Slide 1
Slide 1 text
いまからはじめる
Google Kubernetes Engine
2019
GDG Tokyo New Year Party 2019
2019. 01. 30
@sakajunquality
Slide 2
Slide 2 text
About me
- ID: @sakajunquality
- Jun Sakata
- Google Developers Expert, GCP
- SWE, Infrastructure at Ubie Inc.
- #GKE #CloudBuild #BigQuery
- #Camera #Coffee
Slide 3
Slide 3 text
Agenda
- What’s Kubernetes?
- Why GKE?
- GKE Ecosystems
- GKE Updates
- How to Start ??
Slide 4
Slide 4 text
Topics that are not covered today
- Why GCP?
- Why not GAE?
- Why container?
- What’s Docker?
- What’s Service Mesh?
- What’s Envoy?
Slide 5
Slide 5 text
Topics that are not covered today
- Why GCP?
- Why not GAE?
- Why container?
- What’s Docker?
- What’s Service Mesh?
- What’s Envoy?
Slide 6
Slide 6 text
What’s
Kubernetes?
from Borg to Kubernetes
Slide 7
Slide 7 text
What’s Kubernetes?
- Container Platform based on Google’s Borg
- Borg has supported Google’s service over 12 years
- Orchestrates computing, networking, and storage infrastructure
- Microservices Platform
- OSS written in Go
- Borg is written in C++
- “Graduated” CNCF project
- Crossed the Chasm
Slide 8
Slide 8 text
Kubernetes Managed Services
- GKE (Google Kubernetes Engine)
- EKS (Amazon Elastic Kubernetes Service)
- IKS (IBM Cloud Kubernetes Service)
- AKS (Azure Kubernetes Service)
- Oracle Container Engine for Kubernetes
- DigitalOcean Kubernetes
- etc...
Slide 9
Slide 9 text
Kubernetes Managed Services
- GKE (Google Kubernetes Engine)
- EKS (Amazon Elastic Kubernetes Service)
- IKS (IBM Cloud Kubernetes Service)
- AKS (Azure Kubernetes Service)
- Oracle Container Engine for Kubernetes
- DigitalOcean Kubernetes
- etc...
Too Many Kubernetes Services
Slide 10
Slide 10 text
Why
GKE?
Fully Managed Kubernetes
Slide 11
Slide 11 text
Why GKE?
Because…
- Already Using GCP
- Kubernetes is Hard
- GCP Specific Features
Slide 12
Slide 12 text
Already Using GCP?
Slide 13
Slide 13 text
Container Runtime Environment in GCP
AppEngine (Flexible) Compute Engine Kubernetes Engine
Slide 14
Slide 14 text
Container Runtime Environment in GCP
AppEngine (Flexible) Compute Engine Kubernetes Engine
Not Flexible *
* in terms of supported containers
Slide 15
Slide 15 text
Container Runtime Environment in GCP
AppEngine (Flexible) Compute Engine Kubernetes Engine
Not Flexible *
Not Reliable **
* in terms of supported containers
** in terms of redundancy
Slide 16
Slide 16 text
Google Kubernetes Engine
“Kubernetes”
Flexible and Reliable
Kubernetes Engine
Slide 17
Slide 17 text
Kubernetes is hard
Slide 18
Slide 18 text
No content
Slide 19
Slide 19 text
Kelsey Hightower says
“This guide is not for people looking for a fully automated
command to bring up a Kubernetes cluster. If that's you then
check out Google Kubernetes Engine”
Slide 20
Slide 20 text
Kubernetes is Hard
Kubernetes itself is hard to build, maintain, and manage
e.g.
- Bootstrapping
- High Availability
- Version Updates
- etc.
Slide 21
Slide 21 text
GKE is Fully Managed Kubernetes
- Both control plane and worker node are managed
- Regional or zonal availability
- Auto-Repair / Auto-Update
- VPC Native
Slide 22
Slide 22 text
GCP specific features
Slide 23
Slide 23 text
GCP specific features
(will be covered in the later sections)
Slide 24
Slide 24 text
GKE
Ecosystems
GCP’s products
Slide 25
Slide 25 text
GKE Ecosystems
- Networking
- CI/CD
- Monitoring
- Integrations
Slide 26
Slide 26 text
Networking
Slide 27
Slide 27 text
GKE Ecosystems: Networking
Cloud Armor
Cloud Load Balancing Cloud CDN
Slide 28
Slide 28 text
GKE Ecosystems: Networking
Cloud Load Balancing
- L4/L7 Load Balancer
- High Performance
- Low Latency
- Single Anycast IP
- QUIC supports
Slide 29
Slide 29 text
GKE Ecosystems: Networking
Cloud Armor
- L3-L7 custom rule-based defence
- e.g. SQL Injection
- IP/Geo-based access control
Slide 30
Slide 30 text
GKE Ecosystems: Networking
Cloud CDN
- Global CDN
- High Performance
- Low Latency
- Single Anycast IP
Slide 31
Slide 31 text
GKE Ecosystems: Networking
Cloud Armor
Cloud Load Balancing Cloud CDN
All those resources can be created with Kubernetes’ Ingress resource
Slide 32
Slide 32 text
CI/CD
Slide 33
Slide 33 text
GKE Ecosystems: CI/CD
Cloud Build Container Registry Cloud Source Repositories
Slide 34
Slide 34 text
GKE Ecosystems: CI/CD
Cloud Build
- Fully-managed CI
- 120 min free tiers per Day
- Native Docker Support
- Custom Builders
- https://github.com/GoogleCloudPlatform
/cloud-builders
- https://github.com/GoogleCloudPlatform
/cloud-builders-community
Slide 35
Slide 35 text
GKE Ecosystems: CI/CD
Container Registry
- Docker Registry
- Private / Public
- Vulnerability Scanning
Slide 36
Slide 36 text
GKE Ecosystems: CI/CD
Cloud Source Repositories
- Private Git Repository
- Strong Search w/ New UI
- Mirror from GitHub
Slide 37
Slide 37 text
GKE Ecosystems: CI/CD
General Container Build and Deploy Pipelines
Application
Source Code
Container
Image
Container
Runtime
Slide 38
Slide 38 text
GKE Ecosystems: CI/CD
General Container Build and Deploy Pipelines and GCP Products
Application
Source Code
Container
Image
Container
Runtime
Cloud Source
Repositories
Github
Container
Registry
Kubernetes
Engine
Slide 39
Slide 39 text
GKE Ecosystems: CI/CD
More Kubernetes Specific: Simple GitOps
from GitOps-style continuous delivery with Cloud Build
https://cloud.google.com/kubernetes-engine/docs/tutorials/gitops-cloud-build?hl=en
Slide 40
Slide 40 text
Monitoring
Slide 41
Slide 41 text
GKE Ecosystems: Monitoring
Stackdriver Monitoring Logging
Slide 42
Slide 42 text
GKE Ecosystems: Monitoring
Stackdriver Monitoring
- Full-Stack Monitoring Suite
- New Features
- New Kubernetes Dashboard
- Istio Integration
- Prometheus Integration
Slide 43
Slide 43 text
GKE Ecosystems: Monitoring
Stackdriver Logging
- Full-managed Log platform
- GKE has pre-installed fluentd
- Collects Stdout/Stderr of containers
- Parse JSON to structured log
Slide 44
Slide 44 text
Integrations
Slide 45
Slide 45 text
GKE Ecosystems: Integrations
Cloud Pub/Sub Cloud Functions Cloud IAP
e.g. Notifications
GSuite-based Access
Control
Slide 46
Slide 46 text
GKE Updates
GKE-Related GCP Updates
Slide 47
Slide 47 text
GKE Updates
- Private Cluster + Cloud NAT
- NEG / Container-native Load Balancing
- Node Auto-Provisioning
- Binary Authorization
- Istio
- Stackdriver New Kubernetes Dashboard
and more...
Slide 48
Slide 48 text
GKE Updates: Private Cluster + Cloud Nat
GKE Private Cluster: Nodes with private IP addresses only
Cloud Nat: Managed Nat-Gateway
=> Securing Node Instances
=> Limiting GKE’s source IP
Slide 49
Slide 49 text
GKE Updates: NEG / Container-Native Load Balancing
Using Network Endpoint Group, traffic goes LB to pods w/o
iptables
=> Enhancement in performance
Image from https://cloud.google.com/kubernetes-engine/docs/how-to/container-native-load-balancing?hl=en
Slide 50
Slide 50 text
Cluster autoscaler can create and delete new node pools
=> More flexible and cost-effective workloads
e.g. GPU Nodes for temporary jobs
GKE Updates: Node Auto-Provisioning
Submit Heavy Jobs
Provision Node-Pool
w/ GPU
Destroy Node-Pool
w/ GPU
Slide 51
Slide 51 text
GKE Updates: Binary Authorization
- Ensures that only trusted images are deployed to GKE
- Manage policy for “what to trust”
=> Enhance security
GKE Cluster Create/Edit Form
Slide 52
Slide 52 text
Binary Authorization Policy Example
Slide 53
Slide 53 text
GKE Updates: Istio
- add-on for GKE for Istio service mesh
- one click deploy
- Can be enabled for existing clusters
=> Easier(?) management of Istio
(Prometheus has the Stackdriver sidecar)
Logo from: https://istio.io/about/media-resources/
GKE Cluster Create/Edit Form
Slide 54
Slide 54 text
Stackdriver New Kubernetes Dashboard
- New Integrated Kubernetes Dashboard
- Some issues though…
- https://issuetracker.google.com/issues/118553726
Slide 55
Slide 55 text
Stackdriver New Kubernetes Dashboard
GKE Cluster Create/Edit Form
Slide 56
Slide 56 text
Updates in Kubernetes
Slide 57
Slide 57 text
CHANGELOG
https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG.md
1.14 is coming...
Kubernetes Updates
Slide 58
Slide 58 text
Official Release Notes (in English)
https://cloud.google.com/kubernetes-engine/release-notes
- Check new features
- Check bug fixes
GKE Updates
Slide 59
Slide 59 text
Official Issue Tracker
https://issuetracker.google.com/savedsearches/559746
- Check Bugs
- Check Feature Requests
Other Products: https://cloud.google.com/support/docs/issue-trackers?hl=en
GKE Issues
Slide 60
Slide 60 text
Promising update in the future
https://github.com/aws/containers-roadmap/issues/23
EKS IAM Roles for Pods
=> maybe available in GKE too in the future (hopefully)
=> no more service account json management?
Slide 61
Slide 61 text
How to start ??
Let’s start!
Slide 62
Slide 62 text
$ gcloud container clusters create my-cluster
Slide 63
Slide 63 text
$ gcloud container clusters create my-cluster
Too easy to understand ?
Slide 64
Slide 64 text
No content
Slide 65
Slide 65 text
Too difficult to understand !
Slide 66
Slide 66 text
How to start ??
- Books
- Hands-on
- Online materials
Slide 67
Slide 67 text
Books
https://www.amazon.co.jp/dp/B07GP1Q3VT/ https://www.amazon.co.jp/dp/B0721JNVGT/
Slide 68
Slide 68 text
Books
https://www.amazon.co.jp/dp/B07HFS7TDT/
Slide 69
Slide 69 text
Hands-on
- Quick Start
- https://cloud.google.com/kubernetes-engine/docs/quickstart?hl=en
- Qwiklabs
- https://www.qwiklabs.com/quests/29?locale=en
- Coursera
- https://www.coursera.org/learn/google-kubernetes-engine
- sakajunquality’s hands-on
- https://github.com/sakajunquality/gke-getting-started
Slide 70
Slide 70 text
https://developers-jp.googleblog.com/2019/01/cloud-study-jams-2.html
Slide 71
Slide 71 text
Online Materials
- GKE Document
- https://cloud.google.com/kubernetes-engine/docs/?hl=en
- Kubernetes Documentation
- https://kubernetes.io/docs/home/
- YouTube
- Search “KubeCon”
Slide 72
Slide 72 text
Takeaways
Slide 73
Slide 73 text
Takeaways
- Kubernetes is a container platform based on Google’s
experience.
- GKE is the best way to run containers in GCP.
- GCP’s services work well with GKE.
- More and more features are coming.
- You can start today!
Slide 74
Slide 74 text
One more thing...
Maybe more updates in April
https://cloud.withgoogle.com/next18/sf
Slide 75
Slide 75 text
Thank you
@sakajunquality
Slide 76
Slide 76 text
Appendix
- Large-scale cluster management at Google with Borg
- https://ai.google/research/pubs/pub43438
- What is Kubernetes? - Kubernetes
- https://kubernetes.io/docs/concepts/overview/what-is-kubernetes/
- CNCF Projects
- https://www.cncf.io/projects/
- Using container-native load balancing
- https://cloud.google.com/kubernetes-engine/docs/how-to/container-nati
ve-load-balancing?hl=en
- Using node auto-provisioning
- https://cloud.google.com/kubernetes-engine/docs/how-to/node-auto-prov
isioning?hl=en
Slide 77
Slide 77 text
Appendix (2)
- Example GKE Setup - Cloud Nat
- https://cloud.google.com/nat/docs/gke-example
- Setting up a private cluster
- https://cloud.google.com/kubernetes-engine/docs/how-to/private-cluste
rs
- Binary Authorization
- https://cloud.google.com/binary-authorization/docs/
- Istio on GKE
- https://cloud.google.com/istio/docs/istio-on-gke/overview
- Istio
- https://istio.io/
Slide 78
Slide 78 text
Appendix (3)
- Kubernetes Logos
- https://github.com/kubernetes/kubernetes/tree/master/logo
- GCP Icons
- https://cloud.google.com/icons/?hl=en
- CNCF Artworks
- https://github.com/cncf/artwork
- Kubernetes The Hard Way
- https://github.com/kelseyhightower/kubernetes-the-hard-way