Kubernetes

Edit online

Kubernetes is an open source container orchestration system for automating software deployment, scaling, and management.

It provides features such as:
  • Self-healing.
  • Horizontal scaling.
  • Service discover and load balancing.
  • Secret and configuration management.

More information about Kubernetes can be found on the official Kubernetes website: https://kubernetes.io/.

Repository

The Verify Directory images are available from the IBM Cloud Repository: icr.io/isvd/verify-directory-proxy, icr.io/isvd/verify-directory-seed, icr.io/isvd/verify-directory-server, icr.io/isvd/verify-directory-webadmin, and icr.io/isvd/verify-directory-virtualdir.

Secrets

Sensitive information, like passwords must never be stored directly in the yaml deployment descriptors. Instead, store them within a Kubernetes secret and then reference the secret in the yaml deployment descriptors. Instructions on how to use Kubernetes secrets can be found in the official Kubernetes documentation: https://kubernetes.io/docs/concepts/configuration/secret/.

In the examples that are provided, a ‘secret’ is used to store the administration password. A command to create the ‘secret’ is provided in the following example. Ensure that the kubectl context is set to the correct environment before you run this command.
kubectl create secret generic isvd-passwords --type=string --from-literal=admin=Passw0rd1

Service Accounts

Service accounts can be used to provide an identity for processes that run in a Pod. Information on the usage of service accounts can be found in the official Kubernetes documentation: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/.

In the examples that are provided, the deployment descriptors use the ‘isvd’ service account. The kubectl utility can be used to create the ‘isvd’ service account. Ensure that the kubectl context is set to the correct environment before you run this command.
kubectl create serviceaccount isvd

Readiness, Liveness, and Startup Probes

Kubernetes uses liveness probes to help determine whether a container is unresponsive. If a container does become unresponsive, Kubernetes automatically attempts to restart the container to help rectify the problem.

Kubernetes uses readiness probes to determine whether a container is ready to serve traffic. A pod with containers that report that they are not ready do not receive traffic through Kubernetes Services.

Kubernetes uses startup probes to deal with applications that might require an extra startup time on their first initialization. The startup probe waits for a container to signal that it fully started before the readiness and liveness probes are commenced.
Note: The startup probe was introduced in Kubernetes v1.16 and is not available before v1.16.

The Verify Directory images provide a shell script that can be used to respond to liveness, readiness, and startup probes: /sbin/health_check.sh. If the livenessProbe command-line option is provided to the script, it reports on the liveness of the container. If the startupProbe command-line option is provided to the script, it reports on the startup status of the container. Otherwise, it reports on the readiness of the container. For a liveness probe, the container first checks to see whether it is still starting. If it is starting, it returns a healthy result. After the container is ready, both the liveness and readiness probes return the network connectivity state of the service that is hosted by the container.

For more information about liveness, readiness, and startup probes, see the official Kubernetes documentation.

Persistent Volumes

To be able to persist the Directory server data, the /var/isvd/data directory must be mounted as a persistent volume. It is critical to ensure that when the volume is mounted, the user that the container runs as has write permission to the directory. By default the container runs as the idsldap user with a UID of 1000.

Deployment

The following topics illustrate how to deploy Verify Directory containers into a Kubernetes environment.