Book Image

Kubernetes in Production Best Practices

By : Aly Saleh, Murat Karslioglu
Book Image

Kubernetes in Production Best Practices

By: Aly Saleh, Murat Karslioglu

Overview of this book

Although out-of-the-box solutions can help you to get a cluster up and running quickly, running a Kubernetes cluster that is optimized for production workloads is a challenge, especially for users with basic or intermediate knowledge. With detailed coverage of cloud industry standards and best practices for achieving scalability, availability, operational excellence, and cost optimization, this Kubernetes book is a blueprint for managing applications and services in production. You'll discover the most common way to deploy and operate Kubernetes clusters, which is to use a public cloud-managed service from AWS, Azure, or Google Cloud Platform (GCP). This book explores Amazon Elastic Kubernetes Service (Amazon EKS), the AWS-managed version of Kubernetes, for working through practical exercises. As you get to grips with implementation details specific to AWS and EKS, you'll understand the design concepts, implementation best practices, and configuration applicable to other cloud-managed services. Throughout the book, you’ll also discover standard and cloud-agnostic tools, such as Terraform and Ansible, for provisioning and configuring infrastructure. By the end of this book, you’ll be able to leverage Kubernetes to operate and manage your production environments confidently.
Table of Contents (12 chapters)

Managing secrets and certificates

Secrets and TLS certificates are essential security needs for modern applications, and while Kubernetes provides a native solution to create and consume secrets and sensitive data, it remains in need of additional hardening. On the other hand, Kubernetes has no native answer to certificate issuing and management, which is why we will deploy one of the popular add-ons and use it for this purpose.

Creating and managing secrets

Kubernetes has a secret resource type that can be used to store sensitive data, such as passwords, tokens, certificates, and SSH keys. Pods can consume these secrets by mounting them as volumes or environment variables. However, we do not recommend environment variables because they can leak out and get compromised.

Another challenge here arises when users decide to store the secrets that YAML manifests in Git repositories. In such a case, the sensitive data can be easily compromised because secrets do not use encryption...