Ce diaporama a bien été signalé.
Nous utilisons votre profil LinkedIn et vos données d’activité pour vous proposer des publicités personnalisées et pertinentes. Vous pouvez changer vos préférences de publicités à tout moment.
© Copyright 2018 Pivotal Software, Inc. All rights Reserved. Version 1.0
6 Things You Need to Know to
Safely Run Kubernete...
Cover w/ Image
Me?
Developer (wasn’t Ops)
Web architectures for >10 years
Cloud-native for 6+ years
Cloud Foundry for 6+ y...
❤
💕
💕
💕
❤
❤
💕
🌈
🦋
Let’s have a
look at some
things you
need to get
right…
#1 - Soft Multi-tenancy
K8s Cluster Kubernetes Master
Kubernetes Master
API Server Controller Manager
DNS Scheduler …
…
Kubernetes Master
API Server Controller Manager
DNS Scheduler …
Kubelet Kube Proxy Kubelet Kube Proxy
Kubernetes Master
API Server Controller Manager
DNS Scheduler …
Namespace 1:
Kubelet Kube Proxy Kubelet Kube Proxy
Namespa...
Kubernetes Master
API Server Controller Manager
DNS Scheduler …
Namespace 1:
Kubelet Kube Proxy Kubelet Kube Proxy
Namespa...
https://blog.jessfraz.com/post/hard-multi-tenancy-in-kubernetes/
Kubernetes Master
API Server Controller Manager
DNS Scheduler …
Namespace 1:
Kubelet Kube Proxy Kubelet Kube Proxy
Namespa...
Kubernetes Master
API Server
Controller Manager DNS
Scheduler
Kubelet Kube Proxy Kubelet Kube Proxy
Tenant 1:
Kubernetes M...
Multi-cluster
https://content.pivotal.io/blog/kubernetes-one-cluster-or-many
#2 - Cloud-native Cluster Management
Kubernetes Takes Care of Your Workloads
Image Cache
etcd
K8s Master
Worker Worker Worker
Kubernetes
Scheduler
Desired
Stat...
But who is taking care of your
Kubernetes?
VMs are Monitored
IaaSBOSH
Worker
AGENT
Master
AGENT
etcd
AGENT
Message Bus
Health Monitor
Responses:
pager
email
monitori...
VMs are Monitored
IaaSBOSH
Worker
AGENT
Master
AGENT
etcd
AGENT
Message Bus
Health Monitor
Responses:
pager
email
monitori...
VMs are Monitored
IaaSBOSH
Worker
AGENT
Master
AGENT
etcd
AGENT
Message Bus
Health Monitor
Responses:
pager
email
monitori...
PKS does for your Kubernetes
what
Kubernetes does for your apps
#3 - Who are Your Personas?
Teams Delivering Outcomes
Platform Team
Application Team
Iteratively building and
delivering digital offerings
to the cons...
Warning!!!
kubectl delete deploy kubectl delete node
This is workload related. This is cluster related!
#4 - Stateful Services?
https://twitter.com/kelseyhightower/status/963413508300812295
But a even more has happened since then!
Kubernetes Master
Stateless workloads:
● Can be moved around
● Aided by service discovery
● Don’t have a particular
start ...
Kubernetes Master
Kubernetes Master
Stateful workloads:
● Start order dependencies
● Storage
%
&
%
&
Kubernetes Master
Stateful workloads:
● Start order dependencies
● Storage
Kubernetes abstractions:
● Stateful sets
● Pers...
Kubernetes Master
Stateful workloads:
● Start order dependencies
● Storage
Kubernetes abstractions:
● Stateful sets
● Pers...
Warning!!!
Availability
Zone 1
Availability
Zone2
? ?
Storage classes have
different behaviors
Data replication needs to
b...
#5 - K8s is K8s is K8s - right?
(Spoiler alert: Nope)
https://twitter.com/kelseyhightower/status/935252923721793536
You are probably doing multi-cloud
kubectl
PKS AKS GKE EKS
Kubernetes Master
API Server Controller Manager
DNS Scheduler …
…
There are 150 flags
you can set on
startup
There are man...
You are probably doing multi-cloud
kubectl
PKS AKS GKE EKS
Different cluster configurations -> Different workload behaviors
You are probably doing multi-cloud
kubectl
PKS PKS PKS PKS
Same cluster configurations across all clouds
#6 - New Operational Practices
You are probably doing multi-cloud
kubectl
PKS AKS GKE EKS
pks az gcloud aws
4 times the:
- Skills
- Scripts
- Runbooks
- …
Where should the abstractions lie?
kubectl
PKS PKS PKS PKS
pks pks pks pks
https://content.pivotal.io/blog/happy-monday-how-to-fix-a-kubernetes-cve-before-your-boss-and-the-rest-of-the-world-reads-a...
Embedded OS
(Windows & Linux)
NSX-T
CPI (15 methods)
v1
v2
v3
...
CVEs
Product Updates
vSphere
Azure & 

Azure StackGoogle...
Slaying
Dragons
Slaying Dragons
1. Think about your tenancy needs
2.You need something to take care of your Kubernetes clusters
3.Great ca...
Transforming How The World Builds Software
© Copyright 2017 Pivotal Software, Inc. All rights Reserved.
Cover w/ Image
Me?
Developer (wasn’t Ops)
Web architectures for >10 years
Cloud-native for 6+ years
Cloud Foundry for 6+ y...
6 Things You Need to Know to Safely Run Kubernetes
6 Things You Need to Know to Safely Run Kubernetes
6 Things You Need to Know to Safely Run Kubernetes
6 Things You Need to Know to Safely Run Kubernetes
Prochain SlideShare
Chargement dans…5
×

6 Things You Need to Know to Safely Run Kubernetes

308 vues

Publié le

Kubernetes has exploded in popularity among developers. But as operations teams prepare to support Kubernetes in production, they have more considerations—namely, how to operate a stable platform while maintaining security and compliance. How Kubernetes is configured and deployed has a marked impact on these attributes.

Attend this session with Pivotal’s Vice President of Technology, Cornelia Davis, to learn the following:

● How to isolate tenants in your Kubernetes environment.
● How to make upgrading Kubernetes clusters boring.
● What you should—and shouldn’t—let your developers do.
● What you need around your Kubernetes clusters to keep them safe.

Presenter :
Cornelia Davis, Author and Vice President of Technology, Pivotal

Publié dans : Technologie
  • Soyez le premier à commenter

6 Things You Need to Know to Safely Run Kubernetes

  1. 1. © Copyright 2018 Pivotal Software, Inc. All rights Reserved. Version 1.0 6 Things You Need to Know to Safely Run Kubernetes Cornelia Davis Vice President, Technology, Pivotal April 2019
  2. 2. Cover w/ Image Me? Developer (wasn’t Ops) Web architectures for >10 years Cloud-native for 6+ years Cloud Foundry for 6+ years Discount code 40% off!: 40cloudnat https://www.manning.com/books/cloud-native-patterns @cdavisafc
  3. 3. ❤ 💕 💕 💕 ❤ ❤ 💕 🌈 🦋
  4. 4. Let’s have a look at some things you need to get right…
  5. 5. #1 - Soft Multi-tenancy
  6. 6. K8s Cluster Kubernetes Master
  7. 7. Kubernetes Master API Server Controller Manager DNS Scheduler … …
  8. 8. Kubernetes Master API Server Controller Manager DNS Scheduler … Kubelet Kube Proxy Kubelet Kube Proxy
  9. 9. Kubernetes Master API Server Controller Manager DNS Scheduler … Namespace 1: Kubelet Kube Proxy Kubelet Kube Proxy Namespace 2: These are all shared components That are not namespace aware!!!
  10. 10. Kubernetes Master API Server Controller Manager DNS Scheduler … Namespace 1: Kubelet Kube Proxy Kubelet Kube Proxy Namespace 2: Limitations: ● Noisy neighbors (workloads can affect other tenants) ● Tenants share the same network ● Tenants share DNS ● Tenants share Configuration ● …
  11. 11. https://blog.jessfraz.com/post/hard-multi-tenancy-in-kubernetes/
  12. 12. Kubernetes Master API Server Controller Manager DNS Scheduler … Namespace 1: Kubelet Kube Proxy Kubelet Kube Proxy Namespace 2: The suggestion: Give each tenant their own set of K8s controller components.
  13. 13. Kubernetes Master API Server Controller Manager DNS Scheduler Kubelet Kube Proxy Kubelet Kube Proxy Tenant 1: Kubernetes Master API Server Controller Manager DNS Scheduler Kubelet Kube Proxy Kubelet Kube Proxy Tenant 2: Leverage 20 years of maturity in hypervisor- based security!
  14. 14. Multi-cluster https://content.pivotal.io/blog/kubernetes-one-cluster-or-many
  15. 15. #2 - Cloud-native Cluster Management
  16. 16. Kubernetes Takes Care of Your Workloads Image Cache etcd K8s Master Worker Worker Worker Kubernetes Scheduler Desired State Actual State Replica Set Controller LoadBalancer
  17. 17. But who is taking care of your Kubernetes?
  18. 18. VMs are Monitored IaaSBOSH Worker AGENT Master AGENT etcd AGENT Message Bus Health Monitor Responses: pager email monitoring ressurector … BOSH Director Desired State Actual State Message Bus
  19. 19. VMs are Monitored IaaSBOSH Worker AGENT Master AGENT etcd AGENT Message Bus Health Monitor Responses: pager email monitoring ressurector … BOSH Director Desired State Actual State Worker AGENT etcd AGENT BOSH Director Message Bus
  20. 20. VMs are Monitored IaaSBOSH Worker AGENT Master AGENT etcd AGENT Message Bus Health Monitor Responses: pager email monitoring ressurector … BOSH Director Desired State Actual State CPI BOSH Director Message Bus Worker AGENT etcd AGENT
  21. 21. PKS does for your Kubernetes what Kubernetes does for your apps
  22. 22. #3 - Who are Your Personas?
  23. 23. Teams Delivering Outcomes Platform Team Application Team Iteratively building and delivering digital offerings to the consumer Enabling the app teams all while maintaining Security Compliance Resilience Cost Efficiency Your Application Code Virtualized Infrastructure
  24. 24. Warning!!! kubectl delete deploy kubectl delete node This is workload related. This is cluster related!
  25. 25. #4 - Stateful Services?
  26. 26. https://twitter.com/kelseyhightower/status/963413508300812295 But a even more has happened since then!
  27. 27. Kubernetes Master Stateless workloads: ● Can be moved around ● Aided by service discovery ● Don’t have a particular start order ● Bind to backing services for state
  28. 28. Kubernetes Master
  29. 29. Kubernetes Master Stateful workloads: ● Start order dependencies ● Storage % & % &
  30. 30. Kubernetes Master Stateful workloads: ● Start order dependencies ● Storage Kubernetes abstractions: ● Stateful sets ● Persistent volumes/persistent volume claims % & % &
  31. 31. Kubernetes Master Stateful workloads: ● Start order dependencies ● Storage Kubernetes abstractions: ● Stateful sets ● Persistent volumes/persistent volume claims % & % &
  32. 32. Warning!!! Availability Zone 1 Availability Zone2 ? ? Storage classes have different behaviors Data replication needs to be handled out of band
  33. 33. #5 - K8s is K8s is K8s - right? (Spoiler alert: Nope)
  34. 34. https://twitter.com/kelseyhightower/status/935252923721793536
  35. 35. You are probably doing multi-cloud kubectl PKS AKS GKE EKS
  36. 36. Kubernetes Master API Server Controller Manager DNS Scheduler … … There are 150 flags you can set on startup There are many different controllers that affect workload behaviors Your chosen machine types can affect your workloads (i.e. standard CPU vs. GPU) Cluster addons affect your workloads
  37. 37. You are probably doing multi-cloud kubectl PKS AKS GKE EKS Different cluster configurations -> Different workload behaviors
  38. 38. You are probably doing multi-cloud kubectl PKS PKS PKS PKS Same cluster configurations across all clouds
  39. 39. #6 - New Operational Practices
  40. 40. You are probably doing multi-cloud kubectl PKS AKS GKE EKS pks az gcloud aws 4 times the: - Skills - Scripts - Runbooks - …
  41. 41. Where should the abstractions lie? kubectl PKS PKS PKS PKS pks pks pks pks
  42. 42. https://content.pivotal.io/blog/happy-monday-how-to-fix-a-kubernetes-cve-before-your-boss-and-the-rest-of-the-world-reads-about-it
  43. 43. Embedded OS (Windows & Linux) NSX-T CPI (15 methods) v1 v2 v3 ... CVEs Product Updates vSphere Azure & 
 Azure StackGoogle CloudAWSOpenstack Pivotal
 Network “3Rs” Concourse Repair — CVEs Repave Rotate — Credhub Pivotal Application Service (PAS) Pivotal Container Service (PKS) Pivotal Services
 Marketplace Pivotal Function Service (PFS) Do you trust your software delivery supply chain? https://www.youtube.com/watch?v=1qcTu2QUtrU
  44. 44. Slaying Dragons
  45. 45. Slaying Dragons 1. Think about your tenancy needs 2.You need something to take care of your Kubernetes clusters 3.Great care needed in establishing roles and permissions 4.Stateful workloads work - need to be deliberate about persistence 5.There is no such thing as “Vanilla Kubernetes” 6.Establish new operational practices
  46. 46. Transforming How The World Builds Software © Copyright 2017 Pivotal Software, Inc. All rights Reserved.
  47. 47. Cover w/ Image Me? Developer (wasn’t Ops) Web architectures for >10 years Cloud-native for 6+ years Cloud Foundry for 6+ years Discount code 40% off!: 40cloudnat https://www.manning.com/books/cloud-native-patterns @cdavisafc

×