Run apps with Deployments, ConfigMaps and Secrets — CKA Hoofdstuk 6

Dit deel is nog niet vertaald. Je ziet de Engelse tekst.

$ als gewone gebruiker# als root (of met sudo)

Vaardigheden in dit hoofdstuk

Deployments, rollouts, rollbacks, ConfigMaps, Secrets en autoscaling

Create and scale a Deployment

A Deployment manages a ReplicaSet, which keeps the pods running.

$kubectl create deployment web --image=nginx:1.27 --replicas=3 -n shop
$kubectl get deploy,rs,pods -n shop -l app=web
$kubectl scale deployment web --replicas=5 -n shop
$kubectl create deployment web --image=nginx:1.27 --replicas=3 --dry-run=client -o yaml > web.yaml

6.2

Roll out and roll back

Changing the pod template (for example the image) starts a rolling update; every change is a revision.

$kubectl set image deployment/web nginx=nginx:1.27.3 -n shop
$kubectl rollout status deployment/web -n shop
$kubectl rollout history deployment/web -n shop
$kubectl rollout undo deployment/web -n shop
$kubectl rollout undo deployment/web --to-revision=2 -n shop
$kubectl rollout restart deployment/web -n shop
$kubectl annotate deployment/web kubernetes.io/change-cause="nginx 1.27.3" -n shop

strategy (part of web.yaml)

spec:
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxSurge: 1
      maxUnavailable: 0

Strategy	Behaviour
RollingUpdate	Replace pods step by step (`maxSurge`, `maxUnavailable`)
Recreate	Stop all, then start new (downtime)

6.3

Configure apps with ConfigMaps and Secrets

Keep config out of the image. Use it as environment variables or as files.

$kubectl create configmap web-config --from-literal=APP_ENV=prod --from-file=nginx.conf -n shop
$kubectl create secret generic db-cred --from-literal=username=shop --from-literal=password='S3cret!' -n shop
$kubectl get secret db-cred -n shop -o jsonpath='{.data.password}' | base64 -d

pod part

spec:
  containers:
    - name: app
      image: ghcr.io/s0sta/shop:1.4.0
      envFrom:
        - configMapRef: { name: web-config }
      env:
        - name: DB_PASSWORD
          valueFrom:
            secretKeyRef: { name: db-cred, key: password }
      volumeMounts:
        - name: conf
          mountPath: /etc/nginx/conf.d
  volumes:
    - name: conf
      configMap: { name: web-config }

Let op

Secrets are only base64-encoded, not encrypted, unless encryption at rest is set up (see CKS secrets). Limit who can read them with RBAC.

6.4

Check health with probes

Probes tell Kubernetes if a container is alive and ready.

probes (container part)

readinessProbe:
  httpGet: { path: /ready, port: 8080 }
  periodSeconds: 5
livenessProbe:
  httpGet: { path: /health, port: 8080 }
  initialDelaySeconds: 10
  failureThreshold: 3
startupProbe:
  httpGet: { path: /health, port: 8080 }
  failureThreshold: 30
  periodSeconds: 5

Probe	When it fails
readiness	The pod gets no Service traffic (not restarted)
liveness	The container is restarted
startup	Other probes wait until it succeeds (slow-starting apps)

6.5

Scale automatically with HPA

The HorizontalPodAutoscaler changes the replica count by CPU, memory or custom metrics. It needs metrics-server and resource requests on the pods.

$kubectl autoscale deployment web --cpu-percent=70 --min=2 --max=10 -n shop
$kubectl get hpa -n shop
$kubectl top pods -n shop

6.6

Use the other workload types

Pick the controller that fits the job.

$kubectl create job backup --image=busybox -- sh -c 'echo backup done'
$kubectl create cronjob cleanup --image=busybox --schedule="0 2 * * *" -- sh -c 'echo clean'
$kubectl get daemonset -A
$kubectl get statefulset -A

Kind	For
Job	Run once to completion (`completions`, `parallelism`, `backoffLimit`)
CronJob	A Job on a schedule (cron syntax)
DaemonSet	One pod per node
StatefulSet	Stable names (`db-0`, `db-1`) and one volume per pod

Alle commando's in dit hoofdstuk

kubectl