Chapter 1: Why Kubernetes?

1.1 Pre-Preparation - Reviewing Some Key Terms
1.2 Infrastructure Drift Issues and Kubernetes
1.3 Containers and Images
1.4 Core Fundamentals of Kubernetes
__1.4.1 In Kubernetes, all infrastructure rules are managed with plain YAML.
1.5 Kubernetes Features
1.6 Kubernetes Components and Architecture
__1.6.1 Kubernetes API
__1.6.2 Example 1: Online Retailer
__1.6.3 Example 2: Online Donation Solution
1.7 When not to use Kubernetes
summation

Chapter 2: Why Pad?

2.1 Web Application Example
__2.1.1 Web Application Infrastructure
__2.1.2 Operational Requirements
2.2 What is a pad?
__2.2.1 Various Linux namespaces
__2.2.2 Kubernetes, Infrastructure, Pods
__2.2.3 Node API Objects
__2.2.4 Web Applications and the Control Plane
2.3 Creating a web application with kubectl
__2.3.1 Kubernetes API Server: kube-apiserver
__2.3.2 Kubernetes Scheduler: kube-scheduler
__2.3.3 Infrastructure Controller
2.4 Scalable, High-Availability Applications, Control Plane
__2.4.1 Auto-expansion
__2.4.2 Cost Management
summation

Chapter 3: Creating a Pod

3.1 Exploring Kubernetes Fundamentals with Kind
3.2 What are the Linux basics?
__3.2.1 Linux basics are resource management tools
__3.2.2 Everything is a file (or file descriptor)
__3.2.3 files can be synthesized
__3.2.4 kind setting
3.3 Using Linux Basics in Kubernetes
__3.3.1 Prerequisites for running pods
__3.3.2 Running a simple pod
__3.3.3 Exploring the Linux Dependencies of a Pod
3.4 Creating a pod from scratch
__3.4.1 Creating an isolated process using chroot
__3.4.2 Providing process data for tasks using mounts
__3.4.3 Process Security via Unshare
__3.4.4 Creating a Network Namespace
__3.4.5 Checking process status
__3.4.6 Adjusting CPU through cgroups
__3.4.7 Creating a resource stanza
3.5 Using Pads in Real Life
__3.5.1 Networking Issues
__3.5.2 Understanding how to implement kube-proxy as a Kubernetes service using iptables
__3.5.3 Using the kube-dns pod
__3.5.4 Considering Other Issues
summation

Chapter 4: Using cgroups with processes within a pod

4.1 The pod is idle until the preparation task is completed.
4.2 Processes and Threads in Linux
__4.2.1 sytemd and init processes
__4.2.2 cgroups of processes
__4.2.3 Implementing cgroups for regular pods
4.3 Testing cgroups
4.4 How kubelet manages cgroups
4.5 Learn more about how the kubelet manages resources.
__4.5.1 Why can't the OS use swap in Kubernetes?
__4.5.2 Hacking: How the Poor Manage Their Priorities
__4.5.3 Hack: Editing HugePages with the init container
__4.5.4 Why QoS classes are important and how they work
__4.5.5 Creating a QoS class through resource settings
4.6 Monitoring the Linux Kernel with Prometheus, cAdvisor, and API Server
__4.6.1 Metrics are inexpensive to publish and very valuable.
__4.6.2 Why is Prometheus needed?
__4.6.3 Creating a Local Prometheus Monitoring Service
__4.6.4 Characterizing System Failures in Prometheus
summation

Chapter 5: Container Network Interfaces (CNIs) and Serving Pods Over the Network

5.1 Why Kubernetes Needs SDN
5.2 Implementing the Service Side of Kubernetes SDN: kube-proxy
__5.2.1 kube-proxy data plane
__5.2.2 NodePort Service
5.3 CNI Providers
5.4 A Look at Two CNI Networking Plugins: Calico and Antrea
__5.4.1 Architecture of the CNI Plugin
__5.4.2 Let's use CNI
__5.4.3 Installing the Calico CNI Provider
__5.4.4 Kubernetes Networking with OVS and Antrea
__5.4.5 Notes on CNI providers and kube-proxy on other OSes
summation

Chapter 6: Troubleshooting Large-Scale Network Errors

6.1 Sonobuoy - Tool for verifying cluster functionality
__6.1.1 Tracing the data path of a pod in a real cluster
__6.1.2 Setting up a cluster with the Antrea CNI provider
6.2 Checking CNI routing of various providers using arp and ip commands
__6.2.1 What is an IP tunnel, and why do CNI providers use IP tunnels?
__6.2.2 How many packets flow through the CNI's network interface?
__6.2.3 path
__6.2.4 CNI-specific tool - OVS (Open vSwitch)
__6.2.5 Tracing the data path of an active container using tcpdump
6.3 kube-proxy and iptables
__6.3.1 iptables-save and diff tools
__6.3.2 Examining How Network Policies Modify CNI Rules
__6.3.3 How are these policies implemented?
6.4 Ingress Controller
6.4 Ingress Controller
__6.4.1 Setting Contour and Kind for Exploring Ingress Controllers
__6.4.2 Setting up a simple web server pod
summation

Chapter 7: Pod Storage and CSI

7.1 Quick Workaround: Linux's Virtual File System (VFS)
7.2 Kubernetes Requirements for Three Storage Types
7.3 Creating a PVC in a Kind Cluster
7.4 Container Storage Interface (CSI)
__7.4.1 Entry Provider Issues
__7.4.2 CSI as a specification that operates inside Kubernetes
__7.4.3 CSI - How Storage Drivers Work
__7.4.4 Bind Mounting
7.5 A brief overview of some running CSI drivers
__7.5.1 Controller
__7.5.2 Node Interface
__7.5.3 CSI for non-Linux OS
summation

Chapter 8: Storage Implementation and Modeling

8.1 A Microscope of the Broader Kubernetes Ecosystem - Dynamic Storage
__8.1.1 Instant Storage Management - Dynamic Provisioning
__8.1.2 Comparison of local storage and emptyDir
__8.1.3 PersistentVolume
__8.1.4 Container Storage Interface (CSI)
8.2 Dynamic provisioning benefits from CSI, but is orthogonal.
__8.2.1 StorageClasses
__8.2.2 Back to Data Center Items
8.3 Kubernetes Use Cases for Storage
__8.3.1 Secret - Temporary File Sharing
8.4 What does a dynamic storage provider typically look like?
8.5 hostPath for system control and/or data access
__8.5.1 hostPath, CSI, and CNI: Standard Use Cases
__8.5.2 Cassandra: An Example of Real-World Kubernetes Application Storage
__8.5.3 Advanced Storage Features and the Kubernetes Storage Model
8.6 Further Reading
summation

Chapter 9: Running Pods: How the Kubelet Works

9.1 Kubelet and Nodes
9.2 The core of the kubelet
__9.2.1 Container Runtime: Standards and Conventions
__9.2.2 Kubelet Configuration and API
9.3 Creating a Pod and Seeing It in Action
__9.3.1 Starting the kubelet binary
__9.3.2 After startup: Node lifecycle
__9.3.3 Etcd leases and locks, and the evolution of node leases
__9.3.4 Kubelet's Pod Lifecycle Management
__9.3.5 CRI, Containers, and Images: How They Relate
__9.3.6 kubelet doesn't run containers: that's CRI's job
__9.3.7 Pause Container: Moment of Realization
9.4 Container Runtime Interface (CRI)
__9.4.1 Telling Kubernetes where the container runtime is located
__9.4.2 CRI routine
__9.4.3 Abstraction of kubelet related to CRI: GenericRuntimeManager
__9.4.4 How is CRI called?
9.5 Kubelet Interface
__9.5.1 Runtime Internal Interface
__9.5.2 How the kubelet fetches images - the ImageService interface
__9.5.3 Providing ImagePullSecrets to the kubelet
9.6 Further Reading
summation

Chapter 10: DNS in Kubernetes

10.1 A Brief Introduction to DNS (and CoreDNS)
__10.1.1 NXDOMAIN, record, CNAME record
__10.1.2 Pods require internal DNS
10.2 Why use StatefulSets instead of Deployments?
__10.2.1 DNS with Headless Services
__10.2.2 Persistent DNS records within a StatefulSet
__10.2.3 Using a Polyglot Deployment to Lookup DNS Properties of Pods
10.3 resolv.conf file
__10.3.1 Simple Routing Notes
__10.3.2 CoreDNS: Upstream resolver for ClusterFirst pod DNS
__10.3.3 Hacking the CoreDNS plugin configuration
summation

Chapter 11: The Core of the Control Plane

11.1 Control Plane Overview
11.2 API Server Details
__11.2.1 API Objects and Custom API Objects
__11.2.2 Custom Resource Definitions (CRDs)
__11.2.3 Scheduler Details
__11.2.4 Revisiting Scheduling
11.3 Controller Manager
__11.3.1 Storage
__11.3.2 Service Accounts and Tokens
11.4 Kubernetes Cloud Controller Manager (CCM)
11.5 Further Reading
summation

Chapter 12.
etcd and the control plane

12.1 Note for the Impatient
__12.1.1 Visualizing etcd performance with Prometheus
__12.1.2 Knowing when to tune etcd
__12.1.3 Example: Quick health check of etcd
__12.1.4 etcd v3 vs.
v2
12.2 etcd as a data store
__12.2.1 Watch: Can I run Kubernetes on a different database?
__12.2.2 Strict Consistency
__12.2.3 fsync operation makes etcd consistent
12.3 Exploring the etcd Interface for Kubernetes
12.4 etcd keeps facts accurate
__12.4.1 etcd pre-written log
__12.4.2 Impact on Kubernetes
12.5 CAP Theorem
12.6 Client-Level Load Balancing and etcd
__12.6.1 Size Limits: What to (and Don't) Worry About
12.7 eted encryption
12.8 Performance and Fault Tolerance of etcd at Global Scale
12.9 Heartbeat Times in Highly Distributed etcd
Setting up an etcd client on a 12.10 kind cluster
__12.10.1 Running etcd in non-Linux environments
summation

Chapter 13: Container and Pod Security

13.1 Blast Radius
__13.1.1 Vulnerability
__13.1.2 Intrusion
13.2 Container Security
__13.2.1 Container and Custom Software Update Plan
__13.2.2 Container Inspection
__13.2.3 Container User - Do not run as root user
__13.2.4 Use the smallest container possible
__13.2.5 Container Source
__13.2.6 Linters for Containers
13.3 Pad Security
__13.3.1 Security Context
__13.3.2 Escalated Privileges and Functions
__13.3.3 Pad Security Policy (PSP)
__13.3.4 Do not automatically mount service account tokens
__13.3.5 pseudo-root pod
__13.3.6 Security Perimeter
summation

Chapter 14: Node and Kubernetes Security

14.1 Node Security
__14.1.1 TLS Certificate
__14.1.2 Patching Immutable OS vs. Node
__14.1.3 Isolated Container Runtime
__14.1.4 Resource Attacks
__14.1.5 CPU Unit
__14.1.6 Memory Unit
__14.1.7 Storage Units
__14.1.8 Host Network vs.
Pod Network
__14.1.9 Pad Example
14.2 API Server Security
__14.2.1 Role-Based Access Control (RBAC)
__14.2.2 RBAC API Definition
__14.2.3 Resources and Subresources
__14.2.4 Subjects and RBAC
__14.2.5 RBAC Debugging
14.3 Authn, Authz, Secret
__14.3.1 IAM Service Accounts: Cloud API Security
__14.3.2 Cloud Resource Access
__14.3.3 Dedicated API Server
14.4 Network Security
__14.4.1 Network Policy
__14.4.2 Load Balancer
__14.4.3 OPA (Open Policy Agent)
__14.4.4 Multi-tenancy
14.5 Kubernetes Tips
summation

Chapter 15: Installing Applications

15.1 Thoughts on Kubernetes Apps
__15.1.1 The scope of your application affects the tools you use.
15.2 Microservice apps require thousands of lines of configuration code.
15.3 Rethinking Guestbook App Installation in a Real-World Environment
15.4 Installing the Carvel Toolkit
__15.4.1 Part 1: Modularizing Resources into Separate Files
__15.4.2 Part 2: Patching Application Files Using ytt
__15.4.3 Part 3: Managing and Deploying Guestbook as a Single Application
__15.4.4 Part 4: Configuring the kapp Operator for Application Packaging and Management
15.5 Revisiting Kubernetes Operators
15.6 Tanzu Community Edition: Complete Examples for the Carvel Toolkit
summation

What this book covers

-Basic components of Kubernetes
-Storage and Container Storage Interface
-Kubernetes Security
- Various ways to create a Kubernetes cluster
- Details on the control plane, networking, and other core components