The secret life of Pods

whoami

Pieter Lange
Infrastructure / DevOps engineer
pieter@ptlc.nl
github.com/pieterlange
Specialize in kubernetes based deployments

Agenda

"Don’t anthropomorphize computers, they hate that" - David Wheeler

What is a Pod?
Conception (CI build)
Birth (deployment)

Life (running in k8s)

The environment
Finding a mate (service discovery)
Health

Retirement and death

Deployment patterns

Sidecar
Ambassador
Adapter

What is a Pod?

Pods are not pets!

What is a Pod?

Unless they are....

What is a Pod?

Running instances of applications

Smallest schedulable unit
One or more containers that share the namespace/are tightly coupled
Ephemeral!
Namespace?

Shared memory (SHM)
Volumes
IP
hostname

Pods

Containers follow standards

The Twelve-Factor App

Build server

Overview

```
git push
```
Run your tests
Start docker build
Push artifact to registry
Notify deployment manager
Automatic canary/feature deployment
(Choose environment to deploy to)

Birth certificate

https://grafeas.io

Birth

Pods are born from:

Replication controllers
Deployments (ReplicaSets)
Cronjobs (Jobs)
DaemonSet
~~PetSet~~

StatefulSet

Pod

              
apiVersion: v1
kind: Pod
metadata:
  name: ptlcdebug
spec:
  containers:
  - command:
    - sleep
    - "86400"
    image: alpine:3.7
    name: alpine

Everything's just Pod templates

               
apiVersion: v1
kind: ReplicationController
metadata:
  name: ptlcdebug
spec:
  replicas: 3
  selector:
    app: ptlcdebug
  template:
    metadata:
      name: ptlcdebug
      labels:
        app: ptlcdebug
    spec:
      containers:
      - command:
        - sleep
        - "86400"
        image: alpine:3.7
        name: alpine

Pod life

The environment

Variables

Neighbouring services

OPENLDAP_PORT_389_TCP_ADDR=10.102.226.153

```
OPENLDAP_PORT_389_TCP_PORT=389
```
```
OPENLDAP_PORT_389_TCP_PROTO=tcp
```
```
OPENLDAP_SERVICE_HOST=10.102.226.153
```
```
OPENLDAP_SERVICE_PORT=389
```

OPENLDAP_PORT_389_TCP=tcp://10.102.226.153:389

```
OPENLDAP_PORT=tcp://10.102.226.153:389
```

The environment

Variables

Variables in PodSpec

             
containers:
- name: mycontainer
  image: alpine:3.7
  <...>
  env:
  - name: MY_ENVIRONMENT_VARIABLE
    value: "value"
  - name: AND_ANOTHER
    value: "yup"

The environment

Variables

Variables in PodSpec from shared ConfigMap

             
containers:
- name: mycontainer
  image: alpine:3.7
  <...>
  env:
  - name: LOG_LEVEL
    valueFrom:
      configMapKeyRef:
        name: ddyparams
        key: loglevel

The environment

Variables

Variables in PodSpec from Secret

             
containers:
- name: mycontainer
  image: alpine:3.7
  <...>
  env:
  - name: DATABASE_URL
    valueFrom:
      secretKeyRef:
        name: myapp
        key: databaseurl

The environment

Variables

Variables in PodSpec from Downward API

             
containers:
- name: mycontainer
  image: alpine:3.7
  <...>
  env:
  - name: MY_POD_NAME
    valueFrom:
      fieldRef:
        fieldPath: metadata.name

The environment

Variables

Load all key/value pairs from ConfigMap or Secret using envFrom

             
containers:
- name: mycontainer
  image: alpine:3.7
  envFrom:
  - secretRef:
      name: app-secrets
  - configMapRef:
      name: app-configs

The environment

Volumes

emptyDir
hostPath
secret
GCEPersistentDisk
AWSElasticBlockStore
NFS
iSCSI
RBD
CephFS
Cinder
VsphereVolume

The environment

Kubernetes default serviceaccount

              
~ # ls -al /var/run/secrets/kubernetes.io/serviceaccount
total 0
drwxrwxrwt    3 root     root           140 Sep 24 14:26 .
drwxr-xr-x    3 root     root            27 Sep 24 14:26 ..
drwxr-xr-x    2 root     root           100 Sep 24 14:26 ..9989_24_09_14_26_34.196016358
lrwxrwxrwx    1 root     root            31 Sep 24 14:26 ..data -> ..9989_24_09_14_26_34.196016358
lrwxrwxrwx    1 root     root            13 Sep 24 14:26 ca.crt -> ..data/ca.crt
lrwxrwxrwx    1 root     root            16 Sep 24 14:26 namespace -> ..data/namespace
lrwxrwxrwx    1 root     root            12 Sep 24 14:26 token -> ..data/token

Health checks

                
livenessProbe:
  httpGet:
    path: /health
    port: 80
  initialDelaySeconds: 120
  timeoutSeconds: 1
  periodSeconds: 10
  successThreshold: 1
  failureThreshold: 3

Readiness checks

                
readinessProbe:
  httpGet:
    path: /ready
    port: 80
  initialDelaySeconds: 120
  timeoutSeconds: 1
  periodSeconds: 10
  successThreshold: 1
  failureThreshold: 3

Also: