CKA: 3. Scheduling
Manual scheduling
* before pod is created using nodeName
* POST to pod's Binding API
Affinity and Anti-Affinity
Operators
- In
- NotIn
- Equal
- Exists
Node Affinity Types
- Required During Scheduling, Ignored During Execution
- Preferred During Scheduling, Ignored During Execution
- Required During Scheduling, Required During Execution (Planned)
Example:
nodeAffinity:
requiredDuringSchedulingIgnoredDuringExecution:
nodeSelectorTerms:
- matchExpressions:
- key: disktype
operator: In
values:
- ssd
=========================================
For running pod, one can edit only
The YAML file for ReplicaSet and DaemonSet are same, except kind. Daemonset is similar to Deployment also. There is no replica , no strategy in Daemonset. Neither (1) replicaset nor (2) daemonset can be created using "kubectl create" command. One need to create Deployment using "kubectl create" command and then remove (1) replica and (2) strategy
=========================================
static pod
pod only. No replicaset. No deployment. No service.
Add file create pod. The pod will be recreated if crashes.
Delete file delete pod.
Replace file, restart pod as per new file.
folder is passed to kubelet as "--pod-manifest-path"
kube-adm uses kubeconfig.yaml file
possible value: /etc/kubernetes/manifests in K8s
Master node has readonly mirror copy of static pod. Static pod cannot be deleted, cannot be modified by kubectl command. Its name will be "pod name"-"node name"
usecase to deploy control plane component. So all control plane pod on master have name : "pod name"-"master node name" Master node name is minikube in case of minikube setup.
Daemonset and static pod, both are ignored by scheduler.
=========================================
"k describe pod 'pod-name' " in the event section we can see scheduler name. In YAML file we shall mention
schedularName: "NAME OF SCHEDULAR"
copy scheduler pod YAML. it is static pod. so located at /etc/kubernetes/manifest. Then in the command: section add
command:
- --scheduler-name="NAME OF SCHEDULER"
- --lock-object-name="NAME OF SCHEDULER"
Reference:
https://github.com/kubernetes/community/blob/master/contributors/devel/sig-scheduling/scheduler.md
https://kubernetes.io/blog/2017/03/advanced-scheduling-in-kubernetes/
https://stackoverflow.com/questions/28857993/how-does-kubernetes-scheduler-work
* before pod is created using nodeName
* POST to pod's Binding API
Affinity and Anti-Affinity
Operators
- In
- NotIn
- Equal
- Exists
Node Affinity Types
- Required During Scheduling, Ignored During Execution
- Preferred During Scheduling, Ignored During Execution
- Required During Scheduling, Required During Execution (Planned)
Example:
nodeAffinity:
requiredDuringSchedulingIgnoredDuringExecution:
nodeSelectorTerms:
- matchExpressions:
- key: disktype
operator: In
values:
- ssd
=========================================
For running pod, one can edit only
- spec.containers[*].image
- spec.initContainers[*].image
- spec.activeDeadlineSeconds
- spec.tolerations
The YAML file for ReplicaSet and DaemonSet are same, except kind. Daemonset is similar to Deployment also. There is no replica , no strategy in Daemonset. Neither (1) replicaset nor (2) daemonset can be created using "kubectl create" command. One need to create Deployment using "kubectl create" command and then remove (1) replica and (2) strategy
=========================================
static pod
pod only. No replicaset. No deployment. No service.
Add file create pod. The pod will be recreated if crashes.
Delete file delete pod.
Replace file, restart pod as per new file.
folder is passed to kubelet as "--pod-manifest-path"
kube-adm uses kubeconfig.yaml file
possible value: /etc/kubernetes/manifests in K8s
Master node has readonly mirror copy of static pod. Static pod cannot be deleted, cannot be modified by kubectl command. Its name will be "pod name"-"node name"
usecase to deploy control plane component. So all control plane pod on master have name : "pod name"-"master node name" Master node name is minikube in case of minikube setup.
Daemonset and static pod, both are ignored by scheduler.
=========================================
"k describe pod 'pod-name' " in the event section we can see scheduler name. In YAML file we shall mention
schedularName: "NAME OF SCHEDULAR"
copy scheduler pod YAML. it is static pod. so located at /etc/kubernetes/manifest. Then in the command: section add
command:
- --scheduler-name="NAME OF SCHEDULER"
- --lock-object-name="NAME OF SCHEDULER"
Reference:
https://github.com/kubernetes/community/blob/master/contributors/devel/sig-scheduling/scheduler.md
https://kubernetes.io/blog/2017/03/advanced-scheduling-in-kubernetes/
https://stackoverflow.com/questions/28857993/how-does-kubernetes-scheduler-work
अष्टाध्यायी - 1
माहेश्वर सूत्र
॥ अइउण् । ऋऌक् । एओङ् । ऐऔच् ।
हयवरट् । लण् । ञमङणनम् । झभञ् ।
घढधष् । जबगडदश् । खफछठथचटतव् ।
कपय् । शषसर् । हल् ॥
१. अइउण्।
२. ऋऌक्।
३. एओङ्।
४. ऐऔच्।
५. हयवरट्।
६. लण्।
७. ञमङणनम्।
८. झभञ्।
९. घढधष्।
१०. जबगडदश्।
११. खफछठथचटतव्।
१२. कपय्।
१३. शषसर्।
१४. हल्।
Reference:
https://docs.google.com/document/d/e/2PACX-1vRVI2PN33awPw5n_1u0_iftvygDxOCck6PZzWmys76XJlKH4Hl12Cr5j-46d0wcq6TaslYKM_MzI1tm/pub
https://docs.google.com/document/d/e/2PACX-1vQ_G9OqsoFptuSJUSkNjN6JWW3HDPglFX-khXDd4u2a0TFbnBW0b9zgCKwdTe0xIdFCbH7lQZj0eVGs/pub
https://slabhyankar.wordpress.com/category/learning-sanskrit-by-fresh-approach/lessons-111-120/lesson-119/
https://ashtadhyayi.com/
https://sa.wikipedia.org/wiki/%E0%A4%85%E0%A4%B7%E0%A5%8D%E0%A4%9F%E0%A4%BE%E0%A4%A7%E0%A5%8D%E0%A4%AF%E0%A4%BE%E0%A4%AF%E0%A5%80
http://sanskritavyakaranaprakasha.blogspot.com/2017/12/blog-post_58.html
॥ अइउण् । ऋऌक् । एओङ् । ऐऔच् ।
हयवरट् । लण् । ञमङणनम् । झभञ् ।
घढधष् । जबगडदश् । खफछठथचटतव् ।
कपय् । शषसर् । हल् ॥
१. अइउण्।
२. ऋऌक्।
३. एओङ्।
४. ऐऔच्।
५. हयवरट्।
६. लण्।
७. ञमङणनम्।
८. झभञ्।
९. घढधष्।
१०. जबगडदश्।
११. खफछठथचटतव्।
१२. कपय्।
१३. शषसर्।
१४. हल्।
प्रत्याहार
| अण् | अण् | इण् | यण् | अक् | इक् | उक् | एङ् | अच् | इच् | एच् | ऐच् | अट् | अम् |
| अल् | यम् | ङम् | ञम् | यञ् | झष् | भष् | अश् | हश् | वश् | झश् | जश् | बश् | छव् |
| यय् | मय् | झय् | खय् | चय् | यर् | झर् | चर् | शर् | हल् | वल् | रल् | झल् |
====================================================
पाणिनीय व्याकरण =
अष्टाध्यायी by महर्षि पाणिनि
+
वार्तिक by महामुनि कात्यायन
+
महाभाष्य by पतंजलि
Later on:
सिद्धान्तकौमुदी by भट्टोजिदीक्षित
लघुसिद्धान्तकौमुदी by वरदराज
====================================================
पाणिनीय व्याकरण =
अष्टाध्यायी (4000)
+
शिवसूत्र या माहेश्वर सूत्र (14)
+
धातुपाठ (2000)
+
गणपाठ (261)
====================================================
What is Sutra?
अल्पाक्षरमसान्दीग्धं साखद्विश्वतो मुखम् ।
अदुष्टमनवद्यञ्च सूत्रं सूत्रविदो विदुः ।। इति ।
1. स्वल्पाक्षरम् having minimal number of letters
2. असंदिग्धम् clear, non-confusing
3. सारवत् containing the essential, summary
4. विश्वतोमुखम् unto the universe, universal, omnipresent
5. अस्तोभम् non-stoppable, eternal
6. अनवद्यम् not unspeakable, hence speakable, worth quoting
====================================================
अष्टाध्यायी
Types of Sutra
संज्ञा च परिभाषा च विधिर्नियम एव च।
अतिदेशोऽधिकारश्च षड्विधम् सूत्रं मतम् ॥
(१) संज्ञा सूत्र (total 91) :
नामकरणं संज्ञा - तकनीकी शब्दों का नामकरण।
E.g.
वृद्धिरादैच् 1।1।1
शेषो घ्यसखि 1|4|7
अदेङ् गुणः1| 1| 2
हलोऽनन्तराः संयोगः 1| 1| 7
मुखनासिकावचनोऽनुनासिकः 1|1|8
Most of them are present in 1st chapter or 2nd chapter
E.g.
वृद्धिरादैच् 1।1।1
शेषो घ्यसखि 1|4|7
अदेङ् गुणः1| 1| 2
हलोऽनन्तराः संयोगः 1| 1| 7
मुखनासिकावचनोऽनुनासिकः 1|1|8
Most of them are present in 1st chapter or 2nd chapter
(२) परिभाषा सूत्र (total 23) :
अनियमे नियमकारिणी परिभाषा।
E.g.
In त्यदादीनाम् अ: 7|2|102
परिभाषासूत्रम् called अलोऽन्त्यस्य 1|1|52 is परिभाषा सूत्र
Most of them are present in 1st chapter or 2nd chapter
इको गुणवृद्धी 1| 1| 3
आद्यन्तवदेकस्मिन् 1|1|21
आद्यन्तौ टकितौ 1|1|46
मिदचोऽन्त्यात्परः 1|1|47
E.g.
In त्यदादीनाम् अ: 7|2|102
परिभाषासूत्रम् called अलोऽन्त्यस्य 1|1|52 is परिभाषा सूत्र
Most of them are present in 1st chapter or 2nd chapter
इको गुणवृद्धी 1| 1| 3
आद्यन्तवदेकस्मिन् 1|1|21
आद्यन्तौ टकितौ 1|1|46
मिदचोऽन्त्यात्परः 1|1|47
(३) विधि सूत्र :
कर्तव्यत्वेनोपदेशो विधि:
कर्तव्यत्वेनोपदेशो विधि:
विषय का विधान।
E.g.
इको यण् अचि 6।1।77
E.g.
इको यण् अचि 6।1।77
नलोप: प्रातिपदिकान्तस्य 8|2|7
ऋत्यकः 6|1| 128
सिचि वृद्धिः परस्मैपदेषु 7|2|1
(४) नियम सूत्र :
ऋत्यकः 6|1| 128
सिचि वृद्धिः परस्मैपदेषु 7|2|1
(४) नियम सूत्र :
बहुत्र प्राप्तौ संकोचनं नियमः
बहुत्र प्राप्तो संकोचनं हेतु।
E.g.
पति: समास एव 1|4|8
अनुदात्तङित् आत्मनेपदम् 1|3|12
बहुत्र प्राप्तो संकोचनं हेतु।
E.g.
पति: समास एव 1|4|8
अनुदात्तङित् आत्मनेपदम् 1|3|12
(५) अतिदेश सूत्र : (total 35)
अन्यतुल्यत्वविधानम् अतिदेश:
जो अपने गुणधर्म को दूसरे सूत्रों पर लागू करते हैं।
E.g.
तृज्वत् क्रोष्टुः 7|1|95
स्थानिवदादेशोऽनल्विधौ 1|1|56
अचः परस्मिन् पूर्वविधौ 1|1|57
द्विर्वचनेऽचि 1|1|59
स्थानिवदादेशोऽनल्विधौ 1|1|56
अचः परस्मिन् पूर्वविधौ 1|1|57
द्विर्वचनेऽचि 1|1|59
विज इट् 1|2|2
(६) अधिकार सूत्र : (total 74)
उत्तरप्रकरणव्यापी अधिकारः
उत्तरप्रकरणव्यापी अधिकारः
एकत्र उपात्तस्य अन्यत्र व्यापारः अधिकारः।
E.g.
प्रत्यय: 3।1।1
आकडारात् एका संज्ञा 1| 4| 1
प्राग्रीश्वरान्निपाताः 1|4|56
अनभिहिते 2|3|1
तत्पुरुषोऽनञ् कर्मधारयः 2|4|19
कारके 1|4|23
E.g.
प्रत्यय: 3।1।1
आकडारात् एका संज्ञा 1| 4| 1
प्राग्रीश्वरान्निपाताः 1|4|56
अनभिहिते 2|3|1
तत्पुरुषोऽनञ् कर्मधारयः 2|4|19
कारके 1|4|23
====================================================
अष्टाध्यायी
8 x 4 x (38 to 200) = around 4000
1. The first two chapters primarily focus on new rules and definitions that will be used across all other chapters, and also sutras that talk about formation of प्रातिपदिकs, sutra that talk about deciding पद धातु
2. The third chapter gives all the प्रत्यया: that can be attached to a धातु. This list sequentially includes the twelve सनादिप्रत्यया:, followed by विकरणप्रत्यया:, then कृत्-प्रत्यया:, then तिङ्-प्रत्यया: and finally the आदेशा: that happen to various लकारा:.
3. The fourth and the fifth chapters enumerate all the प्रत्यया: that can be attached to a प्रातिपदिकम् । This included the स्त्रीप्रत्यया:, सुप्-प्रत्यया: and the तद्धितप्रत्यया: ।
4. The Sixth chapter and the seventh chapter contain the rules (सन्धि / आदेश / transformation etc) pertaining to how a प्रत्यय should be attached to the अङ्ग.
5. Finally, the eighth chapter lists the rules regarding what happens after a complete पद is formed. It includes rules regarding णत्व, षत्व, श्चुत्व, जश्त्व, विसर्गलोप and so on.
The detailed division of all 32 paads with important topics in them is as follows -
1.1
|
संज्ञाप्रकरणम्
|
1.2
|
अतिदेशप्रकरणम्, एकश्रुतिप्रकरणम्, वचननिर्धारणम्, एकशेषप्रकरणम्
|
1.3
|
इत्संज्ञाप्रकरणम्, धातुपदनिर्णय:
|
1.4
|
एकसंज्ञाप्रकरणम्, कारकप्रकरणम्, निपातप्रकरणम्, कर्मप्रवचनीयप्रकरणम्
|
2.1
|
अव्ययीभावसमास:, तत्पुरुषसमास:,
|
2.2
|
बहुव्रीहिसमास:, द्वन्द्वसमास:, पूर्वनिपात-परनिपातप्रकरणम्
|
2.3
|
विभक्तिनिर्णय:
|
2.4
|
समासानां लिङ्गवचननिर्धारणम्, लुक्-प्रकरणम्
|
3.1 to 3.4
|
धातुभ्य: विहिता: सर्वे प्रत्यया:
|
Chapters 4 and 5
|
प्रातिपदिकेभ्य: विहिता: सर्वे प्रत्यया:
|
6.1
|
द्वित्वप्रकरणम्, सम्प्रसारणप्रकरणम्, आत्वप्रकरणम्, अच्सन्धिप्रकरणम्, स्वरप्रकरणम्
|
6.2
|
स्वरप्रकरणम्
|
6.3
|
उत्तरपदाधिकार, संहिताधिकार
|
6.4
|
, असिद्धवदधिकार, आर्धधातुकप्रकरणम्, भाधिकार
|
7.1
|
प्रत्ययादेशा:
|
7.2
|
इडागमप्रकरणम्, सार्वधातुके परे अङ्गकार्याणि
|
7.3
|
सार्वधातुके परे अङ्गकार्याणि, विभक्तिप्रत्यये परे अङ्गकार्याणि
|
7.4
|
अङ्गकार्याणि, अभ्यासकार्याणि
|
8.1
|
द्विरुक्तप्रकरणम्, पदाधिकार
|
8.2
|
लोपकार्याणि, झलिपदान्ते कार्याणि, प्लुताधिकार, संहिताधिकार,
|
8.3
|
रुत्वम्, आदेशा:, आगमा:, षत्वम्
|
8.4
|
णत्वम्, हल्सन्धय:
|
Reference:
https://docs.google.com/document/d/e/2PACX-1vRVI2PN33awPw5n_1u0_iftvygDxOCck6PZzWmys76XJlKH4Hl12Cr5j-46d0wcq6TaslYKM_MzI1tm/pub
https://docs.google.com/document/d/e/2PACX-1vQ_G9OqsoFptuSJUSkNjN6JWW3HDPglFX-khXDd4u2a0TFbnBW0b9zgCKwdTe0xIdFCbH7lQZj0eVGs/pub
https://slabhyankar.wordpress.com/category/learning-sanskrit-by-fresh-approach/lessons-111-120/lesson-119/
https://ashtadhyayi.com/
https://sa.wikipedia.org/wiki/%E0%A4%85%E0%A4%B7%E0%A5%8D%E0%A4%9F%E0%A4%BE%E0%A4%A7%E0%A5%8D%E0%A4%AF%E0%A4%BE%E0%A4%AF%E0%A5%80
http://sanskritavyakaranaprakasha.blogspot.com/2017/12/blog-post_58.html
Tmux
Tmux is like GNU Screen. Very useful tool to store your ongoing SSH/Putty terminal by attach/detach. We can have multiple session from single command prompt. It is recommended to use at CKA/CKAD exam, where you need to deal with multiple clusters.
Here are relevant URLs
http://alvinalexander.com/downloads/linux/tmux-cheat-sheet.pdf
http://alvinalexander.com/linux-unix/tmux-cheat-sheet-commands-pdf/
https://leanpub.com/the-tao-of-tmux/read
https://pragprog.com/titles/bhtmux2/
https://www.hamvocke.com/blog/a-guide-to-customizing-your-tmux-conf/
https://man7.org/linux/man-pages/man1/tmux.1.html
Here are relevant URLs
http://alvinalexander.com/downloads/linux/tmux-cheat-sheet.pdf
http://alvinalexander.com/linux-unix/tmux-cheat-sheet-commands-pdf/
https://leanpub.com/the-tao-of-tmux/read
https://pragprog.com/titles/bhtmux2/
https://www.hamvocke.com/blog/a-guide-to-customizing-your-tmux-conf/
https://man7.org/linux/man-pages/man1/tmux.1.html
Feb basic command
1. run tmux
tmux
2. create new window ^bc
3. close window ^d
4. move betweenwindow
^bn ^bp ^b0 ^b1
5. split horizontal
^b"
6. split vertical
^b%
7. move when you are in horizontal and vertical split
^bo ^b;
RBAC in K8s
RBAC is all about
Can "Subject" "Verb" "Object" at "Location"
Can "Subject" "Verb" "Object" at "Location"
Allowed operations are defined in the serverresources.json file per object.
K8s admission controller extracts following from the incoming request to K8s API server
1. HTTP Method. It can derive verb. E.g. POST is mapped with create. VERB
2. From URI extract (1) API group and (2) resource. OBJECT
3. From URI extract Namespace. LOCATION
4. From authentication derive (1) User Name (2) Groups. SUBJECT.
Note: For creating new object, the URI does not contain name of the resource. RBAC is NOT about a resource with specific name can be created or not.
YAML
1. Role.
It has namespace.
Rules.
- VERB
- OBJECT = API group + Resource
Here resource are namespaced resource
apiGroups: [""] //for core api groups with naem"api/"
resources: ["pods"]
verbs: ["get", "create", "update", "list", "delete", "watch"]
resourceNames: ["Pod_name1", "pod_name2"]
2. RoleBinding
It has:
LOCATION = namespace
Reference to Role = LOCATION + VERB + OBJECT
SUBJECT = Kind (user | group | service account) + name
Here suppose service account = sa in namespace myns then it is mentioned as
"serviceaccount=myns:sa"
If we want to specify all service account in the namespace then do NOT use "serviceaccount=myns:*" We shall use: "group=system:serviceaccounts:myns"
3. ClusterRole
It does not have namespace.It is global role. so can be used in all namespaces.
Resource inside ClusterRole can be either (1) namespaced resource or (2) resource with cluster scope (cluster wide resources) . E.g.
- Nodes,
- ClusterRole,
- CluterRoleBinding,
- CSR,
- NS,
- PV (note: PVC is namespaced based resource and PV is cluster wide resource)
k api-resouces --namespaced=true
k api-resouces --namespaced=false
RoleBinding can have reference to ClusterRole, instead of Role.
Since RoleBinding has namespace, the ClusterRole is assigned locally to specific namespace only
4. ClusterRoleBinding
It does not have namespace.
It has reference to ClusterRole
It grants permission globally.
* So ClousterRole has multiple purpose
1. It is global role. It is used to grant permission to user A in namespace AA and user B in namespace BB. It is used in RoleBinding
2. It is for resource with cluster scope. E.g. Nodes, PV
3. It is used in ClusterRoleBinding to grand global permission.
Note: namespaced permission and non-namespaced permission cannot be mixed in single cluster role.
* ClusterRoleBinding can be for
- cluster scope resource
- granting global cluster wide permission.
Default Subjects
1. system:master is name of group. SUBJECT = user | group | service account. So group is SUBJECT
2. system:kube-scheduler ,
3. system:kube-control-manager,
4. system:kube-proxy
kubelet runs with
5. username = system:node:"node name"
group = system:nodes
Here RBAC alone is not sufficient. So authorization mode is both: (1) RBAC and (2) Node. The Kubelet's client certificate is useful for (1) Node Authorizer and (2) Node Restriction Admission plugin
Note: In client certificate username is called CN (Common Name) and group is called Organisations
Default ClusterRole
1. cluster-admin is like super user
2. admin
3. edit
4. view
admin, edit and view are assigned for individual SUBJECT for specific namespace LOCATION
Resource aggregation is used for new CR and default role: admin, edit, view.
Verb Expansion
List = List, Get, Watch
Update = Update, Patch
Subresource
HPA works on /scale subresource
controller works on /status subresource
Federatoin
1 . define centrally and sync all local k8s cluster
2. webhook points to RBAC of other K8s cluster
Limitations
K8s admission controller extracts following from the incoming request to K8s API server
1. HTTP Method. It can derive verb. E.g. POST is mapped with create. VERB
2. From URI extract (1) API group and (2) resource. OBJECT
3. From URI extract Namespace. LOCATION
4. From authentication derive (1) User Name (2) Groups. SUBJECT.
Note: For creating new object, the URI does not contain name of the resource. RBAC is NOT about a resource with specific name can be created or not.
YAML
1. Role.
It has namespace.
Rules.
- VERB
- OBJECT = API group + Resource
Here resource are namespaced resource
apiGroups: [""] //for core api groups with naem"api/"
resources: ["pods"]
verbs: ["get", "create", "update", "list", "delete", "watch"]
resourceNames: ["Pod_name1", "pod_name2"]
2. RoleBinding
It has:
LOCATION = namespace
Reference to Role = LOCATION + VERB + OBJECT
SUBJECT = Kind (user | group | service account) + name
Here suppose service account = sa in namespace myns then it is mentioned as
"serviceaccount=myns:sa"
If we want to specify all service account in the namespace then do NOT use "serviceaccount=myns:*" We shall use: "group=system:serviceaccounts:myns"
3. ClusterRole
It does not have namespace.It is global role. so can be used in all namespaces.
Resource inside ClusterRole can be either (1) namespaced resource or (2) resource with cluster scope (cluster wide resources) . E.g.
- Nodes,
- ClusterRole,
- CluterRoleBinding,
- CSR,
- NS,
- PV (note: PVC is namespaced based resource and PV is cluster wide resource)
k api-resouces --namespaced=true
k api-resouces --namespaced=false
RoleBinding can have reference to ClusterRole, instead of Role.
Since RoleBinding has namespace, the ClusterRole is assigned locally to specific namespace only
4. ClusterRoleBinding
It does not have namespace.
It has reference to ClusterRole
It grants permission globally.
* So ClousterRole has multiple purpose
1. It is global role. It is used to grant permission to user A in namespace AA and user B in namespace BB. It is used in RoleBinding
2. It is for resource with cluster scope. E.g. Nodes, PV
3. It is used in ClusterRoleBinding to grand global permission.
Note: namespaced permission and non-namespaced permission cannot be mixed in single cluster role.
* ClusterRoleBinding can be for
- cluster scope resource
- granting global cluster wide permission.
Default Subjects
1. system:master is name of group. SUBJECT = user | group | service account. So group is SUBJECT
2. system:kube-scheduler ,
3. system:kube-control-manager,
4. system:kube-proxy
kubelet runs with
5. username = system:node:"node name"
group = system:nodes
Here RBAC alone is not sufficient. So authorization mode is both: (1) RBAC and (2) Node. The Kubelet's client certificate is useful for (1) Node Authorizer and (2) Node Restriction Admission plugin
Note: In client certificate username is called CN (Common Name) and group is called Organisations
Default ClusterRole
1. cluster-admin is like super user
2. admin
3. edit
4. view
admin, edit and view are assigned for individual SUBJECT for specific namespace LOCATION
Resource aggregation is used for new CR and default role: admin, edit, view.
Verb Expansion
List = List, Get, Watch
Update = Update, Patch
Subresource
HPA works on /scale subresource
controller works on /status subresource
Federatoin
1 . define centrally and sync all local k8s cluster
2. webhook points to RBAC of other K8s cluster
Limitations
* No validation.
- user exist or not.
- rules
- subject.
Aggregate
We can add label to cluster role
rbac.authorization.k8s.io/aggregate-to-EXISTING_CLUSTER_ROLE: "true"
Impersonation
We can have role/clusterrole , where verb = impersonate is applicable to resources = users | greoups | sas
In HTTP header mandatory header is Impersonate-User. Rest all are Impersonate-* headers are optional. All optional headers Impersonate-Extra-* can be access in role/clusterrole as resource userextras/*
ImagePullSecrets
Create a new secrets name "dr" using
k create secret docker-registry -h
Now edit existing sa "testsa". At the end add
imagePullSecrets:
- name: dr
Now create pod/deployment using "testsa" sa.
Reference:
https://kubernetes.io/docs/reference/access-authn-authz/rbac/
https://kubernetes.io/docs/reference/access-authn-authz/rbac/#user-facing-roles
https://www.youtube.com/watch?v=Nw1ymxcLIDI
https://github.com/liggitt/audit2rbac
Reference:
https://kubernetes.io/docs/reference/access-authn-authz/rbac/
https://kubernetes.io/docs/reference/access-authn-authz/rbac/#user-facing-roles
https://www.youtube.com/watch?v=Nw1ymxcLIDI
https://github.com/liggitt/audit2rbac
CKA : 2. K8s Core Concepts
Node-Controller monitor each node, with heart-bit every 5 seconds. With grace period of 40 seconds, the controller declared that the node is unreachable. After 5 min, the pods of unhealthy nodes are scheduled on other node.
Kubelet is not deployed by kubeadm
without pod, we need to create network between application container and sidecar container. We need to create volume and share with both containers. We need to monitor both containers.
Pycharm editor has very good support for YAML
- Audo indentation
- at bottom status bar, the format of present line in complete tree of YAML.
- off course syntax color highlighting.
Replicaset has selector. so it will take care of pods created earlier also.
Replica controller does not have selector->mathLabels
Replicaset selector choose from set of value
Replica controller choose pod when key, value matches.
After a pod of RS reached to ImagePullBackOff stage, even if you correct image name at RS.yaml file. no impact. you need to delete all pods of RS. RS will create new pod using correct image.
In the RS, these two values should be identical
spec->selector->matchLabels
spec->template->metadata-labels
RS and deployment has same YAML file. Deployment creates RS and RS creates pod.
To change namespace in kubectl the command is:
k config set-context $(k config current-context) --namespace=dev
ResourceQuota is for namespace.
Deployment should be created with "k create deployment" command then set replica count with "k scale" command.
Scheduler consider following values from YAML
- affinity / anti-affinity
- nodeSelector
- taints / tolerations
- reservations / limits
Kubelet is not deployed by kubeadm
without pod, we need to create network between application container and sidecar container. We need to create volume and share with both containers. We need to monitor both containers.
Pycharm editor has very good support for YAML
- Audo indentation
- at bottom status bar, the format of present line in complete tree of YAML.
- off course syntax color highlighting.
Replicaset has selector. so it will take care of pods created earlier also.
Replica controller does not have selector->mathLabels
Replicaset selector choose from set of value
Replica controller choose pod when key, value matches.
After a pod of RS reached to ImagePullBackOff stage, even if you correct image name at RS.yaml file. no impact. you need to delete all pods of RS. RS will create new pod using correct image.
In the RS, these two values should be identical
spec->selector->matchLabels
spec->template->metadata-labels
RS and deployment has same YAML file. Deployment creates RS and RS creates pod.
To change namespace in kubectl the command is:
k config set-context $(k config current-context) --namespace=dev
ResourceQuota is for namespace.
Deployment should be created with "k create deployment" command then set replica count with "k scale" command.
Scheduler consider following values from YAML
- affinity / anti-affinity
- nodeSelector
- taints / tolerations
- reservations / limits
