aptomi / k8s-app-engine Goto Github PK

Somehow fix it

• endpoints show
• enforce some access using global rules & Istio

make sure errors are handled. and we show at least a panel with params

use

criteria:
reject:
- region == 'public_cloud'

Have a way to define what constitutes a service key
4 standard fields + custom defined labels

Explicit:

• service, context, allocation, ...

Implicit:

• service (?) can define which params to include into the key

Impl something demoable

re-apply policy (force), even no changes are detected, to recreate missing objects

e.g.

1. run cleanup_helm.sh
2. run aptomi policy apply --full (or something like this)

These are all global rules:

1. Dev code never talks to Prod code

   • If you request a Dev instance of a service and it contains a reference to Prod instance of another service, it should not be allowed

2. Dev code never gets deployed to Prod cluster

   • Will require introducing labels for k8s clusters

3. Certain part of the organization is not allowed to deploy to certain k8s cluster

4. Compromised user cannot access certain things (services, clusters, etc)

   • Note: this is at a global level, not at a context level

5. Certain users and/or services always get deployed to certain k8s clusters

Carol (ID=3)
[+] twitter-stats ()

Inject secrets into services securely from vault

https://github.com/istio/istio/blob/master/install/kubernetes/addons/prometheus.yaml

[aptomi] ./aptomi policy apply --debug 14:55:52 ☁ master ☂ ⚡
[Services]
Alice (ID=1)
[-] twitter-stats
[Components]
New instances: 0
Deleted instances: 19
Updated instances: 0
[Component Instances]
Use --verbose to see the list
[Applying changes]
[19/19] [====================================================================] 100% Time: 3m3s

need to separate streams
switch to structured logging
log debug into file
etc

Enforce on the wire. Should not be able to physically access a deployed service if a policy says so.

Will require integration with Istio.

replace current users.yaml with real ldap

Also, tell a story how we integrate with existing CI/CD pipelines and promotion of artifacts from Dev to Stage to Prod.

Show that we can glue different things together, which are exposed via Aptomi (and enforce via Istio)

1. Microservices (e.g. web)
2. Java (Traditional)
3. Public cloud (something that runs on Amazon)

map[error:Get https://35.197.31.74/api/v1/namespaces/kube-system/pods?labelSelector=app%3Dhelm%2Cname%3Dtiller: error executing access token command "/usr/local/Caskroom/google-cloud-sdk/latest/google-cloud-sdk/bin/gcloud ": exit status 2]

1. new slide for the problem we are solving
   k8s adoption
   simplify
   visibility

2. clarify our "insertion/integration point".
   If someone is willing to integrate Aptomi into their environment, where it's going to be inserted. E.g. in between Jenkins and k8s or where? Add a slide on this.

let's not do this for the demo

Add --quiet to all gcloud executions

Add Prometheus + Grafana deployment with some label to make it optional (an disable JMX)

Add --quiet to all gcloud executions

low priority

• Cluster links should be moved to the Code level to be usably from global policies
• Add labels to the clusters

• deployChart: false

• no limits / requests

• disable jmx agents??

• minHashtagCounts

• minPopularity

• topListSize

•    service:
      type: NodePort
  

• etc

F0526 17:43:50.694382 18272 policy.go:41] Cannot resolve usage: Cannot evaluate template {{ .Discovery.analytics_pipeline.kafka.kafka.url }}
exit status 255

Needed for global rule (Dev -> us-west, Prod -> us-east)