Kubernetes for java Developers part-2

Cross cutting of a Microservices Architecture

 

  • Communication Configuration
  • Security
  • Retry 
  • Metric 
  • Tracing

 

All the cross cutting concerns which we need to add in the each microservices requires lot of time and effort which adds complexity to the services

Solution : Service Mesh with SideCar pattern

  • We can place all not business logic out of Business logic and place it in a sidecar application 
  • Acts as a proxy
  • Third party application
  • Cluster operator can configure it easily
  • Developers can focus on the actual business logic
  • Service Mesh has a control plane which injects the side car proxy in each microservice
  • Istio is the implementation of Service Mesh

Istio and Service Mesh

  • Istio is Service Mesh
  • Service Mesh manages communication between microservices

Create cluster on EKS

eksctl create cluster --name my-kube-cluster --node-type t2.medium --nodes 2 --nodes-min 2 --nodes-max 3

Download istio 

curl -L https://istio.io/downloadIstio | sh -

Add istio client to your path

 export PATH=$PWD/bin:$PATH

install demo configuration file for istio client

istioctl install --set profile=demo -y

Get details of Ingressgateway

kubectl get svc istio-ingressgateway -n istio-system

Set the ingress IP and ports:

export INGRESS_HOST=$(kubectl -n istio-system get service istio-ingressgateway -o jsonpath='{.status.loadBalancer.ingress[0].ip}')
export INGRESS_PORT=$(kubectl -n istio-system get service istio-ingressgateway -o jsonpath='{.spec.ports[?(@.name=="http2")].port}')
export SECURE_INGRESS_PORT=$(kubectl -n istio-system get service istio-ingressgateway -o jsonpath='{.spec.ports[?(@.name=="https")].port}')

Check the set variable

echo $SECURE_INGRESS_PORT
443
echo $INGRESS_HOST

echo $INGRESS_PORT
80

Set ingress host

% kubectl get svc istio-ingressgateway -n istio-system
NAME                   TYPE           CLUSTER-IP       EXTERNAL-IP                                                              PORT(S)                                                                      AGE
istio-ingressgateway   LoadBalancer   10.100.119.196   a2ad7951e826a42b7a54bfe2c998ca53-852284782.us-west-2.elb.amazonaws.com   15021:32206/TCP,80:30954/TCP,443:30130/TCP,31400:30349/TCP,15443:31354/TCP   9m50s
% export INGRESS_HOST=a2ad7951e826a42b7a54bfe2c998ca53-852284782.us-west-2.elb.amazonaws.com 
% export GATEWAY_URL=$INGRESS_HOST:$INGRESS_PORT
% echo $GATEWAY_URL
a2ad7951e826a42b7a54bfe2c998ca53-852284782.us-west-2.elb.amazonaws.com:80

Clone the project 

git@github.com:pulkitpushkarna/kubernetes-spring-boot.git

Checkout to istio-v1-project-image

git checkout istio-v1-project-image

Deploy pods

kubectl create -f helloworld-deployment.yaml

helloworld-deployment.yaml

apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: hello-world-rest-api
  name: hello-world-rest-api
  namespace: default
spec:
  replicas: 1
  selector:
    matchLabels:
      app: hello-world-rest-api
  template:
    metadata:
      labels:
        app: hello-world-rest-api
    spec:
      containers:
        - image: pulkitpushkarna/kubernetes-with-spring-boot:v1
          imagePullPolicy: IfNotPresent
          name: hello-world-rest-api
          ports:
            - containerPort: 8080

Get pods

kubectl get pod

You will observe that one container is there in the pod 

Delete the deployment

kubectl delete -f helloworld-deployment.yaml

Add a namespace label to instruct Istio to automatically inject Envoy sidecar proxies when you deploy your application 

kubectl label namespace default istio-injection=enabled

Now execute the deployment file

kubectl create -f helloworld-deployment.yaml

Get pods

kubectl get pods

You will observe that there are 2 containers in the pod. One is istio proxy and other one is app container

Execute service file

kubectl create -f helloworld-service.yaml
apiVersion: v1
kind: Service
metadata:
  labels:
    app: hello-world-rest-api
  name: hello-world-rest-api
  namespace: default
spec:
  #type: LoadBalancer
  ports:
    - port: 8080
      name: http
  selector:
    app: hello-world-rest-api

helloworld-service.yaml

Execute the gateway file

kubectl apply -f creating-http-gateway.yaml

creating-http-gateway.yaml

apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: http-gateway
spec:
  selector:
    istio: ingressgateway
  servers:
    - port:
        number: 80
        name: http
        protocol: HTTP
      hosts:
        - "*"

Execute the virtual Service file

kubectl apply -f creating-virtualservice-external.yaml

creating-virtualservice-external.yaml

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: helloworld-virtual-services
spec:
  hosts:
    - "*"
  gateways:
    - http-gateway                      # 1
  http:
    - match:
        - uri:
            prefix: /
      route:
        - destination:
            host: hello-world-rest-api             # 2
            port:
              number: 8080

Validate your network

istioctl analyze

Now access deployed application with gateway

pulkitpushkarna@pulkit-pushkarna kubenetes-spring-boot % echo $GATEWAY_URL
a2ad7951e826a42b7a54bfe2c998ca53-852284782.us-west-2.elb.amazonaws.com:80

Enter generated Url on browser now you should be able to access our deployed application

Checkout to branch

git checkout istion-v2-project-image

In the helloworld-deployment.yaml of thids branch replica is set to 2

kubectl delete -f helloworld-deployment.yaml

Delete the existing deployment

Execute the deployment file

kubectl apply -f helloworld-deployment.yaml

If you try to access the your pods by gateway url you will observe that load balancing is takin place between 2 deployed apps

Exercise 1

  • Set up instio on the your kubernetes cluster
  • Make the configurations to access external Ip of load balancer via istioingressgateway.
  • Deploy the hello world deployment, service, gateway and virtual service.
  • Try to access app endpoint from ELB load balancer external IP

Canary Deployment

  • A canary deployment is a deployment strategy that releases an application or service incrementally to a subset of users.
  • All infrastructure in a target environment is updated in small phases (e.g: 2%, 25%, 75%, 100%)
  • A canary release is the lowest risk-prone, compared to all other deployment strategies, because of this control.

execute deployment file for canary deployment

kubectl apply -f helloworld-v2-deployment.yaml

helloworld-v2-deployment.yaml 

apiVersion: v1
kind: Service
metadata:
  name: hello-world-rest-api
  labels:
    app: hello-world-rest-api
spec:
  ports:
    - port: 8080
      name: http
  selector:
    app: hello-world-rest-api
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: hello-world-rest-api-v1
  labels:
    version: v1
spec:
  replicas: 1
  selector:
    matchLabels:
      app: hello-world-rest-api
      version: v1
  template:
    metadata:
      labels:
        app: hello-world-rest-api
        version: v1
    spec:
      containers:
        - name: hello-world-rest-api
          image: pulkitpushkarna/kubernetes-with-spring-boot:v1
          imagePullPolicy: IfNotPresent #Always
          ports:
            - containerPort: 8080
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: hello-world-rest-api-v2
  labels:
    version: v2
spec:
  replicas: 1
  selector:
    matchLabels:
      app: hello-world-rest-api
      version: v2
  template:
    metadata:
      labels:
        app: hello-world-rest-api
        version: v2
    spec:
      containers:
        - name: hello-world-rest-api
          image: pulkitpushkarna/kubernetes-with-spring-boot:v2
          imagePullPolicy: IfNotPresent #Always
          ports:
            - containerPort: 8080

Deploy virtual service for canary deployment

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: helloworld-virtual-services
spec:
  hosts:
    - "*"
  gateways:
    - http-gateway
  http:
    - match:
        - uri:
            exact: /
      route:
        - destination:
            host: hello-world-rest-api
            subset: v1
          weight: 10
        - destination:
            host: hello-world-rest-api
            subset: v2
          weight: 90
---
apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: hello-world-rest-api
spec:
  host: hello-world-rest-api
  subsets:
    - name: v1
      labels:
        version: v1
    - name: v2
      labels:
        version: v2
kubectl apply -f hello-worldcanary.yaml

If we try to access the loadbalancer we will observe that 90 % traffic goes to v2 and 10 % goes to v1

apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: student-rest-api
  name: student-rest-api
  namespace: default
spec:
  replicas: 1
  selector:
    matchLabels:
      app: student-rest-api
  template:
    metadata:
      labels:
        app: student-rest-api
    spec:
      containers:
        - image: pulkitpushkarna/student-microservice
          imagePullPolicy: IfNotPresent
          name: student-rest-api
          ports:
            - containerPort: 8080

kubectl apply -f student-deployment.yaml

Setting up student microservice

apiVersion: v1
kind: Service
metadata:
  labels:
    app: student-rest-api
  name: student-rest-api
  namespace: default
spec:
  #type: LoadBalancer
  ports:
    - port: 8080
      name: http
  selector:
    app: student-rest-api
kubectl apply -f student-service.yaml
apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: http-gateway-student
spec:
  selector:
    istio: ingressgateway
  servers:
    - port:
        number: 80
        name: http
        protocol: HTTP
      hosts:
        - "*"
kubectl apply -f student-gateway.yaml
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: helloworld-virtual-services
spec:
  hosts:
    - "*"
  gateways:
    - http-gateway-student
  http:
    - match:
        - uri:
            exact: /students
      route:
        - destination:
            host: student-rest-api
            port:
              number: 8080

kubectl apply -f student-virtualsewrvice.yaml

After executing all student related yaml files you will observe that you can access all students via /students endpoint and Single student via /students/id endpoint

Load-balancer-external-ip/students
Load-balancer-external-ip/students/1

Now inside the student-virtualsewrvice.yaml change keyword prefix to exact you will obeserve that you will only be able to access following API

Load-balancer-external-ip/students

Difference between exact and Prefix

Data visualisation by Kiali

  • Kiali is a management console for an Istio-based service mesh
  • It provides dashboards, observability, and lets you operate your mesh with robust configuration and validation capabilities.
  • It shows the structure of your service mesh by inferring traffic topology and displays the health of your mesh.

Set up kiali

kubectl get svc -n istio-system

Check for services in istio-system namespace

Go to /istio-1.11.1/samples/addons folder

Run following command to install kiali

 kubectl apply -f kiali.yaml

Port forwarding for kiali

kubectl port-forward svc/kiali -n istio-system 20001

Execute bookinfo.yaml

kubectl apply -f samples/bookinfo/platform/kube/bookinfo.yaml

Execute virtual service for hello-world

kubectl apply -f creating-virtualservice-external.yaml

Execute following command to create traffic

watch curl http://aeee8b946ee12489a8f0a36f215a0dfe-153539747.us-west-2.elb.amazonaws.com/

Grafana

  •  Grafana is a multiple platform open source analytics and interactive visualization web application
  • It provides charts, graphs, and alerts for the web when connected to supported data sources
  • As a visualization tool, Grafana is a popular component in monitoring stacks.
  • It can be use to monitor kubernetes cluster.

Prometheus

  • Prometheus is a free software application used for Event Monitoring and alerting.
  • It records real-time metrics in a time series database (allowing for high dimentianality built using a Http pull model, with flexible queries and real-time alerting.

Setting up prometheus and grafana

kubectl apply -f grafana.yaml  
kubectl apply -f prometheus.yaml

Go to /istio-1.11.1/samples/addons folder and execute the command below

Port Forwarding for grafana

kubectl port-forward svc/grafana -n istio-system 3000

Some handy commands to interact with clusters

kubectl config view

View cluster configruration

Cluster info

kubectl cluster-info

Get list of clusters

kubectl config get-contexts
kubectl config current-context

Get Current cluster

kubectl config use-context <context-name>

Set context

eksctl delete cluster --name my-kube-cluster

Delete cluster

Exercise 2

  • Perform Canary deployment for hello-world application.
  • Deploy student microservice.
  • Test difference between exact and prefix keywords in virtual service for the student microservice.
  • Use kiali for data visualisation.
  • Use grafana and prometheus for monitoring.

Helm

  • helm helps you manage Kubernetes applications
  • Helm Charts help you define, install, and upgrade even the most complex Kubernetes application.​
  • Following are the features of Helm
    • ​Manage Complexity
    • Easy updates
    • Simple sharing
    • Rollbacks

Instructions to install helm

https://helm.sh/docs/intro/install/

Start Minikube

minikube start

Make a dir

mkdir my-helm-app

Inside my-helm-app dir create a file Chart.yaml and templates folder

pulkitpushkarna@pulkit-pushkarna ~ % cd my-helm-app 
pulkitpushkarna@pulkit-pushkarna my-helm-app % touch Chart.yaml
pulkitpushkarna@pulkit-pushkarna my-helm-app % mkdir templates

Enter the following configuration in Chart.yaml file

apiVersion: v1
name: my-helm-app # Name should be same as name of the parent folder
version: 0.1.0
appVersion: v1
description: This is a demo chart

In the templates folder place copy the webserver.yaml file from kubernetes-spring-boot project

cp /<path-to-project>/kubenetes-spring-boot/webserver.yaml .

Go to the previous folder and run the install command

pulkitpushkarna@pulkit-pushkarna templates % cd ..
pulkitpushkarna@pulkit-pushkarna my-helm-app % helm install my-help-app .

Check your cluster

kubectl get all

Run helm list command

pulkitpushkarna@pulkit-pushkarna my-helm-app % helm list
NAME       	NAMESPACE	REVISION	UPDATED                             	STATUS  	CHART            	APP VERSION
my-help-app	default  	1       	2021-08-27 18:22:24.110505 +0530 IST	deployed	my-helm-app-0.1.0	v1

Copy webserver-service.yaml in templates directory

pulkitpushkarna@pulkit-pushkarna my-helm-app % cd templates 
pulkitpushkarna@pulkit-pushkarna templates % cp ~/projects/kubenetes-spring-boot/webserver-service.yaml .
pulkitpushkarna@pulkit-pushkarna templates % ls
webserver-service.yaml	webserver.yaml

We have added webserver-service so we will update the version of the chart

pulkitpushkarna@pulkit-pushkarna templates % cd ..
pulkitpushkarna@pulkit-pushkarna my-helm-app % vim Chart.yaml
apiVersion: v1
name: my-helm-app # Name should be same as name of the parent folder
version: 0.2.0 # version changed
appVersion: v1
description: This is a demo chart

Update the helm chart

pulkitpushkarna@pulkit-pushkarna my-helm-app % helm upgrade my-help-app .
Release "my-help-app" has been upgraded. Happy Helming!
NAME: my-help-app
LAST DEPLOYED: Fri Aug 27 18:38:06 2021
NAMESPACE: default
STATUS: deployed
REVISION: 2
TEST SUITE: None
pulkitpushkarna@pulkit-pushkarna my-helm-app % helm list
NAME       	NAMESPACE	REVISION	UPDATED                             	STATUS  	CHART            	APP VERSION
my-help-app	default  	2       	2021-08-27 18:38:06.122446 +0530 IST	deployed	my-helm-app-0.2.0	v1

Check cluster for the service which we have created

kubectl get all

Run the deployed application on browser

minikube service webserver-service

Rollback to previous revision

pulkitpushkarna@pulkit-pushkarna my-helm-app % helm rollback my-help-app 1

You can check your cluster webserver-service is removed from the cluster because it was not there in the first revision

Go back to the revision 2 you will notice that service is back

helm rollback my-help-app 2

Uninstall help chart

helm uninstall my-help-app

Parameterized charts

create values.yaml file

pulkitpushkarna@pulkit-pushkarna my-helm-app % touch values.yaml
pulkitpushkarna@pulkit-pushkarna my-helm-app % vim values.yaml
pulkitpushkarna@pulkit-pushkarna my-helm-app % cat values.yaml 
replicaCount: 1

pulkitpushkarna@pulkit-pushkarna my-helm-app % cd templates 
pulkitpushkarna@pulkit-pushkarna templates % ls
webserver-service.yaml	webserver.yaml
pulkitpushkarna@pulkit-pushkarna templates % vim webserver.yaml 

apiVersion: apps/v1
kind: Deployment
metadata:
  name: mywebserver
  labels:
    app: spring-boot-app
spec:
  replicas: {{ .Values.replicaCount}}
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxSurge: 1
      maxUnavailable: 1
  selector:
    matchLabels:
      app: spring-boot-app
  template:
    metadata:
      labels:
        app: spring-boot-app
    spec:
      containers:
        - name: my-spring-boot-app
          image: pulkitpushkarna/kubernetes-with-spring-boot:v1
          ports:
            - containerPort: 8080

Introduce expression for replicaCount in webserver.yaml

Change the yaml chart version

pulkitpushkarna@pulkit-pushkarna templates % cd ..
pulkitpushkarna@pulkit-pushkarna my-helm-app % vim Chart.yaml 

apiVersion: v1
name: my-helm-app # Name should be same as name of the parent folder
version: 0.3.0
appVersion: v1
description: This is a demo chart

Install helm chart you will observer that only one replica is created for webserver

pulkitpushkarna@pulkit-pushkarna my-helm-app % helm install my-helm-app .
NAME: my-helm-app
LAST DEPLOYED: Fri Aug 27 19:16:20 2021
NAMESPACE: default
STATUS: deployed
REVISION: 1
TEST SUITE: None
pulkitpushkarna@pulkit-pushkarna my-helm-app % kubectl get all

Uninstall app

helm uninstall my-helm-app

Install app by providing replicaCount 

helm install my-helm-app . --set replicaCount=3

Change replica count without uninstalling the helm chart

helm upgrade my-helm-app . --set replicaCount=2

Parametized app version

pulkitpushkarna@pulkit-pushkarna my-helm-app % helm uninstall my-helm-app                     
release "my-helm-app" uninstalled
pulkitpushkarna@pulkit-pushkarna my-helm-app % vim values.yaml 

replicaCount: 1
myAppVersion: pulkitpushkarna/kubernetes-with-spring-boot:v1
pulkitpushkarna@pulkit-pushkarna my-helm-app % cd templates 
pulkitpushkarna@pulkit-pushkarna templates % vim webserver.yaml 

apiVersion: apps/v1
kind: Deployment
metadata:
  name: mywebserver
  labels:
    app: spring-boot-app
spec:
  replicas: {{ .Values.replicaCount}}
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxSurge: 1
      maxUnavailable: 1
  selector:
    matchLabels:
      app: spring-boot-app
  template:
    metadata:
      labels:
        app: spring-boot-app
    spec:
      containers:
        - name: my-spring-boot-app
          image: {{ .Values.myAppVersion}}
          ports:
            - containerPort: 8080
pulkitpushkarna@pulkit-pushkarna my-helm-app % helm uninstall my-helm-app
release "my-helm-app" uninstalled
pulkitpushkarna@pulkit-pushkarna my-helm-app % helm install my-helm-app . --set myAppVersion=pulkitpushkarna/kubernetes-with-spring-boot:v2
NAME: my-helm-app
LAST DEPLOYED: Fri Aug 27 19:58:33 2021
NAMESPACE: default
STATUS: deployed
REVISION: 1
TEST SUITE: None

Exercise 3

  • Start minikube
  • Create helm chart for the deployment and webserver.yaml and webserver-service.yaml.
  • Try to access deployed webservice from minkube service command.
  • Parameterise replicas parameter of the yaml file webserver.yaml file in your template folder.

Kubernetes for java Developers part-2

By Pulkit Pushkarna

Made with Slides.com

Kubernetes for java Developers part-2

  • 569

More from Pulkit Pushkarna