Compliance Oriented Kubernetes Setup for AWS, Google Cloud and Microsoft Azure.

Kubespot is an open source terraform module that attempts to create a complete compliance-oriented Kubernetes setup on AWS, Google Cloud and Azure. These add additional security such as additional system logs, file system monitoring, hard disk encryption and access control. Further, we setup the managed Redis and SQL on each of the Cloud providers with limited access to the Kubernetes cluster so things are further locked down. All of this should lead to setting up a HIPAA / PCI / SOC2 being made straightforward and repeatable.

This covers how we setup your infrastructure on AWS, Google Cloud and Azure. These are the three Cloud Providers that we currently support to run Kubernetes. Further, we use the managed service provided by each of the Cloud Providers. This document covers everything related to how infrastructure is setup within each Cloud, how we create an isolated environment for Compliance and the commonalities between them.

Tools & Setup

brew install kubectl kubernetes-helm google-cloud-sdk terraform

Keys

How to get key for cluster creation (client id and secret)

1. Sign in to Azure portal
2. Navigate to the Azure Active Directory
3. Select "App registrations"
4. If there is application already use existing one or create new one as follows
5. Click on the "New registration" button to create a new application registration
6. select the appropriate supported account type (e.g., "Accounts in this organizational directory only")
7. Click on the "Register" button to create the application.
8. After application is created, Under "Certificates & secrets," click on the "New client secret" button to create a new client secret.
9. Copy the client id and client secret and pass it to cluster creation opszero module

Deployment

terraform init
terraform plan
terraform apply -auto-approve

Teardown

terraform destroy -auto-approve

Providers

Inputs

[
  "null"
]

object({
    name                   = string
    vm_size                = string
    os_disk_type           = string
    os_disk_size_gb        = number
    auto_scaling_enabled   = bool
    node_public_ip_enabled = bool
    count                  = number
    min_count              = number
    max_count              = number
    max_pods               = number
    type                   = string
  })

{
  "ManagedBy": "OpsZero",
  "Repositories": "https://github.com/opszero/terraform-azurerm-kubespot"
}

map(list(object({
    name = string
    service_delegation = list(object({
      name    = string
      actions = list(string)
    }))
  })))

object({
    username = string,
    ssh_key  = string
  })

list(object({
    name                   = string
    vm_size                = string
    os_type                = string
    os_disk_type           = string
    os_disk_size_gb        = number
    auto_scaling_enabled   = bool
    node_count             = number
    min_count              = number
    max_count              = number
    max_pods               = number
    node_public_ip_enabled = bool
    mode                   = string
    orchestrator_version   = string
    node_taints            = list(string)
    host_group_id          = string
    #    capacity_reservation_group_id = string
    #    workload_runtime              = string
    #    zones                         = list(string)
  }))

list(object({
    name                   = string
    address_prefix         = string
    next_hop_type          = string
    next_hop_in_ip_address = string
  }))

object({
    create = optional(string, "30m")
    read   = optional(string, "5m")
    update = optional(string, "30m")
    delete = optional(string, "30m")
  })

Resources

Outputs

🚀 Built by opsZero!

opsZero provides software and consulting for DevOps. With our decade plus of experience scaling some of the world’s most innovative companies we have developed deep expertise in Kubernetes, DevOps, FinOps, and Compliance.

Our software and consulting solutions enable organizations to:

• migrate workloads to the Cloud
• setup compliance frameworks including SOC2, HIPAA, PCI-DSS, ITAR, FedRamp, CMMC, and more.
• FinOps solutions to reduce the cost of running Cloud workloads
• Kubernetes optimized for web scale and AI workloads
• finding underutilized Cloud resources
• setting up custom AI training and delivery
• building data integrations and scrapers
• modernizing onto modern ARM based processors

We do this with a high-touch support model where you:

• Get access to us on Slack, Microsoft Teams or Email
• Get 24/7 coverage of your infrastructure
• Get an accelerated migration to Kubernetes

Please schedule a call if you need support.