From e9e2fa0e50cafa3db793ca44390794ee777b5d74 Mon Sep 17 00:00:00 2001 From: Jerome Petazzoni Date: Mon, 18 Nov 2019 09:04:18 -0600 Subject: [PATCH 1/5] Fix YAML formatting --- slides/intro-fullday.yml | 27 ++++++++++++++++++--------- 1 file changed, 18 insertions(+), 9 deletions(-) diff --git a/slides/intro-fullday.yml b/slides/intro-fullday.yml index a0e31be0..e5d32e8a 100644 --- a/slides/intro-fullday.yml +++ b/slides/intro-fullday.yml @@ -20,45 +20,54 @@ chapters: - containers/intro.md - shared/about-slides.md - shared/toc.md -- - containers/Docker_Overview.md +- + - containers/Docker_Overview.md #- containers/Docker_History.md - containers/Training_Environment.md - containers/Installing_Docker.md - containers/First_Containers.md - containers/Background_Containers.md - containers/Start_And_Attach.md -- - containers/Initial_Images.md +- + - containers/Initial_Images.md - containers/Building_Images_Interactively.md - containers/Building_Images_With_Dockerfiles.md - containers/Cmd_And_Entrypoint.md -- - containers/Copying_Files_During_Build.md +- + - containers/Copying_Files_During_Build.md - containers/Exercise_Dockerfile_Basic.md - containers/Multi_Stage_Builds.md - containers/Publishing_To_Docker_Hub.md - containers/Dockerfile_Tips.md - containers/Exercise_Dockerfile_Advanced.md -- - containers/Naming_And_Inspecting.md +- + - containers/Naming_And_Inspecting.md - containers/Labels.md - containers/Getting_Inside.md - containers/Resource_Limits.md -- - containers/Container_Networking_Basics.md +- + - containers/Container_Networking_Basics.md - containers/Network_Drivers.md - containers/Container_Network_Model.md #- containers/Connecting_Containers_With_Links.md - containers/Ambassadors.md -- - containers/Local_Development_Workflow.md +- + - containers/Local_Development_Workflow.md - containers/Windows_Containers.md - containers/Working_With_Volumes.md - containers/Compose_For_Dev_Stacks.md - containers/Exercise_Composefile.md -- - containers/Docker_Machine.md +- + - containers/Docker_Machine.md - containers/Advanced_Dockerfiles.md - containers/Application_Configuration.md - containers/Logging.md -- - containers/Namespaces_Cgroups.md +- + - containers/Namespaces_Cgroups.md - containers/Copy_On_Write.md #- containers/Containers_From_Scratch.md -- - containers/Container_Engines.md +- + - containers/Container_Engines.md #- containers/Ecosystem.md - containers/Orchestration_Overview.md - shared/thankyou.md From f73fb9283248f5e9fe9a66a8869be80e56884a69 Mon Sep 17 00:00:00 2001 From: Jerome Petazzoni Date: Mon, 18 Nov 2019 12:57:26 -0600 Subject: [PATCH 2/5] Put pods before services The flow is better this way, since we can introduce pods just after seeing them in kubectl describe node. Also, add some extra info when we curl the Kubernetes API. --- slides/k8s/kubectlget.md | 149 ++++++++++++++++++++++++++------------- 1 file changed, 101 insertions(+), 48 deletions(-) diff --git a/slides/k8s/kubectlget.md b/slides/k8s/kubectlget.md index 44566b26..2107a0c0 100644 --- a/slides/k8s/kubectlget.md +++ b/slides/k8s/kubectlget.md @@ -71,7 +71,7 @@ - Show the capacity of all our nodes as a stream of JSON objects: ```bash - kubectl get nodes -o json | + kubectl get nodes -o json | jq ".items[] | {name:.metadata.name} + .status.capacity" ``` @@ -182,53 +182,6 @@ class: extra-details --- -## Services - -- A *service* is a stable endpoint to connect to "something" - - (In the initial proposal, they were called "portals") - -.exercise[ - -- List the services on our cluster with one of these commands: - ```bash - kubectl get services - kubectl get svc - ``` - -] - --- - -There is already one service on our cluster: the Kubernetes API itself. - ---- - -## ClusterIP services - -- A `ClusterIP` service is internal, available from the cluster only - -- This is useful for introspection from within containers - -.exercise[ - -- Try to connect to the API: - ```bash - curl -k https://`10.96.0.1` - ``` - - - `-k` is used to skip certificate verification - - - Make sure to replace 10.96.0.1 with the CLUSTER-IP shown by `kubectl get svc` - -] - --- - -The error that we see is expected: the Kubernetes API requires authentication. - ---- - ## Listing running containers - Containers are manipulated through *pods* @@ -467,3 +420,103 @@ class: extra-details [KEP-0009]: https://github.com/kubernetes/enhancements/blob/master/keps/sig-node/0009-node-heartbeat.md [node controller documentation]: https://kubernetes.io/docs/concepts/architecture/nodes/#node-controller + +--- + +## Services + +- A *service* is a stable endpoint to connect to "something" + + (In the initial proposal, they were called "portals") + +.exercise[ + +- List the services on our cluster with one of these commands: + ```bash + kubectl get services + kubectl get svc + ``` + +] + +-- + +There is already one service on our cluster: the Kubernetes API itself. + +--- + +## ClusterIP services + +- A `ClusterIP` service is internal, available from the cluster only + +- This is useful for introspection from within containers + +.exercise[ + +- Try to connect to the API: + ```bash + curl -k https://`10.96.0.1` + ``` + + - `-k` is used to skip certificate verification + + - Make sure to replace 10.96.0.1 with the CLUSTER-IP shown by `kubectl get svc` + +] + +The command above should either time out, or show an authentication error. Why? + +--- + +## Time out + +- Connections to ClusterIP services only work *from within the cluster* + +- If we are outside the cluster, the `curl` command will probably time out + + (Because the IP address, e.g. 10.96.0.1, isn't routed properly outside the cluster) + +- This is the case with most "real" Kubernetes clusters + +- To try the connection from within the cluster, we can use [shpod](https://github.com/jpetazzo/shpod) + +--- + +## Authentication error + +This is what we should see when connecting from within the cluster: +```json +$ curl -k https://10.96.0.1 +{ + "kind": "Status", + "apiVersion": "v1", + "metadata": { + + }, + "status": "Failure", + "message": "forbidden: User \"system:anonymous\" cannot get path \"/\"", + "reason": "Forbidden", + "details": { + + }, + "code": 403 +} +``` + +--- + +## Explanations + +- We can see `kind`, `apiVersion`, `metadata` + +- These are typical of a Kubernetes API reply + +- Because we *are* talking to the Kubernetes API + +- The Kubernetes API tells us "Forbidden" + + (because it requires authentication) + +- The Kubernetes API is reachable from within the cluster + + (many apps integrating with Kubernetes will use this) From 291d2a6c92f59dd42814ab8d5de311be05e084e9 Mon Sep 17 00:00:00 2001 From: Jerome Petazzoni Date: Mon, 18 Nov 2019 13:30:09 -0600 Subject: [PATCH 3/5] Add note about DNS integration --- slides/k8s/kubectlget.md | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/slides/k8s/kubectlget.md b/slides/k8s/kubectlget.md index 2107a0c0..b4085bbe 100644 --- a/slides/k8s/kubectlget.md +++ b/slides/k8s/kubectlget.md @@ -520,3 +520,17 @@ $ curl -k https://10.96.0.1 - The Kubernetes API is reachable from within the cluster (many apps integrating with Kubernetes will use this) + +--- + +## DNS integration + +- Each service also gets a DNS record + +- The Kubernetes DNS resolver is available *from within pods* + + (and sometimes, from within nodes, depending on configuration) + +- Code running in pods can connect to services using their name + + (e.g. https://kubernetes/...) From 2c46106792d68dcb9eb1d4978778410dd572f098 Mon Sep 17 00:00:00 2001 From: Jerome Petazzoni Date: Mon, 18 Nov 2019 13:53:54 -0600 Subject: [PATCH 4/5] Add explanations to navigate slides --- slides/shared/prereqs.md | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/slides/shared/prereqs.md b/slides/shared/prereqs.md index 9daca01a..0c66c22c 100644 --- a/slides/shared/prereqs.md +++ b/slides/shared/prereqs.md @@ -58,6 +58,22 @@ Misattributed to Benjamin Franklin --- +## Navigating slides + +- Use arrows to move to next/previous slide + + (up, down, left, right, page up, page down) + +- Type a slide number + ENTER to go to that slide + +- The slide number is also visible in the URL bar + + (e.g. .../#123 for slide 123) + +- Slides will remain online so you can review them later if needed + +--- + class: in-person ## Where are we going to run our containers? From 03d2d0bc5d6ba4ae79a089690de4cb8a34f052ea Mon Sep 17 00:00:00 2001 From: Jerome Petazzoni Date: Mon, 18 Nov 2019 16:37:07 -0600 Subject: [PATCH 5/5] kubectl is the new SSH --- slides/k8s/kubectlget.md | 44 ++++++++++++++++++++++++++++++++++++++++ 1 file changed, 44 insertions(+) diff --git a/slides/k8s/kubectlget.md b/slides/k8s/kubectlget.md index b4085bbe..7cfbb119 100644 --- a/slides/k8s/kubectlget.md +++ b/slides/k8s/kubectlget.md @@ -20,6 +20,50 @@ --- +class: extra-details + +## `kubectl` is the new SSH + +- We often start managing servers with SSH + + (installing packages, troubleshooting ...) + +- At scale, it becomes tedious, repetitive, error-prone + +- Instead, we use config management, central logging, etc. + +- In many cases, we still need SSH: + + - as the underlying access method (e.g. Ansible) + + - to debug tricky scenarios + + - to inspect and poke at things + +--- + +class: extra-details + +## The parallel with `kubectl` + +- We often start managing Kubernetes clusters with `kubectl` + + (deploying applications, troubleshooting ...) + +- At scale (with many applications or clusters), it becomes tedious, repetitive, error-prone + +- Instead, we use automated pipelines, observability tooling, etc. + +- In many cases, we still need `kubectl`: + + - to debug tricky scenarios + + - to inspect and poke at things + +- The Kubernetes API is always the underlying access method + +--- + ## `kubectl get` - Let's look at our `Node` resources with `kubectl get`!