Practical Kubernetes Guide

Understand the responsibilities of the Kubernetes control plane and worker nodes. Relate the API server, state store, scheduler, controllers, and node components to cluster operation.

Review the networking choices compared in this section. Identify why Pod addressing, subnet capacity, routing, and connected networks matter when selecting an AKS network model.

Explore the kubenet Pod-addressing and routing model introduced in the course. Treat it as legacy-mode context and consult current AKS migration guidance before using it for a new deployment.

Examine the VNet IP-addressing and subnet-capacity considerations of the Azure CNI mode introduced in this lecture. Distinguish these choices from overlay networking.

Compare kubenet and Azure CNI in terms of addressing, routing, and network planning. Connect the trade-offs to the requirements of an AKS environment.

Understand Azure CNI Overlay and the distinction between node-network addresses and the Pod address space. Relate that model to IP planning and network connectivity.

Compare kubenet with Azure CNI Overlay. Identify the architectural differences and the migration considerations that matter when reviewing an existing cluster.

Explore bring-your-own CNI choices for AKS. Consider installation responsibilities, compatibility, and support boundaries before choosing a custom networking implementation.

Review CIDR planning for cluster, Pod, service, and connected-network address spaces. Identify overlap risks before selecting ranges or integrating an AKS cluster into a larger network.

Explore collecting AKS API-server logs for control-plane troubleshooting. Distinguish API-server diagnostics from application container logs and connect each source to the problem being investigated.

Learn how to connect to KAS worker node using SSH for troubleshooting or maintenance tasks.

Learn how to schedule Kubernetes Node restarts/reboot using Kured.
https://github.com/weaveworks/kured

Explore kubelogin-based authentication for AKS. Distinguish obtaining an authenticated identity from the RBAC permissions that authorize Kubernetes API operations.

Change a workload desired replica count manually and inspect the resulting Pods. Distinguish workload replica scaling from increasing the number of cluster nodes.

Understand how the Horizontal Pod Autoscaler adjusts workload replicas from configured metrics. Relate targets and scaling behavior to application demand and available cluster capacity.

Explore manually changing cluster node capacity. Connect node counts and available resources to the workloads the cluster needs to schedule.

Understand the Cluster Autoscaler role in adjusting node capacity for workload scheduling. Distinguish node scaling from the Horizontal Pod Autoscaler replica decisions.

Explore virtual-node capacity for AKS workloads. Review workload and networking limitations before treating this execution model as equivalent to regular cluster nodes.

Understand how the Secrets Store CSI Driver can make Azure Key Vault secrets available to a workload. Identify the roles of the mounted volume, workload identity, and Key Vault permissions.

Learn how to secure sensitive data like passwords in AKS.
This demo will help you to securely retrieve your encrypted passwords from Azure Key Vault.

Learn how to create Security Policies for Kubernetes using OPA Gatekeeper.

Explore restricting workload images to approved container registries. Connect image-source policy to admission controls rather than treating a registry name as authorization by itself.

Understand Kubernetes Operators as controllers that manage application-specific resources. Relate custom resources and reconciliation to repeatable application operations.

Explore operator-based management of Prometheus and Grafana. Distinguish desired monitoring configuration, controller reconciliation, metrics collection, and visualization.

Explore operator-based deployment of the Fluentd, Elasticsearch, and Kibana logging stack. Connect log collection, indexing, and visualization to the cluster logging workflow.

Examine the NGINX Ingress controller example and its role in HTTP routing. Identify the specific implementation and check current maintenance and migration guidance before choosing a production ingress solution.

Configure HTTPS routing with an Ingress and TLS certificate material. Relate hostnames, TLS secrets, and the controller configuration to the intended encrypted request path.

Build a conceptual model of Kubernetes RBAC from the lightboard explanation. Distinguish subjects, permissions, roles, and bindings when reasoning about access to the API server.

Review Kubernetes RBAC terminology and scope in the presentation. Connect Role and ClusterRole rules to the bindings that grant permissions to subjects.

Follow the Role and RoleBinding demonstration. Relate the selected subject, namespace, resources, and allowed verbs to the API operations being authorized.

Understand how workload identities can access Azure services without embedding long-lived application credentials. Distinguish the workload identity, its trust relationship, and the permissions granted to it.

Follow the passwordless-identity demonstration and trace the workload identity to its Azure access permissions. Verify the current identity mechanism and prerequisites before reproducing the example.