Kubernetes: beyond Minikube

A presentation at Webinar Codemotion in February 2020 in by Horacio Gonzalez

Slide 1

Slide 1

2020-02-20 WEBINAR

Slide 2

Slide 2

2020-02-20 Kubernetes: beyond Minikube Horacio Gonzalez @LostInBrittany

Slide 3

Slide 3

Who are we? Introducing myself and introducing OVH OVHcloud

Slide 4

Slide 4

Horacio Gonzalez @LostInBrittany Spaniard lost in Brittany, developer, dreamer and all-around geek Flutter

Slide 5

Slide 5

OVHcloud: A Global Leader 250k Private cloud VMs running 1 Dedicated IaaS Europe 30 Datacenters Own 20Tbps Hosting capacity : 1.3M Physical Servers 360k Servers already deployed Netwok with 35 PoPs

1.3M Customers in 138 Countries

Slide 6

Slide 6

OVHcloud: Our solutions Cloud Web Hosting Mobile Hosting Telecom VPS Containers ▪ Dedicated Server Domain names VoIP Public Cloud Compute ▪ Data Storage Email SMS/Fax Private Cloud ▪ Network and Database CDN Virtual desktop Serveur dédié Security Object Storage Web hosting Cloud HubiC Over theBox ▪ Licences Cloud Desktop Securities MS Office Hybrid Cloud Messaging MS solutions

Slide 7

Slide 7

Orchestrating containers Like herding cats… but in hard mode!

Slide 8

Slide 8

From bare metal to containers Another paradigm shift

Slide 9

Slide 9

Containers are easy… For developers

Slide 10

Slide 10

Less simple if you must operate them Like in a production context

Slide 11

Slide 11

And what about microservices? Are you sure you want to operate them by hand?

Slide 12

Slide 12

Taming microservices with Kubernetes

Slide 13

Slide 13

Kubernetes Way more than a buzzword!

Slide 14

Slide 14

Masters and nodes

Slide 15

Slide 15

Some more details

Slide 16

Slide 16

Desired State Management

Slide 17

Slide 17

Extending Kubernetes

Slide 18

Slide 18

Multi-environment made easy Dev, staging, prod, multi-cloud…

Slide 19

Slide 19

Declarative infrastructure Multi-environment made easy

Slide 20

Slide 20

Having identical, software defined environments

Slide 21

Slide 21

I have deployed on Minikube, woah! A great fastlane into Kubernetes

Slide 22

Slide 22

Running a full K8s in your laptop A great learning tool

Slide 23

Slide 23

Your laptop isn’t a true cluster Don’t expect real performances

Slide 24

Slide 24

Beyond the first deployment So I have deployed my distributed architecture on K8s, everything is good now, isn’t it?

Slide 25

Slide 25

Minikube is only the beginning

Slide 26

Slide 26

From Minikube to prod A journey not for the faint of heart

Slide 27

Slide 27

Kubernetes can be wonderful For both developers and devops

Slide 28

Slide 28

But it comes with a price…

Slide 29

Slide 29

Describing some of those traps To ease and empower your path to production

Slide 30

Slide 30

The truth is somewhere inside…

Slide 31

Slide 31

The network is going to feel it…

Slide 32

Slide 32

The storage dilemma

Slide 33

Slide 33

The ETCD vulnerability

Slide 34

Slide 34

Security Hardening your Kubernetes

Slide 35

Slide 35

The security journey

Slide 36

Slide 36

Kubernetes is insecure by design It’s a feature, not a bug. Up to K8s admin to secure it according to needs

Slide 37

Slide 37

Not everybody has the same security needs

Slide 38

Slide 38

Kubernetes allows to enforce security practices as needed

Slide 39

Slide 39

Listing some good practices

Slide 40

Slide 40

Close open access Close all by default, open only the needed ports Follow the least privileged principle

Slide 41

Slide 41

Define and implement RBAC According to your needs

Slide 42

Slide 42

Define and implement network policies

Slide 43

Slide 43

Use RBAC and Network Policies to isolate your sensitive workload

Slide 44

Slide 44

Always keep up to date Both Kubernetes and plugins

Slide 45

Slide 45

And remember, even the best can get hacked Remain attentive, don’t get too confident

Slide 46

Slide 46

Extensibility Enhance your Kubernetes

Slide 47

Slide 47

Kubernetes is modular Let’s see how some of those plugins can help you

Slide 48

Slide 48

Helm A package management for K8s

Slide 49

Slide 49

Complex deployments

Slide 50

Slide 50

Using static YAML files

Slide 51

Slide 51

Complex deployments

Slide 52

Slide 52

Istio A service mesh for Kubernetes… and much more!

Slide 53

Slide 53

Istio: A service mesh… but not only

Slide 54

Slide 54

Service discovery

Slide 55

Slide 55

Traffic control

Slide 56

Slide 56

Encrypting internal communications

Slide 57

Slide 57

Routing and load balancing

Slide 58

Slide 58

Rolling upgrades

Slide 59

Slide 59

Rolling upgrades

Slide 60

Slide 60

Rolling upgrades

Slide 61

Slide 61

Rolling upgrades

Slide 62

Slide 62

Rolling upgrades

Slide 63

Slide 63

Rolling upgrades

Slide 64

Slide 64

Rolling upgrades

Slide 65

Slide 65

Rolling upgrades

Slide 66

Slide 66

Rolling upgrades

Slide 67

Slide 67

A/B testing

Slide 68

Slide 68

Monitoring your cluster

Slide 69

Slide 69

Velero Backing up your Kubernetes

Slide 70

Slide 70

Kubernetes: Desired State Management

Slide 71

Slide 71

YAML files allows to clone a cluster

Slide 72

Slide 72

But what about the data?

Slide 73

Slide 73

Velero Backup and migrate Kubernetes applications and their persistent volumes

Slide 74

Slide 74

S3 based backup On any S3 protocol compatible store

Slide 75

Slide 75

Backup all or part of a cluster

Slide 76

Slide 76

Schedule backups

Slide 77

Slide 77

Backups hooks

Slide 78

Slide 78

Conclusion And one more thing…

Slide 79

Slide 79

Kubernetes is powerful It can make Developers’ and DevOps’ lives easier

Slide 80

Slide 80

But there is a price: operating it Lot of things to think about

Slide 81

Slide 81

We have seen some of them

Slide 82

Slide 82

One more thing… Who should do what?

Slide 83

Slide 83

Different roles Each role asks for very different knowledge and skill sets

Slide 84

Slide 84

Most companies don’t need to operate the clusters As they don’t build and rack their own servers!

Slide 85

Slide 85

If you don’t need to build it, choose a certified managed solution You get the cluster, the operator get the problems

Slide 86

Slide 86

Like our OVH Managed Kubernetes Made with 💗 by the Platform team

Slide 87

Slide 87

Do you want to try? Send me an email to get some vouchers… horacio.gonzalez@corp.ovh.com

Slide 88

Slide 88

Thank you for listening