Project Lightning Talk: Let’s Deploy etcd Operator - Arka Saha, Maintainer

In this talk, Orko Shaha from Broadcom introduces the etcd operator, emphasizing its necessity in managing etcd clusters. He explains how previous attempts to address this issue lacked community support, leading to the revival of the etcd operator project. The speaker details the features of the operator, including authentication, scaling, and upgrade capabilities, noting that the latest release added certificate support for production environments. He demonstrates how to deploy the etcd operator using Docker, discusses the configuration of bare minimum cluster objects, and explains the importance of secure communication using TLS certificates. Orko also highlights the integration of cert-manager for production environments, ensuring that certificates are correctly issued and mounted to member pods.

Hi everyone. I'm Orko Shaha from Broadcom, software engineer, and I'm also a reviewer in the etcd operator project. So, let's look at uh what etcd operator is and why do we actually need it? So, initially when people started using etcd clusters, there was a problem that nobody started solving as a community was that basically managing those etcd clusters. Like there are many things that we will need

to do to manage the etcd clusters and nobody was addressing it. Although we do did have one project in the CoreOS uh organization, but that wasn't completely followed through and all the users building their own operators to address those problems. So, this have having the etcd operator again as a revival project is basically to address that we will have one community supported and uh native uh operator

which will basically address all these pain points that we have with authentication, scaling up, and upgrades. And this will be starting off as more to support your workload applications that runs on Kubernetes than the Kubernetes itself. So, we do have two releases. The latest one being 0.2 which was released last week which added the certificate support for uh helping the operator to be used in production environments.

Although it's not production ready at this moment because we will have uh other releases like uh which will include recovery, uh backup, as well as the helm chart release. But, yeah, they can like users can start uh playing around with it. So, uh let's quickly jump into the demo of how uh like we we can start uh using the etcd operator. So, the official image that we

have the latest one is 0.2, but if you want to do a local development on your kind list here, you can just clone the repo, do a docker build, make a docker install, and deploy. If just want to try it out, you can just deploy with the official image that we have. And you will see the etcd operator controller pod coming up as well as the CRD

etcd clusters installed. Uh so, let's look at how the cluster etcd cluster object looks like. So, this is this is like a typical bare minimum cluster object which has the version defined of which etcd version you want and what is the size of it. So, scaling out will basically mean that we're adding more and more members to it. So, we have mentioned the size seven. So, as

we can see, uh it keeps adding members until it has reached the size. Similarly, we have the function of in, which is basically Yeah, if we have the seven member cluster like in the previous situation, we can scale it down to three members and that we can actually do an edit on the object and it will reconcile. So, the next part is basically for your dev environment.

If you want your members to communicate and have a secure communication through certificate, this is an inbuilt certificate mechanism that etcd also uses by default and that is what we have implemented here for the operator as well. This is not recommended for production environments, but in case you want to keep your kind cluster light and don't want to install cert manager or any other things. This is

a default one that you can use. So, what we have is the TLS section with where you can provide the auto certificate. The provider is auto and you can set the validation, you can set the name, and as you can see, the corresponding um TLS certificate secrets will be created and one by one as the member comes up it will be mounted to those member pods. And

then finally we have the cert manager. So if you wanted for your production environment the default way of adopting is using the cert manager which many users might already have. So again in the TLS section we say that the provider cert provider is the cert manager and we also mention the name as well as the validity of the certificate. Two new things that we need to propagate

is basically the cluster issuer and like the issuer and what kind of issuer it is. So for cert manager what it happens is that there has to be an issuer which will issue the certificate. So it can be anything. It might be something that is already existing in the cluster. We can we just need to pass the name and the type and that will actually bring up.

So as we can see in the demo we gif that yes the certificate manager creates the certificates as well as the link to it and it will mount to the And that's it for the LCD operator demo and if you have more questions we have a maintenance summit coming up tomorrow. So yep, thank you. All right, thanks there.