Kubernetes in Action, Second Edition Deploying and managing containers and cloud-native applications (Marko Lukša, Kevin Conner)（Z-Library）

M A N N I N G Marko Lukša Kevin Conner Deploying and managing containers and cloud-native applications SECOND EDITION

Kubernetes resources covered in the book *Cluster-level resource (not namespaced) (continued on inside back cover) Resource (abbr.) [API version] Description Section Node* (no) [v1] Represents a worker Node in the Kuber- netes cluster. 4.2 Event (ev) [v1] Report of something that has occurred in the cluster. 4.3 Namespace* (ns) [v1] Enables organizing resources into non- overlapping groups (e.g. per tenant). 7.1 D ep lo yi ng w or kl oa ds Pod (po) [v1] The basic deployable unit containing one or more processes in collocated containers. 5.1 ReplicaSet (rs) [apps/v1] Keeps one or more pod replicas running. 14.1 Deployment (deploy) [apps/v1] Enables declarative updates of pods. 15.1 StatefulSet (sts) [apps/v1] Runs stateful pods with stable identity. 16.1 DaemonSet (ds) [apps/v1] Runs one pod replica per node (on all nodes or just on those matching a node selector). 17.1 Job [batch/v1] Runs pods that perform a completable task. 18.1 CronJob (cj) [batch/v1] Runs a job in the future or periodically. 18.2 C on fig ConfigMap (cm) [v1] A key-value map for storing non-sensitive config options for apps and exposing it to them. 8.2 Secret [v1] Like a ConfigMap, but for sensitive data. 8.3 S to ra ge PersistentVolume* (pv) [v1] Points to persistent storage that can be mounted into a pod. 10.1 PersistentVolumeClaim (pvc) [v1] A request for and claim to a Persistent- Volume. 10.1 StorageClass* (sc) [storage.k8s.io/v1] Defines the type of dynamically-provisioned storage claimable in a PersistentVolume- Claim. 10.1 CSIDriver* [storage.k8s.io/v1] Defines a Container Storage Interface driver available in the cluster. 10.2 VolumeSnapshot [snapshot.storage.k8s.io/v1] Represents a snapshot of a volume on a storage system. 10.4 Licensed to THIAGO BANDEIRA <thiago@lar.ifce.edu.br>

Praise for the First Edition The full path to becoming a professional Kubernaut. Fundamental reading! —Csaba Sari, Chimera Entertainment Authoritative and exhaustive. In a hands-on style, the author teaches how to manage the complete life cycle of any distributed and scalable application. —Antonio Magnaghi, System1 The best parts are the real-world examples. They don’t just apply the concepts, but they road-test them. —Paolo Antinori, Red Hat An in-depth discussion of Kubernetes and related technologies. A must-have! —Al Krinker, USPTOLicensed to THIAGO BANDEIRA <thiago@lar.ifce.edu.br>

Licensed to THIAGO BANDEIRA <thiago@lar.ifce.edu.br>

Kubernetes in Action SECOND EDITION DEPLOYING AND MANAGING CONTAINERS AND CLOUD-NATIVE APPLICATIONS MARKO LUKŠA KEVIN CONNERMANN I NG SHELTER ISLAND Licensed to THIAGO BANDEIRA <thiago@lar.ifce.edu.br>

For online information and ordering of this and other Manning books, please visit www.manning.com. The publisher offers discounts on this book when ordered in quantity. For more information, please contact Special Sales Department Manning Publications Co. 20 Baldwin Road PO Box 761 Shelter Island, NY 11964 Email: orders@manning.com ©2026 by Manning Publications Co. All rights reserved. No part of this publication may be reproduced, stored in a retrieval system, or transmitted, in any form or by means electronic, mechanical, photocopying, or otherwise, without prior written permission of the publisher. Many of the designations used by manufacturers and sellers to distinguish their products are claimed as trademarks. Where those designations appear in the book, and Manning Publications was aware of a trademark claim, the designations have been printed in initial caps or all caps. Recognizing the importance of preserving what has been written, it is Manning’s policy to have the books we publish printed on acid-free paper, and we exert our best efforts to that end. Recognizing also our responsibility to conserve the resources of our planet, Manning books are printed on paper that is at least 15 percent recycled and processed without the use of elemental chlorine. The authors and publisher have made every effort to ensure that the information in this book was correct at press time. The authors and publisher do not assume and hereby disclaim any liability to any party for any loss, damage, or disruption caused by errors or omissions, whether such errors or omissions result from negligence, accident, or any other cause, or from any usage of the information herein. Manning Publications Co. Development editor: Elesha Hyde 20 Baldwin Road Technical development editor: Raphael Villela PO Box 761 Review editor: Radmila Ercegovac Shelter Island, NY 11964 Production editor: Aleksandar Dragosavljević Copy editor: Lana Todorovic-Arndt Proofreader: Keri Hales Technical proofreaders: Mayur Patil, Werner Dijkerman Typesetter: Dennis Dalinnik Cover designer: Marija TudorISBN: 9781617297618 Printed in the United States of America Licensed to THIAGO BANDEIRA <thiago@lar.ifce.edu.br>

To our familiesLicensed to THIAGO BANDEIRA <thiago@lar.ifce.edu.br>

Licensed to THIAGO BANDEIRA <thiago@lar.ifce.edu.br>

brief contents PART 1 GETTING STARTED ........................................................1 1 ■ Introducing Kubernetes 3 2 ■ Understanding containers and containerized applications 25 3 ■ Deploying your first application on Kubernetes 57 4 ■ Navigating the Kubernetes API and object model 89 PART 2 RUNNING APPLICATIONS IN KUBERNETES...................109 5 ■ Running applications with pods 111 6 ■ Managing the pod life cycle and container health 150 7 ■ Organizing pods and other resources using namespaces and labels 190 PART 3 APPLICATION CONFIGURATION AND STORAGE ............223 8 ■ Configuring applications with ConfigMaps and Secrets 225vii 9 ■ Adding volumes for storage, configuration, and metadata 256 10 ■ Persisting data with PersistentVolumes 300 Licensed to THIAGO BANDEIRA <thiago@lar.ifce.edu.br>

BRIEF CONTENTSviii PART 4 CONNECTING AND EXPOSING APPLICATIONS...............341 11 ■ Exposing pods with services 343 12 ■ Using Ingress to route traffic to services 392 13 ■ Routing traffic using the Gateway API 421 PART 5 MANAGING APPLICATIONS AT SCALE ...........................463 14 ■ Scaling and maintaining pods with ReplicaSets 465 15 ■ Automating application updates with Deployments 486 16 ■ Handling stateful applications with StatefulSets 521 17 ■ Deploying per-node workloads with DaemonSets 564 18 ■ Batch processing with Jobs and CronJobs 596Licensed to THIAGO BANDEIRA <thiago@lar.ifce.edu.br>

contents preface xix acknowledgments xx about this book xxii about the authors xxvi about the cover illustration xxviii PART 1 GETTING STARTED ..............................................1 1 Introducing Kubernetes 3 1.1 Introducing Kubernetes 4 Kubernetes in a nutshell 5 ■ About the Kubernetes project 7 Understanding why Kubernetes is so popular 9 1.2 Understanding Kubernetes 11 Understanding how Kubernetes transforms a computer cluster 11 The benefits of using Kubernetes 13 ■ The architecture of a Kubernetes cluster 15 ■ How Kubernetes runs an application 18 1.3 Introducing Kubernetes into your organization 20 Running Kubernetes on-premises and in the cloud 20 To manage or not to manage Kubernetes yourself 21ix Using vanilla or extended Kubernetes 22 ■ Should you even use Kubernetes? 23 Licensed to THIAGO BANDEIRA <thiago@lar.ifce.edu.br>

CONTENTSx 2 Understanding containers and containerized applications 25 2.1 Introducing containers 25 Comparing containers to VMs 26 ■ Introducing the Docker container platform 29 ■ Installing Docker and running a “Hello, World!” container 33 ■ Introducing the Open Container Initiative and Docker alternatives 36 2.2 Deploying the Kubernetes in Action Demo Application 37 Introducing the Kiada Application 37 ■ Building the application 40 ■ Running the container 44 ■ Distributing the container image 45 ■ Stopping, resuming, and deleting the container 46 2.3 Understanding containers 47 Customizing the process environment with Kernel Namespaces 47 Exploring the environment of a running container 50 Limiting the resources available to a process using cgroups 53 Strengthening isolation between containers 54 3 Deploying your first application on Kubernetes 57 3.1 Deploying a Kubernetes cluster 57 Using the built-in Kubernetes cluster in Docker Desktop 58 Running a local cluster using Minikube 61 ■ Running a local cluster using kind (Kubernetes in Docker) 63 ■ Creating a managed cluster with Google Kubernetes Engine 65 ■ Creating a cluster using Amazon Elastic Kubernetes Service 68 ■ Deploying a multi-node cluster from scratch 68 3.2 Interacting with Kubernetes 68 Setting up kubectl, the Kubernetes command-line client 69 Configuring kubectl to use a specific Kubernetes cluster 70 Using kubectl 71 ■ Interacting with Kubernetes through web dashboards 72 3.3 Running your first application on Kubernetes 74 Deploying your application 74 ■ Exposing your application to the world 78 ■ Horizontally scaling the application 82 Understanding the deployed application 85 4 Navigating the Kubernetes API and object model 89 4.1 Getting familiar with the Kubernetes API 90Introducing the API 90 ■ Understanding the structure of an object manifest 92 Licensed to THIAGO BANDEIRA <thiago@lar.ifce.edu.br>

CONTENTS xi 4.2 Examining an object’s individual properties 95 Exploring the full manifest of a Node object 96 ■ Understanding individual object fields 98 ■ Understanding an object’s status conditions 100 ■ Inspecting objects using the kubectl describe command 102 4.3 Observing cluster events via Event objects 104 Introducing the Event object 104 ■ Examining the YAML of the Event object 107 PART 2 RUNNING APPLICATIONS IN KUBERNETES.........109 5 Running applications with pods 111 5.1 Understanding pods 112 Understanding the purpose of pods 112 ■ Organizing containers into pods 114 5.2 Creating pods from YAML or JSON files 118 Creating a YAML manifest for a pod 118 ■ Creating the Pod object from the YAML file 119 ■ Checking the newly created pod 120 5.3 Interacting with the application and the pod 121 Sending requests to the application in the pod 121 ■ Viewing application logs 125 ■ Attaching to a running container 127 Executing commands in running containers 130 ■ Copying files to and from containers 131 ■ Debugging pods using ephemeral containers 132 5.4 Running multiple containers in a pod 134 Extending the Kiada Node.js application using the Envoy proxy 134 ■ Adding Envoy proxy to the pod 135 ■ Interacting with the two-container pod 136 5.5 Running additional containers at pod startup 138 Introducing init containers 138 ■ Adding init containers to a pod 139 ■ Inspecting init containers 142 ■ Kubernetes native sidecar containers 142 5.6 Deleting pods and other objects 145 Deleting a pod by name 145 ■ Deleting objects defined in manifest files 146 ■ Deleting all pods 147 ■ Deleting objects using the “all” keyword 148 Licensed to THIAGO BANDEIRA <thiago@lar.ifce.edu.br>

CONTENTSxii 6 Managing the pod life cycle and container health 150 6.1 Understanding the pod’s status 150 Understanding the pod phase 151 ■ Understanding pod conditions 152 ■ Understanding the container status 154 6.2 Keeping containers healthy 156 Understanding container auto-restart 156 ■ Checking the container’s health using liveness probes 160 ■ Creating an HTTP GET liveness probe 161 ■ Observing the liveness probe in action 163 ■ Using the exec and the tcpSocket liveness probe types 165 ■ Using a startup probe when an application is slow to start 167 ■ Creating effective liveness probe handlers 168 6.3 Executing actions at container start-up and shutdown 170 Using post-start hooks to perform actions when the container starts 171 ■ Using pre-stop hooks to run a process just before the container terminates 177 6.4 Understanding the pod life cycle 179 Understanding the initialization stage 180 ■ Understanding the run stage 182 ■ Understanding the termination stage 184 Visualizing the full life cycle of the pod’s containers 187 7 Organizing pods and other resources using namespaces and labels 190 7.1 Organizing objects into namespaces 191 Listing namespaces and the objects they contain 192 ■ Creating namespaces 194 ■ Managing objects in other namespaces 195 Understanding the (lack of) isolation between namespaces 197 Deleting namespaces 198 7.2 Organizing pods with labels 200 Introducing labels 201 ■ Adding labels to pods 202 ■ Label syntax rules 207 ■ Using standard label keys 208 7.3 Filtering objects with label selectors 210 Using label selectors for object management with kubectl 211 Using label selectors in object manifests 214 7.4 Filtering objects with field selectors 217 Using a field selector in kubectl 217 ■ Using field selectors in object manifests 218 Licensed to THIAGO BANDEIRA <thiago@lar.ifce.edu.br>

CONTENTS xiii 7.5 Annotating objects 219 Introducing object annotations 219 ■ Adding annotations to objects 220 ■ Inspecting an object’s annotations 221 Updating and removing annotations 222 PART 3 APPLICATION CONFIGURATION AND STORAGE..................................................223 8 Configuring applications with ConfigMaps and Secrets 225 8.1 Setting the command, arguments, and environment variables 226 Setting the command and arguments 226 ■ Setting environment variables in a container 229 8.2 Using a ConfigMap to decouple configuration from the pod manifest 233 Introducing ConfigMaps 233 ■ Creating a ConfigMap object 234 ■ Injecting ConfigMap values into environment variables 238 ■ Updating and deleting ConfigMaps 240 8.3 Using Secrets to pass sensitive data to containers 242 Introducing Secrets 243 ■ Creating a Secret 245 ■ Using Secrets in containers 248 ■ Understanding why Secrets aren’t always secure 249 8.4 Exposing metadata to containers via the Downward API 250 Introducing the Downward API 250 ■ Injecting pod metadata into environment variables 252 9 Adding volumes for storage, configuration, and metadata 256 9.1 Introducing volumes 257 Understanding when to use a volume 257 ■ Understanding how volumes fit into pods 261 9.2 Using an emptyDir volume 267 Persisting files across container restarts 267 ■ Initializing an emptyDir volume 272 ■ Sharing files between containers 2769.3 Mounting a container image as a volume 278 Introducing the image volume type 279 Licensed to THIAGO BANDEIRA <thiago@lar.ifce.edu.br>

CONTENTSxiv 9.4 Accessing files on the worker node’s filesystem 281 Introducing the hostPath volume 281 ■ Using a hostPath volume 282 9.5 ConfigMap, Secret, Downward API, and projected volumes 284 Using a configMap volume to expose ConfigMap entries as files 284 ■ How configMap volumes work 287 ■ Using Secret volumes 289 ■ Setting file permissions and ownership in a secret/ configMap volume 291 ■ Using a downwardAPI volume to expose Pod metadata as files 293 ■ Using projected volumes to combine volumes into one 294 9.6 Other volume types at a glance 298 10 Persisting data with PersistentVolumes 300 10.1 Introducing persistent storage in Kubernetes 301 Introducing PersistentVolumeClaims and PersistentVolumes 301 Dynamic vs. static provisioning of PersistentVolumes 304 10.2 Dynamically provisioning a PersistentVolume 307 Creating a PersistentVolumeClaim 307 ■ Using PersistentVolumeClaims 311 ■ Deleting a PersistentVolumeClaim and PersistentVolume 313 ■ Understanding access modes 315 Understanding StorageClasses 319 ■ About CSI drivers 322 10.3 Statically provisioning a PersistentVolume 324 Creating a node-local PersistentVolume 324 ■ Claiming a pre- provisioned PersistentVolume 326 ■ Releasing and recycling a manually provisioned PersistentVolume 328 10.4 Managing PersistentVolumes 331 Resizing PersistentVolumeClaims 331 ■ Creating a snapshot of a PersistentVolumeClaim 333 ■ Restoring a PersistentVolume from a snapshot 335 10.5 Creating ephemeral PersistentVolumes for individual pods 336 Introducing the ephemeral volume type 336 ■ Understanding the benefits of using an ephemeral volume 338Licensed to THIAGO BANDEIRA <thiago@lar.ifce.edu.br>

CONTENTS xv PART 4 CONNECTING AND EXPOSING APPLICATIONS.....341 11 Exposing pods with services 343 11.1 Exposing pods via services 345 Introducing services 346 ■ Creating and updating services 347 Accessing cluster-internal services 351 11.2 Exposing services externally 357 Exposing pods through a NodePort service 358 ■ Exposing a service through an external load balancer 362 ■ Configuring the external traffic policy for a service 365 11.3 Managing service endpoints 366 Introducing the Endpoints object 367 ■ Introducing the EndpointSlice object 368 ■ Managing service endpoints manually 370 11.4 Understanding DNS records for Service objects 372 Inspecting a service’s A and SRV records in DNS 372 ■ Using headless services to connect to pods directly 374 ■ Creating a CNAME alias for an existing service 377 11.5 Configuring services to route traffic to nearby endpoints 378 Forwarding traffic only within the same node with internalTrafficPolicy 378 ■ Topology-aware hints 380 11.6 Managing the inclusion of a pod in service endpoints 382 Introducing readiness probes 382 ■ Adding a readiness probe to a pod 384 ■ Implementing real-world readiness probes 387 12 Using Ingress to route traffic to services 392 12.1 Introducing Ingresses 393 Introducing the Ingress object kind 393 ■ Introducing the Ingress controller and the reverse proxy 394 ■ Installing an ingress controller 396 12.2 Creating and using Ingress objects 397 Exposing a service through an Ingress 398 ■ Path-based ingress traffic routing 402 ■ Using multiple rules in an Ingress object 405 ■ Setting the default backend 40712.3 Configuring TLS for an Ingress 409 Configuring the Ingress for TLS passthrough 410 ■ Terminating TLS at the Ingress 410 Licensed to THIAGO BANDEIRA <thiago@lar.ifce.edu.br>

CONTENTSxvi 12.4 Additional Ingress configuration options 412 Configuring the Ingress using annotations 413 ■ Configuring the Ingress using additional API objects 414 12.5 Using multiple ingress controllers 415 Introducing the IngressClass object kind 416 ■ Specifying the IngressClass in the Ingress object 417 ■ Adding parameters to an IngressClass 417 12.6 Using custom resources instead of services as backends 419 Using a custom object to configure Ingress routing 419 13 Routing traffic using the Gateway API 421 13.1 Introducing the Gateway API 422 Comparing Gateway API to Ingress 422 ■ Understanding the Gateway API implementation 424 ■ Deploying Istio as the Gateway API provider 426 13.2 Deploying a Gateway 428 Understanding Gateway classes 428 ■ Creating a Gateway object 429 ■ Exploring the Gateway’s status 431 13.3 Exposing HTTP services using HTTPRoute 434 Creating a simple HTTPRoute 434 ■ Splitting traffic between multiple backends 438 ■ Routing HTTP requests to different backends 439 ■ Augmenting HTTP traffic with filters 443 13.4 Configuring a gateway for TLS 448 Terminating TLS sessions at the gateway 448 ■ End-to-end encryption using TLSRoutes and pass-through TLS 450 13.5 Exposing other types of services 452 Exposing a TCP service with a TCPRoute 452 ■ UDPRoute 454 GRPCRoute 455 13.6 Using Gateway API resources across namespaces 457 Sharing a gateway across namespaces 457 ■ Routing to a service in a different namespace 459 13.7 From ingress gateways to service mesh 461Licensed to THIAGO BANDEIRA <thiago@lar.ifce.edu.br>

CONTENTS xvii PART 5 MANAGING APPLICATIONS AT SCALE.................463 14 Scaling and maintaining pods with ReplicaSets 465 14.1 Introducing ReplicaSets 466 Creating a ReplicaSet 467 ■ Inspecting a ReplicaSet and its pods 469 ■ Understanding pod ownership 471 14.2 Updating a ReplicaSet 472 Scaling a ReplicaSet 473 ■ Updating the Pod template 475 14.3 Understanding the operation of the ReplicaSet controller 477 Introducing the reconciliation control loop 478 ■ Understanding how the ReplicaSet controller reacts to pod changes 479 Removing a pod from the ReplicaSet’s control 483 14.4 Deleting a ReplicaSet 484 Deleting a ReplicaSet and all associated pods 484 ■ Deleting a ReplicaSet while preserving the pods 484 15 Automating application updates with Deployments 486 15.1 Introducing Deployments 487 Creating a Deployment 487 ■ Scaling a Deployment 493 Deleting a Deployment 496 15.2 Updating a Deployment 497 The Recreate strategy 498 ■ The RollingUpdate strategy 502 Configuring how many pods are replaced at a time 506 ■ Pausing the rollout process 509 ■ Updating to a faulty version 510 Rolling back a Deployment 513 15.3 Implementing other deployment strategies 516 The Canary deployment strategy 517 ■ The A/B strategy 518 The Blue/Green strategy 518 ■ Traffic shadowing 518 16 Handling stateful applications with StatefulSets 521 16.1 Introducing StatefulSets 522 Understanding stateful workload requirements 522 ■ Comparing StatefulSets with Deployments 525 ■ Creating a StatefulSet 527 Inspecting the StatefulSet, Pods, and PersistentVolumeClaims 530 Understanding the role of the headless Service 53416.2 Understanding StatefulSet behavior 537 Understanding how a StatefulSet replaces missing pods 537 Understanding how a StatefulSet handles node failures 538 Licensed to THIAGO BANDEIRA <thiago@lar.ifce.edu.br>

CONTENTSxviii Scaling a StatefulSet 542 ■ ■ Changing the PersistentVolumeClaim retention policy 544 ■ Using the OrderedReady Pod management policy 546 16.3 Updating a StatefulSet 551 Using the RollingUpdate strategy 552 ■ RollingUpdate with partition 554 ■ OnDelete strategy 556 16.4 Managing stateful applications with Kubernetes Operators 557 Deploying the MongoDB community operator 559 ■ Deploying MongoDB via the operator 560 ■ Cleaning up 562 17 Deploying per-node workloads with DaemonSets 564 17.1 Introducing DaemonSets 565 Understanding the DaemonSet object 565 ■ Deploying pods with a DaemonSet 566 ■ Deploying to a subset of Nodes with a node selector 573 ■ Updating a DaemonSet 577 ■ Deleting the DaemonSet 581 17.2 Special features in pods running node agents and daemons 581 Giving containers access to the OS kernel 582 ■ Accessing the node’s filesystem 583 ■ Using the node’s network and other namespaces 584 ■ Marking daemon Pods as critical 585 17.3 Communicating with the local daemon Pod 586 Binding directly to a host port 587 ■ Using the node’s network stack 590 ■ Using a local Service 591 18 Batch processing with Jobs and CronJobs 596 18.1 Running tasks with the Job resource 597 Introducing the Job resource 598 ■ Running a task multiple times 605 ■ Understanding how Job failures are handled 608 Parameterizing pods in a Job 613 ■ Running Jobs with a work queue 621 ■ Communication between Job’s Pods 627 ■ Sidecar containers in Job pods 630 18.2 Scheduling Jobs with CronJobs 632 Creating a CronJob 632 ■ Configuring the schedule 636 Suspending and resuming a CronJob 638 ■ Automatically removing finished Jobs 639 ■ Setting a start deadline 639 Handling Job concurrency 640 ■ Deleting a CronJob and its Jobs 641 index 643 Licensed to THIAGO BANDEIRA <thiago@lar.ifce.edu.br>