Hi! This is Tarun, Welcome to Linux series today we will be dealing with the Standard Network OSI Model.

The OSI model Helps us to understand how the data flows from the sender to the receiver.

Before going to dive into the OSI model we have to understand 2 concepts called DNS resolution and TCP handshake where these are starting points of the Network Model.

DNS Resolution

The process of converting a Human-readable domain name (www.goole.com) into a machine Readable Ip address (93.184.216.34) so computers can locate and communicate with each other over the internet.

TCP Handshake:

It is fundamental process that establish a connection Between client and server over the TCP, before the data passage through Layers this was often refereed has 3 Way handshake.

📊 The 7 Layers of the OSI Model (Top to Bottom)

Here’s a breakdown of each layer, its function, and examples to make the concept tangible.

🔹 Layer 7: Application Layer

• Function: Provides interfaces for user-facing applications to access network services.
• Examples: Web browsers, email clients, file transfer programs.
• Protocols: HTTP, FTP, SMTP, DNS, POP3, SNMP.

🔸 Layer 6: Presentation Layer

• Function: Translates data between the application and the network. Handles encryption, compression, and data formatting.
• The translator or filter that formats and secures your data.

🔹 Layer 5: Session Layer

• Function: Establishes, maintains, and terminates communication sessions between applications.
• Examples: Managing login sessions.
• The coordinator ensuring the conversation stays on track.

🔸 Layer 4: Transport Layer

• Function: Ensures reliable data transmission with error checking, segmentation, and flow control.
• Key Concepts: Ports, TCP/UDP, sequence numbers.
• Protocols: TCP (reliable), UDP (fast but unreliable)

🔹 Layer 3: Network Layer

• Function: Handles routing and logical addressing to deliver packets across networks.
• Examples: IP addressing, packet forwarding
• Protocols: IP, ICMP, OSPF, BGP
• The GPS — figuring out the best route to send data to the destination.

🔸 Layer 2: Data Link Layer

• Function: Deals with physical addressing (MAC addresses), error detection, and frame synchronization.
• Divided into: LLC (Logical Link Control) and MAC (Media Access Control) sublayers
• Protocols: Ethernet, ARP, PPP, Switches
• Moving your data around your local network.

🔹 Layer 1: Physical Layer

• Function: Transmits raw bits over a physical medium like copper wire, fiber optics, or radio waves.
• Examples: Voltage levels, cable types, pin layout, network cards
• Devices: Hubs, cables, modems, repeaters.
• the physical path your data travels on.

After all the OSI layers it will reach through the google server then data will pass trough L1 TO l7 at the receiver side and provides the output to the sender.

That's all for Day! Please like and follow for more content.

Thank you! Happy Reading😊

Hi! This is Tarun, Welcome to Linux series today we will discussing about the important topic in Linux that was Networking concepts.

Ip Address

It was Basically a Unique address for the devices, it allows devices to communicate with each other across the internet or local networks.

Scenario: In the Home 4 devices are connected to a local WIFI network and the devices need to access to the websites like Instagram, you tube etc. then if you want to block the particular devices for certain purpose with out the unique address for the devices then we end up blocking the access for all the devices to over come this scenraio we have a concept called Ip address.

Generally with the Ip address we will be having the unique address for every device so we can particularly block the device to get access to the websites, Ip address can be used for the Tracking and Tracing of the devices.

Ip address follows the Ipv4/Ipv6 Protocol and Ip address is of 4 Bytes or 32 bits Long.

📦 Types of IP Addresses

1. IPv4 (most common)

• Format: x.x.x.x (where each x is a number from 0 to 255)
• Example: 192.168.1.1
• It uses 32 bits → allows about 4.3 billion unique addresses

2. IPv6

• Format: Eight groups of four hexadecimal digits
• Example: 2001:0db8:85a3:0000:0000:8a2e:0370:7334
• Uses 128 bits → allows trillions of addresses
• Designed to replace IPv4 due to address exhaustion

🔢 IPv4 Structure

An IPv4 address has:

• 4 octets (8 bits each)
• Example:
  192.168.10.5 → in binary:
  11000000.10101000.00001010.00000101
• Each part is a byte (8 bits), so:

4×8=32 bits

Subnets:

Subnetting is the process of dividing a large IP network into smaller logical sub-networks (subnets). This helps with:

• Efficient IP address usage
• Improved network performance
• Better security and isolation

Suppose: If in a office or commercial complex employees are using the Free WIFI which was provided by the company and all the employees has the sensitive information so some malicious person enter into the enter and hacks all the information and will get access to the sensitive information of the employees so to overcome this we will create a subnet to the finical or sensitive information so the when ever or anyone want to access the subnet then the person should have the valid Ip address.

CIDR (Classless Inter-Domain Routing):

CIDR is a way to represent IP addresses and their associated subnet mask using a concise slash notation.

Format:

IP address/CIDR.

Example:

192.168.1.0/24

• Here /24 Means.
• The first 24 bits of the 32-bit IP address are the network portion
• The remaining 8 bits are for hosts

Why Use CIDR?

Before CIDR, IPs were assigned based on classes (A, B, C) which often wasted IP space. CIDR allows:

• Flexible subnetting
• Better use of IP space
• More efficient routing

🔧 How CIDR Works (Example)

CIDR: 192.168.1.0/26

• /26 = 26 bits for the network
• 32–26 = 6 bits left for hosts
• 26=642⁶ = 6426=64 IP addresses

Classes Table:

Ports:

The Ports are nothing but the it was basically used to connect the websites, generally each application will have unique ports.

format : 2.3.5.6:9000

That's all for the day, Today we have discussed about the fundamentals of Networking.

Thank you! Happy Reading.

Process Management: The Process is Running instances of a program, as discussed that software applications cannot directly interact with the hardware the O.S does that CPU, Memory, Network Management.

Suppose a developer has written a python script that was taking or utilizing 90% CPU so there is only 10% left to run other applications; so whenever this running application goes into the wait time then other process will be allocated to run applications so this shows that it utilizing more CPU.

If it Comes to the Memory Management when a developer develops a Java application which has Multiple Threads then it takes lot of Memory may be it Consumed 90% then only left with the 10% of Memory then other process cannot allot the Memory for the application.

As the Linux server Admin we need to follow the below process.
1. view.
2. Kill, Stop, Resume.
3. Prior, Deprior.

Viewing of the process:

Command for listing all the process is ps but it doesn't list all the process.

ps

To list out all the process we have to use the below command.

ps -aux

To know how many process with the Line Number → ps aux | nl

To Know the word count of the process → ps aux | wc -l

Components it will show while showing the process.

USER → Who has initiated the Process.

PID → Unique Process ID

%CPU → CPU Utilization.

%MEM → Memory Utilization.

Command → This shows that which command was running.

Killing, Stop and Resume the process :

If any application was getting Hanged then the application need to be killed; so that other application gets the CPU utilization and memory utilization.

For Killing the Process we need to use the below command.

kill <pid>

To Kill out the specific process then we can use the grep command with aux.

ps aux | grep java | grep -v grep

To forcefully kill the process

kill -9 <pid>

To Stop or Resume the process we need to use the below commands.

kill -stop <pid>
kill -cont <pid>

Prior, deprior the process:

we need to use the below command for the prioritization and de prioritization of process.

renice -n 10 -p <4048>
renice -n -5 -p <4048>

Here 10 indicates the priority of the process, if it was + then it will gives less priority.

• 5 indicates that it gives more priority.

Services:

These are Special Types of process that comes up automatically when there is an restart on webserver.

Suppose there are webservers like nginx and Apache which will automatically comes up when there is Linux server bootup these are called services.

To List out a service we need to use the below command.

systemctl list -units --type = service

To Stop the Service:

systemctl stop <servicename>

To start the service:

systemctl start <servicename>

Monitoring:

As part of Monitoring we will check which process taking more CPU, which process taking more memory and which file system taking more utilization.

To check the real time data we need to use the top command.

vmstat → it shows the system performance,when ever the users say that system performance is slow then we can check it using vmstat.

free -m --> To know the Memory Utilization of CPU.
nproc   --> No of CPU on the instances.

To know the disk Management of the webserver df -h

To know how many folders in the file system du -sh and to know the folder utilization we need to use the du -sh *

Disk Management:

If you are running application on the instance then logs will be generated for each and everything so this will incur the volume generally in the org they will take the backup or ZIP the log files.

If we need 10GB of storage we can attach to the instance but applications cannot use it; to use the storage we need to mount the volume and the storage we are adding is of Block storage we need to format it to (ext4, xfs)

lsblk --> list the block storgae attached to the instance.
fsdisk -l --> provide the more info about the instance partition.

command for the file system format:

mkfs -t ext4 /dev/xvdf

To mounting the volume:

mount /dev/xvdf /mnt/demo-volume

That’s all for the Day, Please follow for more content

Thank you! Happy reading😊

Hi! This is Tarun, welcome to today session we will discussing about the file permissions in Linux, and we will be implementing the small demo on the file permissions.

The File permissions is the most important aspect in every organization and used in day-to-day activities.

As we discussed the topic about the user management in the yesterday session if the person deletes the certain file which was the core component in the Linux then the Linux system will get corrupted in order to stop this activity user management is helpful on top of this File permissions.

File Permissions:

Linux comes up with the basic files permissions to modify the file permissions we can use the command called CHMOD, CHOWN.

we will see the simple demo on the file permissions between the developer and tester.

We will create two users called developer and tester using the root user and we will create the simple shell script using the developer user and we will use file permissions with the root user and see that tester can access the shell script and perform the basic operations like read, write and execute.

Creation of Developer user:

We can create a developer user using the below command with root user only.

adduser developer

Creation of Tester User:

We can create a tester user using the below command with the root user only.

adduser tester

We can verify that user’s developer and tester are created in desired way using the below command.

vim /etc/passwd

we have created simple script using the developer user in the /tmp folder below was the script used for demo.

we can check the file permissions using the ls -ltr and below was the file permissions having for the developers for this shell script.

• -rw-rw-r — — This was the file permissions format which will be followed in the Linux system.
• -rw indicates that owner or the user which was having the read and write permissions.
• -rw indicates that group has specific permissions like read and write.
• r — — indicates that others user or external persons having the permissions to access the file.

As from the permissions we can see that other users have only read permission so if we try to execute the shell script using the tester then we will face the error as permission denied.

Now we will set the permissions using the root user with the chmod command as below for both the developer and tester and we will monitor how it was working.

sudo chmod u= helloworld.sh

Now it shows that we have disabled all the permissions using the root user, even the developer was the owner.

We will enable all the permissions to the developer using the below command.

sudo chmod u+rwx helloworld.sh

In the same way we will set the permissions to the tester using the root user, first we will disable all the permissions to the tester user.

sudo chmod o= helloworld.sh

Now we will enable all the permissions using the root user to the tester.

This is all about the file permissions in the Linux and we can use the numbering format as well.

Permissions are represented as:

• Read (r or 4) – View file contents.
• Write (w or 2) – Modify file contents.
• Execute (x or 1) – Run scripts or programs.

chmod 755 filename # User (rwx), Group (r-x), Others (r-x)
chmod 644 filename # User (rw-), Group (r - ), Others (r - )
chmod 700 filename # User (rwx), No access for others

we can change the owner ship of the files, it was usefull whenever was changing the organization or leaving the org then we can use the chown command.

chown newuser filename  # Change owner
chown newuser:newgroup filename  # Change owner and group
chown :newgroup filename  # Change only group

chown qe:qe test.sh

This was all about the file permissions in Linux please give it an try and let me know in the comments session.

Please follow for more content.

Thank you, Happy reading😊

Hi! This is Tarun, welcome to today session of Linux series today we will be dealing with the user management which was used in day-to-day Activities.

User Management is Nothing but when the developers in the team are using the Linux servers as root users this depicts that they have full control over everything by mistake if one developer deletes the /sbin folder from the Linux environment then the full Linux system will be corrupted.

To Solve this issue as part of User Management we will create Users and Groups.

Users:

We will create a User using the command as below.

Tarun715 is the username we will be creating.

sudo useradd Tarun715

After creating the user whether user has created or not using the below command this command is basically, they will show the contents in the /etc/passwd folder.

vim /etc/passwd

If the user is there in the list, then we can say that user was created below highlighted one.

create a password for the user which we have created type the command in the Linux terminal

sudo passwd Tarun715

To know the password for the created Tarun715 we need to provide the below command so that we can get the masked password.

sudo cat /etc/shadow

If user forgot the password to decrypt the generated password it was not possible.

If the User is leaving the organization, then we can simply use the below command.

sudo userdel Tarun715

Difference between Useradd and adduser is Useradd doesn't create the /home directory in this case we can use adduser so that it will create the user and create the home directory as well.

As the Organization policy to change the password for certain days then we can use the below command

sudo chage -M 90 Tarun715

Lock the ceratin user account.

sudo passwd -l Tarun715

Unlock the user account.

sudo passwd -u Tarun715

Groups:

In a Team a group of 250 Developers and 200 quality engineers and 10 Management people, if we have to provide access to the 250 developers one by one it will hectically task and time consuming so we will create a group for devoplers,qe,managment people so we will provide access to the group so that every member in that group will have the access.

Creation of Group and Adding User to Group:

Command for creation of Group

sudo groupadd devops

To see if the group has created or not using

cat /etc/group

To add user to group:

usermod -aG devops Tarun715

To see if the user was added to the group using the below one.

cat /etc/group

Summary: This was the simple demo on the user Managment performed in every Organization.

Thats all for the day, please like and follow for more content.

Thank you! Happy Reading😊

First, we will see what Operating System is.

It is the system software that manages computer hardware, software resources and provides common services for computer programs (It is intermediatory Between users and the computer Hardware)

Operating Manages the Hardware, and it also manages the CPU management and Memory management and device management.

To interact with OS windows operating system, provide the interactive GUI, whereas Linux OS provides Command Line Interface and intern Talk to the Hardware.

Example: For suppose if we write some program then the OS will allocate the memory, required things to execute the program.

Why was Linux chosen over Windows in the Organizations?

In the Organization over 90% was used is the Linux because of the advantages it was Opensource, and it has High Security.

Linux Components:

User Applications → Docker, Vim, Apache etc.

Part of the OS → Shell (zsh,bash,Fish etc.)

Part of the OS → System Libraries (libc, openssl , glibc etc)

Part of the OS → System Utilites (ls,grep,systemctl etc)

Core of the OS → Linux Kernal (Process, Memory, File system and Network)

Hardware (CPU, RAM, Disk, Network, Peripheral's)

Linux Distributions:

Linux distributions (also called distros) are operating systems based on the Linux kernel combined with various software packages. There are many Linux distros tailored for different use cases, such as desktop computing, servers, security, development, and more.

Here’s a quick overview of popular categories and some notable distributions:

🌐 General-Purpose Desktop Distros

• Ubuntu — User-friendly, great for beginners, strong community support.
• Linux Mint — Based on Ubuntu, with a more traditional desktop feel (Cinnamon, MATE).
• Fedora — Cutting-edge software, backed by Red Hat; good for developers.
• Debian — Stable and well-tested, a base for many other distros including Ubuntu.
• openSUSE — Focuses on stability and configurability (via YaST tool).

Folder Structure:

1. /Sbin -> system binaries for Administrator commands. these binary files which are helpful to manage the systems an Administrator.

Eg: add the users, check CPU, check memory.

2. /lib: These libraries are used by the kernel to make the system calls to the hardware

3. boot: It helps in Booting the Linux system.

4. /bin: Basically, contains Essential binary executable (system commands) needs for basic system operation.

->for admin functions we will provide access for sbin

->for non admin functions we will provide access for bin

5. /usr: Unix System Resources.

It contains user utilities and applications -essentially the bulk of the os software the core system tools in /bin, /sbin, /lib

6. /srv: Service
/Srv directory in Linux stands for service and indented to hold data for services provided by the system such as web FTP or Server-related data.

7. /opt: Used for installing 3rd party applications.

-> This makes it easier to Manage, update or remove these applications without effecting core system.

8. /mnt : Mounting a volume

In the Org Administrator had a task to procure the disk space then admin first procure the 30gb disk space and keep in the /mnt folder then they will add in the particular location.

9. /var: Used to store log files, store 3rd party libraries

10./home: In this directory Linux contains home directories where each user stores personal files, settings and data.

11./data: It was created by administrators to store persistent or application specific data.

12. /temp: it is stored for the temp purposes.

13. /run: it stores the run time processes of the application.

14. /etc: directory consists of configuration files of Linux system.

Conclusion: Today we have learnt about the fundamentals about the Linux and the folder structure in Linux.

Thats all for the day, please follow for more content.

Thank you! Happy reading😊

Hi! This is Tarun, Welcome to Day 23 of AWS series today we will be discussing about the load Balancer and its various Types.

1. If we deploy an application on EC2 instance and it was accessed by the end users. In the initial stage the 3 users are accessing the application on the EC2 then there is No load on the EC2, suddenly if the load was increased on the EC2 then instance cannot handle the load so the Users accessing the application on the EC2 will experience severe downtime and slowness.

Soultion to the Above Scenario: We will create a 2 More EC2 instances in total of 3 EC2’s on top of these 3 instances we will place a Load balancer there are different types of load balancer based upon the our requirement we will use it so we will inform the user to access the application using the Load Balancer then the load balancer will route the traffic to the EC2 which we have created.

We have the flexibility to configure that how many request has to go to each instance.

If you are Trying to access some webpage on the internet the request will flow through internet and then it will reach to the requested server and gives back the response to the user and it travels through 7 Layers while travelling from user to requested Webpage.

Traffic Flow in Different Type of Layers.

1. Whenever you try to access the webpage, you initiate the HTTP protocol trough Application Layer(L7)
2. From the Application Layer it will pass through L6(Presentation Layer) it will take care of Encoding of the request.
3. In L5(Session Layer) we will create a session for the layer it gives the information about when the session was created and everything between client and server.
4. The request will pass through L4(Transport Layer) where the request will break into small chunks and will transmit into the small packets where server will easily understand the packets and easily send the response.
5. L3(Network Layer) : Where small packets are created then these packets have to travel through multiple routers finally your request will reach trough Data center.
6. L2(Datalink Layer): Before the request reaches the server, it will pass through datalink layer where request go to a switch from their it will pass through L1.
7. L1(Physical Layer): The request will Comes to L1 it is the Bottom Layer which is Physical Layer which is physical and electric Layer representation of the system it consists of Various Network Components such as Power Plugs, Receiver Cables Etc. This layer sends data bits from one device like a computer to another Device.

Comparision of ALB VS NLB VS GWLB:

Application Load Balancer: This is also called L7 Load Balancer.

When a User Initiates the HTTPS Request it interprets the request based upon the Host,Path,Domain then we can choose ALB.

If we are accessing the Payment service on some website, then it will route it to the Payment service.

If we are accessing the Transaction, then it will route it to the Transaction service.

The main advantage of ALB is it interprets the HTTP request.

It was costly and it was slow because it was analyzing the request and forwarding the request trough servers.

Network Load Balancer: This is also called L4 Load Balancer

With this Load Balancer HTTP Encryption can't be performed here.

It was less costly and has the less latency.

It was More used in Game servers in Game Servers, YouTube Live streaming Platforms.

It will Perform Routing on TCP/UDP packets

It will also have the feature sticky Session (If one request is sent to one server then all the requests will sent to the same server)

Gateway Load Balancer

It is useful when dealing with VPN kind of applications and firewall applications.

When we are dealing with VPN and Firewall applications then the traffic has to be secure the packets need to be encrypted and it offers more security.

Thats all for the Day, please like and follow for such more content.

Thank you! Happy reaching😊

Hi! This is Tarun, Welcome to day 22 of AWS Series today we will brief about an AWS service called Config and we will implement a demo which will invoke Custom Lambda using the AWS Config.

What is AWS Config?

AWS Config is a service that continuously monitors and records your AWS resource configurations — and helps you audit, assess compliance, and troubleshoot configuration changes.

Example: For suppose in Organization while creation of EC2 Monitoring option must be enabled then it was complaint resource. If it was not followed and not checked the monitoring option, then it falls under non complaint resource.

There is another case where s3 access to be private, if it is public then it is noncompliance issue. We need to integrate AWS Config rules with the lambda function, and we need to write lambda function for the resource.

Based on the Organization polices and standards we have to set the Configuration rules for their services

This was Related to the Security.

Features:

• Continuous Configuration Recording
• Configuration History
• Resource Inventory
• Compliance Rules (Managed + Custom)
• Compliance Status & Alerts
• Periodic & Event-Driven Evaluations
• Integration with AWS Lambda

Demo: AWS Config to Monitor AWS EC2 with Custom Lambda.

We will Monitor the AWS Ec2 instance based on the Detailed Monitoring option as it was Mandatory while creation on EC2 to know the certain parameters like CPU Utilization etc.

Aim: First, we need to Uncheck the Detailed Monitoring option and using the custom lambda function and config rule it will show the non-complaint after that we will check the Detailed Monitoring Option then it will automatically trigger the Lambda Function using AWS Config.

Note: We are Monitoring for only one service that is EC2 and only one option Detailed Monitoring.

Step1: First, we need to set up the configuration with the settings below.

1. We need to select customizable overrides and recording as continuous whenever there is an update or change in the resource it will push the notification.

2. We need to provide an existing IAM role or if you want to create a new one, we can do that as well and for storing the config logs, we can either create the s3 bucket or provide the old one.

Step2: Setting Up the Config Rule.

This is the dashboard we will see after setting up the config.

We can setup the custom rule using the rule option and add the new rule.

1. We need to select the custom rule using the lambda function.

2. Before configuring the rule we need to create a lambda function, and we need to provide the function ARN.

Lambda creation:

1. First, we need to select the Author from scratch because we are setting up the lambda function from the Scratch.

2. For the Execution Role, we can create a new role to avoid the confusion.

3. Provide the trigger type as whenever any change made to the ec2 it will trigger the lambda function.

This was the config rule we have setup to monitor the resources which are complaint and noncompliance

While creation of config you will face the below error so use the below script to bypass the error

Error: Before you add this rule, update your IAM permissions to allow the lambda:AddPermission action.

Function Name you need to provide as your Lambda function which you have created in before setup.

Add Lambda:addpermission :
aws lambda add-permission \
 - function-name InstanceTypeCheck \
 - statement-id "AddConfigPermission" \
 - action lambda:InvokeFunction \
 - principal config.amazonaws.com

Step 3: Before Going to the Execution, we need to grant the policies to the Lambda Role as below:

To know more about the IAM roles and policies please follow the below link.

Policies and permissions in AWS Identity and Access Management

This was the Custom Lambda Python code:

import boto3
import json

def lambda_handler(event, context):

    # Get the specific EC2 instance.
    ec2_client = boto3.client('ec2')
    
    # Assume compliant by default
    compliance_status = "COMPLIANT"  
    
    # Extract the configuration item from the invokingEvent
    config = json.loads(event['invokingEvent'])
    
    configuration_item = config["configurationItem"]
    
    # Extract the instanceId
    instance_id = configuration_item['configuration']['instanceId']
    
    # Get complete Instance details
    instance = ec2_client.describe_instances(InstanceIds=[instance_id])['Reservations'][0]['Instances'][0]
    
    # Check if the specific EC2 instance has Cloud Trail logging enabled.
    
    if not instance['Monitoring']['State'] == "enabled":
        compliance_status = "NON_COMPLIANT"

    evaluation = {
        'ComplianceResourceType': 'AWS::EC2::Instance',
        'ComplianceResourceId': instance_id,
        'ComplianceType': compliance_status,
        'Annotation': 'Detailed monitoring is not enabled.',
        'OrderingTimestamp': config['notificationCreationTime']
    }
    
    config_client = boto3.client('config')
    
    response = config_client.put_evaluations(
        Evaluations=[evaluation],
        ResultToken=event['resultToken']
    )  
    
    return response

As the Lambda Function default time was 3 sec, we can set the Execution Time as 10 Sec in the Configuration Tab.

If you receive any error that invoking event was missing, then you need run the below shell script on your console.

aws lambda add-permission \
  --function-name tarswe_lambda \
  --statement-id AddConfigPermission \
  --action lambda:InvokeFunction \
  --principal config.amazonaws.com \
  --source-arn arn:aws:config:us-east-1:196771543217:config-rule/config-rule-0abc123def456ghi7 \
  --region us-east-1

For Function name replace without lambda function and source Arn is the Config rule Arn which you can find in the Config Rule.

Step 4: Testing

After Setting all the Configuration and Custom Lambda function and deploying the code we have to do the below steps.

I. We have an ec2 instance which was created, and we have not enabled the detailed monitoring option.

This shows that the resource which we are using is non complaint, this means that the config rule which we have created will invoke the custom lambda and check the Parameters which was provided in the Lambda function.

II. Now we will Enable the detailed Monitoring option, as we have done the change on the EC2 which is the resource we have provided to monitor then it will automatically invoke the Lambda function.

Wait for some time and check the status on the Config rule tab and it shows as.

Now we can check the Full log details on the AWS service called CloudWatch with latest details as below.

Thats all for the Day, please follow for more content.

Thank you!!! Happy Reading😊

If we are using Docker and other CICD Tools, there is lot of credentials and other information stored and used in the continuous process which are most important and need to be secured.

If this information is leaked, then someone will access the information and login to the tools and delete the images, and it will impact the organization.

Types of Management on AWS:

1. System Manager: It was easily accessible with the simply granting the IAM role.
2. Secrets Manager: The main purpose this was introduced by the AWS was we can ask the secrets manager to update the credentials based upon the time we set in the Organization.

==> The main advantage of the secrets manager was the chance of secure information being leaked is very less.

==> Whenever we are using the Databases, this was most suitable way.

==> Whenever we implemented the CICD on AWS we have pushed the images on to the docker or AWS ECR then we need Docker URL, Docker Username, Docker Password.

==> So, with the combination of system Manager and secrets Manger, we can use it in cost effective manner, we used system manager for docker registry URL and Docker Username, Secrets Manager for the Docker password.

Most Widely used Secrets Manger:

Hashicrop Vault: It was the centralized solution when we were using the Mult iCloud we must Hashicrop Vault.

This is not the AWS managed service, it was the Hashicrop open source platform.

When we are dedicated to only AWS then we must go to the above Solutions which are provided by the AWS.

Thats all for the Day, please follow for more cloud related Content.

Thank You!!! Happy Reading😊

EKS is an AWS managed Kubernetes offering.

The Architecture of EKS is same as the Original Kubernetes cluster it has Master node and worker node.

Master node consists of API server, ETCD, scheduler, CCM, controller these are user facing means the user will directly talk to the control plane components.

Whenever the above-mentioned components are down it will cause a severe issue to debug all the error issues and fix the work becomes hectic.

To resolve this issue AWS came up with the solution called EKS — where it was managed control plane only, where all the components in the control plane will be managed by the AWS.

To Manage the worker node AWS will provides us the 2 options like to deploy the application we can use:

I) EC2

II) Fargate — It was AWS serverless compute where it was specifically for running the containers.

We can use the k8s on AWS using 2 ways.

i) Using EC2 and deploying everything on our own.

ii) Using the EKS and Managed services by the AWS.

We are doing the demo to create the cluster on aws and application must be accessed by the outside world.

We have used the ingress controller that manages external access to services running in a Kubernetes cluster.

Where the user wants to access the application, it will be accessed through the Application load balancer which was placed in the public subnet.

We will create a service in which the pod will be deployed we can use clusterIP Mode, nodeport Mode, loadbalancer Mode.

Always the applications are deployed in the private subnet.

We will use the ingress controller with either clusertip or nodeport mode, basically the ingress used to allow access to the application inside the eks cluster.

How can the user access the ingress controller?

we will place the load balancer in the public subnet then user will talk to the load balancer, and it will route the traffic to the ingress controller.

Function of Ingress Controller: Whenever we deploy the ALB ingress controller it will check for the ingress resource whenever it was detected it will create an ALB then user can talk to the application load balancer then request will go to the Application.

Config of ingress controller: As we have seen the function of controller it will create a application load balancer and user will talk to the ALB and the request will come to the POD which was deployed in the cluster trough service (nodeport, Clusterip, Note : load balancer service was very costly).

Demo: Deploying the 2048 game using the Elastic Kubernetes Service with the Ingress.

To perform the demo, we need to have 3 prerequites on our Terminal

1. Kubectl — Below is the installation link to install Kubectl based upon the operating system.

Install Tools

2. EKSCTL — Below is the installation link

Set up kubectl and eksctl

3. AWS CLI — To connect with aws CLI (installation of aws cli we have seen in the previous sessions)

Installing or updating to the latest version of the AWS CLI

After setting up the prerequisites we need to create the cluster.

Step 1- Cluster creation:

If we use the AWS UI manually, we need to provide a lot of permissions and setting up for the EKS cluster, so we have used the below command to create the EKS cluster.

eksctl create cluster - name eks-app-deploy - region us-east-1 - fargate

Once the cluster was ready, we will see the below output, everything which was needed for the cluster like private subnet, public subnets etc,will be created by AWS EKS.

Now you can see the cluster in the aws ui as well.

In order to talk to the EKS cluster which we have created on the before step we have to configure cluster using the below command.

aws eks update-kubeconfig --name eks-app-deploy --region us-east-1

Once it was configured we can see the below output.

Now we will create fargate profile using the below command — we need to create fargate profiles because everything was managed by the AWS it was an another option of EC2.

Using the below command we can do that.
eksctl create fargateprofile \
    --cluster eks-app-deploy \
    --region us-east-1 \
    --name alb-sample-app \
--namespace game-2048

We can use the default namespace as well, but we have used the game-2048 name space.

These will create fargate profiles.

We will deploy the deployment, service and ingress using the below command.

The Yaml file is an opensource we can use it based upon our requirement.

kubectl apply -f https://raw.githubusercontent.com/kubernetes-sigs/aws-load-balancer-controller/v2.5.4/docs/examples/2048/2048_full.yaml

We are just creating the ingress, but we need to add the ingress controllers.

We will see the below output as the resources are created.

Once the resources are created, we can verify using the commands below.

Kubectl get pods -n game-2048

We can see that the container are running.

We can check the status of the service as well as by using the below command.

Kubectl get svc -n game-2048

Here in the service, we have configured node port mode, anyone who has access to the private subnet can access the application, but we need to access the external-IP address.

We can get the status of the ingress using the bellow command.

kubectl get ingress -n game-2048

Here we have used ALB ingress controller and there is no address on the ingress resource to access the application but the outside world, so we have to create the ingress controller now.

Before creating the ingress controller, we have to do some prerequisite steps.

1. Creation of IAM OIDC provider — This create an IAM users where it will access some resources on the aws.

Command:

eksctl utils associate-iam-oidc-provider - cluster $cluster_name - approve

2. Before creation of ingress we need to grant iam policy as below.

Download the iam policy,

curl -O https://raw.githubusercontent.com/kubernetes-sigs/aws-load-balancer-controller/v2.11.0/docs/install/iam_policy.json

Creation of IAM.

aws iam create-policy \
    --policy-name AWSLoadBalancerControllerIAMPolicy \
--policy-document file://iam_policy.json

We need to create the role as well.

eksctl create iamserviceaccount \
 - cluster=eks-app-deploy \
 - namespace=kube-system \
 - name=aws-load-balancer-controller \
 - role-name AmazonEKSLoadBalancerControllerRole \
 - attach-policy-arn=arn:aws:iam::196771543217:policy/AWSLoadBalancerControllerIAMPolicy \
 - approve

Follow the below steps to deploy the ALB controller.

helm repo add eks https://aws.github.io/eks-charts

helm repo update eks

Helm Install.

helm install aws-load-balancer-controller eks/aws-load-balancer-controller -n kube-system \
 - set clusterName=eks-app-deploy\
 - set serviceAccount.create=false \
 - set serviceAccount.name=aws-load-balancer-controller \
 - set region=us-east-1\
 - set vpcId=vpc-01165c163384303ca

We can verify that pods status using the below command.

kubectl get deploy -n kube-system

Now you can see that the address is attached to the ingress controller with the application load balancer using the below command.

kubectl get ingress -n game-2048

An ALB will be created we can see at the AWS UI.

Yahoo🥳 💥we have successfully deployed the 2048 application, and it can be accessed by the external users.

Disclaimer: Please delete the EKS cluster after the demo it will cost you in the free AWS account.

Thats all for the day, please hit the clap button if you like the content.

Thank you!!! Happy Reading😊