KubeZero - Zero Down Time Kubernetes platform ======================== KubeZero is a Kubernetes distribution providing an opinionated, pre-configured container platform incl. various addons and services. # Design goals - Cloud provider agnostic, bare-metal / self-hosted possible - No vendor lock in, most components are optional and could be exchanged - Organic OpenSource / open and permissive licenses over closed-source solutions - No premium services / subscriptions required - Staying and contributing back to upstream projects as much as possible # Version / Support Matrix | KubeZero \ Kubernetes Version | v1.17 | v1.18 | v1.19 | v1.20 | EOL | |----------------------------------------|-------|-------|-------|-------|-------------| | master branch | no | yes | beta | no | | | stable branch | no | yes | no | no | | | v2.18.0 | no | yes | no | no | 30 Apr 2021 | | v1 | yes | no | no | no | 30 Jan 2021 | ## General - Container runtime cri-o rather than Docker for improved security and performance ## Control plane - support for single node control plane for small clusters / test environments to reduce costs - access to control plane from within the VPC only by default ( VPN access required for Admin tasks ) - controller nodes are used for various platform admin controllers / operators to reduce costs and noise on worker nodes ## GitOps - full ArgoCD support and integration (optional) ## AWS IAM access control - Kiam allowing IAM roles per pod - IAM roles are assumed / requested and cached on controller nodes for improved security - access to meta-data services is blocked / controlled on all nodes - core IAM roles are maintained via CFN templates ## Network - Calico using VxLAN incl. increased MTU - allows way more containers per worker - isolates container traffic from VPC by using VxLAN overlay - no restrictions on IP space / sizing from the underlying VPC architecture ## Storage - flexible EBS support incl. zone awareness - EFS support via automated EFS provisioning for worker groups via CFN templates - local storage provider for latency sensitive high performance workloads ## Ingress - AWS Network Loadbalancer and Istio Ingress controllers - No additional costs per exposed service - Automated SSL Certificate handling via cert-manager incl. renewal etc. - support for TCP services - Client source IP available to workloads via HTTP header - optional full service mesh ## Metrics - Prometheus support for all components - automated service discovery allowing instant access to common workload metrics - Preconfigured community maintained Grafana dashboards for common services - Preconfigured community maintained Alerts ## Logging - all container logs are enhanced with Kubernetes metadata to provide context for each message - flexible ElasticSearch setup, leveraging the ECK operator, for easy maintenance & minimal admin knowledge required, incl. automated backups to S3 - Kibana allowing easy search and dashboards for all logs, incl. pre configured index templates and index management - central fluentd service providing queuing during highload as well as additional parsing options - lightweight fluent-bit agents on each node requiring minimal resources forwarding logs secure via SSL to fluentd