KubeWeekly #159

# はじめに
KubeWeeklyは毎週Kubernetesに関する興味深いニュースを提供しています。（http://bit.ly/kubeweekly ）この記事は 2019/01/16に発行された Kube Weekly #159 ( https://mailchi.mp/cncf/kubeweekly-159 ) を読んで、感じたことをメモ的にまとめたものです。
私の勘違いや説明不足による誤解もあるかと思いますので、この記事読んで「おっ」と思ったらURLを辿って本文を確認してください。


## 9 Kubernetes Security Best Practices Everyone Must Follow - Cloud Native Computing Foundation
<table>
<tr>
  <td colspan="2"><a href="https://www.cncf.io/blog/2019/01/14/9-kubernetes-security-best-practices-everyone-must-follow/">9 Kubernetes Security Best Practices Everyone Must Follow - Cloud Native Computing Foundation</a></td>
</tr>
<tr>
  <td><img src="https://www.cncf.io/wp-content/uploads/2019/01/Screen-Shot-2019-01-11-at-11.34.51-AM.png"></td>
  <td>By Connor Gilbert, product manager at StackRox  Last month, the Kubernetes ecosystem was shaken by the discovery of the first major security flaw in Kubernetes, the world’s most popular container orchestrator....</td>
</tr>
</table>

みんなが従うべき、Kubernetesの9つのセキュリティベストプラクティス

- 最新バージョンを使う
- RBACを有効にする
- Namespaceを使う
  - NetworkPolicyなどで通信を分離しやすいため
- 大事なPodは独立したNodeにスケジュールさせる
  - 読み書き可能なSecretはNode単位で制限されるため
- クラスタメタデータへのアクセスをセキュアにする
- NetworkPolicyを使う
- PodSecurityPolicyを設定する
- Nodeのセキュリティを強化する
  - kubeletの使うポートは不必要インアクセスできないようにしておく
  - 管理者権限でNodeにログインできる人を最小限にする
- AuditLoggingを有効にする

## Container Storage Interface (CSI) for Kubernetes GA
<table>
<tr>
  <td colspan="2"><a href="https://kubernetes.io/blog/2019/01/15/container-storage-interface-ga/">Container Storage Interface (CSI) for Kubernetes GA</a></td>
</tr>
<tr>
  <td><img src="https://kubernetes.io//images/blog-logging/2018-04-10-container-storage-interface-beta/csi-kubernetes.png"></td>
  <td>Author: Saad Ali, Senior Software Engineer, Google
The Kubernetes implementation of the Container Storage Interface (CSI) has been promoted to GA in the Kubernetes v1.13 release. Support for CSI was introduced as alpha in Kubernetes v1.9 release, and promoted to beta in the Kubernetes v1.10 release.
The GA milestone indicates that Kubernetes users may depend on the feature and its API without fear of backwards incompatible changes in future causing regressions.</td>
</tr>
</table>

CSIがKubernetes v1.13でGAになりました。
CSIがなぜ必要となったのか？新機能の紹介。CSIの使い方など。
またCSI Driverを作るときに便利なサイドカーコンテナを紹介している。

## Proposing an enhancement to Kubernetes: The story of a KEP
<table>
<tr>
  <td colspan="2"><a href="https://medium.com/uswitch-labs/proposing-an-enhancement-to-kubernetes-the-story-of-a-kep-f652656d0628">Proposing an enhancement to Kubernetes: The story of a KEP</a></td>
</tr>
<tr>
  <td><img src="https://cdn-images-1.medium.com/max/1200/0*alVQG8f8F1UBDK8M"></td>
  <td>Kubernetes is a big project — it has a wide range of users and a large number of people working on it at any given time. For simple…</td>
</tr>
</table>

Kubernetes Enhancement Proposals (KEPs) の話。大きな機能をKubernetesに導入する際に事前に作成するドキュメント。
この筆者は今まさにKEPを出している所のようで、ここまでで苦労した話などを載せている。

# The Technical

## APIServer dry-run and kubectl diff
<table>
<tr>
  <td colspan="2"><a href="https://kubernetes.io/blog/2019/01/14/apiserver-dry-run-and-kubectl-diff/">APIServer dry-run and kubectl diff</a></td>
</tr>
<tr>
  
  <td>Author: Antoine Pelisse (Google Cloud, @apelisse)
Declarative configuration management, also known as configuration-as-code, is one of the key strengths of Kubernetes. It allows users to commit the desired state of the cluster, and to keep track of the different versions, improve auditing and automation through CI/CD pipelines. The Apply working-group is working on fixing some of the gaps, and is happy to announce that Kubernetes 1.13 promoted server-side dry-run and kubectl diff to beta.</td>
</tr>
</table>


`kubectl diff`について
`kubectl apply --dry-run`では不十分だが、サーバとの完璧なdiffを取るにはいろいろ考慮すべき点がある。
1.12でこの機能はベータサポートされている。

## [How to Create a Kubernetes Custom Controller using client-go](https://itnext.io/how-to-create-a-kubernetes-custom-controller-using-client-go-f36a7a7536cc)

client-goを使ったコントローラの設計とサンプル。

## Scaling Jupyter notebooks with Kubernetes and Tensorflow
<table>
<tr>
  <td colspan="2"><a href="https://learnk8s.io/blog/scaling-machine-learning-with-kubeflow-tensorflow">Scaling Jupyter notebooks with Kubernetes and Tensorflow</a></td>
</tr>
<tr>
  <td><img src="https://learnk8s.io/blog/scaling-machine-learning-with-kubeflow-tensorflow/kubeflow.png"></td>
  <td>One of the most common hurdles with developing AI and deep learning models is to design data pipelines that can operate at scale and in real-time. Data scientists and engineers are often expected to learn, develop and maintain the infrastructure for their experiments, but the process takes time away from focussing on training and developing the models. But what if you could outsource all of the non-data science to someone else while still retaining control? In this article, you will explore how you can leverage Kubernetes, Tensorflow and Kubeflow to scale your models without having to worry about scaling the infrastructure.</td>
</tr>
</table>

Kubeflowの紹介

## Intro to Jenkins X CI/CD for Kubernetes | Log Analysis | Log Monitoring by Loggly
<table>
<tr>
  <td colspan="2"><a href="https://www.loggly.com/blog/intro-to-jenkins-x-ci-cd-for-kubernetes/">Intro to Jenkins X CI/CD for Kubernetes | Log Analysis | Log Monitoring by Loggly</a></td>
</tr>
<tr>
  <td><img src="https://www.loggly.com/wp-content/uploads/2019/01/1500x700-Jenkins-X-for-Kubernetes-V2.png"></td>
  <td>In this article, we’ll introduce you to JX, show you how to use it, and how to monitor your builds and production deployments.</td>
</tr>
</table>

JenkinsXの紹介と使い方。
JenkinsXのCLIであるjxはKubernetesクラスタの作成から、雛形の作成、Webhookの自動設定などを行ってくれる。
KubernetesやJenkinsに詳しくなくとも開発を始めることができる。

## Conquering Statefulness on Kubernetes – Capital One Tech – Medium
<table>
<tr>
  <td colspan="2"><a href="https://medium.com/capital-one-tech/conquering-statefulness-on-kubernetes-26336d5f4f17">Conquering Statefulness on Kubernetes – Capital One Tech – Medium</a></td>
</tr>
<tr>
  <td><img src="https://cdn-images-1.medium.com/max/1200/1*kDgL200kGfaFam7D2tXJeg.png"></td>
  <td>Containerization has revolutionized the way we think of application development as a whole. There are many benefits: consistent…</td>
</tr>
</table>

KubernetesでStatefulを扱うための方法 PersistentVolumeやStatefulSetの紹介

## Running Istio on Kubernetes in production. Part I. – AvitoTech – Medium
<table>
<tr>
  <td colspan="2"><a href="https://medium.com/avitotech/running-istio-on-kubernetes-in-production-part-i-a8bbf7fec18e">Running Istio on Kubernetes in production. Part I. – AvitoTech – Medium</a></td>
</tr>
<tr>
  <td><img src="https://cdn-images-1.medium.com/max/1200/0*IhIlIXzcePIf7KG_.png"></td>
  <td>What is Istio? Istio is a service mesh technology adding an abstraction layer to the network. It intercepts all or part of the traffic in…</td>
</tr>
</table>

Istio の各コンポーネントの動作概要の説明

## Kubernetes authentication via GitHub OAuth and Dex – Preply Engineering Blog – Medium
<table>
<tr>
  <td colspan="2"><a href="https://medium.com/preply-engineering/k8s-auth-a81f59d4dff6">Kubernetes authentication via GitHub OAuth and Dex – Preply Engineering Blog – Medium</a></td>
</tr>
<tr>
  <td><img src="https://cdn-images-1.medium.com/max/1200/1*OfO_kV-hMsUfokKTOfRHKQ.png"></td>
  <td>In this article I will share with you step-by-step guide for generating kubectl credentials using Dex, dex-k8s-authenticator and GitHub.</td>
</tr>
</table>

[mintel/dex-k8s-authenticator](https://github.com/mintel/dex-k8s-authenticator)
と[dexidp/dex](https://github.com/dexidp/dex)を使ってGitHubのアカウントでKubernetesにログインする方法を紹介。

## Lunatech  – Running the Spark-notebook on a Kubernetes google cloud cluster 
<table>
<tr>
  <td colspan="2"><a href="https://lunatech.com/blog/XDxThxAAACoAMoL9/running-the-spark-notebook-on-a-kubernetes-google-cloud-cluster">Lunatech  – Running the Spark-notebook on a Kubernetes google cloud cluster </a></td>
</tr>
</table>

GKE上にSparkをデプロイし、そのSparkクラスタに対してこれまたKubernetes上からREPLでアクセスしたり、spark-notebookでアクセスしたりする方法を紹介。

## [Istio Service Mesh + Apollo Server for GraphQL – ITNEXT](https://itnext.io/istio-service-mesh-apollo-server-for-graphql-7e7421fce5d0)

Kubernetes上にGraphQLのサーバをデプロイしistioのメトリクスで通信状況を可視化する方法を紹介。

# Tooling Spotlight

## aquasecurity/kube-hunter
<table>
<tr>
  <td colspan="2"><a href="https://github.com/aquasecurity/kube-hunter">aquasecurity/kube-hunter</a></td>
</tr>
<tr>
  <td><img src="https://avatars1.githubusercontent.com/u/12783832?s=400&v=4"></td>
  <td>Hunt for security weaknesses in Kubernetes clusters - aquasecurity/kube-hunter</td>
</tr>
</table>

Kubernetesクラスタのセキュリティスキャンを実施するソフトウェア。
ActiveHuntingモードだとクラスタを壊してくる。

# The Editorial


## Why Is Storage On Kubernetes So Hard?
<table>
<tr>
  <td colspan="2"><a href="https://softwareengineeringdaily.com/2019/01/11/why-is-storage-on-kubernetes-is-so-hard/">Why Is Storage On Kubernetes So Hard?</a></td>
</tr>
<tr>
  <td><img src="https://softwareengineeringdaily.com/wp-content/uploads/2019/01/Kubernetes_New.png"></td>
  <td>Container orchestration tools like Kubernetes are revolutionizing the way applications are being developed and deployed. With the rise of the microservices architecture and decoupling of infrastructure from application logic from the developer’s point of view, developers are becoming more focused on building software and delivering value. Kubernetes abstracts away the physical machines it is managing.</td>
</tr>
</table>

KubernetesのStateful周りの説明
CSIの説明や、Rook,Cephの紹介。

## Stateful Kubernetes with Saad Ali
<table>
<tr>
  <td colspan="2"><a href="https://softwareengineeringdaily.com/2019/01/07/stateful-kubernetes-with-saad-ali/">Stateful Kubernetes with Saad Ali</a></td>
</tr>
<tr>
  <td><img src="https://softwareengineeringdaily.com/wp-content/uploads/2019/01/StatefulKubernetes.png"></td>
  <td>In a cloud infrastructure environment, failures happen regularly. The servers can fail, the network can fail, and software bugs can crash your software unexpectedly. The amount of failures that can occur in cloud infrastructure is one reason why storage is often separated from application logic. A developer can launch multiple instances of their application, with</td>
</tr>
</table>

PodCast（聞いていない）
タイトルからするとGoogleでKubernetesを開発しているエンジニアによるStaetfulの機能紹介？

## Kubernetes security: 4 tips to manage risks
<table>
<tr>
  <td colspan="2"><a href="https://enterprisersproject.com/article/2019/1/kubernetes-security-4-tips-manage-risks">Kubernetes security: 4 tips to manage risks</a></td>
</tr>
<tr>
  <td><img src="https://enterprisersproject.com/sites/default/files/images/CIO%20Security.jpg"></td>
  <td>As you bear down on Kubernetes security, use these strategies to avoid missteps in work with containers and orchestration</td>
</tr>
</table>

Kuberntesのセキュリティに関する4つのTips

- 導入の早い段階からセキュリティを意識すること
- Kubernetesコミュニティに積極的に参加すること
- 商用のKuberneteesプラットフォームを検討する
- 古いツールや習慣をあてにしない

## Managing Secrets in Kubernetes
<table>
<tr>
  <td colspan="2"><a href="https://www.weave.works/blog/managing-secrets-in-kubernetes">Managing Secrets in Kubernetes</a></td>
</tr>
<tr>
  <td><img src="https://www.weave.works/assets/images/blt31dff19eeb5e462d/flux-secrets.png"></td>
  <td>In this post, we continue our discussion on how to separate code from configuration in Kubernetes and examine how to manage secrets in Kubernetes.</td>
</tr>
</table>

KubernetesでSecretをどう扱うか？

- クラウドプロバイダが提供するものを使う
- オープンソースの仕組みを使う（Vault, Sealed Secrets)
- 有償製品を使う

特にオープンソースの仕組みの部分について詳しく述べられている。


## On Infrastructure at Scale: A Cascading Failure of Distributed Systems
<table>
<tr>
  <td colspan="2"><a href="https://medium.com/@daniel.p.woods/on-infrastructure-at-scale-a-cascading-failure-of-distributed-systems-7cff2a3cd2df">On Infrastructure at Scale: A Cascading Failure of Distributed Systems</a></td>
</tr>
<tr>
  <td><img src="https://cdn-images-1.medium.com/fit/c/100/100/0*psRC741FWxWQ16ei.jpg"></td>
  <td>At Target, we run a heterogeneous infrastructure in our datacenters (and many other places), where we have multiple different backend…</td>
</tr>
</table>

インフラの更新によるKafkaの障害から始まるKubernetesクラススタの障害についての記録。
Kafkaが詰まり、ロギングのサイドカーのCPU負荷が急増し、しかもそのクラスタには大量のPodがあったため、その影響が無視できないものとなった。
Dockerデーモンが動かなくなりNodeがUnhealthyと判定され、Podの再配置が動き始める。
サービスディスカバリのためにConsulも利用しており、Podの再配置により、これらの情報も更新が頻発するようになった。
Consulの更新が多すぎて、gossipでのコミュニケーションができなくなり、周辺システムがサービスディスカバリに失敗するようになった。

（ここで問題となったConsulの挙動については修正されているようです）

クラスタが大きいとこのようなそれぞれについては小さい負荷が、全体に波及することがあるようです。

## What I learned in my first 2 years as a Software Engineer
<table>
<tr>
  <td colspan="2"><a href="https://medium.com/@TJosefik/what-i-learned-in-my-first-2-years-as-a-software-engineer-eeff12b77ddd">What I learned in my first 2 years as a Software Engineer</a></td>
</tr>
<tr>
  <td><img src="https://cdn-images-1.medium.com/fit/c/100/100/0*Qzy1HidALSMhf9Rc.jpg"></td>
  <td>I survived it.</td>
</tr>
</table>

ソフトウェアエンジニアとしてのはじめの2年で私が学んだこと。
Kubernetesを学ぶことを勧めています。

## What's New in Kubernetes 1.13
<table>
<tr>
  <td colspan="2"><a href="https://www.youtube.com/watch?v=_TWoXHktvE0">What's New in Kubernetes 1.13</a></td>
</tr>
<tr>
  <td><img src="https://i.ytimg.com/vi/_TWoXHktvE0/hqdefault.jpg"></td>
  <td>This release continues to focus on stability and extensibility of Kubernetes with three major features graduating to general availability this cycle in the a...</td>
</tr>
</table>

Kubernetes 1.13の新機能紹介動画（見ていない）

## 5 open source tools to upgrade your next Kubernetes project - JAXenter
<table>
<tr>
  <td colspan="2"><a href="https://jaxenter.com/5-kubernetes-open-source-tools-154333.html">5 open source tools to upgrade your next Kubernetes project - JAXenter</a></td>
</tr>
<tr>
  <td><img src="https://jaxenter.com/wp-content/uploads/2019/01/shutterstock_150981002.jpg"></td>
  <td>Looking to really improve your next Kubernetes project? Here are five tools that are guaranteed to elevate your container orchestration management.</td>
</tr>
</table>

次のKubernetesプロジェクトのためのOpenSourceのツールを5つ紹介。

- [GitHub - kubernetes/minikube: Run Kubernetes locally](https://github.com/kubernetes/minikube)
- [Tilt](https://tilt.build/)
- [GitHub - rook/rook: Storage Orchestration for Kubernetes](https://github.com/rook/rook)
- [GitHub - rancher/rancher: Complete container management platform](https://github.com/rancher/rancher)
- [Serverless Functions for Kubernetes - Fission](http://fission.io/)


## 2019 Data Center Drivers: Kubernetes, Cloud, ML, File System Storage
<table>
<tr>
  <td colspan="2"><a href="https://www.enterprisetech.com/2019/01/10/2019-data-center-drivers-kubernetes-cloud-ml-file-system-storage/">2019 Data Center Drivers: Kubernetes, Cloud, ML, File System Storage</a></td>
</tr>
<tr>
  <td><img src="https://www.enterprisetech.com/wp-content/uploads/2019/01/generic-machine-learning-AI-deep-learning-data-shutterstock-583242211.jpg"></td>
  <td>If 2019 is anything like the previous year, there will be a renewed push for modernization in the data center to alleviate the management complexity,</td>
</tr>
</table>

2019年の業界予想。AIやストレージ、Opsの自動化などについて触れている。

## Day Two Kubernetes: Tools for Operability 
<table>
<tr>
  <td colspan="2"><a href="https://www.infoq.com/presentations/kubernetes-tools">Day Two Kubernetes: Tools for Operability </a></td>
</tr>
<tr>
  <td><img src="https://res.infoq.com/presentations/kubernetes-tools/en/headerimage/Bridget-Kromhout-h-1547176131479.jpg"></td>
  <td>Bridget Kromhout  discusses what containers and Kubernetes clusters are at a high level, looks into the practical application of open source tools to simplify cluster management, and shows how to deploy Kubernetes clusters in a repeatable and portable fashion.</td>
</tr>
</table>

動画（みていない）
コンテナ、Kubernetesの紹介からHelm, draft, brigadeなどMicrosoftのOSSを紹介しているようです。