I am trying to enable some admission controllers on EKS. How do you see the existing admission controllers and enable new ones?
I don't believe this is possible at this time. The control plane is managed by Amazon, and it's not possible to modify it.
If you need a Kubernetes cluster in AWS with these kind of options, use kops
Related
I'm trying to create an AWS EKS cluster with Pulumi and it seems two components exists:
#pulumi/eks providing a Cluster component
#pulumi/aws providing an eks/Cluster component
#pulumi/eks seems to be higher level but I cannot find a documentation specifying the concrete difference between those, and if one is preferred depending on use cases.
What's the difference between those two components?
#pulumi/eks/Cluster is a component resource that is built on top of #pulumi/aws/eks/Cluster and other resources to simplify provisioning of EKS clusters. Its goal is to make common scenarios achievable with a handful of lines of code, as opposed to the involved model of raw AWS resources.
You can find some usage examples in
AWS Crosswalk: AWS Elastic Kubernetes Service
Easily Create and Manage AWS EKS Kubernetes Clusters with Pulumi.
I suggest you start with #pulumi/eks and see if it works well for you.
I managed to get multicluster istio working following the documentation.
However this requires the kubeconfig of the clusters to be setup on each other. I am looking for an alternative to doing that. Based on presentation from solo.io and admiral, it seems that it might be possible to setup ServiceEntries to accomplish this manually. Istio docs are scarce in this this area. Does anyone have pointers on how to make this work?
There are some advantages to setting up the discovery manually or thru our CD processes...
if one cluster gets compromised, the creds to other clusters dont leak
allows us to limit the which services are discovered
I posted the question on twitter as well and hope to get some feedback from the Istio contributors.
As per Admiral docs:
Admiral acts as a controller watching k8s clusters that have a credential stored as a secret object which the namespace Admiral is running in. Admiral delivers Istio configuration to each cluster to enable services to communicate.
No matter how you manage contol-plane configuration (manually or with controller) - you have store and provision credentials somehow. In this case with use of the secrets
You can store your secrets securely in git with sealed-secrets.
You can read more here.
Can somebody point in the direction on how to enable PodNodeSelector admission controller in EKS version 1.15 ?
I'm trying to achieve what is explained in this link, but how to do this in Managed Kubernetes like EKS where you don't have access to control plane components.
In fact: You cannot enable PodNodeSelector in EKS.
The fact that EKS is a Managed Kubernetes solution denies any reconfiguration of control plane components. That's why you cannot enable PodNodeSelector.
There is an official documentation about enabled admission controllers in EKS: Aws.amazon.com: EKS: Userguide: Platform-versions
There is ongoing feature request for PodNodeSelector here (as well as some workarounds): Github.com: AWS: Issue: 304.
There is an answer on StackOverflow with similar question How to enable admission controllers in EKS
I'm trying to set up a multi-cloud deployment using GKE as a single plain of glass for cluster management. Unfortunately, I can't see "Register cluster" option within GKE. I can create a cluster, I can delete a cluster, I can deploy a workload to a cluster, but the option with registering the new cluster is not available for me.
I'm not using the free tier and I'm not within an Organisation also.
Could somebody help me to figure out why it is so? I could not find the solution digging through GCP documentation.
Thank you in advance
I think what you are looking for is Anthos. It has a unified user interface and in the Anthos for operations section of the documentation it says:
Single pane of glass visibility across all clusters ...
But the link to the documentation to register a cluster gives me a 404.... I would suggest reaching out to Google Cloud Support to see if they can help you.
edit: It turns out that you need to be an Anthos customer to access the both the feature and the documentation for the feature.
I came across an open source Kubernetes project KOPS and AWS Kubernetes service EKS. Both these products allow installation of a Kubernetes cluster. However, I wonder why one would pick EKS over KOPS or vice versa if one has not run any of them earlier.
This question does not ask which one is better, but rather asks for a comparison.
The two are largely the same, at the time of writing, the following are the differences I'm aware of between the 2 offerings
EKS:
Fully managed control plane from AWS - you have no control over the masters
AWS native authentication IAM authentication with the cluster
VPC level networking for pods meaning you can use things like security groups at the cluster/pod level
kops:
Support for more Kubernetes features, such as API server options
Auto provisioned nodes use the built in kops node_up tool
More flexibility over Kubernetes versions, EKS only has a few versions available right now
Other significant difference is that EKS is an AWS product so you require an AWS account but kops allows to run Kubernetes in AWS but also in GCE and DigitalOcean.