archived the channel

can I set this flag --kernel-memcg-notification in kubelet ?

https://kops.sigs.k8s.io/instance_groups/#warmpool-aws-only is this for OD only or can we use with spot fleet ?

Hello. Can I somehow get the default containerd toml file? /etc/containerd/config-kops.toml is empty

That's a great question, also interested in the answer. Don't have any insight myself, unfortunately.

question for the audience here: curious what people are doing to pass their CIS benchmarks etc. for kops clusters. I see alot of info out there about how to run your cluster through a CIS benchmark test but less so what people are doing to fix them. I’ve wanted to avoid going down the route of packer/custom AMIs (as that’ll open up a can of other worms) but wondering if that’s the only real solution as I don’t see any easier/obvious solutions ones out there.

hi @bradym us simpsons folks seem to like our kops (esp chief wiggums)

anyone here still using kops? 😅

Adding @U010XGY9B46 bot

@UUB28NLDS help keep tabs! 😉

no, sorry, not really into kubernetes...

@loren have you deployed a cluster with kops within govcloud?

i have access.... don't use it too regularly

@loren has joined the channel

@loren are you using govcloud?

@Jeremy G (Cloud Posse) ☝️

@Andriy Knysh (Cloud Posse) can you review?

Kinda dead in here, but @Erik Osterman (Cloud Posse) and co, I've added feature gates to the kops template. hoping for a review. I didn't see any notes on contributing for docs, but happy to fix that up also: https://github.com/cloudposse/reference-architectures/pull/48

Did anyone Come across NPM memory Issues ?

Just have tested upgrading Works well

Oh, sorry, I ment kubernetes.tf :)

the terraform.tf file? ...that could be anything

I don't have enough context

Guys, if I made the manual changes in the terraform.tf file which I exported from kops, will kops upgrade procedure work properly? Or will this procedure discard my changes and apply a configuration that stored in kops?
E.g. I use one NAT gw for 3 AZ (other two NAT gws I have removed from terraform.tf manually)

Will revert the kops upgrade procedure two nat gws back? Right?

Thank you for explanation. I assumed that. Now that is not a problem.

the user will need CRUD for EC2, ELBs, EBS, EIP, S3, VPC, and at that point, they are basically admins 😃

you are giving this level of access to the person or process responsible for provisioning kops

You're not giving this level of access to kops

I would like to know how do you, guys, make this setup
Because, some time, we need to set up k8s cluster into the customer account and customer's admins are afraid 😐️ the FullAccess policies

Hi everyone!
I have the new question again 🙂
I am trying to set up k8s cluster using kops. I know that official documentation says that I should provide the user with Iam permissions

AmazonEC2FullAccess
AmazonRoute53FullAccess
AmazonS3FullAccess
IAMFullAccess
AmazonVPCFullAccess

But these permissions include FullAccess. This is very insecure.
Do you have any the minimal rule sets that exclude FullAccess?

I also...looking at KOPS configured with Public DNS but... I also wonder if thats good given that it creates records in etcd.... do you anything about this?

There's never a single best way; I guess it depends on the organization. For our use-case, we stick with the kops strategy.

But I wonder if the public ones are configured in the best way...

That what essentially KOPS does because I see some private subnets and public ones tied with Load Balancer...

technically, an ingress can be public or private. in your case, you'd want a public ingress.

so a service will sit on a private "cluster ip", and the (public) ingress will send traffic to that service.

@Fernanda Martins exactly, so best practice is to run all the masters and nodes on a private topology, but then use an Ingress to expose a service

Hello All,
I was reading Kubernetes Security Best Practices and it mentions the practice to use private topology with private VPC. Does anyone here uses a public website of sorts on top of Kops private topology?
How is that working out?

will be fun though 😄

will need some planning and testing as we several prod workloads across 3 regions

feels like a better route

since the migration of data from one cluster to another requires downtime as is

and restore

if it goes tits up then re-roll the version we have

probably better to rebuild if you can

try the update path as described in kops

honestly at this point im thinking I will build the capability to do full cluster backup and restore