devspace-cloud / devspace-cloud

DevSpace Cloud ⚡ Turn Kubernetes into a Powerful Developer Platform (new on-premise edition)

Website • Quickstart • Architecture • Documentation • Blog • Slack • Twitter

Securely provision Kubernetes namespaces for developers

• Secure Multi-Tenancy & Namespace Isolation ensure that cluster users cannot break out of their namespaces
• On-Demand Namespace Provisioning allows developers to create isolated namespaces with a single command
• >70% Cost Savings With Sleep Mode that automatically scales down pod replicas when users are not working

⭐️ Do you like DevSpace? Support the project with a star ⭐️

Contents

• Features
• Architecture
• Installation

Features

DevSpace allows developer teams to work together in shared Kubernetes clusters. Simply add your team members and create isolated namespaces for different users and workloads.

Strict Namespace Isolation

• Automatic Service Account: every service account is restricted by RBAC to only access its namespace
• Automatic RBAC (role-based access control) for every service account / namespace
• Automatic Pod Security Policies to ensure that users cannot break out of their pod limits
• Automatic Network Policies to isolate network traffic between namespaces (zero trust policy by default)
• Automatic Resource Quotas to limit computing and storage resources available per user and namespace
• Automatic Limit Ranges to automatically define resource limits for containers and pods
• Admission Controller to validate every API server request and to perform extensive security checks

Admin UI for Managing Users & Permissions

• Secure Invite Links for adding users to teams and clusters while performing secure token exchange
• User Management that allows to set admins and control who can access which cluster
• Limit Configuration to define limits per namespace and user (e.g. X GB RAM, Y number of namespaces etc.)
• Visual Ingress Manager that allows developers to easily and securely expose services with a few clicks

Great Developer Experience

• On-Demand Namespace Creation and Automatic Isolation with a single command
• Automatic kubectl Context Setup on the developer's machine (+ automatic context updates)
• Automatic Subdomain(s) for Every Namespace to allow service access via ingresses
• Single-Command Application Deployment via DevSpace CLI (optional)
• In-Cluster Development with Hot Reloading of Containers via DevSpace CLI (optional)

More info and install intructions for DevSpace CLI on: www.github.com/devspace-cloud/devspace

Sleep Mode for Namespaces

• >70% Savings on Cloud Infrastructure when cluster auto-scaling is enabled
• Detects Namespace Inactivity (kube context not used for X minutes)
• Automatically Scales Down Replicas to Zero (remembers original replica number and keeps persistent data and configuration)
• Automatically Scales Up Replicas when developers start working again (e.g. running a kubectl, helm etc. command)

Ships Everything Your Team Needs

• Automatic Ingress Controller Setup & Configuration (optional)
• Automatic Cert Manager Setup & Configuration for automatic SSL certificate provisioning (optional)
• In-Build Image Registry for Every Developer and Team (optional)
• Self-Service Signup for Users via Email, GitHub or LDAP (optional)

Architecture

DevSpace Cloud can either be used as-a-Service on devspace.cloud or installed as an on-premise edition (see www.github.com/devspace-cloud/devspace-cloud for instructions).

No matter which edition you use, DevSpace Cloud allows you to connect any Kubernetes cluster with just a single command using DevSpace CLI: devspace connect cluster

After connecting a cluster, DevSpace installs a lightweight control plane inside your cluster as well as optional comfort services (e.g. ingress controller, cert manager, container registry). With the visual admin UI of DevSpace Cloud, you can now generate invite links and send them to developers. You can set limits and permissions for every developer as well as for teams of developers.

Developers can use DevSpace CLI to create isolated namespaces on-demand using a single command: devspace create space

DevSpace CLI runs as a single binary tool directly on a developer's computer and ideally, developers use it straight from their terminal within their favorite IDE. DevSpace CLI per-se does not require a server-side component as it communicates directly to the connected Kubernetes clusters using the kubectl context. However, using DevSpace Cloud in combination with DevSpace CLI allows you to provision namespaces for developers on-demand while DevSpace Cloud ensures that developers are restricted to their namespaces and stay within the limits that the cluster admins configured using the admin UI.

While it is entirely possible to access the isolated namespaces directly via kubectl, helm or other tools, developers can also use DevSpace CLI to streamline the deployment process and deploy complex micro service applications with just a single command: devspace deploy

More info and install intructions for DevSpace CLI on: www.github.com/devspace-cloud/devspace

Install DevSpace Cloud

Learn more in the DevSpace Cloud Documentation

devspace-cloud's Issues

Bug when first installing DevSpace On-Premise Edition via Helm

Hello,
I am encountering a problem when first installing DevSpace On-Premise Edition via Helm.

Error:
"Error: template: devspace-cloud/templates/auth/deployment.yaml:49:22: executing "devspace-cloud/templates/auth/deployment.yaml" at <.Values.auth.liveness>: nil pointer evaluating interface {}.liveness"

Steps to reproduce:

• Launch a one-node-cluster with RKE on Ubuntu18.04
• Install DevSpace On-Premise with the provided helm command in your documentation.

There is a open issue at helm regarding this, but do you have a workaround for this problem?

Thanks very much!

Encountering error about missing spec.selector when running deploy-devspace-cloud

[fatal] Error deploying devspace-cloud: Unable to deploy helm chart: helm install: rpc error: code = Unknown desc = release devspace-cloud failed: Deployment.apps "devspace-ui" is invalid: [spec.selector: Required value, spec.template.metadata.labels: Invalid value: map[string]string{"app":"devspace-ui"}: `selector` does not match template `labels`]

Non TLS deployments should still use the domain for the ingress.

running:
devspace run deploy-devspace-cloud-no-tls

Currently sets --var DOMAIN="" and I'm not sure why, but it's causing the ingress to have no host value.

I'll create a PR to fix this momentarily.

Images missed in docker official registry

Following registry of 'devspace-cloud' used was not found in hub.docker.com
devspacecloud/auth:0.0.6

devspacecloud/hasura:0.0.4

devspacecloud/hasura-init:0.0.5

Disable built in nginx-ingress controller

There should be an option to disable the nginx ingress controller that gets deployed with devspace-cloud.

Another option is to remove it from the chart entirely, I would think it is pretty common for a cluster to already have an ingress controller set up, it seems a bit out of scope for this as well.

Why not just let whatever ingress controller is set up as the default handle any created ingresses?

do not allow https connections when DevSpace Cloud is deployed with http-only configuration

Currently, https connections are allowed even when DevSpace Cloud is deployed as http-only and this leads to issues with the session storage. If the users logs in via https and adds DevSpace Cloud as provider via devspace add provider --host=http://... using http, the CLI will open the login page because the user is not authenticated because the authentication is limited to the https version.

1. If HTTPS is configured, requests should always be forwarded to HTTP (but NON-permanent redirect, so status code 307 instead of 301 because otherwise switching the protocol will never be possible due to infinite browser caching of 301 redirects).
2. If HTTP is configured, requests to HTTPS should not be accepted or forwarded as 307 to HTTP as well. However, it is important that the ingress controller itself is accepting HTTPS requests, e.g. for space domains etc.

Feature Request: Active Directory Authentication

It would be nice if devspace-cloud's authentication worked with Active Directory at some point down the road.

bug: `get account: record not found`

What happened?

UI shows error get account: record not found under certain circumstances (= session data stored in local storage from old instance on same domain).

What did you expect to happen instead?

Redirect user to login if session is not valid or user is not found or any other auth error occurs.

How can we reproduce the bug? (as minimally and precisely as possible)

1. Install DevSpace Cloud via devspace run deploy-devspace-cloud-no-tls
2. Sign up and login.
3. Uninstall DevSpace Cloud via devspace purge -s
4. If local cluster, also purge local storage data via devspace run purge-local-storage
5. Install DevSpace Cloud again via devspace run deploy-devspace-cloud-no-tls (do not reset vars or use the same domain name)
6. Wait until everything is running and open: http://${DOMAIN}/spaces

I can't add on premise provider

When I run the command in README to add a new provider, devspace ask to add first.

# devspace use provider devspace.domain.net.br -n devspace-cloud
[fatal]  Error provider devspace.domain.net.br does not exist! Did you run `devspace add provider devspace.domain.net.br` first?

But when I try to add with the access key:

[info]   Unable to open web browser for login page.
Please follow these instructions for manually loggin in:

  1. Open this URL in a browser: https://devspace.domain.net.br/settings/access-keys
  2. After logging in, click the 'Create Key' button
  3. Enter a key name (e.g. my-key) and click 'Create Access Key'
  4. Copy the generated key from the input field

? 5. Enter the access key here: ********************************

[fatal]  log into provider: Login: login: get token: token save: Couldn't find provider devspace.domain.net.br

I'm using Azure AKS and I can acess with kubectl. I followed the steps, but always get the same error. Please help.

Regards

Add force remove button for cluster (and potentially spaces) which physically do not exist anymore

Currently, when removing a cluster via UI which is not existing anymore, the user gets an error message that the API server host cannot be resolved/reached. We should offer a "force remove" option for this case because it is otherwise not possible to remove clusters which do not exist anymore.

This issue may also exist for Spaces.

Publish helm chart

We should publish the devspace cloud chart to a chart repository and add a README section how to deploy via plain helm.

[4.4.0] Got an error when adding another provider

Hi,

It seems we can't add external providers anymore since 4.4.0.

I tried doing : devspace add provider devspace.xxx.com (my custom devspace provider, that is accessible).

The command returns : Cloud provider not found! Did you run 'devspace add provider [url]'.

It's only the case for new members of the team we have here. Note: devspace.xxx.com is accessible.

Thanks!

Can't delete a space if the namespace has been deleted before

Hi,

I created a space, that created a namespace in Kubernetes.
A few days later I've deleted that namespace with kubectl delete ns ....

Now the space is still existing and I can't devspace use space .... because the serviceaccount doesn't exist anymore.
But I also can't delete the space from devspace cloud. (Internal server error)

Thanks!

Admission controller denies all ingress annotations even if they are harmless

Example error:

rpc error: code = Unknown desc = failed to create resource: admission webhook "limits.devspace.cloud" denied the request: Ingress my-component annotation helm.sh/chart is not allowed

Admission controller is unable to handle networking.k8s.io/v1beta1/Ingress

extensions/v1beta1/Ingress is working but not networking.k8s.io/v1beta1/Ingress which is stated in several examples within the k8s documentation => Error message:

rpc error: code = Unknown desc = validation failed: unable to recognize "": no matches for kind "Ingress" in version "networking.k8s.io/v1beta1"

Support of helm3

Easier ability to search in space view

In addition to my issue for DevSpace UI, I was wondering whether a search bar could be added for the DevSpace Cloud space view too.

I think for most tabs in the space view, it would be very helpful to have search bar, possible right under the navigation tab, to search for container names / event texts / etc. Currently, I'm using the browser's 'find in page' functionality, but with open logs and a container name that is written in the logs, this is quite cumbersome to do :].

Would love to hear what you think :].

docs: add getting started

Outline:

• install CLI
• connect clusters
• configure important limits
• create and manage spaces
• create invite links and manage users