Container Platforms Administration with Docker, Kubernetes and OpenShift Training Course

Day 1 – Containers and Image Management

Introduction to Container Platforms

• Comparison of traditional application deployment versus container-based approaches
• Distinguishing containers from virtual machines
• Understanding container runtimes and engines
• The respective roles of Docker, Kubernetes, and OpenShift
• Overview of common container platform architectures
• Workflows for development, testing, and production environments

Working with Containers

• Executing and managing containers
• The container lifecycle stages
• Initiating, halting, and deleting containers
• Running commands within containers
• Managing environment variables
• Port mapping techniques
• Accessing container logs
• Inspecting resource usage and processes

Building Container Images

• Understanding image structure and layers
• Authoring Dockerfiles and Containerfiles
• Selecting appropriate base images
• Incorporating application dependencies
• Configuring entry points and commands
• Leveraging image caching for efficiency
• Strategies for reducing image size
• Ensuring image reproducibility

Container Registries

• Differentiating between public and private registries
• Tagging and versioning images
• Pushing and pulling images from registries
• Managing image authentication
• Implementing image retention policies and cleanup procedures
• Key security considerations for images

Container Networking and Storage

• Fundamentals of container networking
• Bridge networking mechanisms
• Exposing ports externally
• Facilitating communication between containers
• Utilizing bind mounts and volumes
• Managing persistent data within containers
• Backup strategies and considerations

Hands-on Exercises

• Running and inspecting containers in practice.
• Constructing an application image from scratch.
• Configuring ports and environment variables.
• Publishing an image to a registry.
• Storing persistent data outside the container boundary.

Day 2 – Kubernetes Architecture and Workloads

Kubernetes Fundamentals

• The necessity of container orchestration
• Overview of Kubernetes architecture
• Components of the control plane
• Functionality of worker nodes
• The API server role
• The scheduler mechanism
• Controllers and their functions
• Distinguishing cluster state from desired state
• Interacting with the cluster via kubectl

Kubernetes Resources

• Pods
• ReplicaSets
• Deployments
• Namespaces
• Labels and annotations
• Selectors for resource targeting
• Declarative resource definition approaches
• Working with YAML manifests

Deploying Applications

• Creating and managing Deployments
• Scaling workloads horizontally or vertically
• Updating container images
• Executing rolling updates
• Performing rollbacks to previous versions
• Tracking deployment history
• Restarting workloads as needed
• Managing application replica counts

Application Configuration

• Utilizing ConfigMaps for configuration data
• Securing sensitive data with Secrets
• Injecting environment variables
• Managing external configuration files
• Decoupling application code from configuration settings
• Handling environment-specific configurations

Resource Management

• Defining CPU and memory requests
• Setting CPU and memory limits
• Enforcing resource quotas per namespace
• Applying limit ranges for default constraints
• Understanding scheduling implications of resource settings
• Diagnosing failures caused by resource exhaustion

Hands-on Exercises

• Deploying a containerized application.
• Creating and modifying Kubernetes manifests.
• Scaling an application based on demand.
• Executing a rolling update and performing a rollback.
• Configuring the application using ConfigMaps and Secrets.
• Applying resource requests and limits to workloads.

Day 3 – Kubernetes Networking, Storage and Security

Kubernetes Networking

• The cluster networking model
• Enabling pod-to-pod communication
• Service discovery mechanisms
• Internal DNS resolution within the cluster
• ClusterIP services for internal access
• NodePort services for external node access
• LoadBalancer services for cloud load balancing
• Core concepts of Ingress
• Patterns for exposing applications externally

Network Policies

• Governing traffic flow between workloads
• Defining ingress and egress rules
• Implementing namespace-based traffic control
• Testing network connectivity effectively
• Troubleshooting service communication failures

Persistent Storage

• Distinguishing between ephemeral and persistent storage
• Understanding volumes in Kubernetes
• Managing PersistentVolumes (PVs)
• Using PersistentVolumeClaims (PVCs)
• Configuring StorageClasses
• Enabling dynamic provisioning of storage
• Defining and using access modes
• Applying reclaim policies for volumes
• Storage requirements for stateful applications

Kubernetes Access Control

• Foundations of authentication and authorization
• Implementing Role-Based Access Control (RBAC)
• Defining Roles and ClusterRoles
• Binding roles via RoleBindings and ClusterRoleBindings
• Managing service accounts for automation
• Adhering to the principle of least-privilege access
• Auditing effective permissions for users and accounts

Workload Security

• Configuring security contexts for pods
• Executing containers with non-root privileges
• Managing Linux capabilities
• Mounting read-only filesystems where appropriate
• Secure handling of secrets within workloads
• Verifying image provenance and integrity
• Identifying common configuration risks

Hands-on Exercises

• Exposing an application via Kubernetes services.
• Configuring Ingress resources for external access.
• Restricting traffic flow using network policies.
• Provisioning persistent storage for a workload.
• Setting up RBAC permissions for users and groups.
• Running a workload with an appropriate security context.

Day 4 – Working with OpenShift Environments

Introduction to OpenShift

• OpenShift as an enterprise-grade, Kubernetes-based application platform.
• Mapping Kubernetes resources within the OpenShift ecosystem.
• Architecture of an OpenShift cluster.
• Differentiating projects and namespaces in OpenShift.
• Managing platform users and service accounts.
• Navigating the web console interface.
• Utilizing the OpenShift command-line interface (oc).

Managing Projects and Access

• Creating and managing projects within OpenShift.
• Assigning permissions to users.
• Understanding project-level roles.
• Granting administrative access where necessary.
• Enforcing resource quotas at the project level.
• Applying limit ranges for resource constraints.
• Working with service accounts in projects.
• Auditing resources within a project.

Deploying Applications

• Deploying container images into OpenShift.
• Creating application workloads via Builds or Templates.
• Managing deployment configurations.
• Scaling applications horizontally.
• Updating application versions safely.
• Executing rollbacks for failed updates.
• Managing application configuration settings.
• Handling secrets within the OpenShift workflow.

Application Exposure

• Understanding Services in the OpenShift context.
• Configuring Routes for external access.
• Managing TLS certificates and encryption.
• Differentiating internal and external application access paths.
• Managing hostnames and certificate issuance.
• Troubleshooting common route and service issues.

Storage in OpenShift

• Managing Persistent Volume Claims (PVCs) in OpenShift.
• Utilizing StorageClasses specific to OpenShift.
• Attaching storage volumes to workloads.
• Supporting stateful workloads effectively.
• Managing storage access permissions.
• Troubleshooting volume mounting failures.

Scheduling and Node Management

• Using labels and selectors for targeting.
• Applying node selectors to direct workloads.
• Utilizing taints and tolerations for exclusion.
• Understanding affinity and anti-affinity rules.
• Controlling workload placement on nodes.
• Cordoning and draining nodes for maintenance.
• Best practices for node maintenance procedures.

Hands-on Exercises

• Accessing an OpenShift environment via CLI or web console.
• Creating and configuring a new project.
• Deploying and exposing an application within the cluster.
• Configuring access for users and service accounts.
• Attaching persistent storage to a running workload.
• Scaling and updating a deployed application.

Day 5 – Operations, Monitoring and Troubleshooting

Platform Monitoring

• Monitoring overall cluster and application health.
• Analyzing resource metrics for utilization trends.
• Assessing node health status.
• Evaluating workload status indicators.
• Monitoring capacity and resource utilization rates.
• Identifying performance bottlenecks and constraints.

Logging and Events

• Accessing container logs directly.
• Retrieving pod-level logs.
• Reviewing previous container logs for historical context.
• Analyzing Kubernetes events for cluster activities.
• Interpreting application and platform messages.
• Filtering and analyzing operational data for insights.

Health Checks

• Configuring startup probes for initialization delays.
• Implementing readiness probes for service availability.
• Setting up liveness probes to detect hangs.
• Designing effective health check endpoints.
• Diagnosing probe failure scenarios.
• Mitigating unnecessary application restarts.

Troubleshooting Workloads

• Investigating pods stuck in Pending state.
• Resolving image pull failures.
• Diagnosing CrashLoopBackOff errors.
• Correcting misconfigured environment variables.
• Troubleshooting failed volume mounts.
• Addressing insufficient resource allocation.
• Resolving permission denied errors.
• Diagnosing service and route connectivity issues.
• Resolving DNS resolution problems.
• Investigating application startup failures.

Operational Security

• Auditing existing permissions for compliance.
• Evaluating service account usage patterns.
• Ensuring secure handling of credentials.
• Implementing image security best practices.
• Enforcing network isolation policies.
• Auditing platform access logs.
• Reinforcing the principle of least privilege.

Maintenance and Lifecycle Management

• Conducting routine platform health checks.
• Performing node maintenance tasks safely.
• Planning for application data backups.
• Backing up cluster configuration data.
• Strategic planning for platform updates.
• Implementing change management protocols.
• Testing updates in a staging environment.
• Planning rollback strategies for update failures.
• Understanding disaster recovery concepts and plans.

Final Practical Workshop

Participants will complete an end-to-end operational scenario integrating all learned concepts:

• Building and tagging a container image.
• Publishing the image to a designated registry.
• Deploying the application to either Kubernetes or OpenShift.
• Configuring application settings and injecting credentials.
• Exposing the application for internal or external use.
• Attaching persistent storage for data retention.
• Configuring appropriate access permissions.
• Implementing health checks for reliability.
• Scaling and updating the application in production.
• Diagnosing and resolving an intentionally introduced failure.

Course Format

• Interactive lectures complemented by technical discussions.
• Demonstrations conducted by the instructor.
• Extensive hands-on exercises for skill reinforcement.
• Scenario-based administration and troubleshooting workshops.
• Practical application work within real container, Kubernetes, and OpenShift environments.

Course Customization Options

• The curriculum can be adapted to align with the participant's existing infrastructure, cloud provider choices, and preferred container tooling.
• The depth of coverage for Docker, Kubernetes, and OpenShift topics can be adjusted based on the team's prior experience levels.
• Practical exercises can be customized to reflect the organization's specific applications, deployment pipelines, and operational requirements.

Trademark Notice

OpenShift is a registered trademark of Red Hat, Inc. This training program is independently developed and is not affiliated with, endorsed by, or authorized by Red Hat.