# Rahti ### Kubernetes architecture

# API objects
                        <div class="slide-content">
                        <div class="text-column">

- In Kubernetes, everything is an API object
                        - A complex set of API objects:
                          - Network
                          - Container: management and creation
                          - Job scheduling
                          - Container runtime
                          - Storage

</div>
                        </div>
                        ---
                        # API objects
                        <div class="slide-content mermaid">
                        flowchart TB
                        API(( Kubernetes API )) --> Net[Network]
                        API --> Cont[Containers]
                        API --> Job[Job scheduling]
                        API --> Run[Runtime]
                        API --> Sto[Storage]
                        </div>
                        ---
                        # Project
                        <div class="slide-content">
                        <div class="text-column">

- A project sandboxes API objects (pods and others) in a common namespace
                          - A local, isolated network
                          - Projects cannot access other projects by default
                          - Similar to a Kubernetes namespace, with extra features
                        - A project has:
                          - Name: short and descriptive
                          - Display name: a more verbose description
                          - Description: must contain `csc_project: 2014009`

</div>
                        <div class="image-column">
                            <img src="/img/sld-rahti-image56.png" alt="A Rahti project sandboxing API objects in a namespace.">
                        </div>
                        </div>
                        ---
                        # Pod
                        <div class="slide-content">
                        <div class="text-column">

- A pod is a collection of containers that share a network and IPC namespace
                          - Containers live inside one pod
                        - There is no container object in Kubernetes
                        - Nearly always one container per pod
                        - Communicate via localhost (network) and shared memory (IPC)

</div>
                        </div>
                        ---
                        # Pod
                        <div class="slide-content mermaid">
                        flowchart TB
                        subgraph Pod
                          C1[Container]
                          C2[Container]
                        end
                        C1 <-->|localhost / IPC| C2
                        </div>
                        ---
                        # Service
                        <div class="slide-content">
                        <div class="text-column">

- An API object that gives pods a load-balanced, stable network identity
                          - A pod's IP may change; a service's IP will not
                          - Several pods can sit behind one service
                          - Several ports can be exposed by the same service
                          - The exposed port may differ from the container port

</div>
                        </div>
                        ---
                        # Service
                        <div class="slide-content mermaid">
                        flowchart TB
                        Svc([Service]) --> P1[Pod]
                        Svc --> P2[Pod]
                        Svc --> P3[Pod]
                        </div>
                        ---
                        # Route
                        <div class="slide-content">
                        <div class="text-column">

- An API object that exposes a service to the internet over HTTP(S)
                        - Every host matching `*.2.rahtiapp.fi` points to Rahti automatically
                          - `my-app.2.rahtiapp.fi` is an alias for `2.rahtiapp.fi`
                          - For a different host, configure a DNS CNAME to `2.rahtiapp.fi`
                        - Every `*.2.rahtiapp.fi` host gets a valid TLS certificate automatically

</div>
                        </div>
                        ---
                        # Route
                        <div class="slide-content mermaid">
                        flowchart LR
                        NET(( Internet )) -->|HTTPS| Route([Route]) --> Svc([Service]) --> Pod[Pod]
                        </div>

Thank you

Joona Tolonen

servicedesk@csc.fi