Kubernetes Best Practices. 2nd Edition

Spis treści ebooka

• Preface
  • Who Should Read This Book
  • Why We Wrote This Book
  • Navigating This Book
  • New to This Edition
  • Conventions Used in This Book
  • Using Code Examples
  • OReilly Online Learning
  • How to Contact Us
  • Acknowledgments
• 1. Setting Up a Basic Service
  • Application Overview
  • Managing Configuration Files
  • Creating a Replicated Service Using Deployments
    • Best Practices for Image Management
    • Creating a Replicated Application
  • Setting Up an External Ingress for HTTP Traffic
  • Configuring an Application with ConfigMaps
  • Managing Authentication with Secrets
  • Deploying a Simple Stateful Database
  • Creating a TCP Load Balancer by Using Services
  • Using Ingress to Route Traffic to a Static File Server
  • Parameterizing Your Application by Using Helm
  • Deploying Services Best Practices
  • Summary
• 2. Developer Workflows
  • Goals
  • Building a Development Cluster
  • Setting Up a Shared Cluster for Multiple Developers
    • Onboarding Users
    • Creating and Securing a Namespace
    • Managing Namespaces
    • Cluster-Level Services
  • Enabling Developer Workflows
    • Initial Setup
    • Enabling Active Development
    • Enabling Testing and Debugging
  • Setting Up a Development Environment Best Practices
  • Summary
• 3. Monitoring and Logging in Kubernetes
  • Metrics Versus Logs
  • Monitoring Techniques
  • Monitoring Patterns
  • Kubernetes Metrics Overview
    • cAdvisor
    • Metrics Server
    • kube-state-metrics
  • What Metrics Do I Monitor?
  • Monitoring Tools
  • Monitoring Kubernetes Using Prometheus
  • Logging Overview
  • Tools for Logging
  • Logging by Using a Loki-Stack
  • Alerting
  • Best Practices for Monitoring, Logging, and Alerting
    • Monitoring
    • Logging
    • Alerting
  • Summary
• 4. Configuration, Secrets, and RBAC
  • Configuration Through ConfigMaps and Secrets
    • ConfigMaps
    • Secrets
  • Common Best Practices for the ConfigMap and Secrets APIs
  • Best Practices Specific to Secrets
  • RBAC
    • RBAC Primer
      • Subjects
      • Rules
      • Roles
      • RoleBindings
    • RBAC Best Practices
  • Summary
• 5. Continuous Integration, Testing, and Deployment
  • Version Control
  • Continuous Integration
  • Testing
  • Container Builds
  • Container Image Tagging
  • Continuous Deployment
  • Deployment Strategies
  • Testing in Production
  • Setting Up a Pipeline and Performing a Chaos Experiment
    • Setting Up CI
    • Setting Up CD
    • Performing a Rolling Upgrade
    • A Simple Chaos Experiment
  • Best Practices for CI/CD
  • Summary
• 6. Versioning, Releases, and Rollouts
  • Versioning
  • Releases
  • Rollouts
  • Putting It All Together
  • Best Practices for Versioning, Releases, and Rollouts
  • Summary
• 7. Worldwide Application Distribution and Staging
  • Distributing Your Image
  • Parameterizing Your Deployment
  • Load-Balancing Traffic Around the World
  • Reliably Rolling Out Software Around the World
    • Pre-Rollout Validation
    • Canary Region
    • Identifying Region Types
    • Constructing a Global Rollout
  • When Something Goes Wrong
  • Worldwide Rollout Best Practices
  • Summary
• 8. Resource Management
  • Kubernetes Scheduler
    • Predicates
    • Priorities
  • Advanced Scheduling Techniques
    • Pod Affinity and Anti-Affinity
    • nodeSelector
    • Taints and Tolerations
  • Pod Resource Management
    • Resource Request
    • Resource Limits and Pod Quality of Service
    • PodDisruptionBudgets
      • Minimum available
      • Maximum unavailable
    • Managing Resources by Using Namespaces
    • ResourceQuota
    • LimitRange
    • Cluster Scaling
      • Manual scaling
      • Cluster autoscaling
    • Application Scaling
    • Scaling with HPA
    • HPA with Custom Metrics
    • Vertical Pod Autoscaler
  • Resource Management Best Practices
  • Summary
• 9. Networking, Network Security, and Service Mesh
  • Kubernetes Network Principles
  • Network Plug-ins
    • Kubenet
    • Kubenet Best Practices
    • The CNI Plug-in
    • CNI Best Practices
  • Services in Kubernetes
    • Service Type ClusterIP
    • Service Type NodePort
    • Service Type ExternalName
    • Service Type LoadBalancer
    • Ingress and Ingress Controllers
    • Gateway API
    • Services and Ingress Controllers Best Practices
  • Network Security Policy
  • Network Policy Best Practices
  • Service Meshes
  • Service Mesh Best Practices
  • Summary
• 10. Pod and Container Security
  • Pod Security Admission Controller
    • Enabling Pod Security Admission
    • Pod Security levels
    • Activating Pod Security Using Namespace Labels
  • Workload Isolation and RuntimeClass
    • Using RuntimeClass
    • Runtime Implementations
    • Workload Isolation and RuntimeClass Best Practices
  • Other Pod and Container Security Considerations
    • Admission Controllers
    • Intrusion and Anomaly Detection Tooling
  • Summary
• 11. Policy and Governance for Your Cluster
  • Why Policy and Governance Are Important
  • How Is This Policy Different?
  • Cloud Native Policy Engine
  • Introducing Gatekeeper
    • Example Policies
    • Gatekeeper Terminology
      • Constraint
      • Rego
      • Constraint template
    • Defining Constraint Templates
    • Defining Constraints
    • Data Replication
    • UX
  • Using Enforcement Action and Audit
    • Mutation
    • Testing Policies
    • Becoming Familiar with Gatekeeper
  • Policy and Governance Best Practices
  • Summary
• 12. Managing Multiple Clusters
  • Why Multiple Clusters?
  • Multicluster Design Concerns
  • Managing Multiple Cluster Deployments
  • Deployment and Management Patterns
  • The GitOps Approach to Managing Clusters
  • Multicluster Management Tools
  • Kubernetes Federation
  • Managing Multiple Clusters Best Practices
  • Summary
• 13. Integrating External Services with Kubernetes
  • Importing Services into Kubernetes
    • Selector-Less Services for Stable IP Addresses
    • CNAME-Based Services for Stable DNS Names
    • Active Controller-Based Approaches
  • Exporting Services from Kubernetes
    • Exporting Services by Using Internal Load Balancers
    • Exporting Services on NodePorts
    • Integrating External Machines and Kubernetes
  • Sharing Services Between Kubernetes
  • Third-Party Tools
  • Connecting Cluster and External Services Best Practices
  • Summary
• 14. Running Machine Learning in Kubernetes
  • Why Is Kubernetes Great for Machine Learning?
  • Machine Learning Workflow
  • Machine Learning for Kubernetes Cluster Admins
    • Model Training on Kubernetes
      • Training your first model on Kubernetes
    • Distributed Training on Kubernetes
    • Resource Constraints
    • Specialized Hardware
      • Scheduling idiosyncrasies
    • Libraries, Drivers, and Kernel Modules
    • Storage
      • Dataset storage and distribution among nodes during training
      • Checkpoints and saving models
    • Networking
    • Specialized Protocols
  • Data Scientist Concerns
  • Machine Learning on Kubernetes Best Practices
  • Summary
• 15. Building Higher-Level Application Patterns on Top of Kubernetes
  • Approaches to Developing Higher-Level Abstractions
  • Extending Kubernetes
    • Extending Kubernetes Clusters
    • Extending the Kubernetes User Experience
    • Making Containerized Development Easier
    • Developing a Push-to-Deploy Experience
  • Design Considerations When Building Platforms
    • Support Exporting to a Container Image
    • Support Existing Mechanisms for Service and Service Discovery
  • Building Application Platforms Best Practices
  • Summary
• 16. Managing State and Stateful Applications
  • Volumes and Volume Mounts
  • Volume Best Practices
  • Kubernetes Storage
    • PersistentVolume
    • PersistentVolumeClaims
    • StorageClasses
      • Container Storage Interface and FlexVolume
    • Kubernetes Storage Best Practices
  • Stateful Applications
    • StatefulSets
    • Operators
    • StatefulSet and Operator Best Practices
  • Summary
• 17. Admission Control and Authorization
  • Admission Control
    • What Are They?
    • Why Are They Important?
    • Admission Controller Types
    • Configuring Admission Webhooks
    • Admission Control Best Practices
      • Admission plug-in ordering doesnt matter
      • Dont mutate the same fields
      • Mutating admission webhooks must be idempotent
      • Fail open/fail closed
      • Admission webhooks must respond quickly
      • Scoping admission webhooks
      • Always deploy in a separate namespace using NamespaceSelector
      • Dont touch the kube-system namespace
      • Lock down admission webhook configurations with RBAC
      • Dont send sensitive data
  • Authorization
    • Authorization Modules
      • ABAC
      • RBAC
      • Webhook
    • Authorization Best Practices
      • Dont use ABAC on multiple control plane clusters
      • Dont use webhook modules
  • Summary
• 18. GitOps and Deployment
  • What Is GitOps?
  • Why GitOps?
  • GitOps Repo Structure
  • Managing Secrets
  • Setting Up Flux
  • GitOps Tooling
  • GitOps Best Practices
  • Summary
• 19. Security
  • Cluster Security
    • etcd Access
    • Authentication
    • Authorization
    • TLS
    • Kubelet and Cloud Metadata Access
    • Secrets
    • Logging and Auditing
    • Cluster Security Posture Tooling
  • Cluster Security Best Practices
  • Workload Container Security
    • Pod Security Admission
    • Seccomp, AppArmor, and SELinux
    • Admission Controllers
    • Operators
    • Network Policy
    • Runtime Security
    • Workload Container Security Best Practices
  • Code Security
    • Non-Root and Distroless Containers
    • Container Vulnerability Scanning
    • Code Repository Security
  • Code Security Best Practices
  • Summary
• 20. Chaos Testing, Load Testing, and Experiments
  • Chaos Testing
    • Goals for Chaos Testing
    • Prerequisites for Chaos Testing
    • Chaos Testing Your Applications Communication
    • Chaos Testing Your Applications Operation
    • Fuzz Testing Your Application for Security and Resiliency
    • Summary
  • Load Testing
    • Goals for Load Testing
    • Prerequisites for Load Testing
    • Generating Realistic Traffic
    • Load Testing Your Application
    • Tuning Your Application Using Load Tests
    • Summary
  • Experiments
    • Goals for Experiments
    • Prerequisites for an Experiment
    • Setting Up an Experiment
    • Summary
  • Chaos Testing, Load Testing, and Experiments Summary
• 21. Implementing an Operator
  • Operator Key Components
  • Custom Resource Definitions
    • Kubernetes API objects, resources, version, group, and kind
  • Creating Our API
  • Controller Reconciliation
  • Resource Validation
  • Controller Implementation
  • Operator Life Cycle
    • Version Upgrades
    • Operator Best Practices
  • Summary
• 22. Conclusion
• Index

pokaż cały spis treści

ukryj recenzje