Kubernetes in Highly Restrictive Environments
Download as PPTX, PDF0 likes374 views
The document presents a discussion by Oleg Atamanenko on implementing Kubernetes in highly restrictive environments, detailing the complexity of creating production-grade clusters and the essential requirements such as security, logging, and monitoring. It highlights the limitations of managed solutions, home-grown alternatives, and the intricacies of cross-team responsibilities and on-premises struggles. Best practices for security and future directions, including infrastructure as code and GitOps, are also covered.
Kubernetes in Highly Restrictive Environments
- 1. Kubernetes in Highly Restrictive Environments Oleg Atamanenko | Team Lead, Architect
- 2. Introductions Oleg Atamanenko Team Lead, Architect Working w/ Kubernetes since its release in 2015 Part of the team who built Kublr—an enterprise ready container management platform Twitter @real_atamanenko; @kublr Like what you hear? Tweet at us!
- 3. Automation Ingress Custom Clusters Infrastructure Logging Monitoring Observability API Usage Reporting RBAC IAM Air Gap TLS Certificate Rotation Audit Storage Networking Container Registry CI / CD App Mgmt Infrastructure Container Runtime Kubernetes OPERATIONS SECURITY & GOVERNANCE What’s Kublr? @real_atamanenko; @kublr
- 4. Creating a Production-Grade Kubernetes Cluster 1. Install with kops/kubeadm/… 2. … 3. Done? @real_atamanenko; @kublr
- 5. Creating a Production-Grade Kubernetes Cluster Unfortunately, it’s not that easy! @real_atamanenko; @kublr
- 6. What We’ll Discuss Today 1. Requirements 2. Managed solutions and their limitations 3. Cross-team responsibilities 4. On-premises struggles 5. What to do next? @real_atamanenko; @kublr
- 8. Requirements Security Audit Logging Collections Observability / monitoring Isolated environment support Integration with existing tooling @real_atamanenko; @kublr
- 9. Requirements | Security Integration with Identity Broker Fine-grained role-based access control (RBAC) Authentication Authorization Storing secrets Internal CA @real_atamanenko; @kublr
- 10. Requirements | Audit Kubernetes API server audit Audit support for the logging and monitoring dashboards Audit support for the cluster provisioning tool (cluster install, update, upgrade, delete) @real_atamanenko; @kublr
- 11. Requirements | Logging Integration with existing logging solution RBAC for application logs across teams • per project • per team • per environment @real_atamanenko; @kublr
- 12. Requirements | Monitoring Integration with existing solution RBAC for application metrics across teams • per project • per team • per environment @real_atamanenko; @kublr
- 13. Requirements | Isolated Environment Where to get the required OS packages? How to provide the required Docker containers? Binary repository? @real_atamanenko; @kublr
- 14. Requirements | Support Existing Tooling Integration with existing processes and tools for deployment, logging and monitoring @real_atamanenko; @kublr
- 15. Now that the functional requirements are met, what’s next? @real_atamanenko; @kublr
- 16. What are Your Options? Managed Kubernetes from public cloud providers Home grown solution 3rd party vendor @real_atamanenko; @kublr
- 17. Managed Solutions and Their Limitations May not meet your requirements and/or regulations No access to master nodes No or limited capability to customize K8S configuration No access to the logs from the master May not support on-prem installations @real_atamanenko; @kublr
- 18. Home Grown Solutions Will cover your needs Requires extra time and efforts that could be spent on innovation With 4 major releases per year, it’s REALLY hard to keep up with upstream Kubernetes! @real_atamanenko; @kublr
- 19. 3rd Party Vendor Will cover most of your needs Custom development still may be required Choose wisely! @real_atamanenko; @kublr
- 20. Cross-Team Responsibilities Large organizations often separate teams by: • Compute • Network • Storage • Security Paradigm shift towards Kubernetes deployments @real_atamanenko; @kublr
- 21. On Premises Struggles Pure bare metal limitations vSphere API interactions Realizing HA for Kubernetes Disaster recovery OS upgrades Security updates Kubernetes upgrades Air-gap/offline mode @real_atamanenko; @kublr
- 22. Best Practices for Security Utilize RBAC SELinux/seccomp PodSecurityPolicies NetworkPolicy Admission Web Hooks @real_atamanenko; @kublr
- 23. What’s Next? Infrastructure as a code Immutable Infrastructure CI/CD for infrastructure GitOps @real_atamanenko; @kublr
- 24. Q&A Take Kublr for a test drive! kublr.com/deploy Free non-production license. @real_atamanenko; @kublr
- 25. Stay in touch! Signup for our newsletter at kublr.com Oleg Atamanenko Team Lead, Architect [email protected] @real_atamanenko Kublr | kublr.com @kublr
Editor's Notes
- #5: There are a lot of options available, some common open source tools are kops, kubeadm. Let’s use one of those and run our production workload for it. Probably. Some times. Maybe.