Containers in a Kubernetes World
- 1. Containers in a Kubernetes World Containers and Kubernetes (K8S) – INTLUG April 2023 By Peter Larsen
- 2. Containers and K8S 3 April 2023 Why we are here - AGENDA Talk about containers Talk about container runtime engines – particular Kubernetes We'll be using OpenShift's “Single Node OpenShift”/SNO or Code Ready Containers or OpenShift Local You can run SNO on your computer – 16GB of RAM and 30+ GB of HDD and libvirt/kvm is required. Was going to talk about https://microshift.io/ - however .....
- 3. Containers and K8S 4 April 2023 Word to the wise ..... (that's you!) OpenShift is Kubernetes + a lot more. It runs Kubernetes everywhere – local workstation, datacenter, cloud, edge (like cars) Play along or try at home: https://developers.redhat.com/products/openshift/download https://console.redhat.com/openshift/create/local - download small executable (crc) and pull secret Upstream: https://www.okd.io/guides/sno/ This is not as easy – but doable! Kubernetes is a VERY complex platform – we will not cover it all, just dip our toes in it.
- 4. April 2023 Questions are absolutely welcome – even during the talk
- 5. April 2023 Who has NOT used containers before?
- 6. Containers and K8S 7 April 2023 7 LXC Initial release Aug ‘08 OpenShift online May ‘11 Docker initial Mar ‘13 OpenShift Enterprise 3.0 Jun ‘15 OCI CNCF Initial release, Buildah Jun ‘17 Moby Apr ‘17 Sep ‘17 Kubernetes Mid ‘14 Buildah 1.0 Podman New logo May ‘18 buildah.io podman.io Sep ‘18 Buildah Skopeo Podman RHEL May ‘19 Nov ‘15 Mar ‘16 A lot has happened in just over a decade
- 7. Containers and K8S 8 April 2023 Containers: Podman – no Docker For demonstrations Podman is used Podman is a daemon less container CLI Podman's “api” commands are docker commands alias docker=podman Podman can use the exact same container features of Linux like runc (OCI) and crun (written in C not GO) Rootless containers are safer. With the docker daemon anyone with access to run containers can become root on the host podman is available on most major distributions Is default on Fedora, RHEL and CentOS installs
- 8. Containers and K8S 9 April 2023 Why containerization? Containers are everywhere in IT today Provides lots of advantages over virtualization Better security Easier to maintain Better “DevSecOps” Easy to distribute/install
- 9. April 2023 Typical container structure A quick primer .... Get the coloring book! https://red.ht/3gfVlHF
- 10. Containers and K8S 11 April 2023 WHAT ARE CONTAINERS? It Depends Who You Ask ● Application processes on a shared kernel ● Simpler, lighter, and denser than VMs ● Portable across different environments ● Package apps with all dependencies ● Deploy to any environment in seconds ● Easily accessed and shared INFRASTRUCTURE APPLICATIONS
- 11. Containers and K8S 12 April 2023 VIRTUAL MACHINES AND CONTAINERS VIRTUAL MACHINES CONTAINERS VM isolates the hardware Container isolates the process VM OS Dependencies Kernel Hypervisor Hardware App App App App Container Host (Kernel) Container App OS deps Container App OS deps Container App OS deps Container App OS deps Hypervisor Hardware
- 12. Containers and K8S 13 April 2023 Virtual Machine Application OS dependencies Operating System VIRTUAL MACHINES AND CONTAINERS VM Isolation Complete OS Static Compute Static Memory High Resource Usage Container Isolation Shared Kernel Burstable Compute Burstable Memory Low Resource Usage Container Host Container Application OS dependencies
- 13. Containers and K8S 14 April 2023 VIRTUAL MACHINES AND CONTAINERS Container Host Container Application OS dependencies Dev IT Ops Infrastructure Virtual Machine Application OS dependencies Operating System IT Ops (and Dev, sort of) Infrastructure Clear ownership boundary between Dev and IT Ops drives DevOps adoption and fosters agility Optimized for stability Optimized for agility
- 14. Containers and K8S 15 April 2023 Virtual machines are NOT portable across hypervisors and do NOT provide portable packaging for applications APPLICATION PORTABILITY WITH VM VM Type X Application OS dependencies Operating System BARE METAL PRIVATE CLOUD PUBLIC CLOUD VIRTUALIZATION LAPTOP Application OS dependencies Operating System VM Type Y Application OS dependencies Operating System VM Type Z Application OS dependencies Operating System Guest VM Application OS dependencies Operating System
- 15. Containers and K8S 16 April 2023 APPLICATION PORTABILITY WITH CONTAINERS LAPTOP Container Application OS dependencies Guest VM RHEL BARE METAL Container Application OS dependencies RHEL VIRTUALIZATION Container Application OS dependencies Virtual Machine RHEL PRIVATE CLOUD Container Application OS dependencies Virtual Machine RHEL PUBLIC CLOUD Container Application OS dependencies Virtual Machine RHEL Linux* Containers + Linux Host = Guaranteed Portability Across Any Infrastructure * Distribution Matters
- 16. Containers and K8S 17 April 2023 Base Image Image Layer 1 Image Layer 2 Image Layer 3 Base RHEL OS Update Layer Java Runtime Layer Application Layer Container Image Layers Example Container Image RAPID SECURITY PATCHING USING CONTAINER IMAGE LAYERING
- 17. Containers and K8S 18 April 2023 DIGITAL WORKLOADS ARE MOVING TO CONTAINERS LIFT & SHIFT Better manage scalability and fast-moving application development cycles Meet user demand, give them the ability to perform common tasks Migrate existing applications into more efficient container environments MOBILE MICROSERVICES Move faster & find time for innovation, aligned to business needs ANALYTICS
- 18. April 2023 Highlevel container Architecture
- 19. Containers and K8S 20 April 2023 A container is the smallest compute unit CONTAINER
- 20. Containers and K8S 21 April 2023 containers are created from container images CONTAINER CONTAINER IMAGE BINARY RUNTIME
- 21. Containers and K8S 22 April 2023 IMAGE REGISTRY container images are stored in an image registry CONTAINER CONTAINER IMAGE CONTAINER IMAGE CONTAINER IMAGE CONTAINER IMAGE CONTAINER IMAGE CONTAINER IMAGE
- 22. Containers and K8S 23 April 2023 an image repository contains all versions of an image in the image registry IMAGE REGISTRY frontend:latest frontend:2.0 frontend:1.1 frontend:1.0 CONTAINER IMAGE mongo:latest mongo:3.7 mongo:3.6 mongo:3.4 CONTAINER IMAGE myregistry/frontend myregistry/mongo
- 23. April 2023 Taking a practical look at containers Demo time
- 24. April 2023 That was kinda cool! https://xkcd.com/1988
- 25. April 2023 Why more than pure containers?
- 26. Containers and K8S 27 April 2023 They're GREAT, but .... On a single host all is local, all is simple A single host is a single point of failure A single host running hundreds or thousands of workload doesn't work Keeping container communication private between hosts is “complex” Allowing fail-over of containers between hosts is “complex” Storage configuration must transfer between host (no local disk)
- 27. Containers and K8S 28 April 2023 Challenges Cross node consistency Security integration Configuration management Access Patching/maintenance
- 28. Containers and K8S 29 April 2023 Container platform solution Multi cloud / environment; hybrid Multi-node deployment with failover handling Auto-scale vertical and horizontal State machine Describe what you want – not where, how Configuration Management - pluggable Storage Management – pluggable Network Management - pluggable
- 29. Containers and K8S 30 April 2023 Kubernetes – an introduction Containers are ‘pods’ - a pod is the atomic unit that is run A pod can contain more than one container, but it’s not typical Compute nodes run pods Master nodes manages the compute node cluster using a state store Schedule policy API entry point API defined network, storage, authentication
- 30. Containers and K8S 31 April 2023 POD POD containers are wrapped in pods which are units of deployment and management CONTAINER CONTAINER CONTAINER IP: 10.1.0.11 IP: 10.1.0.55
- 31. Containers and K8S 32 April 2023 pods configuration is defined in a deployment image name replicas labels cpu memory storage POD CONTAINER POD CONTAINER POD CONTAINER DEPLOYMENT
- 32. Containers and K8S 33 April 2023 services provide internal load-balancing and service discovery across pods POD CONTAINER POD CONTAINER POD CONTAINER BACKEND SERVICE POD CONTAINER role: backend role: backend role: backend role: backend role: frontend 10.110.1.11 10.120.2.22 10.130.3.33 10.140.4.44 172.30.170.110
- 33. Containers and K8S 34 April 2023 apps can talk to each other via services Invoke Backend API POD CONTAINER POD CONTAINER POD CONTAINER BACKEND SERVICE POD CONTAINER role: backend role: backend role: backend role: backend role: frontend 10.110.1.11 10.120.2.22 10.130.3.33 10.140.4.44 172.30.170.110
- 34. Containers and K8S 35 April 2023 POD routes add services to the external load-balancer and provide readable urls for the app CONTAINER POD CONTAINER POD CONTAINER BACKEND SERVICE ROUTE app-prod.mycompany.com > curl http://app-prod.mycompany.com “route” was a Red Hat extension to K8S before K8S added “ingress” upstream. Same principle – slightly different implementation.
- 35. Containers and K8S 36 April 2023 projects isolate apps across environments, teams, groups and departments POD C POD C POD C PAYMENT DEV POD C POD C POD C PAYMENT PROD POD C POD C POD C CATALOG POD C POD C POD C INVENTORY ❌ ❌ ❌
- 36. Containers and K8S 38 April 2023 High level architecture - K8S/OpenShift
- 37. Containers and K8S 41 April 2023 Typical System Deployment ENTERPRISE LOAD-BALANCER Application Traffic Dev and Ops User NODE CNTRL CNTRL INFRA CNTRL INFRA NODE NODE NODE NODE NODE INFRA NODE
- 38. Containers and K8S 42 April 2023 ● Pluggable routing architecture ○ HAProxy Router ○ F5 Router ○ Cloud based LB ○ Metal LB (VIP) ● Multiple-routers with traffic sharding ● Router supported protocols ○ HTTP/HTTPS ○ WebSockets ○ TLS with SNI ● Non-standard ports via cloud load-balancers, external IP, and NodePort ROUTING AND EXTERNAL LOAD-BALANCING
- 39. Containers and K8S 43 April 2023 K8S Persistent Storage System (CSI) “A request for storage” Provider: ABC Capacity: 10 GiB Features: XYZ PersistentVolumeClaim “A provider of storage” Provider URL: … Credentials: … Options: ... StorageClass “Provisioned Storage” Name: … Size: … AccessMode: ... PersistentVolume APPLICATION POD(S) “sets up” “submits” “submitted to” “creates” Storage Backend “instructs” “provisions” “mounted by”
- 40. Containers and K8S 44 April 2023 44 ● Built-in internal DNS to reach services by name ● Split DNS is supported via SkyDNS ● Master answers DNS queries for internal services ● Other name servers serve the rest of the queries ● Software Defined Networking (SDN) for a unified cluster network to enable pod-to-pod communication ● OpenShift follows the Kubernetes Container Networking Interface (CNI) plug-in model OPENSHIFT NETWORKING
- 41. Containers and K8S 45 April 2023 OPENSHIFT NETWORK PLUGINS OpenShift SDN (OVS) OPENSHIFT KUBERNETES CNI Flannel** Nuage Tigera Calico & CNX Juniper Contrail Cisco Contiv & Contiv-ACI Big Switch Fully Supported Validated VMware NSX-T In-Progress DEFAULT kuryr- kubernetes OpenShift SDN (OVN*) * Default in OCP 4.1 ** Flannel is minimally verified and is supported only and exactly as deployed in the OpenShift on OpenStack reference architecture Open Daylight (CNI & Kuryr) RH-OSP Neutron Plugin
- 42. Containers and K8S 46 April 2023 Container++ Knative (Cloud Native) Serverless / ServiceMesh CodeReady (IDE in a browser) AI/ML HPC …. ?
- 43. Containers and K8S 47 April 2023 CONFIDENTIAL - FOR INTERNAL USE ONLY
- 44. April 2023 Let's look at containers on K8S / OpenShift Local Demo time
- 45. Containers and K8S 49 April 2023 Kubernetes is ... A runtime platform for containers A platform – just like Linux – providing fundamental services to run/manage containers A state machine An API Controls Networking Storage Deployments Scheduling And a wide range of custom things
- 46. Containers and K8S 50 April 2023 Commands we looked at podman pull, run, inspect, images oc / kubectl (for our talk they are the same) curl
- 47. Containers and K8S 51 April 2023 Getting involved Get involved https://www.okd.io/ https://kubernetes.io/ Try it out!! https://cloud.redhat.com Play in the cloud (for free!) http://learn.openshift.com/
- 48. Containers and K8S 52 April 2023 Get Involved - Podman In Action Written by Mr. Container and Mr. Security himself Daniel Walsh Talks about how container engines work what goes on behind the scenes options and why you may choose one cool features/options you don't know https://www.manning.com/books/podman-in-action
- 49. Containers and K8S 53 April 2023 Thank you! The (IT) future is containerized Unix/Linux has done process isolation for a very long time Delivering software is sending a container – not 150 packages Frameworks make microservice and meshes easier to manage Built in monitoring gives deep insight Self healing Self optimization Secure by default …. Need more reasons???