Skip to content

Document architecture for Kubernetes and Auto DevOps

Document everything that "goes on in the kitchen". Some of these I think are already documented:

  • We don't test connection to Kubernetes currently until the user clicks "Install Helm"
  • GitLab managed apps are installed in the user's cluster in a pod named install-<app_name>
  • How the helm tiller pod is used by helm and that it secured by Tiller TLS which is stored in GitLab's database. How to secure the configmaps that also have the tiller tls information.
  • What each of the different errors we see doing installation of apps could mean. (See kubernetes.log). Why we cannot display errors as is from the "client" (SSRF) - details https://gitlab.com/gitlab-org/gitlab-ce/issues/55087#note_124555971
  • We use kubeclient to create new namespaces and service accounts such as gitlab and tiller. Security implications of this, e.g. it currently allows connections to the local network.
  • How we segment projects in a group cluster
  • We log Kubernetes related events to kubernetes.log. Currently only error events

Also, a getting started guide for developers on the ~Configure team (and other teams that use ~kubernetes and ~"auto devops")

Edited by Thong Kuah