Please enable JavaScript.

Coggle requires JavaScript to display documents.

Kubernetes (Scheduling Maintain target state (labels Affects scheduling…

- - - - Master node defaults with NoSchedule taint
- - - - Collection of charts
    - - config.yaml
      - From command-line with --set
    - - Instance of a chart
  - - - Creates a release #
- - - - NGINX Ingress Controller
        
        Features
        
        Mergeable ingress reources
        
        Several teams can publish their services through the same listen port, they do not need to coordinate to create a single Ingress resource. They can instead develop their Ingress resources and policies independently, and the NGINX Ingress Controller merges them automatically.
        
        Monitors Ingress resources
        
        Automatically configures NGINX to route and load balance traffic to different services
- - - - Added to the cluster API path under apiextensions.k8s.io/v1beta1
      - Must respond to REST requests
    - - --enable-aggregator-routing=true
      - Greater flexibility
      - Subordinate to kube-apiserver
- - - - :red_flag:
        Requests are encrypted with TLS which must be configured using SSL certificates
    - - Authenticator Modules
        
        Static password file
        
        Service account
        
        x509 certificate
        
        Tokens
        
        OpenID connect
        
        Bootstrap
        
        Static
        
        Bearer
      - Webhooks
        
        Verify bearer tokens
        
        Connect with OpenID provider
    - - Modes
        
        Webhook
        
        :star:RBAC
        
        verbs
        
        apiGroups
        
        resources
        
        Access and authorization setup process
        
        Create a namespace
        
        Create a user
        
        Generate credentials for user
        private key, certificate signing request, x509 certificate
        
        Deploy a Role
        RBAC
        
        Deploy a RoleBinding
        Associate user, Role, namespace
        
        Create a context
        
        ABAC
        Attribute based
    - - Initializers
        Allows modification of API request
      - LimitRanger
      - DefaultStorageClass
      - NamespaceLifeCycle
      - ServiceAccount
      - ResourceQuota
        Ensures object doesn't violate existing quotas
      - DefaultTolerationSeconds
      - NodeRestriction
  - - - Source
      - By default all pods can reach each other
      - Define ingress rules to restrict traffic between namespaces
      - Not all providers support the NetworkPolicies kind
      - Security cluster networking with network policies (youtube)
    - - Limitations that are defined for entire pod or per container
      - PodSeurityPolicies
        PSP
        
        Cluster-level rules that govern what a pod can do, what they can access, what user they run as, etc.
- - - - labels
      - Pod template
      - spec
        
        strategy
        
        RollingUpdate
        
        controls how many Pods are deleted at a time
        
        maxsurge
        
        maxUnavailable
        
        Recreate
        
        deletes all existing pods before new pods are created
        
        replicas #
    - - Kind
        
        ReplicaSet
        
        Pods
        
        Containers
        
        Versioned configs
        
        Rollback to previous config
        
        DaemonSet
        
        updateStrategy
        
        OnDelete
        
        RollingUpdate
        
        kubectl set image ds ds-one nginx=nginx:1.8.1.-alpine
  - - - # yaml apiVersion: ... kind: ... metadata: ... spec: ...
    - - Deployment
      - Podd
      - ResourceQuota
      - LimitRange