2020-07-09 15:33:00 +00:00
|
|
|
KubeZero - Zero Down Time Kubernetes platform
|
|
|
|
|
========================
|
|
|
|
|
KubeZero is a pre-configured collection of components deployed onto a bare Kubernetes cluster.
|
|
|
|
|
All chosen components are 100% organic OpenSource.
|
2020-05-01 13:57:31 +00:00
|
|
|
|
2020-07-09 15:33:00 +00:00
|
|
|
# Design goals
|
2020-05-01 14:08:55 +00:00
|
|
|
|
2020-07-09 15:33:00 +00:00
|
|
|
- Cloud provider agnostic, bare-metal / self-hosted possible
|
|
|
|
|
- No vendor lock in
|
|
|
|
|
- No closed source solutions
|
|
|
|
|
- No premium services / subscriptions required
|
|
|
|
|
- Staying to upstream projects as close as possible
|
|
|
|
|
- Minimal custom code
|
|
|
|
|
- Work within each community / give back
|
2020-05-01 14:08:55 +00:00
|
|
|
|
|
|
|
|
|
2020-08-26 10:41:28 +00:00
|
|
|
## General
|
|
|
|
|
- Container runtime cri-o rather than Docker for improved security and performance
|
2020-05-01 14:08:55 +00:00
|
|
|
|
2020-07-09 15:33:00 +00:00
|
|
|
|
2020-08-26 10:41:28 +00:00
|
|
|
## Control plane
|
|
|
|
|
- support for single node control plane for small clusters / test environments to reduce costs
|
|
|
|
|
- access to control plane from within the VPC only by default ( VPN access required for Admin tasks )
|
|
|
|
|
- controller nodes are used for various platform admin controllers / operators to reduce costs and noise on worker nodes
|
|
|
|
|
- integrated ArgoCD Gitops controller
|
2020-07-09 15:33:00 +00:00
|
|
|
|
2020-08-26 10:41:28 +00:00
|
|
|
## AWS IAM access control
|
|
|
|
|
- Kiam allowing IAM roles per pod
|
|
|
|
|
- IAM roles are assumed / requested and cached on controller nodes for improved security
|
|
|
|
|
- blocking access to meta-data service on all nodes
|
|
|
|
|
- IAM roles are maintained/ automated and tracked via CFN templates
|
2020-07-09 15:33:00 +00:00
|
|
|
|
2020-08-26 10:41:28 +00:00
|
|
|
## Network
|
|
|
|
|
- Calico using VxLAN incl. increased MTU
|
|
|
|
|
- allows way more containers per worker
|
|
|
|
|
- isolates container traffic from VPC by using VxLAN overlay
|
|
|
|
|
- no restrictions on IP space / sizing from the underlying VPC architecture
|
2020-07-09 15:33:00 +00:00
|
|
|
|
|
|
|
|
## Storage
|
2020-08-26 10:41:28 +00:00
|
|
|
- flexible EBS support incl. zone awareness
|
|
|
|
|
- EFS support via automated EFS provisioning for worker groups via CFN templates
|
|
|
|
|
- local storage provider for latency sensitive high performance workloads
|
|
|
|
|
|
|
|
|
|
## Ingress
|
|
|
|
|
- AWS Network Loadbalancer and Istio Ingress controllers
|
|
|
|
|
- No additional costs per exposed service
|
|
|
|
|
- Automated SSL Certificate handling via cert-manager incl. renewal etc.
|
|
|
|
|
- support for TCP services
|
|
|
|
|
- Client source IP available to workloads via HTTP header
|
|
|
|
|
- optional full service mesh
|
|
|
|
|
|
|
|
|
|
## Metrics
|
|
|
|
|
- Prometheus support for all components
|
|
|
|
|
- automated service discovery allowing instant access to common workload metrics
|
|
|
|
|
- Preconfigured community maintained Grafana dashboards for common services
|
|
|
|
|
- Preconfigured community maintained Alerts
|
2020-05-01 14:08:55 +00:00
|
|
|
|
2020-08-26 10:41:28 +00:00
|
|
|
## Logging
|
|
|
|
|
- all container logs are enhanced with Kubernetes metadata to provide context for each message
|
|
|
|
|
- flexible ElasticSearch setup via ECK operator to ease maintenance and reduce required admin knowledge, incl automated backups to S3
|
|
|
|
|
- Kibana allowing easy search and dashboards for all logs, incl. pre configured index templates and index management to reduce costs
|
|
|
|
|
- fluentd central log ingress service allowing additional parsing and queuing to improved reliability
|
|
|
|
|
- lightweight fluent-bit agents on each node requiring minimal resources forwarding logs secure via SSL to fluentd
|
