#kubernetes (2019-07)

https://sanic.io

Sanic is an omni-tool which lets you build, deploy, and manage Kubernetes clusters.

reminds me of #geodesic

anyone running a container with 200GB+ memory ?

somebody mentioned a tool for setting ENV variables for docker with support for different environments ?

with some template support

for the life of me I can’t recall the name….

https://github.com/weaveworks/eksctl/issues/508

Anyone know if it’s possible to pass settings in the config to run commands on startup (like with kops)?

…in eksctl

(@mumoshu)

e.g. in kops, we can do:

  hooks:
  # Mitigate CVE-2019-5736
  - before:
    - docker.service
    manifest: |
      Type=oneshot
      ExecStart=/usr/bin/chattr +i /usr/bin/docker-runc

Hi, has anyone tried the bitnami kubeprod.io stack? (https://github.com/bitnami/kube-prod-runtime)

hi, anyone here knows about use boolean value with k8s ?

i’m trying to read the value from Environment variable, and i realize that when setting the env var inside a pod, it’s always format it as a string

for example MY_VAR=abc will be MY_VAR=‘abc’ inside a pod

if any program is expecting the boolean type, it will throw error

is there a way to solve this ?

thanks

environment variables are always strings

it needs to be handled by your program or whatever library you are using

thanks @MiLk

https://github.com/aws/containers-roadmap/issues/398

Higher container density is coming

https://github.com/ibuildthecloud/k3v

Hi, I have an idea about how I’m going to implement config templating for our containers and I will like some feedback :

• Secrets and non secrets will be stored in aws Parameter Store+KMS
• Chamber will be used to update/create secrets
• Path IAM roles will be created for every environment /dev/secrets /prod/secrets etc
• ECS Task per environment will have access to the /env path that have secrets and not secrets ( no shared configs)
• Dev will use chamber to set ENV variable to run their local containers
• confd might be use to create the config templates on Docker build

most Jenkins will be doing the initial push and CodeDeploy will do the rest for Blue Green

any comments ?

Anyone familiar enough with Kubernetes API to maybe know a way to get the resourceVersion of the parent for a given pod? Trying to ignore events in the watch if the change was initiated by its parent (I am not the controller). This is related to a ReplicaSet

https://draft.sh/

saw this at kubecon

my gripes wit this is the feedback loop for rebuilding an image is slow

what were your thoughts?

so during development esp. if you save alot assuming youre doing some web dev you’d typically want to refresh your browser right after you save

and see the changes right away

even during their demo at kubecon there was a bit of waiting

for the demo image (prob really small) to rebuild

I think developers mostly want live reloading

e.g. what you get with telepresence

yep

most prob use docker compose to spin up dependencies

and run their app locally

i think itd be awesome if you could have that type of live reloading but your app is hosted on a k8s cluster in the cloud

each developer would have their own namespace

yep - that’s what we’re working on

but haven’t yet tackled telepresence

are you able to do live reloading comparable to running it locally

cause thats a gamebreaker i think for most devs

https://www.telepresence.io/

so with telepresence you run “the” service locally

but all your backing services run in k8s (e.g. in a developer namespace)

ah

telepresence is like a reverse proxy. it sits in k8s and any requests it gets it sends back to the service on your laptop

so it’s like teleporting your local service into the cluster

plus your local service can access everything running in k8s (e.g. database or other backing services)

since it runs on your local laptop, you get all the benefits

easier debugging, attaching debuggers, live reloads, etc

ah yeah

but i guess other than the fact that dependent services hosted in cloud

is there any other benefit than running those in a docker compose

you’re testing your services in an environment that’s closer to staging/prod

if you have 30-40 microservices as part of your stack, good luck doing that on your laptop

if you need large datasets for development, can’t do that easily locally

maybe it’s nicer to have all the data stay in AWS from a security perspective

truee

multiple developers can be working on pieces of the project at the same time

and using a shared environment

so you host the db remotely as well

assume youre working on an API

its easier for others to QA changes in a public environment (e.g. if your laptop is offline, no one can review)

yea, usually run db as a container for these env

nice

yeah the large dataset hosted remotely one is actually really useful

allowing multiple devs on same project

Has anyone here been able to get Istio installed to EKS? I’m trying to get it installed with my worker nodes all residing in private subnets and I’m running into weird issues.

@Vidhi Virmani I think did

Most of the examples I come across online assume you’re in public subnets with ELBs and security groups open to the world

@Vidhi Virmani if you’ve installed Istio on EKS in private subnets, ping me!

Is there a way to have helm chart create external resources?(RDS/Elasticache)

https://github.com/awslabs/aws-service-operator

https://github.com/awslabs/aws-servicebroker

Then use the Helm raw chart to provision

The CRDs for RDS

Thank you!

What are people using as an oauth2 provider to login to their apps like k8 dashboard?

keycloak

• gatekeeper proxies

keycloak too but not for k8 but for pretty much anything

I’m interested to hear how people are using CD in Kubernetes. Is anyone doing Canary deployments on their EKS cluster? How?

last year spent a few months troubleshooting and improving apps running in ElasticBeanstalk. with help from guys here (thank you). This year I’m deleting those ElasticBeanstalk stacks one by one after moving the apps to K8s. #lifeofadevopsengineer

haha too true. Thanks @i5okie for the update.

I am looking at starting to use Kubernetes for the first time for a small system that I would eventually grow. Would you suggest using Kubernetes directly or using AWS EKS?

I would give eksctl a shot

Probably the most turn key way to get up and running with EKS for a small project.

(we still use kops)

i was playing around with kops over the weekend

worked really well, just unsure at this point how to manage everything

kops is easy to get up and running.

the challenge with kubernetes is updates between major releases can be tricky

e.g. 1.11 -> 1.12 upgraded to etcd3 and there was no automated way to easily upgrade

while on EKS, those kinds of upgrade challenges are handled by the platform

also, i believe the upgrade from 1.14 to 1.15 is also that way

Thanks that is really good to know. I’ll give EKS a go. Much appreciated

we also have TF modules for EKS

https://github.com/cloudposse/terraform-aws-eks-cluster

https://github.com/cloudposse/terraform-aws-eks-workers

complete example https://github.com/cloudposse/terraform-aws-eks-cluster/tree/master/examples/complete

Awesome

Thanks so much!

Just found this as well, seems like a good beginner resource https://eksworkshop.com/introduction/

yes, I saw that - looks amazing

is it possible to create a EKS cluster in my Existing VPC?

yes

I’m looking for a minimally-hacky way to restart running pods in order pickup a change in config data