#office-hours - September 2019

#office-hours starting now! ask questions, get answers. free for everyone. https://zoom.us/j/508587304

It is done @Erik Osterman (Cloud Posse)?

Mentioned in today's #office-hours was "VPC peering between GCP and AWS."
I hadn't heard of this before, and after looking around, I still don't know if what was meant was actually VPC peering between AWS<>GCP or a VPN solution.

@tamsky To clarify, we have VPC peering between the AWS accounts and AWS<~>GCP we are using VPN

joining now!

sorry running late

#office-hours starting now! ask questions, get answers. free for everyone. https://zoom.us/j/508587304

just me today? i don't have anything, was just going to listen in. no offices for me to be noisy in

ok!

yea, no one yet.

@Russell Sherman saw you registered for office hours

we're on now.

also helps if i unmute my headphones lol

I just got home

Gimmie a 5 mins

sure, i'll just hang out

I do have something we could work through if i can steal an office

i need to debug why i'm getting a "too many redirects" on a new service, might be interesting for folks who want to see the workings of the CP stack

nothing sensitive that i'd be afraid to show

ok, sure thing

@Alex Siegman <http://forecastle.stakater.com/url|forecastle.stakater.com/url>: 'https://{{- env "KEYCLOAK_INGRESS_HOSTS" -}}/auth/admin/'

@OScar https://github.com/stakater/Forecastle

@here public #office-hours starting now! join us to talk shop https://zoom.us/j/508587304

What was the issue with using kube2iam?

Every node is responsible for negotiating with AWS apis to get sts tokens

If you restart all your pods or launch a lot of pods you will overload the kube2iam server and AWS apis

Rate limits are account wide

So you can basically DOS attack the AWS apis and they return the favor by blocking you

We have had this happen across multiple accounts and customers before switching to Kiam

Also the security model of kube2iam means the nodes them selves need an admin IAM role

With Kiam only the server needs it and that can be deployed to a dedicated node pool

Coincidentally, my team member just asked about using kube2iam and I recalled that from our office hours.

And it caches the credentials so it’s both much faster and doesn’t DoS AWS

Thanks @Erik Osterman (Cloud Posse) that was helpful.

Read all about it here

Found this as well, which was interesting: https://www.bluematador.com/blog/iam-access-in-kubernetes-kube2iam-vs-kiaim

@Erik Osterman (Cloud Posse) Can you share that link to the AWS Service Operator-like operator for Terraform?

@dalekurt here is how we deploy kiam with cert-manager: https://github.com/cloudposse/helmfiles/tree/master/releases

I seriously use k9s every freaking day. It is my favorite tool since brew

The maintainer is super active, nice, reliable, quick to respond, and brilliant

I've tried a bunch of times to get him to set up the donation stuff but he doesn't seem interested in money. I want to buy the man like 10 beers

@Jeremy G @Andriy Knysh (Cloud Posse) @Igor Rodionov @Maxim Mironenko (Cloud Posse) ☝️ maybe something nice to check out

@Jeremy G has joined the channel

@Igor Rodionov has joined the channel

@Maxim Mironenko (Cloud Posse) has joined the channel