I have deployed my app on Minikube… and now what?

A presentation at Devoxx Belgium in November 2019 in Antwerp, Belgium by Horacio Gonzalez

Slide 1

Slide 1

I have deployed my app on Minikube… and now what? Horacio Gonzalez #Devoxx #BeyondMinikube @LostInBrittany

Slide 2

Slide 2

Who are we? Introducing myself and introducing OVHcloud #Devoxx #BeyondMinikube @LostInBrittany

Slide 3

Slide 3

Horacio Gonzalez @LostInBrittany Spaniard lost in Brittany. Developer, speaker, dreamer, geek Flutter #Devoxx #BeyondMinikube @LostInBrittany

Slide 4

Slide 4

OVHcloud: A Global Leader 200k Private cloud VMs running 1 Dedicated IaaS Europe 30 Datacenters Own 20Tbps Hosting capacity : 1.3M Physical Servers 360k Servers already deployed #Devoxx #BeyondMinikube Netwok with 35 PoPs

1.3M Customers in 138 Countries @LostInBrittany

Slide 5

Slide 5

OVHcloud: Our solutions Cloud Web Hosting Mobile Hosting Telecom VPS Containers ▪ Dedicated Server Domain names VoIP Public Cloud Compute ▪ Data Storage Email SMS/Fax Private Cloud ▪ Network and Database CDN Virtual desktop Serveur dédié Security Object Storage Web hosting Cloud Storage Over the Box ▪ Licences Cloud Desktop Securities MS Office Hybrid Cloud Messaging MS solutions #Devoxx #BeyondMinikube @LostInBrittany

Slide 6

Slide 6

Minikube: K8s on my laptop A great fastlane into Kubernetes #Devoxx #BeyondMinikube @LostInBrittany

Slide 7

Slide 7

Running a full K8s in your laptop A great learning tool #Devoxx #BeyondMinikube @LostInBrittany

Slide 8

Slide 8

Your laptop isn’t a true cluster Don’t expect real performances #Devoxx #BeyondMinikube @LostInBrittany

Slide 9

Slide 9

Beyond the first deployment So I have deployed my distributed architecture on K8s, everything is good now, isn’t it? #Devoxx #BeyondMinikube @LostInBrittany

Slide 10

Slide 10

The long path to production #Devoxx #BeyondMinikube @LostInBrittany

Slide 11

Slide 11

From Minikube to prod A journey not for the faint of heart #Devoxx #BeyondMinikube @LostInBrittany

Slide 12

Slide 12

Technical Difficulties Because music has a price #Devoxx #BeyondMinikube @LostInBrittany

Slide 13

Slide 13

Kubernetes can be wonderful For both developers and devops #Devoxx #BeyondMinikube @LostInBrittany

Slide 14

Slide 14

But it comes with a price… #Devoxx #BeyondMinikube @LostInBrittany

Slide 15

Slide 15

The truth is somewhere inside… #Devoxx #BeyondMinikube @LostInBrittany

Slide 16

Slide 16

The network is going to feel it… #Devoxx #BeyondMinikube @LostInBrittany

Slide 17

Slide 17

The security journey #Devoxx #BeyondMinikube @LostInBrittany

Slide 18

Slide 18

The storage dilemma #Devoxx #BeyondMinikube @LostInBrittany

Slide 19

Slide 19

The ETCD vulnerability #Devoxx #BeyondMinikube @LostInBrittany

Slide 20

Slide 20

Describing some of those traps To ease and empower your path to production #Devoxx #BeyondMinikube @LostInBrittany

Slide 21

Slide 21

Security Hardening your Kubernetes #Devoxx #BeyondMinikube @LostInBrittany

Slide 22

Slide 22

Kubernetes is insecure by design It’s a feature, not a bug It’s up to the K8s admin to secure it according to their needs #Devoxx #BeyondMinikube @LostInBrittany

Slide 23

Slide 23

Not everybody has the same security needs #Devoxx #BeyondMinikube @LostInBrittany

Slide 24

Slide 24

Kubernetes allows to enforce security practices as needed #Devoxx #BeyondMinikube @LostInBrittany

Slide 25

Slide 25

Listing some good practices #Devoxx #BeyondMinikube @LostInBrittany

Slide 26

Slide 26

Close open access Close all by default, open only the needed ports Follow the least privileged principle #Devoxx #BeyondMinikube @LostInBrittany

Slide 27

Slide 27

Define and implement RBAC According to your needs #Devoxx #BeyondMinikube @LostInBrittany

Slide 28

Slide 28

Define and implement network policies #Devoxx #BeyondMinikube @LostInBrittany

Slide 29

Slide 29

Use RBAC and Network Policies to isolate your sensitive workload #Devoxx #BeyondMinikube @LostInBrittany

Slide 30

Slide 30

Always keep up to date Both Kubernetes and plugins #Devoxx #BeyondMinikube @LostInBrittany

Slide 31

Slide 31

And remember, even the best can get hacked Remain attentive, don’t get too confident #Devoxx #BeyondMinikube @LostInBrittany

Slide 32

Slide 32

Extensibility Enhance your Kubernetes #Devoxx #BeyondMinikube @LostInBrittany

Slide 33

Slide 33

Kubernetes is modular Let’s see how some of those plugins can help you #Devoxx #BeyondMinikube @LostInBrittany

Slide 34

Slide 34

Helm A package management for K8s #Devoxx #BeyondMinikube @LostInBrittany

Slide 35

Slide 35

Complex deployments #Devoxx #BeyondMinikube @LostInBrittany

Slide 36

Slide 36

Using static YAML files #Devoxx #BeyondMinikube @LostInBrittany

Slide 37

Slide 37

Complex deployments #Devoxx #BeyondMinikube @LostInBrittany

Slide 38

Slide 38

Istio A service mesh for Kubernetes… and much more! #Devoxx #BeyondMinikube @LostInBrittany

Slide 39

Slide 39

Istio: A service mesh but not only #Devoxx #BeyondMinikube @LostInBrittany

Slide 40

Slide 40

Service discovery #Devoxx #BeyondMinikube @LostInBrittany

Slide 41

Slide 41

Traffic control #Devoxx #BeyondMinikube @LostInBrittany

Slide 42

Slide 42

Encrypting internal communications #Devoxx #BeyondMinikube @LostInBrittany

Slide 43

Slide 43

Routing and load balancing #Devoxx #BeyondMinikube @LostInBrittany

Slide 44

Slide 44

Rolling upgrades #Devoxx #BeyondMinikube @LostInBrittany

Slide 45

Slide 45

Rolling upgrades #Devoxx #BeyondMinikube @LostInBrittany

Slide 46

Slide 46

Rolling upgrades #Devoxx #BeyondMinikube @LostInBrittany

Slide 47

Slide 47

Rolling upgrades #Devoxx #BeyondMinikube @LostInBrittany

Slide 48

Slide 48

Rolling upgrades #Devoxx #BeyondMinikube @LostInBrittany

Slide 49

Slide 49

Rolling upgrades #Devoxx #BeyondMinikube @LostInBrittany

Slide 50

Slide 50

Rolling upgrades #Devoxx #BeyondMinikube @LostInBrittany

Slide 51

Slide 51

Rolling upgrades #Devoxx #BeyondMinikube @LostInBrittany

Slide 52

Slide 52

Rolling upgrades #Devoxx #BeyondMinikube @LostInBrittany

Slide 53

Slide 53

A/B testing #Devoxx #BeyondMinikube @LostInBrittany

Slide 54

Slide 54

Monitoring your cluster #Devoxx #BeyondMinikube @LostInBrittany

Slide 55

Slide 55

Velero Backing up your Kubernetes #Devoxx #BeyondMinikube @LostInBrittany

Slide 56

Slide 56

Kubernetes: Desired State Management #Devoxx #BeyondMinikube @LostInBrittany

Slide 57

Slide 57

YAML files allows to clone a cluster #Devoxx #BeyondMinikube @LostInBrittany

Slide 58

Slide 58

But what about the data? #Devoxx #BeyondMinikube @LostInBrittany

Slide 59

Slide 59

Velero Backup and migrate Kubernetes applications and their persistent volumes #Devoxx #BeyondMinikube @LostInBrittany

Slide 60

Slide 60

S3 based backup On any S3 protocol compatible store #Devoxx #BeyondMinikube @LostInBrittany

Slide 61

Slide 61

Backup all or part of a cluster #Devoxx #BeyondMinikube @LostInBrittany

Slide 62

Slide 62

Schedule backups #Devoxx #BeyondMinikube @LostInBrittany

Slide 63

Slide 63

Backups hooks #Devoxx #BeyondMinikube @LostInBrittany

Slide 64

Slide 64

Conclusion And one more thing… #Devoxx #BeyondMinikube @LostInBrittany

Slide 65

Slide 65

Kubernetes is powerful It can make Developers’ and DevOps’ lives easier #Devoxx #BeyondMinikube @LostInBrittany

Slide 66

Slide 66

But there is a price: operating it Lot of things to think about #Devoxx #BeyondMinikube @LostInBrittany

Slide 67

Slide 67

We have seen some of them #Devoxx #BeyondMinikube @LostInBrittany

Slide 68

Slide 68

One more thing… Who should do what? #Devoxx #BeyondMinikube @LostInBrittany

Slide 69

Slide 69

Different roles Each role asks for very different knowledge and skill sets #Devoxx #BeyondMinikube @LostInBrittany

Slide 70

Slide 70

Most companies don’t need to operate the clusters As they don’t build and rack their own servers! #Devoxx #BeyondMinikube @LostInBrittany

Slide 71

Slide 71

If you don’t need to build it, choose a certified managed solution You get the cluster, the operator get the problems #Devoxx #BeyondMinikube @LostInBrittany

Slide 72

Slide 72

Like our OVH Managed Kubernetes Made with 💗 by the Platform team #Devoxx #BeyondMinikube @LostInBrittany

Slide 73

Slide 73

Do you want to try? Send me an email to get some vouchers… horacio.gonzalez@corp.ovh.com #Devoxx #BeyondMinikube @LostInBrittany

Slide 74

Slide 74

Thank you for listening That’s all, folks! #Devoxx #BeyondMinikube @LostInBrittany