SpringOne Platform 2019 Title: More Devs, No Problems: Enabling Self-Service Access to Kubernetes Speaker: Fabio Yeon, Sr. Staff Engineer, VMware Youtube: https://youtu.be/ca6LEtZm3YU

1. More Devs, No Problems:
Enabling Self-Service Access to Kubernetes
Fabio Yeon
Sr. Staff Engineer
VMware
October 8, 2019
Austin Convention Center

2. Unless otherwise indicated, these slides are © 2013-2019 Pivotal Software, Inc. and licensed under a Creative Commons Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
2
Kubernetes: The enterprise dream
Rapid innovation
through software
Multi-cloud operations
Improved resource
utilization

3. Unless otherwise indicated, these slides are © 2013-2019 Pivotal Software, Inc. and licensed under a Creative Commons Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
3
Practical adoption in orgs
? ?
People
structure
Infrastructure
(clusters)
CIO CSO Ops Dev

4. Unless otherwise indicated, these slides are © 2013-2019 Pivotal Software, Inc. and licensed under a Creative Commons Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
4
Possible end state
? ?
People
structure
CIO CSO Ops Dev
Infrastructure
(clusters)

5. Unless otherwise indicated, these slides are © 2013-2019 Pivotal Software, Inc. and licensed under a Creative Commons Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
5
Kubernetes: The enterprise reality
Fragmentation across teams
Visibility & security challenges
Cost reporting and control
Developers
Clusters

6. Unless otherwise indicated, these slides are © 2013-2019 Pivotal Software, Inc. and licensed under a Creative Commons Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
6
Challenge: Managing disparate Kubernetes clusters
Separate security domains
RBAC managed separately by
cluster
Individual clusters need upgrades,
monitoring, and backups
Security polices applied
individually per cluster
Enabling cross cluster traffic is
manual
Developers can request large
resources and leave them running,
driving $$$
Security
IAM $$
VMware
vSphere
Security
IAM $$$
Amazon Web
Services
Security
IAM $$
Microsoft
Azure
Security
IAM $$$
Google Kubernetes
Engine
Security
IAM $$$
Amazon Web
Services

7. Unless otherwise indicated, these slides are © 2013-2019 Pivotal Software, Inc. and licensed under a Creative Commons Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
7
Our solution: Tanzu Mission Control
Manage
Many clouds
Many clusters
Many teams
Introducing
Tanzu Mission Control
Single control point for teams to manage Kubernetes and operate modern apps

8. Unless otherwise indicated, these slides are © 2013-2019 Pivotal Software, Inc. and licensed under a Creative Commons Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
8
Manage a fleet of cluster resources
Map enterprise identity to Kubernetes
RBAC across clusters
Define policies once and push them
across clusters
Manage cluster lifecycle consistently,
and schedule cluster backups
Unified views of cluster metrics,
logs, data
Automated policy-controlled cross
cluster traffic
Monitor costs across clustersGoogle
Kubernetes
Engine
VMware
vSphere
Microsoft
Azure
Amazon Web
Services
Amazon Web
Services
Tanzu Mission Control
Unified [IAM, Lifecycle, Policy, Operational Visibility, Compliance]
SecurityIAM $$$

9. Unless otherwise indicated, these slides are © 2013-2019 Pivotal Software, Inc. and licensed under a Creative Commons Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
9
Declarative, application-centric policy model
Access policy for namespaces
Configuration
Backup policy
Services policy
Quota policy
Workspace Policies
Cluster Quota Policies
Access Management
Cluster configuration
Backup Policy
Pod Security Policy
Cluster Policies
Platform
Engineers
SREs
VMware Tanzu Mission Control
Cluster
Namespaces
Cluster
Namespaces
Cluster
Namespaces
ns
ns
ns
Cluster Groups
Workspaces

10. Unless otherwise indicated, these slides are © 2013-2019 Pivotal Software, Inc. and licensed under a Creative Commons Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
10
Workspace:
Acme Fitness dev-
staging
azure-dev-cluster-01 development-cluster-2 Enterprise-pks-dev development-cluster-0
payments-
frontend
ns ns ns ns ns ns ns ns
payments-
frontend
payments-
frontend
payments-
frontend
acme-
fitness
acme-
fitness
acme-
fitness
acme-
fitness
One step, multiple clouds, declarative approach

11. Unless otherwise indicated, these slides are © 2013-2019 Pivotal Software, Inc. and licensed under a Creative Commons Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
11
Group namespaces
across clusters to a
Workspace
Define namespace
policy at the Workspace
Policies gets pushed
to each namespace
across multiple clusters
How Tanzu Mission Control applies policies across clusters
Mission Control
Workspace:
WebApplication
Operators
Add Policy to
Workspace

12. Unless otherwise indicated, these slides are © 2013-2019 Pivotal Software, Inc. and licensed under a Creative Commons Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
12
Configuration
Quota
Security
VMware Tanzu Mission Control policy types
Access
Secure your
clusters
Maintain
control

13. Unless otherwise indicated, these slides are © 2013-2019 Pivotal Software, Inc. and licensed under a Creative Commons Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
13
Unified access management across clusters
Cluster
Namespaces
Cluster
Namespaces
Cluster
Namespaces
ns
ns
ns
Import
Users /
Groups
Auth
Token
Kubectl
Operations/IT
WorkspacesCluster Groups
Mission Control
Organization
Development Teams
Identity
Cloud.vmware.com
Active Directory
1
Define
Access
Policies
2

14. Unless otherwise indicated, these slides are © 2013-2019 Pivotal Software, Inc. and licensed under a Creative Commons Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
14
Demo: VMware Tanzu Mission Control
Place
screenshot
here

15. Unless otherwise indicated, these slides are © 2013-2019 Pivotal Software, Inc. and licensed under a Creative Commons Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
15
Connecting people structure to infrastructure
VMware Tanzu Mission Control
Tanzu
Mission
Control
Connecting people
structure and
infrastructure
People
structure
Infrastructure
(clusters)
CIO CSO Ops Dev

16. Stay Connected.
https://k8s.vmware.com/tanzu-mission-control/
yeonf@vmware.com
#springone@s1p