An operator to manage the lifecycle of public cloud providers resources needed to expose endpoints on public nodes.

The standard use case for this tool is to provision external IPs on public nodes as well as firewall rules allowing to determine access permissions on these nodes.

A Kubernetes cluster of version v1.11.3+ is required. If you are just starting out with Kubestatic, it is highly recommended to use the latest version.

To be used with AWS and interact with EC2 resources, an AWS account with the following permissions is required:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AllObjectActions",
            "Effect": "Allow",
            "Action": [
                "ec2:DescribeSecurityGroups",
                "ec2:CreateSecurityGroup",
                "ec2:DeleteSecurityGroup",
                "ec2:AuthorizeSecurityGroupIngress",
                "ec2:RevokeSecurityGroupIngress",
                "ec2:AuthorizeSecurityGroupEgress",
                "ec2:RevokeSecurityGroupEgress",
                "ec2:DescribeAddresses",
                "ec2:AllocateAddress",
                "ec2:ReleaseAddress",
                "ec2:AssociateAddress",
                "ec2:DisassociateAddress",
                "ec2:DescribeInstances",
                "ec2:ModifyInstanceAttribute",
                "ec2:DescribeNetworkInterfaces",
                "ec2:ModifyNetworkInterfaceAttribute",
                "ec2:CreateTags"
            ],
            "Resource": "*"
        }
    ]
}

Follow Kubestatic documentation for Helm deployment here.

You can create resources via the CRDs documented below or by automatically assign external IPs to your nodes.

Kubestatic acts on the following custom resource definitions (CRDs):

ExternalIP An External IP will allow you to provision and attach an external IP to a node (only AWS ElasticIP supported at the moment). ⚠️ The nodes must be deployed on a public subnet.

FirewallRule A FirewallRule will allow you to configure inbound / outbound firewall rules and attach them to your nodes (only AWS EC2 Security Groups supported at the moment).

You can find examples of CRDs defined by Kubestatic here.

Full API documentation is available here.

If you want to automatically attach an external IP to certain nodes of your cluster, simply add the following label to the nodes concerned kubestatic.quortex.io/externalip-auto-assign: true, Kubestatic will deploy an ExternalIP automatically for each of these nodes.

The kubestatic container takes as argument the parameters below.

Distributed under the Apache 2.0 License. See LICENSE for more information.

We use SemVer for versioning.

Got a question? File a GitHub issue.