Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Deploying Rock Solid Applications with Kubernetes

Deploying Rock Solid Applications with Kubernetes

Kubernetes has made it easy to deploy applications to the cloud. It’s even made it easy to deploy the same application across several instances. This, however, does not mean that your application will be highly available by default. To achieve high availability for your applications, there's a lot more involved.

In this talk we'll look at:
- creating secure Docker images and enforcing this at the cluster level with Pod Security Policies;
- configuring Health Checks and possible caveats like Circular Dependencies;
- limiting traffic between services with Network Policies;
- tolerating node failure by implementing correct Anti-Affinity rules;
- rescheduling pods onto new available nodes after node failure with Disruption Budgets;
- setting up correct deployment strategies;
- how to automate this with Custom Resource Definitions;

Jelmer Snoeck

December 12, 2018
Tweet

More Decks by Jelmer Snoeck

Other Decks in Programming

Transcript

  1. Deploying Rock Solid Applications
    with Kubernetes
    https://bit.ly/2LafjmT
    @jelmersnoeck

    View Slide

  2. FIND ME
    github.com/jelmersnoeck
    twitter.com/jelmersnoeck
    Jelmer Snoeck
    ABOUT ME
    - Tech Lead at manifold.co
    - <3 Kubernetes
    - <3 Golang

    View Slide

  3. What even are Rock
    Solid Applications?
    @jelmersnoeck

    View Slide

  4. Secure Applications
    @jelmersnoeck

    View Slide

  5. Highly Available Applications
    @jelmersnoeck

    View Slide

  6. @jelmersnoeck

    View Slide

  7. Disclaimer: simplified
    YAML for demo
    purposes
    @jelmersnoeck

    View Slide

  8. @jelmersnoeck

    View Slide

  9. @jelmersnoeck

    View Slide

  10. Security
    @jelmersnoeck

    View Slide

  11. @jelmersnoeck

    View Slide

  12. Pod Security
    Policies
    @jelmersnoeck

    View Slide

  13. @jelmersnoeck

    View Slide

  14. @jelmersnoeck

    View Slide

  15. RBAC
    @jelmersnoeck

    View Slide

  16. @jelmersnoeck

    View Slide

  17. @jelmersnoeck

    View Slide

  18. @jelmersnoeck

    View Slide

  19. @jelmersnoeck

    View Slide

  20. @jelmersnoeck

    View Slide

  21. @jelmersnoeck

    View Slide

  22. @jelmersnoeck

    View Slide

  23. or…
    @jelmersnoeck

    View Slide

  24. @jelmersnoeck

    View Slide

  25. @jelmersnoeck

    View Slide

  26. Network Policies
    @jelmersnoeck

    View Slide

  27. @jelmersnoeck

    View Slide

  28. @jelmersnoeck

    View Slide

  29. @jelmersnoeck

    View Slide

  30. Caveat: availability depends on your
    networking plugin
    @jelmersnoeck

    View Slide

  31. Security
    @jelmersnoeck

    View Slide

  32. High Availability
    @jelmersnoeck

    View Slide

  33. What even is
    High Availability?
    @jelmersnoeck

    View Slide

  34. This talk is not about High Availability for nodes
    @jelmersnoeck

    View Slide

  35. @jelmersnoeck

    View Slide

  36. @jelmersnoeck

    View Slide

  37. @jelmersnoeck

    View Slide

  38. Deployments
    @jelmersnoeck

    View Slide

  39. Replicas +
    UpdateStrategy
    @jelmersnoeck

    View Slide

  40. @jelmersnoeck

    View Slide

  41. @jelmersnoeck

    View Slide

  42. @jelmersnoeck

    View Slide

  43. @jelmersnoeck

    View Slide

  44. @jelmersnoeck

    View Slide

  45. @jelmersnoeck

    View Slide

  46. @jelmersnoeck

    View Slide

  47. @jelmersnoeck

    View Slide

  48. @jelmersnoeck

    View Slide

  49. @jelmersnoeck

    View Slide

  50. @jelmersnoeck

    View Slide

  51. @jelmersnoeck

    View Slide

  52. (Anti)Affinity
    @jelmersnoeck

    View Slide

  53. @jelmersnoeck

    View Slide

  54. @jelmersnoeck

    View Slide

  55. @jelmersnoeck

    View Slide

  56. @jelmersnoeck

    View Slide

  57. @jelmersnoeck

    View Slide

  58. Probes
    @jelmersnoeck

    View Slide

  59. @jelmersnoeck

    View Slide

  60. Caveat: Circular
    Dependencies
    @jelmersnoeck

    View Slide

  61. Caveat: Circular Dependencies
    @jelmersnoeck

    View Slide

  62. Caveat: Circular Dependencies
    @jelmersnoeck

    View Slide

  63. Caveat: Circular Dependencies
    @jelmersnoeck

    View Slide

  64. Caveat: Circular Dependencies
    @jelmersnoeck

    View Slide

  65. PodDisruptionBudget
    @jelmersnoeck

    View Slide

  66. @jelmersnoeck

    View Slide

  67. @jelmersnoeck

    View Slide

  68. @jelmersnoeck

    View Slide

  69. @jelmersnoeck

    View Slide

  70. @jelmersnoeck

    View Slide

  71. @jelmersnoeck

    View Slide

  72. Prevent
    misconfiguration
    @jelmersnoeck

    View Slide

  73. Linting?

    View Slide

  74. Webhooks!

    View Slide

  75. @jelmersnoeck

    View Slide

  76. @jelmersnoeck

    View Slide

  77. @jelmersnoeck

    View Slide

  78. @jelmersnoeck

    View Slide

  79. @jelmersnoeck

    View Slide

  80. @jelmersnoeck

    View Slide

  81. Webhooks
    - Barbossa
    - Azure Kubernetes Policy Controller (OPA)
    - Anchore Engine
    - …
    @jelmersnoeck

    View Slide

  82. We’re hiring…
    <3
    @jelmersnoeck

    View Slide

  83. Thanks
    I’ll be around for
    questions
    FIND ME
    github.com/jelmersnoeck
    twitter.com/jelmersnoeck
    SPECIAL THANKS TO
    twitter.com/megthesmith

    View Slide

  84. Resources
    - https://hackernoon.com/deploying-rock-solid-applications-with-kubernetes-2
    30fd9bb61f4
    - https://thenewstack.io/myth-cloud-native-portability
    - https://kubernetes.io/docs/concepts/policy/pod-security-policy/
    - https://kubernetes.io/docs/reference/access-authn-authz/rbac/
    - https://kubernetes.io/docs/concepts/services-networking/network-policies/
    - https://kubernetes.io/docs/concepts/workloads/controllers/deployment/
    - https://container-solutions.com/kubernetes-deployment-strategies/
    - https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinit
    y-and-anti-affinity
    - https://kubernetes.io/docs/concepts/workloads/pods/disruptions/
    - https://kubernetes.io/docs/tasks/configure-pod-container/configure-livenes
    s-readiness-probes/
    - https://banzaicloud.com/blog/k8s-admission-webhooks/
    - https://github.com/jelmersnoeck/barbossa
    - https://github.com/Azure/kubernetes-policy-controller
    @jelmersnoeck

    View Slide