SlideShare uma empresa Scribd logo
1 de 38
Baixar para ler offline
Evolution of Containers to
Krishna Kumar, CNCF Ambassador India & Shivram Srivastava, Open Source Maintainer k8s
A presentation at
Contents & pictures are taken from the web; Will be used for education purpose only 
Contents
• Evolution of Containers!
• LXC to Docker …
• Kubernetes
• Architecture
• Components
• Use cases
• More…
Where does all it comes from?
• LXC (LinuX Containers) was the first, most complete implementation of
Linux container manager. It was implemented in 2008 using cgroups
and Linux namespaces, and it works on a single Linux kernel without
requiring any patches. early stages and later replacing it with its own
implementation.
• The LXC containers that are now part of every Linux distribution were
founded on Google’s work in 2006 -
https://linuxacademy.com/blog/containers/history-of-container-
technology/
• When Docker emerged in 2013, containers exploded in popularity. It’s no
coincidence the growth of Docker and container use goes hand-in-
hand. Docker used LXC in its initial stages and later replaced that container
manager with its own library, libcontainer. But there’s no doubt that
Docker separated itself from the pack by offering an entire ecosystem for
container management.
• Brief history of Containers - https://dzone.com/articles/evolution-of-
linux-containers-future
https://content.pivotal.io/infographics/moments-in-container-history
Container Evolution: Moving from Chroot to Namespaces
chroot
 Chroot jails were the earliest isolation
mechanisms. Chroot offers file system
level abstraction and prevents
applications from interfering with each
other.
 There was problem with chroot: The
chroot can be broken by root users.
Applications in different namespaces
could still interfere in many ways. Also
Start some programs (with some
overlapping name) from two shells
chrooted to two different directories.
Execute ps –ef | grep “<overlapping
portion>” from one bash shell and kill
all the PID’s corresponding to the
matching results (a typical termination
program), will kill program in other
bash shell.
5
namespaces
 The name spaces are IPC, PID, hostname, User,
Mount, network
 Application isolation by manipulate certain system
attributes - e.g: clone(), unshared(), setns(), execute the
bash shell in separate PID, mount proc file system
namespaces, kill the init process of the child
namespace, etc.
Container Evolution: cgroups – Resource Limiting
• Handles resource quota allocation. It associates “subsystems” – which are kernel modules
that meter the system resources such as (cpu and memory) to “hierarchies of ‘cgroups’” –
which are user-defined rules to restrict resource usage of processes. Some of the cgroup
subsystems are:
o blkio — this subsystem sets limits on input/output access to and from block devices
such as physical drives (disk, solid state, or USB).
o cpu — this subsystem uses the scheduler to provide cgroup tasks access to the CPU.
o cpuacct — this subsystem generates automatic reports on CPU resources used by
tasks in a cgroup.
o cpuset — this subsystem assigns individual CPUs (on a multicore system) and
memory nodes to tasks in a cgroup.
o devices — this subsystem allows or denies access to devices by tasks in a cgroup.
o freezer — this subsystem suspends or resumes tasks in a cgroup.
o memory — this subsystem sets limits on memory use by tasks in a cgroup and
generates automatic reports on memory resources used by those tasks.
o net_cls — this subsystem tags network packets with a class identifier (classid) that
allows the Linux traffic controller (tc) to identify packets originating from a particular
cgroup task.
o net_prio — this subsystem provides a way to dynamically set the priority of network
traffic per network interface.
o ns — the namespace subsystem.
o perf_event — this subsystem identifies cgroup membership of tasks and can be used
for performance analysis.
6
A cgroup example:
Container Evolution: LXC Architecture
7
- LXC abstracts the complexities of configuring the cgroups
and namespaces and helps to automate the process.
- LXC (Linux Containers) is an operating-system-level
virtualization method for running multiple isolated Linux
systems (containers) on a control host using a single Linux
kernel. “LXC” refers to capabilities of the Linux kernel (specifically
namespaces and control groups) which allow sandboxing
processes from one another, and controlling their resource
allocations.
- Kernel features for containers: Isolated Namespaces: (Audit,
System, Device, Time, Taskcount), Watch mount points, root level
permissions, file system read only privilege for Copy-on-write, Use
resource limitation feature, Avoid running container with User ID
= 0; harden OS,
Major Container Types….
Docker: The most popular container OS - a lightweight, portable, self sufficient LXC container that can run virtually anywhere. It has layered container
image, global container registry, Cluster management, CLI/Rest API connections.
Rocket: From CoreOS/RedHat, Rocket has more rigorous security, app container specifications. Also developed flannel, etcd to support container
orchestration.
Photon: Photon OS is a minimal Linux container host, optimized to run on VMware platforms. Compatible withDocker, and Kubernetes.
Garden: From Pivotal Cloud Foundry. Garden (Warden) is a platform-agnostic Go API for container creation and management, with pluggable back ends
for different platforms and runtimes.
Mesos Containers: MesosContainerizer provides lightweight containerization and resource isolation of executors using Linux-specific functionality such
as control cgroups and namespaces.
Windows Containers: Two different run times - Windows Server Containers which uses shared kernel space and Hyper-V Isolation Containers which run
each container in a optimized virtual machine (e.g: Windows 10 containers)
IBM Nabla Container: Cut down OS system calls to a bare minimum with as little code as possible. This is expected to decrease the surface area available
for an attack. Make use of Library OS (unikernel techniques) and use only 9 system calls; the rest are blocked through linux seccomp policy.
Google gVisor: User-space kernel, written in Go, that implements a substantial portion of the Linux system surface. It includes an OCI runtime
called runsc that provides an isolation boundary between the application and the host kernel.
Kata Containers: standard implementation of lightweight Virtual Machines (VMs) that feel and perform like containers, but provide the workload
isolation and security advantages of VMs. It is designed to be architecture agnostic, run on multiple hypervisors and be compatible with the OCI.
ConrtainerD: It is an industry-standard core container runtime available as a daemon for Linux and Windows, which can manage the complete container
lifecycle of its host system. It uses runC to run containers according to the OCI specification.
OCI: Open Container Initiative -currently contains two specifications: the Runtime Specification (runtime-spec) and the Image Specification (image-spec).
The Runtime Specification outlines how to run a “filesystem bundle” that is unpacked on disk. At a high-level an OCI implementation would download an
OCI Image then unpack that image into an OCI Runtime filesystem bundle. 8
Container Platform - Docker
 Docker is a platform and tool for building, distributing,
and running container.
 Docker means a person who docks, shipping docks.
 Docker Inc is a private company which handles all
aspects of Docker. https://www.docker.com/
 Docker's open source components are
generally licensed under the Apache 2.0 license. Written in
GO language.
 Docker also has Enterprise commercial product.
 In 2008, Solomon Hykes and few others started
dotcloud and eventually it becomes Docker, Inc. the
company revolutionize the cloud industry.
9
How to Build Docker Image
• An image is an inert, immutable, file that's
essentially a snapshot of a
container.Images are created with the build
command, and they'll produce a container
when started with run. Images are stored in
a Docker registry such as
registry.hub.docker.com
• Docker can build images automatically by
reading the instructions from a Dockerfile, a
text document that contains all the
commands you would normally execute
manually in order to build a Docker image.
• https://docs.docker.com/engine/reference/co
mmandline/images/
12
 FROM keyword tells which image is your image based on
 COPY instruction copies new files/directories from <src> and
adds to the filesystem of the container at the path <dest>
 EXPOSE listens on the specified network ports at runtime
(does not make the ports of the container accessible to the
host)
 CMD provide defaults for an executing container. There can be
only one cmd in a Dockerfile. If multiple CMDs are there, then
only the last cmd will take effect
 To build the image name “nginx:latest_image “ from current
directory where dockerfile is residing; run
docker build –t nginx:latest_image .
Sample Docker File
Docker Registry
• Create an account in Docker Hub. Push the image which you tagged. Docker hub account would contain the pushed image.
• One can pull the image and run a container using the image.
• https://docs.docker.com/registry/
• https://blog.octo.com/en/docker-registry-first-steps/
13
Docker CI/CD pipeline
• https://success.docker.com/article/dev-pipeline
14
Developer workflow
Ops workflow
15https://www.docker.com/sites/default/files/Docker_CheatSheet_08.09.2016_0.pdf
From Virtualization to Cloud Native
16
Containers
Cloud
Native
Open
Source
IaaS
PaaS
Open
Source
PaaS
Virtualiza-
tion
2000 2001 2006 2009 2010 2011
Non-
Virtualized
Hardware
2013 2015
IaaS
Container Orchestration Engines
 Kubernetes is a orchestration system for running Docker and
other containers.
 Some other leading container orchestration Engines (like Kubernetes):
 Mesosphere Mesos
 Docker Swarm
 Hashicorp Nomad
 Netflix Titus
 Racher Cattle
 Pivotal Cloud Foundry
 Amazon ECS
 Deis (Microsoft acquired it)
 Cisco Mantl
 Kontena Pharos
 https://medium.freecodecamp.org/how-to-choose-the-right-container-orchestration-and-how-to-deploy-it-41844021c241
CNCF is an open source software foundation (under Linux foundation) dedicated to making cloud native computing universal and sustainable. Cloud
native computing uses an open source software stack to deploy applications as microservices, packaging each part into its own container, and
dynamically orchestrating those containers to optimize resource utilization. Cloud native technologies enable software developers to build great
products faster. The following projects are under the foundation:
18
• Platinum members:
Orchestration
Incubating Sandbox
Service
Mesh
Storage
Networking
API
Service
Discovery
Distributed
Tracing
Service Mesh
Software
Update Spec
StorageSecurity
Logging Remote
Procedure Call
Monitoring
Distributed
Tracing API
Container
Runtime
Messa
ging
Iden
tity
Spec
Identit
y
Poli
cy
Graduated
Server
less Tooling
Container
Runtime
Package
Manageme
nt
Harbor
Registry
Open
Metrics
TIKV
Key-Value
Store
19
20
21
Evolution of Kubernetes!!
• Borg – original paper -
https://static.googleusercontent.com/media/research.google.com/en//pubs/archive/43438.pd
f
• Omega – original paper -
https://static.googleusercontent.com/media/research.google.com/en//pubs/archive/41684.pd
f
• Borg: The Predecessor to Kubernetes - https://kubernetes.io/blog/2015/04/borg-predecessor-
to-kubernetes/
• Lessons learned from three container management system over a decade at Google - Borg,
Omega, and Kubernetes - https://storage.googleapis.com/pub-tools-public-publication-
data/pdf/44843.pdf
• Kubernetes (κυβερνήτης, Greek for "governor", "helmsman" or "captain") was founded by Joe
Beda, Brendan Burns and Craig McLuckie, was quickly joined by other Google engineers
including Brian Grant and Tim Hockin, and was first announced by Google in mid-2014.
• Kubernetes is also referred to as k8s, as there are 8 characters between k and s.
• Kubernetes celebrates its birthday every year on 21st July. Kubernetes 1.0 was released on July
21 2015. Generally licensed under the Apache 2.0 license. Written in GO language.
• In July 2015, Google along with Twitter, IBM, Intel, Cisco, and Goldman Sachs, among others
announced creating CNCF and inducted kubernetes as the first project in it.
• Aug 2018, Google sets Kubernetes free with $9m in its pocket for expenses - Google shifting
the ownership of Kubernetes cloud resources to CNCF.
“Kubernetes is an open-source system for automating deployment, scaling, and
management of containerized applications. It groups containers that make up an
application into logical units for easy management and discovery.”
K8s - Main features
23
• Open source & run anywhere
• Group containers in to logical units
• Easy management & Discovery
• Self healing
• Scaling – Planet size (billions of containers in a week)
• Serverless with server
• Optimize resource usage
• Multi Clouds
 Automatic bin-packing
Kubernetes automatically schedules the containers based on resource usage and constraints, without sacrificing the availability.
 Self-healing
Kubernetes automatically replaces and reschedules the containers from failed nodes. It also kills and restarts the containers which do not respond to health checks, based on
existing rules/policy.
 Horizontal scaling
Kubernetes can automatically scale applications based on resource usage like CPU and memory. In some cases, it also supports dynamic scaling based on customer metrics.
 Service discovery and Load balancing
Kubernetes groups sets of containers and refers to them via a Domain Name System (DNS). This DNS is also called a Kubernetes service. Kubernetes can discover these services
automatically, and load-balance requests between containers of a given service
 Automated rollouts and rollbacks
Kubernetes can roll out and roll back new versions/configurations of an application, without introducing any downtime.
 Secrets and configuration management
Kubernetes can manage secrets and configuration details for an application without re-building the respective images. With secrets, we can share confidential information to
our application without exposing it to the stack configuration, like on GitHub.
 Storage orchestration
With Kubernetes and its plugins, we can automatically mount local, external, and storage solutions to the containers in a seamless manner, based on software-defined storage
(SDS).
 Batch execution
Besides long running jobs, Kubernetes also supports batch execution.
Every 3 months there is one release.
https://kubernetes.io/docs/setup/release/
notes/
K8s Architecture
One or more master nodes
One or more worker nodes
Distributed key-value store, like etcd
https://kubernetes.io/docs/concepts/
https://kubernetes.io/docs/home/
https://www.slideshare.net/RedHatDevelopers/kubernetes-introduction-86540172 24
Pod Concept…
25
• Pod – Multiple containers share
IP/storagevolume/resources/secrets/
labels/Lifecycle – Define as a YAML
• Service – Groups of pods act as one
service with IP and DNS name
• Label – Key/value pair associated
with k8s objects like Pod.
• https://kubernetes.io/docs/concepts
/workloads/pods/pod-overview/
26
 The master node is responsible for managing the Kubernetes cluster, and it
is the entry point for all administrative tasks.
1. API server
2. Scheduler
3. Controller manager
4. etcd.
 A worker node is a machine (VM, physical server, etc.) which runs the
applications using Pods and is controlled by the master node. Pods are
scheduled on the worker nodes, which have the necessary tools to run and
connect them. A Pod is the scheduling unit in Kubernetes. It is a logical
collection of one or more containers which are always scheduled together.
To run and manage a container's lifecycle, we need a container runtime on
the worker node. Some container runtimes are: containerd, rkt, lxd, docker.
We will explore them further in later chapters.
1. Container runtime
2. kubelet
3. kube-proxy
 kubectl – Command Line interface (CLI)
K8s Components
Master Node Components
27
1. API server
• All the administrative tasks are performed via the API
server within the master node. A user/operator sends REST
commands to the API server, which then validates and
processes the requests. After executing the requests, the
resulting state of the cluster is stored in the distributed key-
value store.
2. Scheduler
• schedules the work to different worker nodes. The scheduler
has the resource usage information for each worker node. It
also knows about the constraints that users/operators may
have set, such as scheduling work on a node that has the
label disk==ssd set. Before scheduling the work, the scheduler
also takes into account the quality of the service requirements,
data locality, affinity, anti-affinity, etc. The scheduler schedules
the work in terms of Pods and Services.
3. Controller manager
• Manages different non-terminating control loops, which
regulate the state of the Kubernetes cluster. Each one of these
control loops knows about the desired state of the objects it
manages, and watches their current state through the API
server. In a control loop, if the current state of the objects it
manages does not meet the desired state, then the control
loop takes corrective steps to make sure that the current state
is the same as the desired state.
4. etcd
• Is a distributed key-value store which is used to store the
cluster state. It can be part of the Kubernetes Master, or, it can
be configured externally, in which case, master nodes would
connect to it.
K8s etcd – more.…
28
• State Management with etcd
• Kubernetes uses etcd to store the cluster state.
• etcd is a distributed key-value store based on the Raft
Consensus Algorithm.
• Raft allows a collection of machines to work as a coherent
group that can survive the failures of some of its members.
• At any given time, one of the nodes in the group will be the
master, and the rest of them will be the followers. Any node
can be treated as a master
• etcd is written in the Go programming language.
• In Kubernetes, besides storing the cluster state, etcd is also
used to store configuration details such as subnets,
ConfigMaps, Secrets, etc.
Worker Node Components
29
1. The kubelet is an agent which runs on each worker node and
communicates with the master node. It receives the Pod definition via
various means (primarily, through the API server), and runs the
containers associated with the Pod. It also makes sure that the
containers which are part of the Pods are healthy at all times. The
kubelet connects to the container runtime using Container Runtime
Interface (CRI).
2. The Container Runtime Interface consists of protocol buffers, gRPC
API, and libraries.
3. Kube-proxy Instead of connecting directly to Pods to access the
applications, we use a logical construct called a Service as a
connection endpoint. A Service groups related Pods and, when
accessed, load balances to them. kube-proxy is the network proxy
which runs on each worker node and listens to the API server for each
Service endpoint creation/deletion. For each Service endpoint, kube-
proxy sets up the routes so that it can reach to it.
1. dockershim
• With dockershim, containers are created using Docker installed on the
worker nodes. Internally, Docker uses containerd to create and manage
containers.
2. cri-containerd
• With cri-containerd, we can directly use Docker's smaller offspring
containerd to create and manage containers
3. CRI-O
• CRI-O enables using any Open Container Initiative (OCI) compatible
runtimes with Kubernetes. Supports runC and Clear Containers as
container runtimes now.
Kubectl
• kubectl create -f is what we call Imperative
Management. On this approach you tell the
Kubernetes API what you want to create, replace
or delete, not how you want your K8s cluster
world to look like.
• kubectl apply is part of the Declarative
Management approach, where changes that you
may have applied to a live object (i.e. through
scale) are maintained even if you apply other
changes to the object.
• https://kubernetes.io/docs/reference/kubectl/o
verview/
30
31
https://dzone.com/articles/kubectl-commands-cheat-sheet
32
PaaS
• Kel
• WSO2
• Rancher
• OpenShift Origin (OKD)
• OpenShift
Online/Dedicated/Container Platform
• Eldarion Cloud
• Alauda Container Platform
• Hasura
• teresa
• Containerum
Serverless
• Funktion
• Fission
• Kubeapps Kubeless
• OpenWhisk
• Iron.io
• OpenFaaS
• FaaS-netes
• Nuclio
• Virtual Kubelet
Custom Scheduler
• Scheduler - Cost based scheduler
• Sticky Node Scheduler
• ksched - Experimental flow based
scheduler
• escheduler - Written in elixir
• bashScheduler - Written in bash
Containers Supported
• Docker:
• Rkt
• Rktnetes
• rktlet
• containerd
• cri-containerd
• CRI-O (OCI)
• Hyper.sh/frakti
• virtlet
• infranetes
K8s environments…
Enterprise Products
• CoreOS Tectonic
• OpenShift - Container Platform
• SUSE Container as a Service
• Kubermatic
• Canonical Distribution of
Kubernetes - CDK
• IBM Cloud Private
Cluster Manager
• Cisco Container Platform
• Gardener -Kubermatic
• Rancher
• PKS
• Telekube
• Kqueen
Developer Platforms
• Fabric8
• Spring Cloud integration
• Mantl
• goPaddle
• VAMP
Private/Public clouds
• GKE
• AWS EKS
• Azure AKS
• Vsphere
• Alibaba Cloud
• Docker EE
• Platform9
• OpenShift Online
K8s - Storage & Networking
33
Persistent Volume Providers
• GCE
• AWS
• Rook
• Glusterfs
• OpenStack Cinder
• CephRBD
• QuoByte
• Kube-Aliyun
• Portworx
• Rancher Longhorn
• Stork
• OpenEBS
• StorageOS
Networking Stacks
• Weave Net
• Canal by Tigera
• OpenContrail
• Nuage
• Kuryr
• Contiv
• Calico
• OpenVSwitch
• Kube-router
• Cilium
• Linen
• CNI-Genie
• Romana
• Infoblox
• External DNS - To control DNS records dynamically via Kube
resources
• cni-ipvlan-vpc-k8s
• kubernetes-network-policy-recipes
• Multus-cni - Multi-homed pod cni
• Network-Controller - Open vSwitch, Multiple network interfaces that
associate with Kubernetes pods
• AWS VPC CNI - Networking plugin using Elastic Network Interfaces
• NSX-T - CNI plugin supporting load balancing and distributed
firewalls.
• Container Network Model (CNM) - proposed by Docker
• Container Network Interface (CNI) - proposed by CoreOS.
K8s - Installers & Monitoring
34
Installers
• Minikube - Run Kubernetes locally
• Kops - OS Agnostique - AWS
• Kube-deploy
• Kubeadm - OS Agnostique - Cloud Agnostique
• Kubespray - OS Agnostique - Cloud Agnostique
• Bootkube - CoreOS - Cloud Agnostique
• Kube-aws - CoreOS - AWS
• Kismatic - CentOS - Cloud Agnostique
• Juju - Ubuntu - Cloud Agnostique
• Terraform - CoreOS - AWS
• Supergiant - CoreOS - Cloud Agnostique
• Archon - OS Agnostique - Cloud Agnostique
• KubeNow - Ubuntu - Cloud Agnostique
• Kubicorn - OS Agnostique - Cloud Agnostique
• Simplekube - systemd OS - Cloud Agnostique
• Conjure-up - Ubuntu - Cloud Agnostique
• Kube-ansible - OS Agnostique - Cloud Agnostique
• Kubernetes-Saltstack - systemD OS - Cloud Agnostique
• matchbox - CoreOS - Network boot and provision Container Linux clusters
(e.g. etcd3, Kubernetes, more).
• RKE - OS Agnostique - Cloud Agnostique
• Typhoon - Container Linux - Cloud Agnostique
• Docker for Windows - Run Kubernetes and Docker locally on your Windows
PC (Edge Channel)
• Docker for MAC - Run Kubernetes and Docker locally on your MAC (Edge
Channel)
• MetalK8s - CentOS - On-Prem - Cloud Agnostique - Apache-2.0
Monitoring
• Console
• Datadog
• eventrouter - simple introspective kubernetes service that forwards events
to a specified sink.
• Grafana Kubernetes App
• Heapster
• Instana
• Kubebox - Terminal console for Kubernetes
• Kubedash
• Kubernetes Operational View - read-only system dashboard for multiple
K8s clusters
• Kubetail
• Kubewatch
• Netsil
• Outcold Solutions - monitoring Kubernetes, OpenShift and Docker in Splunk
Enterprise and Splunk Cloud (metrics and log forwarding)
• Prometheus
• Sysdig Monitoring
• Sysdig Open Source
• Weave Scope
• Searchlight
• Ingress Monitor Controller - A Kubernetes Controller to watch your
ingresses and create liveness alerts for your endpoints
K8s - more elements…
35
Operators
• Prometheus
• Kong API
• Kubernetes Operators
• K8s Operator Workshop
• Cert Operator
• Cert manager
• cert-manager
• Operator Kit
• Container Linux Update Operator
• DB Operator
• KubeVirt
• Operator SDK
• kooper - Simple Go library to create
Kubernetes operators and controllers
CI / CD
•Jenkins X - CI/CD for Kubernetes using
Jenkins
•kb8or
•Wercker
•Shippable
•GitLab
•Kontinuous
•Kit
•Spinnaker
•CircleCI
•KubeCI
•Vili
•Keel
•Apollo - Open Source application
providing teams with self service UI for
creating and deploying their services to
Kubernetes.
•Weave Flux – GitOps reconcoliation
operator
•Codefresh - Kubernetes CI/CD platform
(with private Docker and Helm Chart
repositories)
Some Related Software..
•Argo The Workflow Engine for
Kubernetes
•Hypernetes
•Kubernetes Cluster Federation
(previously Ubernetes)
•kmachine
•Kubefuse
•KubeSpray
•Kubernetes Ec2 Autoscaler
•Kubeform
•kube-openvpn
•Archon
•Client Libraries
•Kubic-Project
•Telepresence - Locally develop/debug
services against a remote Kubernetes
cluster
•Fission Workflows - Workflow-based
serverless function composition
•Ambassador - API Gateway built on the
Envoy Proxy
Kubernetes – use cases …..
36
https://thenewstack.io/ebooks/us
e-cases/use-cases-for-
kubernetes/
 Scaling services like large scale web applications for ecommerce
operation
 Stateful workloads – Zookeper, MySQL, etc.
 Serverless execution for short burst jobs (like AWS Lambda)
 Optimized resource usage with resource quota
 Hybrid and multi cloud scenarios
 Solution providers for CRM, ERP, etc.
 System Integrators for Enterprise/Legacy/Cloud
 Specific needs – Advanced routing, network scanners, etc.
 Kubernetes case studies - https://kubernetes.io/case-studies/
 And now gaining momentum in Big data, AI/ML, Block chain,
Robotics operations and so on, almost all areas of computing..
 The business case for running k8s -
https://thenewstack.io/containers-enable-companies-just-less/
K8s - Quick Setup
Setup - https://kubernetes.io/docs/setup/
MiniKube installation - https://github.com/kubernetes/minikube
https://kubernetes.io/docs/setup/independent/create-cluster-
kubeadm/
https://kubernetes.io/docs/setup/scratch/
Getting started -
http://containertutorials.com/get_started_kubernetes/index.html
Docker – k8s Lab: http://docker-k8s-lab.readthedocs.io/en/latest/
K8s in Google cloud Quick start -
https://cloud.google.com/kubernetes-engine/docs/quickstart
37
38
Demo Time……
K8s – more….
• K8s - The Hard Way - https://github.com/kelseyhightower/kubernetes-the-hard-way
• Software conformance certifications - https://kubernetes.io/blog/2017/10/software-conformance-
certification/
• CKA Certified Kubernetes Administrator) https://www.cncf.io/certification/cka/ & CKAD (Certified
Kubernetes Application Developer) - https://www.cncf.io/certification/ckad/
• Docker certification: DCA (Docker certified Associate Exam) - https://www.udemy.com/introduction-to-
docker-and-the-dca-certification/
• Intro k8s from CNCF - https://www.cncf.io/announcement/2017/07/10/linux-foundation-cncf-edx-org-
announce-new-free-intro-kubernetes-course/
• Kubernetes Fundamentals (LFS258) - https://training.linuxfoundation.org/training/kubernetes-
fundamentals/
• Microservices with k8s - https://in.udacity.com/course/scalable-microservices-with-kubernetes--ud615,
https://www.udemy.com/kubernetes-certified-administrator/
• Coursera courses - https://www.coursera.org/courses?query=kubernetes
• K8s deep dive & use cases - https://thenewstack.io/kubernetes-deep-dive-and-use-cases/
• K8s deep dive Altoros - https://www.altoros.com/training/kubernetes-deep-dive.html
• Redhat k8s deep dive - https://blog.openshift.com/kubernetes-deep-dive-api-server-part-1/
• VMWare test drive – k8s deep dive - https://kb.vmtestdrive.com/hc/en-us/articles/360001127513-
Kubernetes-Deep-dive
• Top tutorials - https://techbeacon.com/top-tutorials-mastering-kubernetes
• Cheat sheet - https://kubernetes.io/docs/reference/kubectl/cheatsheet/
• Illustrated Comic - https://cloud.google.com/kubernetes-engine/kubernetes-comic/
• Illustrated Children's Guide to Kubernetes- https://www.youtube.com/watch?v=4ht22ReBjno
39
https://github.com/ramitsurana/awesome-kubernetes
40
The best place to get all latest & meet the experts!!

Mais conteúdo relacionado

Mais procurados

Mais procurados (20)

Kubernetes Introduction
Kubernetes IntroductionKubernetes Introduction
Kubernetes Introduction
 
Kubernetes Basics
Kubernetes BasicsKubernetes Basics
Kubernetes Basics
 
Kubernetes Architecture
 Kubernetes Architecture Kubernetes Architecture
Kubernetes Architecture
 
Introduction to kubernetes
Introduction to kubernetesIntroduction to kubernetes
Introduction to kubernetes
 
Introduction to kubernetes
Introduction to kubernetesIntroduction to kubernetes
Introduction to kubernetes
 
Kubernetes for Beginners: An Introductory Guide
Kubernetes for Beginners: An Introductory GuideKubernetes for Beginners: An Introductory Guide
Kubernetes for Beginners: An Introductory Guide
 
Kubernetes - A Comprehensive Overview
Kubernetes - A Comprehensive OverviewKubernetes - A Comprehensive Overview
Kubernetes - A Comprehensive Overview
 
Kubernetes - introduction
Kubernetes - introductionKubernetes - introduction
Kubernetes - introduction
 
Introduction of Kubernetes - Trang Nguyen
Introduction of Kubernetes - Trang NguyenIntroduction of Kubernetes - Trang Nguyen
Introduction of Kubernetes - Trang Nguyen
 
Kubernetes Helm: Why It Matters
Kubernetes Helm: Why It MattersKubernetes Helm: Why It Matters
Kubernetes Helm: Why It Matters
 
Kubernetes Architecture | Understanding Kubernetes Components | Kubernetes Tu...
Kubernetes Architecture | Understanding Kubernetes Components | Kubernetes Tu...Kubernetes Architecture | Understanding Kubernetes Components | Kubernetes Tu...
Kubernetes Architecture | Understanding Kubernetes Components | Kubernetes Tu...
 
Kubernetes: A Short Introduction (2019)
Kubernetes: A Short Introduction (2019)Kubernetes: A Short Introduction (2019)
Kubernetes: A Short Introduction (2019)
 
Kubernetes
KubernetesKubernetes
Kubernetes
 
Kubernetes a comprehensive overview
Kubernetes   a comprehensive overviewKubernetes   a comprehensive overview
Kubernetes a comprehensive overview
 
Getting started with Docker
Getting started with DockerGetting started with Docker
Getting started with Docker
 
Docker introduction
Docker introductionDocker introduction
Docker introduction
 
Docker and kubernetes
Docker and kubernetesDocker and kubernetes
Docker and kubernetes
 
(Draft) Kubernetes - A Comprehensive Overview
(Draft) Kubernetes - A Comprehensive Overview(Draft) Kubernetes - A Comprehensive Overview
(Draft) Kubernetes - A Comprehensive Overview
 
Kubernetes Basics
Kubernetes BasicsKubernetes Basics
Kubernetes Basics
 
Kubernetes 101 for Beginners
Kubernetes 101 for BeginnersKubernetes 101 for Beginners
Kubernetes 101 for Beginners
 

Semelhante a Evolution of containers to kubernetes

Evolution of Linux Containerization
Evolution of Linux Containerization Evolution of Linux Containerization
Evolution of Linux Containerization
WSO2
 
Revolutionizing the cloud with container virtualization
Revolutionizing the cloud with container virtualizationRevolutionizing the cloud with container virtualization
Revolutionizing the cloud with container virtualization
WSO2
 

Semelhante a Evolution of containers to kubernetes (20)

Evolution of Linux Containerization
Evolution of Linux Containerization Evolution of Linux Containerization
Evolution of Linux Containerization
 
Evoluation of Linux Container Virtualization
Evoluation of Linux Container VirtualizationEvoluation of Linux Container Virtualization
Evoluation of Linux Container Virtualization
 
Revolutionizing the cloud with container virtualization
Revolutionizing the cloud with container virtualizationRevolutionizing the cloud with container virtualization
Revolutionizing the cloud with container virtualization
 
Accelerate your development with Docker
Accelerate your development with DockerAccelerate your development with Docker
Accelerate your development with Docker
 
Accelerate your software development with Docker
Accelerate your software development with DockerAccelerate your software development with Docker
Accelerate your software development with Docker
 
Docker Dojo
Docker DojoDocker Dojo
Docker Dojo
 
Dev opsec dockerimage_patch_n_lifecyclemanagement_2019
Dev opsec dockerimage_patch_n_lifecyclemanagement_2019Dev opsec dockerimage_patch_n_lifecyclemanagement_2019
Dev opsec dockerimage_patch_n_lifecyclemanagement_2019
 
SW Docker Security
SW Docker SecuritySW Docker Security
SW Docker Security
 
Containers and workload security an overview
Containers and workload security an overview Containers and workload security an overview
Containers and workload security an overview
 
Understanding the container landscape and it associated projects
Understanding the container landscape and it associated projectsUnderstanding the container landscape and it associated projects
Understanding the container landscape and it associated projects
 
Building Distributed Systems without Docker, Using Docker Plumbing Projects -...
Building Distributed Systems without Docker, Using Docker Plumbing Projects -...Building Distributed Systems without Docker, Using Docker Plumbing Projects -...
Building Distributed Systems without Docker, Using Docker Plumbing Projects -...
 
Academy PRO: Docker. Lecture 1
Academy PRO: Docker. Lecture 1Academy PRO: Docker. Lecture 1
Academy PRO: Docker. Lecture 1
 
Dev opsec dockerimage_patch_n_lifecyclemanagement_
Dev opsec dockerimage_patch_n_lifecyclemanagement_Dev opsec dockerimage_patch_n_lifecyclemanagement_
Dev opsec dockerimage_patch_n_lifecyclemanagement_
 
Containerize! Between Docker and Jube.
Containerize! Between Docker and Jube.Containerize! Between Docker and Jube.
Containerize! Between Docker and Jube.
 
Devoxx 2016: A Developer's Guide to OCI and runC
Devoxx 2016: A Developer's Guide to OCI and runCDevoxx 2016: A Developer's Guide to OCI and runC
Devoxx 2016: A Developer's Guide to OCI and runC
 
Containers in depth – Understanding how containers work to better work with c...
Containers in depth – Understanding how containers work to better work with c...Containers in depth – Understanding how containers work to better work with c...
Containers in depth – Understanding how containers work to better work with c...
 
Michigan IT Symposium 2017 - Container BOF
Michigan IT Symposium 2017 - Container BOFMichigan IT Symposium 2017 - Container BOF
Michigan IT Symposium 2017 - Container BOF
 
An introduction to contianers and Docker for PHP developers
An introduction to contianers and Docker for PHP developersAn introduction to contianers and Docker for PHP developers
An introduction to contianers and Docker for PHP developers
 
Diving Through The Layers: Investigating runc, containerd, and the Docker eng...
Diving Through The Layers: Investigating runc, containerd, and the Docker eng...Diving Through The Layers: Investigating runc, containerd, and the Docker eng...
Diving Through The Layers: Investigating runc, containerd, and the Docker eng...
 
Hack the whale
Hack the whaleHack the whale
Hack the whale
 

Mais de Krishna-Kumar

Mais de Krishna-Kumar (20)

SODA Ambassadors & Community Ecosystem
SODA Ambassadors & Community EcosystemSODA Ambassadors & Community Ecosystem
SODA Ambassadors & Community Ecosystem
 
Open Source Building Career and Competency
Open Source Building Career and CompetencyOpen Source Building Career and Competency
Open Source Building Career and Competency
 
CCICI CIP 1.0 Testbed - Security access implementation and reference - v1.0
CCICI CIP 1.0 Testbed - Security access implementation and reference - v1.0CCICI CIP 1.0 Testbed - Security access implementation and reference - v1.0
CCICI CIP 1.0 Testbed - Security access implementation and reference - v1.0
 
Google Anthos - Azure Stack - AWS Outposts :Comparison
Google Anthos - Azure Stack - AWS Outposts :ComparisonGoogle Anthos - Azure Stack - AWS Outposts :Comparison
Google Anthos - Azure Stack - AWS Outposts :Comparison
 
Cloud Native Use Cases / Case Studies - KubeCon 2019 San Diego - RECAP
Cloud Native Use Cases / Case Studies - KubeCon 2019 San Diego - RECAPCloud Native Use Cases / Case Studies - KubeCon 2019 San Diego - RECAP
Cloud Native Use Cases / Case Studies - KubeCon 2019 San Diego - RECAP
 
Cloud interoperability and open standards for digital india open infrasummit
Cloud interoperability and open standards for digital india open infrasummitCloud interoperability and open standards for digital india open infrasummit
Cloud interoperability and open standards for digital india open infrasummit
 
Google Cloud Container Security Quick Overview
Google Cloud Container Security Quick OverviewGoogle Cloud Container Security Quick Overview
Google Cloud Container Security Quick Overview
 
Kubernetes Application Deployment with Helm - A beginner Guide!
Kubernetes Application Deployment with Helm - A beginner Guide!Kubernetes Application Deployment with Helm - A beginner Guide!
Kubernetes Application Deployment with Helm - A beginner Guide!
 
KubeCon + CloudNativeCon Barcelona and Shanghai 2019 - Highlights
KubeCon + CloudNativeCon Barcelona and Shanghai 2019 - HighlightsKubeCon + CloudNativeCon Barcelona and Shanghai 2019 - Highlights
KubeCon + CloudNativeCon Barcelona and Shanghai 2019 - Highlights
 
Introduction to ieee standards development - Bangalore Section
Introduction to ieee standards development - Bangalore SectionIntroduction to ieee standards development - Bangalore Section
Introduction to ieee standards development - Bangalore Section
 
IEEE Standards Association - Introduction
IEEE Standards Association - IntroductionIEEE Standards Association - Introduction
IEEE Standards Association - Introduction
 
IoTShow.in Bangalore 2019 - a Recap on 'IoT and Edge' Talk.
IoTShow.in Bangalore 2019 - a Recap on 'IoT and Edge' Talk.IoTShow.in Bangalore 2019 - a Recap on 'IoT and Edge' Talk.
IoTShow.in Bangalore 2019 - a Recap on 'IoT and Edge' Talk.
 
Kubecon seattle 2018 recap - Application Deployment aspects
Kubecon seattle 2018 recap - Application Deployment aspectsKubecon seattle 2018 recap - Application Deployment aspects
Kubecon seattle 2018 recap - Application Deployment aspects
 
Open Source Edge Computing Platforms - Overview
Open Source Edge Computing Platforms - OverviewOpen Source Edge Computing Platforms - Overview
Open Source Edge Computing Platforms - Overview
 
cncf overview and building edge computing using kubernetes
cncf overview and building edge computing using kubernetescncf overview and building edge computing using kubernetes
cncf overview and building edge computing using kubernetes
 
My Ladakh Marathon Run 2018
My Ladakh Marathon Run 2018My Ladakh Marathon Run 2018
My Ladakh Marathon Run 2018
 
Now yoga - a study on where why what how
Now yoga  - a study on where why what howNow yoga  - a study on where why what how
Now yoga - a study on where why what how
 
CNCF Introduction - Feb 2018
CNCF Introduction - Feb 2018CNCF Introduction - Feb 2018
CNCF Introduction - Feb 2018
 
KubeCon USA 2017 brief Overview - from Kubernetes meetup Bangalore
KubeCon USA 2017 brief Overview - from Kubernetes meetup BangaloreKubeCon USA 2017 brief Overview - from Kubernetes meetup Bangalore
KubeCon USA 2017 brief Overview - from Kubernetes meetup Bangalore
 
Yoga for confused IT engineer
Yoga for confused IT engineerYoga for confused IT engineer
Yoga for confused IT engineer
 

Último

%+27788225528 love spells in new york Psychic Readings, Attraction spells,Bri...
%+27788225528 love spells in new york Psychic Readings, Attraction spells,Bri...%+27788225528 love spells in new york Psychic Readings, Attraction spells,Bri...
%+27788225528 love spells in new york Psychic Readings, Attraction spells,Bri...
masabamasaba
 
+971565801893>>SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHAB...
+971565801893>>SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHAB...+971565801893>>SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHAB...
+971565801893>>SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHAB...
Health
 
%+27788225528 love spells in Boston Psychic Readings, Attraction spells,Bring...
%+27788225528 love spells in Boston Psychic Readings, Attraction spells,Bring...%+27788225528 love spells in Boston Psychic Readings, Attraction spells,Bring...
%+27788225528 love spells in Boston Psychic Readings, Attraction spells,Bring...
masabamasaba
 
%+27788225528 love spells in Atlanta Psychic Readings, Attraction spells,Brin...
%+27788225528 love spells in Atlanta Psychic Readings, Attraction spells,Brin...%+27788225528 love spells in Atlanta Psychic Readings, Attraction spells,Brin...
%+27788225528 love spells in Atlanta Psychic Readings, Attraction spells,Brin...
masabamasaba
 
Abortion Pill Prices Tembisa [(+27832195400*)] 🏥 Women's Abortion Clinic in T...
Abortion Pill Prices Tembisa [(+27832195400*)] 🏥 Women's Abortion Clinic in T...Abortion Pill Prices Tembisa [(+27832195400*)] 🏥 Women's Abortion Clinic in T...
Abortion Pill Prices Tembisa [(+27832195400*)] 🏥 Women's Abortion Clinic in T...
Medical / Health Care (+971588192166) Mifepristone and Misoprostol tablets 200mg
 

Último (20)

%in ivory park+277-882-255-28 abortion pills for sale in ivory park
%in ivory park+277-882-255-28 abortion pills for sale in ivory park %in ivory park+277-882-255-28 abortion pills for sale in ivory park
%in ivory park+277-882-255-28 abortion pills for sale in ivory park
 
%+27788225528 love spells in new york Psychic Readings, Attraction spells,Bri...
%+27788225528 love spells in new york Psychic Readings, Attraction spells,Bri...%+27788225528 love spells in new york Psychic Readings, Attraction spells,Bri...
%+27788225528 love spells in new york Psychic Readings, Attraction spells,Bri...
 
8257 interfacing 2 in microprocessor for btech students
8257 interfacing 2 in microprocessor for btech students8257 interfacing 2 in microprocessor for btech students
8257 interfacing 2 in microprocessor for btech students
 
+971565801893>>SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHAB...
+971565801893>>SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHAB...+971565801893>>SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHAB...
+971565801893>>SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHAB...
 
Define the academic and professional writing..pdf
Define the academic and professional writing..pdfDefine the academic and professional writing..pdf
Define the academic and professional writing..pdf
 
%+27788225528 love spells in Boston Psychic Readings, Attraction spells,Bring...
%+27788225528 love spells in Boston Psychic Readings, Attraction spells,Bring...%+27788225528 love spells in Boston Psychic Readings, Attraction spells,Bring...
%+27788225528 love spells in Boston Psychic Readings, Attraction spells,Bring...
 
tonesoftg
tonesoftgtonesoftg
tonesoftg
 
%in kaalfontein+277-882-255-28 abortion pills for sale in kaalfontein
%in kaalfontein+277-882-255-28 abortion pills for sale in kaalfontein%in kaalfontein+277-882-255-28 abortion pills for sale in kaalfontein
%in kaalfontein+277-882-255-28 abortion pills for sale in kaalfontein
 
%in Soweto+277-882-255-28 abortion pills for sale in soweto
%in Soweto+277-882-255-28 abortion pills for sale in soweto%in Soweto+277-882-255-28 abortion pills for sale in soweto
%in Soweto+277-882-255-28 abortion pills for sale in soweto
 
%+27788225528 love spells in Atlanta Psychic Readings, Attraction spells,Brin...
%+27788225528 love spells in Atlanta Psychic Readings, Attraction spells,Brin...%+27788225528 love spells in Atlanta Psychic Readings, Attraction spells,Brin...
%+27788225528 love spells in Atlanta Psychic Readings, Attraction spells,Brin...
 
Microsoft AI Transformation Partner Playbook.pdf
Microsoft AI Transformation Partner Playbook.pdfMicrosoft AI Transformation Partner Playbook.pdf
Microsoft AI Transformation Partner Playbook.pdf
 
Devoxx UK 2024 - Going serverless with Quarkus, GraalVM native images and AWS...
Devoxx UK 2024 - Going serverless with Quarkus, GraalVM native images and AWS...Devoxx UK 2024 - Going serverless with Quarkus, GraalVM native images and AWS...
Devoxx UK 2024 - Going serverless with Quarkus, GraalVM native images and AWS...
 
W01_panagenda_Navigating-the-Future-with-The-Hitchhikers-Guide-to-Notes-and-D...
W01_panagenda_Navigating-the-Future-with-The-Hitchhikers-Guide-to-Notes-and-D...W01_panagenda_Navigating-the-Future-with-The-Hitchhikers-Guide-to-Notes-and-D...
W01_panagenda_Navigating-the-Future-with-The-Hitchhikers-Guide-to-Notes-and-D...
 
Abortion Pill Prices Tembisa [(+27832195400*)] 🏥 Women's Abortion Clinic in T...
Abortion Pill Prices Tembisa [(+27832195400*)] 🏥 Women's Abortion Clinic in T...Abortion Pill Prices Tembisa [(+27832195400*)] 🏥 Women's Abortion Clinic in T...
Abortion Pill Prices Tembisa [(+27832195400*)] 🏥 Women's Abortion Clinic in T...
 
WSO2CON 2024 - Cloud Native Middleware: Domain-Driven Design, Cell-Based Arch...
WSO2CON 2024 - Cloud Native Middleware: Domain-Driven Design, Cell-Based Arch...WSO2CON 2024 - Cloud Native Middleware: Domain-Driven Design, Cell-Based Arch...
WSO2CON 2024 - Cloud Native Middleware: Domain-Driven Design, Cell-Based Arch...
 
WSO2CON 2024 - Does Open Source Still Matter?
WSO2CON 2024 - Does Open Source Still Matter?WSO2CON 2024 - Does Open Source Still Matter?
WSO2CON 2024 - Does Open Source Still Matter?
 
Payment Gateway Testing Simplified_ A Step-by-Step Guide for Beginners.pdf
Payment Gateway Testing Simplified_ A Step-by-Step Guide for Beginners.pdfPayment Gateway Testing Simplified_ A Step-by-Step Guide for Beginners.pdf
Payment Gateway Testing Simplified_ A Step-by-Step Guide for Beginners.pdf
 
Crypto Cloud Review - How To Earn Up To $500 Per DAY Of Bitcoin 100% On AutoP...
Crypto Cloud Review - How To Earn Up To $500 Per DAY Of Bitcoin 100% On AutoP...Crypto Cloud Review - How To Earn Up To $500 Per DAY Of Bitcoin 100% On AutoP...
Crypto Cloud Review - How To Earn Up To $500 Per DAY Of Bitcoin 100% On AutoP...
 
%in Harare+277-882-255-28 abortion pills for sale in Harare
%in Harare+277-882-255-28 abortion pills for sale in Harare%in Harare+277-882-255-28 abortion pills for sale in Harare
%in Harare+277-882-255-28 abortion pills for sale in Harare
 
MarTech Trend 2024 Book : Marketing Technology Trends (2024 Edition) How Data...
MarTech Trend 2024 Book : Marketing Technology Trends (2024 Edition) How Data...MarTech Trend 2024 Book : Marketing Technology Trends (2024 Edition) How Data...
MarTech Trend 2024 Book : Marketing Technology Trends (2024 Edition) How Data...
 

Evolution of containers to kubernetes

  • 1. Evolution of Containers to Krishna Kumar, CNCF Ambassador India & Shivram Srivastava, Open Source Maintainer k8s A presentation at Contents & pictures are taken from the web; Will be used for education purpose only 
  • 2. Contents • Evolution of Containers! • LXC to Docker … • Kubernetes • Architecture • Components • Use cases • More…
  • 3.
  • 4. Where does all it comes from? • LXC (LinuX Containers) was the first, most complete implementation of Linux container manager. It was implemented in 2008 using cgroups and Linux namespaces, and it works on a single Linux kernel without requiring any patches. early stages and later replacing it with its own implementation. • The LXC containers that are now part of every Linux distribution were founded on Google’s work in 2006 - https://linuxacademy.com/blog/containers/history-of-container- technology/ • When Docker emerged in 2013, containers exploded in popularity. It’s no coincidence the growth of Docker and container use goes hand-in- hand. Docker used LXC in its initial stages and later replaced that container manager with its own library, libcontainer. But there’s no doubt that Docker separated itself from the pack by offering an entire ecosystem for container management. • Brief history of Containers - https://dzone.com/articles/evolution-of- linux-containers-future https://content.pivotal.io/infographics/moments-in-container-history
  • 5. Container Evolution: Moving from Chroot to Namespaces chroot  Chroot jails were the earliest isolation mechanisms. Chroot offers file system level abstraction and prevents applications from interfering with each other.  There was problem with chroot: The chroot can be broken by root users. Applications in different namespaces could still interfere in many ways. Also Start some programs (with some overlapping name) from two shells chrooted to two different directories. Execute ps –ef | grep “<overlapping portion>” from one bash shell and kill all the PID’s corresponding to the matching results (a typical termination program), will kill program in other bash shell. 5 namespaces  The name spaces are IPC, PID, hostname, User, Mount, network  Application isolation by manipulate certain system attributes - e.g: clone(), unshared(), setns(), execute the bash shell in separate PID, mount proc file system namespaces, kill the init process of the child namespace, etc.
  • 6. Container Evolution: cgroups – Resource Limiting • Handles resource quota allocation. It associates “subsystems” – which are kernel modules that meter the system resources such as (cpu and memory) to “hierarchies of ‘cgroups’” – which are user-defined rules to restrict resource usage of processes. Some of the cgroup subsystems are: o blkio — this subsystem sets limits on input/output access to and from block devices such as physical drives (disk, solid state, or USB). o cpu — this subsystem uses the scheduler to provide cgroup tasks access to the CPU. o cpuacct — this subsystem generates automatic reports on CPU resources used by tasks in a cgroup. o cpuset — this subsystem assigns individual CPUs (on a multicore system) and memory nodes to tasks in a cgroup. o devices — this subsystem allows or denies access to devices by tasks in a cgroup. o freezer — this subsystem suspends or resumes tasks in a cgroup. o memory — this subsystem sets limits on memory use by tasks in a cgroup and generates automatic reports on memory resources used by those tasks. o net_cls — this subsystem tags network packets with a class identifier (classid) that allows the Linux traffic controller (tc) to identify packets originating from a particular cgroup task. o net_prio — this subsystem provides a way to dynamically set the priority of network traffic per network interface. o ns — the namespace subsystem. o perf_event — this subsystem identifies cgroup membership of tasks and can be used for performance analysis. 6 A cgroup example:
  • 7. Container Evolution: LXC Architecture 7 - LXC abstracts the complexities of configuring the cgroups and namespaces and helps to automate the process. - LXC (Linux Containers) is an operating-system-level virtualization method for running multiple isolated Linux systems (containers) on a control host using a single Linux kernel. “LXC” refers to capabilities of the Linux kernel (specifically namespaces and control groups) which allow sandboxing processes from one another, and controlling their resource allocations. - Kernel features for containers: Isolated Namespaces: (Audit, System, Device, Time, Taskcount), Watch mount points, root level permissions, file system read only privilege for Copy-on-write, Use resource limitation feature, Avoid running container with User ID = 0; harden OS,
  • 8. Major Container Types…. Docker: The most popular container OS - a lightweight, portable, self sufficient LXC container that can run virtually anywhere. It has layered container image, global container registry, Cluster management, CLI/Rest API connections. Rocket: From CoreOS/RedHat, Rocket has more rigorous security, app container specifications. Also developed flannel, etcd to support container orchestration. Photon: Photon OS is a minimal Linux container host, optimized to run on VMware platforms. Compatible withDocker, and Kubernetes. Garden: From Pivotal Cloud Foundry. Garden (Warden) is a platform-agnostic Go API for container creation and management, with pluggable back ends for different platforms and runtimes. Mesos Containers: MesosContainerizer provides lightweight containerization and resource isolation of executors using Linux-specific functionality such as control cgroups and namespaces. Windows Containers: Two different run times - Windows Server Containers which uses shared kernel space and Hyper-V Isolation Containers which run each container in a optimized virtual machine (e.g: Windows 10 containers) IBM Nabla Container: Cut down OS system calls to a bare minimum with as little code as possible. This is expected to decrease the surface area available for an attack. Make use of Library OS (unikernel techniques) and use only 9 system calls; the rest are blocked through linux seccomp policy. Google gVisor: User-space kernel, written in Go, that implements a substantial portion of the Linux system surface. It includes an OCI runtime called runsc that provides an isolation boundary between the application and the host kernel. Kata Containers: standard implementation of lightweight Virtual Machines (VMs) that feel and perform like containers, but provide the workload isolation and security advantages of VMs. It is designed to be architecture agnostic, run on multiple hypervisors and be compatible with the OCI. ConrtainerD: It is an industry-standard core container runtime available as a daemon for Linux and Windows, which can manage the complete container lifecycle of its host system. It uses runC to run containers according to the OCI specification. OCI: Open Container Initiative -currently contains two specifications: the Runtime Specification (runtime-spec) and the Image Specification (image-spec). The Runtime Specification outlines how to run a “filesystem bundle” that is unpacked on disk. At a high-level an OCI implementation would download an OCI Image then unpack that image into an OCI Runtime filesystem bundle. 8
  • 9. Container Platform - Docker  Docker is a platform and tool for building, distributing, and running container.  Docker means a person who docks, shipping docks.  Docker Inc is a private company which handles all aspects of Docker. https://www.docker.com/  Docker's open source components are generally licensed under the Apache 2.0 license. Written in GO language.  Docker also has Enterprise commercial product.  In 2008, Solomon Hykes and few others started dotcloud and eventually it becomes Docker, Inc. the company revolutionize the cloud industry. 9
  • 10. How to Build Docker Image • An image is an inert, immutable, file that's essentially a snapshot of a container.Images are created with the build command, and they'll produce a container when started with run. Images are stored in a Docker registry such as registry.hub.docker.com • Docker can build images automatically by reading the instructions from a Dockerfile, a text document that contains all the commands you would normally execute manually in order to build a Docker image. • https://docs.docker.com/engine/reference/co mmandline/images/ 12  FROM keyword tells which image is your image based on  COPY instruction copies new files/directories from <src> and adds to the filesystem of the container at the path <dest>  EXPOSE listens on the specified network ports at runtime (does not make the ports of the container accessible to the host)  CMD provide defaults for an executing container. There can be only one cmd in a Dockerfile. If multiple CMDs are there, then only the last cmd will take effect  To build the image name “nginx:latest_image “ from current directory where dockerfile is residing; run docker build –t nginx:latest_image . Sample Docker File
  • 11. Docker Registry • Create an account in Docker Hub. Push the image which you tagged. Docker hub account would contain the pushed image. • One can pull the image and run a container using the image. • https://docs.docker.com/registry/ • https://blog.octo.com/en/docker-registry-first-steps/ 13
  • 12. Docker CI/CD pipeline • https://success.docker.com/article/dev-pipeline 14 Developer workflow Ops workflow
  • 14. From Virtualization to Cloud Native 16 Containers Cloud Native Open Source IaaS PaaS Open Source PaaS Virtualiza- tion 2000 2001 2006 2009 2010 2011 Non- Virtualized Hardware 2013 2015 IaaS
  • 15. Container Orchestration Engines  Kubernetes is a orchestration system for running Docker and other containers.  Some other leading container orchestration Engines (like Kubernetes):  Mesosphere Mesos  Docker Swarm  Hashicorp Nomad  Netflix Titus  Racher Cattle  Pivotal Cloud Foundry  Amazon ECS  Deis (Microsoft acquired it)  Cisco Mantl  Kontena Pharos  https://medium.freecodecamp.org/how-to-choose-the-right-container-orchestration-and-how-to-deploy-it-41844021c241
  • 16. CNCF is an open source software foundation (under Linux foundation) dedicated to making cloud native computing universal and sustainable. Cloud native computing uses an open source software stack to deploy applications as microservices, packaging each part into its own container, and dynamically orchestrating those containers to optimize resource utilization. Cloud native technologies enable software developers to build great products faster. The following projects are under the foundation: 18 • Platinum members: Orchestration Incubating Sandbox Service Mesh Storage Networking API Service Discovery Distributed Tracing Service Mesh Software Update Spec StorageSecurity Logging Remote Procedure Call Monitoring Distributed Tracing API Container Runtime Messa ging Iden tity Spec Identit y Poli cy Graduated Server less Tooling Container Runtime Package Manageme nt Harbor Registry Open Metrics TIKV Key-Value Store
  • 17. 19
  • 18. 20
  • 19. 21
  • 20. Evolution of Kubernetes!! • Borg – original paper - https://static.googleusercontent.com/media/research.google.com/en//pubs/archive/43438.pd f • Omega – original paper - https://static.googleusercontent.com/media/research.google.com/en//pubs/archive/41684.pd f • Borg: The Predecessor to Kubernetes - https://kubernetes.io/blog/2015/04/borg-predecessor- to-kubernetes/ • Lessons learned from three container management system over a decade at Google - Borg, Omega, and Kubernetes - https://storage.googleapis.com/pub-tools-public-publication- data/pdf/44843.pdf • Kubernetes (κυβερνήτης, Greek for "governor", "helmsman" or "captain") was founded by Joe Beda, Brendan Burns and Craig McLuckie, was quickly joined by other Google engineers including Brian Grant and Tim Hockin, and was first announced by Google in mid-2014. • Kubernetes is also referred to as k8s, as there are 8 characters between k and s. • Kubernetes celebrates its birthday every year on 21st July. Kubernetes 1.0 was released on July 21 2015. Generally licensed under the Apache 2.0 license. Written in GO language. • In July 2015, Google along with Twitter, IBM, Intel, Cisco, and Goldman Sachs, among others announced creating CNCF and inducted kubernetes as the first project in it. • Aug 2018, Google sets Kubernetes free with $9m in its pocket for expenses - Google shifting the ownership of Kubernetes cloud resources to CNCF. “Kubernetes is an open-source system for automating deployment, scaling, and management of containerized applications. It groups containers that make up an application into logical units for easy management and discovery.”
  • 21. K8s - Main features 23 • Open source & run anywhere • Group containers in to logical units • Easy management & Discovery • Self healing • Scaling – Planet size (billions of containers in a week) • Serverless with server • Optimize resource usage • Multi Clouds  Automatic bin-packing Kubernetes automatically schedules the containers based on resource usage and constraints, without sacrificing the availability.  Self-healing Kubernetes automatically replaces and reschedules the containers from failed nodes. It also kills and restarts the containers which do not respond to health checks, based on existing rules/policy.  Horizontal scaling Kubernetes can automatically scale applications based on resource usage like CPU and memory. In some cases, it also supports dynamic scaling based on customer metrics.  Service discovery and Load balancing Kubernetes groups sets of containers and refers to them via a Domain Name System (DNS). This DNS is also called a Kubernetes service. Kubernetes can discover these services automatically, and load-balance requests between containers of a given service  Automated rollouts and rollbacks Kubernetes can roll out and roll back new versions/configurations of an application, without introducing any downtime.  Secrets and configuration management Kubernetes can manage secrets and configuration details for an application without re-building the respective images. With secrets, we can share confidential information to our application without exposing it to the stack configuration, like on GitHub.  Storage orchestration With Kubernetes and its plugins, we can automatically mount local, external, and storage solutions to the containers in a seamless manner, based on software-defined storage (SDS).  Batch execution Besides long running jobs, Kubernetes also supports batch execution. Every 3 months there is one release. https://kubernetes.io/docs/setup/release/ notes/
  • 22. K8s Architecture One or more master nodes One or more worker nodes Distributed key-value store, like etcd https://kubernetes.io/docs/concepts/ https://kubernetes.io/docs/home/ https://www.slideshare.net/RedHatDevelopers/kubernetes-introduction-86540172 24
  • 23. Pod Concept… 25 • Pod – Multiple containers share IP/storagevolume/resources/secrets/ labels/Lifecycle – Define as a YAML • Service – Groups of pods act as one service with IP and DNS name • Label – Key/value pair associated with k8s objects like Pod. • https://kubernetes.io/docs/concepts /workloads/pods/pod-overview/
  • 24. 26  The master node is responsible for managing the Kubernetes cluster, and it is the entry point for all administrative tasks. 1. API server 2. Scheduler 3. Controller manager 4. etcd.  A worker node is a machine (VM, physical server, etc.) which runs the applications using Pods and is controlled by the master node. Pods are scheduled on the worker nodes, which have the necessary tools to run and connect them. A Pod is the scheduling unit in Kubernetes. It is a logical collection of one or more containers which are always scheduled together. To run and manage a container's lifecycle, we need a container runtime on the worker node. Some container runtimes are: containerd, rkt, lxd, docker. We will explore them further in later chapters. 1. Container runtime 2. kubelet 3. kube-proxy  kubectl – Command Line interface (CLI) K8s Components
  • 25. Master Node Components 27 1. API server • All the administrative tasks are performed via the API server within the master node. A user/operator sends REST commands to the API server, which then validates and processes the requests. After executing the requests, the resulting state of the cluster is stored in the distributed key- value store. 2. Scheduler • schedules the work to different worker nodes. The scheduler has the resource usage information for each worker node. It also knows about the constraints that users/operators may have set, such as scheduling work on a node that has the label disk==ssd set. Before scheduling the work, the scheduler also takes into account the quality of the service requirements, data locality, affinity, anti-affinity, etc. The scheduler schedules the work in terms of Pods and Services. 3. Controller manager • Manages different non-terminating control loops, which regulate the state of the Kubernetes cluster. Each one of these control loops knows about the desired state of the objects it manages, and watches their current state through the API server. In a control loop, if the current state of the objects it manages does not meet the desired state, then the control loop takes corrective steps to make sure that the current state is the same as the desired state. 4. etcd • Is a distributed key-value store which is used to store the cluster state. It can be part of the Kubernetes Master, or, it can be configured externally, in which case, master nodes would connect to it.
  • 26. K8s etcd – more.… 28 • State Management with etcd • Kubernetes uses etcd to store the cluster state. • etcd is a distributed key-value store based on the Raft Consensus Algorithm. • Raft allows a collection of machines to work as a coherent group that can survive the failures of some of its members. • At any given time, one of the nodes in the group will be the master, and the rest of them will be the followers. Any node can be treated as a master • etcd is written in the Go programming language. • In Kubernetes, besides storing the cluster state, etcd is also used to store configuration details such as subnets, ConfigMaps, Secrets, etc.
  • 27. Worker Node Components 29 1. The kubelet is an agent which runs on each worker node and communicates with the master node. It receives the Pod definition via various means (primarily, through the API server), and runs the containers associated with the Pod. It also makes sure that the containers which are part of the Pods are healthy at all times. The kubelet connects to the container runtime using Container Runtime Interface (CRI). 2. The Container Runtime Interface consists of protocol buffers, gRPC API, and libraries. 3. Kube-proxy Instead of connecting directly to Pods to access the applications, we use a logical construct called a Service as a connection endpoint. A Service groups related Pods and, when accessed, load balances to them. kube-proxy is the network proxy which runs on each worker node and listens to the API server for each Service endpoint creation/deletion. For each Service endpoint, kube- proxy sets up the routes so that it can reach to it. 1. dockershim • With dockershim, containers are created using Docker installed on the worker nodes. Internally, Docker uses containerd to create and manage containers. 2. cri-containerd • With cri-containerd, we can directly use Docker's smaller offspring containerd to create and manage containers 3. CRI-O • CRI-O enables using any Open Container Initiative (OCI) compatible runtimes with Kubernetes. Supports runC and Clear Containers as container runtimes now.
  • 28. Kubectl • kubectl create -f is what we call Imperative Management. On this approach you tell the Kubernetes API what you want to create, replace or delete, not how you want your K8s cluster world to look like. • kubectl apply is part of the Declarative Management approach, where changes that you may have applied to a live object (i.e. through scale) are maintained even if you apply other changes to the object. • https://kubernetes.io/docs/reference/kubectl/o verview/ 30
  • 30. 32 PaaS • Kel • WSO2 • Rancher • OpenShift Origin (OKD) • OpenShift Online/Dedicated/Container Platform • Eldarion Cloud • Alauda Container Platform • Hasura • teresa • Containerum Serverless • Funktion • Fission • Kubeapps Kubeless • OpenWhisk • Iron.io • OpenFaaS • FaaS-netes • Nuclio • Virtual Kubelet Custom Scheduler • Scheduler - Cost based scheduler • Sticky Node Scheduler • ksched - Experimental flow based scheduler • escheduler - Written in elixir • bashScheduler - Written in bash Containers Supported • Docker: • Rkt • Rktnetes • rktlet • containerd • cri-containerd • CRI-O (OCI) • Hyper.sh/frakti • virtlet • infranetes K8s environments… Enterprise Products • CoreOS Tectonic • OpenShift - Container Platform • SUSE Container as a Service • Kubermatic • Canonical Distribution of Kubernetes - CDK • IBM Cloud Private Cluster Manager • Cisco Container Platform • Gardener -Kubermatic • Rancher • PKS • Telekube • Kqueen Developer Platforms • Fabric8 • Spring Cloud integration • Mantl • goPaddle • VAMP Private/Public clouds • GKE • AWS EKS • Azure AKS • Vsphere • Alibaba Cloud • Docker EE • Platform9 • OpenShift Online
  • 31. K8s - Storage & Networking 33 Persistent Volume Providers • GCE • AWS • Rook • Glusterfs • OpenStack Cinder • CephRBD • QuoByte • Kube-Aliyun • Portworx • Rancher Longhorn • Stork • OpenEBS • StorageOS Networking Stacks • Weave Net • Canal by Tigera • OpenContrail • Nuage • Kuryr • Contiv • Calico • OpenVSwitch • Kube-router • Cilium • Linen • CNI-Genie • Romana • Infoblox • External DNS - To control DNS records dynamically via Kube resources • cni-ipvlan-vpc-k8s • kubernetes-network-policy-recipes • Multus-cni - Multi-homed pod cni • Network-Controller - Open vSwitch, Multiple network interfaces that associate with Kubernetes pods • AWS VPC CNI - Networking plugin using Elastic Network Interfaces • NSX-T - CNI plugin supporting load balancing and distributed firewalls. • Container Network Model (CNM) - proposed by Docker • Container Network Interface (CNI) - proposed by CoreOS.
  • 32. K8s - Installers & Monitoring 34 Installers • Minikube - Run Kubernetes locally • Kops - OS Agnostique - AWS • Kube-deploy • Kubeadm - OS Agnostique - Cloud Agnostique • Kubespray - OS Agnostique - Cloud Agnostique • Bootkube - CoreOS - Cloud Agnostique • Kube-aws - CoreOS - AWS • Kismatic - CentOS - Cloud Agnostique • Juju - Ubuntu - Cloud Agnostique • Terraform - CoreOS - AWS • Supergiant - CoreOS - Cloud Agnostique • Archon - OS Agnostique - Cloud Agnostique • KubeNow - Ubuntu - Cloud Agnostique • Kubicorn - OS Agnostique - Cloud Agnostique • Simplekube - systemd OS - Cloud Agnostique • Conjure-up - Ubuntu - Cloud Agnostique • Kube-ansible - OS Agnostique - Cloud Agnostique • Kubernetes-Saltstack - systemD OS - Cloud Agnostique • matchbox - CoreOS - Network boot and provision Container Linux clusters (e.g. etcd3, Kubernetes, more). • RKE - OS Agnostique - Cloud Agnostique • Typhoon - Container Linux - Cloud Agnostique • Docker for Windows - Run Kubernetes and Docker locally on your Windows PC (Edge Channel) • Docker for MAC - Run Kubernetes and Docker locally on your MAC (Edge Channel) • MetalK8s - CentOS - On-Prem - Cloud Agnostique - Apache-2.0 Monitoring • Console • Datadog • eventrouter - simple introspective kubernetes service that forwards events to a specified sink. • Grafana Kubernetes App • Heapster • Instana • Kubebox - Terminal console for Kubernetes • Kubedash • Kubernetes Operational View - read-only system dashboard for multiple K8s clusters • Kubetail • Kubewatch • Netsil • Outcold Solutions - monitoring Kubernetes, OpenShift and Docker in Splunk Enterprise and Splunk Cloud (metrics and log forwarding) • Prometheus • Sysdig Monitoring • Sysdig Open Source • Weave Scope • Searchlight • Ingress Monitor Controller - A Kubernetes Controller to watch your ingresses and create liveness alerts for your endpoints
  • 33. K8s - more elements… 35 Operators • Prometheus • Kong API • Kubernetes Operators • K8s Operator Workshop • Cert Operator • Cert manager • cert-manager • Operator Kit • Container Linux Update Operator • DB Operator • KubeVirt • Operator SDK • kooper - Simple Go library to create Kubernetes operators and controllers CI / CD •Jenkins X - CI/CD for Kubernetes using Jenkins •kb8or •Wercker •Shippable •GitLab •Kontinuous •Kit •Spinnaker •CircleCI •KubeCI •Vili •Keel •Apollo - Open Source application providing teams with self service UI for creating and deploying their services to Kubernetes. •Weave Flux – GitOps reconcoliation operator •Codefresh - Kubernetes CI/CD platform (with private Docker and Helm Chart repositories) Some Related Software.. •Argo The Workflow Engine for Kubernetes •Hypernetes •Kubernetes Cluster Federation (previously Ubernetes) •kmachine •Kubefuse •KubeSpray •Kubernetes Ec2 Autoscaler •Kubeform •kube-openvpn •Archon •Client Libraries •Kubic-Project •Telepresence - Locally develop/debug services against a remote Kubernetes cluster •Fission Workflows - Workflow-based serverless function composition •Ambassador - API Gateway built on the Envoy Proxy
  • 34. Kubernetes – use cases ….. 36 https://thenewstack.io/ebooks/us e-cases/use-cases-for- kubernetes/  Scaling services like large scale web applications for ecommerce operation  Stateful workloads – Zookeper, MySQL, etc.  Serverless execution for short burst jobs (like AWS Lambda)  Optimized resource usage with resource quota  Hybrid and multi cloud scenarios  Solution providers for CRM, ERP, etc.  System Integrators for Enterprise/Legacy/Cloud  Specific needs – Advanced routing, network scanners, etc.  Kubernetes case studies - https://kubernetes.io/case-studies/  And now gaining momentum in Big data, AI/ML, Block chain, Robotics operations and so on, almost all areas of computing..  The business case for running k8s - https://thenewstack.io/containers-enable-companies-just-less/
  • 35. K8s - Quick Setup Setup - https://kubernetes.io/docs/setup/ MiniKube installation - https://github.com/kubernetes/minikube https://kubernetes.io/docs/setup/independent/create-cluster- kubeadm/ https://kubernetes.io/docs/setup/scratch/ Getting started - http://containertutorials.com/get_started_kubernetes/index.html Docker – k8s Lab: http://docker-k8s-lab.readthedocs.io/en/latest/ K8s in Google cloud Quick start - https://cloud.google.com/kubernetes-engine/docs/quickstart 37
  • 37. K8s – more…. • K8s - The Hard Way - https://github.com/kelseyhightower/kubernetes-the-hard-way • Software conformance certifications - https://kubernetes.io/blog/2017/10/software-conformance- certification/ • CKA Certified Kubernetes Administrator) https://www.cncf.io/certification/cka/ & CKAD (Certified Kubernetes Application Developer) - https://www.cncf.io/certification/ckad/ • Docker certification: DCA (Docker certified Associate Exam) - https://www.udemy.com/introduction-to- docker-and-the-dca-certification/ • Intro k8s from CNCF - https://www.cncf.io/announcement/2017/07/10/linux-foundation-cncf-edx-org- announce-new-free-intro-kubernetes-course/ • Kubernetes Fundamentals (LFS258) - https://training.linuxfoundation.org/training/kubernetes- fundamentals/ • Microservices with k8s - https://in.udacity.com/course/scalable-microservices-with-kubernetes--ud615, https://www.udemy.com/kubernetes-certified-administrator/ • Coursera courses - https://www.coursera.org/courses?query=kubernetes • K8s deep dive & use cases - https://thenewstack.io/kubernetes-deep-dive-and-use-cases/ • K8s deep dive Altoros - https://www.altoros.com/training/kubernetes-deep-dive.html • Redhat k8s deep dive - https://blog.openshift.com/kubernetes-deep-dive-api-server-part-1/ • VMWare test drive – k8s deep dive - https://kb.vmtestdrive.com/hc/en-us/articles/360001127513- Kubernetes-Deep-dive • Top tutorials - https://techbeacon.com/top-tutorials-mastering-kubernetes • Cheat sheet - https://kubernetes.io/docs/reference/kubectl/cheatsheet/ • Illustrated Comic - https://cloud.google.com/kubernetes-engine/kubernetes-comic/ • Illustrated Children's Guide to Kubernetes- https://www.youtube.com/watch?v=4ht22ReBjno 39 https://github.com/ramitsurana/awesome-kubernetes
  • 38. 40 The best place to get all latest & meet the experts!!