Admin overview doc #6412
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change | ||||
|---|---|---|---|---|---|---|
| @@ -0,0 +1,112 @@ | ||||||
| --- | ||||||
| audience: administrator | ||||||
| components: | ||||||
| - serving | ||||||
| - eventing | ||||||
| function: explanation | ||||||
| --- | ||||||
| # Overview | ||||||
|
|
||||||
| This page provides guidance for administrators on how to manage Knative on an existing Kubernetes cluster. | ||||||
|
|
||||||
| As a cluster administrator, your responsibilities include managing the Kubernetes environment, installing cluster-wide components, and enabling developers to deploy applications on the cluster. Knative aims to simplify developer tasks, while aligning with existing management tools and processes. | ||||||
|
|
||||||
| Knative includes a plugin system within the existing cluster infrastructure, enabling Knative resources such as routes and brokers to be implemented using multiple underlying suppliers. For example, a Knative Eventing app can deliver events to a broker that triggers a function based on the received event. That function could then have a testing cluster respond using an in-memory option, or a staging or production environment might use a cloud-provided Kafka service. | ||||||
iRaindrop marked this conversation as resolved.
Outdated
Show resolved
Hide resolved
|
||||||
|
|
||||||
| Of particular interest to cluster administrators is that Knative supports customizable _default values_ on the parameters defined in resource YAML files. These configurations reduce the amount of environment configuration tasks developers needs to consider. | ||||||
|
|
||||||
| ## Knative installations | ||||||
|
|
||||||
| See the [Installation roadmap](../install/README.md#installation-roadmap) for prerequisites and installation steps. Your first installation decision is whether to use a YAML-based installation or use the Knative Operator. The Knative Operator is a custom controller that extends the Kubernetes API to install Knative components. If you just need to get acquainted with Knative at this time, you can install the quickstart. | ||||||
iRaindrop marked this conversation as resolved.
Outdated
Show resolved
Hide resolved
|
||||||
|
|
||||||
| ## Configuring Knative | ||||||
|
|
||||||
| Knative uses Kubernetes-style YAML manifests to define and configure system components. These manifests include core resources, custom resource definitions (CRDs), and extensibility features. As with Kubernetes, these configuration resources are declarative and managed using the `kubectl` CLI tool. | ||||||
iRaindrop marked this conversation as resolved.
Outdated
Show resolved
Hide resolved
|
||||||
|
|
||||||
| ### Resource scoping and namespaces | ||||||
|
|
||||||
| Knative resources are associated with namespaces. Knative adheres to the Kubernetes model of namespace-based isolation that lets you manage development teams and resources by assigning them to namespaces that you can define. There is also management of functionality by the applications that reference a namespace. | ||||||
iRaindrop marked this conversation as resolved.
Outdated
Show resolved
Hide resolved
|
||||||
|
|
||||||
| Namespaces can also isolate boundaries for tooling such as logs, metrics, tracing, CI/CD integrations, and dashboards. The extent of this isolation depends on both the enforcement strategy and how consistently teams adhere to namespace boundaries. | ||||||
|
Member
There was a problem hiding this comment.
Suggested change
|
||||||
|
|
||||||
| You can optimize and enforce isolation involving namespaces using standard Kubernetes mechanisms, including: | ||||||
iRaindrop marked this conversation as resolved.
Show resolved
Hide resolved
|
||||||
|
|
||||||
| - [Role-Based Access Control (RBAC)](https://kubernetes.io/docs/reference/access-authn-authz/rbac/) | ||||||
| - [Resource Quotas](https://kubernetes.io/docs/concepts/policy/resource-quotas/) | ||||||
| - [Network Policies](https://kubernetes.io/docs/concepts/services-networking/network-policies/) | ||||||
| - [Pod Security Standards](https://kubernetes.io/docs/concepts/security/pod-security-standards/) | ||||||
|
|
||||||
| ### Configuring Knative components | ||||||
|
|
||||||
| Knative configurations are performed by the following methods: | ||||||
|
|
||||||
| - Editing YAML manifests | ||||||
|
|
||||||
| Modify resource definitions directly, including labels, annotations, and field values. You can use Kubernetes features such as [OPA](https://kubernetes.io/blog/2019/08/06/opa-gatekeeper-policy-and-governance-for-kubernetes/) and [Kyverno](https://kyverno.io) to enforce specific values on a resource type, or use ConfigMaps in plugin installations to set values at the cluster level. | ||||||
|
|
||||||
| - Using ConfigMaps | ||||||
|
|
||||||
| Store and manage configuration data as key-value pairs. ConfigMaps are frequently used to tune platform-wide behavior. Most of the Knative ConfigMaps are in the `knative-serving` and `knative-eventing` namespaces. Their settings apply to all the relevant Knative components in all namespaces. | ||||||
|
|
||||||
| - Applying resources with the `kubectl` CLI | ||||||
|
|
||||||
| Apply updated YAML manifests, as opposed to ConfigMaps, to the cluster using standard Kubernetes workflows. | ||||||
|
||||||
|
|
||||||
| - Using the Knative Operator | ||||||
|
|
||||||
| Some platform-wide settings can be managed declaratively using the Knative Operator. | ||||||
|
Member
There was a problem hiding this comment.
Suggested change
|
||||||
|
|
||||||
| ### Configuration tasks | ||||||
|
|
||||||
evankanderson marked this conversation as resolved.
Show resolved
Hide resolved
|
||||||
| Knative documentation provides the following configuration procedures. This list is subject subject to change. | ||||||
|
|
||||||
| Configurations for default settings: | ||||||
|
|
||||||
| - [Broker defaults](../eventing/configuration/broker-configuration.md) | ||||||
| - [ConfigMap defaults](../serving/configuration/config-defaults.md) | ||||||
| - [Event source defaults](../eventing/configuration/sources-configuration.md) | ||||||
| - [Channel defaults](../eventing/configuration/channel-configuration.md) | ||||||
| - [Kafka channel defaults](../eventing/configuration/kafka-channel-configuration.md) | ||||||
| - [Domain names](../serving/using-a-custom-domain.md) | ||||||
| - [Ingress gateway replacement](../serving/setting-up-custom-ingress-gateway.md) | ||||||
|
|
||||||
| Configurations for new development: | ||||||
|
|
||||||
| - [Deployment resources](../serving/configuration/deployment.md) | ||||||
| - [Istio access to deployed services](../serving/istio-authorization.md) | ||||||
| - [Namespace exclusion from webhooks](../serving/istio-authorization.md) | ||||||
|
|
||||||
| Configurations for maintenance: | ||||||
|
|
||||||
| - [Garbage collection](../serving/revisions/revision-admin-config-options.md) | ||||||
| - [High availability](../serving/config-ha.md) | ||||||
| - [Rollout duration for revisions](../serving/configuration/rolling-out-latest-revision-configmap.md) | ||||||
| - [Autoscaling of Kafka features](../eventing/configuration/keda-configuration.md) | ||||||
|
|
||||||
| Configurations for security encryptions: | ||||||
|
|
||||||
| - [cert-manager](../serving/encryption/configure-certmanager-integration.md) | ||||||
| - [External domains](../serving/encryption/external-domain-tls.md) | ||||||
| - [Local domains](../serving/encryption/cluster-local-domain-tls.md) | ||||||
| - [system-internal](../serving/encryption/system-internal-tls.md) | ||||||
|
|
||||||
| Configurations for extensions: | ||||||
|
|
||||||
| - [Kafka Broker features](../serving/encryption/system-internal-tls.md) | ||||||
| - [Sugar Controller](../eventing/configuration/sugar-configuration.md) | ||||||
|
|
||||||
| Configurations for flagging features: | ||||||
|
|
||||||
| - [Serving features](../serving/configuration/feature-flags.md) | ||||||
| - [Eventing features](../eventing/features/README.md) | ||||||
|
Comment on lines
+55
to
+97
Member
There was a problem hiding this comment. This feels like it would be better spent updating the titles and organization in the left-nav: 
|
||||||
|
|
||||||
| ## Authorizations | ||||||
|
|
||||||
| You can grant developers access to additional resources related to their namespace in other services, such as observability, logs, metrics, tracing, and dashboards. | ||||||
|
Member
There was a problem hiding this comment. Not for this PR, but we should expand this to also talk about how application access can be managed by using ingress and Eventing features to require specific types of tokens (authentication and authorization) to deliver requests or events. |
||||||
|
|
||||||
| ## Upgrades | ||||||
|
|
||||||
| Administrators are generally responsible for performing upgrades cluster infrastructure and apps and services. Knative is designed and tested for continuous operation during upgrades and rollbacks, allowing you to: | ||||||
|
|
||||||
| - Upgrade or revert the Knative components while it is serving traffic, rather than needing a maintenance window. | ||||||
| - Downgrade one Knative version. Downgrades work provided that no applications have used new features since the last upgrade. | ||||||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Uh oh!
There was an error while loading. Please reload this page.