Colin Hom, Infrastructure Engineer at CoreOS

1. Colin Hom - Infrastructure Engineer
github.com/colhom | colin.hom@coreos.com
Kube-AWS: Production
Kubernetes Clusters on AWS

2. Design Goals
Artifacts should be:

3. Design Goals
Artifacts should be:
Secure

4. Design Goals
Artifacts should be:
Secure
Reproducible

5. Design Goals
Artifacts should be:
Secure
Reproducible
Auditable

7. Cloud
EC2, VPC, IAM, security groups,
Autoscaling groups

8. Cloud
EC2, VPC, IAM, security groups,
Autoscaling groups
Host
docker, flannel,
etcd

9. Cloud
EC2, VPC, IAM, security groups,
Autoscaling groups
Host
docker, flannel,
etcd
Cluster
hyperkube

10. Cloud
EC2, VPC, IAM, security groups,
Autoscaling groups
Host
docker, flannel,
etcd
Cluster
hyperkube
containers:
- name: cat-pics-server
image: quay.io/colin_hom/cat-pics:latest

11. “Under the hood” demo

12. $ kube-aws init
--cluster-name=demo-chom
--external-dns-name=my-cluster-endpoint
--region=us-west-1
--availability-zone=us-west-1c
--key-name=key-pair-name
--kms-key-arn="arn:aws:kms:us-west-1:
xxxxxxxxxx:key/xxxxxxxxxxxxxxxxxxx"
$ ls -R .
> cluster.yaml
Step 1.
Initialize your
cluster configuration
Under the hood

13. Under the hood
cluster.yaml
1.
init
clusterName: demo-chom
externalDNSName: demo.coreos.com
availabilityZone: us-west-1c
#workerCount: 1
#workerInstanceType: m3.medium
#controllerInstanceType: m3.medium

14. $ kube-aws render
$ ls -R .
> userdata/
> credentials/
> stack-template.json
> cluster.yaml
> kubeconfig
Step 2.
Render cluster assets
Under the hood

15. Under the hood
init
cluster.yaml
render
user data
TLS credentials
stack template
1. 2.

16. Under the hood
init
cluster.yaml
render
user data
TLS credentials
stack template
1. 2.
"AutoScaleWorker": {
"Properties": {
"AvailabilityZones": [
"{{.AvailabilityZone}}"
],
"DesiredCapacity": "{{.WorkerCount}}",
….
}

17. $ kube-aws up
…. (get coffee)
$ kubectl get nodes
> NAME STATUS AGE
> node-1 READY 10m
Step 3.
Push the button!
Under the hood

18. Under the hood
init
cluster.yaml
render
user data
TLS credentials
stack template
1. 2.
up
3.
stack template
user data
TLS credentials

19. Under the hood
init
cluster.yaml
render
user data
TLS credentials
stack template
1. 2.
up
3.
stack template
user data
TLS credentials

20. $ kube-aws up --export
> Exporting demo-chom.stack-template.json
$ git add my-cluster.stack-template.json
$ git commit -am “first pass at my
cluster!”
Step 4.
Save your state!
Under the hood

21. render
Under the hood
init
cluster.yaml
user data
TLS credentials
stack template
1. 2.
up
3. j
stack template
user data
TLS credentials
4.
export

22. Design Goals
Secure
Reproducible
Auditable

23. $ git diff
>
--- a/cluster.yaml
+++ b/cluster.yaml
# Instance type for worker nodes
-#workerInstanceType: m3.medium
+workerInstanceType: m3.large
$ kube-aws up --export
> Exporting demo-chom.stack-template.json
Let’s make some changes!
Change the worker instance type from m3.medium to m3.large

24. $ git diff
>
# Instance type for worker nodes
-#workerInstanceType: m3.medium
+workerInstanceType: m3.large
$ kube-aws up --export
> Exporting demo-chom.stack-template.json
Let’s make some changes!
Change the worker instance type from m3.medium to m3.large

25. $ git diff
>
# Instance type for worker nodes
-#workerInstanceType: m3.medium
+workerInstanceType: m3.large
$ kube-aws up --export
> Exporting demo-chom.stack-template.json
Let’s make some changes!
Change the worker instance type from m3.medium to m3.large

26. $ git diff
>
# Instance type for worker nodes
-#workerInstanceType: m3.medium
+workerInstanceType: m3.large
$ kube-aws up --export
> Exporting demo-chom.stack-template.json
$ git commit -am “workers are m3.large”
Let’s make some changes!
Change the worker instance type from m3.medium to m3.large

27. $ git diff HEAD~1
c542d5d8f20f6c059dfccc2b147f0097b1656
381
Author: Colin Hom <colhom@gmail.com>
Date: Thu Apr 28 13:37:45 2016
-0700
# Instance type for worker nodes
-#workerInstanceType: m3.medium
+workerInstanceType: m3.large
j
Let’s make some changes!

28. Road to Version 1.0
Recently Completed:
- Calico for network policy
- Route53 Integration
- Existing VPC support
Future Work:
- Zero-downtime upgrade path
- HA control plane
- Automated TLS rotation

29. github.com/coreos/coreos-
kubernetes
Colin Hom
github.com/colhom | colin.hom@coreos.com | coreos.com
We’re hiring in all departments! Email: careers@coreos.com Positions: coreos.com/ careers