Connecting to an insecure cluster inside Kubernetes

[jseldess]

From Gitter:

K. S. Ernest (iFire) Lee @fire Nov 13 12:17
How do you connect to a kubernetes cockroachdb cluster? I'm was trying to get a proxy command but failing.
Trying to follow https://www.cockroachlabs.com/docs/build-a-test-app.html .

it only shows how to create a pod on the cluster and type commands on a shell
I want to use a client driver to access the database.

@a-robinson, would be great to get your input here. If it's not too complex, I'd like to add another step to the kubernetes and docker swarm tutorials for connecting to the cluster from a client.

[a-robinson]

This is pretty drastically different depending on the use case desired.

The user on Gitter was trying to connect to the CockroachDB cluster from his local development machine. There isn't a good way to do this. It looks like he eventually resorted to the only real option for that, which was opening his database up to the entire internet. I realize the development value of connecting to your DB from your local dev box, but I doubt that we want to recommend such a configuration.

The other, more supportable use case would be deploying an application into the cluster which uses a client driver to access the database. This is a much more natural thing to do, but most of the tutorial would be around how to deploy an application to Kubernetes (not around anything related to cockroachdb itself) -- i.e. building an app into a docker container and deploying it into the cluster. You don't really do anything differently to connect to cockroachdb in kubernetes vs in a more traditional deployment. You just have to use the name of the Kubernetes service (cockroachdb-public) as the hostname when connecting.

Do you think either of these would be useful? Which one?

[fire]

As the person from that gitter. I would prefer the method of opening up Cockroachdb to the internet and having authentication working either by password or by a certificate. This obviously has to be secure. However, this also means that the cockroachdb becomes a database as a service to your other applications which are outside the kubernetes cluster. This quite useful as you can then have other applications access the kubernetes. It may also be a security barrier to having the application.

The second use case already works. The application (cockroachdb shell) given as an example already demonstrates this.

[a-robinson]

Thanks for the extra info, @fire. Do you have a particular concrete use case in mind (other than development) where you want cockroachdb inside of kubernetes available to applications outside of your kubernetes cluster, or are you saying it would hypothetically be useful?

I'm curious because in my experience stateful workloads like databases tend to be the last thing moved into container orchestration systems. If that's not actually the case, then we should indeed expand our docs to cover secured clusters with external IPs.

[fire]

Here are two:

1. Allowing analysts to make ad-hoc queries from their tableau or online platforms. (This is similar to the development workflow).
2. Streaming backups

[fire]

For #1 I guess installing spark / https://github.com/getredash/redash inside of kubernetes could work. However, some analysts are dependent on their desktop tools.

[a-robinson]

@jseldess has opened #875 to document how to secure clusters on Kubernetes. Once we have that, documenting this use case will just be a matter of showing people how to set the service type to LoadBalancer.