### Elliptic-curve cryptography (ECC)

Elliptic-curve cryptography (ECC)

finding the discrete logarithm of a random elliptic curve element with respect to a publicly known base point is infeasible: this is the "elliptic curve discrete logarithm problem" (ECDLP).

Applicable for
ECC Key length comparison with RSA Key length.

 RSA ECC 512 112 1024 160 2048 224 3072 256 7680 384 15360 512

Elliptic Curve
• Symmetric to X axis
• Straight line : intersect with 3 points
• y ^ 2 = x ^3 + a * x + b Weierstrass equation.
• No self-intersections,
• No isolated points
• R = P + Q : First, draw the line that intersects P and Q to curve then third point will be -R
• If line is tangent then also it interacts with one more curve.
• All vertical lines intersects the curve at infinity.
• Other algorithms
ECC implementation

Module form https://en.wikipedia.org/wiki/Modular_form and Field arithmetic https://en.wikipedia.org/wiki/Field_arithmetic

* Software

* Hardware

### Public Key Cryptography

PKI (Public Key Infrastructure)

• CA (Certificate Authority) binds public key with identity. = TTP Trusted Third
• Party. E.g. Symantec, Comodo, GoDaddy
• OSCP Responder
• RA (Registration Authority) = subordinate CA in Microsoft PKI.
• VA (Validation Authority)
• Central Directory to store index keys
• Certificate Management System
• Certificate Policy
Method of certification

1. CA

2. Web of Trust. E.g. PGP (Pretty Good Privacy) and GnuPG
3. Simple Public Key Infrastructure (SPKI). Authorization loop : verifier = issuers

Open Source implementation of CA

• OpenSSL is the simplest CA and tool to build PKI enabled apps. C. Part of all major Linux distributions,
• EJBCA is a full featured, Enterprise grade, CA implementation. Java.
• OpenCA is a full featured CA implementation
• XCA is a graphical interface, and database.
• (Discontinued) TinyCA was a graphical interface for OpenSSL.
• XiPKI CA and OCSP responder. With SHA3 support, OSGi-based Java.
• IoT_pki is a simple PKI. Python cryptography library
• DogTag
• gnoMint
• EasyRSA, OpenVPN's command line CA utilities using OpenSSL.
• r509
• Boulder is an automated server that uses the Automated Certificate Management Environment (ACME) protocol.
• Windows Server : Active Directory Certificate Services.
Free digital certificate for public by CA

• CAcert  https://en.wikipedia.org/wiki/CAcert
• Let's Encrypt. https://en.wikipedia.org/wiki/Let%27s_Encrypt
Tools

• genrsa
• ssh-keygen
Standards

Public Key Cryptography Standards : https://en.wikipedia.org/wiki/PKCS
Cryptographic Message Syntax :  https://en.wikipedia.org/wiki/Cryptographic_Message_Syntax and RFC 2315, RFC 2360, RFC 3369

Books

1. Introduction to cryptography and network security

2. Cryptography theory and practice

3. Field Arithmetic

4. Problems in the Theory of Modular Forms

### Kubernates - practicals

To get more practical insight about internals of Kubernetes

2. Learn Kubernetes using Interactive Browser-Based Scenarios
https://www.katacoda.com/courses/kubernetes

3.
Hands-on with Minikube: single node kubernates cluster

To install Minikube :

Free course : “Kubernetes Hardway”

4.

Then execute command:

minikube start

Now play around with Minicube with kubectl

Overview of kubectl

https://kubernetes.io/docs/reference/kubectl/overview/

kubectl Cheat Sheet

https://kubernetes.io/docs/reference/kubectl/cheatsheet/

5. K8S client

https://github.com/kubernetes-client/

https://github.com/kubernetes-client/python

7. Ansible modules

https://docs.ansible.com/ansible/latest/modules/k8s_module.html
https://docs.ansible.com/ansible/latest/modules/k8s_facts_module.html
https://docs.ansible.com/ansible/latest/modules/k8s_scale_module.html

8. Useful commands

https://hub.docker.com/r/karthequian/helloworld/

kubectl run hw --image=karthequian/helloworld --port=80

Deployment name is : hw

kubectl get all
kubectl get pods
kubectl get pods --all-namespaces

the pod is only accessible by its internal IP address within the cluster. To make a container accessible from outside the Kubernetes virtual network, one has to expose the pod as a Kubernetes service using expose command

kubectl expose deployment hello-minikube --type=NodePort

To get YAML file at deployment

kubectl get deploy/hw -o yaml
kubectl get helloworld-service -o yaml

Create

kubectl create -f helloworld-deployment.yml
kubectl create -f helloworld-service.yml
minikube service helloworld

Scale

kubectl get rs //replica set
kubectl scale --replica=3 deply/helloworld-deployment

With Labels

kubectl get pods --show-labels
kubectl label pod/helloworld app=newName --overwrite // to overwrite
kubectl label pod/helloworld app- // to delete

Labels can be used with deployments, services, replica sets etc.

With Selector

To search

kubectl get pods -l label1=value1,label2=value2

kubectl get pods -l label1!=value1

kubectl get pods -l label1 in (value1, value2)

kubectl get pods -l label1 notin (value1, value2)

One can use --selector instead of -l

To delete we can use

kubectl delete pods -l .....

Health check

kubectl create -f helloworld-black.yaml --record

--record is used to add it to roll out history

kubectl set image deployment/navbar-deployment helloworld=karthequian/helloworld:blue

kubectl rollout history deployment/navbar-deployment

kubectl rollout undo deployment/navbar-deployment

to rollback to a specific version. To do this, add a `--to-revision=version`

Debug

kubectl describe pod "pod name"
kubectl describe deployment "deployment name"
kubectl logs "pod name"
kubectl exec --it "pod name" /bin/bash
kubectl exec --it "pod name" -c "container name" /bin/bash

Dashboard

minikube dashboard

kubectl edit "pod name"

Configmaps

an example of "log_level", and pass the value "debug" to a pod via a configmap in this example.

To create a configmap for this literal type
kubectl create configmap logger --from-literal=log_level=debug

To see all your configmaps: `kubectl get configmaps`

To read the value in the logger configmap: `kubectl get configmap/logger -o yaml`

To edit the value, we can run `kubectl edit configmap/logger`

Application Secretes

They cannot be part of YML file.

kubectl create secrete
kubectl get secrete

We have similar CLI commands for cronjobs, statefulsets and namespaces

kubectl create cronjobs
kubectl edit cronjobs/hellow

kubectl create -f "yaml file for statefulsets"
kubectl get statefulsets

namespace provides multi-tenancy to k8s instance. k8s provides multiple virtual cluster on same physical cluster.

kubectl get namespaces
kubectl create namespaces "name"
kubectl delete namespaces "name"

Auto Complete

source <(kubectl completion bash) # setup autocomplete in bash into the current shell, bash-completion package should be installed first.

echo "source <(kubectl completion bash)" >> ~/.bashrc # add autocomplete permanently to your bash shell.

# Get ExternalIPs of all nodes

Events

# List Events sorted by timestamp

Autoscale

kubectl autoscale deployment foo --min=2 --max=10                # Auto scale a deployment "foo"

Running Pods

kubectl logs my-pod                                 # dump pod logs (stdout)
kubectl port-forward my-pod 5000:6000               # Listen on port 5000 on the local machine and forward to port 6000 on my-pod
kubectl top pod POD_NAME --containers               # Show metrics for a given pod and its containers

Use Case : nginx server with load balancer

kubectl run nginx --image = nginx: 1.10 --replicas = 5

kubectl get deployments
kubectl get pods

kubectl expose deployment nginx -type=LoadBalancer -port=80
kubectl get svc

Reference :

### istio

istio

Micro-service mesh management framework

It provides a uniform way to connect, manage, and secure microservices. It supports managing traffic flows between microservices, enforcing access policies, and aggregating telemetry data, all without requiring changes to the microservice code.

Benifit
=======

* A/B testing,
* canary releases,
* failure recovery,
* metrics,

Key Capablity

* Traffic Management
* rate limiting,
* Observability
* monitoring
* Policy Enforcement
* access control,
* Servie identity and security
* service-to-service authentication,
* discovery of services,
* end-to-end authentication.
* Platform Support
* Cloud,
* on-premise,
* Kubernetes,
* Mesos
* Integration and Customization : integrate with existing solutions for
* ACLs,
* logging,
* monitoring,
* quotas,
* auditing
* etc.

==========================

* Grafana : dashboard to visulize service mesh traffic data
* Prometheus : to query istio metrics
* ServiceGraph :  generating and visualizing a graph of services within a mesh
* Zipkin : distributed tracing system

Architecture
============

1. Data plane :
set of intelligent proxy (Envoy)
2. Control plane :
manage and configure proxy
to route traffic
to enforce policy runtime.

1. Envoy : sidecar proxy in same pod with features :
dynamic service discovery,
TLS termination,
HTTP & gRPC proxying,
circuit breakers,
health checks,
staged rollouts with %-based traffic split,
fault injection,
rich metrics.

2. Mixer:
platform independant
flexible plugin model
with a variety of host environments and infrastructure backend
enforce access control
enforce usage policies
collect telemetry data from envoy
Mixer configuration for
attribute extractation
policy evaluation

3. Pilot
converts high level routing rules that control traffic behavior into Envoy-specific configurations
propagates Envoy-specific configurations to the sidecars at runtime
abstracts platform-specifc service discovery mechanisms
transalate service discovery to Envoy data plane API
Benefits
service discovery
traffic management
intelligent routing
A/B tests,
canary deployments
resiliency
timeouts,
retries,
circuit breakers,
etc.
multiple environments
Kubernetes,

4. istio-Auth
Authentication using mutua TLS
Built-in identity + credentials management
enforce policy based on service identity

### Kubernetes

1. Design
=========

API : Primitives (Building Blocks) for
1. deploy
2. maintain
3. scale
apps.

1.1 Pod
=======

* Scheduling unit
* Pod = 1+ co-located containers. and options how container(s) should run
* Pod has unique IP within cluster.
* Can be managed by Kubernetes API or controller.
* they share storage, Linux namespace, IP address
* ephemeral and disposable
* States : pending, running, succeeded, failed, CrashLoopBackOff
* Pod is like an implementation of "composite container pattern"
** pod can have zero or more sidecar containers. Istio add one sidecar container to each pod.

** pod can have zero or more ambassador containers. It proxy a local connection (to 127.0.0.1) towards outside world.
** pod can have zero or more adapter containers. It standardize the output.

Summary : A computer is a collection of resources, some processing, memory, disk, and network interfaces. In K8s the pod is the new computer.

Pod Implementation

* "pause container" is a parent container for rest of the container within pod.
* Other container will share network namespace, ipc and pid namespace with pause container.
* "pause container" also reap all zombie processes created by child containers.

1.2 Labels, Selectors and namespace
===================================

Labels

* Key-Value pair
* attached to pod and node
* grouping mechanism

Selectors

1. Equality based selector (= and !=)
2. Set based selector (IN, NOT IN, EXISTS)

Selectors has two types

1. Label selector
2. Field selector

Namespace

Multiple virtual cluster backed by same physical cluster.
To divide cluster resources among multiple user using cluster quota.
K8S has "default" namespace
Basically namespace is non-overlapping set of K8s objects.

1.3 Controllers
===============

* Manage a set of podes as per "Labels and Selector"
* reconciliation loop drive cluster state from actual to desirable
* Benefits
1. App Reliability
2. Scalling
Examples:

1. Replication controller: to scale up and down. Maintain correct number of pods. It facilitate horizontal scaling and ensure that Pods are resilient in case of host or application failures. If a container goes down or a host becomes unavailable, Pods will re-start on different hosts as necessary to maintain a target
number of replicas. Now it replaces by Deployment Controller and raplicaset.

2. Deployment controller : Declarative updates (YAML file) for pods and replica set. It updates PodTemplateSpec. So new Replicaset is created with new version of pod. If not OK, rollback to old Replicaset.

3. Daemonset controller to run 1 pod on 1 node. We can run a specific pod on all node also. "nodeSelector" is used to specify the node.
4. Job controller
5. endpoints controller, joins service and pod together,
6. namespace controller,
7. service accounts and token controller for access mgmt
8. Node controller to manage worker states.
9. Stateful set : manage the deployment and scaling for a set of pods, and provide guarantees about (1) ordering and (2) uniqueness of these pods. But unlike a deployment, a stateful set manages the sticky identity for each of these pods.

* Kind of controllers
Replicasets
Deploymnets
DaemonSet
Jobs
Services

1.4 Services
============

* set of pods works together, E.g. tier in multi-tier
* set defined by labels and selector.
* Kubernetes discover pods based on services
* A service round-robins requests between pods. It is load balancers and front-ends to a collection of Pods.
* Services are the external point of contact for container workloads, accessible via an internal DNS server.
* A Services’ IP address remains stable and can be exposed to the outside world via an Ingress. It abstracts away the number of Pods as well as virtual IP addresses for each Pod that can change as Pods are scheduled to different cluster hosts.

Service Discovery

* NodePort
* Ingress

* HAProxy,
* Traefik,
* F5 etc.

2. Architecture
===============

* Master-slave

Master node is controlled by kubectl
Kubectl has kubeconfig file that stores : server information, authentication information to access API server
For production, min 3 node cluster.

2.1 C-plane
===========

2.1.1 etcd
==========

* key value data store
* configuration data of cluster , configmap
* represent overall state of cluster
* other components monitors changed at etcd
* it stores : job scheduling info, pod details, storage information etc.
* it can also store ThirdPartyResource. Suppose there is 3rd party resource by name "cron-tab.alpha.ianlewis.org" with version v1 at default namespace, the corresponding custom controller can access it using HTTP GET

http: // localhost: 8001 / apis / alpha.ianlewis.org / v1 / namespaces / default / crontabs

2.1.2 API server
================

* JSON over HTTP
* Validate REST request and update API objects's state at etcd
* It performs CRUD operations for K8s object data.
* so client can configure workloads, containers across the worker nodes

2.1.3 Schedular
===============

* plugable
* match resource "supploy" to workload "demands"
* select node to run pod
* inputs
- resource availability
- resource utilization
- resource requirement
- QoS
- afinity requirements
- anti-afinity requirements
- data locality
- policy
- user specification
* supports the use of user-defined custom schedulers
- Replica Sets and Deployments
- Stefulsets for services (old name PetSets)
- DaemonSets
- Jobs (run to completion)
- Cron Jobs
* "pod start" and "pod stop" hook
* "Reschedular" for guaranteed scheduling

2.1.4 controller manager
========================
* Controller is a daemon that constantly compare the desire state of cluster as per etcd and actual state and then take necessary corrective action. Observer - Diff - Act cycle.
* Controller uses Watch API for add/delete/modify of K8S objects at API server.
* controller should be accessible by k8s worker node of cluster.
* process to run (1) Daemonset controller (2) Replication controller and many more as per section 1.3
* communicate with API server to create, update, delete (1) pod, (2) service end points (3) etc.

2.2 Kubernetes Node (worker OR minion)
===================

= Worker = Minion
* run container runtime. e.g Docker, rkt and below components

2.2.1 Kubelet (K8S Node Agent)
=============

* hearbeat for health of node.
* it communicate with API server to see if the pod is to be run on this node.
* If yes, it executes pod containers via container engine
* it mounts and run pod secrets and volumes. Volumes are within pod
* it respond back the pod and node states to API server, after health check ( / master node)
It used Podspec YAML file, that describe a pod
API Server / HTTP endpoint / File
* it is effectively 'pod - controller'

2.2.2 Kube-proxy
================

* n/w proxy + load balancer
* route to container based on IP + port
* Process on all worker node
* 3 modes
1. User space mode
2. iptables mode
3. ipvs mode

The master node communicate with Kubelet and the end-user communicate with Kube-Proxy.

==============

Agent to collect resource usage.

2.2.4 container tooling
=======================

e.g. Docker

2.2.5 supervisord
=================

Restart component, as and when needed.

2.2.6 kube-dns
==============

It resolves Kubernetes service DNS names to IP addresses.

* High Availability HAProxy auto configuration and auto service discovery for Kubernetes. https://github.com/AdoHe/kube2haproxy

Other alternatives
==================

1. Docker Swarm
2. Kubernetes To get started : kubernetes.io
3. Mesos Marathon
4. Amazon ECS (Amazon EC2 container service)
2. It has its own repository.
3. Task can be part of CloudFormation stack. Task, Queue, EC2 Volume all together in CloudFormation to start and to cleanup
4. To get started https://aws.amazon.com/ecs/
5. AWS Fargate https://aws.amazon.com/fargate
6. Google Kubernetes Engine (^L = clear = cls at Google Cloud Shell)
7. Microsoft Azure Kubernetes Services (AKS)
9. Cloud Foundry
10. Rackspace
11. Oracle Cloud Infrastructure
12. Docker Compose : Single machine. Not for large scale. With one command, "docker compose up" it will bring up : containers, volumes, networks
13. Rancher

To get started : kubernetes.io

K8s Installation
================

kubeadm is A tool to install k8s on any cloud.

1. install docker
2. run 'kubeadm init' Get the join tocken
3. On each worker node run 'kubeadm join' along with join token. So all nodes will join the cluster
4. Pod n/w
4.1 All containers can communicate with all containers, without NAT
4.2 All nodes can communicate with all containers, without NAT
4.3 The IP that container sees itself is same as all other see for that container.

"flannel", and "weave-net" are good starting point for such networking. Few more tools : "calico" and "Romana"
For details:

K8s uses https://github.com/containernetworking/cni Container Network Interface for networking among containers.

kops is to install k8s cluster on AWS. Azure and GCP has similar tools

Logging and Monitoring
======================

logstash, Fluentd, Filebeats running at pod, will ship the logs to Elasticserach , Kabana

Logging with fluentd, kibana and elasticsearch (EFK Stack) : https://logz.io/blog/kubernetes-log-analysis/
Fluentd architecture: https://www.fluentd.org/architecture

• cAdvisor to collect container usage statistics. it is per node.
• Heapster runs as a pod in cluster. It collect data from kubelet per node. Kubelet collect from cAdvisor. Heapster groups all information by pod with relevant labels.
• Promethus framework is for application metrics. it is a time series DB.

All the above 3 tools sends data to Grafana for visualization.

Authentication and Authorization
================================

Users:
1. Normal users : Users in LDAP or SSO
2. Service accounts
* Manage by Kube API server
* Bound to specific namespace
* Its credentials are managed in secrets

2. UID
3. group : used for authorization.
4. Extra fields

Popular authentication

1. client certs
2. static token files
3. OpenID connect
4. Webhook mode

Popular authorization

1. ABAC : Attribute based Access control
2. RBAC: Role-based Access control
3. Webhook

Role bindings binds role and (1) user OR (2) group OR (3) service accounts

Webhook is for 3rd party integration OR to define complex set of rules.

Reference

70 Best Kubernetes Tutorials
https://www.aquasec.com/wiki/display/containers/70+Best+Kubernetes+Tutorials

Kubernetes Architecture

https://www.aquasec.com/wiki/display/containers/Kubernetes+Architecture