-
Notifications
You must be signed in to change notification settings - Fork 20
/
05.Rehearsal.txt
364 lines (326 loc) · 8.36 KB
/
05.Rehearsal.txt
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
ex1.
Basic pod, namespace
https://github.com/fahmifahim/kubernetes/blob/master/01.CKAD_exam_concepts_practices.md#exercise-1
$ kubectl create namespace ckad-prep
ex2.
ConfigMap with environment file
https://github.com/fahmifahim/kubernetes/blob/master/01.CKAD_exam_concepts_practices.md#exercise-2-configmap
$ kubectl create configmap db-config --from-env-file=config.txt
$ vim pod.yaml (to use configmap)
spec:
containers:
- image: ...
name: ...
envFrom:
- configMapRef:
name: db-config
# if you need to set specific variable name (eg. VARIABLE_NAME) and get the values from ConfigMap key:
spec:
containers:
- name:
image:
env:
- name: VARIABLE_NAME
valueFrom:
configMapKeyRef:
name: db-config #configmap name
key: variable-name #variable from ConfigMap
# if you need to mount the ConfigMap to specific path (/somepath) on Container:
spec:
volumes:
- name: cm-ref
configMap:
name: db-config
- name: secret-ref
secret:
secretName: mysecret
containers:
- name: ...
image: ...
volumeMounts:
- name: cm-ref
mountPath: /somepath
- name: secret-ref
mountPath: /somepath2
ex3.
Secret (keyword: distribute credentials securely using secret)
https://github.com/fahmifahim/kubernetes/blob/master/01.CKAD_exam_concepts_practices.md#exercise-3-secret
$ kubectl create secret generic db-credentials --from-literal=db-user-name='user1'
$ kubectl create secret generic db-credentials2 --from-literal=db-pwd='password'
$ vim pod.yaml (use secret in the pod as environment)
spec:
containers:
- name: ...
image: ...
env:
- name: DB_USERNAME # desired variable at the
valueFrom:
secretKeyRef:
name: db-credentials # name of declared secret
key: db-username # name of key inside the secret
- name: DB_PASSWORD
valueFrom:
secretKeyRef:
name: db-credentials
key: db-pwd
# if you want to use all the keys inside the secret:
spec:
containers:
- name: ...
image: ...
envFrom:
- secretRef:
name: db-credentials # the env variable will be `db-user`. method same as ConfigMap
ex4.
SecurityContext
https://github.com/fahmifahim/kubernetes/blob/master/01.CKAD_exam_concepts_practices.md#exercise-4-security-context
$ vim pod.yaml (define security context in pod )
spec:
securityContext:
runAsUser: 1000
runAsGroup: 3000
fsGroup: 2000
volumes:
- name: security-ctx-vol # volume to apply the security context rules
emptyDir: {}
containers:
- name: ...
image: ...
volumeMounts:
- name: security-ctx-vol # must match the security context-ed volume
mountPath: /data/app # path of directory inside container
# add capability security context only at a single container
spec:
containers:
- name: ...
image: ...
securityContext:
capabilities:
add: ["NET_ADMIN", "SYS_TIME"]
ex5.
ResourceQuota
https://kubernetes.io/docs/tasks/administer-cluster/manage-resources/quota-memory-cpu-namespace/
$ vim quota.yaml
apiVersion: v1
kind: ResourceQuota
metadata:
name: mem-cpu-quota
spec:
hard:
pods: "5"
requests.cpu: "2"
requests.memory: 1Gi
limits.cpu: "3"
limits.memory: 2Gi
# Define pod with resource quota
spec:
containers:
- name: ...
image: ...
resources:
requests:
cpu: "500m"
memory: "100Mi"
limits:
cpu: "800m"
memory: "200Mi"
# Check resource quota in specific namespace
$ kubectl get quota
$ kubectl describe quota
# List pod based on its used quota
$ kubectl top pod <pod-name> --containers
ex6.
Service Account
https://kubernetes.io/docs/reference/access-authn-authz/service-accounts-admin/
# Create service account
$ kubectl create serviceaccount backend-team
# Create pod with specific service accoun
$ kubectl run test-pod1 --image nginx --restart Never --serviceaccount backend-team
$ kubectl exec -it test-pod1 -- bash
$ cat /var/run/secrets/kubernetes.io/serviceaccount/token
ex7.
InitContainer
https://kubernetes.io/docs/concepts/workloads/pods/init-containers/
# Define Init Container:
spec:
volumes:
- name: config-dir
emptyDir: {}
initContainers:
- image: ...
name: ...
volumeMounts:
- name: config-dir
mountPath: /test/dir
command:
- wget
- -O
- /usr/shared/app/config.json
- https://raw.githubusercontent.com/bmuschko/ckad-crash-course/master/exercises/07-creating-init-container/app/config/config.json
containers:
- image: ...
name: ...
ports:
- containerPort: 8080
volumeMounts:
- name: config-dir
mountPath: /test/dir
!! wget command
$ kubectl run TEST --image busybox --restart Never --dry-run -o yaml --command -- wget -O test.json www.ibm.com/test.json
# YAML format:
command:
- wget
- -O
- test.json
- www.ibm.com/test.json
ex8.
AdapterContainer
$ kubectl run TEST --image busybox --restart Never --dry-run -o yaml -- /bin/sh -c 'while true; do echo Hello World; sleep 30; done'
# YAML format:
args:
- /bin/sh
- -c
- while true; do echo Hello World; sleep 30; done
spec:
containers:
- name: app
image: busybox
args:
- /bin/sh
- -c
- while true; do echo "$(date) | $(du -sh ~)" >> /var/logs/diskspace.txt; sleep 5; done;
- name: transformer
image: busybox
args:
- /bin/sh
- -c
- sleep 20; while true; do while read LINE; do echo "$LINE" | cut -f2 -d"|" >> $(date +%Y-%m-%d-%H-%M-%S)-transformed.txt; done < /var/logs/diskspace.txt; sleep 20; done;
ex9.
Liveness Readiness Probe
https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/
spec:
containers:
ports:
- name: nodejs-port
containerPort: 3000
livenessProbe:
httpGet:
path: /
port: nodejs-port
initialDelaySeconds: 3
periodSeconds: 5
readinessProbe:
httpGet:
path: /healthz
port: nodejs-port
livenessProbe:
exec:
command:
- ls
initialDelaySeconds: 5
periodSeconds: 10
ex10.
Debugging misconfigured pod
ex11.
Labels Annotations
$ kubectl get pods --show-labels
$ kubectl label pods <name> label-key=label-value
$ kubectl annotate pods <name> annotation-key=annotation-value
ex12.
Deployment
$ kubectl create deployment <name> --image nginx
$ kubectl set image deployment <name> nginx=nginx:latest --record
$ kubectl rollout history deployment <name> --revision=2
$ kubectl rollout status deployment <name>
$ kubectl scale deployment <name> --replicas 5
ex13.
CronJob
# YAML format for Cronjob
apiVersion: batch/v1beta1
kind: CronJob
metadata:
name: hello
spec:
schedule: "*/1 * * * *"
jobTemplate:
spec:
activeDeadlineSeconds: 65 # set this parameter to automatically terminate job after waiting for 65 seconds
template:
spec:
containers:
- name: hello
image: busybox
args:
- /bin/sh
- -c
- date; echo Hello from the Kubernetes cluster
restartPolicy: OnFailure
ex15.
Network Policy
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: app-stack-network-policy
namespace: app-stack
spec:
podSelector:
matchLabels:
tier: database
policyTypes:
- Ingress
ingress:
- from:
- podSelector:
matchLabels:
tier: backend
ports:
- protocol: TCP
port: 3306
ex16.
Persistent Volume and Claim
# Declare PV in advance
apiVersion: v1
kind: PersistentVolume
metadata:
name: pv
labels:
id: vol1
spec:
storageClassName: shared
capacity:
storage: 1Mi
accessModes:
- ReadWriteMany
hostPath:
path: "/data/config"
# Declare PVC to bind with the PV
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: pvc
spec:
storageClassName: shared
accessModes:
- ReadWriteMany
resources:
requests:
storage: 1Mi
selector:
matchLabels:
id: vol1
# Declare pod to use the PVC
apiVersion: v1
kind: Pod
metadata:
name: app
spec:
volumes:
- name: task-pv-storage
persistentVolumeClaim:
claimName: pvc
containers:
- name: app
image: nginx
volumeMounts:
- mountPath: "/var/app/config"
name: task-pv-storage