/authn-authz.md - - k8s/csr-api.md - - k8s/openid-connect.md - - k8s/podsecuritypolicy.md -- - k8s/ingress.md - #- k8s/gitworkflows.md - - k8s/prometheus.md -- - k8s/volumes.md + #- k8s/csr-api.md + #- k8s/openid-connect.md + #- k8s/podsecuritypolicy.md +- + - k8s/volumes.md #- k8s/build-with-docker.md #- k8s/build-with-kaniko.md - k8s/configuration.md - #- k8s/owners-and-dependents.md - - k8s/extending-api.md - - k8s/operators.md - - k8s/operators-design.md -- - k8s/statefulsets.md + - k8s/logs-centralized.md + - k8s/prometheus.md +- + - k8s/statefulsets.md - k8s/local-persistent-volumes.md - k8s/portworx.md + #- k8s/extending-api.md + #- k8s/operators.md + #- k8s/operators-design.md #- k8s/staticpods.md -- - k8s/whatsnext.md + #- k8s/owners-and-dependents.md + #- k8s/gitworkflows.md +- + - k8s/whatsnext.md - k8s/links.md - shared/thankyou.md