liveBookmanning.com

What you will learn in Google Anthos in Action

Manage hybrid and multi-cloud Kubernetes clusters

by Antonio Gulli

Read it on liveBook Get the book at manning.com

Chapter by chapter

Concepts explained in this book

• load balancerA network load balancer is a Layer 4 load balancer that distributes TCP traffic using network-level forwarding and addresses.
• vpc-native clusterVPC-native mode is a cluster networking configuration in which cluster IP addresses are assigned from a virtual private cloud network.
• network policyA network policy is a configuration that controls which network connections are permitted between workloads or network endpoints.
• subnetworkAn IP subnet is a contiguous range of IP addresses defined by a network prefix for assigning and routing network addresses.
• MultiClusterIngressMulticluster Ingress is a Google-hosted controller that deploys shared HTTP(S) load-balancing resources across multiple GKE clusters and regions.
• network endpoint groupA network endpoint group is a collection of backend network endpoints or services to which Google Cloud load-balancing traffic can be routed.
• CalicoCalico is an open-source networking and network-security solution for containers, virtual machines, and host-based workloads.
• clusterip service typeA ClusterIP is a stable, cluster-internal virtual IP address assigned to a Kubernetes Service.
• container-native load balancingContainer-native load balancing sends load-balancer traffic directly to pod endpoints instead of routing it through cluster nodes.
• Dataplane v2Dataplane V2 is a GKE networking dataplane architecture based on eBPF and Cilium for implementing pod networking and network policy.
• gke dataplane v1GKE Dataplane v1 is the GKE networking implementation based on kube-proxy, iptables, and Calico.
• internal load balancingAn internal load balancer distributes traffic originating within a Google Cloud VPC network to cluster nodes or workloads.
• layer-7 load balancerA layer 7 load balancer routes application traffic using information from protocols such as HTTP.
• pod ip addressA pod IP address is the network address assigned to a Kubernetes pod for communication within its cluster.
• routes-based clusterA routes-based cluster is a GKE cluster whose pod networking relies on Google Cloud routes rather than native VPC pod addresses.
• Cloud Service MeshCloud Service Mesh is Google's managed service mesh for controlling, securing, and observing communication among distributed services, formerly known as Anthos Service Mesh.
• Anthos on bare metalAn Anthos cluster on bare metal is an Anthos Kubernetes cluster running directly on physical servers without virtualization.
• Anthos Config ManagementAnthos Config Management is a Google Anthos component for centrally applying policy and configuration to clusters and services.
• labelA Kubernetes label is a key-value metadata pair attached to a resource for identification, organization, and selection.
• Migrate to ContainersMigrate to Containers, formerly Migrate for Anthos, is a Google Cloud tool that converts applications from virtual machines or traditional environments into containerized workloads for Kubernetes.
• shared vpc modelA shared VPC is a Google Cloud networking arrangement in which resources in service projects use networks owned by a host project.
• AnthosAnthos is Google Cloud's platform for managing and deploying applications consistently across on-premises and multiple cloud environments.
• constraintA Gatekeeper constraint is a custom resource that instantiates a constraint template and specifies the resources to which its policy applies.
• Config ConnectorAnthos Config Connector is a Kubernetes-based configuration tool that represents Google Cloud resources as declarative Kubernetes objects.
• multiple repository modeenableMultiRepo is an Anthos Config Management configuration flag that enables synchronization from multiple repositories.
• GatekeeperGatekeeper is an open-source Kubernetes admission-control system that uses Open Policy Agent policies to validate and enforce resource constraints.
• monolithic architectureA monolithic application is an application whose major capabilities are implemented and deployed as one largely indivisible unit.
• tolerationA Kubernetes toleration is pod scheduling configuration that permits a pod to be placed on a node with a matching taint.
• virtual ip addressA virtual IP address is a logical network address that can be assigned to a service or endpoint independently of a particular physical interface or host.
• namespaceA namespace is a Kubernetes logical partition that scopes and organizes namespaced resources within a cluster.
• ConstraintTemplateA constraint template library is a collection of reusable Gatekeeper templates that define policy constraints and their validation logic.
• Policy ControllerPolicy Controller is a Kubernetes policy-enforcement component that evaluates and enforces organizational policies on cluster resources.
• admission controllerAn admission controller is a Kubernetes component that intercepts API requests after authentication and authorization and can validate or mutate them before persistence.
• taintA Kubernetes node taint is a key-value restriction on a node that repels pods lacking a matching toleration.
• node selectorA Kubernetes node selector is pod scheduling configuration that restricts placement to nodes having specified labels.
• legacy systemA legacy system is an existing application or technology that remains in use despite limitations from its age, design, or support model.
• privileged containerA privileged container is a container granted broad host-level capabilities, kernel access, and device access through privileged mode.
• sidecar processA sidecar is a container deployed alongside a main container in the same Pod to provide supporting functionality such as proxying.
• bmctlbmctl is a command-line tool and binary executable for deploying and managing Anthos clusters on bare-metal infrastructure.
• dry runDry-run is an enforcement mode that reports policy violations without blocking the operation that caused them.
• Google Cloud consoleGoogle Cloud console is Google's web-based interface for viewing and managing Google Cloud resources and services.
• unstructured modeUnstructured mode is an Anthos Config Management configuration mode in which resources are assigned explicitly to selected namespaces without a required namespace hierarchy.
• affinityNode affinity is a Kubernetes scheduling constraint that selects nodes through label expressions and required or preferred matching behavior.
• cluster selectorA ClusterSelector is an Anthos Config Management selector that determines which clusters a configuration or policy applies to.
• serviceA Kubernetes Service is a resource that provides a stable network endpoint for accessing workloads within a cluster.
• cloud-native network functionA cloud-native network function (CNF) is a telecommunications network function designed to run as modular, containerized software on cloud-native infrastructure.
• role-based access controlRole-based access control (RBAC) is an authorization model that grants permissions according to roles assigned to users or other principals.
• namespace selectorA NamespaceSelector is an Anthos Config Management object that selects namespaces by matching their Kubernetes labels.
• anti-affinityPod anti-affinity is a Kubernetes scheduling constraint that prevents a pod from sharing a selected topology domain with matching existing pods.
• Anthos Identity ServiceAnthos Identity Service is an Anthos component that integrates external identity providers for authenticating users to clusters.
• cluster nodeA Kubernetes node is a machine that provides compute resources for running pods in a Kubernetes cluster.
• topology keyA topology key is a Kubernetes pod-affinity field that identifies the node-label domain, such as a hostname or zone, used for comparing placement.
• modernization initiativeModernization is the transformation of existing applications or infrastructure to take advantage of current software platforms and operational practices.
• migration planA migration plan is a configuration describing how an application is to be transformed and migrated from its source environment.
• hierarchy repositoryA hierarchy repository is an Anthos Config Management policy repository whose directory structure expresses configuration purpose, scope, and namespace inheritance.
• VPC peeringVPC Network Peering is a cloud networking capability that privately connects separate virtual private cloud networks by exchanging routes.
• Hierarchy ControllerHierarchy Controller is a Kubernetes controller that provides hierarchical namespaces, inheritance, and object replication between parent and child namespaces.
• roleA Kubernetes Role is a namespace-scoped RBAC resource that defines permissions on resources.
• persistent volumeA persistent volume is a Kubernetes resource representing storage provisioned for use by workloads independently of a pod's lifecycle.
• node poolA node pool is a group of Kubernetes worker nodes managed together with shared configuration and machine characteristics.
• clusterroleA ClusterRole is a Kubernetes RBAC resource that defines permissions at cluster scope.
• namespace exemptionA namespace exemption is a configuration that excludes resources in a Kubernetes namespace from specified policy processing.
• policy engineA policy engine is a software evaluation system that decides whether requests satisfy declarative rules.
• uptimeHigh availability is the property of a system remaining operational with minimal interruption despite component failures or maintenance.
• label selectorA Kubernetes selector is a label-based condition for identifying resources or choosing eligible nodes or workloads.
• user clusterA user cluster is a GKE on-prem Kubernetes cluster that runs application workloads under the administration of an admin cluster.
• podA pod is the smallest deployable unit in Kubernetes, grouping one or more containers with shared networking and storage.
• node-local persistent volumeA local persistent volume is storage backed by a disk or filesystem on a particular Kubernetes node and therefore tied to that node's availability.
• rootA root user is a Unix or Linux account with unrestricted administrative permissions over the operating system.
• Kubernetes clusterA Kubernetes cluster is a set of coordinated computing nodes managed by Kubernetes to run containerized workloads and services.
• containerizationContainerization is the process of packaging an application and its dependencies into containers for portable execution.
• cloud landing zoneA cloud landing zone is a foundational cloud environment configured with standardized identity, networking, security, governance, and billing controls.
• deployment pipelineA CI/CD pipeline is an automated workflow that moves software changes through integration, validation, and delivery stages from source to production.
• GitOpsGitOps is an operational model that manages system configuration and deployments declaratively from version-controlled repositories.
• standalone cluster deploymentA standalone cluster is an Anthos on bare metal deployment arrangement operated independently rather than as part of an admin-and-user cluster topology.
• resource limitA Kubernetes resource quota is a namespace-scoped control that limits the aggregate resource consumption of objects in a namespace.
• Kubernetes manifestA Kubernetes manifest is a structured configuration document that declares one or more Kubernetes resources and their desired settings.
• logLogging is the recording of system and application events for analysis, troubleshooting, and auditing.
• strangler patternThe strangler fig pattern incrementally replaces parts of a legacy system with new implementations until the legacy system is reduced or removed.
• multicluster deploymentA hybrid cluster deployment is an Anthos on bare metal topology that runs user workloads on an admin cluster while managing other user clusters.
• DockerfileA Dockerfile is a text configuration file containing instructions for building a Docker container image.
• VPCA virtual private cloud (VPC) is an isolated virtual network that provides address ranges, routing, and connectivity for cloud resources.
• cluster role bindingA ClusterRoleBinding is a Kubernetes RBAC resource that grants a ClusterRole's permissions across the cluster.
• configmapA ConfigMap is a Kubernetes resource that stores non-confidential configuration data separately from container images.
• endpoint sliceAn EndpointSlice is a Kubernetes resource that contains a subset of network endpoints for a Service.
• Kubernetes SecretA Kubernetes Secret is a resource for storing data intended to be confidential or sensitive for use by workloads.
• RoleBindingA RoleBinding is a Kubernetes RBAC resource that grants the permissions of a role to users, groups, or service accounts within a namespace.
• serverless computingA serverless workload is an application workload whose infrastructure provisioning and capacity management are handled by a platform rather than directly by its operator.
• Cloud InterconnectPartner Interconnect is a Google Cloud connectivity option that connects an external network to Google's network through a supported service provider.
• Cloud VPNCloud VPN is a Google Cloud service that connects peer networks through encrypted IPsec VPN tunnels over the public internet.
• routingTraffic routing is the directed selection of destinations for network requests according to routing rules or release-management criteria.
• migrationMigration is the process of moving workloads or applications from one execution environment or deployment model to another.
• Cloud BuildCloud Build is a Google Cloud service that executes automated build, test, and deployment steps from source code.
• backup and restoreA backup is a stored copy of data or system state that can be used for recovery after loss or failure.
• Knative EventingKnative Eventing is the Knative component that obtains events from sources, routes them through brokers and triggers, and delivers them to targets.
• network interfaceA network interface is a software or hardware connection through which a computing workload sends and receives network traffic.
• virtual network functionA virtual network function (VNF) is a telecommunications network function implemented as software running on virtualized computing infrastructure.
• IPsec VPNAn IPsec VPN tunnel is an encrypted tunnel using IPsec to carry traffic between peer networks.
• contractAn API is a defined interface through which software components communicate and access capabilities or data.
• software upgradeCluster upgrading is the process of changing a cluster's software or platform components to a newer version.
• containerA containerized application is an application packaged to run inside one or more containers with its required dependencies.
• Kubernetes schedulerThe Kubernetes scheduler selects suitable nodes for newly created pods according to resource availability and scheduling constraints.
• admin clusterAn admin cluster is the GKE on-prem cluster that provides administrative Kubernetes control-plane services for user clusters.
• GKE on-premGKE on-prem is Google's Kubernetes platform for running Anthos-managed clusters on customer-controlled infrastructure.
• RootSyncRootSync is an Anthos Config Management object that specifies how configuration is synchronized from a root repository in multiple repository mode.
• Anthos VM RuntimeAnthos VM Runtime is an Anthos capability for running virtual-machine workloads on Kubernetes clusters.
• multi-NIC podA multi-NIC pod is a Kubernetes pod configured with multiple network interfaces.
• Multus CNI pluginMultus CNI is a Kubernetes container network interface plugin that attaches multiple network interfaces to a pod.
• NetworkAttachmentDefinitionA NetworkAttachmentDefinition is a Kubernetes custom resource that describes an additional network available for pod attachment.
• SR-IOVSR-IOV is a PCI Express virtualization technology that lets a physical device expose multiple virtual interfaces for direct assignment to workloads.
• Connect GatewayConnect Gateway is an Anthos capability that provides authenticated access to registered clusters through Google Cloud.
• policy directoryA policy directory is a directory of declarative policy and configuration files that specifies the desired state of managed clusters.
• GKE ConnectGKE Connect is an Anthos component that connects external Kubernetes clusters to Google Cloud for centralized registration and management.
• island modeIsland mode is a cluster networking configuration in which workloads can communicate within a cluster but are isolated from external network access.
• microservice architectureA microservices architecture structures an application as independently deployable services that communicate over a network.
• network host projectA network host project is the Google Cloud project that owns and centrally administers a shared VPC network and makes it available to attached service projects.
• service projectA service project is a Google Cloud project whose resources use networking provided by a shared VPC host project.
• gkeadmingkeadm is the GKE on-prem command-line tool for creating and upgrading an admin workstation.
• gkectlgkectl is the GKE on-prem command-line tool for creating, validating, scaling, upgrading, and managing clusters.
• container imageA Docker image is an immutable package containing a filesystem and metadata used to create Docker containers.
• control plane nodeA control plane is the Kubernetes cluster layer that stores cluster state, accepts requests, schedules workloads, and runs controllers.
• persistent volume claimA PersistentVolumeClaim is a Kubernetes resource through which a workload requests storage with specified capacity and access properties.
• statefulnessA stateful application retains client-session or other operational state that can affect subsequent requests.
• StatefulSetA Kubernetes StatefulSet is a resource that manages replicated pods with stable identities and persistent storage associations.
• stateless systemA stateless application does not retain client-session state between requests.
• mutual TLSMutual TLS (mTLS) is a Transport Layer Security configuration in which both communicating parties authenticate each other with certificates and encrypt the connection.
• continuous integrationContinuous integration is a software development practice in which code changes are frequently integrated into a shared codebase and validated by automated builds and tests.
• flat networkA flat network architecture is a network design in which participating clusters share a common network address space or network fabric.
• single VPCA single VPC design places resources in one virtual private cloud and provides one flat network space.
• abstract namespaceAn abstract namespace is an Anthos Config Management grouping of one or more actual Kubernetes namespaces that share inherited objects.
• telemetryTelemetry is automatically collected information about system or service behavior, including metrics, logs, and traces.
• circuit breaker patternA circuit breaker is a distributed-systems fault-isolation mechanism that temporarily stops requests to an failing or unavailable service.
• system boundaryA service boundary is the defined separation around a service's responsibilities, data, and independently deployable behavior.
• multi-cloud deploymentA multicloud platform is a platform designed to operate across multiple independent cloud environments.
• kubernetes api serverkube-apiserver is the Kubernetes control-plane component that exposes and processes the Kubernetes API.
• service meshA service mesh is an infrastructure layer that manages communication, traffic, security, and observability for distributed services.
• Minikubeminikube is an open-source tool that runs a local Kubernetes cluster for developing and testing applications.
• control loopA control loop repeatedly compares a resource’s desired state with its current state and takes corrective action to reconcile them.
• Knative ServingKnative Serving is the Knative component for deploying, serving, and routing serverless workloads packaged as containers.
• Cloud BuilderA cloud builder is a container image packaged to run a particular build or deployment tool within Cloud Build.
• cloudbuild.yamlcloudbuild.yaml is a Cloud Build configuration file that declares the steps and parameters of a build pipeline.
• gke-deploygke-deploy is a Cloud Build builder that deploys Kubernetes resources to Google Kubernetes Engine while applying Google-recommended practices.
• traffic splittingTraffic splitting is the controlled distribution of requests among service versions or destinations according to configured proportions or rules.
• continuous developmentContinuous development is a software development practice that automatically rebuilds, redeploys, and previews application changes during development.
• traffic managementTraffic management is the control of how network requests are routed, distributed, delayed, or faulted across service instances and application versions.
• infrastructure as codeInfrastructure as Code is the practice of defining and managing computing infrastructure through machine-readable configuration rather than manual procedures.
• policyA policy is a declarative rule that specifies required behavior, configuration, or access conditions for managed resources.
• CI/CD serverA CI/CD platform is an integrated set of services and tools that automates software integration, testing, delivery, and deployment workflows.
• multi-cluster setupA multicluster setup is an architecture that distributes workloads or environments across multiple Kubernetes clusters.
• authenticationAuthentication is the process of verifying the identity of a user, service, or other system actor.
• zero-trust networkingA zero-trust policy requires each access request to be explicitly authenticated and authorized instead of trusting a network location by default.
• automatic sidecar injectionAutomatic sidecar injection is the admission-time addition of a proxy sidecar to newly created pods based on cluster configuration.
• multitenancyMultitenancy is an architecture in which multiple teams or tenants share a platform while retaining logical separation of their workloads and resources.
• container registryA Docker registry is a service that stores and distributes Docker container images.
• modern applicationA software application characterized by qualities such as interactivity, low latency, connectivity, intelligence, context awareness, reliability, security, and cross-device usability.
• TLSTransport Layer Security is a cryptographic protocol that protects network communications with confidentiality, integrity, and endpoint authentication.
• trajectoryA rollout is the controlled deployment of a new application or service version and its progression toward the intended state.
• RepoSyncA RepoSync is an Anthos Config Management resource that synchronizes a repository's configuration into a namespace.
• Knative ServiceA Knative Service is a resource that defines and manages a deployable serverless application, including its configuration, revisions, and traffic route.
• single pane of glassA single pane of glass is a unified interface that presents and manages resources across multiple environments, providers, clusters, or tenants.
• Google Distributed Cloud EdgeGoogle Distributed Cloud Edge is a fully managed Google solution that delivers hardware, operating systems, and software for telco network functions and edge applications at customer locations.
• hybrid deploymentA hybrid cloud deployment operates a platform across a public cloud and one or more on-premises data centers.
• Kubernetes resourceA Kubernetes resource, also called a Kubernetes object, is an API-managed representation of a desired or observed cluster entity and its state.
• canary deploymentA canary deployment is a release strategy that exposes a new version to a small portion of traffic before expanding its availability.
• EnvoyEnvoy is an open-source, high-performance proxy designed for service-to-service communication and distributed application networking.
• self-healing mechanismSelf-healing is the automatic detection and recovery from defined failures or unhealthy operating conditions.
• virtual networkAn Azure virtual network is an isolated virtual network in Microsoft Azure that provides connectivity for cloud resources.
• Kubernetes worker nodeA worker node is a Kubernetes cluster node that reports available resources, runs container workloads, and maintains node network rules.
• SkaffoldSkaffold is a command-line tool that facilitates continuous development for containerized applications by automating build, deploy, and feedback workflows.
• Skaffold configuration fileA Skaffold configuration file is a YAML document that defines Skaffold build, deployment, and development workflow steps.
• classless inter-domain routingA CIDR block is an IP address range represented with Classless Inter-Domain Routing prefix notation.
• host portionHost bits are the portion of an IP address that identifies individual addresses within a network prefix.
• ip address managementIP address management is the planning, allocation, tracking, and reuse of network addresses and address ranges.
• IP maskingIP masquerading rewrites the source address of network traffic so that it appears to originate from another address, commonly a node address.
• ipv4 address exhaustionIP exhaustion is the condition in which an address pool no longer contains enough available IP addresses for required resources.
• ServiceCIDRA Service IP CIDR is the address range from which cluster IP addresses are allocated to Kubernetes Services.
• service-level objectiveA service-level objective is a target value or range for a service-level indicator that expresses an expected level of service performance.
• Kubernetes EngineGoogle Kubernetes Engine is Google Cloud's managed Kubernetes service for running containerized workloads.
• physical serverA physical server is a dedicated computer whose hardware directly provides computing resources for running operating systems and applications.
• KnativeKnative is an open-source platform that extends Kubernetes for deploying and running cloud-native workloads, including serverless applications.
• enforcement actionAn enforcement action is a policy configuration that determines how violations are handled, such as by auditing or denying a request.
• declarative configurationA declarative model specifies the desired configuration of resources, leaving the system to determine and perform the actions needed to reach it.
• service accountA Kubernetes service account is a namespace-scoped Kubernetes identity that supplies credentials and permissions to workloads or users.
• breaking changeA breaking change is a modification to an interface or behavior that can cause existing dependent clients or services to fail.
• blast radiusBlast radius is the scope of components, users, or functionality affected by a failure or operational change.
• cloud elasticityElasticity is the ability to automatically adjust resources or service capacity in response to changing demand.
• domainA business domain is a bounded area of business knowledge, rules, data, and capabilities addressed by software.
• GDCE zoneA GDCE zone is a physical rack or group of racks sharing space, power, cooling, and a contiguous network fabric as a single failure domain.
• interconnectAn interconnect is a bundled logical link composed of one or more physical links between GDCE and a customer network.
• interconnect attachmentAn interconnect attachment is an isolated virtual link provisioned over an interconnect between a GDCE network and a customer network.
• machineA machine is a GDCE resource representing a physical server assigned to a region according to the location of the GDCE system.
• routerA router is a virtual routing instance that configures routing functions for a network in a GDCE zone.
• subnetworkA subnetwork is a layer-2 VLAN subnet within a GDCE virtual network with its own broadcast domain and customer-assigned address range.
• VPN connectionA VPN connection is a configured encrypted logical connection between a GDCE environment and a Google Cloud project.
• instrumentationInstrumentation is the inclusion of code or integrations that emit measurements and diagnostic signals about software execution.
• modern architectureModern architecture is a software architecture approach emphasizing modular services, independent deployment, automation, and scalable operation.
• unit testUnit testing is the practice of testing an isolated software unit, such as a function, class, or module, against expected behavior.
• container breakoutA container breakout is an escape from a container's isolation that enables access to the host system or resources outside the container.
• migration fit assessment toolmfit is a command-line utility that collects workload data, assesses migration suitability, and generates fit assessment reports.
• node portNodePort is a Kubernetes Service type that exposes a service through a port on each cluster node.
• channelA Knative channel is an event-delivery buffer that can use in-memory or persistent storage while events are processed.
• Knative Eventing BrokerA Knative Eventing Broker is an event-ingress resource that receives events and makes them available for filtering and delivery to consumers.
• cluster managementCluster management is the administration, configuration, monitoring, and lifecycle control of a computing cluster.
• data-collection scriptA data-collection script is a script that gathers operating-system, process, service, and package information from a workload environment.
• fit assessment processA fit assessment process is a structured procedure for discovering workload characteristics, evaluating migration suitability, and reporting results.
• guest-level data collectionGuest-level data collection is the gathering of operating-system and workload information by running a collection script inside a virtual machine.
• migctlmigctl is the command-line utility for configuring, executing, and monitoring Migrate to Containers migrations.
• authorization decisionAuthorization is the process of determining which actions or resources an authenticated actor is permitted to access.
• Knative RevisionA Knative Revision is an immutable snapshot of a workload's container version and configuration that defines a deployable serving version.
• autoscalingScaling is the adjustment of computing resources or system capacity to handle changing workload demand.
• security policyA security policy is a set of rules governing the protection of systems, applications, and data from unauthorized access or harmful activity.
• GKE on AWSGKE on AWS is Google's managed Kubernetes distribution that runs cluster control and worker components on Amazon Web Services infrastructure.
• egress gatewayAn egress gateway is a service-mesh gateway that receives traffic leaving the mesh and forwards it to external destinations.
• kubeconfigA kubeconfig is a configuration file containing the connection details, credentials, and contexts that Kubernetes client tools use to access clusters.
• security contextA Kubernetes security context is a pod or container specification field that controls identity, privilege, and filesystem security settings at runtime.
• anthos-gkeanthos-gke is a command-line binary for installing and managing GKE on AWS environments.
• Migrate to Virtual MachinesMigrate to Virtual Machines, formerly Migrate for Compute Engine, is a Google Cloud service for migrating virtual machines from on-premises or other cloud environments to Compute Engine.
• CloudEventsCloudEvents is an open standard for describing event data in a common, interoperable format.
• event adapterAn event adapter is a component that understands a source-specific event format and translates it into CloudEvents.
• event-driven architectureEvent-driven architecture is a software architecture in which components communicate and initiate processing through events.
• event sourceAn event source is a component that obtains events from an authoritative system and delivers them to Knative Eventing.
• triggerA Knative Trigger is an eventing resource that filters brokered events and routes matching events to a target.
• PodSecurityPolicyPodSecurityPolicy is a deprecated Kubernetes API resource for enforcing security constraints on pods.
• observabilityObservability is the ability to understand a system's internal state from the outputs it produces, such as metrics, logs, and traces.
• tiered telemetry approachA tiered telemetry approach is an observability design that combines telemetry collection and analysis across multiple systems or provider layers.
• Cloud CodeCloud Code is a Google Cloud plug-in that integrates Kubernetes and cloud-native application development workflows into supported development environments.
• KubernetesKubernetes is an open-source platform for orchestrating and automating containerized workloads and infrastructure.
• admin workstationAn admin workstation is a management machine from which GKE on-prem admin and user clusters are installed and operated.
• continuous deliveryA continuous delivery pipeline is an automated sequence of steps that builds, tests, and deploys software while keeping changes releasable.
• multicluster networkingMulticluster networking is networking that enables communication among services or workloads in multiple Kubernetes clusters.
• GCP projectA Google Cloud project is an administrative container that holds configuration settings, resources, and access controls for applications using Google Cloud services.
• workload placementWorkload placement is the scheduling of application workloads onto computing nodes according to resource, location, and policy requirements.
• Knative ConfigurationA Knative Configuration is a custom resource that declares the desired configuration of a workload independently from its container code.
• ingress controllerAn ingress controller is a Kubernetes control-plane component that implements Ingress routing rules for incoming traffic.
• application modernizationThe process of updating existing or creating new applications according to modular, portable, and automated architectural and operational principles.
• cloud native application developmentAn approach to developing, updating, and operating modular services on distributed infrastructure or cloud environments.
• service VIPA service VIP is a virtual IP address that provides a routable network endpoint for a service.
• securitySecurity is the protection of applications, services, and data against unauthorized access, misuse, disruption, or compromise.
• study designA/B testing is an experimentation technique that compares multiple variants of an application or service by exposing them to different user groups or requests.
• certificate managementCertificate management is the issuance, distribution, renewal, and control of digital certificates for authenticated secure communication.
• Cloud DeployCloud Deploy is a Google Cloud service that automates the promotion and deployment of application releases across defined target environments.
• shared-responsibility modelA shared responsibility model is an operating model in which responsibility for infrastructure, platforms, applications, and data is divided among participating parties.
• Cloud RouterCloud Router is a Google Cloud networking resource that exchanges routes with connected peer routers using dynamic routing.
• disconnected environmentA disconnected environment is an environment whose application services cannot communicate with services in other environments.
• cloud controller managerThe cloud controller manager is a Kubernetes control-plane component that runs controllers integrating cluster operation with an underlying cloud provider.
• controller managerkube-controller-manager is the Kubernetes control-plane component that runs controllers to reconcile cluster resources toward their desired state.
• etcdetcd is a distributed, strongly consistent key-value store used to persist Kubernetes cluster state and resource data.
• non-root userA nonroot user is an operating-system identity that does not have the unrestricted administrative privileges of root.
• fleetA fleet is a Google Cloud logical grouping of clusters and other resources for centralized multicluster management, policy application, and trust relationships.
• bastion hostA bastion host is a hardened intermediary host through which administrators connect to otherwise restricted systems or management networks.
• AWSClusterAWSCluster is a custom resource representing the configuration of a GKE on AWS cluster.
• AWSNodePoolAWSNodePool is a custom resource representing the configuration of a node pool in a GKE on AWS cluster.
• GKE on AWS management serviceThe GKE on AWS management service is the administrative service that provisions and manages GKE on AWS user clusters.
• Istio ingress gatewayThe istio-ingressgateway is an Istio ingress gateway service that receives mesh traffic and routes it to services in a cluster.
• TerraformTerraform is an open-source infrastructure-as-code tool for provisioning and managing infrastructure through declarative configuration.
• Terraform providerA Terraform provider is a plugin that maps Terraform resources and operations to an external platform's provisioning API.
• Anthos UIAnthos UI is the web-based interface for viewing and managing Anthos resources through the Google Cloud console.
• anthos networkingAnthos networking is the set of networking capabilities for connecting Anthos environments, clusters, services, and clients.
• cloud networkingCloud networking is the design and operation of network connectivity among cloud-based infrastructure environments and resources.
• hybrid connectivityHybrid connectivity is network connectivity between infrastructure environments such as public clouds and on-premises data centers.
• Kubernetes operatorA Kubernetes operator is a controller pattern that automates management of an application or service by reconciling its desired state through the Kubernetes API.
• egress controlEgress control governs outgoing traffic from a service mesh to external services or networks.
• edge computingEdge is a distributed computing environment located near the users, devices, or data sources that generate or consume workloads.
• attached clusterAn attached cluster is a remotely managed conformant Kubernetes cluster registered to Anthos.
• Kubernetes DeploymentA Kubernetes Deployment is a resource that declaratively manages the desired state and rollout of replicated applications.
• privilege escalationPrivilege escalation is the acquisition of permissions or capabilities beyond those initially granted to a process or workload.
• IstioIstio is an open-source service mesh that provides traffic management, security, and observability for distributed services.
• monitoringMonitoring is the collection and analysis of system or application signals to assess operational behavior and status.
• port forwardingPort forwarding is a networking technique that maps a port on one system to a port on another service or system.
• proxyless approachA proxyless approach is a service-mesh communication model in which a service sends telemetry and communicates with the control plane without a sidecar proxy.
• Google Cloud MarketplaceGoogle Cloud Marketplace is a catalog and procurement platform for discovering, acquiring, and deploying commercial and open-source software and services on Google Cloud.
• certificate rotationCertificate rotation is the replacement and redistribution of certificates before or after they expire or become unsuitable.
• certification authorityA certificate authority is a trusted entity that issues and signs digital certificates.
• Google Cloud IAMGoogle Cloud IAM is an access-control service that manages identities, roles, and permissions for Google Cloud resources.
• Istio certificate authorityThe Istio certificate authority is the Istio component that issues workload identities through signed certificates.
• key rotationKey rotation is the periodic replacement of cryptographic keys and transition to their replacements.
• peer authenticationPeer authentication is service-to-service authentication that verifies the identity of the communicating client.
• root certificateA root certificate is a self-signed certificate that anchors a certificate authority trust chain.
• certificateA certificate is a digitally signed credential that binds an identity to a public key or other authenticated information.
• X.509 certificateAn X.509 certificate is a public-key certificate conforming to the X.509 standard format.
• minimum-footprint mentalityA minimum-footprint mentality is an operational design approach that limits a management system to explicitly designated resources rather than taking control of an entire environment.
• ingress objectIngress is a Kubernetes API resource that defines rules for routing external HTTP and HTTPS traffic to services.

These guides are generated from the text of Manning books by Manning's knowledge graph and link to the sections they draw on. The full books are available on liveBook and at manning.com.