Kubernetes pod:
DEEP DIVE
![](https://s3.amazonaws.com/media-p.slid.es/uploads/793759/images/5405555/pasted-from-clipboard.png)
ContainerDays 2019
Hamburg, 26/06/2019
whoami
![](https://s3.amazonaws.com/media-p.slid.es/uploads/793759/images/5387891/pasted-from-clipboard.png)
![](https://s3.amazonaws.com/media-p.slid.es/uploads/793759/images/5387894/pasted-from-clipboard.png)
DARIO TRANCHITELLA
- Father
- Developer
- DevOps
- Gopher
- former drummer
CLOUD DEVOPS ENGINEER
NAMECHEAP (NC Cloud Team)
![](https://s3.amazonaws.com/media-p.slid.es/uploads/793759/images/5387892/accountImage.jpg)
this
talk
IS ABOUT...
AND WHY THIS TALK?
THIS TALK IS NOT MADE
OF COPY-PASTED QUOTE
- Dario Tranchitella (ContainerDay 2018)
![](https://s3.amazonaws.com/media-p.slid.es/uploads/793759/images/5405706/pasted-from-clipboard.png)
what is a pod?
![](https://s3.amazonaws.com/media-p.slid.es/uploads/793759/images/5387897/pasted-from-clipboard.png)
![](https://s3.amazonaws.com/media-p.slid.es/uploads/793759/images/6256266/33gddg.jpg)
![](https://s3.amazonaws.com/media-p.slid.es/uploads/793759/images/5387919/Screen_Shot_2018-10-20_at_17.31.28.png)
kubernetes.io
A pod (as in a pod of whales or pea pod) is a group of one or more containers (such as Docker containers), with shared storage/network, and a specification for how to run the containers. A pod’s contents are always co-located and co-scheduled, and run in a shared context. A pod models an application-specific “logical host” - it contains one or more application containers which are relatively tightly coupled — in a pre-container world, being executed on the same physical or virtual machine would mean being executed on the same logical host.
https://kubernetes.io/docs/concepts/workloads/pods/pod/
the definition implementation
apiVersion: v1
kind: Pod
metadata:
name: containerdays
spec:
containers:
- name: foo
image: nginx:alpine
resources:
limits:
cpu: "500m"
memory: "256Mi"
requests:
cpu: "250m"
memory: "128Mi"
- name: bar
image: redis:alpine
resources:
limits:
cpu: "500m"
memory: "256Mi"
requests:
cpu: "250m"
memory: "128Mi"
...keep in mind that a container is made of:
- namespace
- cgroup
- copy on write FS
MORE INFO?
Giulio De Donato: Isoliamo un Processo senza Container (ContainerDay 2016)
K8S_POD_<NAME> AND PAUSE?
![](https://s3.amazonaws.com/media-p.slid.es/uploads/793759/images/6286995/Screenshot_from_2019-06-23_14-20-23.png)
![](https://media3.giphy.com/media/S2Gnqycv3KyHK/giphy.gif)
what is the pause container?
![](https://s3.amazonaws.com/media-p.slid.es/uploads/793759/images/5387909/Screen_Shot_2018-10-20_at_17.26.28.png)
kuberentes pause container
https://github.com/kubernetes/kubernetes/blob/master/build/pause/pause.c
sigaction
examine and change a signal action: returns 0 on success, -1 on error.
SIGINT (2)
Interrupt from keyboard
SIGTERM (15)
Termination signal
SIGCHLD (20,17,18)
Child stopped or terminated
...what about 42?
Answer to the Ultimate Question of Life, the Universe, and Everything!
![](https://s3.amazonaws.com/media-p.slid.es/uploads/793759/images/5550213/pasted-from-clipboard.png)
openshift pause container (< v4)
https://github.com/openshift/origin/blob/v4.0.0-alpha.0/images/pod/pod.go
signal.Notify
Go signal notification works by sending os.Signal values on a channe
os.Interrupt
It's sigint (2)
syscall.SIGTERM
It's sigterm (15)
os.Kill
It's sigkill (9)
PLEASE
ADD LITTLE
COMPLEXITY
...so, it's demo time!
![](https://media2.giphy.com/media/OMeGDxdAsMPzW/giphy.gif)
START YOUR OWN POD
docker run \
-d \
--rm \
--name containerdays \
k8s.gcr.io/pause-amd64:3.1
docker run \
-d \
--rm \
--name containerdays_foo \
--network container:containerdays \
--cpu-shares 512 \
--cpu-quota 75000 \
--ipc container:containerdays \
nginx:alpine
docker run \
-d \
--rm \
--name containerdays_bar \
--network container:containerdays \
--cpu-shares 512 \
--cpu-quota 75000 \
--ipc container:containerdays \
redis:alpine
apiVersion: v1
kind: Pod
metadata:
name: containerdays
spec:
containers:
- name: foo
image: nginx:alpine
resources:
limits:
cpu: "750m"
memory: "256Mi"
requests:
cpu: "500m"
memory: "128Mi"
- name: bar
image: redis:alpine
resources:
limits:
cpu: "750m"
memory: "256Mi"
requests:
cpu: "500m"
memory: "128Mi"
![](https://media0.giphy.com/media/12NUbkX6p4xOO4/giphy.gif)
...wut, something's missing
-
MEMORY REQUEST
memory request is primarily useful to the scheduler, which uses it to find a node with at least that many memory available
-
SECURITY CONTEXT
- --user
- --group-add
- --cap-{add,drop}
- --privileged
- --security-opt
- ...and so on
PLEASE
ADD MORE
COMPLEXITY
![](https://s3.amazonaws.com/media-p.slid.es/uploads/793759/images/6256295/pasted-from-clipboard.png)
![](https://s3.amazonaws.com/media-p.slid.es/uploads/793759/images/5409340/pasted-from-clipboard.png)
![](https://s3.amazonaws.com/media-p.slid.es/uploads/793759/images/5409344/pasted-from-clipboard.png)
edamame.POD.service
[Unit]
Description=EdamamePod, awesome and tasty pod
Requires=docker.service
[Service]
ExecStartPre=/usr/bin/echo "This could be a init script, WDYT?"
ExecStartPre=/usr/bin/docker volume create edamame_volume
ExecStart=/usr/bin/docker run --rm --name edamame k8s.gcr.io/pause-amd64:3.1
ExecStop=/usr/bin/docker stop edamame
Restart=always
[Install]
WantedBy=multi-user.target
EDAMAME.foo.service
[Unit]
Description=edamame.foo, aka Redis
PartOf=edamame.pod.service
[Service]
TimeoutStartSec=0
ExecStart=/usr/bin/docker run --rm --name edamame.foo -v edamame_volume:/etc/edamame --network container:edamame redis:alpine
ExecStop=/usr/bin/docker stop edamame.foo
Restart=always
[Install]
WantedBy=multi-user.target
EDAMAME.bar.service
[Unit]
Description=edamame.bar, aka NGINX
PartOf=edamame.pod.service
[Service]
TimeoutStartSec=0
ExecStart=/usr/bin/docker run --rm --name edamame.bar -v edamame_volume:/etc/edamame --network container:edamame nginx:alpine
ExecStop=/usr/bin/docker stop edamame.bar
Restart=always
[Install]
WantedBy=multi-user.target
...mmm, where are container patterns?
![](https://media1.giphy.com/media/ANbD1CCdA3iI8/giphy.gif)
designing distributed systems (brendan burns)
![](https://s3.amazonaws.com/media-p.slid.es/uploads/793759/images/5409301/pasted-from-clipboard.png)
ambassador
https://github.com/prometherion/openshift-prometheus-grafana-ambassador
...any question?
![](https://media2.giphy.com/media/LyJ6KPlrFdKnK/giphy.gif)
ContainerDays 2019
By Dario Tranchitella
ContainerDays 2019
- 1,404