Container: a set of processes with view-level isolation, restricted resource utilization and separate file systems. Similar to virtual machines but with a lighter weight, containers can share the operating systems between applications. "View-level isolation" means that only part of the processes is visible and that these processes have independent hostnames. The restriction on resource utilization may involve the memory size and CPU count. Common container engines include Docker, Containerd, etc.
Image: a special file system. In addition to programs, libraries, resources, and other files required for a container to run, it also contains some configuration parameters (such as environment variables) prepared for running. An image is a template for a container, while a container is an instance of an image. The image is static, while the container is dynamic. A repository image is the image stored in the image repository, and a node image is the image stored on the cluster node.
Repository: a place for centrally storing and distributing container image files. It is divided into public repositories and private repositories.
Cluster: specifically refers to the container cluster, i.e., a Kubernetes (k8s for short) cluster or an enterprise-customized cluster derived from Kubernetes (such as the Openshift cluster). Multiple servers managed by a set of Kubernetes systems form a cluster. Kubernetes is a container orchestration and management system. It provides functions such as service discovery, elastic scaling, load balancing, and fault self-healing. Kubernetes divides the servers in a cluster into Master (control node) and Node (computing node). The Master runs a group of processes related to cluster management, such as etcd, kube-apiserver, kube-controller-manager, and kube-scheduler. These processes realize the management capabilities of the entire cluster, such as resource management, pod scheduling, elastic scaling, security control, system monitoring and error correction, and all of them are fully automatic. As a computing node in the cluster, the Node runs upper-level service applications, and the pod is the smallest running unit managed by Kubernetes on the Node. The Node runs the service processes such as kubelet and kube-proxy of Kubernetes. These processes create, start, monitor, restart, and destroy pods, and realize the software-mode load balancer.
Node: the basic elements of a container cluster. The node can be run on a virtual machine or a physical machine, depending on the services. Each node contains the basic components required to run the pod, including Kubelet, Kube-proxy, Container Runtime, etc.
Namespace: a mechanism provided by Kubernetes that divides resources in the same cluster into isolated groups. The resources in the same namespace must have a unique name, but this is not required for resources in different namespaces. In actual use, you can create the corresponding namespace for different users, tenants, environments, or projects, such as creating namespaces for the test, dev, and pro environments.
Pod: the smallest deployable unit that can be created, scheduled, and managed in Kubernetes. Pods are a collection of containers rather than individual application containers. Containers in the same pod share the same network namespace, IP address, and port space. Like individual application containers, pods are considered to be relatively ephemeral (rather than durable) entities. Pods are created, assigned a unique ID (UID), and scheduled to nodes where they remain until termination or deletion. If a node fails, the pods scheduled to that node are scheduled for deletion, after a timeout period.
Workload: an application running on Kubernetes. Kubernetes provides a variety of built-in workload resource types such as Deployment, StatefulSet, and DaemonSet.
Service: an important concept in Kubernetes, which mainly provides load balancing and automatic service discovery. When a Service resource is created, a unique IP address (cluster IP) is assigned and remains in the entire life resource of the Service. Once a Service is created, the entire IP cannot be modified.
Ingress: exposes services to external applications and enables access to services in the Kubernetes cluster from the outside. This resource object defines the association of different domain names and URLs with their corresponding back-end services (Kubernetes Service).
Endpoint: a resource object in the Kubernetes cluster stored in ETCD, which records the access addresses of all pods corresponding to a Service.
Secrets: store and manage some sensitive data in Kubernetes, such as passwords, tokens, keys, and other sensitive information. They store the encrypted data that the pod wants to access to the ETCD, allowing users to access the information stored in the Secret by mounting Volume or environment variables in the pod's container.
PV and PVC: to better support the data storage of stateful applications, Kubernetes also provides PV, PVC and StorageClass resource objects to manage the storage. PV is short for Persistent Volume. It is an abstraction of the underlying data storage. PV is created, maintained, and configured by an administrator. PVC is short for Persistent Volume Claim. If we compare PV to an interface that encapsulates our underlying data storage, then, the PVC can call the interface to realize data storage operations, and PVC consumes the resources of PV.
Label: a key/value pair that distinguishes resource objects such as workload, pod, Service, RC, etc. Each resource object can have multiple Labels, but the key of each Label can only correspond to one value.
Software Package: a program or a group of programs that have specific functions and are used to complete specific tasks. It can be divided into application software packages and system software packages.
Process: a running activity of a computer program on a certain data set. It is the basic unit of resource allocation and scheduling in the system and the basis of the operating system structure. In the modern computer architecture of thread-oriented design, the process is the container of threads. A program is the description of instructions, data, and their organizational forms, and a process is the entity of a program.
Port: an outlet for equipment to communicate with the outside world. Here, the port refers to the virtual container ports and node ports that are exposed for external access, such as port 80 of the container.
Running Application: an application running on a container, including Web services, databases, middleware, and other application categories.
Software Framework: a software component specification that implements an industry standard or completes a specific basic task. It also refers to a software product that provides the basic functions required by the specification when implementing a software component specification. The function of the framework is similar to that of the infrastructure, which is irrelevant to the specific software application. However, it provides and implements the most basic software architecture and system.
Web Site: a web service based on XML and HTTPS. Its communication protocol is mainly based on SOAP. The description of the service discovers and obtains the metadata of the service through WSDL and UDDI.
Web Service: a service-oriented architecture technology that provides services through standard Web protocols. The aim is to ensure that application services on different platforms can be interoperable.
Route: a recommended method in OpenShift. A route uses a unique URL public service to access the service from outside the cluster (that is, from somewhere other than the cluster nodes). Routes match the request rules of the client and are assigned to the Service layer after the match is successful. A route points to a Service, and a Service can be pointed to by multiple routes with different rules.
Service Account: typically an account that identifies and manages a service entity in a computer system, cloud service, or network.

Container Security Guard

Basic Concepts