Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Kubernetes Config Connector: Provision GCP Infrastructure Using Kubernetes

github.com

Post reply on HN
Print view View original

11–20 of 26 posts

Re: Kubernetes Config Connector: Provision GCP Infrastructure Using Kubernetes

#11

Post by migueloller »

zxcmx wrote: post #9
ec109685 wrote: post #2

AWS started building something similar but momentum seems to have stopped once the developer left: https://aws.amazon.com/blogs/opensource/aws-service-operator... It is too bad because declarative specifications and control loops to have state converge to what it should be is a nice pattern. Keeping up with all of AWS’s surface area though is hard if their heart isn’t in it.

We thought about this pattern for a while and ultimately decided we didn't want app compute to directly provision supporting infrastructure. You end up in this weird place where your compute nodes can, at any time, assume super powerful roles that can change nacls, security groups, completely destroy database clusters or what have you. It feels like running your app as root and database admin, but more . I guess if y…

With properly configured RBAC this shouldn’t be an issue. The problem is making sure those policies are properly enforced. The tools are there, though.

Re: Kubernetes Config Connector: Provision GCP Infrastructure Using Kubernetes

#12

Post by leg100 »

K8s is in one sense a convergence engine, bringing container resources across a cluster into line with a given desired state.

So why not cloud resources too?

Having to run a cluster to do so doesn't feel quite right, however. But then if you're using Terraform - which is the most popular "cloud convergence engine" - you've probably provisioned compute resources with which to run Terraform. So not that strange.

Re: Kubernetes Config Connector: Provision GCP Infrastructure Using Kubernetes

#13

Post by alpb »

ec109685 wrote: post #3

Why doesn’t GCP use AWS’s feature announcement style and have a little blog written that walks the developer through how to use it? So much better to get an immediate feel for a service.

Mostly because the service is still beta.

Re: Kubernetes Config Connector: Provision GCP Infrastructure Using Kubernetes

#14

Post by srmatto »

jbigelow76 wrote: post #4

Spin up a k8s cluster to manage your other resources that will be used by your... other k8s clusters. Is kubernetes just one big snake eating its own tail now?

Kubernetes Gardener uses a main cluster to provision and maintain child clusters.

https://gardener.cloud/

Re: Kubernetes Config Connector: Provision GCP Infrastructure Using Kubernetes

#15

Post by robszumski »

I am really interested in using this GCP Operator and the corresponding ones from AWS and Azure to replace functionality from Open Service Brokers with a more Kubernetes-native experience.

Even better, this model uses the RBAC, namespaces, quotas and tools that developers are already using.

Re: Kubernetes Config Connector: Provision GCP Infrastructure Using Kubernetes

#18

Post by jwhitlark »

zxcmx wrote: post #9
ec109685 wrote: post #2

AWS started building something similar but momentum seems to have stopped once the developer left: https://aws.amazon.com/blogs/opensource/aws-service-operator... It is too bad because declarative specifications and control loops to have state converge to what it should be is a nice pattern. Keeping up with all of AWS’s surface area though is hard if their heart isn’t in it.

We thought about this pattern for a while and ultimately decided we didn't want app compute to directly provision supporting infrastructure. You end up in this weird place where your compute nodes can, at any time, assume super powerful roles that can change nacls, security groups, completely destroy database clusters or what have you. It feels like running your app as root and database admin, but more . I guess if y…

I think these kind of tools are more about provisioning a "normal" cluster from an "admin" cluster. That way the power flows downhill, as it were.

Re: Kubernetes Config Connector: Provision GCP Infrastructure Using Kubernetes

#19

Post by [deleted] »

migueloller wrote: post #11
zxcmx wrote: post #9

Earlier quoted context omitted.

We thought about this pattern for a while and ultimately decided we didn't want app compute to directly provision supporting infrastructure. You end up in this weird place where your compute nodes can, at any time, assume super powerful roles that can change nacls, security groups, completely destroy database clusters or what have you. It feels like running your app as root and database admin, but more . I guess if y…

With properly configured RBAC this shouldn’t be an issue. The problem is making sure those policies are properly enforced. The tools are there, though.

[deleted]

Re: Kubernetes Config Connector: Provision GCP Infrastructure Using Kubernetes

#20

Post by [deleted] »

captn3m0 wrote: post #10
zxcmx wrote: post #9

Earlier quoted context omitted.

We thought about this pattern for a while and ultimately decided we didn't want app compute to directly provision supporting infrastructure. You end up in this weird place where your compute nodes can, at any time, assume super powerful roles that can change nacls, security groups, completely destroy database clusters or what have you. It feels like running your app as root and database admin, but more . I guess if y…

We're trying it out in a dev-cluster/dev-account setup to let teams provision their own buckets/SQS and some supporting infrastructure easily without AWS access.

[deleted]
Post reply on HN