More Related Content Similar to Running Kubernetes Across Multiple AWS Accounts (CON409) - AWS re:Invent 2018 (20) More from Amazon Web Services (20) Running Kubernetes Across Multiple AWS Accounts (CON409) - AWS re:Invent 20182. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Running Kubernetes Across
Multiple AWS Accounts
Bryce Carman
Sr. Software Dev Engineer
Amazon EKS
C O N 4 0 9
3. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Agenda
Kubernetes on Amazon Web Services (AWS)
Node Lifecycle
Amazon Elastic Container Service for
Kubernetes (Amazon EKS) Architecture
4. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
5. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Kubernetes on AWS
Kubernetes
Control Plane
Worker Nodes
VPC
kubectl
Kubelet
6. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Pod to Kubernetes
Kubernetes
Control Plane
VPC
Worker Node
Pod
7. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
User to Pod
Kubernetes
Control Plane
VPC
kubectl
Kubelet
Pod 2Pod 1
8. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
9. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Node Lifecycle
Cluster Discovery
How are the Control Plane and the Node able to securely communicate?
TLS Bootstrap
Secure Kubelet API
Node AWS Identity and Access Management (IAM) Authentication
10. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Node Cluster Discovery
Kubernetes
Control Plane
Worker Nodes
VPC
Kubelet
11. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
IAM Authentication
K8s Control Plane
STS
get-caller-
identity
Kubectl/kubelet
Kubectl/kubelet
12. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Secure Kubelet API
Kubernetes
Control Plane
VPC
kubectl
Kubelet
Pod 2Pod 1
13. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
14. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Kubernetes on Amazon EKS
Worker Nodes
VPC
kubectl
VPC
15. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Kubernetes
Control Plane
Split VPC Kubernetes
Worker Nodes
VPC
kubectl
VPC
Elastic
network
interface
16. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Availability zone
Cross VPC Availability Zones
VPC
kubectl
VPC
Availability zone
Worker Node
Kubernetes
Control Plane
Kubernetes
Control Plane
Elastic
network
interface
Elastic
network
interface
17. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Kubernetes Best Practices
Treat your Kubernetes Control Plane as a service
Know how data flows in the cluster
Secure Kubelet API!
18. Thank you!
© 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Bryce Carman
brycecar@amazon.com
19. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.