Overview

This is a reference design and implementation based on Rafay's Terraform Provider to provision a RBAC controlled, dedicated operating environment aka project for an application team/business unit using Amazon's EKS clusters. We will then run a number of day-two operations on our cluster.

Important

The lifecycle of all resources will be managed using Terraform Infrastructure as Code based on Rafay's Terraform Provider.

Source Code for Template¶

The Terraform source code and related assets are available in a public Git repo as shown below

Git Repo

Background¶

It is a relatively common pattern for platform teams to provide downstream application teams with a dedicated operating environment.

Day-1¶

This environment maps to a project in a Rafay Org
Access to the project is controlled to specific users/groups based RBAC and/or ABAC rules
It is common for organizations to require "separation of duties" esp. between infrastructure operations and application operations.
Cloud credentials are automatically created in the project which is then used to provision at least one Kubernetes cluster for the application team
It is common for organizations to standardize their clusters with a required baseline (aka cluster blueprint) comprising several software addons
To ensure clusters operate within accordance of corporate policies OPA policies are put in place

Day-2¶

The cluster may need to be upgraded to a new Kubernetes version to ensure that it is supported by the provider

Items Out of Scope¶

Although possible using Rafay, this reference design does not include the following items. We have provided pointers below to content that can be used to address this.

The user is expected to embed the working Terraform code in their pipeline.
Creation and management of namespaces and/or workspaces for application teams
How application teams can deploy/operate their containerized applications on the Kubernetes cluster.

What Will You Do by Part¶

Part	What will you do?
1	Build out the infrastructure required to support application teams in AWS. This will be using Rafay's Terraform provider to provision a number of resources in a project in your Org. Once complete we will navigate the console and view the cluster through the integrated dashboard and securely access the cluster's API server using zero trust kubectl
2	Walk through an upgrade on the Amazon EKS cluster
3	Deprovision the cluster and remove the underlying infrastructure

The following sequence describes the resources that can be customized and provisioned using Terraform IaC based automation.

sequenceDiagram
    participant pipe as External Pipeline
    participant tf as Terraform <br>Provider
    participant rafay as Rafay
    participant csp as Cloud <br>(AWS)
    pipe->>tf: New Operating Environment 
    tf-->>rafay: Create Project 
    tf-->>rafay: Create User Group
    tf-->>rafay: Map Roles to Group (RBAC)
    tf-->>rafay: Create Cloud Credential
    tf-->>rafay: Add Git/Helm Repositories <br> (for Add-Ons)
    tf-->>rafay: Create Namespaces <br> (for Add-Ons)
    tf-->>rafay: Create Add-ons <br>(nginx, cert-manager, karpenter)
    tf-->>rafay: Create OPA Constraint Templates
    tf-->>rafay: Create OPA Constraints
    tf-->>rafay: Create OPA Installation Profile
    tf-->>rafay: Create OPA Policy
    tf-->>rafay: Create Custom Blueprint <br> (Managed and Custom Add-ons)
    tf-->>rafay: Create Cluster Overrides 
    rafay->>csp: Provision EKS Cluster <br> (using Cloud Credential)
    rafay->>csp: Apply Custom Blueprint <br> (with Cluster Overrides)
    csp->>rafay: Blueprint Sync Successful 
    rafay->>tf: Cluster Ready
    tf->>pipe: Operating Environment Ready
    tf-->>rafay: Upgrade Cluster <br> (Day-2 Operation)

Roadmap¶

This reference design is constantly evolving. We plan to progressively enhance the design with additional functionality based on our roadmap and customer feedback. Please watch this space or our product blogs for updates.

References¶

To access the documentation for Lifecycle Management for EKS, click here