Introduction

Cluster

Cluster Architecture

Nodes

Controllers

Leases

Container Runtime Interface

Garbage Collection

ETCD

Code DNS

Workloads

Containers

Images

Runtime Class

apiVersion: v1
kind: Pod
metadata:
  name: mypod
spec:
  runtimeClassName: myclass
  # ...

Container Lifecycle

Container Lifecycle Hooks

Ephemeral Containers

Sidecar Containers

Pods

Pod Lifecycle

Init Containers

Multi Container Pods

Sidecar Injection

Disruption

Pod Quality of Service Classes

Pod Restart Policy

Pod Priorities

Disruptions

Deployments

apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx-deployment
  labels:
    app: nginx
spec:
  replicas: 3
  selector:
    matchLabels:
      app: nginx
  template:
    metadata:
      labels:
        app: nginx
    spec:
      containers:
      - name: nginx
        image: nginx:1.14.2
        ports:
        - containerPort: 80

Updating a Deployment

Scalability

Deployment Types

kubectl rollout undo deployment/nginx-deployment --to-revision=2


kubectl autoscale deployment/nginx-deployment --min=10 --max=15 --cpu-percent=80


kubectl autoscale deployment/nginx-deployment --min=10 --max=15 --cpu-percent=80

ReplicaSets

apiVersion: apps/v1
kind: ReplicaSet
metadata:
  name: frontend
  labels:
    app: guestbook
    tier: frontend
spec:
  # modify replicas according to your case
  replicas: 3
  selector:
    matchLabels:
      tier: frontend
  template:
    metadata:
      labels:
        tier: frontend
    spec:
      containers:
      - name: php-redis
        image: us-docker.pkg.dev/google-samples/containers/gke/gb-frontend:v5


apiVersion: autoscaling/v1
kind: HorizontalPodAutoscaler
metadata:
  name: frontend-scaler
spec:
  scaleTargetRef:
    kind: ReplicaSet
    name: frontend
  minReplicas: 3
  maxReplicas: 10
  targetCPUUtilizationPercentage: 50

StatefulSets

DaemonSets

Jobs

Cron Jobs

Replication Controller

Networking

Network Types

Pod Network

Cluster network

Node Network

Dual Stack

Gateway API

Service

Service Cluster IP Allocation

Ingress

SSL Termination

Ingress Rules

Ingress Controller

Gateway API

Endpoint Slices

Network Policies

DNS

Routing

Topology Aware Routing

Storage

Volumes

Persistent Volumes

Persistent Volume Claims

Projected Volumes

Ephemeral Volumes

Storage Classes

Volume Attribute Classes

Volume Provisioning

Static Provisioning

Dynamic Provisioning

Volume Snapshots

Volume Snapshot Classes

Volume Health Monitoring

Configuration

Config Maps

Secrets

Resource Requests & Limits

Autoscaling

Cluster Autoscaling

Pod Autoscaling

HPA

VPA

Pod Disruption Budgets

Priority Classes

Runtime Classes

Admission Controllers

Security

Authorization Modes

RBAC

Roles

apiVersion: rbac.authorization.k8s.iov1
kind: Role
metadata:
	name: developer
	namespace: namespace_name
rules:
	- apiGroups: [""]
	  resources: ["pods"]
	  verbs: ["get", "create", "list"]
	  resourceName: ["myApp"]

Cluster Role

Users

RoleBinding

apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
	name: developer-role-binding
subjects:
	- kind: User/Group/ServiceAccount
	  name: username
	  apiGroup: rbac.authorization.k8s.io
roleRef:
	kind: Role
	name: developer
	apiGroup: rbac.authorization.k8s.io

Service Accounts

Other Authorization Modes

Cluster Hardening

Certificates

Certificates API

Scheduling

Node Name & Selector

Node Affinity

Taints & Tolerations

Inter Pod Affinity

Node Selector

Node Affinity

Node Anti Affinity

Pod Affinity

Taints

Tolerations

Assigning Pods to Nodes

Pod Overhead

apiVersion: node.k8s.io/v1
kind: RuntimeClass
metadata:
  name: kata-fc
handler: kata-fc
overhead:
  podFixed:
    memory: "120Mi"
    cpu: "250m"

Pod Scheduling Readiness

Objects

Labels & Selectors

Namespaces

Annotations

Field Selectors

Finalizers

Owners & Dependents

Administration

Building a Cluster from scratch

Upgrading a cluster

Certificate Management

Building a cluster

Cluster Installation

Node Configuration

Container Runtime Interface

kudeadm, kubelet and kubectl

Connecting to a cluster

Network Configuration

Container Communication

Container Network Interface

Network Plugin

Garbage Collection

Troubleshooting

Debug with Temporary Pods

Kubectl format output

Troubleshoot Kubelet & Kubectl

Pod Access Problems

Objects

Labels & Selectors

Labels

Selectors

apiVersion: v1
kind: Pod
metadata:
  name: cuda-test
spec:
  containers:
    - name: cuda-test
      image: "registry.k8s.io/cuda-vector-add:v0.1"
      resources:
        limits:
          nvidia.com/gpu: 1
  nodeSelector:
    accelerator: nvidia-tesla-p100


kubectl get pods -l environment=production,tier=frontend


kubectl get pods -l 'environment in (production),tier in (frontend)'


selector:
  matchLabels:
    component: redis
  matchExpressions:
    - { key: tier, operator: In, values: [cache] }
    - { key: environment, operator: NotIn, values: [dev] }

Namespaces

Miscellaneous

Best Practices

Configuration Best Practices

Production Environment

Resource Profiles

Automated Placements

Observability

Probes

Liveness Probes

Readiness Probes

Startup Probes

Operators

Maturity Level

Operator Framework

Custom Resource Definition

APIs

API Groups

API Versions

Deprecations

Production

Best Practices

Behavioral Patterns

Batch Jobs

Periodic Jobs

Daemon Service

Singleton Service

Stateful Service

Commands

Tools & Services

Crossplane

Kustomize

Helm

Kubeshark

Resources

Tasks

Deployments

Labels, selectors and annotations

Networking

Ingress

Storage

ConfigMaps & Secrets

API Usage

Troubleshooting

Observability

Scheduling

Operators

Security

Hardening Clusters

Hardening a Kubernetes (K8s) cluster from a security perspective involves a multi-layered approach that encompasses several aspects of the Kubernetes environment. Here’s a comprehensive guide to securing your Kubernetes cluster:

Commands

Questions

Topics

Network Policies

Storage

Security

Volumes

apiVersion: v1
kind: Pod
metadata:
  name: business-app
spec:
  volumes:
  - name: logs-volume
    emptyDir: {}
  containers:
  - image: nginx
    name: nginx
    volumeMounts:
    - mountPath: /var/logs
      name: logs-volume

apiVersion: v1
kind: PersistentVolume
metadata:
  name: db-pv
spec:
  capacity:
    storage: 1Gi
  accessModes:
    - ReadWriteOnce
  hostPath:
    path: /data/db

kind: PersistentVolumeClaim
apiVersion: v1
metadata:
  name: db-pvc
spec:
  accessModes:
    - ReadWriteOnce
  resources:
    requests:
      storage: 512m

apiVersion: v1
kind: Pod
metadata:
  name: app-consuming-pvc
spec:
  volumes:
    - name: app-storage
      persistentVolumeClaim:
        claimName: db-pvc
  containers:
  - image: alpine
    name: app
    command: ["/bin/sh"]
    args: ["-c", "while true; do sleep 60; done;"]
    volumeMounts:
      - mountPath: "/mnt/data"
        name: app-storage

ISTIO

EKS

Tools