ZeroDownTime/KubeZero
3
0
Fork 0
Code Issues 1 Pull Requests 25 Packages Projects Releases Wiki Activity
ZeroDownTime Kubernetes platform - https://kubezero.com
749 Commits 28 Branches 0 Tags 7.6 MiB
Smarty 55.8%
Shell 24%
CSS 9.9%
Python 4.4%
Makefile 2.7%
Other 3.2%
fa5c1f9b2a
Go to file
Stefan Reimer fa5c1f9b2a fix: another round of ugrade fixes for 1.22
2022-05-04 16:59:17 +02:00
charts fix: another round of ugrade fixes for 1.22 2022-05-04 16:59:17 +02:00
docs chore: doc reorg to prep 1.22 release, RunTimeClass config for crun 2022-04-13 12:24:10 +02:00
releases fix: another round of ugrade fixes for 1.22 2022-05-04 16:59:17 +02:00
scripts fix: Fix CNI upgrade, new ECK CRDs, new logging, Istio fixes 2022-04-29 20:22:20 +02:00
.gitattributes Initial commit 2020-05-01 14:57:31 +01:00
.gitignore chore: some cleanup, new tools script to check cgroup memory limits 2021-04-14 16:06:29 +02:00
.helmdocsignore CI/CD tools update 2021-01-21 10:53:53 +00:00
.versionrc chore: checkin diffs to sync desktop 2021-05-12 16:32:33 +02:00
CHANGELOG.md More documentation updates 2021-01-26 14:04:47 +00:00
cliff.toml fix: various minor tweaks and updates 2021-08-25 16:02:21 +02:00
Dockerfile ci: Reorg kubezero container build 2022-04-08 17:09:40 +02:00
LICENSE.md Initial commit 2020-05-01 14:57:31 +01:00
Makefile ci: Reorg kubezero container build 2022-04-08 17:09:40 +02:00
README.md doc: update readme 2022-05-03 15:58:03 +02:00

README.md

KubeZero - Zero Down Time Kubernetes platform

KubeZero is a Kubernetes distribution providing an integrated container platform so you can focus on your applications.

Design philosophy

  • Cloud provider agnostic, bare-metal/self-hosted
  • Focus on security and simplicity before feature bloat
  • No vendor lock in, most components are optional and could be exchanged
  • Organic Open Source / open and permissive licenses over closed-source solutions
  • No premium services / subscriptions required
  • Staying and contributing back to upstream projects as much as possible
  • Corgi approved 🐶

Architecture

aws_architecture

Version / Support Matrix

KubeZero releases track the same minor version of Kubernetes.
Any 1.21.X-Y release of Kubezero supports any Kubernetes cluster 1.21.X.

KubeZero is distributed as a collection of versioned Helm charts, allowing custom upgrade schedules and module versions as needed.

KubeZero Version Kubernetes Version EOL
v1.23.X-Y v1.23.X Alpha
v1.22.8-Y v1.22.8 30 Sep 2022
v1.21.9-Y v1.21.9 31 May 2022
v1.20.8 v1.20 Feb 2022
v1.19 v1.19 Jul 2021
v1.18 v1.18 Apr 2021

Upstream release policy

Components

OS

  • all nodes are based on Alpine V3.15
  • 2 GB encrypted root filesystem
  • no 3rd party dependencies at boot ( other than container registries )
  • minimal attack surface
  • extremely small memory footprint / overhead

Container runtime

  • cri-o rather than Docker for improved security and performance

Control plane

  • all Kubernetes components compiled against Alpine OS using buildmode=pie
  • support for single node control plane for small clusters / test environments to reduce costs
  • access to control plane from within the VPC only by default ( VPN access required for Admin tasks )
  • controller nodes are used for various platform admin controllers / operators to reduce costs and noise on worker nodes

GitOps

  • cli / cmd line install
  • optional full ArgoCD support and integration
  • fuse device plugin support to build containers as part of a CI pipeline leveraging rootless podman build agents

AWS integrations

  • IAM roles for service accounts allowing each pod to assume individual IAM roles
  • access to meta-data services is blocked all workload containers on all nodes
  • all IAM roles are maintained via CloudBender automation
  • aws-node-termination handler integrated
  • support for spot instances per worker group incl. early draining etc.
  • support for Inf1 instances part of AWS Neuron.

Network

  • Multus support for multiple network interfaces per pod, eg. additional AWS CNI
  • Calico using VxLAN incl. increased MTU
    allows flexible / more containers per worker node compared to eg. AWS VPC CNI
  • isolates container traffic from VPC by using VxLAN overlay
  • no restrictions on IP space / sizing from the underlying VPC architecture

Storage

  • flexible EBS support incl. zone awareness
  • EFS support via automated EFS provisioning for worker groups via CloudBender automation
  • local storage provider (OpenEBS LVM) for latency sensitive high performance workloads
  • CSI Snapshot controller and Gemini snapshot groups and retention

Ingress

  • AWS Network Loadbalancer and Istio Ingress controllers
  • no additional costs per exposed service
  • real client source IP available to workloads via HTTP header and access logs
  • ACME SSL Certificate handling via cert-manager incl. renewal etc.
  • support for TCP services
  • optional rate limiting support
  • optional full service mesh

Metrics

  • Prometheus support for all components
  • automated service discovery allowing instant access to common workload metrics
  • pre-configured Grafana dashboards and alerts
  • Alertmanager events via SNSAlertHub to Slack, Google, Matrix, etc.

Logging

  • all container logs are enhanced with Kubernetes and AWS metadata to provide context for each message
  • flexible ElasticSearch setup, leveraging the ECK operator, for easy maintenance & minimal admin knowledge required, incl. automated backups to S3
  • Kibana allowing easy search and dashboards for all logs, incl. pre configured index templates and index management
  • fluentd-concerter service providing queuing during highload as well as additional parsing options
  • lightweight fluent-bit agents on each node requiring minimal resources forwarding logs secure via TLS to fluentd-concenter