flanksource / karina Goto Github PK

View Code? Open in Web Editor NEW

69.0 9.0 29.0 7.32 MB

karina is an open-source toolkit for building batteries included kubernetes based platforms.

Home Page: https://karina.docs.flanksource.com/

License: Apache License 2.0

Go 88.98% Shell 1.45% Dockerfile 0.15% Makefile 1.16% Open Policy Agent 0.62% Lua 7.64%

kubernetes k8s operator monitoring kubeadm nsx-t vmware-vsphere aws gke

karina's Introduction

Kubernetes Platform Toolkit

karina is an open-source toolkit for building platforms, which includes:

Integrated Production Runtime for monitoring, logging, multi-tenancy, auth, policy, secrets, DBaaS and CICD.
- Docker Registry (Harbor)
- Authentication (Dex, Oauth Proxy)
- Authorization & Policy Enforcement (Open Policy Agent and Gatekeeper)
- Certificate Management (cert-manager)
- Secret Management (Sealed Secrets, Vault)
- CI/CD (Tekton, ArgoCD, Flux, kpack, keptn)
- Database as a Service (postgres-operator, rabbitmq-operator, redis-operator)
- Logging (ElasticSearch, Filebeat, Packetbeat, Auditbeat, Kibana)
- Monitoring (Grafana, Prometheus, Thanos, Karma, Canary Checker)
- Multi-Tenancy (Namespace Configurator Cluster Quotas, Kiosk)
Cluster Provisioning framework for Kind, vSphere and Cluster API (Coming Soon)
Operations focused CLI for health checks, backup and restore, rolling updates, logging, etc..

karina leverages a number of other standalone operators built by flanksource:

kommons as high-level library wrapping client-go
canary-checker for multi-cluster synthetic monitoring of pod scheduling, docker pulls, DNS, ICMP, LDAP, Postgres, HTTP, etc..
template-operator for building re-usable CRD's similar to crossplane's XRD
platform-operator for multi-tenancy support
git-operator for deploying GitOps tools like Flux and exposing REST interfaces onto of Git.

Design Principles

Batteries Included - Most components require just a version to enable and are pre-configured with ingress, LDAP and TLS (managed by cert-manager) due to a shared infrastructure model that includes information such as top-level wild card domain, LDAP/S3 connection details, etc.
Escape Hatches for when the defaults don't work for you, easily use kustomize patches to configure resource limits, labels, annotations and anything else on any object managed by karina.
Integrated, but independent - karina works best when used to provision a Kubernetes cluster and then deploy and test a production runtime, but each function can also be used independently, i.e you can run karina e2e tests in an environment that wasn't provisioned or deployed by karina.

Comparisons

To see how karina compares to other tools in the ecosystem see comparisons

Community & FAQs

Please join the flanksource Slack workspace.

Contributing

Please follow the guideline below when contributing to this project

Conventional commits

karina's People

Contributors

Stargazers

Watchers

karina's Issues

Rename platform-cli to karina

platform-cli is a bit too generic we need something a little more memorable and shorter to say

Please create new suggestions and/or vote for current suggestions

kind based cluster provision

Add an option clusterType: kind to provision a Kind based cluster instead of a vSphere based cluster

Prometheus Alerts: Externalise Alerts

Currently, the alerts are created as part of the jsonnet build process which makes them hard to customize and extend.

Extract the alerts out into a standalone file, that can be overridden using an overlay.

Support templates in Grafana Dashboards and Alert Rules

Currently dashboards and alerts using http://alertmanager and http://prometheus-k8s.monitoring.svc.local` which are not accessible outside the cluster
i.e. to provide correct link to alertmanager, back to the grafana dashboards from alerts

Dex: Make branding configurable

Switch to kubeadm upload certs to cert distribution

Implement cert-manager-csi

Cert storage in vault

migrate command

Given to clusters, migrate the workload from 1 to another.

Options:

Backup & Restore excluding POD's (allowing them to schedule on new nodes immediately)
GitOps redeploy + selective backup + restore e.g. dex.coreos.com CRD's to allow uninterrupted authorization using existing tokens

Istio support

DNS Integration

Deploy fluentd operator

https://github.com/vmware/kube-fluentd-operator

Vault Support

snapshot should include system objects

platform-cli snapshot --include-specs kube-system,nsx-system,quack,opa

Should include the YAML specs alongside the logs for:
Services, Deployments, Daemonsets, Statefulsets, secrets and config maps (with values masked),

Postgres operator: move installation from deploy.sh to yaml + go

copy + paste YAML's with hardcoded pgo namespace
move cert generation into golang
shell out for sshd key generation or find go library

postgres operator: client installation does not work

i.e the following returns a tls error

eval $(platform-cli deploy pgo client)
pgo status

i believe this is due to cert location changing frompgo-client-auth to pgo.tls

All Pods need to be passing liveness and readiness checks
- Max 1 restart per day, bursting to 3 restarts on the first day (to allow for normal restart behaviour as dependencies are created)
Node Readiness conditions should not have flapped within the last day

When specifying --active-tests

A new pod should schedule, start (with a new IP) and connect to the k8s API server and then terminate successfully with 120 seconds

OAuth Proxy

k8s.TestNamespace should check readiness/liveness and restart count

All Pods need to be passing liveness and readiness checks
Max 1 restart per day, bursting to 3 restarts on the first day (to allow for normal restart behaviour as dependencies are created)