This is a reference design and implementation based on Rafay Environment Manager using Terraform IaC sourced from a Git repository. You will setup and use Environment Manager to build and manage operating environments based on Amazon EKS clusters in RBAC controlled Rafay projects. Environment Manager enables a self-service model for Development and DevOps teams (Admins) to create environments while giving enough control to the central Ops, SRE and Platform teams (End Users) to enforce security, cost, governance guardrails and standardization.
This design builds on and extends the Terraform based reference design by providing self service based automation using Environment Manager.
It is a relatively common pattern for platform teams to provide downstream application teams with a dedicated operating environment.
- This environment maps to a project in a Rafay Org
- Access to the project is controlled to specific users/groups based RBAC and/or ABAC rules
- It is common for organizations to require "separation of duties" esp. between infrastructure operations and application operations.
- Cloud credentials are automatically created in the project which is then used to provision at least one Kubernetes cluster for the application team
- It is common for organizations to standardize their clusters with a required baseline (aka cluster blueprint) comprising several software addons
- The cluster may need to be scaled up/down as per the needs of the application team
- The cluster may need to be upgraded to a new Kubernetes version to ensure that it is supported by the provider
Items Out of Scope¶
Although possible using Rafay, this reference design does not include the following items. We have provided pointers below to content that can be used to address this.
- Creation and management of namespaces and/or workspaces for application teams
- How application teams can deploy/operate their containerized applications on the Kubernetes cluster.
What Will You Do by Part¶
|Part||What will you do?|
|1||Setup and Configure Environment Manager|
|2||Manage the lifecycle of a AWS environment|
The following resources will be created as part of the environment:
sequenceDiagram participant pipe as Rafay <br> Env Manager participant tf as Terraform <br>Provider participant rafay as Rafay participant csp as Cloud <br>(AWS) pipe->>tf: New Operating Environment tf-->>rafay: Create Project tf-->>rafay: Create User Group tf-->>rafay: Map Roles to Group (RBAC) tf-->>rafay: Create Cloud Credential tf-->>rafay: Add Git/Helm Repositories <br> (for Add-Ons) tf-->>rafay: Create Add-ons <br>(nginx, cert-manager) tf-->>rafay: Create Custom Blueprint <br> (Managed and Custom Add-ons) tf-->>rafay: Add Cluster Overrides rafay->>csp: Provision EKS Cluster <br> (using Cloud Credential) rafay->>csp: Apply Custom Blueprint <br> (with Cluster Override) csp->>rafay: Blueprint Successful rafay->>tf: Cluster Ready tf->>pipe: Operating Environment Ready tf-->>rafay: Create Nodegroup <br> (Day-2 Operation) tf-->>rafay: Scale Nodegroup <br> (Day-2 Operation) tf-->>rafay: Upgrade Cluster <br> (Day-2 Operation)
This exercise is expected to take ~60 minutes to complete. A setup script will be used to assist in setting up the pre-requisites for this guide. The setup script wil perform the following actions:
- Create a repository in the controller
- Create a Secret Sealer in the controller
- Create a GitOps Agent that will run on the machine where the setup script is executed from
- Create a GitOps System-Sync pipeline in the controller that will be used to sync resources between the controller and the forked Git repository
The sequence diagram below illustrates the steps you will experience at a high level.
Either the Environment Template User or the Infra Admin can perform the deploy/destroy operations on an environment.
sequenceDiagram autonumber participant admin as Platform Team participant rafay as Rafay participant user as Developer rect rgb(191, 223, 255) Note over admin,rafay: Setup Environment Template admin->>admin: Clone Git Repo admin->>rafay: Setup Env Manager <br>Resources admin->>rafay: Input Cloud Credentials end rect rgb(191, 223, 255) Note over rafay,user: Provision & Use Environment user->>rafay: Create Environment user->>rafay: Use Environment user->>rafay: Destroy Environment end
- You have access to a AWS Account
- You have access to a Mac or Linux machine
- You have a Git client on your machine that is setup for push/pull