Kubernetes Notes

•  When we create secrets, we will encode data values in base64, kubelet in the nodes is reponsible to decode the base64 encoded data when it is consumed by containers within a pod
• If we add new pod with same labels, why replica controller don't recognize it and delete other pod. Because replica controller adds ownerrefrences section in metadata of every pod it creates and adds it name(i.e repliacontroller name) under it.Instead of completely relying on labels it also checks this section
• (VV Imp) kubectl run was earlier used to create deployments as well. However, with Kubernetes 1.18, kubectl run was updated to only create pods and it lost its deployment-specific options as well. If you are looking to create a deployment, you should instead use the kubectl create deployment command.
• When we create ClusterIp type service, we know that it can be used to talk within cluster but not outside.For testing this exec into the pods and try acessing clusterIp serviceip:port, coolthing is we can also access the service using clusterIp servicename:port 
• Similarly how we have done port forwarding for pods, we can also do port forwarding for clusterIP service(Since with all other services we can access pods from outside cluster no need of port forwarding)
• When we use portforwarding service will not loadbalance requests to underlying pods.It just selects one pod and sends traffic to that pod only
  
  

Ingress:

• The deployment(& its service) and the Ingress resource should be namespace else Ingress will not route traffic if actual deployment is in one namespace and its services are in other namespace
• Earlier in aws when ingress rule is created only network level loadbalancer was used because there is no support for path based routing. When ingress supported path based routing then aws launced application load balancer instead of network level load balancer
• If by mistake if you create 2 ingress resources using same host name by default only first created one will work i.e load balancer sends traffic to Ingress rule created first(Need to test).For any reason if first ingress resource was deleted than traffic will be routed to other(Any how we don't recommend to use it)
• VVVIMP Staring from k8 1.19, For every ingress resource you create you need to specify ingressClassName Field because there may be mutltipe ingress controllers in clusters.
  An alternative solution is to add a below annotation to IngressClass  ingressclass.kubernetes.io/is-default-class: "true"(if you have only one ingress controller), It is like jsut specifying default ingress class
  More info: official docs
  The trouble shooting for the same can be dne by inspecting ingress controller logs

Authentication and authorization in kubernetes:

Auhentication:

• There are lot of ways using which authentication to the api server can be done like x509 certificates(widely used),static token file,openID connect,LDAP etc.
• After authentication we need to include authorization mechanism using RBAC(most popular) other were Node,ABAC,webhook etc
• The traditional way i.e how we connect to the cluster using kubeconfig file(via kubectl) used x509 cerificates.The process looks like below:

1. Create a privatekey and CSR(certiicate signing request)
2. Self sign the CSR to get valid cerificate using api server ca.csr and ca.key(Certificate authority).This is possible only when you have ssh access to the control plane.
3. Specify the self signed certicate in kubeconfig file and create a context
4. Let's say you use managed service and you don't have access to the control plane then you can create a CSR kubernetes resource in k8 and approve it using kubectl.(Handson is available here)

All authetication methods summary: video

Ingress:

• Annotations are really important. We can use same Load balncer for different ingress resources created in different namespaces using below annotation, more info here
  

  alb.ingress.kubernetes.io/group.name: my-group

• We don't need to specify tls secret section in ingress yaml file to handle ssl traffic. Create a arn certificate and specify that under below annotation:

          alb.ingress.kubernetes.io/certificate-arn

• using above way, only https resources are accessible.If you want to redirect http traffic to https.you need to specify below annotation with above annotation.Both needs to be specified.
   alb.ingress.kubernetes.io/listen-ports: '[{"HTTPS":443}, {"HTTP":80}]

           alb.ingress.kubernetes.io/certificate-arn: <certificate arn>