December 2023 Summaries

Readiness probes in Kubernetes are health checks that determine if a container is ready to receive traffic based on specific conditions, such as successful HTTP or TCP requests. They play an essential role in ensuring the availability and stability of applications running in a cluster by preventing traffic from being directed to containers that are not fully prepared to handle requests. Common types of readiness probes include HTTP, TCP, and Command probes, each with its own configuration parameters. Properly configuring readiness probes can help manage resource constraints, deal with application bugs or issues, and prevent competing or conflicting liveness & readiness probes. Some best practices for using readiness probes include defining them for all containers in your pods, choosing the right probe type, properly configuring parameters, creating lightweight dedicated endpoints, and performing regular reviews of your configuration.

Network Policies in Kubernetes are objects that control network traffic flow within a cluster by defining which Pods can exchange network traffic. They prevent apps from communicating with each other, thus limiting the damage if one app is compromised. Each Network Policy targets a group of Pods and sets Ingress (incoming) and Egress (outgoing) network endpoints that those Pods can communicate with. These policies are additive, meaning multiple policies targeting a particular Pod apply their "allow" rules together. They represent layer 3/4 controls in the OSI networking model, providing granular options to configure network flows. However, they have limitations such as the inability to log events when a network policy block occurs and lack of support for explicit deny policies. Implementation of Network Policies depends on the CNI networking plugin used in the cluster. They are best practices for secure Kubernetes configurations, helping prevent unnecessary broadness in Pod network access.

Docker Init is a utility that automates the process of enabling a project to be built and run with Docker, saving time and increasing consistency when Dockerizing a new application. It provides a set of Dockerfile templates for ASP.NET, Go, Node, Python, and Rust server applications, allowing users to immediately build their image and start a container. The command creates three files: Dockerfile, compose.yaml, and .dockerignore. Docker Init is helpful in several real-world development scenarios, such as quickly bootstrapping new projects, adding Docker to existing projects with sensible defaults, learning how to use Docker with additional programming languages, and saving time by automating more project management tasks.

A Kubernetes manifest file is a text file that describes an object in the cluster using YAML or JSON format. Manifests are crucial for managing objects as they allow versioning configurations alongside code and declaratively applying them to the cluster. They provide several advantages over imperative commands, such as predictable configuration updates, versioning of objects, collaborative management, and facilitating automation in CI/CD pipelines. Key fields in manifests include apiVersion, kind, metadata, and spec. Manifests can be written for multiple objects in one file or across multiple files. Following best practices like checking for errors, organizing manifests, protecting against unintentional changes, documenting, using linters, and employing templating tools can improve the quality and maintainability of Kubernetes manifest files.

Resource blocks are the building blocks of the Terraform language, describing one or more infrastructure objects like virtual machines, gateways, load balancers, etc. The count meta-argument simplifies the creation of multiple resource instances without having to repeat the same resource block multiple times. It can be used with both resource and module blocks. The index attribute within the count object is a sequential number for each instance starting from 0, which can be used as part of the name to make them uniquely identifiable. The count argument supports using numeric expressions and can change the value conditionally.

The kubectl cp command is a utility in Kubernetes used to copy files and directories between local systems and containers within pods, or between pods. It requires a compatible version of the K8S API server (v1.14+) and can be useful for troubleshooting, debugging, or data exchange. The command syntax includes source, destination, namespace, pod name, and path parameters. Common errors include unexpected EOF and termination with exit code 126, which can be resolved by checking network configuration, permissions, file existence, container health, and compatibility of the file format with the target operating system. Spacelift offers features to manage Kubernetes infrastructure more easily and securely.

The jsonencode function in Terraform is used to encode a given value into a JSON-formatted string. It can be useful for creating IAM users in AWS or Policy in Azure. The opposite of the jsonencode function, the jsondecode function in Terraform allows you to parse a JSON-formatted string and convert it into a data structure that can be used within your Terraform configurations. Examples include using JSON files as input variables and local variables, passing in JSON via environment variables, decoding JSON strings to Terraform maps, using jsonencode in the template file, using jsonencode with the for loop, creating IAM policies using the jsonencode function, and creating Azure Policy definitions with the jsonencode function. The difference between jsonencode and heredoc Terraform is that jsonencode is specifically for encoding structured data into a JSON string, while Heredoc allows you to define a block of text without escaping special characters or worrying about JSON formatting.

Docker's "docker ps" command is essential for developers working with containerized apps, as it provides a list of the containers on your machine. It can be used to check whether a container is running, display container sizes, and find stopped containers that need restarting or removal. The command has various options such as -a (--all) flag to view stopped containers, -n/--last flag to view recently created containers, -l/--latest flag for the most recent container, and -s/--size flag to inspect container sizes. Additionally, docker ps supports filters and formatters to customize output and make it easier to manage containers effectively.

Role-Based Access Control (RBAC) is a method of limiting access to computer systems by assigning granular roles to users, allowing them to perform specific actions on defined resources. Kubernetes includes a robust RBAC implementation that can be used to segregate users in your cluster and restrict their access to just the necessary cluster resources. Key points include understanding the difference between RBAC and ABAC, knowing how to use Role, ClusterRole, RoleBinding, and ClusterRoleBinding objects, and following best practices for maintaining security and manageability of Kubernetes clusters.

Lens is a popular Kubernetes management tool that provides a feature-filled graphical interface, allowing users to interact with their clusters visually instead of relying on obscure CLI commands. Developed by Mirantis, it supports monitoring, deployment, and management scenarios in a clean user interface that features multi-cluster capabilities. Lens is free for personal use and individuals with annual revenue below $10m, but a Pro license is required for large-scale business use. It offers an IDE-like experience for Kubernetes developers and administrators, making it easier to control clusters without learning console commands.