Upgrade to Pro — share decks privately, control downloads, hide ads and more …

oSC23 - Rancher integration with AWS services: possibilities, challenges, outlook.

oSC23 - Rancher integration with AWS services: possibilities, challenges, outlook.

Rancher can deploy and manage your Kubernetes clusters on AWS EKS and EC2. But what about things like Authentication, Logging, Monitoring or Backup? I will give an overview of AWS services for these four pillars and talk about what’s already possible, which challenges some integrations might have and an outlook what’s planned. Learn more about how the integrations are working under the hood and which technologies and open-sources solutions are involved.

Presented at openSUSE Conference 2023:
https://events.opensuse.org/conferences/oSC23/program/proposals/4169

Dominik Wombacher

May 27, 2023
Tweet

More Decks by Dominik Wombacher

Other Decks in Technology

Transcript

  1. © 2023, Amazon Web Services, Inc. or its affiliates. All rights reserved. Amazon Confidential and Trademark.
    © 2023, Amazon Web Services, Inc. or its affiliates. All rights reserved. Amazon Confidential and Trademark.
    Rancher integration with AWS services
    Dominik Wombacher
    Sr. Partner Solutions Architect
    [email protected]
    Possibilities, challenges, outlook

    View Slide

  2. © 2023, Amazon Web Services, Inc. or its affiliates. All rights reserved. Amazon Confidential and Trademark.
    Session Agenda
    Amazon Region Design
    Rancher on Amazon Elastic Kubernetes Service (EKS)
    Integration with AWS services
    Outlook
    Q&A
    2

    View Slide

  3. © 2023, Amazon Web Services, Inc. or its affiliates. All rights reserved. Amazon Confidential and Trademark.
    © 2023, Amazon Web Services, Inc. or its affiliates. All rights reserved. Amazon Confidential and Trademark.
    Amazon Region Design
    3

    View Slide

  4. © 2023, Amazon Web Services, Inc. or its affiliates. All rights reserved. Amazon Confidential and Trademark.
    AWS Regions & Availability Zones
    3 1 L A U N C H E D R E G I O N S / 9 9 A V A I L A B I L I T Y Z O N E S / 4 0 0 + E D G E L O C A T I O N S
    4

    View Slide

  5. © 2023, Amazon Web Services, Inc. or its affiliates. All rights reserved. Amazon Confidential and Trademark.
    AWS Region Design
    H O W A M A Z O N D E F I N E S R E G I O N S A N D A V A I L A B I L I T Y Z O N E S
    5
    AZ
    AZ
    AZ AZ
    Transit
    Transit
    Datacenter
    Datacenter
    Datacenter

    View Slide

  6. © 2023, Amazon Web Services, Inc. or its affiliates. All rights reserved. Amazon Confidential and Trademark.
    © 2023, Amazon Web Services, Inc. or its affiliates. All rights reserved. Amazon Confidential and Trademark.
    Rancher on Amazon EKS
    6

    View Slide

  7. © 2023, Amazon Web Services, Inc. or its affiliates. All rights reserved. Amazon Confidential and Trademark.
    Rancher on Amazon EKS Architecture
    7

    View Slide

  8. © 2023, Amazon Web Services, Inc. or its affiliates. All rights reserved. Amazon Confidential and Trademark. 8
    Quick fire quiz
    High-Available, production ready, Rancher on AWS
    How many steps? How long does it take?

    View Slide

  9. © 2023, Amazon Web Services, Inc. or its affiliates. All rights reserved. Amazon Confidential and Trademark. 9
    5
    Steps
    Rancher Setup from AWS Marketplace
    20
    Minutes

    View Slide

  10. © 2023, Amazon Web Services, Inc. or its affiliates. All rights reserved. Amazon Confidential and Trademark.
    Rancher Setup from AWS Marketplace
    H I G H A V A I L A B L E , P R O D U C T I O N R E A D Y W I T H 5 S T E P S I N 2 0 M I N U T E S
    10
    IAM Role DNS Zone Marketplace EC2
    SUSE
    Rancher
    Setup
    Rancher on Amazon EKS
    1 2 3 4 5

    View Slide

  11. © 2023, Amazon Web Services, Inc. or its affiliates. All rights reserved. Amazon Confidential and Trademark.
    Go ahead and install Rancher on AWS!
    11
    https://go.aws/3KDHL0X

    View Slide

  12. © 2023, Amazon Web Services, Inc. or its affiliates. All rights reserved. Amazon Confidential and Trademark.
    © 2023, Amazon Web Services, Inc. or its affiliates. All rights reserved. Amazon Confidential and Trademark.
    Integration with AWS
    services
    12

    View Slide

  13. © 2023, Amazon Web Services, Inc. or its affiliates. All rights reserved. Amazon Confidential and Trademark.
    Rancher integration with AWS services
    13

    View Slide

  14. © 2023, Amazon Web Services, Inc. or its affiliates. All rights reserved. Amazon Confidential and Trademark.
    Terminology
    AWS IAM
    Role
    Policy
    EC2 Instance IAM Role
    AWS Access key
    W H A T W A S A G A I N A …
    14

    View Slide

  15. © 2023, Amazon Web Services, Inc. or its affiliates. All rights reserved. Amazon Confidential and Trademark.
    Terminology
    W H A T W A S A G A I N A A W S I A M R O L E A N D P O L I C Y ?
    15
    IAM Role
    IAM Permission policy
    IAM Trust relationship

    View Slide

  16. © 2023, Amazon Web Services, Inc. or its affiliates. All rights reserved. Amazon Confidential and Trademark.
    Terminology
    W H A T W A S A G A I N A A W S A C C E S S K E Y A N D E C 2 I N S T A N C E I A M R O L E ?
    16
    S3 Bucket
    Role
    EC2
    Instance
    Container 1
    Container 2
    Container 3
    EC2 Instance IAM Role
    Long-term security
    credential
    AWS access key

    View Slide

  17. © 2023, Amazon Web Services, Inc. or its affiliates. All rights reserved. Amazon Confidential and Trademark.
    IAM Roles for Service Accounts (IRSA)
    AWS IAM Role associated to Kubernetes service account
    Available out-of-the-box on Amazon EKS
    Security best-practices
    Temporary credentials
    Least privilege principle
    Fully supported by AWS CLI and AWS SDK
    F I N E - G R A I N E D I A M R O L E S F O R K U B E R N E T E S S E R V I C E A C C O U N T S
    17
    AWS Identity
    and Access
    Management (IAM)
    AWS STS

    View Slide

  18. © 2023, Amazon Web Services, Inc. or its affiliates. All rights reserved. Amazon Confidential and Trademark.
    IAM Roles for Service Accounts (IRSA)
    F I N E - G R A I N E D I A M R O L E S F O R K U B E R N E T E S S E R V I C E A C C O U N T S
    18

    View Slide

  19. © 2023, Amazon Web Services, Inc. or its affiliates. All rights reserved. Amazon Confidential and Trademark.
    Backup
    Amazon S3
    high available and resilient backup location
    Rancher provides the backup-restore-operator
    Backups can be scheduled and encrypted
    serviceAccount annotation
    During installation
    A U T O M A T E D B A C K U P S O F A L L R A N C H E R R E S O U R C E S
    19
    Amazon Simple Storage
    Service (Amazon S3)

    View Slide

  20. © 2023, Amazon Web Services, Inc. or its affiliates. All rights reserved. Amazon Confidential and Trademark.
    Backup
    A U T O M A T E D B A C K U P S O F A L L R A N C H E R R E S O U R C E S
    20

    View Slide

  21. © 2023, Amazon Web Services, Inc. or its affiliates. All rights reserved. Amazon Confidential and Trademark.
    Logging
    AWS CloudWatch
    Central log location
    Helm chart rancher-logging
    Enhanced cloud provider logging
    Gathers EKS logs as well
    serviceAccount annotation
    need to be added after installation
    S I N G L E P A N E O F G L A S S F O R A L L C O N T A I N E R A N D A P P L I C A T I O N
    21
    Amazon CloudWatch

    View Slide

  22. © 2023, Amazon Web Services, Inc. or its affiliates. All rights reserved. Amazon Confidential and Trademark.
    Logging
    Resources
    rancher-logging-root
    rancher-logging-eks
    S I N G L E P A N E O F G L A S S F O R A L L C O N T A I N E R A N D A P P L I C A T I O N
    22

    View Slide

  23. © 2023, Amazon Web Services, Inc. or its affiliates. All rights reserved. Amazon Confidential and Trademark.
    Authentication
    AWS Identity Center
    Single-Sign-On for hundreds of applications
    AWS Managed Microsoft AD
    Multi-AZ high availability
    Rancher includes provider for:
    LDAP, OAuth, OIDC, SAML
    C E N T R A L I Z E D U S E R M A N A G E M E N T A N D A U T H E N T I C A T I O N
    23
    AWS IAM
    Identity Center
    AWS Directory
    Service
    AWS Managed
    Microsoft AD

    View Slide

  24. © 2023, Amazon Web Services, Inc. or its affiliates. All rights reserved. Amazon Confidential and Trademark.
    Authentication
    C E N T R A L I Z E D U S E R M A N A G E M E N T A N D A U T H E N T I C A T I O N
    24

    View Slide

  25. © 2023, Amazon Web Services, Inc. or its affiliates. All rights reserved. Amazon Confidential and Trademark.
    Monitoring
    Amazon Managed Grafana
    Amazon Managed Service for Prometheus
    Rancher Monitoring
    Provides Grafana, Alertmanager and Prometheus
    Based on kube-prometheus-stack
    Dedicated stack per Cluster
    I N S I G H T S A B O U T A L L E N V I R O N M E N T S
    25
    Amazon Managed Grafana
    Amazon Managed Service
    for Prometheus

    View Slide

  26. © 2023, Amazon Web Services, Inc. or its affiliates. All rights reserved. Amazon Confidential and Trademark.
    Monitoring
    I N S I G H T S A B O U T A L L E N V I R O N M E N T S
    26

    View Slide

  27. © 2023, Amazon Web Services, Inc. or its affiliates. All rights reserved. Amazon Confidential and Trademark.
    Monitoring
    C E N T R A L I Z E D A C R O S S A L L E N V I R O N M E N T S
    27

    View Slide

  28. © 2023, Amazon Web Services, Inc. or its affiliates. All rights reserved. Amazon Confidential and Trademark.
    State of AWS service integration
    28

    View Slide

  29. © 2023, Amazon Web Services, Inc. or its affiliates. All rights reserved. Amazon Confidential and Trademark.
    © 2023, Amazon Web Services, Inc. or its affiliates. All rights reserved. Amazon Confidential and Trademark.
    Outlook
    29

    View Slide

  30. © 2023, Amazon Web Services, Inc. or its affiliates. All rights reserved. Amazon Confidential and Trademark. 30
    Seamless integration
    out-of-the-box, easy to use

    View Slide

  31. © 2023, Amazon Web Services, Inc. or its affiliates. All rights reserved. Amazon Confidential and Trademark.
    Goals
    AWS Reference Architectures
    Improved Rancher Documentation
    Officially supported AWS Authentication Provider
    IRSA for Rancher core components
    Centralized monitoring stack
    S E A M L E S S I N T E G R A T I O N B E T W E E N R A N C H E R A N D A W S S E R V I C E S
    31

    View Slide

  32. © 2023, Amazon Web Services, Inc. or its affiliates. All rights reserved. Amazon Confidential and Trademark.
    Q&A
    Ask me anything!
    32
    https://pulse.buildon.aws/survey/LHLGI5JU
    Please provide Feedback

    View Slide

  33. © 2023, Amazon Web Services, Inc. or its affiliates. All rights reserved. Amazon Confidential and Trademark.
    © 2023, Amazon Web Services, Inc. or its affiliates. All rights reserved. Amazon Confidential and Trademark.
    Thank you!
    Dominik Wombacher
    Sr. Partner Solutions Architect
    [email protected]

    View Slide