1. Open Infrastructure: Integrating OpenStack and Kubernetes
Giuseppe Attardi
Department CSD, GARR
TNC19
Tallinn 18/6/2019

2. GARR Federated Cloud OpenStack IaaS Deployment as a Service (Juju)
WorkPlace
OnlyOffice Collaboration Suite
Document editing, project management
Kubernetes
Bare metal cluster (MaaS)
Package deployment (Helm)
Now the challenge is: let the one thousand GARR Cloud users, and the future ones, access both Cloud and Container platform using the same personal account.
As an additional complication, we enabled Federated authentication on GARR Cloud: users authenticate with their institutional Identity providers (members of IDEM/EduGain) or OIDC. We deprecate basic authentication via keystone username and password, which would have made things easier.
Nevertheless, we kept on with the idea to use Keystone as the external identity provider for Kubernetes, leveraging the mechanism of Webhook authentication. What we present here is a joint work between GARR and SWITCH within GEANT project GN4-2, carried on mainly by Roberto di Lallo at GARR and Saverio Proto at Switch. Roberto unfortunately left GARR so Saverio will give some more details.

3. Deployment as a Service (Juju)
Select app from catalog
Deploy on private cloud
Scale
Deploy on public cloud

4. Helm Package deployment for Kubernetes
Helm chart is a collection of YAML template files
Single command deployment
> helm install --set replicas=3 app

5. WebHook token authenticator
Kubernetes Authentication via Keystone
New GN4-2
contribution
Allows OpenStack users to access Kubernetes
Innovative solution based on Keystone Application Credentials
Code contributed to OpenStack
Extension to OpenStack dashboard
1. kubectl config
10. user, group
8. Token
4. Token
7. Token
5. Token
6. Token
9. user, group
3. Application Credential
2. kubectl exec args
kubectl
credential plugin
client-go
WebHook token authenticator
New OpenStack
feature

6. Full Instructions See article on Superuser magazine:
integrating-openstack-and-kubernetes/

7. Getting Credentials from OpenStack Dashboard
The user then goes to the dashboard, signs in, and creates an Application Credential.
You can see here the patches we applied on the dashboard: a box with the user namespace, generated from the username, and the button to download the kubeconfig.

8. Let's share solutions.
Thank you.