Cloud Native Computing Foundation Kubernetes Community Days Bengaluru 2021, 10 Jul 2021

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Provisioning Infrastructure with Crossplane

Description

Kubernetes Community Days Bengaluru'21

Crossplane is a Kubernetes add-on to represent infrastructure resources as Kubernetes custom resources. This talk shall show how Crossplane can be used to manage infrastructure and build your own control plane on top of that.

Slides: https://docs.google.com/presentation/d/1I63qMMYTXt6ragvo5QMFLeDpw4W3YnUMpj2En7H7jsk/edit?usp=sharing

A

My name is style and today I'll be speaking on crossplane as a tool for provisioning infrastructure a little bit about myself. I work as a software engineer at infra cloud and close my twitter handle.

A

So today we will uh first go through the fundamentals of crossfilm, uh get an idea of what it is. Then we will try to provision some infrastructure and I'll be using aws for that. uh After that, we will see how uh some features in crossfit allow you to make abstractions over existing infrastructure resources and then how it also helps you to build kind of a platform or control plane on top of your infrastructure.

A

So crosspin is a component is add-on that helps you manage your infrastructure. uh It helps so it does so by allowing you to represent your infrastructure resources uh as kubernetes custom resources or crs a quick example of that can be seen here. So this is uh across the representation of rds instance in aws.

A

So it's a typical kubernetes cr and you have your api version, the kind and a bunch of parameters.

A

So once you install the the specification in in a kubernetes, cluster, crossbend will take care of actually creating an rds instance in native u.s account and then watching this that this rds instance uh throughout its lifetime. For any modifications.

A

Besides, it also helps you build some abstractions uh and then package and distribute your infrastructure resources in form of oci images all right uh before we actually provision some resources.

A

uh We need to understand that that a provider is that actual custom controller uh that is running in a kubernetes cluster and trying to sync the desired state and the actual state in the uh in your infrastructure or aws account in this example.

A

uh Provider config is nothing but a reference to a kubernetes secret that is holding your credentials for the uh infrastructure provider and then managed resources are the actual resources that you create in your kubernetes cluster.

A

So all together, it may look something like this. uh You have a competency cluster, you install crosstalk in that and when you install a provider like provider aws, you get a bunch of crds and the provider aws is responsible for actually uh connecting to your aws account and then managing all this uh actual uh infrastructure resources which you have created through crds.

A

So, uh let's try to create the rdds instance that we saw already so again it's a typical cr. So I can just do cube kettle apply and the name of the file.

A

So once this is done, I I should see an actual rds instance getting created in my aws.

A

Account all right uh yeah, so we have output. uh Let's see uh if crosstown tells us anything about the state of this rds instance.

A

Okay, so here's some metadata uh so, for example, these are the properties that we have provided. Split and a property called a state which cross bin fest for us from uh aws.

A

So it says uh the rds instance is being created, uh let's go to the aws console and then we should have yeah. We have a rds instance that is being created.

A

uh Let's take a look on yet another example. So I have this iem user and again I can just do cube. Curl apply name of the file.

A

Okay, so again I can take the state of that user. I can do cubical hit. I am user again uh prospect has fed some properties after the user was created in aws.

A

If I go to the im console in aws, I should see a user created here.

A

So after this is created, uh crossfin uh periodically is watching this resources, the im user and the rds instance for any changes, and if, if it does detect any changes, uh it's job of crossplan to bring it back to the desired set that we had specified in our uh demo file.

A

So, for example, if I delete this user cross plane at that snake, next, reconciliation uh will detect that the user is deleted, uh but the user does exist as crd introspect right. So so it will try to just create the user again, as we should see yeah, so the user is created again so, uh like any other uh kubernetes resource, uh crossplane uses the strong kubernetes control loop to watch over the resources uh in any infrastructure and then manages them throughout their life cycle and by infrastructure.

A

I I actually mean anything that has an exposed api. uh You can just create a provider for that and use that with.

A

A

Let's go back to the audio sensors example that we saw earlier so this was the yaman specification that we used to create just the dp instance, while actually creating db instances. You might want to create uh some other resources, like a subnet group or a security group, to be attached with your rd systems to do that in crossfin. You would typically write another bunch of yama specifications and then install them to your cooperative cluster.

A

Well, that works perfectly. You can get a quite overwhelming uh because you will have a lot of resources to deal with and a lot of properties, so crossfind allows you to abstract all that away into a single resource of type called composite resource definition or srd.

A

So, for example, I've created xrd called composite postgresql instance, which exposes just one single property called as storage gb, and this will decide the storage capacity of my db instance.

A

All of the rest details are captured in a another resource called composition where I have foreign, for example. This case I have a db subnet group, rds instance, and the default properties of the resources.

A

uh What I also have uh is the storage gb parameter, which is mapped to a field called allocated storage, which is a field that is actually accepted by uh the aws apis, and I can label that uh with a label. Something like this. So since this is for aws, I can label it with provide a rate of this.

A

So what this means is for the single uh xrd, you can write multiple compositions, let's say, for example, other than this aws composition. I can write another composition for gcp and then the users, when creating an instance of this xrd, are free to choose where they want to create the db instance and accordingly choose uh the composition that they want.

A

Another type that we can see here uh is a composite resource claim that is nothing but a namespace proxy of this xrd, which is automatically created by crossfit.

A

So in the end, when you install the xrd in the composition, uh then you can just create a db instance uh using any composition with a simple yaml specification such as this. So, as you see, I'm just providing the storage db parameter and I'm choosing uh my composition using a field called composition, selector and providing a label.

A

And if I want to create a rdb instance since in gcp I can switch to gcp, uh provided that I have a composition for gcp and it defines the respective cloud resources that are associated to a db instance. In.

A

Gcp, so uh once you do that, uh you can also uh package this composition uh and composite resource uh definitions uh into oci image by writing a configuration file, and then you can just push it to any oci uh compatible registry and then allow others to use that.

A

So using features like composition and composite resource definition, uh you can build a sort of platform which is between your infrastructure, users and infrastructure itself.

A

uh This allows you to build a control plane so that your users do not directly use infrastructure, but instead use your control plane to actually manage some infrastructure.

A

Since all of this runs uh on kubernetes, you can use some sort of policy manager for kubernetes to establish an outback framework over all these resources.

A

So, for example, uh here using the same database example, uh I can create an xrd which will point to a vpc which I had created in prior and then I can allow users to create their own database instances which will be scoped to their own namespaces and they are free to use uh compositions like dev or fraud uh based on the requirements.

A

So in this way, a platform operator can uh just impose some restrictions, uh like the success restrictions on the field, uh decide the level of flexibility to be given to the users for for using the actual infrastructure.

A

There are a bunch of other features that uh you might be interested once you start uh working with crossfin. I suggest you visit the crossfit docks or join the community on crossman slack removal.

A

That should be all from me for today. Thank.

A