Background
At Giant Swarm we manage Kubernetes clusters for
customers 24/7.
Both on bare metal and in the cloud.
Slide 6
Slide 6 text
Distributed Team
People are in 6 different european countries
Looking for more platform engineers and SREs
Slide 7
Slide 7 text
Kubernetes as a Service (KaaS)
Own DC in Frankfurt, Germany
Full access to clusters
Slide 8
Slide 8 text
No content
Slide 9
Slide 9 text
On-premises KaaS
Current focus is to manage Kubernetes in the DCs or AWS
accounts of the customers itself.
Slide 10
Slide 10 text
Open Source
Our tooling is open-source and we are working with the
community to improve kubernetes operations.
Slide 11
Slide 11 text
Multiple Clusters
"Soft" multi-tenancy not enough in enterprise context
PCI-compliance, privacy laws, etc.
Different environments: separation of dev, test, prod
Test new K8s versions
Slide 12
Slide 12 text
People must come to things in their
own time, in their own way, for their
own reasons, or they never truly come
at all. - Dee Hock
Slide 13
Slide 13 text
RBAC, NetworkPolicies FTW
We encourage to use the features and integrate.
Small clusters make little sense
Support while processes need to be adapted
Kubernetes matures - trust over time
Slide 14
Slide 14 text
Introducing:
Giantnetes
Slide 15
Slide 15 text
Motivation
Rather obvious. If you provide others with Kubernetes
because you think the building blocks are right, you just have
to use it too.
Slide 16
Slide 16 text
De nition
G8s: Giantnetes
K8s: Kubernetes == Guest cluster
Immutability
Container linux (Hosts and Guests)
Continuous pipeline (Container build, registry, kubernetes)
Slide 21
Slide 21 text
Reproducable builds and
deployments at any point in time
Architect ( )
Draughtsman
( )
https://github.com/giantswarm/architect
https://github.com/giantswarm/draughtsman
Slide 22
Slide 22 text
Every manual change is ephemeral
Slide 23
Slide 23 text
Mean time to recovery!
Slide 24
Slide 24 text
Networking
Flannel/VPC network between guest cluster nodes
Calico between containers
Network policy controller
Slide 25
Slide 25 text
No content
Slide 26
Slide 26 text
No content
Slide 27
Slide 27 text
No content
Slide 28
Slide 28 text
No content
Slide 29
Slide 29 text
Certi cates
Each cluster has its own root ca
Using PKI backends in Vault
Certificates are rotated every day
Slide 30
Slide 30 text
Certi cates #2
Kubernetes components use mutual TLS
Client certificates are used for RBAC
Micro Operators
Operators should have single responsibilities.
Keep them simple and maintainable
Slide 48
Slide 48 text
Operatorkit
Our services are based upon microkit. We've also created
operatorkit to reduce boilerplate in our operators and collect
them in a library.
https://github.com/giantswarm/operatorkit
Slide 49
Slide 49 text
Self-hosted
First step Having Giantnetes and all guest clusters running
self-hosted will further ease the lifecycle management of
the clusters.
Slide 50
Slide 50 text
No content
Slide 51
Slide 51 text
Thank you.
Timo Derstappen
CTO of Giant Swarm @teemow