Container Sovereignty: Kubernetes Without Cloud Dependencies Training Course

Introduction to Self-Managed Kubernetes for Government

• Overview of Kubernetes architecture and core components
• Considerations and trade-offs between managed and self-managed Kubernetes for government operations
• Addressing vendor lock-in concerns and the benefits of sovereignty in government IT environments
• Deployment options: kubeadm, kOps, and manual installation for government use cases

Planning Your Infrastructure for Government

• Hardware sizing requirements for control plane and worker nodes in government data centers
• High availability requirements and topologies to ensure robust and reliable operations for government services
• Operating system selection and preparation (Ubuntu, RHEL, Rocky Linux) for government systems
• Network prerequisites and firewall configuration to meet government security standards

Installing Container Runtimes for Government

• Container runtime options: containerd versus CRI-O, tailored for government environments
• Installing and configuring containerd for secure and efficient operations in government agencies
• Installing and configuring CRI-O to meet specific government requirements
• Runtime security considerations to ensure compliance with government regulations

Bootstrapping the Cluster with kubeadm for Government

• Installing kubeadm, kubelet, and kubectl for government Kubernetes clusters
• Initializing the first control plane node to establish a secure foundation for government operations
• Configuring kubeconfig for secure cluster access in government settings
• Joining additional control plane nodes for high availability in government environments
• Joining worker nodes to the cluster to support scalable and resilient government applications

Configuring High Availability for Government

• Stacked versus external etcd topologies to ensure high availability in government Kubernetes clusters
• Setting up HAProxy or Keepalived for API server load balancing in government data centers
• Certificate management and renewal processes to maintain security and compliance in government systems
• Backup and recovery strategies for etcd to ensure data integrity and availability in government operations

Container Networking for Government

• CNI plugin selection: Calico, Cilium, Flannel, Weave, tailored for government network requirements
• Installing and configuring Calico to meet government security standards
• Network policies for enhanced security in government Kubernetes clusters
• Node-to-node communication and pod networking strategies for efficient government operations
• Exposing services without cloud load balancers to support on-premises government infrastructure

Service Load Balancing for Government

• MetalLB for bare-metal load balancing in government data centers
• Configuring Layer 2 and BGP modes to meet government network specifications
• Keepalived and HAProxy alternatives for additional load balancing options in government environments
• Ingress controller deployment (nginx, Traefik) to support secure and scalable government services

Storage Solutions for Government

• Concepts of storage classes and CSI drivers for government Kubernetes clusters
• Local persistent volumes to optimize performance in government data centers
• NFS provisioner setup to support shared storage needs in government environments
• Distributed storage options: Ceph RBD, OpenEBS, for enhanced reliability and scalability in government operations
• Snapshot and cloning capabilities to facilitate data management and recovery in government systems

Cluster Security for Government

• Certificate authority and PKI management to ensure secure communications in government Kubernetes clusters
• RBAC configuration and service accounts to enforce role-based access control in government systems
• Pod security standards and admission controllers to enhance application security for government applications
• Securing the API server and etcd to protect critical data and operations in government environments
• Image signing and verification to ensure the integrity of container images used in government systems

Self-Hosted Container Registry for Government

• Harbor registry deployment to support secure image storage and management in government data centers
• Docker Registry setup to meet the needs of government agencies
• Image replication and vulnerability scanning to ensure compliance and security in government operations
• Registry authentication and integration with existing government identity management systems

Monitoring and Observability for Government

• Deployment of the Prometheus and Grafana stack to monitor government Kubernetes clusters
• VictoriaMetrics as a lightweight alternative for resource-constrained government environments
• Node and pod metrics collection to support proactive monitoring and troubleshooting in government systems
• Custom alerting rules and dashboards to facilitate timely response to issues in government operations
• Log aggregation with Loki or Fluentd to ensure comprehensive logging for audit and compliance purposes in government agencies

Cluster Maintenance for Government

• Kubernetes version upgrades using kubeadm to keep government clusters up-to-date and secure
• Rolling updates for control plane components to minimize downtime in government operations
• Certificate rotation procedures to maintain security and compliance in government systems
• Node maintenance and cordoning strategies to ensure smooth and efficient cluster management in government data centers

Backup and Disaster Recovery for Government

• etcd backup and restore procedures to ensure data integrity and availability in government Kubernetes clusters
• Velero for comprehensive cluster resource and persistent volume backups in government environments
• Cross-site replication strategies to enhance disaster recovery capabilities for government operations
• Testing recovery procedures to validate the effectiveness of backup and disaster recovery plans in government systems

Multi-Cluster Management for Government

• Rancher or Portainer for centralized management of multiple government Kubernetes clusters
• Cluster federation concepts to support seamless workload distribution and management across government data centers
• Workload distribution strategies to optimize resource utilization and performance in government operations