Kubernetes Architecture Flashcards
How does a Kubernetes cluster operate?
API calls to operators. Most things run in containers.
What should you do to make sure that a Kubernetes upgrade will work?
Make sure that all components will work together
How do you make sure all versions will work together?
Run kubeadm upgrade plan
What does the control plane do?
Run server and management processes.
What did the cloud-controller-manager replace?
kube-controller-manager
What’s an example of an essential Kubernetes add-on?
DNS services
What are some optional Kubernetes add-ons?
Cluster logging and resource monitoring
What usually manages the kubelet process?
systemd, when the cluster is built using kubeadm
Which pods get started when a cluster starts?
Those in /etc/kubernetes/manifests/
What does kube-apiserver do?
Handle and validate API calls, and connect to the etcd cluster
What does the Konnectivity service do?
Allows the separation of user and server initiated traffic.
What’s the advantage of segregating user and server initiated traffic?
Reduced performance, capacity and security concerns
What does kube-scheduler do?
Uses an algorithm to decide which node will host a pod
In order, what does kube-scheduler evaluate to decide where to place a pod?
Quota restrictions
Taints and tolerations
Labels and metadata
What does the etcd database store?
Cluster state, networking and persistent information
How do values get updated in etcd?
Values get appended to the end of the database, and old values are removed when compaction runs
What happens if there are simultaneous requests to update a value in etcd?
The first one will succeed, but the others will fail with a 409 error.
What happens when you get a 409 error?
Nothing, the client has to make another request.
What do you have to do before doing an etcd update?
Back up the cluster’s etcd state
How do you back up an etcd state?
Run etcdctl snapshot save or etcdctl snapshot restore
What does the kube-controller-manager agent do?
Keep track of the state of the cluster, and use controllers to get the states to match
What does CCM do?
Interact with agents outside of the cloud, like public cloud providers, to create things like load balancers.
What processes do all Kube nodes run?
kubelet, kube-proxy and a container engine
What does the kubelet do?
Interact with the container engine on the nodes and make sure all required containers are running
How does the kubelet work (slightly more detail)
Takes in API calls for pod specifications and configures the node until the spec has been met. Includes provisioning access to storage, Secrets or ConfigMaps.
What is the Topology Manager?
A component that allocates containers according to NUMA assignments.
What does supervisord do?
In a non-systemd cluster, makes sure the kubelet and docker processes are running
What does kube-proxy do?
Manages the network connectivity to all containers using iptables entries.
What do you use for cluster wide logging?
Kube doesn’t have it built in, so use Fluentd
How can you get cluster wide metrics?
SIG provides some basic node and pod CPU & memory stats, but Prometheus can provide more metrics.
What are operators also known as?
Controllers or watch-loops
What do Deployments manage?
replicaSets
What are replicaSets?
Copies of pods running the same podSpec
What does a service operator do?
Connects all the decoupled components
What does a service operator do? (more detail)
Sends messages through the kube-apiserver, which forwards settings to kube-proxy on every node
What does a service do?
Connect pods together
Expose pods to the internet
Decouples settings
Defines pod access policies
What is the usual makeup of a pod?
One application container, and anciliary components
What are common names for these ancilliary containers?
Sidecar, ambassador or adapter
How can you choose the resources a container can consume?
The resources section of the PodSpec, or a ResourceQuota object
What order do containers start in?
There is no order - they start in parallel
How does an init container differ from a normal container?
They must be running before standard containers will start
They can contain code or utilities that aren’t in an app (like a shell command).
They have independent security from app containers.
