Node automation

As we have worked on making Amazon Machine Images (AMIs) with Packer, we have seen what kind of thing we can do with pre-baked instance images, but their true power is only fully harnessed when the whole infrastructure is comprised of them. If your orchestration management nodes and worker nodes have their own system images, with a couple of startup scripts also baked-in though the init system (for example, systemd startup services), you can make instances launched with those images auto-join your cluster during boot in their predefined roles. Taking this further to a conceptual level, if we extract all stateful configuration into the image configurations and all dynamic configurations into a separate service accessible to all nodes such as EC2 user-data or HashiCorp Vault, your cluster will be almost fully self-configuring besides the initial deployment and image building.

By having this powerful auto-join capability, you are eliminating most of the manual work related to scaling your cluster up or down since there is no need for interacting with the VM instance other than starting it. A rather simple illustration of this architecture is depicted in the following figure, where orchestration and worker nodes have their own respective images and self-configure on startup using a shared configuration data provider within the VPC itself:

CAUTION! To prevent serious security breaches make sure to separate and isolate any sensitive information to be accessible only by the desired systems in this configuration service layout. As we mentioned in one of the early chapters, following security best practices by using need-to-know practices will ensure that a compromise of a single point (most likely a worker node) will not be able to spread easily to the rest of your cluster. As a simple example here, this would include making sure that management secrets are not readable by worker nodes or their network.
..................Content has been hidden....................

You can't read the all page of ebook, please click here login for view all page.
Reset
3.133.114.221