kubenates training note (21-22 Mar 2019)

related repositories
- https://github.com/up1/course-kubernetes-in-practice
- https://github.com/up1/workshop-kubernetes-microservices

========================= day1=========================
gcloud sdk => https://cloud.google.com/sdk/docs/quickstart-macos

slide => https://github.com/up1/course-kubernetes-in-practice

cloud native landspace => https://landscape.cncf.io/

container design principal
- image immutible: 1 image run anywhere

- high observability principle
  -- health
    --- readiness: workable (can connect db, redis, external)
    --- liveness: call, get 200 (but don't know workable or not)

  -- metrics
    --- tracing
    --- logging

- single responsibility
  -- 1 container -> 1 process

- support graceful shutdown
  -- handle sigterm

- self containment principle
  -- no configuratin in container
  -- no storage is related to container (change disk, not affect app)

kubernetes world is a service layer, everything is a service

standard k8s
- 4 machines
- design to run eveywhere
- master & slaves
- เวลาเรา manage, manage ผ่าน master
- เวลาใช้งาน เข้า slaves ตรงๆ ไม่ผ่าน master

$ kubectl get nodes // get nodes

k8s master components
- API server => mapping, updating etds, access etcd, authen, authorize
- scheduler => เลือกว่าจะดีพลอยเครื่องไหน, resource utilization
- controller => maintain number of pods (up or down)
- etcd => discovery


k8s slaves (node) components:
- kubelet: get command from master, จงสร้างแอพ 1, เป็น agent
- docker
- kube-proxy: รับ request จากภายนอก(คนใช้งาน), เก็บ iptables
- fluend

tracing
tool: jeager, istio

workshop 01-hello
$ kubectl run hello --image=somkiat/hello:latest --port=8080 --generator=run/v1
--generator=run/v1 => คือให้มันสร้าง replicationcontroller ให้
replicationcontroller/hello created

pod คือ หน่วยที่เล็กที่สุด
scaling => scale ระดับ pod
ใน pod มีได้หลาย container แต่ควรมีแค่ container เดียว

$ kubectl get pod // get pods
$ kubectl describe pod/hello-6ln72 // get pod details

2 containers ถ้าอยู่ใน pod เดียวกัน คุยผ่าน localhost ได้

$ kubectl get pod/hello-6ln72 -o json // get json format, or -o yaml

$ kubectl get rc // get replicationcontroller or "kubectl get replicationcontroller"

$ kubectl scale rc hello --replicas=3 // scale to 3

$ kubectl get pod -w // watching

$ kubectl delete pod/hello-6ln72 // delete pod

* replicationcontroller ปัจจุบันไม่ได้ใช้แล้วนะ

$ kubectl get pod -o wide // ดูว่าแต่ละ pod รันบนเครื่องไหน

$ kubectl get pod,rc // view pod & rc

$ kubectl delete rc/hello // delete rc

$ kubectl --namespace=kube-system get pod // ดู pod system

logging (เป็น udp มีโอกาสหาย สำหรับ application log)
1. app log to syslog server
2. fluend set source to syslog (monitor syslog)
audit log ห้ามหาย ห้ามใช้

ของ gcp, fluend จะอ่าน log แล้วโยนเข้า stack driver ให้

เราจะไม่ expose pod, expose ผ่าน service layer เอา

$ kubectl get service // or "kubectl get svc", can see clusterIP

3 types of services
1. clusterIP:
  - private
  - clusterIP is ip of the service
2. node port
3. load balance
  - default => dynamic ip
  - static ip => pay money
  - access LB ที่เดียว
4. ingress controller (built-in k8s)
  - map /a => go to service A
  - map /b => go to service B

$ kubectl expose rc hello --type=LoadBalancer --name hello-http // expose LB
$ kubectl get svc -w
$ kubectl get svc/hello-http -o yaml

workshop 02 - single pod

selector เดียวกันคือ cluster เดียวกัน

$ kubectl get all

$ kubectl delete all --all

1. cd /Users/apple/Desktop/myProjects/k8s-training/course-kubernetes-in-practice/workshop/02-pod-service/single-pod
2. kubectl create -f .
    or kubectl create -f https://xxxxx.yaml
    or kubectl create -f pod.yaml
3. kubectl delete -f . // delete all

allow firewall on gcpcloud
$ gcloud compute firewall-rules create xxx123 --allow tcp:32346

$ kubectl get node -o wide // node is machine

replicaSet
- we don't use replicationcontroller anymore, use replicaSet (rs)

view all resources => kubectl api-resources

deployment stretagy
- re-create
- ramp -> default k8s
- blue green
- ab
- canary
- shadow

$ kubectl describe po/hello-5bbb55ffb-cg7kk // can see namespace of this pod
$ kubectl get ns // get name space

service expose pod (in selector -> selector pod)
deployment -> replicaSet -> pod

$ kubectl get deploy // get deployment

owasp
- web
- mobile
- docker

slide: SCK-DOCKER-KUBERNETES-IN-PRACTICE.pdf

config map: reference configuration
secret: xxxxx (config ที่เป็นความลับ, e.g., password)
super secret should use 3rd party, e.g., vault

kompose -> convert docker-compose to k8s (https://github.com/kubernetes/kompose)





========================= day2=========================
monitor docker
- cAdvisor: monitor docker (https://github.com/google/cadvisor)
- prometheus:
  -- set docker daemon json to point to prometheus server
  -- enable localhost:1337
  -- advance=> {
    "metrics-addr": "0.0.0.0:1337",
    "experimental: true,
    "debug": true
  }
  -- http://localhost:1337/metrics

$ docker system events // watch docker event


hpa (horizontal pod autoscaler)
hpa
- auto scale based on cpu by default, we can auto scale by custom matric
- มันจะค่อยๆ สเกล  ถ้าทราฟฟิคพีคสูงมากๆ ไมเวิร์ต ต้อง manual scale

components in autoscaling
- cAdvisor (in kubelet) will monitor pod data
- heapster (metrics-server for new version) collect metrics from cAdvisors
- hpa will get metrics from heapster
- hpa work with deployment, will increase or decrease number of replicas

heapster is deprecated (use metrics-server instead)

metrics-server: need to install by ourselves for on-premise case


$kubectl create -f https://raw.githubusercontent.com/up1/course-kubernetes-in-practice/master/working-with-java/02-web-app/k8s/mongodb/mongo-controller.yaml
$kubectl create -f https://raw.githubusercontent.com/up1/course-kubernetes-in-practice/master/working-with-java/02-web-app/k8s/mongodb/mongo-service.yaml

$kubectl create -f https://raw.githubusercontent.com/up1/course-kubernetes-in-practice/master/working-with-java/03-hpa/boot-deployment.yaml
$kubectl create -f https://raw.githubusercontent.com/up1/course-kubernetes-in-practice/master/working-with-java/03-hpa/boot-service.yaml

$ gcloud compute firewall-rules create xxx124 --allow tcp:32500 // open firewall
$ kubectl get node -o wide // get external ip of machine
$ curl http://35.224.26.179:32500/user

$kubectl autoscale deployment/spring-boot-service-deployment --min=1 --max=5 --cpu-percent=5
$kubectl get hpa
$kubectl describe hpa

secret and configuration management
$ kubectl get configmap
$ kubectl get secret

configmap 2 modes
- env -> need to re-deploy deployment
- volumn -> don't need to re-deploy deployment

$ spring-boot-service-deployment-567f8d58bc-lc85k // exec pod

$ kubectl apply -f config.yaml // apply config map after updating
$ kubectl apply -f . // apply configuration change

stateful with k8s

sample: https://codelabs.developers.google.com/codelabs/cloud-mongodb-statefulset/index.html#0

stateful with k8s
- volumn
- statefulset

volumes
- EmptyDir:
  -- เหมือน tmp ข้อมูลจะออโต้ลบเอง
  -- e.g., log
  -- 1 pod 2 containers: main & fluentd (shift log)
- hostPath
- gitRepo
- NFS
- icePersistentDisk
- flocker: cloud storage
- Persistent Volume Claim (PVC)

storage class:
- dynamic claim
- class, e.g., gold, platinum

Persistent Volume:
- static claim: ต้องบอกว่าจะเคลมกี่ G
- cannot bind 2 pvc to the same pv

$ cd workshop/05-volume/persistent_volume

$ kubectl get pv -w // get pv
$ kubectl get pvc -w  // get pvc
$ kubectl get po,pv,pvc


http://www.somkiat.cc/hello-cotton-for-api-testing/ // automate test

workshop >> https://github.com/up1/workshop-kubernetes-microservices

online play docker >> https://labs.play-with-docker.com/


port
- nodeport: port of nodeport
- port: port of service
- targetPort: port of pod