Course info

Source-outline mode. Generate academy from uploaded outlines: Kubernetes_Introduction_Outline_v2_2.pdf This refreshed Kubernetes Introduction Overview course walks you from first principles to practical, kubectl-driven workflows on a local cluster. You’ll build a clear mental model of how Kubernetes works, then practice creating Pods, Deployments, Services, storage, configuration, and secure access patterns. The updated version preserves the original 17-section flow while adding modern security, observability, and threat modeling practices. A refreshed, hands-on introduction to Kubernetes that preserves the instructor's original 17-section flow: theory first, then labs, from installing kubectl through Pods, Deployments, Services, storage, configuration, stateful workloads, troubleshooting, RBAC and threat modeling. What you will learn: - Install and configure kubectl and a local Kubernetes cluster using tools such as minikube or kind. - Explain the roles of Kubernetes control plane and node components and what happens when you run kubectl apply. - Create and manage core Kubernetes resources such as Pods, Deployments, Services, Namespaces, ConfigMaps, Secrets, and StatefulSets using YAML manifests. - Configure Services and label selectors to expose applications inside and outside the cluster, and verify Endpoints. - Attach persistent storage to workloads using PersistentVolumes, PersistentVolumeClaims, StorageClasses, and StatefulSets. - Monitor and troubleshoot workloads using kubectl get, describe, logs, and exec, including common failure modes like CrashLoopBackOff and Pending. - Apply basic security practices including RBAC, ServiceAccounts, Pod securityContext settings, and Pod Security Standards, and perform a simple threat modeling exercise for a Kubernetes workload. The following reference materials were provided as context. Use them as guidance only -- always prefer the latest, most current information over any potentially outdated content in these files. --- Reference: Kubernetes_Introduction_Outline_v2_2.pdf --- ## Kubernetes Introduction Overview ## This two-day course provides an overview of deploying and managing containerized applications with Kubernetes. This course will teach you how to install Kubernetes, deploy, manage, and monitor Kubernetes workloads. ## Audience ## It is for developers, operation managers, and IT professionals who would like to learn Kubernetes. ## Software Platform ## Kubernetes ## Prerequisites ## Students should have some familiarity with deploying containerized applications. ## Getting started with Kubernetes ## • Kubernetes in a nutshell: an illustrated overview • Install kubectl on Windows and Linux • Test kubectl commands • Kubernetes playgrounds (Killercoda and Kubernetes interactive tutorial) • How the course flows: theory followed by hands-on labs ## Installing a Kubernetes Cluster ## • Installation options: local, self-managed, and managed Kubernetes • Local clusters with minikube or kind • Overview of kubeadm • Managed services: Amazon EKS, Google GKE, and Azure AKS • kubeconfig, contexts, and connecting kubectl to a cluster • Lab: create a local cluster and verify it with kubectl ## Cluster Components: Masters and Nodes ## • Control plane components: API server, etcd, scheduler, and controller manager • Node components: kubelet, kube-proxy, and the container runtime • Container runtimes and the CRI: containerd and CRI-O • What happens when you run kubectl apply • Add-ons: DNS and the metrics server ## Pods ## • The atomic unit of scheduling: VMs, containers, and Pods • Kubernetes and Docker are complementary technologies • Pods and containers • Single-container and multi-container Pods • Pods are atomic, mortal, and scaled by adding Pods ## • The canonical multi-container example • The Pod shared execution environment and network namespace • Pod theory summary • Lab: write pod.yml and create the Pod with kubectl apply • Lab: introspect a running Pod with kubectl get, describe, and exec • Lab: access the service running inside the container • Lab: clean up ## Deployments ## • Deployment theory: Deployments, ReplicaSets, and Pods • Self-healing and scalability • Desired state vs. current state • Declarative vs. imperative models • Reconciliation loops • Rolling updates with zero downtime • Rollbacks and revision history • Lab: create a Deployment from deploy.yml and inspect its ReplicaSets • Lab: access the app with a NodePort Service • Lab: configure the rolling update strategy (maxSurge and maxUnavailable) • Lab: perform a rolling update, then pause and resume the rollout • Lab: check rollout status and history, then roll back • Lab: clean up ## Services ## • Service theory: stable IP, DNS name, and load balancing • Labels and loose coupling with label selectors • Services and Endpoints objects • Accessing Services from inside the cluster (ClusterIP) • Accessing Services from outside the cluster (NodePort) • Common Service types: ClusterIP, NodePort, LoadBalancer, and ExternalName • Service discovery with DNS and environment variables • Lab: expose a Deployment imperatively with kubectl expose • Lab: create a Service declaratively with svc.yml • Inspecting Services and Endpoints • Real-world example: zero-downtime version updates with label selectors ## Storage ## • The big picture: storage providers, CSI, and the persistent volume subsystem • The Container Storage Interface (CSI) • The Kubernetes persistent volume subsystem: PVs, PVCs, and StorageClasses • Access modes and reclaim policies • Lab: create a PV, a PVC, and a Pod that mounts the volume • StorageClasses and dynamic provisioning • Multiple StorageClasses and implementing them • Demo: StorageClass, PVC, and Pod; delete the Pod and verify the data persists ## ConfigMaps ## • Decoupling applications from their configuration • ConfigMap theory • How ConfigMaps work • ConfigMaps and Kubernetes-native apps ## • Creating ConfigMaps declaratively • Injecting ConfigMap data as environment variables • Injecting ConfigMap data into container startup commands • Injecting ConfigMap data with volumes, and live updates • Hands-on with ConfigMaps ## Secrets ## • Secrets vs. ConfigMaps • Why base64 is not encryption • Creating Secrets declaratively and imperatively • Consuming Secrets as environment variables and volumes • Encrypting Secrets at rest (overview) • Lab: pass credentials to a Pod ## StatefulSets ## • Stateful vs. stateless containers and services • StatefulSet theory and how it compares with Deployments • Predictable Pod names and sticky IDs • Ordered creation, scaling, and deletion • Volumes and failure handling • Network ID, headless Services, and governing Services • Hands-on with StatefulSets ## Namespaces ## • Use cases for Namespaces • Inspecting Namespaces: default and kube-system • Creating and managing Namespaces declaratively and imperatively • Configuring kubectl to use a specific Namespace • Lab: deploy an application to a Namespace and test it • Lab: clean up and reset kubeconfig ## Monitoring and Troubleshooting ## • Inspecting resources with kubectl get, describe, logs, and exec • Reading Pod status and events • Watching changes with --watch • Liveness and readiness probes • Common errors: ImagePullBackOff, CrashLoopBackOff, and Pending • Lab: diagnose and fix a broken Deployment ## API Security and RBAC ## • The API security big picture: authentication, authorization, and admission control • Authentication: users and ServiceAccounts • Authorization with role-based access control (RBAC) • Roles, ClusterRoles, RoleBindings, and ClusterRoleBindings • Checking permissions with kubectl auth can-i • Admission control • Lab: grant a user read-only access to a Namespace ## Image and Pod Security Basics ## • Image security: trusted registries, vulnerability scanning, and image signing (overview) ## • Pod securityContext: running as non-root and dropping privileges • Pod Security Standards: privileged, baseline, and restricted • Lab: apply a securityContext and observe the effect ## Threat Modeling Kubernetes ## • What is threat modeling? • Spoofing • Tampering • Repudiation • Information Disclosure • Denial of Service • Elevation of Privilege • Security talks and resources ## Kubernetes and Docker ## • Kubernetes drops Docker: the Dockershim deprecation • What changed and what did not for Docker images and developers ## Additional Resources ## • Kubernetes on AWS and Amazon EKS • Persistent disks on Google Cloud • Best practices for working with labels and label selectors • Logging and Kibana • Docker Certified Associate exam preparation • Kubernetes vs. Docker Swarm • Illustrated videos: Phippy goes to the zoo