Explore Kubernetes architecture, frameworks, and interfaces. Gain insights into deployment, scaling, and management of containerized applications. Discover extensibilities and get hands-on customizing Kubernetes.

k8s-go.tar.gz

k8s-go-v2

go-env-v2

Kubernetes is a popular open-source container orchestration system that automates the deployment, scaling, and management of containerized applications. This course is designed to provide a comprehensive understanding of Kubernetes and its programming concepts. You’ll dive deep into advanced topics of Kubernetes.

This course will cover topics such as Kubernetes architecture, frameworks, plugins, and interfaces. You’ll also learn the powerful extensibilities of Kubernetes and make full use of these built-in capabilities to build your customized Kubernetes.

This course is ideal for developers, DevOps engineers, and system administrators who want to learn how to master Kubernetes. By the end of the course, you’ll have a solid understanding of Kubernetes, its programming concepts, and be able to deploy, scale, and manage containerized customizations on Kubernetes. You will also get hands-on experience extending Kubernetes to meet your requirements.

Programming with Kubernetes

# Overview

With the help of the CRI, we can let `kubelet` talk with a variety of container runtimes. In this lesson, we will show how to configure containerd to run both the runc and gVisor containers. **runc** is a low-level container engine that is used by containerd to manage containers. On the other hand, **gVisor** is an application kernel that provides a secure environment for containers.

# Why different container runtimes

Normally, a Kubernetes cluster is shared by many users and workloads---this could bring in some security concerns. Not all the applications running in the cluster are trusted. Some of them may use malicious container images, which may incur unexpected risks. Moreover, the commonly used container runtime Docker/containerd has an inescapable security issue; containers sharing the same kernel with the host, which makes it exploitable with the same vulnerabilities when the host system kernel gets affected. If some containers are running in privilege mode, the host system kernel can be exploited through those containers as well.

The common containerization approaches (such as containerd) rely on Linux `namespaces` and `cgroups`, which are fairly suitable to run trusted application containers. However, hypervisor-based containerization implementations can provide stronger isolation, which can help mitigate the vulnerabilities with hosting untrusted containers.

In Kubernetes, the `RuntimeClass` API is provided to allow the running of workloads with a selected container runtime.

Learn how to run multiple container runtimes in Kubernetes.

Before Getting Started

Kubernetes Architecture

Customizing AuthX

Dynamic Admission Control

Customizing Schedulers

Extending APIs with CustomResourceDefinition (CRD)

Extending APIs with Aggregated APIServer

Container Network Interface

Container Runtime Interface

Extend kubectl

How to Write Good Kubernetes Operators

Assessment of Programming with Kubernetes

Wrap Up

Run Multiple Container Runtimes

Overview

Why different container runtimes