Hacker News Reader

Comment by darkwater | Hacker News Reader

So yet another example of people piggybacking on the Kubernetes manifests & inner loop to define and apply resources on other APIs. I wonder when some places will start to provision dedicated k8s masters just to run their IaC loop, instead of running actual workload...

View on HN

Already happening. A control plane only cluster is an excellent replacement for Hashicorp Vault for example.

See also the Cluster API to manage other clusters and Crossplane to manage anything Terraform would have managed.

> Already happening. A control plane only cluster is an excellent replacement for Hashicorp Vault for example.

Vault? Don't you mean Terraform (Enterprise), or platforms based on TF that do that kind of thing (converging platform to its code definition, automatically).

I don't really understand why (and how) one would use K8s API server as a replacement for HC Vault.

It has RBAC, service accounts, and Secrets all with APIs. I guess you could automate provisioning storage accounts on nodes or have a system that creates tokens with the cluster key. Not sure that's really any better than not using it, though

We do that - chucked all kubernetes apis and run an apiserver with our own apis + controllers to reconcile state. It’s a bit of work to make it work bc the tooling is obviously not designed for this but you can make it happen

You mean everyone that runs a Crossplane cluster? Already happening

Could call that project "tortuga".

Tortugas hasta el final, in fact.

Reply on news.ycombinator.com