Cloud Native Computing Foundation KubeCon + CloudNativeCon Europe 2020 - Virtual, 4 Sep 2020

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: SIG Service Catalog Update - Jonathan Berkhahn, IBM & Mateusz Szostok, Kyma

Description

Don’t miss out! Join us at our upcoming events: EnvoyCon Virtual on October 15 and KubeCon + CloudNativeCon North America 2020 Virtual from November 17-20. Learn more at https://kubecon.io. The conferences feature presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects.

SIG Service Catalog Update - Jonathan Berkhahn, IBM & Mateusz Szostok, Kyma

Service Catalog lets you provision cloud services directly fromt he comfort of native Kubernetes tooling, regardless of where the service is actually hosted. Service Catalog is a Kubernetes implementation of the Open Service Broker API, an open standard to provision and manage cloud services. In this session,t he Service Catalog leads will demo the current Service Catalog functionality, and the activities around the sub-projects. This will be followed by a deep dive into the problems we are facing and the future of the Service Catalog project. At the end of this talk, we'll also go through a short comparison between Service Catalog and operators.

https://sched.co/ZrGx

A

Hello, everybody, I'm adela shostak, I'm senior software engineer at sap, labs, poland. Today we have a session about the service catalog and it's both an introduction and some updates about the state of this. um So um this is the only session on service catalog during this kubecon, and it's only 35 minutes. I will try to close you only 25 and the result for the q a session.

A

uh Let me go further and what you will learn so, basically, first, what the use cases for having sales catalog are.

A

Next, I will briefly show you what is powered by and then I will show you a demo and because it's a cube cone, we need to talk about yarns and last but not least, I will talk about our plans for current milestones.

A

So, let's start and before we jump into uh service, catalog use cases. Let's start with the background, how the applications are developed. As we all know, uh our application most applications are not islands, often they interface with some backing services, like databases, billing systems, some caches and so on. What is important is that those services are necessary for your application to function properly.

A

But do you as a developer, don't want to focus on creating and managing those services?

A

For you, it's important to have some slas, but mostly you don't care where they are running and who is managing them um and one national slide to ensure that you're on the same page, when I'm talking about services, I mean a platform holds a services like an object, store or third party services like in azure text analytics, but definitely not about the kubernetes services which are used for the dns discovery, and so we already know that application use some services and we also know which services we are talking about.

A

So the question is: how do I get one you are probably from you are familiar with the influence. Probably your organization also has it um so mostly to submit a ticket and wait until they will take it and process it. Then you need to take need to get some credentials and figure out how to store them. But the worst thing is that the process may differ between various services that you want to use and access.

A

A

We told you that you can have a single place inside your kubernetes cluster called marketplace where you can find all those services, for example, mysql or mongodb, and also with some variants. Mysql right now have a free, basic and enterprise variant.

A

It's like a t-shirt, so the enterprise will be the most expensive one, but you as a developer, can start with the free free one and the provisioning process is the same for all of them. So you simply select a service in a given variant and provision it then you can create a binding in this case, binding means creating kubernetes secrets with all the information you need to know to connect to that instance.

A

Of course, you can create more than one binding, so have a separate set of credentials for each application and that's what service catalog delivers and behind the scenes in most use cases a cluster of new registers broker and its one-time operation once the broker is registered sales category queries that broker and makes the offering available in marketplace and what is service broker service broker is an independent server running somewhere.

A

It can be inside your cluster but doesn't have to it offers a catalog of services, for example, in ecosystem we have a gcp broker and if, after installing it, you will see a managed offering from the gcp inside your marketplace, so you as a developer, you see all the services that you can pick and you can simply say: hey provision me a mysql database and if it's coming from gcp broker, then the service is created on the gcp site, you, as a user, don't care how it's created or managed it's a responsibility of that broker to know how to do that and provisioning is not only about creating somebody in services.

A

It can also trigger an action, for example, subscribe to an api.

A

So during the provisioning you can subscribe to a text analytics service from the azure and later you can create the binding with and use the secretive credential inside it. So to sum up, basically, I can do anything that can be split in two actions. First, one provision so do something on the back end. Second, one bind so retrieve all information that I need to know to connect to that instance.

A

Yeah and this whole concept is powered by the open service broker api specification. The point of it is to abstract the life cycle of managing an application. It allows cloud platform in our use case, kubernetes, to interact with a broker and service. Catalog is a client implementation where you can register all those brokers.

A

As you see on the diagram, the beauty of it is that you have a single place and unified way to manage all those services that are coming from a different brokers in a uh in your cluster. Also, if you are a broker developer, you can write your logic only once and register across all platforms that support the open service block api specification.

A

Yeah, as I said, the specification is about the res api, so communication between service, catalog and service broker is done via rs course, but the specification is more complicated because it describes also how to handle errors, orphan mitigations, retries and so on. But the important thing is that all those things are implemented only once, instead of scatter so view as a user you, you should only trigger provisioning, but rest will be handled by service catalog and right now. Let's see it in action. So let me share my.

A

A

A

And now you should be able to see my console with three commands that I already executed to just speed up the demo. uh First one is creating a kubernetes cluster on my local machine. I used kind to do it next. What I did uh is to install service catalog using home free client next, what I did is to install mini broker and the mini broker is a lightweight implementation just for the demo purpose.

A

So, first of all, if I register broker, I should have something already in my marketplace, but before we check it, let's check the status of the broker, and maybe one small introduction right now for the demo. I will use sdcat and svcat is a cli developed and published by us just to interact with the service catalog. It gives you more user-friendly experience when you want to uh talk to the service catalog, for example, if you are not familiar with the kubernetes, so what I can do is to type sd card get broker.

A

What I can say is that I have a one broker registered in my platform and is in status ready. So I should see something in my marketplace: sd card marketplace and yeah. I see couple of services.

A

um What I see here is like class and plans same as I showed you uh previously and in that example, is that the broker that I installed is um somehow exposing him charts to service catalog as a class and plans, and in that uh scenario plans are not the t-shirts uh they are describing the version of the database. So, for example, I have more db mongodb mysql postgres redis, with quite a lot of versions.

A

What I can do next is to describe that class, so I can execute sd card describe class mariadb.

A

What I see here is once again all plans connected with that class, so all variants that I can install, I see the name tags and also from which broker that class was created.

A

So I know that it's from coming from the mini broker. So let me, let's assume, that we want to have in our cluster some application that needs to connect to some database and it's a mariadb. So what I can do with sd card is to say sd card provision, the name of the application, the instance sorry class and plans that I want to provision. But before we do it, I will just show you that you can simply say provision and ask for help here. You will see the usage of it as a supervision.

A

Previously, you need to add some name also refer to plan and class, so in that way you'll create a new instance of the service. Of course, you can specify some parameters to override the default settings. There is a few different ways how you can do it using secrets, jsons or just key value pairs so also again that provision.

A

Demo, mario db, let's hit the button. What we can see here is that the request was sent. um There is no parameters defined during the provision request, but in more sophisticated use cases I can set um the initial databases uh some size of the database, the name of database and stuff like that.

A

So right now I can check the status of it. So get instance.

A

As I see I have one instance inside my default namespace, which is in ready state so right now I know that my broker should deploy a hand chart also in that namespace, so check. Let if we have some uh some pots here and yeah that's true. Just few seconds ago uh chat was deployed and right now I have some instance, but still I do not know how to connect to that database and what sales catalog uh gives. You is an option to just bind to that instance.

A

So I can say, service sd card bind the name of that instance and hit the button. Once again, I didn't send any parameters, but it's more sophisticated uh for more specific, sophisticated classes. You can set there some roles that you want to have assigned for your users and stuff similar to that.

A

So, let's check the status of the binding.

A

As I can see, there is a one binding in my default namespace in ready state. So I told you during the demo that binding cisco should also create a secret in my namespace, with all the information that I need to know to connect to that instance. So, let's check, if I have some secret here and that's true, because I have it it's here, it's a few seconds ago created and the name is exactly the same as my binding because I didn't override it.

A

So what I can do is to describe that secret, scribe secret and as promised in under data, we have quite a lot of information that all of them are uh useful. When you want to connect to that instance, and in normal use case, you will just get that credential and inject into your application, probably into your part and later on.

A

It can be consumed by your application and execute some business logic, um and I showed you uh all those commands using sd card, because it's really nice, it gives you a much better user experience when interacting with the service catalog, but still under the hood. What sims catalog does is to create a custom resource. So when I execute sdk provision, then it creates a custom resource called service instance.

A

So I can check it. uh If I have something like that and that's true, I have something like that in my um cluster and say my name space, it's almost the same output, but with the custom resource. What I can do is to also ask about the ammo version, so I have more details and it's true. The status is quite uh huge because there is more information about it and there are also more information about the under spec field, but the most important ones are service class name and service family.

A

So let me go back to my presentation.

A

A

Yeah, so here I have the same custom resource but with, uh but only we require fields.

A

These definitions are equal to the sd card command that you can see below, but this yam you can use to describe your infrastructure as code, for example, you can use it in your scripts or bundle in some helm, charts and deploy that into your cluster in some cis. Why not? So what we can say is that service catalog is an operator uh which is watching own crds and when you create a service instance, the controller reacts and sends a rest provisioning code to the correlated broker.

A

And in general service catalog has 8 crds. I will not describe all of them, but what is worth to mention is that we have a cluster and nice place called brokers. If you register a cluster a broker, then its offering is available across all nayspaces.

A

But if you decide to go with a namespace option, then you will limit of this offering to a given namespace. It's cool, for example, because of security reason.

A

B

A

With vm, you also have more power having free access, you can customize all fields under spec, for example, I added catalog restriction, which simply allows you to skip those services and to not show them in your marketplace, and you can, of course create more sophisticated rules and add more stuff like uh how often the broker should be refreshed with the new offering.

A

And yeah final summary of that story: why are we doing this? And the answer is quite simple: we want to help you to discover third party services and, as a result, you can focus on writing your business application and, at the same time, be sure that your service is managed by experts.

A

And if you are a service provider, then it's also awesome, because the crazy thing is that you ride a broker which is a platform agnostic, so it can be integrated in all platform that supports uh opencv api specification. So, for example, at the same time you can register it in kubernetes and cloud foundry and service. Dialog is a project located under kubernetes repository.

A

Of course it can be deployed using helm charts. As I showed you on the demo. We also support hand free currently serious catalog is in the beta version, but it's already used on production by sap and ibm and, as we have already started talking about the status, let's go into more detailed update.

A

um Yeah. Almost a year ago, we changed the architecture of the service catalog, um and now uh we have all that free release, which is the latest release available on our github um and so what changed in the new service catalog. As you can see on the diagram uh we get, we got rid of the api server and etcd and replace that with crds. That simplifies a lot. We also added the webhook server, which allows us to intercept crowd requests, so we can set some defaults validate manifest before storing them in etc.

A

Here you have also a query qr code, so we can scan it because it points to our migration guide.

A

Next yeah, this change forced us to have two branches master and audit to for the api server version and according to the kubernetes best practices, we supported a duplicated version for nine months. But what is important is that the support expired at the end of last month, so please take into account and use and submit issues only for all that free version.

A

um Yeah as a six service catalog, we have two sub projects. One is a mini broker. We are which I showed you during the demo, and we also use it in the official catalog workflow documentation.

A

uh The second one is a open search, broker, client written in, go it simply. Abstracts rest call defined in opencv api specification and you can use it in your go applications.

A

Of course, it also used in our service catalog controllers,.

A

Next plans for for the service, catalog so definitely documentation enhancement. We want to combine with the official guidelines. I want to clean up the communication structure, write more tutorials and also better describe what kind of features we already have in service catalog and what will come up in the new feature.

A

We want to be compliant with the new open source book api. Currently, we support 2.14, which is a little bit behind the official spec, um because right now they are working on 2.16, so we need to uh catch up on it.

A

We already did a lot of work regarding ci, but travis is still used for cutting new releases and the best option would be to use only one technology for our cis and move all this stuff to prowl migration of strategical resources under seek control.

A

Right now on the left, you can see the url that we are currently supporting, but those url were created were created by sick maintainers and we just want to switch them to the official ones and just be complying with the best practices.

A

The decision of the future of the fourth person functionality- that's a huge topic um during the demo. I showed you that you can create an instance which is awesome later on.

A

You can create a binding a lot of bindings if you want, but then you end up with the kubernetes secrets where you have all those information that you need, but in end-to-end scenario you have an application for which you want to inject those secrets, and there is idea called pod presets, which gives you an option to inject secrets into your uh deployment later on to plot um and even in camera project, we created something called service, binding usage, which uh crd to go with the controller, and in with that, when we create that custom resource, we need to specify the binding and the target uh application.

A

The whole magic will be done by controller and under the hood we are using pod presets, but it's not the core function of the service catalog. Yet maybe we will donate that. Maybe we'll come up with something else, or maybe we'll decide that it's out of scope for the service clock, but yeah decision still needs to be made and your feedback is really welcome and the ideas how we can do it and your use cases about it.

A

One more thing so recently guys from vmware, uh have created a proposal for supporting day two operations, which is really interesting topic for all service catalog users. Simply it gives brokers an option to describe generic extensions so for backups or some just ping. My service and stuff like that. So please take a look and leave a comment on what you think about it.

A

As you see, a lot of things are going on and if you want to become a contributor, then join our bi-weekly sig meeting. It takes place every other monday at 1 pm, pacific time yeah. Here we also have some useful links. uh The presentation is available on the qcon site website, so you can download it from there and use used.

A

Those information.

A

Yeah and with that we finished the main presentation, but nine are open for your questions. Thank you.

B

Me hi uh so we're going to go into some.

A

Of the questions.

B

You all have been asking um so, let's just get down to it um first step: can we limit services and plans to certain name spaces? So a couple people asked a couple variations of this someone answer them all at once. um Currently, there's two mechanisms to limit access to services, uh it's possible when you install a broker to install it as a namespace scope resource, in which case its dependent classes and plans will be available at only in that namespace.

B

um Additionally, it's possible when installing a broker to whitelist or blacklist specific services on that broker to further show which ones show up in the system.

B

Next up any support extensions for integration with logging and monitoring services such as splunk or prometheus.

B

So currently I don't believe we have any particular special integration with logging services.

B

The way service catalog was deployed is just a in a kubernetes cluster, so provided you have any any integration with how kube handles its logs um you'd be able to plug in that solution to service catalog, but we ourselves.

A

Do not have any.

B

Special implementation on our end.

A

Yes, but one thing is that we're exposing some metrics from controllers and web hooks, so you can just create a service monitor if you have promote use in your cluster and in that way, just get a little metrics and expose them to some graph. Another words um yeah.

B

Okay, uh what is the current state of adoption of service catalog by various firms?

B

um So I'm only sort of familiar with uh large, like cloud platform companies, um I myself work for ibm. I know we use for a bunch of services on our cloud.

B

I know vmware uses it. I.

B

You're know on it. I know sap is at some point, obviously, but all that material due to that.

A

B

uh Yeah and then I know, there's a whole bunch of smaller, like individual vendors that offer their thing by a service cat or via service broker, um but I couldn't I couldn't really speak to those specifically.

B

I just kind of work on the service catalog side of things.

B

Can we customize the binding secrets for? Can we customize the binding prefix with, for example, a prefix to support multiple service bindings to a deployment?

B

um So currently, I believe the name of the secret is always the same as the name of the binding you, the user can control the name of the binding, so you can name it whatever. You want, additionally, uh there's nothing, stopping you from having multiple secrets bound to a single deployment. um So hopefully it answers this question. I don't really get it if it doesn't.

A

Yeah, I think that's mostly answer the question, and uh one thing is that if we creating a secret uh there, you have a key value purse and you can just during the injection those secrets into your deployment. You can just specify the prefix and we also doing that in kimas. So when you're ejecting the same secrets, because there is a quite common to just name, the key as a url or password.

A

So in that way, we just during the injection of the secret we're just adding a prefix. So we know that.

B

A

B

That's because it's quite painful.

A

If you have the value with the same.

B

That's like a kubernetes thing: no, that's not a service catalog specific.

A

B

Is that any segment.

A

B

um How do you deal with the case where you have an application interacting with multiple cloud services, for example, a cloud bucket and a queue? Will that lead to two? I am roles being created or the service catalog merge the permissions needed and create one. I am role when both are bound to a single application.

A

I think it's uh at least that question should be answered by the broker developers and from my experience, because we use the gcp broker. I can say that they have two strategies there, so you can just create the em for a bunch of services and store those credential in one secret and later you can just provision a few of them with their reference to that uh um common, not the common but shared credentials.

A

uh The other option is to just for each of the services create your own em, so but yeah, it's a little bit depends on the broker developers and how they represents their uh functionality uh inside the service catalog, because what we are doing is only to provisioning and binding to a given instance and.

A

Yeah, I think that should answer the question. If you will just check the gcp broker side, then you can just check their approach for such strategies. As I have eem, they have.

B

To see it on a lot of a lot of steps, that's could be the answer to it. It's really beyond the scope of service catalog and it's up to the broker author of how specifically.

A

B

That sort of thing um please share your views on operators versus service catalog, so operators are something we hear a lot about as sort of a competing solution to service catalog, but at least for the time being, they aren't really trying to solve the same problem.

B

uh Operators are a hopefully mature ecosystem for basically implementing uh crds and then controllers. The base are based on those crds, whereas the service catalog is more of an interface point between kubernetes and other cloud infrastructure.

B

There's like other weird stuff, you can do with it, but that's that's how I view it. So I don't I don't know necessarily if they're competing. um There are some people who are trying to build operators up to the point where they could be a solution to the same problem. Service catalog is trying to solve, uh but I don't think it's quite there yet.

B

Are there any brokers available for cloud provider, services like aws, rds or azure cosmos db?

B

um I don't know about those two services specifically.

B

I do know many cloud providers offer their services via service broker. I know azure at least. Usually I've used it recently, so I don't know if they still do um but like yeah, like matus, was saying, I know, gcp offers a bunch of their services fire cloud.

A

B

I know here at ibm we offer anything you could ever want via broker. um So I definitely think there's there's lots of stuff out there in the ecosystem right now today, but I can't speak to those two things specifically.

B

A

Give me a sec.

B

New questions are coming in, apparently, azure has stopped supporting their osb implementation in favor of an operator.

B

uh How does the upgrade of a bound service happen? Is it part of the service catalog functionality? um So, assuming you mean, like I provision a database I bind to that database. How does that did that specific database instance get upgraded that isn't part of service catalog functionality, yet so that's really up to the service broker author at this current point in time to say when and how upgrades like that happen.

B

um The open service broker api is current in the process of trying to add that mechanism to the spec, to allow the platform to trigger or be aware of, updates to instances like that. But that isn't quite there yet, but it might be in the very near future.

B

Can you repeat the black listing and white listing aspect of services and plans? So when you first add a service broker to the catalog, uh you can whitelist tag or blacklist tag. Specific services from that broker's catalog to you know somehow filter the stuff that actually shows up in the the marketplace of services available on your.

B

B

Shhh, uh how does the operator side of the service broker look like what options are you aware of? um So I'm assuming this just means like someone who operates the service broker, not operators, the kubernetes thing, um so a service broker itself is just a if you actually go. Look at the spec, it's just a web server that implements five endpoints.

B

Fetch catalog provision instance provision binding deprovision, binding deprovision instance, so it's it's actually pretty simple, um and once you have that up and running you know it'll work with anything that has an osb implementation. uh I know there are libraries out there uh that allow you to quickly stand over broker. I've done a couple myself just for fun, um but it's it's not too difficult to stand up the actual broker part, because it's a very simple web server.

B

That only has you know five endpoints uh and unfortunately that is all we have the time for today. uh So thank you all for coming and thank you for coming to our talk.