KubeZero - Zero Down Time Kubernetes platform

KubeZero is a pre-configured collection of components deployed onto a bare Kubernetes cluster. All chosen components are 100% organic OpenSource.

Design goals

• Cloud provider agnostic, bare-metal / self-hosted possible
• No vendor lock in
• No closed source solutions
• No premium services / subscriptions required
• Staying to upstream projects as close as possible
• Minimal custom code
• Work within each community / give back

Version / Support Matrix

KubeZero \ Kubernetes Version	v1.17	v1.18	v1.19	v1.20+	EOL
master branch	no	yes	beta	no
stable branch	yes	no	no	no
v2.18.0	no	yes	no	no	30 Apr 2021
v1	yes	no	no	no	30 Jan 2021

General

• Container runtime cri-o rather than Docker for improved security and performance

Control plane

• support for single node control plane for small clusters / test environments to reduce costs
• access to control plane from within the VPC only by default ( VPN access required for Admin tasks )
• controller nodes are used for various platform admin controllers / operators to reduce costs and noise on worker nodes
• integrated ArgoCD Gitops controller

AWS IAM access control

• Kiam allowing IAM roles per pod
• IAM roles are assumed / requested and cached on controller nodes for improved security
• blocking access to meta-data service on all nodes
• IAM roles are maintained/ automated and tracked via CFN templates

Network

• Calico using VxLAN incl. increased MTU
• allows way more containers per worker
• isolates container traffic from VPC by using VxLAN overlay
• no restrictions on IP space / sizing from the underlying VPC architecture

Storage

• flexible EBS support incl. zone awareness
• EFS support via automated EFS provisioning for worker groups via CFN templates
• local storage provider for latency sensitive high performance workloads

Ingress

• AWS Network Loadbalancer and Istio Ingress controllers
• No additional costs per exposed service
• Automated SSL Certificate handling via cert-manager incl. renewal etc.
• support for TCP services
• Client source IP available to workloads via HTTP header
• optional full service mesh

Metrics

• Prometheus support for all components
• automated service discovery allowing instant access to common workload metrics
• Preconfigured community maintained Grafana dashboards for common services
• Preconfigured community maintained Alerts

Logging

• all container logs are enhanced with Kubernetes metadata to provide context for each message
• flexible ElasticSearch setup via ECK operator to ease maintenance and reduce required admin knowledge, incl automated backups to S3
• Kibana allowing easy search and dashboards for all logs, incl. pre configured index templates and index management to reduce costs
• fluentd central log ingress service allowing additional parsing and queuing to improved reliability
• lightweight fluent-bit agents on each node requiring minimal resources forwarding logs secure via SSL to fluentd