search

crossplane / example-cnp

Platform API as Configuration
Apache License 2.0
11 stars 5 forks source link

Add data services that can be provisioned and securely connected to a CNP Cluster #19

Open prasek opened 4 years ago

prasek commented 4 years ago

XRDs and compositions for Postgres, MySQL, redis, etc.

Using data services resources similar to: https://github.com/crossplane/stack-aws-sample/blob/master/kustomize/aws/database/dbsubnetgroup.yaml

Note that the current EKS cluster composition creates its own VPC/subnets, so think we'd need to create separate dbsubnets groups for the per cluster subnets that are created, which introduces some complexity ... how do I provision an RDS instance that is securely connected to my CNP cluster?

Possibly using different RDS compositions that reference the dbsubnetgroup and subnets for my Cluster instance, and then using a compositionLabelSelector to match. Or maybe we can have the platform consumer pass the dbsubnet group name into the CR for the RDSInstance, but it would be nice to hide these infrastructure details from the app teams / platform consumer (PC).

Maybe we could pass the clusterRef into the RDSInstance and get the necessary subnets from there, so the PC can just say give me an RDS Postgres and securely connect it to this app cluster.

negz commented 4 years ago

This seems a little tangential to the initial scope of this repo (sketching out a specific community member - Accenture's - use case) in order to firm up our API shapes (concepts etc). Do we think adding more use cases (i.e. managing data services) to this repo will shake out further areas of our APIs and concepts that we need to work on, or is mostly about increasing the set of use cases we can demonstrate to our community?

prasek commented 4 years ago

if I was provisioning an RDS instance on a app/target cluster with the Crossplane Agent installed it would be awesome for the claim to automatically pass the context of the cluster I'm running on and pull the subnets needed in the dbsubnetgroup so that could be used when provisioning an RDS instance and ensuring it's on a subnets that is accessible from nodes in the app/target cluster.