Introduction¶

Welcome to the Cloud Native Applications on Kubernetes course. Before getting started, please make sure you have read the following information:

• Courses Homepage for information about the Course Info
• Lecture slides for more detailed Course Information.
• Lab materials
• Scoring (You can login with ut.ee username/password)
• ETAIS Self Service

For any questions, using the Slack channels is recommended, as it also makes answers visible to other people.

Practical labs¶

Lab sessions take place during their allotted times. A new topic is published after the week's lecture and that's the topic for the lab that week.

There is no hard deadline for labs except a week before the exam, but do consider the fact that the workload is quite large and cannot be done in a few days, especially as you are going to be facing issues and problems.

Practical sessions have been designed to be highly hands-on, but mostly independent - students get guides with thorough explanations about the task at hand, which they can freely do either at home or during the practical sessions. The practical sessions are there to help with any issues encountered.

Course environment¶

The labs are scored automatically by an automated system, which checks the students environment for specific task completions by probing endpoints in the environment for responses that should be there.

This scoring system is available from this link: Scoring. Once logged in, continue to Host groups in the leftmost panel, and there should be at least localhost defined there.

At first, there won't be a machine related to you, as you've not set it up yet.

This kind of automated scoring might not be perfect, as there are quite a few ways a task might be understood and done. If you feel the check is wrong or don't understand why it's not succeeding for your task, ask the teachers in Slack.

Setting up the personal environment¶

In this course, you are going to be installing and administrating your own Kubernetes cluster, but before you can do that, you'll need an environment to install the Kubernetes to.

You are going to be using virtual machines for this, provided by the ETAIS cloud service. ETAIS’s main aim is to serve Estonian students and researchers.

For access, you'll have received an email with instructions on how to log in. You are also invited into the Cloud Native Applications on Kubernetes organization, and have a private project in that organization.

After setting up the virtual machine, you'll also need to register it with the scoring server.

ETAIS¶

Before you can create your virtual machines, make sure you can access the self-service environment here: ETAIS

If everything works, you are ready to create a personal virtual machine. There's two steps involved - creating an SSH key, and making the machine.

Creating a public/private SSH key pair¶

Before you continue you need to set up a public/private key pair so you could use them to connect to the machine.

Public key cryptography, or asymmetrical cryptography, is any cryptographic system that uses pairs of keys: public keys which may be disseminated widely, and private keys which are known only to the owner. This accomplishes two functions: authentication, where the public key verifies a holder of the paired private key sent the message, and encryption, where only the paired private key holder can decrypt the message encrypted with the public key.

In a public-key encryption system, any person can encrypt a message using the receiver's public key. That encrypted message can only be decrypted with the receiver's private key. More on that here.

Now to actually create the key pair. How to go about creating the keys depends on the operating system you use. With Linux/MacOS it's rather straightforward, with Windows you have a choice between using WSL and PuTTY.

Once the public key is successfully added, you should be able to see it in the list of SSH Keys.

Starting a virtual machine¶

Now that you have a way to setup authentication, you can start a virtual machine.

Before you create a machine, please decide on an alias. This alias can be anything that already does not exist in the host list of the scoring.

You can use your matrix number, username, real name, an animal, a random alphanumeric string - but no punctuation, and no spaces.

The external IP for your machine is given from the campus network subnet. This means that your machine is accessible from only inside the University network - for example with VPN.

You should now be able to SSH into the machine, at the external IP address. In a bit of time, also <alias>.cloud.ut.ee DNS address should start working.

Logging into your virtual machine (SSH)¶

Secure Shell (SSH) is a cryptographic network protocol for operating network services securely over a network. The best-known example application is for remote login to computer systems by users.

SSH provides a secure channel over an unsecured network in a client-server architecture, connecting an SSH client application with an SSH server. Common applications include remote command-line login and remote command execution, but any network service can be secured with SSH. More on that here.

Connecting to Cloud resources (VM-s) over SSH is preferred. The other option is to use the slow network console from minu.etais.ee, but usually this is reserved for emergency purposes. The problem with the network console is that you cannot copy/paste to it, and can have only one terminal open.

Consul¶

Now that you can access your machine, your scoring server needs to find your machine somehow. For this, a tool called consul has been setup in the Scoring server, in the server role.

You're going to need to install consul in client role, for it to connect to the consul server.

consul, among other things, registers itself to the existing cluster, and makes it's name and IP address visible to the scoring server.

Installing consul requires downloading it, setting up the necessary configuration, binary and system files, and starting it.

dnf install wget unzip

{
  "client_addr": "0.0.0.0",
  "datacenter": "k8s",
  "data_dir": "/var/lib/consul",
  "domain": "k8s",
  "dns_config": {
      "enable_truncate": true
  },
  "enable_syslog": true,
  "encrypt": "i5GSG0lNrO+gCBdW67tqTd6qctc2pqFHOt97Z9yiIss=",
  "log_level": "INFO",
  "rejoin_after_leave": true,
  "server": false,
  "retry_join": [
      "172.17.90.165"
  ],
  "ui": false
}

[Unit]
Description="HashiCorp Consul - A service mesh solution"
Documentation=https://www.consul.io/
Requires=network-online.target
After=network-online.target
ConditionFileNotEmpty=/etc/consul/config.json

[Service]
User=consul
Group=consul
ExecStart=/bin/bash -c "/usr/local/bin/consul agent -advertise=$(curl -s http://169.254.169.254/latest/meta-data/public-ipv4) -node=$(curl -s http://169.254.169.254/latest/meta-data/hostname | awk -F '.' '{print $1}') -config-dir=/etc/consul/"
ExecReload=/usr/local/bin/consul reload
KillMode=process
Restart=on-failure
LimitNOFILE=65536

[Install]
WantedBy=multi-user.target

Changing firewall rules¶

As is standard with cloud based virtual environments, the user can define their networking policies by using a form of firewall rules.

Because of the which rules are used by default ETAIS (SSH), you'll need to apply some rules to your machine, for it to be able to receive pings and consul service related traffic. Namely, you need to open ICMP and 8301/tcp+udp.

First, you'll add a security group to the VM to open ICMP.

Secondly, just to avoid problems in the future, open the port 8301/tcp+udp for two-way consul traffic.

Scoring access¶

For scoring to work properly, you'll need to give teachers and the scoring server access to your virtual machine. You'll also need a root user password, so if something goes wrong, you can login to your machine via the ETAIS console, and fix it.

Now, give the lab instructors and automated scoring system access to your VM over SSH using a scoring account. The public key for the scoring user is available for download here, and it works exactly like your own public-private key pair for ssh. Download scoring user's public key

Now, add the downloaded public key to the list of authorized keys for scoring account:

scoring@host:~$ sudo ls -l /root

Password for root user¶

VMs in ETAIS by default come without passwords - meaning you can only gain access to the VM with the correct key pair. In this course, the root user should have a password, as it allows for disaster recovery in case something happens to your key or virtual machine, through the web console.

Linking your VM to Matrix number¶

Due to the fact that you are allowed to use any VM name possible, there needs to be a connection between your VM name and actual person.

Make a text file `/etc/identity`. Fill in the following template, and put it into `/etc/identity`:
```
VM name: <your_VM_name>
Matrix number: <your_matrix_number>
```

In this exact format, as we will be parsing this with scripts.

This lab is now complete once all the checks in the scoring server have turned green.