Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Caggle > Kubernetes > Flashcards

Kubernetes Flashcards

1
Q

container runtime

A

a k8s component, the underlying software that is used to run containers, e.g. docker

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

pod is what of k8s

A

k8s object

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

to see each pod’s node

A

kubectl get po -o wide

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

create yml of pod quickly

A

kubectl run redis –image=redis123 –dry-run=client -o yaml

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

edit pod

A
  1. use existing yml
  2. extract into yml and recreate pod
  3. k edit only for below properties
    spec.containers[].image
    spec.initContainers[    ].image
    spec.activeDeadlineSeconds
    spec.tolerations
    spec.terminationGracePeriodSeconds
    spec.replica
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Replica Set (prev. replication controller)
difference of above two?

A
  1. high availability
  2. load balancer across nodes

selector: use to allow for managing pod that not created by replicaSet directly

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

edit replicaset

A

k replace -f xxx.yml
k scale –replicas=6 -f rs-definition.yml
k scale –replicas=6 replicaset my-rs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

get version of a k object

A

k explain replicaset

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

quick delete multiple pods

A

in a line: k delete po po1 po2 po3 po4

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

deployment vs rs

A

deployment contains replicaset, rs contains pod

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

–all-namespaces
–label

A

short -A
-l=”tier=db”

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Cert Tip: Imperative Command

A
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Run an instance of the image webapp-color and publish port 8080 on the container to 8282 on the host.

A

docker run -p 8282:8080 webapp-color

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

light version docker image

A

python:3.6-alpine on alpine not debian

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Practice test Docker images

A

answer is missing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

docker ps vs docker ps -a

A

-a list all containers including the stopped ones
container automatically exit when its task/process is done, which is defined by “CMD”. The process has to be things like web server, db server but not “bash”

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

docker run ubuntu

A

will exit but
docker run ubuntu [cmd]
docker run ubuntu sleep 5 will lasts for 5 secs
or:
CMD sleep 5
CMD [“sleep”, “5”]

or:
ENTRYPOINT [“sleep”]
docker run ubuntu-sleeper 10

or:
ENTRYPOINT [“sleep”]
CMD [“5”] -> default value

or: modify during runtime
docker run –entrypoint sleep2.0 ubuntu-sleeper 10

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

k replace –force -f x.yml

A

replace pods

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

docker run –name ubuntu-container –entrypoint sleep2.0 ubuntu-sleeper 10 in pod definition

A

command:

args: [“10”]

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

imperative vs declarative

A

k create configmap
k create -f xxx.yml

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

convert base64

A

echo -n ‘paswrd’ | base64
echo -n ‘paswrd’ | base64 –decode

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

ubuntu install

A

apt-get install

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

list processes on docker host / inside container

security context

A

ps aux
PID for different containers on the host are different -> process isolation
by default process run as root, but root user inside container is not like it on the host

change root’s capability,
docker run –add-cap MAC_ADMIN
or –drop-cap
–privilege

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

get user inside pod

A

k exec po po-name – whoami

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

resource CPU unit

memory unit 1G vs 1Gi

A

1 vCPU
0.1 == 100 m vCPU mili vCPU
minimal 1m vCPU

1 G = gigabyte 1,000,000,000 bytes
1 Gi = gibibyte about 1073,000,000 bytes (2 to the power of 30)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

can cpu or mem exceed the limit

A

CPU not, it is throttled. Mem yes, in the end it will be terminated with OOM (OOM kill)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

what is the resource require and limit by default
best CPU configure:

A

no limit

with requests but no limit

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

when no request but limit set? what is request then?

A

request = limit set automatically by k8s

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

set default resource limit request globally for all newly created pod

A

limitRange object

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

restrict the total amount of resource

A

resourceQuota object
like hard limit/requests in the current namespace

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

check reason of failed pod

A

describe po and check last state and Reason: is there

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

default sa what is it? There’s also way to disable the mounting of sa token

A

it is automatically mounted to the pod of the ns, it has very restricted permission to run only basic kubectl cmd query. automountSAToken: false in spec

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

how to change the sa of a pod from default? of deployment?

A

change it in the spec and recreate! For deployment, no need to recreate, just edit

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

latest 1.24 sa token is not automatic created, how to create it?

A

k create token sa-name, it has by default 1h expiry time
or
(not recomanded, no time boundary)
create a kubernetes.io/s-a-token type secret for the account as before

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

check token of a sa
check taint of a no

A

describe it and check tokens:
describe and check taints:

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

check sa of a pod/deploy

A

describe the pod and find Service Account:

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

change sa of deploy from default

A

go to spec/template/spec/ add ServiceAccountName: sa-name

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

taint nodes
untain no

A

k taint no no-name app=blue:taint-effect

add a minus in the end

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

what is restricted by the taint and tolerants

A

it only restrict the no. A pod with a matched toleration will not guaranteed to be scheduled on the tainted node

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

check where is the po

A

-o wide

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

node-selector
label a node

A

nodeSelector in pod.spec
(very simple only one label: value)

k label no no-name key=value

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

node affinity

A

ensure a pod is hosted on a particular node. More advanced than nodeSelector

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

requiredDuringSchedulingIgnoredDuringExectution

A

during schedule of pod, must find the matched node, if not found, don’t schedule
During the pod execution, if node’s label is changed so that the condition doesn’t match any more, ignore it. if required is defined, pod will be evicted.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

multi-container pods

A

logging agent + web server they need to share same lifecycle (volumn, storage, netware)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

multi-container pod

A

sidecar (logging server +web server),
adapter: before sending logs to a central server, we adapt the log in to a unified format
ambassador: to connect to different stage db, you may choose to outsource such logic to separate container, such as at local host it connects to a local database, and the new container will proxy that request to other right db

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

check pod conditions

A

k describe po
check conditions section

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

readiness probes

A

check if a pod’s ready status is really true or false. it is application relevant, e.g. http test /api/ready. or if a particular TCP socket is listening or just exec a custom script

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

liveness probes

A

check if a container is health.
http test - /api/healthy or if a particular TCP socket is listening or just exec a custom script

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
49
Q

docker run -d event-simulator

A

detach mode without output the log

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
50
Q

print log of multi-container pod

A

k logs -f po-name container-name

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
51
Q

metrics server

A
  1. one for each k8s cluster
  2. no historical data, only in-memory
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
52
Q

with metrics-server, what can do

A

k top node
k top po

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
53
Q

get things based on label

get all pod’s label

A

k get po –selector app=App1

k get po –l app=App1

k get po –show-labels

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
54
Q

annotation

A

used to record other details for informationary purpose, phone numbers etc. or may be for other integration purpose

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
55
Q

check status of each revision

A

kubectl rollout history deployment nginx –revision=1

record cause:
kubectl set image deployment nginx nginx=nginx:1.17 –record

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
56
Q

edit deploy

A

kubectl rollout status deployment nginx

kubectl rollout history deployment nginx

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
57
Q

set deploy image

A

k set image deploy frontend simple-webapp=kodecloud/webapp-color:v2

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
58
Q

use pod to run 3+2, how to get output

A

k logs po-name

59
Q

job
completion
parallelism

A

job will create po to run a certain one time task
completion will be the #pod to create, keep create this number of pod until they all successfully completed
parallelism

60
Q

cronjob
schedule
how is the yaml vs job

A

job can be schedule
schedule: takes cron like format string

spec:
schedule:
jobTemplate:
spec (job’s spec)

61
Q

check job successful history, attemps

A

describe job and check
Pods Statuses:

62
Q

k8s network : how to access pod’s ip

A

inside node, accessable the pod’s ip directly

63
Q

k8s service use case

A

service is in fact a virtual server inside the node, it has its own IP address, it is called cluster IP of the service

NodePort: to listen to a port on the note and forward request on that port to a port on the pod running the web app
clusterIP: virtual ip inside cluster to allow communication between different services, such as frontend to backend
LoadBalancer: service provisions a load balancer for our app in a supported cloud providers, it is to distribute load accross the different web server in your frontend tier

64
Q

nodePort target port, port, node Port

A

target port: port on the pod
port: port on the service, service is in fact a virtual server inside the node
nodeport: the port on the node for external, between 30000 - 32767

only port is the must, target port by default equals to port

to access: use node ip/port number

65
Q

cluster IP use case, target port, port

A

between tiers of a web app: frontend, backend, db.
target port is the port of backend exposes.
port is where the service is exposed

66
Q
A
67
Q

what is endpoint of a svc

A

endpoints is another name of the port identified by the label selectors. It can be used to check if our svc’s selector is correctly set

68
Q

describe a frontend backend

A

There is a web server serving frontend to users, an app server serving backend API and the db server.
user send in request to web server, the web server send request to API server, then the api server get data from db and send it to backend

69
Q

ingress vs egress

A

the direction of a request, but not that of response. netpol only define on ingress, egress is automatically configured itself for response

if need request out to other server, we need to configure egress rule in the netpol

70
Q

by default connectivity

A

all allow, all can communicate to others

71
Q

how to restrict

A

use network policy to only allow access from api-pod on port 3306.

by default everything are connected, but once one netpol is defined for a po, the po is default deny by that type of traffic (in or out)

network policy is not supported by all network solution on k8s, fiannel doesn’t support it, need to check its documentation. You can create, but it won’t work without any error msg

networkpolicy can define ingress from podSelector, namespaceSelector,
ipBlock for server outside of cluster

72
Q

netpol yaml rule

A
  • ports vs portsare different
    each - starts a new rule
    the rule can be defined with ports or to
    they can also combine in one rule start with -

one rule combined with and
- to
ports:

two rules combined with Or
vs
-to:
- ports:

TCP UDP needs to define into seperate protocol inside ports:

73
Q

pod A can ping pod B

A

ping doesn’t mean connection, it has a special port, with ICMP protocol

74
Q

K8s ingress controller vs load balancer? Vs nginx server?

A

Ingress controller contains load balancer + nginx server (or any other load balancing solution) + other functions. It is a k8s deploy

75
Q

K8s ingress controller role in k8s?

A

Ingress controller helps the apps deployed in k8s using a single accessible url that you can configure routes to different services within your cluster based on the url path. It also implement ssl security.

it also has to be published as a nodePort or loadbalancer svc, and it is a one-time config.

76
Q

to inspect ing, logs the ingress pod and find wrong default-backend

A

–default-backend-service=green-space/default-backend-service

redeploy ingress-controller with above changes

77
Q

Term of ingress rules?

A

Ingress resources, type Ingress, Ingress rule is defined for each host/domain-name (I call it base url), e.g. http://www.my-store.com/

78
Q

3 types of ingress rule defined by yaml

A

spec.backend directly
spec.rules.http for each host/domain-name
spec.rules.-host (for multiple host)

79
Q

nginx.ingress.kubernetes.io/rewrite-target: /$2, replace(“/something(/|$)(.*)”, “/$2”)

A

regular expression capturing group

80
Q

docker copy-on-write mechanism

A

image layer is read only
container layer is read write,
when modify app.py, you can still modify it but it is copied to container layer firstly.

81
Q

when container is removed, the container layer is gone
to persist data, use volumn

A

volume mounting:
docker volume create data_volume -> create a volume locally /var/lib/volume
docker run –mount my-volume:/path-in-container mysql

if you don’t run create volume before run container, it will be created automatically

82
Q

external data source?

A

bind mounting: use the path directly

docker run -v /fullpath-to-data:/path-in-container

latest:
docker run –mount type=bind, source=fullpath-to-data, target=/path-in-container mysql

83
Q

what is doing bind mounting?

what is doing volume mounting

A

storage driver: e.g. AUFS, ZFS, overlay
volume driver: azure file storage, netApp, rexray
docker run -it –name mysql –volume-driver rexray/ebs –mount src=ebs-vol, target …

84
Q

docker container is meant to be transient

A

means they meant to last for a short period of time

85
Q

pod.spec.volumes

A

not nice way: a file path on the node (host) on k8s:
hostpath.type: Directory

better: to use ebs
replace volumes.awsElasticBlockStore

86
Q

persistent volumes

A

to manage volumes centrally, it is a cluster wide pool of storage volumes configured by admins. The developer can use it by creating PVC.
To bind it, use selector in PVC yaml.
PVC and PV is 1to1 mapping. If no PV available, pvc will be pending.

87
Q

what happens when pvc is deleted

A

persistentVolumeReclaimPolicy: Retain/Delete/Recycle
retain: pv will be retained and cannot be used by other pvc
delete: pv will be deleted as well
recycle: scrubb the data and reused for other pvc

88
Q

authentication vs authorization of kube apiserver

A

who can access?
static pwd files, static token file, certs, external identity providers like LDAP
SA

what can they do:
RBAC authorization

89
Q

all communication between the components surrounded by kube apiserver is secured by ???

A

tls cetificates

90
Q

auth:

A

Two types account: user, sa
cannot create user, external identity provide is needed for example.
SA can be created

91
Q

kubeconfig

A

three things:
cluster, context, users
context is the thing which links above two.
k config view: to list it
k config use-context: to change it

92
Q

context

A

specify namespace along with user and cluster

93
Q

access api groups

A

curl http://localhost:6443 -k

to list resource group
curl http://localhost:6443/apis -k | grep name

to get more permissions, need to authenticate, –key, –cert –cacert etc.
OR kubectl proxy, it launches a proxy service locally on port 8001 and will use the cred from the kube-config file. No need to auth anymore

94
Q

curl, check a svc

A

-m 5 set timeout
curl -m 5 jupiter-crew-svc:8080 (svc name:port)

for nodeport:
curl nodeIp:nodeport

95
Q

wget vs curl

A

do http request
wget -O- frontend:80

-O-: print content

wget focus on downloading file
curl serves more general purpose, by default don’t download things

96
Q

kubectl proxy

A

a http proxy service created by kubectl utility to access the kube-api server without auth

97
Q

to know preferred version of a api group

A

k proxy 8001& (& run in the background)
curl localhost:8001/apis/authorization.k8s.io

98
Q

kube-apiserver –authorization-mode=Node, RBAC, Webhook

A

define the order of authorization option, by default it is alwaysallow

99
Q

role

A

apiGroups [””] core as empty
resources: [“pod”]
verbs: [get, create]

even to a specific pod
resourceName: [“blue-po”, “red-po”]

100
Q

rolebinding

A

bind role to a user
subjects: for user detail
roleRef: role detail

101
Q

check my permission
as admin you can check other’s permission

A

k auth can-i delete nodes

k create po –as dev-user

102
Q

clusterRole

A

role is namespaced, but there are resources that are not namespaced but cluster scoped, such as node, pv, ns.

clusterRole can also authorize a user to access pods across all ns

103
Q

Get the API groups and resource names

A

k api-resources

104
Q

get default enabled admission controller

A

k -n kube-system exec kubeapi-server-pod – kube-apiserver -h | grep enable-admission-plugins

check second paragraph:

admission plugins that should be enabled in addition to default enabled ones (…here all default enabled ones!!!)

to edit in a kubeadm setup when it is running as a po:
vi /etc/kubernetes/manifests/kube-apiserver.yaml

or follow documentation

105
Q

vim search

A

https://monovm.com/blog/how-to-search-in-vim-editor/#:~:text=Press%20the%20%22%2F%22%20key%20to%20enter%20search%20mode.,occurrence%20of%20the%20character%20string.

106
Q

two type admission controller

A

mutating: DefaultStorageClass , NamespaceAutoProvision
validate: NamespaceExits

mutate is invoked first followed by validate

107
Q

mutating/validating admission webhook server

A

two special admission controller to support external admission controller, we need to point it to our own server within or outside k8s cluster to run our own code & logic.

on k8s: kind: ValidatingWebhookConfiguration

webhook will send a AdmissionReview object to the sever for reviewing, the server will return a true or false

108
Q

api version: alpha beta, how to enable?

enable api groups

A

not enable by default,
in ExecStart=
–runtime-config=batch/v2alpha1

109
Q

beta vs alpha vs GA (stable)

A

beta has e2e tests, has only minor bugs, commit to move to GA (general availble)

110
Q

what is preferred version

A

mulitple version can be deployed to a k8s cluster, but when run k get deploy, it only return the preferred version.
To know preferred version:
k explain deploy
or
/apis/batch

storage version: only one version can be defined as storage version. when other version is created, it will be converted to the preferred before storing to edcd version

storage and preferred are usually the same but they don’t necessarily have to be the same

111
Q

api deprecation policy

A
  1. api elements may only be removed by incrementing the version of the API group
  2. api objects must be able to round-trip between api versions in a given release without information loss, with the exception of whole REST resources that do not exist in some versions
    4a, beta support at least 9 month or 3 releases
    GA supports 12 months or 3 releases
    5, when a release supports both new and previous version (v1beta2, v1beta1), after 1 release, we can change the storage/preferred version to the new version.
    3: v2alpha won’t deprecate GA v1 version. v2 can deprecate GA v1
112
Q

k convert

A

k convert -f old-yaml-file –output-version new-version. it outputs new version’s yaml

need to install kubectl convert plugin

113
Q

get short name of resource

A

k api-resources

114
Q

what happens to etcd db when create resource ? what is controller

A

the resource is store the object in etcd data store
controller keeps monitoring etcd and create the replica set based on defined.
each resource has a controller, deploy has deploy controller in Go

115
Q

to define a custom resource other than deploy, replicaset etc

A

use CRD, it only allow you to create resource via k, but it didn’t really does anything. To further do things, custom controller is needed.
scope: namespaced or not
group: define api group, e.g. flights.com
names:
kind: of the resources
singular:
plural:
shortName:
version, schema of its yaml

116
Q

custom controller

A

loops: monitor and change
usually in Go, as it is easier. It can be in python but it is expensive, it needs to create own queueing and caching mechanism

117
Q

operator framework

A

is CRD + custom controller together
operatorHub.io

118
Q

helm concept

A

package manager for k8s app

119
Q

os

A

install helm with snap utility
apt-based system such as Debian or ubuntu apt-get
package-based system, pkg install helm

to get version of linux
lsb_release -a

cat /etc/release

120
Q

Chart.yaml

A

it has info about the helm chart, the version, name etc.
artifacthub.io - chart repository
to search it:
helm search hub wordpress
to search other repo, need to add the repo:
helm repo add bitnami https://charts.bitnami.com/bitnami

to search this repo:
helm search repo wordpress
helm repo list - to list the charts

helm repo update - update chart list from remote

121
Q

to find resource installed by a certain helm release, use selector

A

kubectl get all -n NAMESPACE –selector=release=RELEASE_NAME

122
Q

helm command install

A

helm install release-name chart-name/chart-directory:
download the chart, extract, install it locally.
release: each install of a chart is called a release. it is like id
to list package: helm install
to uninstall package: helm uninstall rellease-name
To only download/extract hem chart:
helm pull –untar bitnami/workpress

123
Q

app creation order

A

pv, pvc, po, svc!
first create pvc

124
Q

remove pvc

A

delete finalizers in the yaml metadata
use /finalizers to search in vim editor

125
Q

networkpolicy

A

check connectivity?

root@controlplane:~$ kubectl exec -it webapp-color – sh

/opt # nc -v -z -w 5 secure-service 80

126
Q

create temporary pod

A

kubectl run tmp –restart=Never –rm –image=nginx:alpine -i – curl http://project-plt-6cc-svc.pluto:3333

–rm: delete po after exits

run not exec!!!

127
Q

exec command in a pod

A

k -n moon exec web-moon-c77655cc-dc8v4 find /usr/share/nginx/html

128
Q

vim: multiple line edit

A

ctrl V: select
shit I: insert
esc: save

129
Q

containerPort:

A

ports : containerPortList of ports to expose from the container. Exposing a port here gives the system additional information about the network connections a container uses, but is primarily informational!!!
Not specifying a port here DOES NOT prevent that port from being exposed.

130
Q

tcp vs http

A

http is later higher than tcp. TCP checks basic network connection, http checks app level connection

131
Q

assign po to a no

A

spec.
nodeSelector with labels
nodeName with name

132
Q

run as root:
add capability

A

spec.securityContext.runAsUser: 0
spec.container.security.securityContext.capabilities.add

133
Q

echo to log

A

while true; do echo $(date) Hi i am shell&raquo_space; date.txt;sleep 5; done;

134
Q

kubectl get event –field-selector involvedObject.name=probe-ckad-aom

A

get events who has label name=probe-ckad-aom, e.g. pod

135
Q

get first field

A

kubectl get ns | cut -d’ ‘ -f1

136
Q

batch process

A

k -n sun label pod -l type=runner protected=true # run for label runner and label them all with protected

k get po –selector type=label –no-headers | awk ‘{print $1}’ | xargs -I {} kubectl label po {} protected=true –namespace=sun

137
Q

search po based on text

A

k describe po | grep happy-shop -A10 -B10
grep before and after 10 lines!

138
Q

cm: –from-env-file vs –from-file

A

–from-env-file: key-value pairs
–from-file: the whole file content will be the value, the file name will be its key.
OR: –from-file=<my-key-name>=<path-to-file></path-to-file></my-key-name>

139
Q

istio, what is it?

A

it is a service mesh (pattern), it manages communication between microservices. istio is the implementation

140
Q

what is its function and why?

A

To make in-cluster security in microservice archtecture.
it introduces a
1. sidecar pattern with evovy proxy: it separates the non-business logic from the microservice. These logic like comunication configuration (COMM), security logic (SEC), retry logic (R), metrics & tracing logic (MT) can be configured once from control plane (istiod) to all microservices (pods)
2. traffic split: canary deployment (90 % new version)

141
Q

how to configure istio?

A

two crd, virtualservice and destinationrule, both are on istiod. By conifgure istiod, we configure the proxy.

142
Q

istio ingress gateway

A

entrypoint to your cluster. It is an alternative to nginx ingress controller. configure as crd: gateway

143
Q
A

Caggle (6 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions