TESTING k8s MANIFESTS & SERVICE MESH CONFIG'S

Hello,

Srinivasan Sekar

Open Source Enthusiast

@srinivasanskr

srinivasanTarget

Lead Consultant

Ashay Thorat

@ashu1425

ash1425

Lead Consultant

Agenda,

  • kubernetes and manifests
  • Failure stories
  • Static checks
  • Demo
  • Service Mesh
  • Config's for Service Mesh
  • Demo

Kubernetes Manifests

apiVersion: apps/v1
kind: Deployment
metadata:
  name: orders-deployment
  labels:
    app: orders
spec:
  replicas: 3
  selector:
    matchLabels:
      app: orders
  template:
    metadata:
      labels:
        app: orders
    spec:
      containers:
      - name: orders
        image: registry.com/orders:tag
        ports:
        - containerPort: 8080

  • Kubernetes workloads are described in YAML manifests

apiVersion: v1
kind: Service
metadata:
  name: orders-service
spec:
  selector:
    app: orders
  ports:
    - protocol: TCP
      port: 80
      targetPort: 8080

Kubernetes Best Practices

  • Health checks

  • Graceful shutdown

  • Fault tolerance

  • Resource Utilisation

  • Resource tagging (labels)

  • Configuration and Secrets

  • Pod security policy

  • Namespaces, etc

Static Checks

  • Integrating Static checks allows catching policy violations and errors close to dev cycle.

  • Static checks can be categorised as:

    • API Validators

    • Built-in Checkers

    • Custom Validators

API Validators

apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx-deployment
  labels:
    app: nginx
spec:
  replicas: one
  selector:
    matchLabels:
      app: nginx
  template:
    metadata:
      labels:
        app: nginx
    spec:
      containers:
      - name: nginx
        image: nginx:1.14.2
        ports:
        - containerPort: 80

API Validators

  • Validates k8s manifest against the k8s API server

  • Using schemas generated from the Kubernetes OpenAPI specification

Built In Checkers

  • Validates k8s manifest against the in-built opinionated checks

One size doesn't fit all:
Datadog ensures that they don't use ImagePullPolicy as "Always"

Custom Validators

  • Conftest is a utility to help you write tests against structured configuration data.

  • Write tests for your Kubernetes configurations, Terraform code, Serverless configs or any other structured data.

Open Policy Agent

  • OPA gives you the ability to offload the decision-making process from policy enforcement to a dedicated engine.

  • Domain agnostic general-purpose agent

  • unified toolset and framework for policy across the cloud native stack.

DEMO

Service Mesh

Istio Architecture

https://istio.io/v1.4/docs/ops/deployment/architecture/

Canary Deployments

Text

https://www.mobilise.cloud/kubernetes-deployment-strategies/

Canary Deployments - Can you spot the error?

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: helloworld
spec:
  hosts:
    - helloworld
  http:
  - route:
    - destination:
        host: helloworld
        subset: v1
      weight: 90
    - destination:
        host: helloworld
        subset: v2
      weight: 90

DEMO

Resources

  • https://k8s.af/
  • https://github.com/open-policy-agent/conftest/tree/master/examples
  • https://learnk8s.io/
  • https://kubernetes.io/blog/2019/03/22/kubernetes-end-to-end-testing-for-everyone/
  • https://kube-score.com/
  • https://istio.io/v1.4/docs/ops/deployment/architecture/
  • https://www.mobilise.cloud/kubernetes-deployment-strategies/
  • https://www.youtube.com/watch?v=QXApVwRBeys
  • https://www.youtube.com/watch?v=_wySvT2uqyM

Testing k8s manifests

By Srinivasan Sekar

Made with Slides.com

Testing k8s manifests

  • 649

More from Srinivasan Sekar