4 ms·

If you (or someone on your team) is truly enjoying assembling DIY solutions using the best of what OSS has to offer, the possibilities of how to accomplish this

If you (or someone on your team) is truly enjoying assembling DIY solutions using the best of what OSS has to offer, the possibilities of how to accomplish this are endless. But for a single-command fire-and-forget commercial solution, take a look at http://gravitational.com/telekube http://gravitational.com/telekube It allows you to, basically, define your own "Kubernetes flavor" with pre-installed components like CI/CD pipeline, databases, redis, etc, call it "developer cluster foo" and have X replicas of it running on any infrastructure. Telekube runs a single process per box and manages dozens of parts (kube services, docker, systemd, terraform) automatically for you, does atomic in-place version upgrades of the entire stack, etc. It is basically a "kubernetes appliance" and that's how many of our customers use it: ship it in a box into on-premise environments. Yes, yes. It was a shameless plug since I work at Gravitational. We believe that DevOps folks have better things to do that spend any time provisioning Kubernetes and keeping it (and a dozen of components it now consists of) alive.

raesene9 9y ago
Interesting! Do you document what security options you use with Telekube anywhere? One of the things I've noticed with the wide variety of k8s distros and installers that there are is that it's not always easy to establish what they've chosen to do in that regard, and as some of the options like RBAC are newer and have some operational overhead, not every distro uses them.
- old-gregg 9y ago
  Yes, the security portion of our clusters is handled by Teleport, which is OSS and its architecture is well-documented here: http://gravitational.com/teleport/docs/2.0/architecture/ http://gravitational.com/teleport/docs/2.0/architecture/ Teleport maps your corporate groups/roles to both SSH and Kubernetes.
  - raesene6 9y ago
    thanks for that. I was perhaps more thinking of areas around how you configure kubernetes. for example, do you use RBAC, do you configure kubelet authentication/authorization, what certificates are used by the API server for etcd authentication? that kind of thing :) If there's manifests/pod speccs for the components that'd probably have the answers...

raesene9 9y ago

Interesting! Do you document what security options you use with Telekube anywhere? One of the things I've noticed with the wide variety of k8s distros and installers that there are is that it's not always easy to establish what they've chosen to do in that regard, and as some of the options like RBAC are newer and have some operational overhead, not every distro uses them.

old-gregg 9y ago
Yes, the security portion of our clusters is handled by Teleport, which is OSS and its architecture is well-documented here: http://gravitational.com/teleport/docs/2.0/architecture/ http://gravitational.com/teleport/docs/2.0/architecture/ Teleport maps your corporate groups/roles to both SSH and Kubernetes.
- raesene6 9y ago
  thanks for that. I was perhaps more thinking of areas around how you configure kubernetes. for example, do you use RBAC, do you configure kubelet authentication/authorization, what certificates are used by the API server for etcd authentication? that kind of thing :) If there's manifests/pod speccs for the components that'd probably have the answers...