errordeveloper / k9c

Cloud9+kubectl container

k9c – Cloud9+kubectl container

This repository has build script and deployment manifest for a container that has Cloud9 IDE and kubectl installed (along with other handy packages), it's intended to be used for training/workshops, as it can run as a pod in cluster so all attendees need is a browser.

Deploy it to a GKE cluster (or other provider with functional storage and external load balancers):

kubectl create namespace ide 
kubectl create namespace ide-workspace
kubectl apply -f https://raw.github.com/errordeveloper/k9c/master/manifests/ide.yaml
kubectl apply -f https://raw.github.com/errordeveloper/k9c/master/manifests/traefik.yaml

Get exteral IP:

traefik_ip="$(kubectl get svc -n kube-system traefik -o jsonpath='{.status.loadBalancer.ingress[0].ip}{"\n"}')"

Next, open http://${traefik_ip}/ in your browser and login with username:password.

Have a great Kubernetes experience with Cloud9 in your cluster!

NOTE: it's mostly for training/workshops, at present it's not very secure – use it at your own risk.

k9c's Issues

Restrict service account

Full access to a single namespace (call it workspace), read-only access to k9c namespace.

revisit RBAC rules

We need a way to create namespaces without making a sacrifice of cluster security (or find a way to do things otherwise). The most important aspect is the protection of ide, kube-system and weave namespaces, so that user doesn't accidentally delete important pieces under their own feet.

try using bare repos in a volume instead of git server

(or make flux work with GCP HTTPS-only repos)

Add load-generator tool

Sometimes we'd like to run a command like hey to generate load.

Add support for Google Cloud Source Repositories

In order to have access to GCP repos we need to install the gcloud SDK and configure git with the gcloud credentials.

Restrict pod security context

We shouldn't run as root inside the container

Ingress controller with TLS

So that we can make it more secure, and provide some routing.

• /ide => k9c:service/ide
• /app/* => k9c:service/*