The document discusses various managed Kubernetes platforms for deploying containers including Amazon EKS, Kops, Kubeadm, and Rancher. It provides an overview of each tool, how to install and set them up, and compares their key features such as installation difficulty, upgrade support, maintenance, and integration with AWS services. Examples of using eksctl and kubectl to deploy an EKS cluster and commands for creating a cluster with Kops are also included.

1. Hoseok Seo
Solutions Architect, AWS
AWS Container Webinar

2. Why Kubernetes?
마이크로 서비스 아키텍처?
DevOps ?
Image 배포로 인한 설치 및 관리 편리성 ?
Auto Scaling & Self Healing ?
무중단 rolling update ?
가상화 기술 발전과 충분한 IT리소스 ?

3. Google Trends

4. Pets vs Cattle
https://www.slideshare.net/randybias/the-history-of-pets-vs-cattle-and-using-it-properly

5. Going back in time
https://kubernetes.io/docs/concepts/overview/what-is-kubernetes/

6. Why Kubernetes?
https://aws.amazon.com/ko/kubernetes/?nc1=h_ls

7. What Kubernetes is not?
https://kubernetes.io/docs/concepts/overview/what-is-kubernetes/
• Does not limit the types of applications supported.
• Does not deploy source code and does not build your application.
• Does not provide application-level services, such as middleware, data-processing frameworks,
databases, caches, nor cluster storage systems as built-in services.
• Does not dictate logging, monitoring, or alerting solutions.
• Does not provide nor mandate a configuration language/system.
• Does not provide nor adopt any comprehensive machine configuration, maintenance, management,
or self-healing systems.
• Additionally, Kubernetes is not a mere orchestration system.

8. CNCF Cloud Native Landscape for Kubernetes (2020.04.08)
https://landscape.cncf.io/images/landscape.png

9. Your company/organization manages containers with
https://www.cncf.io/wp-content/uploads/2020/03/CNCF_Survey_Report.pdf

10. Kubernetes Platform

11. Rancher vs kops vs Kubeadm vs Amazon EKS
Rancher (RKE) Kops Kubeadm Amazon EKS
Certified Kubernetes Y Y Y Y
Kubernetes
version supproted
v1.17.4
v1.16.8
v1.15.11
1.16
1.15
1.14
…
1.18
1.17
1.16
…
1.15
1.14
1.13
Installation method Rancher web UI
cui
terraform
kops-cli
terraform
cui aws-cli
terraform
eksctl
cloudformation
console
Installation difficulty Low Medieum High Low
Upgrade Support Good Normal Good Good
Maintenance Rancher Forum
Subscription plans
Kops Github Kubeadm Github AWS Forum
AWS Support Plan
AWS Integration Good Good Good Perfect

12. What is Rancher?

13. Rancher 2.0
https://rancher.com/announcing-rancher-2-0/

14. Rancher Server Architecture

15. What is Kops?
We like to think of it as kubectl for clusters.
kops helps you create, destroy, upgrade and maintain production-grade, highly available,
Kubernetes clusters from the command line. AWS (Amazon Web Services) is currently
officially supported, with GCE and OpenStack in beta support, and VMware vSphere in
alpha, and other platforms planned.

16. Getting Started with kops on AWS – Intro
1. aws 제어와 kops cluster 생성을 위한 IAM 권한 생성
2. kops-cli 와 kubectl 설치
3. kops 환경 설정을 위한 s3 bucket 생성
4. kops 설치를 위한 환경변수 설정
5. kops cluster 생성 및 validation 확인

17. Getting Started with kops on AWS – setup IAM user
* aws-cli 명령어를 통한 aws 의 자원 제어와 kops-cli 로 cluster 생성을 위해서
하단과 같은 IAM 권한 필요
AmazonEC2FullAccess
AmazonRoute53FullAccess
AmazonS3FullAccess
IAMFullAccess
AmazonVPCFullAccess

18. Getting Started with kops on AWS – install kops cli and kubectl
* kops cluster 생성을 kops-cli 설치와 kubernetes 제어를 위한 kubectl 설치
wget -O kops https://github.com/kubernetes/kops/releases/download/$(curl -s
https://api.github.com/repos/kubernetes/kops/releases/latest | grep tag_name | cut -d '"' -f 4)/kops-
linux-amd64
sudo chmod 755 kops; sudo mv kops /usr/local/bin/kops
wget -O kubectl https://storage.googleapis.com/kubernetes-release/release/$(curl -s
https://storage.googleapis.com/kubernetes-release/release/stable.txt)/bin/linux/amd64/kubectl
sudo chmod 755 kubectl; sudo mv kubectl /usr/local/bin

19. Getting Started with kops on AWS – create s3 bucket
* kops Cluster State storage 설정을 위해 s3 bucket 생성
aws s3 mb s3://kops001-bucket-state-store --region ap-northeast-1
aws s3api put-bucket-versioning --bucket kops001-bucket-state-store --versioning-configuration
Status=Enabled

20. Getting Started with kops on AWS – environment setting
* kops 설치에 필요한 환경변수 설정
export NAME=kops001cluster.k8s.local
export KOPS_STATE_STORE=s3://kops001-bucket-state-store
export MASTER_NODE_SIZE="m5.large"
export MASTER_ZONES="ap-northeast-1a,ap-northeast-1c"
export MASTER_COUNT=3
export NODE_SIZE="m5.large"
export NODE_ZONES="ap-northeast-1a,ap-northeast-1c"
export NODE_COUNT=3
* kops cluster 내에서 사용하는 인증서 생성
mkdir ~/key; cd ~/key;ssh-keygen -t rsa -f $NAME.key -N ''

21. Getting Started with kops on AWS – install kops cluster
* kops 의 create cluster 명령어로 생성
kops create cluster ${NAME}
--ssh-public-key=~/key/$NAME.key.pub
--state $KOPS_STATE_STORE
--master-size $MASTER_SIZE
--master-zones $MASTER_ZONES
--master-count $MASTER_COUNT
--node-size $NODE_SIZE
--zones $ZONES
--node-count $NODE_COUNT
--networking amazon-vpc-routed-eni
--topology private
--yes

22. What is Kubeadm?
Kubeadm is a tool built to provide kubeadm init and kubeadm join as best-practice “fast
paths” for creating Kubernetes clusters.
kubeadm performs the actions necessary to get a minimum viable cluster up and running. By
design, it cares only about bootstrapping, not about provisioning machines. Kubeadm also supports
other cluster lifecycle functions, such as upgrades, downgrade, and managing bootstrap tokens.
Likewise, installing various nice-to-have addons, like the Kubernetes Dashboard, monitoring
solutions, and cloud-specific addons, is not in scope.

23. Getting Started with kops on AWS – Before you begin
One or more machines running one of:
• Ubuntu 16.04+
• Debian 9+
• CentOS 7
• Red Hat Enterprise Linux (RHEL) 7
• Fedora 25+
• HypriotOS v1.0.1+
• Container Linux (tested with 1800.6.0)
2 GB or more of RAM per machine (any less will leave little room for your apps)
2 CPUs or more
Full network connectivity between all machines in the cluster (public or private network is fine)
Unique hostname, MAC address, and product_uuid for every node. See here for more details.
Swap disabled. You MUST disable swap in order for the kubelet to work properly.

24. Getting Started with kops on AWS - Check required ports

25. Getting Started with kops on AWS - Install
Installing runtime
Installing kubeadm, kubelet and kubect
Configure cgroup driver used by kubelet on control-plane node
Master node configuration (kubeadm init)
Worker Node join into cluster (kubeadm join)
https://kubernetes.io/docs/setup/production-environment/tools/kubeadm/install-kubeadm/

26. E L A S T I C CO N TA I N E R S E R V I C E F O R K U B E R N E T E S
(EKS)

27. Principles of AWS Managed Kubernetes
E L A S T I C C O N TA I N E R S E R V I C E F O R K U B E R N E T E S
EKS는 대규모 회사가 운영 수준의
작업 부하를 실행하는 플랫폼이다
EKS is a platform for enterprises to run production-grade workloads
EKS는 순수 쿠버네티스 및
업스트림 경험을 유지한다
EKS provides a native and upstream Kubernetes experience
EKS 고객이 다른 AWS 서비스를 사용할
때, 복잡하지 않고 매끄럽게 연계한다
If EKS customers want to use additional AWS services,
the integrations are seamless and eliminate undifferentiated heavy lifting
EKS 팀은 쿠버네티스 프로젝트에
적극적으로 기여한다
EKS team actively contributes to the Kubernetes project
TenetsAmazon EKS

28. Amazon EKS Architecture
mycluster.eks.amazonaws.com
EKS 워커노드
kubectl
AZ 1 AZ 2 AZ 3
사용자의 AWS 계정
VPC

29. EKS Control Plane
고 가용성을 내재한 단일 테넌트
인프라스트럭처
전체 “순수 AWS” 서비스
NLB을 활용한 부하분산
컨트롤 플레인 로그(new)
• API 서버, Audit, Controller Manager,
Authenticator, Scheduler

30. EKS Data Plane
다양한 인스턴스유형 및 가격정책 적용
• p2, p3 GPU, i3.metal, 스팟 또는 조합
AI/ML용 Amazon EKS
• EKS에 최적화된 GPU 지원 AMI
EKS AMI 빌드 스크립트
워크로드 특성에 적합한 인스턴스 적용
• Snapchat은 최신 세대의 c5 EC2 인
스턴스를 적용하여, c4 대비 최대
25 % 향상된 가격대비 성능 달성

31. K8S Components Configured with EKS
EKS 마스터
엔드포인트
ALB/NLB
클러스터
연결
모니터링/
매트릭스
Amazon EKS 노드
스토리지 & 정책
(Amazon EBS / EFS 스토리지 클래스 )
컴퓨트 & 정책
(오토 스케일링)
네트워크 & 정책 ( Calico )

32. Getting Started with Amazon EKS - install eksctl and kubectl
* EKS cluster 생성을 eksctl 설치와 kubernetes 제어를 위한 kubectl 설치
curl --silent --location "https://github.com/weaveworks/eksctl/releases/latest/download/eksctl_$(uname
-s)_amd64.tar.gz" | tar xz -C /tmp
sudo mv /tmp/eksctl /usr/local/bin
wget -O kubectl https://storage.googleapis.com/kubernetes-release/release/$(curl -s
https://storage.googleapis.com/kubernetes-release/release/stable.txt)/bin/linux/amd64/kubectl
sudo chmod 755 kubectl; sudo mv kubectl /usr/local/bin

33. Getting Started with Amazon EKS - eks cluster yaml file
apiVersion: eksctl.io/v1alpha5
kind: ClusterConfig
metadata:
name: eks-test001
region: ap-northeast-1
version: "1.15"
nodeGroups:
- name: ng1-eks-test001
instanceType: m5.large
minSize: 3
maxSize: 5
desiredCapacity: 3
volumeSize: 100
volumeType: gp2
volumeEncrypted: true
privateNetworking: true
ssh:
publicKeyName: eks1tokyo
iam:
withAddonPolicies:
autoScaler: true
cloudWatch: true
ebs: true
fsx: true
efs: true
albIngress: true
cloudWatch:
clusterLogging:
enableTypes: ["api", "audit", "authenticator",
"controllerManager", "scheduler"]

34. Getting Started with Amazon EKS - create eks cluster using eksctl
* eksctl 의 create cluster 명령어로 생성
eksctl create cluster --auto-kubeconfig -f eks_cluster_test001.yaml

35. Getting Started with kops on AWS – Installation Captured Video

36. Getting Started with Amazon EKS - Installation Captured Video

37. Amazon EKS Architecture diagram
https://aws.amazon.com/blogs/opensource/eks-support-mu/

38. Amazon EKS Architecture diagram
https://aws.amazon.com/quickstart/architecture/amazon-eks/

39. AWS Service related to Amazon EKS
• VPC
• Network
• IAM
• Security Group
• EC2
• LoadBalancer
• Storage

40. AWS Service related to Amazon EKS
• VPC
• Network
• IAM
• Security Group
• EC2
• LoadBalancer
• Storage

41. AWS Service related to Amazon EKS
• VPC
• Network
• IAM
• Security Group
• EC2
• LoadBalancer
• Storage

42. AWS Service related to Amazon EKS
• VPC
• Network
• IAM
• Security Group
• EC2
• LoadBalancer
• Storage

43. AWS Service related to Amazon EKS
• VPC
• Network
• IAM
• Security Group
• EC2
• LoadBalancer
• Storage

44. AWS Service related to Amazon EKS
• VPC
• Network
• IAM
• Security Group
• EC2
• LoadBalancer
• Storage

45. AWS Service related to Amazon EKS
• VPC
• Network
• IAM
• Security Group
• EC2
• LoadBalancer
• Storage
https://www.oodlestechnologies.com/blogs/AWS-EC2-Expanding-linux-root-partition/

46. AWS Service related to Amazon EKS
• VPC
• Network
• IAM
• Security Group
• EC2
• LoadBalancer
• Storage
• Classic Load Balancer
• Application Load Balancer
• Network Load Balancer

47. AWS Service related to Amazon EKS
• VPC
• Network
• IAM
• Security Group
• EC2
• LoadBalancer
• Storage
https://medium.com/@youngstone89/aws-storage-services-overview-aws-solutions-architect-1ab8c289d516

48. CNCF Cloud Native Landscape for Container Registry (2020.04.08)
https://landscape.cncf.io/images/landscape.png

49. Container Registry

50. DocerHub vs QUAY vs HARBOR vs Amazon ECR
DocerHub QUAY HARBOR Amazon ECR
Company Docker Inc RED HAT CNCF Incubating project AWS
Docker image support O O O O
Container registry
webhooks
O O X O
Container registry high
availability
O O X O
Supports private
container registries
O O O O
Use container registry
through REST API
O O O O
Docker tag expiration
and retention policies
X O △ O
Encryption △ O △ O
Security Scan O (Clair) O (Clair) O (Clair) O (Clair)
AWS Integration Normal Normal Normal Perfect
Price Start at $7 / month $15 per private repositories
month
Instance price + @ Storage: $0.10 per GB-
month

51. What is Amazon ECR?

52. What is Amazon EC2 Container Registry (ECR)?
Fully Managed Secure Highly Available Simplified Workflow

53. Amazon ECR - ECR Components
• Registry & Repository
• Registry Policy
• Image
• Authorization Token

54. Amazon ECR - features
Amazon Elastic Container
Service integration
Docker support
AWS Marketplace
High availability and durability
Team collaboration
Access control
Encryption
Third-party integrations
Amazon ECS/EKS 에서 실행되는 애플리케이션의 컨테이너 이미지를
손쉽게 저장, 실행 및 관리할 수 있음
Amazon ECR 리포지토리를 지정하기만 하면 Amazon ECS/EKS 에서
애플리케이션에 적합한 이미지를 가져옴

55. Amazon ECR - features
Amazon Elastic Container
Service integration
Docker support
AWS Marketplace
High availability and durability
Team collaboration
Access control
Encryption
Third-party integrations
Docker Registry HTTP API V2를 지원하므로 Docker CLI 명령(예: push, pull,
list, tag) 또는 다양한 Docker 도구를 사용할 수 있음
클라우드, 온프레미스, 로컬 시스템 등 어느 Docker 환경에서나 Amazon
ECR에 손쉽게 액세스 가능

56. Amazon ECR - features
Amazon Elastic Container
Service integration
Docker support
AWS Marketplace
High availability and durability
Team collaboration
Access control
Encryption
Third-party integrations
사용자가 생성하는 컨테이너와 AWS Marketplace를 통해 구매하는 컨테이너
소프트웨어를 모두 저장할 수 있음

57. Amazon ECR - features
Amazon Elastic Container
Service integration
Docker support
AWS Marketplace
High availability and durability
Team collaboration
Access control
Encryption
Third-party integrations
컨테이너 이미지를 Amazon S3에 저장하고 있음
데이터를 여러 시설과 각 시설의 여러 장비에 중복 저장하고 있음

58. Amazon ECR - features
Amazon Elastic Container
Service integration
Docker support
AWS Marketplace
High availability and durability
Team collaboration
Access control
Encryption
Third-party integrations
네임스페이스를 사용하여 레지스트리의 리포지토리를 정의 및 구성하여,
팀의 기존 워크플로에 따라 리포지토리를 구성할 수 있음
리소스 수준의 정책을 통해 다른 사용자가 자신의 리포지토리에 수행할 수
있는 API 작업(예: create, list, describe, delete 및 get)을 설정할 수 있으므로
리포지토리를 다른 사용자 및 AWS 계정과 손쉽게 공유 가능

59. Amazon ECR - features
Amazon Elastic Container
Service integration
Docker support
AWS Marketplace
High availability and durability
Team collaboration
Access control
Encryption
Third-party integrations
AWS IAM(Identity and Access Management) 를 사용하여 컨테이너
이미지에 액세스할 수 있는 사용자 및 항목(예: EC2 인스턴스)에 대한 권한을
제어하고 모니터링 할 수 있음
IAM을 통해 같은 AWS 계정 또는 다른 계정의 사용자가 컨테이너 이미지에
액세스할 수 있도록 허용하는 정책을 정의 가능
사용자와 역할별로 서로 다른 권한(예: 푸시, 풀 또는 전체 관리자 액세스)을
지정하여 이러한 정책을 세분화할 수 있음

60. Amazon ECR - features
Amazon Elastic Container
Service integration
Docker support
AWS Marketplace
High availability and durability
Team collaboration
Access control
Encryption
Third-party integrations
HTTPS를 통해 컨테이너 이미지를 송수신할 수 있음
저장 이미지는 Amazon S3 서버 측 암호화를 사용해 자동으로 암호화 됨

61. Amazon ECR - features
Amazon Elastic Container
Service integration
Docker support
AWS Marketplace
High availability and durability
Team collaboration
Access control
Encryption
Third-party integrations
Amazon ECR은 타사 개발자 도구와 통합이 쉬움
지속적 통합 및 전달 프로세스에 Amazon ECR을 통합하여 기존 개발
워크플로를 유지 관리할 수 있음

62. Amazon ECR - create repository

63. Amazon ECR - images

64. Amazon ECR - Vulnerabilities

65. Q & A