checklist.md

• Best place to get started

• https://eksworkshop.com/

• Talk Minikube

• Talk Play with Kubernetes

• https://labs.play-with-k8s.com/

• EKS Service Role

• Create EKS Cluster (with same user who will use kubectl)

• Talk about IAM and K8s RBAC

• What is kubectl?

• Use AWS CLI to update kubeconfig

• Create Work Nodes with EC2

• Add RBAC settings for Worker Nodes

• eksctl - let's hear from Paul!

Beyond Setup

• How to Use ECR

• What is Helm?

• Install Helm

• Look at some Charts

• Fine-Grained IAM Role for Service Accounts

• https://aws.amazon.com/blogs/opensource/introducing-fine-grained-iam-roles-service-accounts/

Resources

List of Kubernetes Objects

Basic

• Pod
• Service
• Volume
• Namespace

Higher Level

• Deployment
• DaemonSet
• StatefulSet
• ReplicaSet
• Job

K8s Tools

MacOS
# Change to linux or windows
sudo curl --silent --location -o /usr/local/bin/kubectl https://storage.googleapis.com/kubernetes-release/release/v1.13.7/bin/darwin/amd64/kubectl

sudo chmod +x /usr/local/bin/kubectl

Or

brew install kubectl 

https://kubernetes.io/docs/reference/kubectl/cheatsheet/

VPC for EKS

https://amazon-eks.s3-us-west-2.amazonaws.com/cloudformation/2019-10-08/amazon-eks-vpc-sample.yaml

Create EKS Service Role

https://docs.aws.amazon.com/eks/latest/userguide/service_IAM_role.html

Create cluster with AWS CLI

aws eks create-cluster --name manual-eks --role-arn arn:aws:iam::812570870442:role/eksctl-amg-cluster-ServiceRole-1MNOCDK6M6M9I --resources-vpc-config file://vpc-config.json

Update kubectl with AWS CLI

aws eks --region region update-kubeconfig --name cluster_name

EKS Optimized AMI

https://docs.aws.amazon.com/eks/latest/userguide/getting-started-console.html

Allow Worker Nodes to Join

curl -o aws-auth-cm.yaml https://amazon-eks.s3-us-west-2.amazonaws.com/cloudformation/2019-10-08/aws-auth-cm.yaml

# Downloads:
apiVersion: v1
kind: ConfigMap
metadata:
  name: aws-auth
  namespace: kube-system
data:
  mapRoles: |
    - rolearn: <ARN of instance role (not instance profile)>
      username: system:node:{{EC2PrivateDNSName}}
      groups:
        - system:bootstrappers
        - system:nodes

Then run:

kubectl apply -f aws-auth-cm.yaml
kubectl get nodes --watch

ECR Role for Node Workers

https://docs.aws.amazon.com/AmazonECR/latest/userguide/ECR_on_EKS.html

Deploy Simple Pod

apiVersion: v1
kind: Pod
metadata:
  name: myapp-pod
  labels:
    app: myapp
spec:
  containers:
  - name: myapp-container
    image: busybox
    command: ['sh', '-c', 'echo Hello Kubernetes! && sleep 3600']

Deploy Load Balancer

apiVersion: v1
kind: Service
metadata:
  name: example-service
spec:
  selector:
    app: example
  ports:
    - port: 8765
      targetPort: 9376
  type: LoadBalancer

apiVersion: apps/v1 # for versions before 1.9.0 use apps/v1beta2
kind: Deployment
metadata:
  name: nginx-deployment
spec:
  selector:
    matchLabels:
      app: nginx
  replicas: 2 # tells deployment to run 2 pods matching the template
  template:
    metadata:
      labels:
        app: nginx
    spec:
      containers:
      - name: nginx
        image: nginx:1.7.9
        ports:
        - containerPort: 80

eksctl Commands

eksctl create cluster --name=k8s-eksctl --nodes=3 --alb-ingress-access --region=${AWS_REGION}

Install Helm

https://helm.sh/ https://helm.sh/docs/glossary/

curl https://raw.githubusercontent.com/kubernetes/helm/master/scripts/get > get_helm.sh

chmod +x get_helm.sh

./get_helm.sh

Create service account for Tiller

cat <<EoF > ./rbac.yaml
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: tiller
  namespace: kube-system
---
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRoleBinding
metadata:
  name: tiller
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin
subjects:
  - kind: ServiceAccount
    name: tiller
    namespace: kube-system
EoF

kubectl apply -f ./rbac.yaml

helm init --service-account tiller

Dockerfile

docker build -t corretto-app .
$(aws ecr get-login --no-include-email --region us-east-1)

docker tag corretto-app:latest 812570870442.dkr.ecr.us-east-1.amazonaws.com/corretto-app:latest

docker push 812570870442.dkr.ecr.us-east-1.amazonaws.com/corretto-app:latest

kubectl apply -f corretto-deployment.yaml --kubeconfig ./kubeconfig
kubectl apply -f corretto-service.yaml --kubeconfig ./kubeconfig
kubectl get svc --kubeconfig kubeconfig

kubectl delete -f corretto-deployment.yaml --kubeconfig ./kubeconfig
kubectl delete -f corretto-service.yaml --kubeconfig ./kubeconfig