AWS Reference Platform for Kubernetes + Data Services

This repository contains a reference AWS Platform Configuration for use as a starting point in Upbound Cloud or Upbound Universal Crossplane (UXP) to build, run and operate your own internal cloud platform and offer a self-service console and API to your internal teams. It provides platform APIs to provision fully configured EKS clusters, with secure networking, and stateful cloud services (RDS) designed to securely connect to the nodes in each EKS cluster -- all composed using cloud service primitives from the Official Upbound AWS Provider. App deployments can securely connect to the infrastructure they need using secrets distributed directly to the app namespace.

Contents

• Upbound Cloud
• Build Your Own Internal Cloud Platform
• Install Tools
• Quick Start
• Platform Ops/SRE: Run your own internal cloud platform
  • App Dev/Ops: Consume the infrastructure you need using kubectl
  • APIs in this Configuration
• Customize for your Organization
• Learn More

Upbound Cloud

What if you could eliminate infrastructure bottlenecks, security pitfalls, and deliver apps faster by providing your teams with self-service APIs that encapsulate your best practices and security policies, so they can quickly provision the infrastructure they need using a custom cloud console, kubectl, or deployment pipelines and GitOps workflows -- all without writing code?

Upbound Cloud enables you to do just that, powered by the open source Upbound Universal Crossplane project.

Consistent self-service APIs can be provided across dev, staging, and production environments, making it easy for app teams to get the infrastructure they need using vetted infrastructure configurations that meet the standards of your organization.

Build Your Own Internal Cloud Platform

App teams can provision the infrastructure they need with a single YAML file alongside Deployments and Services using existing tools and workflows including tools like kubectl, Flux and ArgoCD to consume your platform's self-service APIs.

The Platform Configuration defines the self-service APIs and classes-of-service for each API:

• CompositeResourceDefinitions (XRDs) define the platform's self-service APIs - e.g. XPostgreSQLInstance.
• Compositions offer the classes-of-service supported for each self-service API - e.g. Standard, Performance, Replicated.

Crossplane Providers include the cloud service primitives (AWS, Azure, GCP, Alibaba) used in a Composition.

Learn more about Composition in the Crossplane Docs.

Pre-Requisite & Optional Tools

Install the following command line tools:

• up cli

  There are multiple ways to install up, including Homebrew and Linux packages.

  curl -sL https://cli.upbound.io | sh
  

• kubectl crossplane extension (optional)

  curl -sL https://raw.githubusercontent.com/crossplane/crossplane/master/install.sh | sh
  cp kubectl-crossplane /usr/local/bin

Quick Start

Platform Ops/SRE: Run your own internal cloud platform

There are two ways to run Universal Crossplane:

1. Hosted on Upbound Cloud
2. Self-hosted on any Kubernetes cluster

To provision the AWS Reference platform, you can pick the option that is best for you.

We'll go through each option in the next sections.

Upbound Cloud Hosted UXP Control Plane

Hosted Control planes are run on Upbound's cloud infrastructure and provide a restricted Kubernetes API endpoint that can be accessed via kubectl or CI/CD systems.

Create a free account in Upbound Cloud

1. Sign up for Upbound Cloud.
2. When you first create an Upbound Account, you can create an Organization

Create a Hosted UXP Control Plane in Upbound Cloud

1. In your browser, Create a Control Plane in Upbound Cloud (e.g. dev, staging, or prod)
2. Connect kubectl to your Control Plane instance.
   • Click on your Control Plane
   • Select the Connect Using CLI
   • Login to upbound using up cli: up login
   • Paste the commands to configure your local kubectl context
   • Test your connectivity by running kubectl get pods -n upbound-system

Installing UXP on a Kubernetes Cluster

The other option is installing UXP into a Kubernetes cluster you manage using up, which is the official CLI for interacting with Upbound Cloud and Universal Crossplane (UXP).

Ensure that your kubectl context is pointing to the correct cluster:

kubectl config current-context

Install UXP into the upbound-system namespace:

up login
up uxp install

Validate the install using the following command:

kubectl get all -n upbound-system

Install the Platform Configuration

Now that your kubectl context is configured to connect to a UXP Control Plane, we can install this reference platform as a Crossplane package.

# Check the latest version available in https://marketplace.upbound.io/configurations/upbound/platform-ref-aws/
kubectl apply -f examples/configuration.yaml
kubectl get pkg

Configure Providers in your Platform

Refer to official marketplace documentation

Provision Resources

With the setup complete, we can now use platform-aws to provision resources in AWS.

Create EKS Cluster

The example cluster composition create an EKS cluster and includes a nested composite resource for the network, which creates a VPC, Subnet, Route Tables and a Gateway.

kubectl apply -f examples/cluster-claim.yaml

Verify status:

kubectl get claim
kubectl get composite
kubectl get managed

Provision a PostgreSQLInstance in your team Control Plane GUI console

1. Browse the available self-service APIs (XRDs) Control Plane
2. Provision a CompositePostgreSQLInstance using the custom generated GUI for your Platform Configuration
3. View status / details in your Control Plane GUI console

Connect kubectl to your team Control Plane

1. Connect kubectl to a Control Plane from the self-service GUI console.

Provision a PostgreSQLInstance using kubectl

kubectl apply -f examples/postgres-claim.yaml

Verify status:

kubectl get claim
kubectl get composite
kubectl get managed

Cleanup & Uninstall

Cleanup Resources

Delete resources created through the Control Plane Configurations menu:

• From the Teams GUI using the ellipsis menu in the resource view.
• Using kubectl delete -n team1 <claim-name>.

Delete resources created using kubectl:

kubectl delete -f examples/cluster-claim.yaml
kubectl delete -f examples/postgres-claim.yaml

Verify all underlying resources have been cleanly deleted:

kubectl get managed

Uninstall Provider & Platform Configuration

kubectl delete configurations.pkg.crossplane.io platform-ref-aws
kubectl delete providers.pkg.crossplane.io provider-aws
kubectl delete providers.pkg.crossplane.io provider-helm

Uninstall Crossplane kubectl plugin

rm /usr/local/bin/kubectl-crossplane*

APIs in this Configuration

• Cluster - provision a fully configured EKS cluster
  • definition.yaml
  • composition.yaml includes (transitively):
    • XEKS for EKS Cluster
    • XNetwork for network fabric
    • XServices for Prometheus and other cluster services
• XEKS Creates EKS cluster.
  • definition.yaml
  • composition.yaml includes:
  • EKSCluster
  • XNetwork for network fabric
  • NodeGroup
  • Role
  • RolePolicyAttachment
  • OpenIDConnectProvider
  • HelmReleases for Prometheus and other cluster services.
• XNetwork - fabric for a Cluster to securely connect to Data Services and the Internet.
  • definition.yaml
  • composition.yaml includes:
    • VPC
    • Subnet
    • InternetGateway
    • RouteTable
    • SecurityGroup
• PostgreSQLInstance - provision a PostgreSQL RDS instance that securely connects to a Cluster
  • definition.yaml
  • composition.yaml includes:
    • RDSInstance
    • DBSubnetGroup

Customize for your Organization

Create a Repository called platform-ref-aws in your Upbound Cloud Organization:

Set these to match your settings:

UPBOUND_ORG=acme
UPBOUND_ACCOUNT_EMAIL=me@acme.io
REPO=platform-ref-aws
VERSION_TAG=v0.3.0
REGISTRY=xpkg.upbound.io
PLATFORM_CONFIG=${REGISTRY:+$REGISTRY/}${UPBOUND_ORG}/${REPO}:${VERSION_TAG}

Clone the GitHub repo.

git clone https://github.com/upbound/platform-ref-aws.git
cd platform-ref-aws

Login to your container registry.

docker login ${REGISTRY} -u ${UPBOUND_ACCOUNT_EMAIL}

Build package.

up xpkg build --name package.xpkg --package-root=package --examples-root="examples"

Push package to registry.

up xpkg push ${PLATFORM_CONFIG} -f package.xpkg

Install package into an Upbound Control Plane instance.

kubectl crossplane install configuration ${PLATFORM_CONFIG}

The AWS cloud service primitives that can be used in a Composition today are listed in the Crossplane AWS Provider Docs.

To learn more see Configuration Packages.

What's Next

If you're interested in building your own reference platform for your company, we'd love to hear from you and chat. You can setup some time with us at info@upbound.io.

For Crossplane questions, drop by slack.crossplane.io, and say hi!