SPIKE: Open Service Broker API

[alkar]

Background

Investigate whether it's a good fit for managing resources. See references.

Proposed user journey

N/A

Approach

N/A

Questions / Assumptions

• Is it easy to setup?
• How does it manage resources?
• Comparison to terraform approach we currently have.
• etc.

Definition of done

• [x] must answer the questions above

Reference

• https://www.openservicebrokerapi.org/
• https://github.com/openshift/ansible-service-broker
• https://aws.amazon.com/blogs/opensource/provision-aws-services-kubernetes-aws-service-broker/
• https://kubernetes.io/docs/concepts/extend-kubernetes/service-catalog/

[tatyree]

Moving out of To Do for now - needs more detail, please.

[tatyree]

@alkar if you've already done it, or are doing it, just move it to the appropriate column, please.

[alkar]

Must have missed this one. I had a go at it for half a day, didn't get far, put it back in the queue. Hope to pick it up again this week.

[alkar]

Could not create an RDS postgres:

cat <<EOF | kubectl apply -f -
apiVersion: v1
kind: Namespace
metadata:
  name: demo
---
apiVersion: servicecatalog.k8s.io/v1beta1
kind: ServiceInstance
metadata:
  name: demo-postgres
  namespace: demo
spec:
  clusterServiceClassExternalName: dh-rdspostgresql
  clusterServicePlanExternalName: dev
  parameters:
    AccessCidr: 0.0.0.0/0
---
apiVersion: servicecatalog.k8s.io/v1beta1
kind: ServiceBinding
metadata:
  name: demo-postgres
  namespace: demo
spec:
  instanceRef:
    name: demo-postgres
EOF

Upstream issue: https://github.com/awslabs/aws-servicebroker/issues/3

[alkar]

Documentation can be found here.

To answer the questions of the ticket:

• It is very easy to setup.
• It manages resources using CloudFormation.
• Overall, the service catalog approach seems a much better approach because offers a single way to manage all things, using a common configuration format, all driven on the kubernetes API. However, at the moment the implementation doesn't feel ready for production.

Pros

• One way to manage kubernetes and AWS resources
• We won't have to build terraform modules
• It is API driven
• It's the official kubernetes approach to external resource management
• The core of this implementation, ansible-service-broker, is a very active project, backed by RedHat

Cons

• Holds state in its own etcd instance (although it looks they're moving to a different approach)
• RDS doesn't work, potentially other services too?
• Feels brittle: to provision a resource it spins up a container that runs ansible to spin up a cloudformation stack
• There is no obvious way to control access to specific services using RBAC, we would potentially have to drive resource creation using pull requests.