1 of 52

How to Make Kubernetes

Rhyme with Prod-Readiness

Tiffany Jernigan

VMware

Matthias Häußler

Novatec

www.containerdays.io

#CDS23

2 of 52

Who we are

Tiffany Jernigan

Sr. Dev Advocate, VMware

@tiffanyfayj

Matthias Häußler

Chief Technologist, Novatec

@maeddes

@maeddes @tiffanyfayj

3 of 52

@maeddes @tiffanyfayj

4 of 52

Why this talk?

www.containerdays.io

#CDS23

@maeddes @tiffanyfayj

5 of 52

@maeddes @tiffanyfayj

6 of 52

🎉

🥰

🥳

@maeddes @tiffanyfayj

7 of 52

What is

production readiness?

www.containerdays.io

#CDS23

@maeddes @tiffanyfayj

8 of 52

🎉

🥰

🥳

@maeddes @tiffanyfayj

9 of 52

Prod readiness in detail

Has undergone rigorous testing and quality assurance
Ensured it’s reliable, stable and secure
Performs optimally under expected load and traffic conditions
Adaptive to unexpected load/traffic conditions and failures
Properly documented & described
Consistently and repeatably buildable
Monitored and Observable - Ability to identify and resolve issues quickly
"Future-proofing": Being able to upgrade to patch security issues

@maeddes @tiffanyfayj

M

We are a fan of visualization, but this the only slide with bulleted list on our presentation. ��Essential thing is bullet 2: reliable, stable, secure. Performance, adaptivity�Documentation: have a proper text doc/wiki that describes it, but also is basically manifested in a clean code format to be easily reproducible/replicated in case things go wrong��Probably valid for any kind of system that provides services. Nothing specific to cloud native, k8s, container aspects. As we know we're at Kubecon where the main topic is kubernetes XD. So we want to narrow it down to a bit of a k8s scope. To look at it in a way to see how many of these things in the list are already addressed by a plain, vanilla k8s. Basically, what it provides out of the box in every form. And also look to see what the delta is/what we're still missing and then can say it's prod ready with that configuration.

10 of 52

What does “vanilla” Kubernetes provide?

www.containerdays.io

#CDS23

@maeddes @tiffanyfayj

11 of 52

@maeddes @tiffanyfayj

12 of 52

@maeddes @tiffanyfayj

13 of 52

@maeddes @tiffanyfayj

14 of 52

@maeddes @tiffanyfayj

15 of 52

@maeddes @tiffanyfayj

16 of 52

@maeddes @tiffanyfayj

17 of 52

@maeddes @tiffanyfayj

18 of 52

What is “vanilla” Kubernetes missing?

www.containerdays.io

#CDS23

@maeddes @tiffanyfayj

19 of 52

Summary

@maeddes @tiffanyfayj

20 of 52

Infrastructure

@maeddes @tiffanyfayj

21 of 52

Infrastructure

@maeddes @tiffanyfayj

M

Temporary Tiffany notes:�Storage class: when you want to storage persistent data, you need to create persistent volumes (e.g. EBS on AWS, portworx). On prem- you might have a SAN (storage area network). Storage classes are a way to represent the different things available to you. In k8s you have a pattern in many places – many places with multiple options. E.g. in ingress you can do contour, nginx, traefik etc etc. since k8s some # you have ingress classes. Might have an nginx ingress class, traefik ingress class. When you create an ingress you can choose what class you want to use. Basically storage classes let you pick between different storage options/types.

Some backing up: etcd (manifests) backup, Velero for workloads

managed svcs: ??

high scale of nodes: e.g. kube-proxy limitations on IP tables for instance and need IPVS (e.g. replace for Cillium which you can then use as CNI and network policy plugins)

—

22 of 52

Networking - Inbound traffic

@maeddes @tiffanyfayj

23 of 52

Networking - Traffic control

@maeddes @tiffanyfayj

24 of 52

Networking - Traffic control

@maeddes @tiffanyfayj

25 of 52

O11y

@maeddes @tiffanyfayj

26 of 52

O11y

@maeddes @tiffanyfayj

27 of 52

Security - API Access / RBAC

@maeddes @tiffanyfayj

28 of 52

Workloads

@maeddes @tiffanyfayj

29 of 52

Workloads

@maeddes @tiffanyfayj

30 of 52

Workloads

@maeddes @tiffanyfayj

31 of 52

Workloads

@maeddes @tiffanyfayj

32 of 52

GitSecOps

@maeddes @tiffanyfayj

33 of 52

“Summary”

@maeddes @tiffanyfayj

34 of 52

Summary

@maeddes @tiffanyfayj

35 of 52

pod logs	logs	observability
kubelet logs
control plane logs
metrics-server	metrics
time series database (Prom, etc)	metrics
tracing	tracing
ingress controller	networking
service mesh	networking
Gateway API
network policies	security
secret manager	security
PVC backups	infrastructure/ backups
control plane backups (if applicable)
cluster autoscaler (when applicable)

@maeddes @tiffanyfayj

36 of 52

37 of 52

Infrastructure

@maeddes @tiffanyfayj

38 of 52

Network

@maeddes @tiffanyfayj

39 of 52

Observability

@maeddes @tiffanyfayj

40 of 52

Security

@maeddes @tiffanyfayj

41 of 52

Workloads

@maeddes @tiffanyfayj

42 of 52

And now what?

www.containerdays.io

#CDS23

@maeddes @tiffanyfayj

43 of 52

44 of 52

Management

@maeddes @tiffanyfayj

45 of 52

@maeddes @tiffanyfayj

46 of 52

Novatec Training Environment

@maeddes @tiffanyfayj

47 of 52

48 of 52

Cloud vs On-Prem

@maeddes @tiffanyfayj

49 of 52

Managed vs Self-Hosted

@maeddes @tiffanyfayj

50 of 52

@maeddes @tiffanyfayj

51 of 52

Summary

In the end there is no right or wrong,

it is more about the decision where to invest the time and money

Maintain the stack yourself -> Invest in the skill and have it in-house
Have someone done it for you -> Invest in service providers

In general we recommend to use the highest abstraction possible

Don’t solve problems which have already been solved!

Using and relying on a ready tested platform will let you focus more on higher abstractions -> your apps!

If there is a managed solution that suits your needs -> use it!
If you want to manage the stack yourself -> get enablement & consultancy

@maeddes @tiffanyfayj

52 of 52

Please reach out to us!

Tiffany Jernigan

Sr. Dev Advocate, VMware

@tiffanyfayj

Matthias Häußler

Chief Technologist, Novatec

@maeddes

@maeddes @tiffanyfayj