README.md

All Things Docker and Kubernetes

This repository contains projects on containerization and orchestration that I'm currently working on in 2021 the present.

• How to Use this Repo
• Projects
  • Pre-requisites
  • Project List
• Notes
  • Docker + Containers
  • Cloud-Native
  • Kubernetes
  • Kubernetes Security
  • Helm
  • Amazon Elastic Kubernetes Service (EKS)
  • Azure Kubernetes Service (AKS)
  • Google Kubernetes Engine (GKE)
  • Troubleshooting Guides
• Certification Exams
  • Practice Tests
  • Links
• Resources

How to Use this Repo

• Each project in this repo is equipped with easy-to-follow, detailed instructions.

• You can also go through the Docker and Kubernetes notes below for a quick walkthrough.

Projects

Pre-requisites

Here are some pre-requisites before we can perform the projects and labs.

• For Docker Labs

• For Kubernetes Labs

• Optional Tools

Project List

The complete list of projects can be found here.

Notes

Docker + Containers

• From VMs to Containers

• What is Docker?

• The Docker Architecture

• Linux Kernel Features

• How Docker runs on Windows

• Installing Docker

• Using Docker without Root Permission

• Docker Objects

• Tagging the Image

• Pushing/Pulling an Image to/from a Container Registry

• Docker Commands

• Attach and Detach Mode

• Inputs

• Port Mapping

• Persisting Data

• Logs

• Environment Variables

• CMD and ENTRYPOINT

• Docker Networking

• Docker Compose

• Docker Compose Commands

• Status Codes and Restart Policies

• Docker Swarms

• Container Security

• Container Best Practices

Cloud Native

• What is Cloud Native?

• Containers and being Cloud Native

• Cloud-Native Landscape

• Business and Technical Considerations

• Design Considerations

• Monoliths and Microservices

• Tradeoffs

• Best Practices for Application Deployments

• Product is Released, What's Next?

Kubernetes

• Container Management Challenges

• What is Kubernetes

• Kubernetes API Objects

• Kubernetes Cluster

• Pod Operations

• Kubernetes Networking

• Setting up Kubernetes

• Kubeconfig file

• Kubernetes API

• Enabling API versions for API Groups

• Changing deprecated API versions using kubectl convert

• Custom Resources

• Manifests

• Pods

• Static Pods

• Scheduling

• DaemonSets

• Labels, Selectors, and Annotations

• Jobs and CronJobs

• Taints and Tolerations

• Node Selectors and Node Affinity

• Pod Affinity

• Resource Requirements

• ReplicaSets

• Scaling

• Services

• ClusterIP

• Nodeport

• External Name

• Kubernetes Ingress

• Deployments

• Rollouts and Rollbacks

• Probes, Sidecar Containers, and Init Containers

• Volumes and StorageClasses

• ConfigMaps and Secrets

• Certificate Authority

• Stateless vs. Stateful

• Application Lifecycle Management

• Kubernetes Dashboard

• Kubernetes Commands

• Cluster Maintenance

• Back Up, Restore and Upgrade Clusters

• Kubernetes Ecosystem

• CNCF Projects

• Kubernetes in the Cloud

• Kubernetes Patterns for Application Developers

Kubernetes Security

• The 4Cs of Cloud Native Security

• Cluster Hardening

  • CIS Security Benchmarks

  • CIS-CAT Pro Assessor

  • Kube-bench

  • Security Primitives

  • Authentication and Authorization

  • Authentication Mechanisms

  • Authorization Mechanisms

  • Role-Based Access Control

  • Service Accounts

  • TLS Certificates

  • Security Contexts

  • Kubelet Security

  • Kubectl Proxy and Port Forwarding

  • Kubernetes Dashboard

  • Network Policy

  • Ingress

  • Securing the Docker Daemon

  • Securing Control Plane Communications with Ciphers

• System Hardening

  • Least Privilege Principle

  • Limit Node Access

  • SSH Hardening

  • Linux Privilege Escalation

  • Remove Obsolete Packages and Services

  • Restrict Kernel Modules

  • Identify and Disable Open Ports

  • Minimize IAM Roles

  • Restrict Network Access

  • Tracing Linux Syscalls

  • Restricting Linux Syscalls through Seccomp

  • AppArmor

  • Linux Capabilities

• Minimize Microservice Vulnerabilities

  • Admission Controllers

  • Pod Security

  • Managing Kubernetes Secrets

  • Open Policy Agent

  • Container Sandboxing

  • One-way SSL and Mutual SSL

• Supply Chain Security

  • Image Security and Best Practices

  • Whitelist Allowed Registries

  • Static Analysis of User Workloads

  • Scan images for known vulnerabilities

• Monitoring, Logging, and Runtime Security

  • Falco

  • Mutable and Immutable Infrastructure

  • Use Audit Logs to monitor access

Helm

• Helm Package Manager

• Helm Chart and Templates

• Helm Commands

Amazon Elastic Kubernetes Service

• Amazon EKS - Managed Kubernetes

• Amazon EKS - Pricing

• Amazon EKS - IAM and RBAC

• Amazon EKS - Networking

• Amazon EKS - Loadbalancers

• Amazon EKS - Cluster AutoScaler

• Amazon EKS - Logging to CloudWatch

• Amazon EKS - Persistent Volumes

• Amazon EKS - Self-managed vs. Managed Nodegroups

Troubleshooting Guides

• Log Locations

• Error: Cannot View Kubernetes Nodes

• Error: Failing to Delete CloudFormation Stack

• Default etcd port

Certification Exams

Practice Tests

• Certified Kubernetes Administrator (CKA)
• Certified Kubernetes Application Developer (CKAD)

Links

• Exam Tips

• Open Source Curriculum for CNCF Certification Courses

• Certified Kubernetes Administrator (CKA)

• Certified Kubernetes Application Developer (CKAD)

• Certified Kubernetes Security Specialist (CKS)

• Important Instructions: CKA and CKAD

• Linux Foundation Certification Exam: Candidate Handbook

Resources

Useful courses on Docker:

• Docker in Production Using Amazon Web Services

• Building, Deploying, and Running Containers in Production

• Docker and Kubernetes: The Complete Guide

• Docker in Production Using Amazon Web Services

• The Complete Practical Docker Guide

• Complete AWS ECS Bootcamp (Beginner friendly)

Useful courses on Kubernetes:

• Getting Started with Kubernetes LiveLessons, 2nd Edition

• Hands-on Kubernetes

• Learning Path - Kubernetes Administration

• Learning Path - Using Kubernetes as a Developer

• Learn DevOps: The Complete Kubernetes Course

• Cloud Native Fundamentals by SUSE

• Running Kubernetes on AWS (EKS)

• Hands-On Amazon Elastic Kubernetes Service (EKS) LiveLessons: Running Microservices

• Packaging Applications with Helm for Kubernetes

Other resources on Docker:

• Dockerfile reference

• Best practices for writing Dockerfiles

• Docker Build command

• Docker Run command

• Introduction to Docker registry

• Docker Tag command

• Docker Push command

• Open Container Initiative (OCI) Specifications

• Buildpacks: An App’s Brief Journey from Source to Image

Other resources on Kubernetes:

• DNS for Services and Pods

• Custom Resources or CRDs

• Autoscaling in Kubernetes

• Kubernetes Components

• eksctl - Config file schema

Github repositories:

• Kubernetes Autoscaler

• kubernetes/kops

• wardviaene/kubernetes-course

• wardviaene/devops-box (devops box with pre-built tools)

• kelseyhightower/kubernetes-the-hard-way

• mmumshad/kubernetes-the-hard-way

• yankils/Simple-DevOps-Project

• phcollignon/helm

• phcollignon/helm3

Metrics, Logging, Health Checks, and Tracing:

• Pattern: Health Check API

• Best Practice on Metric Naming

• How to Log a Log: Application Logging Best Practices

• log4j - Logging Levels

• Enabling Distributed Tracing for Microservices With Jaeger in Kubernetes

Free DNS Service using freedns

• Sign up at http://freedns.afraid.org/
• Choose for subdomain hosting
• Enter the AWS nameservers given to you in route53 as nameservers for the subdomain

Free DNS Service using dot.tk

• provides a free .tk domain name you can use
• you can point it to the amazon AWS nameservers

Free DNS Service using Namecheap

• often has promotions for tld’s like .co for just a couple of bucks