tenancy and deployment for downstream clusters

dbones-labs / lab-dev

OrgOps - Enable DevOps with GitOps and KubeOps

https://github.com/dbones-labs/lab-dev/wiki

1 stars 0 forks source link

tenancy and deployment for downstream clusters #4

Open dbones opened 2 years ago

dbones commented 2 years ago

deployment rbac

Rancher require

namespaces to have an annotation

then rancher can manage the rbac in the project for all the namespaces.

fleet requires (for a secure setup)

service account
roles and bindings

to limit where a tenancy can deploy too

serviceaccounts are not linked to projects

so the contecpt of a `tenancy` will need to be controlled by namepaces, not by projects for this part

dbones commented 2 years ago

we can setup a separate Repo that is controlled by lab.dev, it has all the metadata, this can then be registered with all clusters and push the correct updates (via fleet)

lab.dev can checkin changes

role
bindings
service accounts
namespaces

this would minimise the

secrets of downstream clusters being shared (allow fleet to do it)
informtion we would duplicate if we did a operator in the clusters (again fleet can deploy these items)

however we need to handle git and also have a dedicated Repo, created when the org is setup in Github.

dbones commented 2 years ago

the service account needs alot of access to default

dbones commented 2 years ago

consider a controller to ensure the resources are correct for each tennet

dbones commented 2 years ago

apiVersion: fleet.cattle.io/v1alpha1
kind: GitRepo
metadata:
  name: lab-ds
  namespace: fleet-default
spec:
  branch: main
  clientSecretName: github-credentials
  insecureSkipTLSVerify: false
  paths: []
  repo: https://github.com/fox-in-the-lab/lab.git
  serviceAccount: tenancy1
  targets:
  - clusterGroup: downstream

---

apiVersion: fleet.cattle.io/v1alpha1
kind: ClusterGroup
metadata:
  name: downstream
  namespace: fleet-default
spec:
  selector:
    matchExpressions: []
    matchLabels: {}

dbones commented 2 years ago

use special folders to control deployment to sub-cluster assets

targetCustomizations:
  - name: bob
    clusterSelector:
      matchExpressions:
        - key: lab.dev/name2
          Operator: In
          values:
            - aqua
    yaml:
      overlays:
        - deploy

dbones commented 2 years ago

This looks correct :)