Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google Kubernetes clusters config checker tool

github.com

Post reply on HN
Print view View original

11–20 of 34 posts

Re: Google Kubernetes clusters config checker tool

#11

Post by pdimitar »

cyberpunk wrote: post #10
pdimitar wrote: post #9

As many people predicted years ago (I can't claim to know k8s that well, in fact I suck at it), eventually we'll go full circle and k8s config will just become its own specialized programming language. Maybe we should stop moving these things so agonizingly slow and through the path of natural (and did I mention slow as molasses ) evolution and just skip to the endgame that most of us know will inevitably come? Appar…

Why do you need a 'specialized programming language' when kube for most people, is just waiting for various objects via api? I mean, sure, ATM it can be a bit painful to generate your 'Deployment' object in json or yaml or whatever, but then it's just a post to the kubeapi and it's done.. You can do that in any language you want.. What am I missing?

You're missing the part where people do this periodically and can never truly remember all the gotchas so they make small mistakes with time that at one point make your cluster fall over with cryptic error messages. I've seen it (but as I said above I am by no means a k8s pro).

That's why there are these linters.

Having a small super-specialized language that catches errors before "compiling" your configuration to an YAML will help hugely.

Re: Google Kubernetes clusters config checker tool

#12

Post by adamgordonbell »

pdimitar wrote: post #11
cyberpunk wrote: post #10

Earlier quoted context omitted.

Why do you need a 'specialized programming language' when kube for most people, is just waiting for various objects via api? I mean, sure, ATM it can be a bit painful to generate your 'Deployment' object in json or yaml or whatever, but then it's just a post to the kubeapi and it's done.. You can do that in any language you want.. What am I missing?

You're missing the part where people do this periodically and can never truly remember all the gotchas so they make small mistakes with time that at one point make your cluster fall over with cryptic error messages. I've seen it (but as I said above I am by no means a k8s pro). That's why there are these linters. Having a small super-specialized language that catches errors before "compiling" your configuration to an…

Dhall for kubernetes might be what you are looking for.

https://github.com/dhall-lang/dhall-kubernetes

Re: Google Kubernetes clusters config checker tool

#13

Post by pdimitar »

adamgordonbell wrote: post #12
pdimitar wrote: post #11

Earlier quoted context omitted.

You're missing the part where people do this periodically and can never truly remember all the gotchas so they make small mistakes with time that at one point make your cluster fall over with cryptic error messages. I've seen it (but as I said above I am by no means a k8s pro). That's why there are these linters. Having a small super-specialized language that catches errors before "compiling" your configuration to an…

Dhall for kubernetes might be what you are looking for. https://github.com/dhall-lang/dhall-kubernetes

Ha, nice, I'll take a look -- thanks.

Re: Google Kubernetes clusters config checker tool

#14

Post by solatic »

https://github.com/google/gke-policy-automation/blob/main/gk...

What's the point of requiring the control plane to be locked down to authorized networks (IP address ranges)? Isn't Google responsible for DDoS protection, enforcing authentication controls (i.e. logging in with a Google account in the right Google group), patching the control plane ASAP for any security vulnerabilities?

If you have a VPN, if you have heavy-duty network monitoring on your VPN endpoint, sure, limit it to the VPN. For the rest of us? Is every startup running GKE without heavy-duty VPN / network monitoring fundamentally insecure? That doesn't sound right to me. Security is supposed to be a spectrum, and it seems like black-and-white automated config checkers like these are more likely to provoke arguments internally ("but the tool said it's bad!!") than to help reach a nuanced understanding of why tradeoffs are made. No?

Re: Google Kubernetes clusters config checker tool

#15

Post by paulgb »

vaughands wrote: post #8
nova22033 wrote: post #7

Earlier quoted context omitted.

This is not an officially supported Google product. How does this work? It's developed by google but it's not officially supported?

It's likely someone's 20% project.

Google also has (or had? it's been 7 years since I was there) pretty strict rules around working on your own OSS even on your free time, so the easiest way is (was?) for Google to own the IP and apply an open source license.

Re: Google Kubernetes clusters config checker tool

#16

Post by phailhaus »

pdimitar wrote: post #9

As many people predicted years ago (I can't claim to know k8s that well, in fact I suck at it), eventually we'll go full circle and k8s config will just become its own specialized programming language. Maybe we should stop moving these things so agonizingly slow and through the path of natural (and did I mention slow as molasses ) evolution and just skip to the endgame that most of us know will inevitably come? Appar…

There's no reason to create an entirely new language. Since k8s manifests can be represented in JSON, you can use existing templating languages like Jsonnet [1] in order to generate it for you. All we need is an official library.

[1] https://jsonnet.org/

Re: Google Kubernetes clusters config checker tool

#17

Post by ninkendo »

phailhaus wrote: post #16
pdimitar wrote: post #9

As many people predicted years ago (I can't claim to know k8s that well, in fact I suck at it), eventually we'll go full circle and k8s config will just become its own specialized programming language. Maybe we should stop moving these things so agonizingly slow and through the path of natural (and did I mention slow as molasses ) evolution and just skip to the endgame that most of us know will inevitably come? Appar…

There's no reason to create an entirely new language. Since k8s manifests can be represented in JSON, you can use existing templating languages like Jsonnet [1] in order to generate it for you. All we need is an official library. [1] https://jsonnet.org/

There was a tool called ksonnet for this (jsonnet + a default library for k8s configs), but the company behind it got bought and it's no longer maintained: https://github.com/ksonnet/ksonnet

Re: Google Kubernetes clusters config checker tool

#18

Post by mdaniel »

paulgb wrote: post #15
vaughands wrote: post #8

Earlier quoted context omitted.

It's likely someone's 20% project.

Google also has (or had? it's been 7 years since I was there) pretty strict rules around working on your own OSS even on your free time, so the easiest way is (was?) for Google to own the IP and apply an open source license.

I somehow got the impression that kind of restriction was illegal in California, although I guess it's like a lot of things in the legal domain: those who have the most lawyers wins

Re: Google Kubernetes clusters config checker tool

#19

Post by no_circuit »

solatic wrote: post #14

https://github.com/google/gke-policy-automation/blob/main/gk... What's the point of requiring the control plane to be locked down to authorized networks (IP address ranges)? Isn't Google responsible for DDoS protection, enforcing authentication controls (i.e. logging in with a Google account in the right Google group), patching the control plane ASAP for any security vulnerabilities? If you have a VPN, if you have he…

Likely security in layers. Why expose your control plane to attacks directly from the internet if you don't have to? Cuts down login attempts noise in logs since anything would have to be coming from the VPC. Other than initial setup of a bastion -- that's the tradeoff -- sounds like less to worry about for a small shop or a startup. Same for Cloud SQL or any other managed service.

Re: Google Kubernetes clusters config checker tool

#20

Post by jkaplowitz »

mdaniel wrote: post #18
paulgb wrote: post #15

Earlier quoted context omitted.

Google also has (or had? it's been 7 years since I was there) pretty strict rules around working on your own OSS even on your free time, so the easiest way is (was?) for Google to own the IP and apply an open source license.

I somehow got the impression that kind of restriction was illegal in California, although I guess it's like a lot of things in the legal domain: those who have the most lawyers wins

California applies limits to such restrictions, but does allow them when the side projects in question relate to the employer's actual or demonstrably anticipated business, among other exceptions. A tool specific to Google Kubernetes Engine, as we're discussing here, plainly relates to Google's business.

My memory of Google US employment legalese - note I have not worked for them for over 7 years and am not speaking for them here - is that they acknowledge limits to their IP assignment provisions which are consistent with California law. Any Googler who is confident that those limits protect their ownership by default of their side project does not have to seek Google's approval in order to own it, even according to the contract wording.

But Google's business is so broad that it's often legitimately debatable (and sometimes beyond the knowledge of the Googler doing the work) as to whether something would be in scope. So getting their approval, which can come either with explicit assignment of rights back to the Googler or explicit permission to release under Google copyright, is often the prudent approach to minimize undesired risks.

Post reply on HN