Skip to content

v1.0.0

Choose a tag to compare

View all tags
@heyvaldemar heyvaldemar released this 12 Oct 22:18
· 51 commits to main since this release
v1.0.0
fd61a04

The first release of a reference Kubernetes platform for Amazon EKS. Everything it claims is a check that fails the build when the claim stops being true, and every check is shown the violation it exists for.

What is in it

  • The platform as Argo CD ApplicationSets keyed on the cluster Secret, every chart at one exact version and every Git source at the cluster's pinned commit: Envoy Gateway, cert-manager, External Secrets, Kyverno, kube-prometheus-stack, the OpenTelemetry Collector and Velero on every cluster; Karpenter, the AWS Load Balancer Controller and ExternalDNS on EKS.
  • Admission the API server enforces itself. Kyverno CEL policies compiled into native ValidatingAdmissionPolicies: images by digest, requests and memory limits, probes, restricted Pod Security for tenants. They keep refusing with Kyverno scaled to zero, which deletes its own webhooks on the way down.
  • Tenants, one directory each. The platform creates each tenant's namespace, quota and Argo CD project; the project has one destination and an allow-list of kinds with no RBAC on it, and every tenant sync runs as an account the API server limits to the same kinds (Argo CD sync impersonation, enforced).
  • Backups proven by restores. Velero file-system backup, a daily drill that deletes the demo tenant and its volume, restores it and reads back data written before the backup.
  • An SLO that is proven to page, with multi-window burn-rate alerts unit-tested by promtool and made to fire in the cluster.
  • Terraform for EKS 1.37: access entries only, KMS for Secrets, IMDSv2 with hop limit 1, Pod Identity per controller, Graviton system nodes, Karpenter's AWS side, the Velero bucket. Tested with terraform test against a mocked provider, 24 planted violations.
  • Thirteen decision records (docs/decisions/), each ending with how the choice would be explained to a customer; a threat model; a Well-Architected review; runbooks; and a hands-on guide whose three break-and-fix exercises run as written every week.

What it does not claim

The EKS path has not been applied to a real AWS account. It is written, validated, linted and tested against a mocked provider; the guarded, cost-reported real-cloud run is designed (ADR 10) and not built. Nothing here runs in production anywhere. The README's "What is proven, and how" table is the exact list of what is.

How this release was checked

On d439a41, the commit before this release's changelog commit:

  • kind e2e: a fresh kind cluster, the whole platform installed by Argo CD, every Application Synced and Healthy, then 55 of 55 checks. The first attempt timed out after 25 minutes waiting for kube-prometheus-stack to report Healthy, on a runner whose node had gone NotReady; the rerun passed. It is recorded here because a release note that hides a red run is the kind of status this platform exists to distrust.
  • Verification: the rendered manifests through kubeconform, kube-linter, pluto, the Argo CD and policy checks and promtool, 25 planted violations each caught, and the Terraform tests with their 24.
  • hands-on guide, on e6654d3: the three exercises as written. The only later change touches one request in the e2e suite.

Upgrading

This is the first release. From the next one on, CI installs the previous release, writes data, moves the cluster to the new commit and reads the data back before a release is cut.

Full history in CHANGELOG.md.

Assets 5
Loading