Posts Tagged Kubernetes

Pulumi and Docker: Development to Production

Here at Pulumi, we’re big fans of Docker: at this point there is little doubt that Docker has completely revolutionized the way that we think about deploying software. However, even in 2019, it’s quite difficult to get Docker containers to production. docker run is great, and we all love it, but unfortunately it’s quite a big leap from docker run to running your container in a production-ready environment.

We recently wrote a blog post about using AWS Fargate to run your docker containers with our open source packages. In this blog post we’re going to focus on another interesting aspect of Pulumi: being able to re-use your infrastructure code for both development and production!

Read more →

Simplify Kubernetes RBAC in Amazon EKS with open source Pulumi packages

One of the most common areas Kubernetes operators struggle with in production involves creating and managing role-based access control (RBAC). This is so daunting that RBAC is often not implemented, or implemented halfway, or the configuration becomes impossible to maintain.

Fortunately, Pulumi makes RBAC on Kuberenetes so easy that you’ll never create an insecure cluster again. In this post, we will contrast the traditional way of working with RBAC on EKS with using Pulumi.

Read more →

Getting Started on Google Cloud Platform with Pulumi

Getting Started on Google Cloud Platform with Pulumi

Google Cloud is one of the most exciting cloud platforms available today, with a breadth of powerful infrastructure services from Google Container Engine (GKE) and Google Cloud Functions to Cloud Firestore and Cloud Spanner.

Pulumi¬†is the most productive tooling available today for teams building cloud applications and infrastructure, in your favorite languages. Add them together, and¬†teams¬†can easily take maximum advantage of¬†Google Cloud Platform’s¬†rich features, productively, with a combined platform that makes it easy to collaborate, share, and reuse.

Read more →

Improving Kubernetes Management with Pulumi's Await Logic

Improving Kubernetes Management with Pulumi's Await Logic

Pulumi enables customers to create, deploy, and manage modern applications and infrastructure in their preferred cloud environment using general purpose languages such as Javascript, Typescript and Python. For many businesses today, the use of modern technology is associated with Kubernetes, tools (command line or domain specific tools) to bring-up Kubernetes and a large pile of raw YAML files to deploy Kubernetes resources with.

Pulumi’s ready to use, language specific Kubernetes packages allow you to trade in the grab bag of tools and YAML files in exchange for the full expressive power of a general purpose language. In this blog post, we discuss “await logic”, which allows users to have better visibility into the state of Kubernetes resources as they are being deployed or created.

Read more →

If you liked ksonnet, you'll love Pulumi!

If you liked ksonnet, you'll love Pulumi!

The Kubernetes landscape is constantly evolving as end users and developers search for the right tools, approaches, and abstractions to help them manage Cloud Native infrastructure in production.

On Feb 5, Heptio (now part of VMWare) announced that work on ksonnet, a project launched by Heptio, Box, Microsoft, and Bitnami, will stop. We’re sad to see ksonnet winding down, but are thankful for the collaborative exchange of ideas between projects, and are excited to see continued investment in VMWare/Heptio’s other projects. The good news is that, if you liked ksonnet, we’re confident that you’ll love Pulumi. In this post,¬†we’ll tell you¬†why.

Read more →

Using Helm and Pulumi to define cloud native infrastructure as code

Using Helm and Pulumi to define cloud native infrastructure as code

The Helm community is one of the brightest spots in the infrastructure ecosystem: collectively, it has accumulated person-decades of operational expertise to produce Kubernetes manifests that “just work.”

But for many users, it is not feasible to run *everything* in Kubernetes, and the community is just starting to develop answers to questions like: what happens when a Helm Chart needs to interface with, for example, a managed database like AWS RDS or Azure CosmosDB?

Pulumi is a cloud native development platform designed to be able to express any cloud native infrastructure as code in a natural, intentional manner using real languages. The most natural way to solve this challenge would be to stand up an instance of AWS RDS, populate a Kubernetes Secret with the connection details, and then simply let my application use these newly available resources. Pulumi gives users the primitives they need in order to achieve tasks like this most effectively.

Read more →

How do Kubernetes Deployments work? An adversarial perspective

How do Kubernetes Deployments work? An adversarial perspective

This post is part 3 in a series on the Kubernetes API. Earlier, Part 1 focused on the lifecycle of a Pod and Part 2 focused on the lifecycle of a Service.

What is happening when a Deployment rolls out a change to your app? What does it actually do when a Pod crashes or is killed? What happens when a Pod is re-labled so that it’s not targeted by the Deployment?

Deployment is probably the most complex resource type in Kubernetes core. Deployment specifies how changes should be rolled out over ReplicaSets, which themselves specify how Pods should be replicated in a cluster.

In this post we continue our exploration of the Kubernetes API, cracking Deployment open using kubespy, a small tool we developed to observe Kubernetes resources in real-time.

Read more →

kubespy trace: a real-time view into the heart of a Kubernetes Service

kubespy trace: a real-time view into the heart of a Kubernetes Service

This post is part 3 in a series on the Kubernetes API. Earlier, Part 1 focused on the lifecycle of a Pod, and later Part 3 details how Kubernetes deployments work.

Why isn’t my Pod getting any traffic?

An experienced ops team running on GKE might assemble the following checklist to help answer this question:

  1. Does a Service exist? Does that service have a .spec.selector that matches some number of Pods?
  2. Are the Pods alive and has their readiness probe passed?
  3. Did the Service create an Endpoints object that specifies one or more Pods to direct traffic to?
  4. Is the Service reachable via DNS? When you kubectlexec into a Pod and you use curl to poke the Service hostname, do you get a response? (If not, does any Service have a DNS entry?)
  5. Is the Service reachable via IP? When you SSH into a Node and you use curl to poke the Service IP, do you get a response?
  6. Is kube-proxy up? Is it writing iptables rules? Is it proxying to the Service?

This question might have the highest complexity-to-sentence-length ratio of any question in the Kubernetes ecosystem. Unfortunately, it’s also a question that every user finds themselves asking at some point. And when they do, it usually means their app is down.

To help answer questions like this, we’ve been developing a small diagnostic tool, kubespy. In this post we’ll look at the new kubespy trace command, which is broadly aimed at automating questions 1, 2, 3, and providing “hints” about 4 and 5.

Read more →