OpenShift administration

Three-part training on OpenShift 4 administration. Topics shared with vanilla Kubernetes use the Kubernetes slides, listed with each topic below.

Slides used throughout the training

These decks are used across all parts:

• OPENSHIFT.pdf: differences with vanilla Kubernetes, installation, Machine API, RBAC, SCCs
• C_K8s_02_standard_API.pdf: Kubernetes basics reminder: Deployments, rollouts, StatefulSets, K9s

Technical resources, useful in every lab:

• ktbx, the Kubernetes toolbox, including K9s
• kubectl essentials

Part 1: Introduction

Back to Kubernetes basics

Slides:

• E_01_advanced-k8s-cluster-internals.pdf: cluster internals, etcd, API server, scheduler

Labs:

• Kubernetes Controllers
• Multi-Container Pod Design Patterns
• Kubelet and static pods
• etcd administration

Ingress, Routes and DeploymentConfig

Slides:

• D_01_Ingress.pdf
• D_08_openshift_ingress-gateway.pdf: Ingress, Routes and Gateway API

Labs:

• OpenShift Networking: From Ingress to Route

Pod placement: affinity, anti-affinity, taints

Slides:

• E_05_advanced-k8s_advanced_scheduling.pdf

Labs:

• Pod placement: affinity, anti-affinity, taints

Article:

• Taints and tolerations

Part 2: Administration and security

RBAC

Slides:

• E_02_advanced-k8s_RBAC.pdf

Labs:

• Kubectl proxy and curl
• RBAC
• RBAC monitoring
• Kubernetes Service Account Token Lab

Operators

Slides:

• E_06_advanced-k8s_operators.pdf

Demo and lab:

• Operators with OLM: the Grafana Operator: the trainer installs the operator from the web console (Part 1), then the trainees use it (Part 2)

Monitoring: application metrics and Thanos

Slides:

• D_03_Prometheus_monitoring.pdf
• D_05_multicluster-monitoring.pdf: Thanos

Labs:

• Monitoring with Prometheus
• Prometheus operator demo

Stateful applications

Slides:

• C_K8s_02_standard_API.pdf: StatefulSets

Labs:

• MongoDB: up to the Rolling Update section, which is done in Part 3

MachineSets and availability zones

Slides:

• OPENSHIFT.pdf: Machine API, MachineSets

Labs:

• OpenShift MachineSets and availability zones (on the shared Azure IPI cluster)

Security context and SCCs

Slides:

• E_03_advanced-k8s_Security_node+network.pdf: security context, Pod Security Admission, NetworkPolicy

Labs:

• Security context (on kind): script
• Pod Security Admission (on kind): script
• OpenShift Security Context Constraints (SCC)
• Helm on OpenShift: Migrating to Security Context Constraints
• NetworkPolicy (optional, on kind)

Autoscaling

Slides:

• E_04_advanced-k8s_computational_resources.pdf

Labs:

• Requests, limits, quotas and LimitRanges: scripts
• Horizontal Pod Autoscaling (HPA)
• Vertical Pod Autoscaling (VPA)

Part 3: Deployment and troubleshooting

Rolling updates, rollback, canary and A/B testing

Slides:

• C_K8s_02_standard_API.pdf: Deployments, rollouts
• D_08_openshift_ingress-gateway.pdf: Gateway API

Labs:

• StatefulSet: canary with partition, rolling update and rollback of MongoDB
• Gateway API: canary release and A/B testing
• Optional: Deployments: rolling update, rollback and canary

Troubleshooting

Slides:

• D_06_develop_with_k8s.pdf: kubectl debug and ephemeral containers

Labs:

• Debug running pods: kubectl describe, Pending pods, logs, kubectl exec, up to “Debugging with an ephemeral debug container” (Kubernetes documentation)
• Debugging with an ephemeral container (Kubernetes documentation)
• Optional: Troubleshooting an application from A to Z