3 ms·

would've been easier to just migrate to k8s and used some kind of ignition/managed k8s (and maybe ansible, if things still needs some manual tweaking).

by merb 9y ago

kuschku 9y ago
Let's make one thing very clear here - k8s is never easy. I've been running a cluster since it became usable, and it definitely is the opposite of easy. Kubernetes is powerful, it is modular, and it makes everything a lot more efficient, but setting it up - especially in such large deployments as 1Password would have here - is never easy.
- _ix 9y ago
  Any recommendations toward primers and getting started with k8s?
  - kuschku 9y ago
    Manning's Kubernetes in action is a good start, additionally I can recommend everything Kelsey Hightower created on that topic. Also, I recommend that you first try using kubernetes before you dive in with setting it up. Kubernetes.io has a live tutorial where you can work with a minikube cluster in your browser, afterwards you might want to use Google Cloud's free tier for a small Kubernetes cluster or Minikube until you're comfortable with kubernetes. For seting up your own cluster, I've heard great stuff about kubernetes the hard way – not to actually set one up, but to learn how the internals work, so you can then fix issues in the cluster you’ll set up with kubeadm/kops/GKE
roustem 9y ago
I would love to migrate to k8s at some point. It would make some things easier. We still need to figure out how to do that without downgrading our existing security configuration -- a lot of it depends on running different services in their own subnets and AWS security roles. It might be easier now that AWS is starting to support Kubernetes.
ben0x539 9y ago
I'm really interested in migrating some of our own systems/services to k8s and I'd love if you could elaborate a bit. How do IAM resouces or VPC subnets etc map to k8s concepts?
- kronin 9y ago
  You can use IAM to auth to a cluster using heptio authenticator https://github.com/heptio/authenticator/blob/master/README.md https://github.com/heptio/authenticator/blob/master/README.m... You can grant IAM roles to individual pods running in k8s using kube2iam, though there are new advancements seemingly coming, or already out, now that amazon has announced eks. https://github.com/jtblin/kube2iam https://github.com/jtblin/kube2iam Kops can provision and manage a cluster that incorporates multiple subnets allowing you to have a multi-az buildout https://github.com/kubernetes/kops/blob/master/docs/high_availability.md https://github.com/kubernetes/kops/blob/master/docs/high_ava...
- merb 9y ago
  well k8s has his own RBAC system so IAM does not map 1:1. The same with VPC subnets, you actually have your own network with k8s. Some can peer via BGP, like kube-router (as far as I know) and calico (which I use). So basically k8s is a little bit different than the concepts of aws.

would've been easier to just migrate to k8s and used some kind of ignition/managed k8s (and maybe ansible, if things still needs some manual tweaking).

by merb 9y ago

would've been easier to just migrate to k8s and used some kind of ignition/managed k8s (and maybe ansible, if things still needs some manual tweaking).

kuschku 9y ago

Let's make one thing very clear here - k8s is never easy. I've been running a cluster since it became usable, and it definitely is the opposite of easy. Kubernetes is powerful, it is modular, and it makes everything a lot more efficient, but setting it up - especially in such large deployments as 1Password would have here - is never easy.

_ix 9y ago
Any recommendations toward primers and getting started with k8s?
- kuschku 9y ago
  Manning's Kubernetes in action is a good start, additionally I can recommend everything Kelsey Hightower created on that topic. Also, I recommend that you first try using kubernetes before you dive in with setting it up. Kubernetes.io has a live tutorial where you can work with a minikube cluster in your browser, afterwards you might want to use Google Cloud's free tier for a small Kubernetes cluster or Minikube until you're comfortable with kubernetes. For seting up your own cluster, I've heard great stuff about kubernetes the hard way – not to actually set one up, but to learn how the internals work, so you can then fix issues in the cluster you’ll set up with kubeadm/kops/GKE

roustem 9y ago

I would love to migrate to k8s at some point. It would make some things easier. We still need to figure out how to do that without downgrading our existing security configuration -- a lot of it depends on running different services in their own subnets and AWS security roles. It might be easier now that AWS is starting to support Kubernetes.

ben0x539 9y ago

I'm really interested in migrating some of our own systems/services to k8s and I'd love if you could elaborate a bit. How do IAM resouces or VPC subnets etc map to k8s concepts?

kronin 9y ago
You can use IAM to auth to a cluster using heptio authenticator https://github.com/heptio/authenticator/blob/master/README.md https://github.com/heptio/authenticator/blob/master/README.m... You can grant IAM roles to individual pods running in k8s using kube2iam, though there are new advancements seemingly coming, or already out, now that amazon has announced eks. https://github.com/jtblin/kube2iam https://github.com/jtblin/kube2iam Kops can provision and manage a cluster that incorporates multiple subnets allowing you to have a multi-az buildout https://github.com/kubernetes/kops/blob/master/docs/high_availability.md https://github.com/kubernetes/kops/blob/master/docs/high_ava...
merb 9y ago
well k8s has his own RBAC system so IAM does not map 1:1. The same with VPC subnets, you actually have your own network with k8s. Some can peer via BGP, like kube-router (as far as I know) and calico (which I use). So basically k8s is a little bit different than the concepts of aws.