►
Description
Don’t miss out! Join us at our next event: KubeCon + CloudNativeCon Europe 2022 in Valencia, Spain from May 17-20. Learn more at https://kubecon.io The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects.
How NOT to Start with Kubernetes - Christian Heckelmann, Dynatrace
To k8s or not? THAT should be the first question you answer before considering moving your workloads to k8s. Granted – in many cases - Kubernetes is going to be the right choice but don’t just default to k8s because its hip or cool. When starting with Kubernetes you will run into many challenging situations or must make important decisions that will impact the way you will benefit or not benefit from k8s, that will decide whether you have sleepless nights or whether you can enjoy your evenings and weekends with friends and family! I, Christian Heckelmann, would have loved to know a lot more about Kubernetes networking, resource limits, the importance of training people upfront, providing templates, security, the CNCF landscape and more. 2 years ago, I started my journey as DevOps engineer setting up k8s 1.9 on bare metal. In this talk I recap my lessons learned in the hope that everyone that starts with k8s doesn’t start off in the wrong direction.
A
Hello,
everybody
and
welcome
to
my
talk
my
session,
how
not
to
start
with
kubernetes
my
name
is
kristen
hegelmann
and
I
want
to
share
with
you
within
the
next
30
minutes
the
lessons
I've
learned
running,
kubernetes
on-prem
so
on
your
own
data
center
and
it
might
be
a
little
bit
boring
for
you
if
you're
already
running
kubernetes,
because
all
the
things
I
will
mention
are
basically
beginner
yeah
failures
right.
So
I've
splitted
this
presentation
in
two
parts,
operation
and
infrastructure,
as
well
as
development
and
deployment
stuff.
A
So
back
in
2018
I
was
working
for
another
company
which
was
yeah
highly
regulated
and
one
of
our
architects
reached
out
to
us
to
the
operations
team.
Where
I
was
a
system
engineer
and
said:
hey,
we
want
to
use
containers,
we
want
to
use
container
orchestration
and
if
we
can
help
him
yeah
running
a
small
poc
and
the
poc
was
kubernetes
against
not
against,
but
kubernetes
and
docker
swamp.
We
want
to
compare
both
of
them,
both
solutions
and,
as
I
mentioned,
we
need
to
run
on-prem.
A
A
But
when
you
are
building
a
platform
or
starting
using
a
platform
like
kubernetes
in
your
company,
then
you
should
onboard
all
other
departments
as
well
from
the
beginning,
get
involved
with
security,
get
involved
with
the
data
center,
guys
like
storage
and
networking,
guys
right
because,
as
mentioned
you're
building
a
little
data
center
within
the
data
center
and
the
platform
will
be
used
by
by
all
of
your
your
developers
all
of
your
operation,
guys.
So
do
it
in
a
little
bigger
scope
than
you
expect
and
yeah.
A
That's
the
key
takeaway
here
from
my
perspective
and
also
if
you
have
no
idea
or
no
experience
running
kubernetes,
then
perhaps
you
should
get
external
help.
There
are
companies
out
there.
They
will
take
your
money
and
and
say
what
you
should
do
here
right
so
but
let's
first
start
with
infrastructure
and
operation
topics.
A
So,
as
I
said,
our
small
poc
was
really
just
in
my
case
a
three
note:
kubernetes
cluster,
so
I
provisioned
three
vms.
I
started
installing
kubernetes
using
cube
adm
manually
with
sh
into
the
boxes
running
all
the
commands
right
and
it
was
working.
It
was
working
fine
for
the
first
couple
of
weeks,
but
then
I
upgraded
to
kubernetes
1.10.
This
was
also
still
possible
and
we
hadn't
had
any
storage
provision
or
ingress
controllers
on
this
little
poc
cluster
from
the
beginning.
So
it
was
just
plain
kubernetes
and
some
web
applications
deployed
into
it.
A
But
later
on,
when
I
wanted
to
upgrade
to
kubernetes
111
yeah,
my
upgrade
failed
and
the
cluster
was
in
a
non-recoverable
state
so
yeah
this
was
a
little
bit,
not
the
best
thing
right,
but
and
perhaps
I
could
fix
it
now
with
my
knowledge,
what
I
have,
but
back
in
the
days
the
cluster
was
just
that
right.
So
I
switched
to
rancher
and
not
installing
kubernetes
manually
anymore
and
rancher
is
quite
nice.
It
provides
a
nice
ui.
A
A
So
don't
skip
this
tab
document
everywhere,
so
people
are
able
to
deploy
clusters
even
without
your
help
right.
So
next
a
little
bit
more
into
details
with
networking
so
networks
in
iron
configuration.
There
are
plenty
of
network
scene
eyes
available.
These
are
only
listed
a
few
of
them
like
calico,
flannel,
weave,
canals,
psyllium
and
so
the
network
scene.
A
I
is
a
really
crucial
thing
you
need
to
to
think
about
before
you're,
starting
or
starting
using
kubernetes,
which
network
scene
I
should
you
use
and
as
well,
which
side
arrange,
for
instance,
for
your
port
and
service
network.
You
want
to
use.
So
in
my
case,
I
had
here
a
little
bit
of
an
issue
so
when
provisioning
clusters
with
rancho
rancher
will
have
the
default
subnet
range
for
port
and
service
network
1043
and
10
42.
A
A
I
was
able
to
mitigate
this
problem
by
adding
the
five
full
reverse
proxy
in
front
of
the
workload,
but
still
think
about
stuff,
like
that,
when
you're,
installing
your
network
scene
file
right.
Another
thing
I
stumbled
across
was
network
policies,
so
in
my
first
cluster
was
provisioning
was
basically
in
the
example.
Flannel
listed
it
as
a
scene.
I
provided
right
and
it
was
working
great.
It
was
working
fine
and
I
also
used
flannel
then
for
my
first
cluster,
I
provisioned
in
rancho,
but
flannel
is
not
able
to
to
utilize
network
policies
or
enforce
network
policies.
A
So
one
day
I
wanted
to
isolate
network
traffic
from
one
of
my
name
spaces
and
it
wasn't
yeah.
I
wasn't
able
to
do
this
and
also
ranger
wasn't
able
to
change
the
network
scene.
I,
after
the
cluster
creation.
You
can
do
this
yeah
with
with
other
provisioners
or
or
with
a
vanilla
cluster,
for
instance,
but
with
rancher.
We
were
stuck
with
flannel,
at
least
on
this
one
development
cluster.
A
Then
you
need
to
think
about.
Do
I
want
to
encrypt
data
and
transit
and
not
using
in
service
mesh,
for
instance,
then
you
can
run.
I
think
kalaiko
is
able
to
offer
this
and
weavenet
as
well
and
know
at
least
the
basics
like
like
dean
as
how
dean
s
is
being
done
in
kubernetes
right
and
how
to
resolve
service
names
within
kubernetes
that
you're
not
going.
A
That
was
the
next
question
after
my
first
poc
cluster,
so
how
we
could
reach
our
services
inside
of
the
cluster
and
yeah
I
I
was
also.
I
had
no
experience
right
so
so
I
was
reading
through
documentations
or
examples,
and
I
ended
up
with
deploying
a
metal
lb
inside
of
our
cluster
and
using
traffic
as
an
ingress
controller.
I
had
a
single
traffic
increase
controller
running
and
we
splitted
our
traffic
for
external
internal
using
allow
us,
but
this
is
error
prone.
A
So
perhaps
it
would
be
better
here
to
have
separate
ingress
controller
for
for
external
and
internal
workloads
and
also
in
our
case,
perhaps
it
would
be
a
better
idea
to
put
our
existing
f5
in
front
of
the
of
the
ingress
controller
instead
using
metallic
reusing,
the
stuff
you
already
own
right
or
you
already
have
in
your
your
environment,
and
then
you
have
to
think
about
security.
Do
I
want
to
add
network
web
application
firewall
in
front
on
the
load
balancer
level
in
aws
you
can
enable
and
valve
on
your
load
balancer.
A
You
can
use
on
ingress
level
like
in
engine
x.
You
can
use
smart
security,
for
instance,
right
so
think
about
security
in
advance,
as
well
as
how
do
we
want
to
manage
sl
certificates?
A
very
convenient
way
is
using
search
manager
with
let's
encrypt,
but
you
don't
want
to
end
up
with
yeah
deploying
certificates
manually
with
cuba
city
apply
and
taking
care
of
reviewing
your
certificates
after
two
years
right.
So
so
you
will
forget
it.
A
Give
me
trust
me,
you
will
forget
sometimes
to
renew
your
certificates
and
specific
namespace
or
whatever,
and
then
you
probably
will
have
a
short
outage
right.
So
the
next
thing
I
want
to
to
cover
here
so
developer,
reached
out
to
us
out
to
me
and
said:
hey.
We
need
to
store
some
files
in
our
cluster
and
our
workloads,
and
I
said
okay,
I
have
no
idea.
A
I
need
to
to
do
some
research
here.
What
what
I
need
to
do,
and
he
said
yeah
I
already
found
something
in
the
internet
and
yeah.
It
was
basically
in
a
manual
how
to
install
a
kt
with
cluster
and
fs
inside
of
your
cluster,
and
we
were
yeah
just
following
the
guides
following
the
instructions,
but
what
was
happening
after
that.
Every
time
I
was
upgrading
kubernetes,
the
version
and
the
cubelet
service
was
restarted
on
the
node.
A
I
switch
to
plain
old,
simple
nfs,
client
provision.
So
if
you
want
to
to
introduce
some
some
storage
back-end,
perhaps
you
should
also
ask
your
your
storage
guys
what
they
can
provision,
or
perhaps
they
have
already
some
solutions
for
you
right,
and
you
also
need
to
think
about
okay,
how
I'm
doing
backups
for
my
persistent
volumes,
if
you
want
to,
if
there
are
files
in
it,
you
really
need
right
so
backup.
What
kind
of
workload
do
you
expect
what
your
infrastructure
is
already
providing?
A
A
I
just
handed
over
to
the
developer
and
token
with
cluster
admin
rights
right
and
this
token
was
being
reused
by
a
lot
of
people,
and
it
shouldn't
be
here
the
case
right
so
so.
This
was
one
of
the
problems
that
we,
it
was
really
hard
after
to
get
rid
of
the
token
because
it
was
using,
it
was
in
cube,
config
files
within
the
pipelines
and
so
on,
so
don't
share
credentials
across
teams
have
separate
accounts
for
deployment
monitoring,
operation
tasks,
everybody
should
have
its
own
user
and
so
on.
A
A
You
write
to
standard
out,
then
our
fluency
process
will
grab
the
log
files
and
forward
it
to
splunk,
and
here
in
splunk
you
can
now
see
all
the
logs
of
your
pods
and
then
be
happy
with
that
right.
So
so
log
monitoring
is
also
really
crucial
and
there
are
plenty
of
open
source
solutions
out
there,
like
from
ethos
in
combination
with
grafana
elk
stack
for
for
logging
and
so
on.
So
take
your
time.
A
A
A
Yeah
deploy
cluster
policies
from
the
beginning,
so
that
no
workload
will
will
being
deployed
even
on
the
dev
clusters,
without
the
proper
validation.
Like
the
ingress
validation,
I
told
you
like
port
security,
for
instance,
these
low
privileged
containers
that
your
deployment
requires
some
resource
limits
and
requests
defined
right
that
there
are
health
checks
configured
within
yours
within
your
service,
so
start
with
policies
straight
away,
and
the
last
thing
I
want
to
mention
in
operations,
infrastructure
tasks
is
yeah.
It's
I
titled
the
slide,
cube,
control,
cube,
cuddle
or
cubesat.
A
However,
you
want
to
pronounce
it,
but
operators
and
developers
should
at
least
be
familiar
with
common
cube.
Ctl
commands
right,
like
get
port
logs,
describe
pot
and
so
on.
I've
seen
a
lot
of
people
were
struggling
when,
for
instance,
the
web
ui
from
from
rancho
was
not
away
and
they
were
not
able
to
troubleshoot
deployment
issues
right
and-
and
these
are
the
basics
you
should
yeah-
be
aware
of-
and
also
invest
again
in
trainings
here
to
to
yeah
that
the
people
are
familiar
with
the
tools.
A
So
next
will
be
already
development
and
employment
stuff
so
running
workload
in
cuban
eaters.
Because
of
the
wrong
motivation,
I've
seen
this
multiple
times
when,
when
you
ask
somebody
hey
why
you
yeah,
I
deployed
this
application
in
our
kubernetes
cluster,
then
yeah
you're
getting
answers
like
I
run
it
in
kubernetes,
because
I
don't
want
to
request
the
vm.
A
If
it
makes
sense,
there
should
be
the
architects
who
decide
what
kind
of
workload
to
put
in
which
environment
or
in
if
it
should
run
in
kubernetes
or
not
the
next
one
local
development.
A
lot
of
time.
I've
seen
something
so
I
getting
pink
like
kubernetes
is
down.
My
deployment
is
not
working
right
and
you
were
checking
the
deployment
and
you
had
a
lot
of
restarts
of
the
container.
A
Then
you
pulled
the
container
to
your
local
computer
and
and
just
run
the
docker
start
on
the
container,
and
you
see
the
container
wasn't
starting
at
all,
so
developers
should
be
familiar
or
when
they're
working
on
kubernetes
at
least
testing
their
containers
on
their
local
machine.
There
are
multiple
options
to
run
a
kubernetes
on
your
local
machine
like
kubernetes
and
docker
mini
cube
keys.
So
you
can
also
test
your
deployment.
A
I've
seen
a
lot
of
people
who
are
building
helm,
charts
and
then
having
a
git
commit
history,
hundreds
of
of
commits
just
to
test
their
home
deployment.
You
don't
need
to
run
every
time,
an
entire
cicd
pipeline
to
just
test
out
your
helm
chart.
This
could
be
done
locally
faster,
in
my
opinion,
so
get
familiar
with
local
development
tools
and
and
yeah
just
use
them.
A
If
it's
getting
rebuild
your
image
with,
let's,
let's
assume,
you're,
building
a
nodejs
application
you're
using
a
node
latest
right,
then
all
of
a
sudden
it
could
be
that
yeah
nodejs
is
releasing
new
new
version
and
your
application's
not
compatible
anymore
with
the
newest
nodejs
version,
and
then
it
will
build
with
news
base
image
and
will
break
basically
your
workload
right
so
try
to
avoid.
At
least
the
latest
takes
one
of
the
problems
I
had
with
the
katie.
A
A
This
was
also
one
of
the
bigger
problem
because
we
weren't
able
to
provision
any
persistent
volumes
anymore
right.
So
please
don't
use
latest,
but
talking
of
images,
private
registry
and
base
images.
I
think
it's
really
crucial
to
have
a
library
of
own
base
images
and
an
own
registry
in
your
environment,
private
registry,
where
you
have
full
control
over
the
images
where
you
can
scan
your
images
for
vulnerabilities,
so
so,
for
instance,
harbor
it's
an
open
source
registry.
You
can
use
it
and
then
just
scan
your
images
constantly.
A
You
can
add
additional
configuration
to
the
base
images
java
8
was
there,
for
instance,
one
one
example:
no
need
to
pull
everything
from
docker
hub
and
hit
the
rate
limit
right
and
then
don't
use
the
image
pull
policy
always
so
there.
There
are
some
use
cases.
Imageable
policy
always
is
usable
or
good,
but
normally
you
don't
want
to
pull
the
image
every
time
it's
getting
rescheduled
on
another
worker
node.
A
If
the
image
is
already
there,
because
it
will
be
much
more
faster
to
spin
up
your
application
right
if
it's
just
reusing
the
image
which
is
already
cached
on
the
machine
and
if
possible,
use
block
and
allow
lists
for
your
developers,
you
don't
want
to
have
something
like
this
in
the
sprinter
below
docker
pull
from
some
untrusted
sources,
perhaps
with
a
crypto
miner
in
it.
So
I've
seen
people
using
from
really
untrusted
sources
or
not
known
sources.
A
Images
like
alpine
curl
like
why
not
just
you're,
building
your
own
alpine
image
with
curl
included,
if
needed,
right
so
and
another
problem,
I've
seen
frequently
was
not
using
the
power
of
kubernetes
or,
like
this
quote,
says
by
auto
scaling.
I
have
two
ports
so
when
you
just
deploy
two
ports
or
or
one
part
of
your
of
your
application,
why
just
run
it
in
kubernetes
when
you
don't
use
yeah?
The
features
of
kubernetes
is
what
kubernetes
is
offering
you
here
like,
as
I
said,
auto
scaling,
very
cool
stuff
right,
so
use
just
the
features.
A
Kubernetes
is
offering
you
other
problem
in
in
development
life
cycle,
health
checks
so
make
sure
your
application
is
configured
with
a
proper
health
check.
Please
and
prevent
again.
You
can
use
caverno
or
open
policy
agent
to
prevent
applications
being
deployed
to
your
cluster
without
a
proper
health
check,
liveness
check,
readiness,
probe
or
whatever
right,
and
if
you
get
ever
getting
asked
hey,
please
restart
my
container
or
my
my
application
in
kubernetes.
Then
you
have
to
ask
the
developer
okay.
Why
we
need
to
restart
it
manually.
This
shouldn't
be
the
the
way
you
work
in
kubernetes.
A
A
So
what
you
can
do
against
something
like
that
again,
you
can
yeah
prevent
workloads
with
the
policies
or
you
can
add,
just
default
requests
and
and
limits
based
on
namespace
or
cluster,
and
a
question
I
was
getting
asked
quite
frequently
was
yeah,
but
I
don't
know
how
many
resources
my
application
is
using.
So
you
can
reference
here
again
back
to
the
local
development
section.
A
A
The
next
thing
I
want
to
talk
about
is
environment
variables
for
configuration
and
secrets.
You
can
totally
put
some
configuration
volumes
and
environment
variables,
but
I've
seen
also
deployments
with-
I
don't
know:
50
60
different
environment
variables
for
for
configuration,
so
use
configmaps
for
configuration
right
and
never
ever
put
secrets
and
plain
text
into
environment
variables
so
create
and
standard.
How
is
your
application
should
be
configured
right
and
use
a
secret
store?
A
For
instance,
you
can
use
vault
or
you
can
use
some
stuff,
like
sealed
secrets
from
bitnami,
which
makes
the
things
more
in
yeah,
more
secure
and
kubernetes
secrets
are
not
encrypted
in
in
your
cluster
right.
So
if
you
can
read
a
secret
with
your
service
account
or
your
user
account,
you
can
just
run
a
base
460
code
and
you
will
have
the
value
of
the
secret.
So
keep
that
in
mind
also,
when
creating
service
accounts
that
you
not
yeah,
allow
them
to
read
all
secrets.
A
So
and
one
of
the
yeah
last
slides
using
a
template
engine
or
helm.
So
so
what
I've
seen
in
our
environment
that
people
are
reusing
the
same
yaml
files
for
deployment
for
for
ingresses
and
for
service
annotations
for
services
over
and
over
again,
and
it
makes
something
yeah.
It
makes
really
hard
to
change
all
these
yeah
deployment
and
and
all
the
yaml
files
in
different
git
repositories.
A
If
you
want
to
introduce
something
like
a
new
annotation,
if
you
want
to
add
some
some
monitoring
annotations
to
your
application
and
so
on
so
provide
perhaps
an
helm
template
for
your
developers,
which
they
can
use
because
most
of
the
deployments
in
our
organization
were
most
likely
the
same
right
and
I
create
an
helm,
template
they
can
use
and
then
also
just
having
switches
inside
of
the
template
like
expose
my
service
externally,
yes
or
no,
do
you
want
to
have
persistent
volume?
Yes
or
no?
They
don't
need
to
think
about
storage
classes.
A
They
don't
need
to
think
about
ingress
configuration,
it's
just
a
matter
of
the
template
and
the
developer
could
then
easily
just
deploy
in
its
ci
sd
pipelines.
Application
by
using
a
helm,
upgrade
install
providing
the
image,
the
image
url
and
the
image
tag,
setting
some
more
parameters
and
they
were
good
to
go
and
they
can
deploy
the
application
to
capabilities.
A
So
this
was
for
us
or
for
me
a
huge
time
saver
so
and,
as
summary
of
my
talk
is
when
you're
starting
your
journey
in
kubernetes
in
your
near
company,
invest
in
trainings.
If
you
have
no
idea,
like,
I
had
back
in
the
days,
invest
in
trainings
document.
How
to
use
the
platform
documentation
is,
is,
is
here
also
the
key
to
not
run
into
the
same
issues
over
and
over
again
right
to
give
the
developers
and
the
operations
team
guidance
on
how
to
use
kubernetes
how
to
use
the
platform.
A
I
provide
templates
avoid
common
mistakes
like
the
forgotten
health
checks
and
so
on,
and
try
to
reject
everything
as
early
as
possible,
which
is
not
yeah
meet
the
required
standards
of
your
of
your
deployments
right
so
again,
stuff
like
using
the
policy
engines
and
involve
your
security
operations
from
the
beginning
and
involve
all
other
teams
from
the
beginning.
Right,
as
I
said,
you're
building
here,
a
really
huge
platform
which
is
being
used
by
all
of
the
people
in
your
organization
later
on.