Archive
Posts in Kubernetes
Using audit2rbac to create RBAC policies from Kubernetes audit log
When I first started with Kubernetes, it took me some time to understand two things. One, how do I generate manifests to run my service. I tackled this in a previous blog post. The second was wrapping my head around RBAC policies…
$ read more →Using external-dns to managed DNS entries in Kubernetes clusters
Kubernetes provides a service resource to distribute traffic across one or more pods. I won't go into detail on what a service is, since it's covered in-depth elsewhere. For Internet-facing applications, this Service will typically be of type LoadBalancer. If you are running in the "cloud," creating a service of type LoadBalancer will trigger cloud provider specific logic to provision an external load balancer (either private or public) with the target being your service…
$ read more →Notes from episode 70 of TGIK: Assuming AWS roles with kube2iam/kiam
Over the past few months I've been trying to learn everything there is to know about Kubernetes. Kubernetes is an amazing technology for deploying and scaling containers though it comes with a cost. It's an incredibly complex piece of software and there are a ton of bells and whistles to become familiar with. One way that I've found for coming up to speed is Joe Beda's weekly TGIK live broadcast…
$ read more →Observing Kubernetes kubectl API calls
Recently I spent some time digging into the Kubernetes API. This was an incredible experience, and it really helped me understand the various calls, how they are structured, and what they do. To observe the API calls made by kubectl, you can run it with the "-v10" option: This will print a TON of information to your screen. To see the API calls generated by $(kubectl get po), you can grep the results for GET: The API call to retrieve the list of pods contains the API version, the namespace to retrieve pods from, and the the results are paginated to 500 by default…
$ read more →The beginners guide to creating Kubernetes manifests
As a long time Kubernetes user the question I hear most often is "how do I create manifests (the file that describes how to create and manage resources in a cluster)?" When I ask the person posing the question how they are creating resources today, I frequently hear that they cobbled together a bunch of random manifests they found on the 'net or are using $(kubectl apply -f http://site/manifest) based on a website suggestion. Learning how to generate manifests from scratch baffled me when I was first getting started with Kubernetes. I couldn't find a comprehensive guide showing how to create resources from scratch, and the information needed to become proficient with this process was scattered across various sites. To assist folks who are just entering the K8S space I thought I would document the process I use to approach the "how do I create a manifest from scratch?" question…
$ read more →