#kops (2019-01)

https://github.com/cloudposse/prod.cloudposse.co#populate-chamber-secrets

where do I find that list? in aws/kops-aws-platform/chamber-kops.sh?

@Jan good question

busy trying to stand up the root kops as is

then modify the a fork of the module for targeting existing vpc’s

I am working on docs: https://github.com/cloudposse/geodesic/pull/339

this should be merged by EOW (sunday)

they still don’t take into account some of the latest changes.

https://github.com/kubernetes/node-problem-detector

https://registry.terraform.io/modules/cloudposse/kops-iam-authenticator-config/aws/0.1.0

Terraform module to create and apply a Kubernetes ConfigMap for aws-iam-authenticator to be used with Kops to map IAM principals to Kubernetes users

@bazbremner has joined the channel

@webb has joined the channel

Are you using rbac by default?

erg wrong channel I think

in our kops manifest, we have it disabled by default

but there’s a boolean to enable it

https://github.com/cloudposse/geodesic/blob/master/rootfs/templates/kops/default.yaml#L36

yea

Have it enabled

@Ajay Tripathy has joined the channel

yo

when runnign k8s via kops in aws

what creates the KubernetesAdmin role referenced here?

https://github.com/cloudposse/terraform-aws-kops-iam-authenticator-config/blob/master/examples/complete/terraform.tfvars.example#L5

https://github.com/kubernetes-sigs/aws-iam-authenticator#1-create-an-iam-role

here

might have to wait for @Andriy Knysh (Cloud Posse) …

are they prerequisites or do you create them automatically?

https://github.com/kubernetes-sigs/aws-iam-authenticator#why-do-i-want-this

I don’t have first-hand experience setting this up yet

so I can just google =P

hahah

yea all good

will figure it out

https://github.com/cloudposse/terraform-aws-kops-iam-authenticator-config/blob/master/main.tf

so liek this is the 2nd half of what I would have expected

the 1st part would have been the creation of the iam roles

will extend and submit

inf act its not needed

https://github.com/hjacobs/kubernetes-failure-stories

https://github.com/cloudposse/terraform-aws-kops-iam-authenticator-config/pull/2

@Jan

I thanks

so…. who wants to talk me through whats going on here?

module "kops_state_backend" {
  source           = "git::<https://github.com/cloudposse/terraform-aws-kops-state-backend.git?ref=tags/0.1.5>"
...
  cluster_name     = "${var.region}"
  region           = "${var.region}"
...
}

https://github.com/cloudposse/terraform-root-modules/blob/master/aws/kops/main.tf#L31-L36

so in the example we use cluster name as the DNS zone subdomain name, e.g. if the domain for the nevironment is [prod.example.com](http://prod.example.com), then the module will create a subdomain us-west-2 and you’ll access your cluster at [us-west-2.prod.example.com](http://us-west-2.prod.example.com)

instead of the region, you can use any name that suits your needs, e.g. [kops.prod.example.com](http://kops.prod.example.com)