Artikel: Backups mit Velero


Listing 1: Custom-Role für Velero erzeugen

ROLE_PERMISSIONS=(
compute.disks.get
compute.disks.create
compute.disks.createSnapshot
compute.projects.get
compute.snapshots.get
compute.snapshots.create
compute.snapshots.useReadOnly
compute.snapshots.delete
compute.zones.get
storage.objects.create
storage.objects.delete
storage.objects.get
storage.objects.list
iam.serviceAccounts.signBlob
)
gcloud iam roles create velero.server \
--project $PROJECT_ID \
--title "Velero Server" \
--permissions "$(IFS=","; echo
"${ROLE_PERMISSIONS[*]}")"
gcloud projects add-iam-policy-binding
$PROJECT_ID \
--member serviceAccount:$SERVICE_
ACCOUNT_EMAIL \
--role projects/$PROJECT_ID/roles/
velero.server
gsutil iam ch serviceAccount:$SERVICE_ACCOUNT_EMAIL:objectAdmin gs://${BUCKET}


Listing 2: Velero antwortet auf Frage nach erfolgreichem Backup

Name: initial-backup
Namespace: velero
Labels: velero.io/storagelocation=default
Annotations: velero.io/source-clusterk8s-gitversion=v1.26.
5-gke.2700
velero.io/source-clusterk8s-major-version=1
velero.io/source-clusterk8s-minor-version=26
Phase: Completed
Namespaces:
Included: *
Excluded: <none>
Resources:
Included: *
Excluded: <none>
Cluster-scoped: auto
Label selector: <none>
Storage Location: default
Velero-Native Snapshot PVs: auto
TTL: 720h0m0s
CSISnapshotTimeout: 10m0s
ItemOperationTimeout: 1h0m0s
Hooks: <none>
Backup Format Version: 1.1.0
Started: 2023-09-04 21:39:22 +0300 EEST
Completed: 2023-09-04 21:39:31 +0300 EEST
Expiration: 2023-10-04 21:39:22 +0300 EEST
Total items to be backed up: 581
Items backed up: 581
Velero-Native Snapshots: <none included>



Artikel: Strategien für Rolling Upgrades


Listing: Konfigurationsbeispiel für eine Webanwendung

apiVersion: apps/v1
kind: Deployment
metadata:
name: my-app-deploy
spec:
replicas: 3
strategy:
type: RollingUpdate
rollingUpdate:
maxSurge: 1
maxUnavailable: 0
selector:
matchLabels:
app: my-app
minReadySeconds: 10
template:
metadata:
labels:
app: my-app
spec:
containers:
- name: my-app-container
image: myregistry/my-app:1.0.0
ports:
- containerPort: 8080
readinessProbe:
httpGet:
path: /health
port: 8080
initialDelaySeconds: 5
periodSeconds: 10
timeoutSeconds: 2
failureThreshold: 3



Artikel: Argo Workflows


Listing 1: Erstes Beispiel für einen Workflow

apiVersion: argoproj.io/v1alpha1
kind: Workflow
metadata:
generateName: stepsspec:
entrypoint: hello-hello-hello
# Diese spec enthält zwei Templates: hellohello-hello und print-message
templates:
- name: hello-hello-hello
# Dieses Template definiert eine Sequenz
von Schritten
steps:
- - name: hello1 # hello1 wird vor den
nächsten Schritt ausgeführt
template: print-message
arguments:
parameters:
- name: message
value: "hello1"
- - name: hello2a # Doppel dash =>
Ausführung sequentiell
template: print-message
arguments:
parameters:
- name: message
value: "hello2a"
- name: hello2b # Einzel dash =>
Parallele Ausführung
template: print-message
arguments:
parameters:
- name: message
value: "hello2b"
- name: print-message
inputs:
parameters:
- name: message
container:
image: busybox
command: [echo]
args: ["{{inputs.parameters.message}}"]


Listing 2: Workflow mit DAG-Template

apiVersion: argoproj.io/v1alpha1
kind: Workflow
metadata:
generateName: dag-diamondspec:
entrypoint: diamond
templates:
- name: echo
inputs:
parameters:
- name: message
container:
image: alpine:3.7
command: [echo,
"{{inputs.parameters.message}}"]
- name: diamond
dag:
tasks:
- name: A
template: echo
arguments:
parameters: [{name: message, value:A}]
- name: B
dependencies: [A]
template: echo
arguments:
parameters: [{name: message, value:B}]
- name: C
dependencies: [A]
template: echo
arguments:
parameters: [{name: message, value:C}]
- name: D
dependencies: [B, C]
template: echo
arguments:
parameters: [{name: message, value:D}]


Listing 3: Artifacts übergeben

apiVersion: argoproj.io/v1alpha1
kind: Workflow
metadata:
generateName: artifact-examplespec:
entrypoint: main
templates:
- name: main
dag:
tasks:
- name: generate-artifact
template: create-file
- name: consume-artifact
template: read-file
depends: generate-artifact
arguments:
artifacts:
- name: my-file
from: "{{tasks.generate-artifact.outputs.artifacts.my-file}}"
- name: create-file
script:
image: alpine:3.14
command: [sh]
source: |
echo "Hallo, Welt!" > /tmp/output.txt
outputs:
artifacts:
- name: my-file
path: /tmp/output.txt
- name: read-file
inputs:
artifacts:
- name: my-file
path: /tmp/input.txt
script:
image: alpine:3.14
command: [sh]
source: |
cat /tmp/input.txt


Listing 4: Build einer Go-Anwendung als Workflow abbilden

apiVersion: argoproj.io/v1alpha1
kind: Workflow
metadata:
generateName: ci-examplespec:
entrypoint: ci-example
arguments:
parameters:
- name: revision
value: cfe12d6
volumeClaimTemplates:
- metadata:
name: workdir
spec:
accessModes: ["ReadWriteOnce"]
resources:
requests:
storage: 1Gi
templates:
- name: ci-example
inputs:
parameters:
- name: revision
steps:
- - name: build
template: build-golang
arguments:
parameters:
- name: revision
value: "{{inputs.parameters.revision}}"
- - name: test
template: run-hello
arguments:
parameters:
- name: os-image
value: "{{item.image}}:{{item.tag}}"
withItems:
- { image: 'debian', tag: '9.1' }
- { image: 'alpine', tag: '3.6' }
- name: build-golang
inputs:
parameters:
- name: revision
artifacts:
- name: code
path: /go/src/github.com/golang/example
git:
repo: https://github.com/golang/example.git
revision: "{{inputs.parameters.revision}}"
container:
image: golang:1.8
command: [sh, -c]
args: ["cd /go/src/github.com/golang/example/hello && go build -v ."]
volumeMounts:
- name: workdir
mountPath: /go
- name: run-hello
inputs:
parameters:
- name: os-image
container:
image: "{{inputs.parameters.os-image}}"
command: [sh, -c]
args: ["/go/src/github.com/golang/example/hello/hello"]
volumeMounts:
- name: workdir
mountPath: /go


Listing 5: Ereignisse in Google Cloud Storage verarbeiten

# Schritt 1
gcloud iam service-accounts create argo-gcs-access
--project=your-project-id
# Schritt 2
gcloud projects add-iam-policy-binding your-project-id
--member="serviceAccount:argo-gcs-access@your-project-id.iam.gserviceaccount.com"
--role="roles/storage.objectViewer"
gcloud projects add-iam-policy-binding your-project-id
--member="serviceAccount:argo-gcs-access@your-project-id.iam.gserviceaccount.com"
--role="roles/pubsub.subscriber"
# Schritt 3
gcloud iam service-accounts add-iam-policy-binding
argo-gcs-access@your-project-id.iam.gserviceaccount.com
--member="serviceAccount:your-project-id.svc.id.goog[argo-events/argo-gcs-sa]"
--role="roles/iam.workloadIdentityUser"
--project=your-project-id
apiVersion: v1
kind: ServiceAccount
metadata:
name: argo-gcs-sa
namespace: argo-events
annotations:
iam.gke.io/gcp-service-account: argo-gcs-access@your-project-id.iam.gserviceaccount.com


Listing 6: Sensor einrichten

apiVersion: argoproj.io/v1alpha1
kind: Sensor
metadata:
name: gcs-workflow-trigger
namespace: argo-events
spec:
serviceAccountName: argo-gcs-sa
dependencies:
- name: gcs-dep
eventSourceName: gcs-events
eventName: gcs-bucket
triggers:
- template:
name: trigger-workflow
argoWorkflow:
operation: submit
source:
resource:
apiVersion: argoproj.io/v1alpha1
kind: Workflow
metadata:
generateName: gcs-triggeredspec:
serviceAccountName: argo-gcs-sa
entrypoint: main
arguments:
parameters:
- name: file-key
value: "{{dependencies.gcs-dep.event.data.name}}"
templates:
- name: main
inputs:
parameters:
- name: file-key
artifacts:
- name: input-file
path: /tmp/input-file
gcs:
bucket: my-gcs-bucket
key: "{{workflow.parameters.file-key}}"
container:
image: gcr.io/google.com/cloudsdktool/cloud-sdk:latest
command: ["bash", "-c"]
args:
- |
echo "Processing file: {{workflow.parameters.file-key}}"
cat /tmp/input-file
# Weitere Logik hier, z.B. Datei verarbeiten
volumeMounts:
- name: workdir
mountPath: /tmp
volumeClaimTemplates:
- metadata:
name: workdir
spec:
accessModes: ["ReadWriteOnce"]
resources:
requests:
storage: 1Gi



Artikel: Cluster skalieren mit Keda


Listing 1: Beispielanwendung "Metriken für Prometheus"

apiVersion: apps/v1
kind: Deployment
metadata:
name: prometheus-example-app
namespace: default
labels:
app: prometheus-example-app
spec:
replicas: 1
selector:
matchLabels:
app: prometheus-example-app
template:
metadata:
labels:
app: prometheus-example-app
spec:
containers:
- name: prometheus-example-app
image: quay.io/brancz/prometheus-example-app:v0.3.0
ports:
- containerPort: 8080
---
apiVersion: v1
kind: Service
metadata:
name: prometheus-example-app
namespace: default
annotations:
prometheus.io/scrape: "true"
prometheus.io/port: "8080"
prometheus.io/path: "/metrics"
spec:
selector:
app: prometheus-example-app
ports:
- port: 8080
targetPort: 8080
protocol: TCP
name: metrics


Listing 2: values.yaml-Datei für die Helm-Installation

server:
service:
servicePort: 9090
scrapeConfigFiles:
- |
- job_name: 'prometheus-example-app'
kubernetes_sd_configs:
- role: service
namespaces:
names:
- default
relabel_configs:
- source_labels: [__meta_kubernetes_service_annotation_prometheus_io_scrape]
action: keep
regex: true
- source_labels: [__meta_kubernetes_service_annotation_prometheus_io_port]
action: replace
target_label: __port__
- source_labels: [__meta_kubernetes_service_annotation_prometheus_io_path]
action: replace
target_label: __metrics_path__
alertmanager:
enabled: false
kubeStateMetrics:
enabled: false
nodeExporter:
enabled: false
pushgateway:
enabled: false
helm install prometheus prometheus-community/prometheus -f values.yaml --namespace default


Listing 3: Scaled-Object-Manifest

apiVersion: keda.sh/v1alpha1
kind: ScaledObject
metadata:
name: prometheus-example-app-scaledobject
namespace: default
spec:
scaleTargetRef:
name: prometheus-example-app
minReplicaCount: 1
maxReplicaCount: 10
triggers:
- type: prometheus
metadata:
serverAddress: http://prometheus-server.default.svc.cluster.local:9090
metricName: http_requests_total
query: sum(rate(http_requests_total{job="prometheus-example-app"}[5m]))
threshold: "5"
namespace: default


Listing 4: Scaled Object anlegen

apiVersion: keda.sh/v1alpha1
kind: ScaledObject
metadata:
name: pubsub-consumer-scaledobject
namespace: default
spec:
scaleTargetRef:
name: pubsub-consumer
minReplicaCount: 0
maxReplicaCount: 10
pollingInterval: 10
cooldownPeriod: 30
triggers:
- type: gcp-pubsub
authenticationRef:
name: keda-workload-identity-auth
metadata:
subscriptionName: keda-echo-read
mode: SubscriptionSize
value: "5"
activationValue: "10"
timeHorizon: "1m"
---
apiVersion: keda.sh/v1alpha1
kind: TriggerAuthentication
metadata:
name: keda-workload-identity-auth
namespace: default
spec:
podIdentity:
provider: gcp