yoshiat

6 ms·

1.
by yoshiat 7y ago
"This guide provides best practices to safely and efficiently set up multiple multi-tenant clusters for an enterprise organization." This "multiple" multi-tenant clusters part isn't coming through. Please do jump in
2.
by yoshiat 7y ago
Sorry if it was confusing. You need to read into more about how to set up in-cluster multi-tenancy. We do recommend robust configurations for production setup (e.g. dev, staging and production) however you can certainly squash and skip it i
3.
by yoshiat 7y ago
For secure isolation, we learned it's not sufficient. It's good for resource isolation though. PTAL at https://www.youtube.com/watch?v=6rMGRvcjvKc
4.
by yoshiat 7y ago
For robust configuration yes. However one can certainly collapse/shrink if having multiple clusters is going to be a burden cost-wise and operation-wise. This best practices was modeled based on the most robust architecture.
5.
by yoshiat 7y ago
Exactly! https://cloud.google.com/kubernetes-engine/docs/best-practic...
6.
by yoshiat 7y ago
Thanks! We actually do and shipped together with the best practices. https://github.com/GoogleCloudPlatform/gke-enterprise-mt Please give us feedback there in case you hit any issue!
7.
by yoshiat 7y ago
PTAL at doing Multi-Tenancy in GKE! https://cloud.google.com/kubernetes-engine/docs/best-practic... We don't recommend using node pools for isolation.
8.
by yoshiat 7y ago
Yes and it's going GA. https://cloud.google.com/blog/products/containers-kubernetes... https://cloud.google.com/kubernetes-engine/docs/best-practic...
9.
by yoshiat 7y ago
Nit: we don't recommend dedicated nodes for isolation. PTAL at https://www.youtube.com/watch?v=6rMGRvcjvKc And the guidance from GKE is at https://cloud.google.com/kubernetes-engine/docs/best-
10.
by yoshiat 7y ago
thockingoog's responses below articulates my feeling very well. https://news.ycombinator.com/item?id=22487726 https://news.ycombinator.com/item?id=22487110 What I can do is to lower the bar for aggrega
11.
by yoshiat 7y ago
Yes, namespace alone isn't sufficient for isolation. Would you be able to look at our latest Multi-Tenancy best practices? https://cloud.google.com/kubernetes-engine/docs/best-practic... It's a living pr
12.
by yoshiat 7y ago
Thank you for your feedback and we understand this was a surprise to you and many. For cluster per customer architecture, would you be able to look into https://cloud.google.com/kubernetes-engine/docs/best-practic.
13.
by yoshiat 7y ago
As you can see from the Borg paper [1] and the name, "borglet" is the most closest component to "kubelet". [1] https://pdos.csail.mit.edu/6.824/papers/borg.pdf
14.
by yoshiat 7y ago
That's a very old slide :) I "guess" the slide deck was talking about https://cloud.google.com/compute/docs/containers/deploying-c...
15.
by yoshiat 7y ago
Yes, exactly. https://cloud.google.com/kubernetes-engine/docs/concepts/clu...
16.
by yoshiat 7y ago
I replied in other comments but our talk at Next'19 [1] includes a story by one of our customers, which may help understand the use cases. In a nutshell, GKE Sandbox should allow sharing the resources of GKE Nodes (VMs) among multiple
17.
by yoshiat 7y ago
(Co-author of the post) The fact that gVisor is being used in multiple services at Google is probably the confusing part. In case of GKE Sandbox, the users here are external and using Cloud (specifically GKE). The target use case is to add