Cloud Native Computing Foundation Crossplane Community Day EU 2021, 14 May 2021

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Lightning Talk: Self-Service Provisioning with the Crossplane Service Broker- Tobias Brunner, VSHN

Description

Don’t miss out! Join us at our upcoming event: KubeCon + CloudNativeCon North America 2021 in Los Angeles, CA from October 12-15. Learn more at https://kubecon.io The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects.

Lightning Talk: Self-Service Provisioning with the Crossplane Service Broker- Tobias Brunner, VSHN AG

The Crossplane Service Broker exposes Crossplane primitives via the Open Service Broker API. Tobias will introduce the concepts behind the Crossplane Service Broker and demonstrate to the audience how it all works together. By leveraging the Open Service Broker API while coupling it with the powerful concept of Crossplane Compositions it's very easy to enable users of a platform which exposes Open Service Broker API integration (like Kubernetes Service Catalog or Cloudfoundry) to provision services fully automated. In a demonstration a real use case will be shown how a Redis service can be provisioned using the Open Service Broker API, leveraging the Crossplane Compositions and the Helm provider.

A

Hi, I'm tobias, I work for region and I live in zurich. Switzerland vision operates, managed services for the customers all around the world, even in australia for the australian government, usually the customers have high security requirements, and some of them are in highly regulated areas like banks, insurances or telecommunication companies.

A

About a year ago, we decided to base our next generation managed services offering on kubernetes and discovered crossplane as the potential control plane to achieve that with our open source, tooling called project syn, we created the basis to orchestrate configuration on a huge feed of kubernetes clusters, including the deployment and configuration of crossplane itself.

A

Our first implementation is crossplane as the orchestration control plane to gather its projects. Zoon is made for the biggest swiss telecommunication company called swisscom at the beginning. Swisscom offers redis and mariah db galera in their internal services marketplace as a managed service running on kubernetes at massive scale.

A

The amount of expected service instances is so high that it's not possible to run them all on a single cluster of their internal kubernetes, offering these services are currently consumed by applications running on cloud foundry and the services need to be available as a full sales service offering in their internal marketplace.

A

It is planned to extend the offering to users of the managed kubernetes offering called icube using the kubernetes service catalog. All these services are running in swisscom's own data center and infrastructure. With high security measures for matching swiss commerce requirements, we had to implement an open service broker api application, which maps crossblank concepts to the concepts of the open service broker api specifications as the ideas behind crowsplain matched the ideas behind open service broker api very well. We were able to write the translator between these two worlds, called the swisscom the crowsplain service broker.

A

In this diagram. You can see that the service offering maps to the composite resource definitions, service plans, mapped to compositions and service instances mapped to composite resources. All are integral concepts of crossplane.

A

The crossplane service broker operates solely on crossplane objects and no other state is needed.

A

Let's have a look at how this looks like in a live demo we'll see a redis instance provisioned on the service cluster, which was requested by a user via the service catalog.

A

The demo environment consists of three local k3d clusters and this architecture represents a real world example.

A

A cross plane cluster in the middle of this diagram exists once and runs crossplane and the crossbar and service broker. The services itself are provisioned by the crossplane helm provider on the service cluster, from which many of them could exist and in reality a lot of them exist.

A

The end user is using the services from the consumer cluster by using the kubernetes service catalog. Now, let's dive into it straight away.

A

In the middle, you see the control cluster. This cluster is running crossplane and we will now have a look around what is available in this cluster. First, we will have a look at the composite resource definitions. You see, there is a redis instance defined this composite resource definition also has a lot of metadata available, which is then consumed by the crossplane service broker to be presented to the user of the broker.

A

When we look at the compositions which map to the service plans on the open service broker api, you can see that there is one plan defined which is called ready, small, and this is represented by this composition.

A

Also, this composition has metadata, which again is used by the crossplane service broker, to be presented to the user of the broker querying the cost of already instances shows us that there is currently no redis instance provisioned. Let's change that, we will switch now to the consumer cluster and check what brokers are available on this cluster.

A

The only broker configured at this time is the redis broker, which is ready querying this broker for available services is returning us just one service. It's the ready, ready service and one plan, the small plan which we can now provision.

A

This is very easy with the service catalog command and at this time the service is getting provisioned. What we can see with this cad instances command with, which shows us the state provisioning going back to the control cluster. Now we can see that there is now one redis instance object available. This has been created by the crossplane service broker on the call from the consumer cluster.

A

This is now being provisioned by via the crossplane health provider, and we can see that there was is already a release, object created by crossplane, and this actually instantiates a hem chart on the service cluster, and this is already done here down on the bottom of this window in the service cluster.

A

Also, this service is provisioned into its own namespace, which we can now have a look into and see what ports are available in this namespace.

A

So you can see the ready service is already up and running, and if we go back to the consumer cluster, we can see that the status is in this time ready. So the service is available for the end user to be consumed for that we are now creating a service binding, which returns us all the needed information to actually connect to this service.

A

This is now done. The status is already ready, and this created a secret on the on the consumer cluster ready to be used by the application.

A

This secret contains information like the server ip addresses, ports, uh usernames passwords and all other parameters which are needed to con contact the service. Actually, that's the end of the demo. Let's go back to the slides shortly.

A

If you want to try this out yourself, it's hosted on github. The full demonstration is available under this url displayed on the slides.

A

The crossplane open service broker api is open source on github and it's already being used in production and will be gradually improved over time.

A

We have some points on the roadmap already, so the first thing we will do is implement authentication with bearer token, which could contain meta information, for example, for access control or for filtering plans which are available to this particular user or team. Whatever information is stored, in the token this will allow us also to as mentioned, implement the plan filtering on the broker side.

A

We will also implement asynchronous binding operations, and, last but not least, we have plan plan upgrades on our plate so that we can upgrade, for example, from small to medium plans and so on, we'll work on these features over the next weeks and months. Some of these features are depending on features in crossbrain, which will be hopefully available very soon.

A

If you want to know more about what we did. Please reach out to me at my email address or on twitter thanks for listening and enjoy the crossband community day.