whentimeslows/website
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Tweak page production environment

Browse Source 
This page has a lot of indentations or line wrappings that are "wrong".
It would make tracking changes (especially for localization teams) very
difficult.
This commit is contained in:
Qiming Teng
2022-06-18 13:45:31 +08:00
parent 3332857e51
commit cfdd213d0a
1 changed files with 158 additions and 139 deletions
Download Patch File Download Diff File Expand all files Collapse all files
content/en/docs/setup/production-environment/_index.md
+158 -139
View File
@@ -28,29 +28,29 @@ on or hand to others, consider how your requirements for a Kubernetes cluster
are influenced by the following issues: are influenced by the following issues:
- *Availability*: A single-machine Kubernetes [learning environment](/docs/setup/#learning-environment) - *Availability*: A single-machine Kubernetes [learning environment](/docs/setup/#learning-environment)
has a single point of failure. Creating a highly available cluster means considering: has a single point of failure. Creating a highly available cluster means considering:
- Separating the control plane from the worker nodes. - Separating the control plane from the worker nodes.
- Replicating the control plane components on multiple nodes. - Replicating the control plane components on multiple nodes.
- Load balancing traffic to the cluster’s {{< glossary_tooltip term_id="kube-apiserver" text="API server" >}}. - Load balancing traffic to the cluster’s {{< glossary_tooltip term_id="kube-apiserver" text="API server" >}}.
- Having enough worker nodes available, or able to quickly become available, as changing workloads warrant it. - Having enough worker nodes available, or able to quickly become available, as changing workloads warrant it.
- *Scale*: If you expect your production Kubernetes environment to receive a stable amount of - *Scale*: If you expect your production Kubernetes environment to receive a stable amount of
demand, you might be able to set up for the capacity you need and be done. However, demand, you might be able to set up for the capacity you need and be done. However,
if you expect demand to grow over time or change dramatically based on things like if you expect demand to grow over time or change dramatically based on things like
season or special events, you need to plan how to scale to relieve increased season or special events, you need to plan how to scale to relieve increased
pressure from more requests to the control plane and worker nodes or scale down to reduce unused pressure from more requests to the control plane and worker nodes or scale down to reduce unused
resources. resources.
- *Security and access management*: You have full admin privileges on your own - *Security and access management*: You have full admin privileges on your own
Kubernetes learning cluster. But shared clusters with important workloads, and Kubernetes learning cluster. But shared clusters with important workloads, and
more than one or two users, require a more refined approach to who and what can more than one or two users, require a more refined approach to who and what can
access cluster resources. You can use role-based access control access cluster resources. You can use role-based access control
([RBAC](/docs/reference/access-authn-authz/rbac/)) and other ([RBAC](/docs/reference/access-authn-authz/rbac/)) and other
security mechanisms to make sure that users and workloads can get access to the security mechanisms to make sure that users and workloads can get access to the
resources they need, while keeping workloads, and the cluster itself, secure. resources they need, while keeping workloads, and the cluster itself, secure.
You can set limits on the resources that users and workloads can access You can set limits on the resources that users and workloads can access
by managing [policies](/docs/concepts/policy/) and by managing [policies](/docs/concepts/policy/) and
[container resources](/docs/concepts/configuration/manage-resources-containers/). [container resources](/docs/concepts/configuration/manage-resources-containers/).
Before building a Kubernetes production environment on your own, consider Before building a Kubernetes production environment on your own, consider
handing off some or all of this job to handing off some or all of this job to
@@ -59,16 +59,16 @@ providers or other [Kubernetes Partners](https://kubernetes.io/partners/).
Options include: Options include:
- *Serverless*: Just run workloads on third-party equipment without managing - *Serverless*: Just run workloads on third-party equipment without managing
a cluster at all. You will be charged for things like CPU usage, memory, and a cluster at all. You will be charged for things like CPU usage, memory, and
disk requests. disk requests.
- *Managed control plane*: Let the provider manage the scale and availability - *Managed control plane*: Let the provider manage the scale and availability
of the cluster's control plane, as well as handle patches and upgrades. of the cluster's control plane, as well as handle patches and upgrades.
- *Managed worker nodes*: Configure pools of nodes to meet your needs, - *Managed worker nodes*: Configure pools of nodes to meet your needs,
then the provider makes sure those nodes are available and ready to implement then the provider makes sure those nodes are available and ready to implement
upgrades when needed. upgrades when needed.
- *Integration*: There are providers that integrate Kubernetes with other - *Integration*: There are providers that integrate Kubernetes with other
services you may need, such as storage, container registries, authentication services you may need, such as storage, container registries, authentication
methods, and development tools. methods, and development tools.
Whether you build a production Kubernetes cluster yourself or work with Whether you build a production Kubernetes cluster yourself or work with
partners, review the following sections to evaluate your needs as they relate partners, review the following sections to evaluate your needs as they relate
@@ -99,52 +99,52 @@ and ensuring that it can be repaired if something goes wrong is important,
consider these steps: consider these steps:
- *Choose deployment tools*: You can deploy a control plane using tools such - *Choose deployment tools*: You can deploy a control plane using tools such
as kubeadm, kops, and kubespray. See as kubeadm, kops, and kubespray. See
[Installing Kubernetes with deployment tools](/docs/setup/production-environment/tools/) [Installing Kubernetes with deployment tools](/docs/setup/production-environment/tools/)
to learn tips for production-quality deployments using each of those deployment to learn tips for production-quality deployments using each of those deployment
methods. Different [Container Runtimes](/docs/setup/production-environment/container-runtimes/) methods. Different [Container Runtimes](/docs/setup/production-environment/container-runtimes/)
are available to use with your deployments. are available to use with your deployments.
- *Manage certificates*: Secure communications between control plane services - *Manage certificates*: Secure communications between control plane services
are implemented using certificates. Certificates are automatically generated are implemented using certificates. Certificates are automatically generated
during deployment or you can generate them using your own certificate authority. during deployment or you can generate them using your own certificate authority.
See [PKI certificates and requirements](/docs/setup/best-practices/certificates/) for details. See [PKI certificates and requirements](/docs/setup/best-practices/certificates/) for details.
- *Configure load balancer for apiserver*: Configure a load balancer - *Configure load balancer for apiserver*: Configure a load balancer
to distribute external API requests to the apiserver service instances running on different nodes. See to distribute external API requests to the apiserver service instances running on different nodes. See
[Create an External Load Balancer](/docs/tasks/access-application-cluster/create-external-load-balancer/) [Create an External Load Balancer](/docs/tasks/access-application-cluster/create-external-load-balancer/)
for details. for details.
- *Separate and backup etcd service*: The etcd services can either run on the - *Separate and backup etcd service*: The etcd services can either run on the
same machines as other control plane services or run on separate machines, for same machines as other control plane services or run on separate machines, for
extra security and availability. Because etcd stores cluster configuration data, extra security and availability. Because etcd stores cluster configuration data,
backing up the etcd database should be done regularly to ensure that you can backing up the etcd database should be done regularly to ensure that you can
repair that database if needed. repair that database if needed.
See the [etcd FAQ](https://etcd.io/docs/v3.4/faq/) for details on configuring and using etcd. See the [etcd FAQ](https://etcd.io/docs/v3.4/faq/) for details on configuring and using etcd.
See [Operating etcd clusters for Kubernetes](/docs/tasks/administer-cluster/configure-upgrade-etcd/) See [Operating etcd clusters for Kubernetes](/docs/tasks/administer-cluster/configure-upgrade-etcd/)
and [Set up a High Availability etcd cluster with kubeadm](/docs/setup/production-environment/tools/kubeadm/setup-ha-etcd-with-kubeadm/) and [Set up a High Availability etcd cluster with kubeadm](/docs/setup/production-environment/tools/kubeadm/setup-ha-etcd-with-kubeadm/)
for details. for details.
- *Create multiple control plane systems*: For high availability, the - *Create multiple control plane systems*: For high availability, the
control plane should not be limited to a single machine. If the control plane control plane should not be limited to a single machine. If the control plane
services are run by an init service (such as systemd), each service should run on at services are run by an init service (such as systemd), each service should run on at
least three machines. However, running control plane services as pods in least three machines. However, running control plane services as pods in
Kubernetes ensures that the replicated number of services that you request Kubernetes ensures that the replicated number of services that you request
will always be available. will always be available.
The scheduler should be fault tolerant, The scheduler should be fault tolerant,
but not highly available. Some deployment tools set up [Raft](https://raft.github.io/) but not highly available. Some deployment tools set up [Raft](https://raft.github.io/)
consensus algorithm to do leader election of Kubernetes services. If the consensus algorithm to do leader election of Kubernetes services. If the
primary goes away, another service elects itself and take over. primary goes away, another service elects itself and take over.
- *Span multiple zones*: If keeping your cluster available at all times is - *Span multiple zones*: If keeping your cluster available at all times is
critical, consider creating a cluster that runs across multiple data centers, critical, consider creating a cluster that runs across multiple data centers,
referred to as zones in cloud environments. Groups of zones are referred to as regions. referred to as zones in cloud environments. Groups of zones are referred to as regions.
By spreading a cluster across By spreading a cluster across
multiple zones in the same region, it can improve the chances that your multiple zones in the same region, it can improve the chances that your
cluster will continue to function even if one zone becomes unavailable. cluster will continue to function even if one zone becomes unavailable.
See [Running in multiple zones](/docs/setup/best-practices/multiple-zones/) for details. See [Running in multiple zones](/docs/setup/best-practices/multiple-zones/) for details.
- *Manage on-going features*: If you plan to keep your cluster over time, - *Manage on-going features*: If you plan to keep your cluster over time,
there are tasks you need to do to maintain its health and security. For example, there are tasks you need to do to maintain its health and security. For example,
if you installed with kubeadm, there are instructions to help you with if you installed with kubeadm, there are instructions to help you with
[Certificate Management](/docs/tasks/administer-cluster/kubeadm/kubeadm-certs/) [Certificate Management](/docs/tasks/administer-cluster/kubeadm/kubeadm-certs/)
and [Upgrading kubeadm clusters](/docs/tasks/administer-cluster/kubeadm/kubeadm-upgrade/). and [Upgrading kubeadm clusters](/docs/tasks/administer-cluster/kubeadm/kubeadm-upgrade/).
See [Administer a Cluster](/docs/tasks/administer-cluster/) See [Administer a Cluster](/docs/tasks/administer-cluster/)
for a longer list of Kubernetes administrative tasks. for a longer list of Kubernetes administrative tasks.
To learn about available options when you run control plane services, see To learn about available options when you run control plane services, see
[kube-apiserver](/docs/reference/command-line-tools-reference/kube-apiserver/), [kube-apiserver](/docs/reference/command-line-tools-reference/kube-apiserver/),
@@ -166,39 +166,39 @@ consider how you want to manage your worker nodes (also referred to
simply as *nodes*). simply as *nodes*).
- *Configure nodes*: Nodes can be physical or virtual machines. If you want to - *Configure nodes*: Nodes can be physical or virtual machines. If you want to
create and manage your own nodes, you can install a supported operating system, create and manage your own nodes, you can install a supported operating system,
then add and run the appropriate then add and run the appropriate
[Node services](/docs/concepts/overview/components/#node-components). Consider: [Node services](/docs/concepts/overview/components/#node-components). Consider:
- The demands of your workloads when you set up nodes by having appropriate memory, CPU, and disk speed and storage capacity available. - The demands of your workloads when you set up nodes by having appropriate memory, CPU, and disk speed and storage capacity available.
- Whether generic computer systems will do or you have workloads that need GPU processors, Windows nodes, or VM isolation. - Whether generic computer systems will do or you have workloads that need GPU processors, Windows nodes, or VM isolation.
- *Validate nodes*: See [Valid node setup](/docs/setup/best-practices/node-conformance/) - *Validate nodes*: See [Valid node setup](/docs/setup/best-practices/node-conformance/)
for information on how to ensure that a node meets the requirements to join for information on how to ensure that a node meets the requirements to join
a Kubernetes cluster. a Kubernetes cluster.
- *Add nodes to the cluster*: If you are managing your own cluster you can - *Add nodes to the cluster*: If you are managing your own cluster you can
add nodes by setting up your own machines and either adding them manually or add nodes by setting up your own machines and either adding them manually or
having them register themselves to the cluster’s apiserver. See the having them register themselves to the cluster’s apiserver. See the
[Nodes](/docs/concepts/architecture/nodes/) section for information on how to set up Kubernetes to add nodes in these ways. [Nodes](/docs/concepts/architecture/nodes/) section for information on how to set up Kubernetes to add nodes in these ways.
- *Add Windows nodes to the cluster*: Kubernetes offers support for Windows - *Add Windows nodes to the cluster*: Kubernetes offers support for Windows
worker nodes, allowing you to run workloads implemented in Windows containers. See worker nodes, allowing you to run workloads implemented in Windows containers. See
[Windows in Kubernetes](/docs/setup/production-environment/windows/) for details. [Windows in Kubernetes](/docs/setup/production-environment/windows/) for details.
- *Scale nodes*: Have a plan for expanding the capacity your cluster will - *Scale nodes*: Have a plan for expanding the capacity your cluster will
eventually need. See [Considerations for large clusters](/docs/setup/best-practices/cluster-large/) eventually need. See [Considerations for large clusters](/docs/setup/best-practices/cluster-large/)
to help determine how many nodes you need, based on the number of pods and to help determine how many nodes you need, based on the number of pods and
containers you need to run. If you are managing nodes yourself, this can mean containers you need to run. If you are managing nodes yourself, this can mean
purchasing and installing your own physical equipment. purchasing and installing your own physical equipment.
- *Autoscale nodes*: Most cloud providers support - *Autoscale nodes*: Most cloud providers support
[Cluster Autoscaler](https://github.com/kubernetes/autoscaler/tree/master/cluster-autoscaler#readme) [Cluster Autoscaler](https://github.com/kubernetes/autoscaler/tree/master/cluster-autoscaler#readme)
to replace unhealthy nodes or grow and shrink the number of nodes as demand requires. See the to replace unhealthy nodes or grow and shrink the number of nodes as demand requires. See the
[Frequently Asked Questions](https://github.com/kubernetes/autoscaler/blob/master/cluster-autoscaler/FAQ.md) [Frequently Asked Questions](https://github.com/kubernetes/autoscaler/blob/master/cluster-autoscaler/FAQ.md)
for how the autoscaler works and for how the autoscaler works and
[Deployment](https://github.com/kubernetes/autoscaler/tree/master/cluster-autoscaler#deployment) [Deployment](https://github.com/kubernetes/autoscaler/tree/master/cluster-autoscaler#deployment)
for how it is implemented by different cloud providers. For on-premises, there for how it is implemented by different cloud providers. For on-premises, there
are some virtualization platforms that can be scripted to spin up new nodes are some virtualization platforms that can be scripted to spin up new nodes
based on demand. based on demand.
- *Set up node health checks*: For important workloads, you want to make sure - *Set up node health checks*: For important workloads, you want to make sure
that the nodes and pods running on those nodes are healthy. Using the that the nodes and pods running on those nodes are healthy. Using the
[Node Problem Detector](/docs/tasks/debug/debug-cluster/monitor-node-health/) [Node Problem Detector](/docs/tasks/debug/debug-cluster/monitor-node-health/)
daemon, you can ensure your nodes are healthy. daemon, you can ensure your nodes are healthy.
## Production user management ## Production user management
@@ -215,39 +215,51 @@ cluster (authentication) and deciding if they have permissions to do what they
are asking (authorization): are asking (authorization):
- *Authentication*: The apiserver can authenticate users using client - *Authentication*: The apiserver can authenticate users using client
certificates, bearer tokens, an authenticating proxy, or HTTP basic auth. certificates, bearer tokens, an authenticating proxy, or HTTP basic auth.
You can choose which authentication methods you want to use. You can choose which authentication methods you want to use.
Using plugins, the apiserver can leverage your organization’s existing Using plugins, the apiserver can leverage your organization’s existing
authentication methods, such as LDAP or Kerberos. See authentication methods, such as LDAP or Kerberos. See
[Authentication](/docs/reference/access-authn-authz/authentication/) [Authentication](/docs/reference/access-authn-authz/authentication/)
for a description of these different methods of authenticating Kubernetes users. for a description of these different methods of authenticating Kubernetes users.
- *Authorization*: When you set out to authorize your regular users, you will probably choose between RBAC and ABAC authorization. See [Authorization Overview](/docs/reference/access-authn-authz/authorization/) to review different modes for authorizing user accounts (as well as service account access to your cluster): - *Authorization*: When you set out to authorize your regular users, you will probably choose
- *Role-based access control* ([RBAC](/docs/reference/access-authn-authz/rbac/)): Lets you assign access to your cluster by allowing specific sets of permissions to authenticated users. Permissions can be assigned for a specific namespace (Role) or across the entire cluster (ClusterRole). Then using RoleBindings and ClusterRoleBindings, those permissions can be attached to particular users. between RBAC and ABAC authorization. See [Authorization Overview](/docs/reference/access-authn-authz/authorization/)
- *Attribute-based access control* ([ABAC](/docs/reference/access-authn-authz/abac/)): Lets you create policies based on resource attributes in the cluster and will allow or deny access based on those attributes. Each line of a policy file identifies versioning properties (apiVersion and kind) and a map of spec properties to match the subject (user or group), resource property, non-resource property (/version or /apis), and readonly. See [Examples](/docs/reference/access-authn-authz/abac/#examples) for details. to review different modes for authorizing user accounts (as well as service account access to
your cluster):
- *Role-based access control* ([RBAC](/docs/reference/access-authn-authz/rbac/)): Lets you
assign access to your cluster by allowing specific sets of permissions to authenticated users.
Permissions can be assigned for a specific namespace (Role) or across the entire cluster
(ClusterRole). Then using RoleBindings and ClusterRoleBindings, those permissions can be attached
to particular users.
- *Attribute-based access control* ([ABAC](/docs/reference/access-authn-authz/abac/)): Lets you
create policies based on resource attributes in the cluster and will allow or deny access
based on those attributes. Each line of a policy file identifies versioning properties (apiVersion
and kind) and a map of spec properties to match the subject (user or group), resource property,
non-resource property (/version or /apis), and readonly. See
[Examples](/docs/reference/access-authn-authz/abac/#examples) for details.
As someone setting up authentication and authorization on your production Kubernetes cluster, here are some things to consider: As someone setting up authentication and authorization on your production Kubernetes cluster, here are some things to consider:
- *Set the authorization mode*: When the Kubernetes API server - *Set the authorization mode*: When the Kubernetes API server
([kube-apiserver](/docs/reference/command-line-tools-reference/kube-apiserver/)) ([kube-apiserver](/docs/reference/command-line-tools-reference/kube-apiserver/))
starts, the supported authentication modes must be set using the *--authorization-mode* starts, the supported authentication modes must be set using the *--authorization-mode*
flag. For example, that flag in the *kube-adminserver.yaml* file (in */etc/kubernetes/manifests*) flag. For example, that flag in the *kube-adminserver.yaml* file (in */etc/kubernetes/manifests*)
could be set to Node,RBAC. This would allow Node and RBAC authorization for authenticated requests. could be set to Node,RBAC. This would allow Node and RBAC authorization for authenticated requests.
- *Create user certificates and role bindings (RBAC)*: If you are using RBAC - *Create user certificates and role bindings (RBAC)*: If you are using RBAC
authorization, users can create a CertificateSigningRequest (CSR) that can be authorization, users can create a CertificateSigningRequest (CSR) that can be
signed by the cluster CA. Then you can bind Roles and ClusterRoles to each user. signed by the cluster CA. Then you can bind Roles and ClusterRoles to each user.
See [Certificate Signing Requests](/docs/reference/access-authn-authz/certificate-signing-requests/) See [Certificate Signing Requests](/docs/reference/access-authn-authz/certificate-signing-requests/)
for details. for details.
- *Create policies that combine attributes (ABAC)*: If you are using ABAC - *Create policies that combine attributes (ABAC)*: If you are using ABAC
authorization, you can assign combinations of attributes to form policies to authorization, you can assign combinations of attributes to form policies to
authorize selected users or groups to access particular resources (such as a authorize selected users or groups to access particular resources (such as a
pod), namespace, or apiGroup. For more information, see pod), namespace, or apiGroup. For more information, see
[Examples](/docs/reference/access-authn-authz/abac/#examples). [Examples](/docs/reference/access-authn-authz/abac/#examples).
- *Consider Admission Controllers*: Additional forms of authorization for - *Consider Admission Controllers*: Additional forms of authorization for
requests that can come in through the API server include requests that can come in through the API server include
[Webhook Token Authentication](/docs/reference/access-authn-authz/authentication/#webhook-token-authentication). [Webhook Token Authentication](/docs/reference/access-authn-authz/authentication/#webhook-token-authentication).
Webhooks and other special authorization types need to be enabled by adding Webhooks and other special authorization types need to be enabled by adding
[Admission Controllers](/docs/reference/access-authn-authz/admission-controllers/) [Admission Controllers](/docs/reference/access-authn-authz/admission-controllers/)
to the API server. to the API server.
## Set limits on workload resources ## Set limits on workload resources
@@ -256,38 +268,45 @@ of the Kubernetes control plane. Consider these items when setting up for the
needs of your cluster's workloads: needs of your cluster's workloads:
- *Set namespace limits*: Set per-namespace quotas on things like memory and CPU. See - *Set namespace limits*: Set per-namespace quotas on things like memory and CPU. See
[Manage Memory, CPU, and API Resources](/docs/tasks/administer-cluster/manage-resources/) [Manage Memory, CPU, and API Resources](/docs/tasks/administer-cluster/manage-resources/)
for details. You can also set for details. You can also set
[Hierarchical Namespaces](/blog/2020/08/14/introducing-hierarchical-namespaces/) [Hierarchical Namespaces](/blog/2020/08/14/introducing-hierarchical-namespaces/)
for inheriting limits. for inheriting limits.
- *Prepare for DNS demand*: If you expect workloads to massively scale up, - *Prepare for DNS demand*: If you expect workloads to massively scale up,
your DNS service must be ready to scale up as well. See your DNS service must be ready to scale up as well. See
[Autoscale the DNS service in a Cluster](/docs/tasks/administer-cluster/dns-horizontal-autoscaling/). [Autoscale the DNS service in a Cluster](/docs/tasks/administer-cluster/dns-horizontal-autoscaling/).
- *Create additional service accounts*: User accounts determine what users can - *Create additional service accounts*: User accounts determine what users can
do on a cluster, while a service account defines pod access within a particular do on a cluster, while a service account defines pod access within a particular
namespace. By default, a pod takes on the default service account from its namespace. namespace. By default, a pod takes on the default service account from its namespace.
See [Managing Service Accounts](/docs/reference/access-authn-authz/service-accounts-admin/) See [Managing Service Accounts](/docs/reference/access-authn-authz/service-accounts-admin/)
for information on creating a new service account. For example, you might want to: for information on creating a new service account. For example, you might want to:
- Add secrets that a pod could use to pull images from a particular container registry. See [Configure Service Accounts for Pods](/docs/tasks/configure-pod-container/configure-service-account/) for an example. - Add secrets that a pod could use to pull images from a particular container registry. See
- Assign RBAC permissions to a service account. See [ServiceAccount permissions](/docs/reference/access-authn-authz/rbac/#service-account-permissions) for details. [Configure Service Accounts for Pods](/docs/tasks/configure-pod-container/configure-service-account/)
for an example.
- Assign RBAC permissions to a service account. See
[ServiceAccount permissions](/docs/reference/access-authn-authz/rbac/#service-account-permissions)
for details.
## {{% heading "whatsnext" %}} ## {{% heading "whatsnext" %}}
- Decide if you want to build your own production Kubernetes or obtain one from - Decide if you want to build your own production Kubernetes or obtain one from
available [Turnkey Cloud Solutions](/docs/setup/production-environment/turnkey-solutions/) available [Turnkey Cloud Solutions](/docs/setup/production-environment/turnkey-solutions/)
or [Kubernetes Partners](https://kubernetes.io/partners/). or [Kubernetes Partners](https://kubernetes.io/partners/).
- If you choose to build your own cluster, plan how you want to - If you choose to build your own cluster, plan how you want to
handle [certificates](/docs/setup/best-practices/certificates/) handle [certificates](/docs/setup/best-practices/certificates/)
and set up high availability for features such as and set up high availability for features such as
[etcd](/docs/setup/production-environment/tools/kubeadm/setup-ha-etcd-with-kubeadm/) [etcd](/docs/setup/production-environment/tools/kubeadm/setup-ha-etcd-with-kubeadm/)
and the and the
[API server](/docs/setup/production-environment/tools/kubeadm/ha-topology/). [API server](/docs/setup/production-environment/tools/kubeadm/ha-topology/).
- Choose from [kubeadm](/docs/setup/production-environment/tools/kubeadm/), [kops](/docs/setup/production-environment/tools/kops/) or [Kubespray](/docs/setup/production-environment/tools/kubespray/) - Choose from [kubeadm](/docs/setup/production-environment/tools/kubeadm/),
deployment methods. [kops](/docs/setup/production-environment/tools/kops/) or
[Kubespray](/docs/setup/production-environment/tools/kubespray/)
deployment methods.
- Configure user management by determining your - Configure user management by determining your
[Authentication](/docs/reference/access-authn-authz/authentication/) and [Authentication](/docs/reference/access-authn-authz/authentication/) and
[Authorization](/docs/reference/access-authn-authz/authorization/) methods. [Authorization](/docs/reference/access-authn-authz/authorization/) methods.
- Prepare for application workloads by setting up - Prepare for application workloads by setting up
[resource limits](/docs/tasks/administer-cluster/manage-resources/), [resource limits](/docs/tasks/administer-cluster/manage-resources/),
[DNS autoscaling](/docs/tasks/administer-cluster/dns-horizontal-autoscaling/) [DNS autoscaling](/docs/tasks/administer-cluster/dns-horizontal-autoscaling/)
and [service accounts](/docs/reference/access-authn-authz/service-accounts-admin/). and [service accounts](/docs/reference/access-authn-authz/service-accounts-admin/).