►
From YouTube: Managing RBAC Cross Multiple Kubernetes Clusters - Alena Prokharchyk, Rancher Labs, Inc.
Description
Join us for Kubernetes Forums Seoul, Sydney, Bengaluru and Delhi - learn more at kubecon.io
Don't miss KubeCon + CloudNativeCon 2020 events in Amsterdam March 30 - April 2, Shanghai July 28-30 and Boston November 17-20! Learn more at kubecon.io. The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects
Managing RBAC Cross Multiple Kubernetes Clusters - Alena Prokharchyk, Rancher Labs, Inc.
Having several Kubernetes clusters in the organization quickly became de facto. The need could be driven by geographical separation, where clusters are located in different regions; or logical when cluster is dedicated to a particular team or department. With that comes a new challenge for an administrator - managing users and their permissions in heterogeneous Kubernetes cloud. During this session I want to share my team's experience building an open source authentication/authorization framework leveraging Kubernetes CRDs, that makes cross clusters auth and RBAC easy by having: * Multiple clusters, but single authentication and authorization point * Managing users RBAC permissions cross clusters, and automatic permission grant to the user * Effective way of grouping cluster's resources into manageable subsets to make RBAC/PodSecurity/NetworkPolicy application easier.
To learn more click here: https://sched.co/FuLp
A
Hello,
everyone
Nihao,
my
name,
my
name
is
Alena
proper
chick
I
am
a
principal
software
engineer
at
Rancho
lots
a
little
bit
about
myself.
I
was
born
in
Eastern
Europe
and
in
2007.
I
won
a
green
card
in
the
lottery
and
moved
to
United
States
to
California,
and
starting
from
2011
I've
been
working
exclusively
on
the
open
source
projects
in
the
infrastructure
space
and
recently,
with
the
main
focus
on
kubernetes,
and
today
we
are
going
to
be
talking
about
managing
our
bug
across
multiple
kubernetes
clusters.
We'll
start
by
looking
at.
A
When
do
you
need
multiple
kubernetes
clusters
and
actually
curious?
How
many
of
you
manage
multiple
kubernetes
clusters
in
production
cool
and
how
many
of
you
are
writing
kubernetes
native
applications
using
the
custom
controllers
and
CRNAs
alright,
so
I
hope
that
presentation
will
be
useful
for
everybody
and
so
let's
get
started
unless
look
a
little
bit
at
the
history
of
the
infrastructure.
A
I
started
with
a
virtual
machine,
because
the
virtual
machine
was
a
great,
with
a
great
way
to
see
that
there
was
a
need
for
sharing
the
resources
like
CPU
and
memory
and
with
the
virtual
machine
came
the
need
for
them
orchestrating
platforms
for
the
virtual
machines
like
Apache
cloud.
Second
OpenStack,
because
infrastructure
is
more
complex,
you
need
the
network
and
you
need.
The
storage
in
this
system
is
allowed
you
to
configure
it.
Then,
although
the
containers
were
present
well
before
docker
made
them
popular
in
2013,
it
became
very
popular
thanks
to
docker.
A
Thanks
to
the
simplicity
of
its
api's
and
similar
to
the
virtual
machines.
There
was
a
need
for
the
are
castration
systems
to
orchestrate
the
containers
to
lay
down
the
networking
between
them.
The
storage
very
similar
to
the
virtual
machine
so
and
darkus
trading
system
like
swarm,
kubernetes
and
masses,
came
around,
but
I
think
today
received
to
save
that.
Kubernetes
is
the
most
popular
one,
and
today
the
kubernetes
has
become
a
commodity
across
private
and
pop
and
public
cloud
ecosystem.
You
start
thinking
of
like
instead
of
I
need
to
provision
a
virtual
machine.
A
You
start
thinking
about.
I
need
to
provision
a
kubernetes
cluster
and
cloud
providers
make
it
simple
by
offering
your
communities
as
a
service.
There
are
a
lot
of
tools
around
standing
out.
The
kubernetes
clusters
on
the
various
infrastructure
system,
either
in
premises
or
or
in
the
public
clouds
and
having
multiple
clusters
is
also
becoming
a
new
de
facto
and
more
and
more
companies
have
more
than
one
kubernetes
cluster
and
let's
go
over
the
use
cases
of.
When
do
you
need
more
than
one
kubernetes
cluster?
The
first
use
case
is
the
most
obvious.
A
A
Cd
nodes
have
to
be
relatively
close
and
even
cubelet
and
api
server
component.
So
it
is
better
to
create
a
one
cluster
region.
The
Hiskey
is
number
two
for
having
multiple
kubernetes
cluster.
An
organization
is
the
logical
separation
driven
by
the
security
reasons
where
you
create
the
cluster
unpro
project.
A
Like
imagine,
you
have
a
development
set
up
somewhere
on
premises
in
your
local
data
center
and
your
production
set
up
in
the
cloud
where
your
users
can
access
it
and
you
might
want
to
apply
a
different
level
of
protection,
and
you
know
even
the
login
turn
on
the
logging
on
the
production.
Setup
can
be
more
excessive
than
on
the
development
setup
and
the
use
case
number
three
is
also
logical
separation,
but
this
time
it
is
driven
nobody
security
reasons,
but
more
like
a
functionality
reasons.
A
It's
where
you
create
a
cluster
protein,
because
different
team
is
a
different
people
and
different
peoples,
different
best
practices
and
different
preferences
like
one
one
team
can
prefer
to
have
I,
don't
know.
Engine
ax
is
a
load
balancer
and
another
team
might
like
the
service
much
better,
and
why
can't
you
have
both
like
if
the
system
administrator
can
handle
there
setting
up
the
cluster
is
based
in
the
requirement.
That's
a
that's
a
good
reason
for
having
multiple
kubernetes
clusters,
as
I
said.
A
So
we
have
a
geographical
reasons
and
we
have
the
logical
reasons
and
all
of
them
are
valid.
Now.
What
are
the
Canaries
cloud
types
they're,
homogeneous,
kubernetes
cloud
heads?
It's
where
you
wanna
line,
show
kubernetes
clusters,
unlike
when
all
your
variants
close
to
reside
on
the
one
cloud
provider,
they
have
similar
settings
and
then
there
is
a
heterogeneous
or
a
hybrid,
kubernetes
cloud.
It's
where
your
kubernetes
Unitas
can
recite
on
pram
or
in
the
cloud
and
both
or
in
the
different
types
of
cloud.
I.
Think
the
most
common
I've
seen
them
on.
A
A
It
is
very
common
that
your
organization
has
a
different
set
of
the
kubernetes
cluster
ease
and
there
are
certain
challenges
when
it
comes
to
the
hybrid
kubernetes
cloud,
so
different
hosted
communities
providers,
they
have
their
own
authentication
types,
so
Google
has
warned
Amazon
has
another.
Other
cloud
providers
has
their
own,
so
an
authentication
strategy
on
a
hosted
provider
cannot
really
be
adjusted
to
your
company
needs,
and
so
and
even
if
like
you'd
say,
let's
say
you
already
have
some
I
think
the
authentication
system
like
LDAP
or
you
want
to
use
the
github.
A
It's
not
very
easy
to
do
the
cross
clusters
and
when
it
comes
to
our
bug
the
role
based
access
control,
it
is
a
bit.
It
is
a
bit
tough
to
set
it
up
on
the
different
on
the
different
kubernetes
clusters.
It
is
possible
and
it
is
possible
like
for
administrator
to
script
it,
but
there
might
be
a
better
way
to
do
it.
So
all
the
challenges
brought
the
need
for
the
missing
puzzle
piece.
A
So
there
is
a
need
for
the
system
that
would
manage
multiple
kubernetes
clusters
across
different
clouds,
and
the
first
piece
that
there
is
to
address
is
authentication
and
authorization
cross
kubernetes
clusters.
So
an
our
goal
at
Rancher
was
to
build
a
authentication
and
authorization
management
system
that
is
here
are
the
requirements.
It's
gotta
be
open
source.
All
our
code
is
an
open
source.
A
It's
gotta
be
written
and
developed
as
a
community's
native
application.
We're
gonna
share
more
details
of
what
kubernetes
native
application
is
on
the
next
slide.
It
has
to
extend
kubernetes
api
is
using
crts
customer
source
definition,
and
the
logic
has
to
be
implemented
as
a
custom
controllers
now
a
little
bit
about
what
is
he
already
in
kubernetes,
so
think
of
it
as
a
way
of
extending
the
kubernetes
abs?
A
It's
where
you
can
describe
your
resource
and
you
can
inject
it
in
the
kubernetes
api,
so
you
can
use
the
common
kubernetes,
client
cube,
CTL
or
kubernetes
api
to
fetch
your
resources
to
do
the
simple
crowds
on
them
so
like,
for
example,
I
keep
CTL
get
pod
should
be
very
similar
to
the
cube
CTL.
Get
your
custom
resource
alert
in
this
case
and
then
the
actual
logic
behind
the
customer
source
definition
is
implemented
by
the
custom
controller
and
what
is
a
custom
controller?
A
It
is
basically
the
cut
the
logic
that
washes
for
the
Sierra
resource
changes
and
then
it
executes
some
logic
based
on
the
resource
spec
or
status,
and
update
the
resource
status.
So
the
user
can
see
in
the
API
what
happened
to
his
resource
based
on
the
controller
results,
and
be
aware
that
there
can
be
multiple
controllers
operating
on
the
same
resource.
So
for
that
it
is
better
to
to
design
your
CRD.
A
The
way
that
in
your
stereos,
are
going
to
be
multiple
conditions
and
one
custom
controller
will
take,
will
do
that,
be
it's
only
for
one
of
them,
so
they
do
not
clash.
Now.
What
is
the
need
of
coordinators
native
application?
What
it
is
like
I've
tried
to
find
the
definition
online
and
I
really
couldn't
so
I've
tried
to
come
up
with
my
own
based
on
so
first
of
all,
it
has
to
be
this.
A
Application
has
to
be
continuous
and
it
has
to
be
deployed
in
a
docker
container
and
has
to
run
as
a
kubernetes
pod,
and
it
has
to
be
launched
using
either
community
on
manifest
or
kubernetes
api
s--,
and
also
it
is
very
common
for
the
kubernetes
native
application
to
utilize.
The
comes
to
kubernetes
constructs
like
config
maps
and
secrets,
so
secrets
for
storing
sensitive
data.
The
config
map
for
passing
the
custom
configuration
to
your
controller,
and
then
this
is
actually
the
nice
bonus.
It's
not
the
requirement
for
a
native
app.
A
It
has
to
be
managed
using
the
kubernetes
api.
So
now
this
is
Ranger.
It's
open
source.
All
the
code
is
in
the
github
or
Rancher
and
sure
we
accept
external
contributions,
and
if
you
try
and
find
any
issues,
please
file
them
will
be
happy
to
fix
them.
So
now,
our
to
that
Overson
is
a
bit
different
from
one
that
six
I'm,
not
sure.
A
If
anybody
used
wrench
for
1.6
but
okay
yeah,
so
tada
dough
is
very
different
and
so
what
it
is
so,
first
of
all,
it
is
built
on
top
of
kubernetes,
which
means
that
it
uses
each
CD
as
a
database.
So
our
one
that
X
version
was
written
in
Java
and
was
using
my
sequel
so
I
as
a
developer,
I
had
to
convert
my
skills,
my
Java
skills
and
learned
how
to
program
and
go
yeah
so
to
thyroids.
We
didn't
go
and,
as
I
said,
it
extends
the
kubernetes
api
s--.
A
Every
Ranchi
resource
is
represented
as
a
custom,
resource
definition
and
the
resources
in
the
in
city
database
and
then
functional
components
run
as
kubernetes
controllers.
There
is
just
a
brief
summary
of
what
Rancher
is
now:
let's,
let's
go
over
the
authentication
and
authorization
across
clusters
before
moving
to
authorization.
I
think
it's
very
important
to
talk
about
authentication,
because
that's
the
first
step
that
your
user
needs
to
make
in
order
to
gain
an
access
to
the
underlying
kubernetes
clusters.
So
how
is
authentication
done
with
Rancher?
A
So,
first
of
all
imagine
you
have
multiple
clusters
and
you
don't
want
to
go
to
each
and
every
cluster
and
configure
the
authentication
like
the
way
kubernetes.
Does
we
wanted
to
provide
the
way?
So
you
can
configure
your
authentication
only
once
and
we
have
an
integration
with
a
bunch
of
authentication
providers
like
Active
Directory,
github,
open
LDAP.
We
are
extending
this
set
based
on
the
user
requirements.
We
are
adding
more,
but
this
is
a
basic
set.
So
what
happens?
Is
the
global
administrator
comes
in
to
Rancher
and
it
hooks
it
up
with
an
authentication
provider?
A
And
again
it's
only
done
once
and
then
every
user,
from
from
the
from
the
syndication
provider,
can
get
an
access
to
rent
your
UI
and
API
and
here's
a
little
bit
of
the
flow
and
how
is
it
implemented
so
rangers
seats
as
authentication
proxy
in
front
of
every
kubernetes
cluster?
So
when
the
request
to
the
cluster
needs
to
be
made,
it
actually
comes
to
the
Rancher
API.
Then
Rancher
authentica
is
the
request
against
the
authentication
provider.
A
If
the
request
is
authenticated,
it
impersonates
it
by
passing
the
user
and
group
to
the
request
that
goes
to
the
kubernetes
cluster
and
if
the
request
is
not
authenticated.
Obviously
you,
the
user,
gets
an
error
and
a
little
bit
about
the
implementation
implementation
details.
So,
as
you
know
that
kubernetes
itself
doesn't
have
the
first
class
object
for
the
user
in
groups.
A
But
if
you
manage
access
for
the
users
across
multiple
clusters,
it
does
make
sense
to
make
user
in
groups
as
a
series
is
a
first-class
object,
so
you
can
actually
assign
some
missions
to
them
and
manage
them.
So,
yes,
we
introduced
this
two
new
two
concepts
into
our
management
plane
and
then
admin
can
grant
permissions
on
producer
and
group
to
a
particular
cluster
or
to
a
particular
project
and.
A
Underneath
so
we
are
using
kubernetes
bird
talking
authentication
for
for
authentication
the
request
today
to
the
user
cluster
right.
So
once
the
user
is
authenticated.
Here
is
time
to
think
about
what
the
user
can
do
in
the
given
kubernetes
cluster,
what
kind
of
resources
he
can
see
and
work
with,
and
what
types
of
access
he
can
get
into
this
resources?
Their
name
is
role
based
access
control
or
our
bug
provides
a
very
nice
set
of
constraints
where
you
can
define
the
roles
and
the
role
bindings
in
the
role.
A
You
actually
say
you,
you
define
the
resource
and
you
define
the
operations
that
can
be
done
on
the
resource
and
the
role
binding
is
like
a
connection
of
the
role
to
the
user.
So
once
the
user
is
connected
to
the
role
he
can
do,
whatever
is
defined
in
the
role.
So
now
there
are
two
auerbach
role:
levels
in
kubernetes:
one
is
a
cluster,
oh
and
another.
A
One
is
the
namespace
role,
so
the
cluster
role
is
defined
globally
and
it
is
applied
across
namespaces
in
the
cluster
and
the
namespace
role
is
applied
to
a
particular
namespace
in
the
multi
cluster
management
system.
There
was
an
obvious
need
to
introduce
one
more
row
above
the
cluster
as
you're
managing
the
access
to
multiple
clusters.
So
we
added
the
global
row
and
what
this
global
role
allows
you
to
do
so,
there's
a
new
CRD
and
it
is
used
to
manage
users.
A
So
there
you
can
define
the
manage
the
users
management
rules,
it
is
used
to
manage
user
roles
and
it
is
used
to
manage
the
authentication
can
fix
for
syndication
providers
like
github
config,
LDAP
config.
So
the
global
role
is
an
extra
that
Rancher
added
to
the
management
plane
in
addition
to
the
existing
kubernetes
kubernetes
objects.
A
And
yes,
so
it
also
allows
you
to
manage
access
to
a
particular
cluster,
and
there
was
one
more
need
that
we
find
very
important
to
fulfill.
We
added
one
more
role
in
between
the
cluster
and
the
namespace,
and
it
is
called
the
project
role
and
we
find
that
in
in
the
organizations
in
the
companies.
Sometimes
there
is
a
need
for
collaboration
when
users
from
the
multiple
namespaces
have
to
collaborate
with
each
other
and
the
same
set
of
the
arbok
rules
have
to
apply
to
their
namespaces.
And
again
you
don't
want
to
do
it.
A
You
don't
want
to
do
the
same
operation
on
multiple
resources.
So
we
added
this
concept
of
a
project
which
is
another
CRD
and
what
project
is.
It
is
actually
a
collection
of
the
namespaces
and
it
is
a
way
to
define
the
arbok
rules
on
a
project
level
and
the
main
spaces
that
are
a
part
of
this
project
can
automatically
inherit
them
yep
and
here's
an
example
of
one
of
our
custom
controllers
for
the
project.
A
A
Project
is,
are
also
nice
way
to
specify
the
part
security
policy.
You
can
define
the
part
security
policy
on
for
project
basis
and
every
part
that
is
launched
inside
this
project
will
inherit
automatically
and
another
useful
construct
on
project
basis,
because
you
can
define
the
resource
quarter
in
the
project
and
all
the
namespaces
within
the
project
are
going
to
make
sure
that
they
are
not
going
to
go
over
the
quota
that
is
defined
on
the
project
and
here's
just
an
example
of
how
the
network
policy
works.
A
So,
let's
say
in
your
organization,
you
have
some
stable
project
and
you
have
a
pilot
project.
The
namespaces
within
the
project
can
communicate
with
each
other
freely
and
and
between
the
project
that
access
is
denied.
So
today,
in
venture
we
just
have
the
simple
network
network
policies
like
do
not
blood
projects
we
communicate
with
each
other,
but
we're
going
to
add
more
customization
into
it
in
the
future,
all
right.
A
So
Rancher
itself,
as
I
said,
is
the
native
kubernetes
up
and
it
gets
lunch
tinder
as
a
kubernetes
spot,
but
it
also
can
be
launched
in
just
a
regular
kubernetes
container.
So
on
my
laptop
I
have
I,
have
a
mini
cube
running
and
the
docker
and
I'm
going
to
launch
French
her
as
a
docker
container,
the
doctor
run
command,
so
the
application
is
going
to
listen.
Is
it
big
enough
or
should
I
make
it
bigger.
A
A
A
Alright,
so
what
it
does
is
it
launches
the
docker
container
and
it
actually
launches
an
embedded
coordinators
cluster
on
it.
That's
just
a
one
way
of
sending
up
Rancher.
You
can
also
stand
it
up
as
a
kubernetes
application
on
adjacent
kubernetes
cluster,
but
for
the
development
purpose.
It's
it's
very
easy
to
set
it
up
in
the
docker
container
and
you
can
see
what's
going
on.
If
you
look
at
the
logs,
you
can
say
that
we
are
creating
their
resource
definition,
role,
bindings
and
stuff.
So
once
the
once
it's
up.
A
Username
and
password
authentication-
and
here
as
you
can
see,
there
is
already
one
cluster
registered
into
my
into
my
system.
So
this
is
a
global
view.
That's
where
you
actually
see
all
your
clusters
and
you
can
add
more
clusters.
So,
like
remember
now
you
are
managing
multiple
cluster
and
you
have
to
add
them
register
them
somehow
in
the
system,
and
there
are
various
way
on
how
you
wanna,
how
you
can
do
it.
You
can
either
let
us
provision
the
cluster
for
you.
We
can.
A
We
have
an
integration
with
the
hosted
kubernetes
providers
like
we
can
provision
the
clusters
on
Jiki,
ets
or
easier,
or
if
you
already
have
your
kubernetes
cluster
provisioned,
and
you
just
want
to
manage
the
authentication
with
us.
You
can
import
your
clusters
into
rancher.
So
let's
just
try
that
just
choose
this
custom
import
option
and
the
name
and
we'll
give
you
the
command
that
you
will
need
to
run
inside
your
kubernetes
cluster,
so
it
can
get
registered
into
Ranger.
A
A
A
Just
go
back
to
the
local
setup,
so
hopefully
it
gets
faster.
But
so
you
start
by
by
importing
your
clusters
or
registering
your
cluster
adventure,
and
then
it
is
time
to
set
up
the
authentication
provider
for
your
for
the
system
and
it's
going
to
be
like
under
security
authentication.
That's
where
all
the
providers
are
configured
and
if
you
choose
the
github,
we
use
the
github
both
way
of
connecting
with
it.
So
you
just
have
to
go
to
your
github
account
and
register
the
application.
A
The
URL,
it's
not
going
to
work
with
the
localhost
I'm
just,
but
it's
going
to
be
like
a
regular
public
eye.
It
should
be
a
public
IP
address
once
you
want
your
kubernetes
cluster
in
somewhere,
where
it's
available
to
everybody.
So,
but
once
the
users
are
configured
okay,
so
okay
I
think
it's
recovered.
Let's
go
to
the
authentication
where
I
already
have
the
github
off
set
up,
and
this
is
a
place
where
you
can
define
the
rules
of
who
can
access
your
enter
setup.
A
So
by
default,
any
authorized
user
from
your
github
can
access
Rancher
and
you
can
actually-
and
we
will
do
the
user
and
group
for
discovery
here
once
the
user
is
logged
into
Rancher.
The
user,
CRT
or
Group
C
already
gets
automatically
created
in
the
rancher
and
then
the
question
is
like
how
you're
going
to
access
your
cluster.
Do
you
need
to
use
Rancher
uie?
No
as
a
user
or
system
administrator?
A
If
you
don't
want
to
use
the
UI
or
API,
and
if
you
prefer
the
native
kubernetes
way,
you
can
use
the
cube
CTL,
and
for
that
you
just
go
to
the
cluster
of
you.
So
there's
a
global
view
and
there's
a
cluster
of
you
and
the
cluster
of
you
will
generate
the
cube
config
that
can
be
used
for
accessing
your
cluster.
A
That
is
about
that
indication
and
how
you
connect
your
underlying
kubernetes
cluster
is
and
like
a
back
to
authorization
on
what
the
particular
user
can
do
in
the
kubernetes
cluster,
so
by
default,
number
of
roles
can
be
pre-configured,
so
here
is
a
bunch
of
pre-configured
global
roles
and
any
user
who
logs
into
Rancher
automatically-
and
here
is
the
user
role.
And
what
is
this
user
role
is.
If
you
click
on
edit,
you
will
see
all
the
all
the
permissions
that
this
user
can
do.
A
You
can
define
your
own
roles,
but
you
cannot
define
the
global
roles
you
can,
and
here
is
their
like
on
every
level
for
a
cluster
or
for
project.
You
can
define
your
customer
roles
and
we
also
pre-populate
some
of
them
for
you
and
just,
for
example,
cluster
role,
and
here
you
brand
the
permissions
of
what
this
role
can
do
like
in
this
case
it
can
delete
and
get
the
apps
or
you
can
inherit
from
the
existing
role.
A
It's
just
an
easier
way
of
of
creating
it,
and
once
the
role
is
defined,
you
can
actually
see
it.
If
you
go
to
the
cluster
and
go
to
the
members,
and
when
you
add
a
new
member
to
your
cluster,
you
bind
it
to
a
specific
role
that
you've
just
said
here
here
it
is,
and
the
members
can
be
added
either
in
pro
cluster
level
or
on
pre
project
level.
So
this
is
a
global
view.
The
close
review
and
the
project
view
default
system
are
the
projects.
Let's
just
go
to
the.
C
A
C
A
Actually
for
Google
I
can
show
you
like
there's
some
extra
step
that
you
have
to
make
in
order
for
it
to
be
in
order
for
authentication
to
work
correctly.
But
it's
going
to
be
the
same,
so
you
have
to
authenticate
through
a
rancher
and
then
the
rancher
will
authenticate
you
to
that
to
that
cluster
and
we
use
we
use
a
bird
talking
approach.
So
we
do
create
a
service
account
and
then
once
user
is
authenticated
with
Rancher
we
get
the
bird
talking
of
the
service
account.
A
C
C
D
D
A
The
deployment
is
not
showing
up
so
we
had.
We
had
a
bug
where
the
deployment
that
is
that
it
has
on
the
references,
are
not
showing
up
in
the
wrench
or
API
and
we
fixed
it
in
the
latest
release
it
there
was.
There
was
the
bug
but
I'm,
not
sure
I'm,
not
sure,
if
that's
what
you're
I'm,
not
sure
if
it's
the
cause
of
the
behavior
that
you
are
seeing.
A
A
The
cluster
agent
I'm
curious,
why
you
see
the
node
agent
in
the
important
clusters,
so
usually
the
node
agent
gets
launched
on
the
clusters
that
we
prickly
cluster
agent
gets,
gets
launched
in
every
cluster
that
is
registered
with
Rancher.
It
is
used
for
communicating
like
from
the
cluster
trencher,
but
the
node
agent
I
believe
is
only
registered
when
we
provision
the
nose
for
you
yeah.
So
so
when
we
provision
that
not
only
the
kubernetes
cluster,
we
provision
the
knows
where
kubernetes
cluster
is
going
to
lunched.
So
that's
actually
for
syncing
back
the
note
state
into.
D
A
B
A
A
Today
we
support
only
the
education
providers
that
I
showed
you
in
the
demo
I'm,
not
sure
how
it
would
work
with
the
cloud,
because,
if
it's
like,
if
it's
a
club,
it
is
not
gonna
work.
Cross
clouds
write.
Whatever
providers
are
show,
it
is
gonna
like
work
on
every
on
every
cloud
and
every
kubernetes
cost
through
and
if
it's
like
in
your
case
is
something
very
specific
to
your
particular
cloud.
A
A
Mean
open
to,
we
actually
accept
that
contribution
so
like
if
you
feel
that
you
want
to
add
one
more
provider
to
the
list.
You're
welcome
to
do
that.
We
have
actually
several
we
have.
We
had
this
model
for
for
a
bunch
of
things
like,
for
example,
for
the
node
drivers
that
I
use
for
a
knows
provisioning.
We
we
have
a
some
default
set
of
what
we
support
like
we
support
digital
ocean,
for
example,
easy
to
you,
but
multiple
customers
and
users.