K8s-config-connector: KCC as a managed service

[Scorpiion]

Hi,

I'm not sure if this is the best place to write this, but I would like to put in a vote for Google offering KCC as a managed service. I really like KCC, but I do get some push back from collages and customers about the fact that we need to manage a cluster dedicated for KCC* (the recent price change for GKE does not help).

Compared to for example Google's deployment manager or Terraform Cloud, both have their own type of managed services. It would be a lot easier for me to "sell" KCC to collages and customers if there were a hosted version.

If you who read this as a KCC user and also would like KCC as a managed service, please add a :+1: so maintainers get feel for potential interest.

_*We are implementing KCC where it have access to multiple folders and projects. It has it's own root folder that it owns), and in that setup it feels best to have KCC in it's own project+cluster for security reasons. We have one KCC cluster for dev and one KCC cluster for prod (different orgs) and each of them controls two kubernetes clusters for actual apps etc._

[Jonpez2]

I would also love that

[spew]

Thanks for the excellent feature request and writeup. Please do thumbs up this post if you are reading it and desire such a service.

[Scorpiion]

KCC as a service feature

It would be nice to see any potential errors collected in one place. There is a disconnect now from when you run kubectl apply to when you see any potential errors. A pattern I keep using is to run kubectl get on the resource, checking the logs might also work but they are not as readable and keeps being streamed. Another use case is if kubectl apply is being run from a git driven CI/CD pipeline.

In a KCC as a service I would have liked to see error messages collected into a single place.

[xiaobaitusi]

Hi @Scorpiion,

Are you describing a UI feature where you can see the status of resources that managed by KCC? Just in case that you are not aware, we have all KCC resource CRDs grouped as 'gcp' category, kubectl get gcp -oyaml -n [NAMESPACE] will return all KCC resources.

[davinkevin]

You also can run KCC with a service account in a K3S instance where you want... this is how we setup the first cluster in some case.

BTW, KCC as a service is gcloud api from command line or deployment manager from my point of view.

[Scorpiion]

Hi @xiaobaitusi, in general I'm not talking about only a "UI feature", I'm talking about KCC as a managed service, similar to Cloud SQL and similar managed services. Regarding status, I was referring to the fact that KCC works on an asynchronous model, you apply an update and you don't know until in the future if you will get any errors, you don't know if it's one second away or 2 minutes etc. As I described above I currently run kubectl get to check updated resources, but it's quite manual and not the best UX, I can get any information I need, but it's not seamless and it's hard to explain/sell to people who are used to UI interfaces. We use KCC across multiple folders/projects and use different namespaces or each project, we have a dedicated KCC cluster only for KCC. Dumping all KCC related yaml does not solve the UX problem I described, you still need to find the relevant ones and see if there are any errors. What would be nice is if I can just open a window and see that there has been an issue, in the same way that the GKE UI can show a red icon on a workload that is not being scheduled because lack of resources. While not perfect from an UI point of view I think a lot of the GKE UI could be reused for a KCC UI and it might solve 80% of use cases.

Hi @davinkevin, I have also thought about using K3S, nice to hear that someone have tested it and that it works, cool! With that said, you still need to maintain that VM(s) where K3S is running, and K3S itself. In many organizations getting someone to maintain yet another service, without them personally getting anything out of it, is not always an easy sell, managed services are not the best fit for everyone but for many companies it's the best option because good labor is expensive and hard to find and retain.

I get your point that KCC as a service is somewhat similar gcloud api from the command line or deployment manager, but it's not quite the same. At a very high level KCC and deployment manager does the same thing, yes, that does not mean that they are completely interchangeable? It's a bit like saying that Google has MySQL as a managed service, why would anyone need PostgreSQL?

[tonybenchsci]

@Scorpiion "currently run kubectl get to check updated resources, but it's quite manual and not the best UX" , we have found it pretty useful to use the "Object Browser" in GKE. It's the closest thing to the DM deployments page.

[captain-kark]

Being able to install it when creating a cluster would be an acceptable compromise, similar to how istio CRDs can be today.

If that were the case, having the option to only import certain CRDs would be a nice addition. Granting role/editor or role/owner to a service account is always a tough sell. Creating a single node in a new GKE cluster with an IAM account limited to just the resources requested would all fit on a couple of (or even one) g1-small instances. Any anthos-like multi-cluster setup that includes config management would be outside this scope, I'm specifically referring to a simple 1:1 relationship between the current GKE cluster, and the project it was created under.

[Scorpiion]

I can see that there is a (relatively) new KCC add-on for GKE, relevant for this issue I think. I thought it was worth mentioning here for those interested. I have not tried it out yet but I will look into migrating my existing installation automation to use the KCC add-on instead.

I have a feeling that this is the closest to "KCC as a managed service" we will come, so I will close this issue now and hope that the KCC add-on will be continually developed and become GA soon.

[captain-kark]

Do you have a link to this new KCC add-on for GKE?

[spew]

Hello, @Scorpiion we do intend to offer more managed options but cannot communicate any timelines at this time.

[spew]

Hello @captain-kark you can take a look at the Add-on tab in the install instructions: https://cloud.google.com/config-connector/docs/how-to/install-upgrade-uninstall

[Scorpiion]

Hi @spew, thanks for the extra information, sounds interesting and I hope to learn more in the future! Do you think it would be valuable to keep this issue open @spew or is it good to have it closed? Feel free to reopen if you find it useful as a reference during your continued work on these future managed offerings.

I was going to link to the same page, worth noting that the add-on is also available in the UI when creating new clusters.