ZeroDownTime/KubeZero
3
0
Fork 0
Code Issues 1 Pull Requests 23 Packages Projects Releases Wiki Activity
ZeroDownTime Kubernetes platform - https://kubezero.com
390 Commits 26 Branches 0 Tags 7.6 MiB
Smarty 68.7%
Shell 17.1%
CSS 7%
Python 3.1%
Makefile 1.9%
Other 2.2%
9ca8920387
Go to file
Stefan Reimer 9ca8920387 Fix changed key for kiam
2021-01-21 13:35:20 +00:00
charts Fix changed key for kiam 2021-01-21 13:35:20 +00:00
docs More logging tuning 2020-12-10 06:36:26 -08:00
scripts CI/CD tools update 2021-01-21 10:53:53 +00:00
.gitattributes Initial commit 2020-05-01 14:57:31 +01:00
.gitignore Version bump for aws-ebs-csi and kiam, ES bugfix bump, fluentd tuning 2021-01-21 12:31:06 +00:00
.helmdocsignore CI/CD tools update 2021-01-21 10:53:53 +00:00
CHANGES.md Add custom prometehus-operator settings 2020-08-06 11:52:16 +01:00
LICENSE.md Initial commit 2020-05-01 14:57:31 +01:00
Makefile Version bump for aws-ebs-csi and kiam, ES bugfix bump, fluentd tuning 2021-01-21 12:31:06 +00:00
README.md CI/CD tools update 2021-01-21 10:53:53 +00:00

README.md

KubeZero - Zero Down Time Kubernetes platform

KubeZero is a pre-configured collection of components deployed onto a bare Kubernetes cluster. All chosen components are 100% organic OpenSource.

Design goals

  • Cloud provider agnostic, bare-metal / self-hosted possible
  • No vendor lock in
  • No closed source solutions
  • No premium services / subscriptions required
  • Staying to upstream projects as close as possible
  • Minimal custom code
  • Work within each community / give back

Version / Support Matrix

KubeZero \ Kubernetes Version v1.17 v1.18 v1.19 v1.20 EOL
master branch no yes beta no
stable branch no yes no no
v2.18.0 no yes no no 30 Apr 2021
v1 yes no no no 30 Jan 2021

General

  • Container runtime cri-o rather than Docker for improved security and performance

Control plane

  • support for single node control plane for small clusters / test environments to reduce costs
  • access to control plane from within the VPC only by default ( VPN access required for Admin tasks )
  • controller nodes are used for various platform admin controllers / operators to reduce costs and noise on worker nodes
  • integrated ArgoCD Gitops controller

AWS IAM access control

  • Kiam allowing IAM roles per pod
  • IAM roles are assumed / requested and cached on controller nodes for improved security
  • blocking access to meta-data service on all nodes
  • IAM roles are maintained/ automated and tracked via CFN templates

Network

  • Calico using VxLAN incl. increased MTU
  • allows way more containers per worker
  • isolates container traffic from VPC by using VxLAN overlay
  • no restrictions on IP space / sizing from the underlying VPC architecture

Storage

  • flexible EBS support incl. zone awareness
  • EFS support via automated EFS provisioning for worker groups via CFN templates
  • local storage provider for latency sensitive high performance workloads

Ingress

  • AWS Network Loadbalancer and Istio Ingress controllers
  • No additional costs per exposed service
  • Automated SSL Certificate handling via cert-manager incl. renewal etc.
  • support for TCP services
  • Client source IP available to workloads via HTTP header
  • optional full service mesh

Metrics

  • Prometheus support for all components
  • automated service discovery allowing instant access to common workload metrics
  • Preconfigured community maintained Grafana dashboards for common services
  • Preconfigured community maintained Alerts

Logging

  • all container logs are enhanced with Kubernetes metadata to provide context for each message
  • flexible ElasticSearch setup via ECK operator to ease maintenance and reduce required admin knowledge, incl automated backups to S3
  • Kibana allowing easy search and dashboards for all logs, incl. pre configured index templates and index management to reduce costs
  • fluentd central log ingress service allowing additional parsing and queuing to improved reliability
  • lightweight fluent-bit agents on each node requiring minimal resources forwarding logs secure via SSL to fluentd