All tools should have a .kube/config file and a namespace created for them. This should happen automatically on new tool creation. The config file would set the path to the kube master as well as credentials to access it. This allows people to use kubectl if they want to, but primary use case will be the 'webservice' command which will read this file as well.
It should probably be only readable by the tool since there's no reason for them to modify it.
| Subject | Repo | Branch | Lines +/- | |
|---|---|---|---|---|
| tools: Provision accounts for all tools | operations/puppet | production | +385 -37 |
| Status | Subtype | Assigned | Task | ||
|---|---|---|---|---|---|
| Resolved | yuvipanda | T129309 Goal: Allow using k8s instead of GridEngine as a backend for webservices | |||
| Resolved | yuvipanda | T133999 Provision a .kube/config file for all tools | |||
| Resolved | yuvipanda | T133515 Write a k8s admission controller to enforce that all containers running come from our private repository | |||
| Resolved | yuvipanda | T133873 Use a 'pause' container from our private repo, not gcr.io |
Small python script that does the following:
In the long run, we should replace it with perhaps a CA based authentication setup, but that is a while off.
Change 296747 had a related patch set uploaded (by Yuvipanda):
tools: Provision accounts for all tools