Rafay Kubernetes Management Cloud on AWS

Partner Solution Deployment Guide

QS

January 2021
Kutumba Manne, Rafay Systems
Janine Singh, AWS IoT Partner team
Troy Ameigh and Jay McConnell, AWS Integration & Automation team

Refer to the GitHub repository to view source files, report bugs, submit feature ideas, and post feedback about this Partner Solution. To comment on the documentation, refer to Feedback.

This Partner Solution was created by Rafay Systems in collaboration with Amazon Web Services (AWS). Partner Solutions are automated reference deployments that help people deploy popular technologies on AWS according to AWS best practices. If you’re unfamiliar with AWS Partner Solutions, refer to the AWS Partner Solution General Information Guide.

Overview

This guide covers the information you need to deploy the Rafay Kubernetes Management Cloud Partner Solution in the AWS Cloud.

Costs and licenses

Using this Partner Solution in a production environment requires a KMC license. To acquire a license create a Rafay account.

Architecture

Deploying this Partner Solution with default parameters builds the following Rafay KMC environment in the AWS Cloud.

Architecture
Figure 1. Partner Solution architecture for Rafay KMC on AWS

As shown in Figure 1, this Partner Solution sets up the following:

  • A highly available architecture that spans three Availability Zones.*

  • A VPC configured with public and private subnets, according to AWS best practices, to provide you with your own virtual network on AWS.*

  • In the public subnets:

    • Managed network address translation (NAT) gateways to allow outbound internet access for resources in the private subnets.*

    • Linux bastion hosts in an Auto Scaling group to allow inbound Secure Shell (SSH) access to Amazon EC2 instances in the private subnets. To manage the cluster, the bastion hosts are configured with the Kubernetes Kubectl command line interface.

  • In the private subnets, Kubernetes worker nodes that automatically set up the Rafay Operator software, which connects to the Rafay Kubernetes Management Cloud.

  • Amazon Elastic Kubernetes Service (Amazon EKS), which creates the Kubernetes control plane.

* The template that deploys this Partner Solution into an existing VPC skips the components marked by asterisks and prompts you for your existing VPC configuration.

Deployment options

This Partner Solution provides the following deployment options:

This Partner Solution provides separate templates for these options. It also lets you configure Classless Inter-Domain Routing (CIDR) blocks, instance types, and Rafay KMC settings.

Deployment steps

  1. Sign in to your AWS account, and launch this Partner Solution, as described under Deployment options. The AWS CloudFormation console opens with a prepopulated template.

  2. Choose the correct AWS Region, and then choose Next.

  3. On the Create stack page, keep the default setting for the template URL, and then choose Next.

  4. On the Specify stack details page, change the stack name if needed. Review the parameters for the template. Provide values for the parameters that require input. For all other parameters, review the default settings and customize them as necessary. When you finish reviewing and customizing the parameters, choose Next.

    Unless you’re customizing the Partner Solution templates or are instructed otherwise in this guide’s Predeployment section, don’t change the default settings for the following parameters: QSS3BucketName, QSS3BucketRegion, and QSS3KeyPrefix. Changing the values of these parameters will modify code references that point to the Amazon Simple Storage Service (Amazon S3) bucket name and key prefix. For more information, refer to the AWS Partner Solutions Contributor’s Guide.

  5. On the Configure stack options page, you can specify tags (key-value pairs) for resources in your stack and set advanced options. When you finish, choose Next.

  6. On the Review page, review and confirm the template settings. Under Capabilities, select all of the check boxes to acknowledge that the template creates AWS Identity and Access Management (IAM) resources that might require the ability to automatically expand macros.

  7. Choose Create stack. The stack takes about 45–60 minutes to deploy.

  8. Monitor the stack’s status, and when the status is CREATE_COMPLETE, the Rafay Kubernetes Management Cloud deployment is ready.

  9. To view the created resources, choose the Outputs tab.

Postdeployment steps

Test the deployment

  1. After signing up for a Rafay account, check for an email message from Rafay Systems. Log in to the Rafay console using the user name, password, and link to the Rafay console you receive.

  2. In the Rafay console, select Infrastructure, Clusters to access details about the newly imported cluster. Refer to Figure 2 for an example of imported cluster information in the Rafay console.

testing deployment
Figure 2. Imported cluster information in the Rafay console

Best practices for using Rafay KMC on AWS

For more information, refer to Rafay Product Documentation.

Security

The following are important considerations related to the Rafay Systems KMC:

  • Roles-based access control and AWS Identity and Access Management (IAM).

  • You can automate the provisioning and lifecycle management of Amazon EKS clusters in all supported AWS Regions.

  • With automated provisioning, you can deploy a cluster in moments. In order to do this, you must provide credentials that allow programmatic access to AWS services.

  • Two types of credentials are supported: IAM role and IAM user. For more information about how to create and configure KMC credentials, refer to Rafay Product Documentation.

Email allow listing

A third-party service is used for emails sent by Rafay KMC (for example, for first-time user activation, password resets, and notifications). If users in your organization are not receiving these emails, we recommend allow listing the sender’s IP. The dedicated IP address used for sending emails by KMC is 149.72.39.92.

Network firewall rules

The Rafay controller is designed for customers to deploy and manage clusters in both public and on-premises environments. To onboard an on-premises or cloud-based cluster for ongoing operations and lifecycle management, ensure the following:

  • A Kubernetes operator is installed on each managed cluster. This establishes and maintains an outbound TLS-based control channel for the Rafay controller, which is hosted on AWS for SaaS.

  • No inbound ports should be open on the customer’s external firewall for Rafay control-plane traffic.

The Rafay Kubernetes operator uses only TCP Port 443, Outbound to communicate with the Rafay controller.

Controller details

For greater control over IP connectivity between EKS clusters and KMC, customers can add relevant IP addresses and fully qualified domain names to their firewalls or security groups. This helps to ensure that outbound connectivity is allowed only for specified IPs. For more information, refer to RaFay Product Documentation.

Additional resources

Troubleshooting

For troubleshooting common Partner Solution issues, refer to the AWS Partner Solution General Information Guide and Troubleshooting CloudFormation.

Customer responsibility

After you deploy a Partner Solution, confirm that your resources and services are updated and configured—including any required patches—to meet your security and other needs. For more information, refer to the Shared Responsibility Model.

Feedback

To submit feature ideas and report bugs, use the Issues section of the GitHub repository for this Partner Solution. To submit code, refer to the Partner Solution Contributor’s Guide. To submit feedback on this deployment guide, use the following GitHub links:

Notices

This document is provided for informational purposes only. It represents current AWS product offerings and practices as of the date of issue of this document, which are subject to change without notice. Customers are responsible for making their own independent assessment of the information in this document and any use of AWS products or services, each of which is provided "as is" without warranty of any kind, whether expressed or implied. This document does not create any warranties, representations, contractual commitments, conditions, or assurances from AWS, its affiliates, suppliers, or licensors. The responsibilities and liabilities of AWS to its customers are controlled by AWS agreements, and this document is not part of, nor does it modify, any agreement between AWS and its customers.

The software included with this paper is licensed under the Apache License, version 2.0 (the "License"). You may not use this file except in compliance with the License. A copy of the License is located at https://aws.amazon.com/apache2.0/ or in the accompanying "license" file. This code is distributed on an "as is" basis, without warranties or conditions of any kind, either expressed or implied. Refer to the License for specific language governing permissions and limitations.