{"id":13562692,"url":"https://github.com/cloudogu/k8s-diagrams","last_synced_at":"2025-05-16T07:05:32.119Z","repository":{"id":43842842,"uuid":"254403561","full_name":"cloudogu/k8s-diagrams","owner":"cloudogu","description":"A collection of kubernetes-related diagrams","archived":false,"fork":false,"pushed_at":"2025-01-09T10:26:06.000Z","size":37,"stargazers_count":337,"open_issues_count":0,"forks_count":66,"subscribers_count":21,"default_branch":"main","last_synced_at":"2025-04-08T16:09:54.958Z","etag":null,"topics":["authc","authn","container","deployment","k8s","kubernetes","node","pod","podsecuritypolicies","psp","rbac","security"],"latest_commit_sha":null,"homepage":"","language":null,"has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"agpl-3.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/cloudogu.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2020-04-09T15:05:35.000Z","updated_at":"2025-03-30T06:29:16.000Z","dependencies_parsed_at":"2024-01-14T03:45:15.421Z","dependency_job_id":"d360e19e-8e7d-4fb9-83d8-ffd871e13f83","html_url":"https://github.com/cloudogu/k8s-diagrams","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cloudogu%2Fk8s-diagrams","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cloudogu%2Fk8s-diagrams/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cloudogu%2Fk8s-diagrams/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cloudogu%2Fk8s-diagrams/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/cloudogu","download_url":"https://codeload.github.com/cloudogu/k8s-diagrams/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":254485060,"owners_count":22078767,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["authc","authn","container","deployment","k8s","kubernetes","node","pod","podsecuritypolicies","psp","rbac","security"],"created_at":"2024-08-01T13:01:11.255Z","updated_at":"2025-05-16T07:05:27.106Z","avatar_url":"https://github.com/cloudogu.png","language":null,"funding_links":[],"categories":["Others","Various Other Resources"],"sub_categories":["Activity Timeline"],"readme":"k8s-diagrams\n===\n\nA collection of diagrams explaining kubernetes, extracted from our \n- [k8s trainings](https://cloudogu.com/en/trainings/?mtm_campaign=k8sdiagrams\u0026mtm_kwd=trainings\u0026mtm_source=github\u0026mtm_medium=link)\n- [k8s AppOps Security eBook](https://my.cloudogu.com/kubernetes-appops-security-ebook) (German)\n- [blog articles](https://cloudogu.com/en/blog/tag/k8s-security/?mtm_campaign=k8sdiagrams\u0026mtm_kwd=blog\u0026mtm_source=github\u0026mtm_medium=link) \n- and talks ([k8s sec](https://github.com/cloudogu/k8s-appops-security-talks), [k8s intro](https://github.com/cloudogu/k8s-intro-talk))\n\n===\n\nThe diagrams are realized using [PlantUML](https://plantuml.com/), so they're basically text and can be adjusted easily.  \nNote that the diagrams don't use UML notation. They are rather box and line diagrams.\n\n# Table of contents\n\n\u003c!-- Update with `doctoc --notitle README.md`. See https://github.com/thlorenz/doctoc --\u003e\n\u003c!-- START doctoc generated TOC please keep comment here to allow auto update --\u003e\n\u003c!-- DON'T EDIT THIS SECTION, INSTEAD RE-RUN doctoc TO UPDATE --\u003e\n\n\n- [Deployment ➜ Pod ➜ Container](#deployment-%E2%9E%9C-pod-%E2%9E%9C-container)\n- [Pod ➜ Node](#pod-%E2%9E%9C-node)\n- [Services, Nodes and Pods explained](#services-nodes-and-pods-explained)\n- [Services, Nodes and Pods explained (including IP addresses)](#services-nodes-and-pods-explained-including-ip-addresses)\n- [Ingresses explained](#ingresses-explained)\n- [Rolling Updates explained](#rolling-updates-explained)\n- [Authentication and Authorization](#authentication-and-authorization)\n- [Role Based Access Control (RBAC) Resources](#role-based-access-control-rbac-resources)\n- [PodSecurityPolicy Activation via RBAC](#podsecuritypolicy-activation-via-rbac)\n- [Troubleshooting Kubernetes PodSecurityPolicies](#troubleshooting-kubernetes-podsecuritypolicies)\n- [GitOps](#gitops)\n  - [High-level overview](#high-level-overview)\n  - [Details](#details)\n\n\u003c!-- END doctoc generated TOC please keep comment here to allow auto update --\u003e\n\n\n# Deployment ➜ Pod ➜ Container\n\nRelationship between Deployment, Pod and Container.  \nSimplified - leaves out ReplicaSets for brevity.\n\n![](https://www.plantuml.com/plantuml/proxy?src=https://raw.githubusercontent.com/cloudogu/k8s-diagrams/master/diagrams/deploy-pod-container.puml\u0026fmt=svg)\n\n\n# Pod ➜ Node\n\nRelationship between Pod and Node.  \n\n![](https://www.plantuml.com/plantuml/proxy?src=https://raw.githubusercontent.com/cloudogu/k8s-diagrams/master/diagrams/pod-node.puml\u0026fmt=svg)\n\n\n# Services, Nodes and Pods explained\n\nTraffic flow from Cloud LoadBalancer via Service to Pods running on Nodes.\n\n![](https://www.plantuml.com/plantuml/proxy?src=https://raw.githubusercontent.com/cloudogu/k8s-diagrams/master/diagrams/services.puml\u0026fmt=svg)\n\n\n# Services, Nodes and Pods explained (including IP addresses)\n\nTraffic flow from Cloud LoadBalancer via Service to Pods running on Nodes.\nIncluding different address IP address ranges and ports:\n\n* external IP,\n* node internal and external IP and node port,\n* service IP,\n* pod IP and target port (on container)\n\n![](https://www.plantuml.com/plantuml/proxy?src=https://raw.githubusercontent.com/cloudogu/k8s-diagrams/master/diagrams/services-with-ip.puml\u0026fmt=svg)\n\n\n# Ingresses explained\n\nProgress of a requests from the ingress controller's service to the actual pod, illustrating the role of the `ingress` resource.\n\n![](https://www.plantuml.com/plantuml/proxy?src=https://raw.githubusercontent.com/cloudogu/k8s-diagrams/master/diagrams/ingress.puml\u0026fmt=svg)\n\n\n# Rolling Updates explained\n\n![](https://www.plantuml.com/plantuml/proxy?src=https://raw.githubusercontent.com/cloudogu/k8s-diagrams/master/diagrams/rolling-update.puml\u0026fmt=svg)\n\n\n# Authentication and Authorization\n\nFlow from user API server request to response: check authn via identity provider, then authz via RBAC.    \n\n![](https://www.plantuml.com/plantuml/proxy?src=https://raw.githubusercontent.com/cloudogu/k8s-diagrams/master/diagrams/k8s-auth.puml\u0026fmt=svg)\n\n# Role Based Access Control (RBAC) Resources\n\nA simplified display of resources involved in RBAC and their correlations.\n\nNote that \n* `Permission` is not a k8s resource, but a list of rules inside the (Cluster-)roles that make up a kind of permission.  \n  It consits of resources and verbs granted on it. For example: \n  * resources: \"secrets\"\n  * verbs: \"get\"\n* `Subject` can be a serviceAccount, user or group \n\n![](https://www.plantuml.com/plantuml/proxy?src=https://raw.githubusercontent.com/cloudogu/k8s-diagrams/master/diagrams/rbac.puml\u0026fmt=svg)\n\n\n# PodSecurityPolicy Activation via RBAC\n\nConnection from Pod to PSP via RBAC (Role, RoleBinding, ServiceAccount).\n\n![](https://www.plantuml.com/plantuml/proxy?src=https://raw.githubusercontent.com/cloudogu/k8s-diagrams/master/diagrams/psp-rbac.puml\u0026fmt=svg)\n\n\n# Troubleshooting Kubernetes PodSecurityPolicies\n\nA diagram to help debugging Kubernetes PodSecurityPolicies.\n\n![](https://www.plantuml.com/plantuml/proxy?src=https://raw.githubusercontent.com/cloudogu/k8s-diagrams/master/diagrams/troubleshooting-k8s-psps.puml\u0026fmt=svg)\n\n# GitOps\n\nDiagrams describing the general concepts of gitOps and distinguishing it from \"ciOps\".  \n\nSee also our\n* [GitOps playground](https://github.com/cloudogu/k8s-gitops-playground/) (to experience argocd and flux hands-on in a local k8s cluster), \n* [GitOps glossary](https://cloudogu.com/en/glossary/gitops/) and\n* [offerings for consulting](https://cloudogu.com/en/consulting/).\n\n## High-level overview \n\n![](https://www.plantuml.com/plantuml/proxy?src=https://raw.githubusercontent.com/cloudogu/k8s-diagrams/master/diagrams/ciops.puml\u0026fmt=svg)\n\n![](https://www.plantuml.com/plantuml/proxy?src=https://raw.githubusercontent.com/cloudogu/k8s-diagrams/master/diagrams/gitops-simple.puml\u0026fmt=svg)\n\n## Details \nThere are different options when implementing GitOps. Some of them are depicted bellow.\n\n![](https://www.plantuml.com/plantuml/proxy?src=https://raw.githubusercontent.com/cloudogu/k8s-diagrams/master/diagrams/gitops-with-image.puml\u0026fmt=svg)\n\nCI Server writes image version to GitOps Repo.\n\n---\n\n![](https://www.plantuml.com/plantuml/proxy?src=https://raw.githubusercontent.com/cloudogu/k8s-diagrams/master/diagrams/gitops-with-auto-update.puml\u0026fmt=svg)\n\nCI Server read-only on GitOps Repo; GitOps Operator writes image version to GitOps Repo.\n\n---\n\n![](https://www.plantuml.com/plantuml/proxy?src=https://raw.githubusercontent.com/cloudogu/k8s-diagrams/master/diagrams/gitops-with-app-repo.puml\u0026fmt=svg)\n\nInfra as Code stays in app repo, CI Server writes to GitOps repo.\n\n## GitOps Patterns\n\nSee [cloudogu/gitops-patterns](https://github.com/cloudogu/gitops-patterns) for more details on GitOps and diagrams.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcloudogu%2Fk8s-diagrams","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fcloudogu%2Fk8s-diagrams","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcloudogu%2Fk8s-diagrams/lists"}