49 lines
1.9 KiB
Org Mode
49 lines
1.9 KiB
Org Mode
#+TITLE: Service Demon
|
|
#+AUTHOR: Adam Mohammed
|
|
|
|
|
|
Service Demon is a centralized configuration provider for Nautilus services.
|
|
|
|
This provides a way to do k8s native application deployment in a way that's simple
|
|
and requires almost no configuration on the client.
|
|
|
|
|
|
Service Demon runs in k8s and expects a service agent to be deployed alongside
|
|
your application.
|
|
|
|
|
|
** Workflow
|
|
|
|
This demon (playing off of "daemon") hosts an application registration process that,
|
|
the our agent is aware of. By simply deploying the agent in your namespace, it will kick off
|
|
the application registration process. On completion, the agent is able to respond to commands
|
|
from the configuration service to update k8s resources that your application can rely on.
|
|
|
|
|
|
The agent on deploy, will use TLS certificates generated for your applications ingress to
|
|
announce itself as an application that wishes to be registered.
|
|
|
|
Once the app announces that it would like to be registered, an authorized human must approve
|
|
the application.
|
|
|
|
Once the approval goes through, the application is registered, and can start to request application
|
|
configuration manifests.
|
|
|
|
The agent will fetch the manifests it needs and store them by talking to the k8s api. It will create
|
|
configuration maps, secrets, and other resources as necessary.
|
|
|
|
|
|
From there a client library loaded into your application will know how to read those manifests
|
|
and provide some baseline functionality to your service.
|
|
|
|
|
|
** Motivation
|
|
|
|
Although microservices are autonomous, they rely on common infrastructure to
|
|
reduce the operational overhead on the team maintaining them. Right now,
|
|
Nautilus has trouble performing authentication and authorization checks,
|
|
particularly between services.
|
|
|
|
By using a central configuration store, we can deploy and manage authorization policies
|
|
centrally, and push them down to the active services, so we can control authorization at runtime.
|