Book Image

Kubernetes and Docker - An Enterprise Guide

By : Scott Surovich, Marc Boorshtein
Book Image

Kubernetes and Docker - An Enterprise Guide

By: Scott Surovich, Marc Boorshtein

Overview of this book

Containerization has changed the DevOps game completely, with Docker and Kubernetes playing important roles in altering the flow of app creation and deployment. This book will help you acquire the knowledge and tools required to integrate Kubernetes clusters in an enterprise environment. The book begins by introducing you to Docker and Kubernetes fundamentals, including a review of basic Kubernetes objects. You’ll then get to grips with containerization and understand its core functionalities, including how to create ephemeral multinode clusters using kind. As you make progress, you’ll learn about cluster architecture, Kubernetes cluster deployment, and cluster management, and get started with application deployment. Moving on, you’ll find out how to integrate your container to a cloud platform and integrate tools including MetalLB, externalDNS, OpenID connect (OIDC), pod security policies (PSPs), Open Policy Agent (OPA), Falco, and Velero. Finally, you will discover how to deploy an entire platform to the cloud using continuous integration and continuous delivery (CI/CD). By the end of this Kubernetes book, you will have learned how to create development clusters for testing applications and Kubernetes components, and be able to secure and audit a cluster by implementing various open-source solutions including OpenUnison, OPA, Falco, Kibana, and Velero.
Table of Contents (20 chapters)
1
Section 1: Docker and Container Fundamentals
5
Section 2: Creating Kubernetes Development Clusters, Understanding objects, and Exposing Services
9
Section 3: Running Kubernetes in the Enterprise

Using audit2rbac to debug policies

There is a tool called audit2rbac that can reverse engineer errors in the audit log into RBAC policy objects. In this section, we'll use this tool to generate an RBAC policy after discovering that one of our users can't perform an action they need to be able to do. This is a typical RBAC debugging process and learning how to use this tool can save you hours trying to isolate RBAC issues:

  1. In the previous chapter, a generic RBAC policy was created to allow all members of the k8s-cluster-admins group to be administrators in our cluster. If you're logged into OpenUnison, log out.
  2. Now, log in again, but before hitting the Finish Login button at the bottom of the screen, remove the k8s-cluster-admins group and add cn=k8s-create-ns,cn=users,dc=domain,dc=com:

    Figure 8.1 – Updated login attributes

  3. Next, click on Finish Login. Once logged in, go to the dashboard. Just as when OpenUnison was first deployed, there won&apos...