Skip to main content

Components Deep Dive

KubeZero is built on a carefully selected stack of proven open-source technologies. Each component serves a specific purpose and works together to create a cohesive platform.

Core Platform Components​

ArgoCD - GitOps Engine​

Role: Continuous delivery and GitOps orchestration

ArgoCD serves as the central nervous system of KubeZero, watching Git repositories and ensuring the cluster state matches the desired state defined in code.

Key Features:

  • Declarative GitOps: Describes desired state in Git
  • Multi-cluster Management: Manages multiple Kubernetes clusters
  • Visual Dashboard: Rich web UI for monitoring deployments
  • Progressive Delivery: Supports canary and blue-green deployments
  • RBAC Integration: Fine-grained access control

Configuration Example:

# modules/argo-cd/values.yaml
server:
  extraArgs:
    - --insecure
  config:
    url: https://gitops.local.kubezero.io
    repositories: |
      - type: git
        url: https://github.com/kubezero/kubezero
  rbacConfig:
    policy.default: role:readonly
    policy.csv: |
      p, role:admin, applications, *, */*, allow
      g, admin, role:admin

Crossplane - Infrastructure as Code​

Role: Kubernetes-native infrastructure management

Crossplane extends Kubernetes to manage cloud infrastructure, eliminating the need for external tools like Terraform.

Key Features:

  • Cloud-Agnostic: Works with AWS, GCP, Azure, and more
  • Kubernetes-Native: Uses CRDs and controllers
  • Composition Engine: Create higher-level abstractions
  • Self-Service: Teams can provision infrastructure via Kubernetes APIs

Example Usage:

# Crossplane Composition for EKS cluster
apiVersion: apiextensions.crossplane.io/v1
kind: Composition
metadata:
  name: xeks-cluster
spec:
  compositeTypeRef:
    apiVersion: kubezero.io/v1alpha1
    kind: XEKSCluster
  resources:
    - name: eks-cluster
      base:
        apiVersion: eks.aws.crossplane.io/v1alpha1
        kind: Cluster
        spec:
          forProvider:
            region: us-west-2
            version: "1.28"

Ingress NGINX - Traffic Management​

Role: HTTP/HTTPS routing and load balancing

Ingress NGINX provides a robust, production-ready ingress controller for routing external traffic to services.

Key Features:

  • High Performance: Handles thousands of requests per second
  • SSL/TLS Termination: Automatic certificate management
  • Authentication: OAuth, Basic Auth, and more
  • Advanced Routing: Path-based and host-based routing

Configuration Example:

# Ingress resource example
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: app-ingress
  annotations:
    nginx.ingress.kubernetes.io/rewrite-target: /
    cert-manager.io/cluster-issuer: letsencrypt-prod
spec:
  tls:
    - hosts:
        - app.example.com
      secretName: app-tls
  rules:
    - host: app.example.com
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: app-service
                port:
                  number: 80

Cert-Manager - Certificate Management​

Role: Automated TLS certificate provisioning and renewal

Cert-Manager automatically obtains and renews TLS certificates from various sources, including Let's Encrypt.

Key Features:

  • Automatic Provisioning: Certificates issued on-demand
  • Multiple CAs: Support for various certificate authorities
  • Kubernetes Integration: Seamless integration with ingress
  • Monitoring: Certificate expiration tracking

Configuration Example:

# ClusterIssuer for Let's Encrypt
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt-prod
spec:
  acme:
    server: https://acme-v02.api.letsencrypt.org/directory
    email: [email protected]
    privateKeySecretRef:
      name: letsencrypt-prod
    solvers:
      - http01:
          ingress:
            class: nginx

External-DNS - DNS Automation​

Role: Automatic DNS record management

External-DNS automatically creates and manages DNS records for Kubernetes services and ingresses.

Key Features:

  • Multi-Provider Support: Works with major DNS providers
  • Automatic Synchronization: Keeps DNS records in sync
  • Annotation-Driven: Simple configuration via annotations
  • Safe Updates: Prevents accidental deletions

Configuration Example:

# Service with External-DNS annotation
apiVersion: v1
kind: Service
metadata:
  name: my-app
  annotations:
    external-dns.alpha.kubernetes.io/hostname: myapp.example.com
spec:
  type: LoadBalancer
  ports:
    - port: 80
      targetPort: 8080
  selector:
    app: my-app

External Secrets Operator - Secrets Management​

Role: Secure secrets integration from external systems

ESO fetches secrets from external secret management systems and creates Kubernetes secrets.

Key Features:

  • Multiple Backends: Support for various secret stores
  • Automatic Sync: Keeps secrets up-to-date
  • Template Support: Transform secrets during sync
  • Security: Never stores secrets in Git

Configuration Example:

# ExternalSecret resource
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: app-secrets
spec:
  refreshInterval: 1h
  secretStoreRef:
    name: vault-backend
    kind: SecretStore
  target:
    name: app-secrets
    creationPolicy: Owner
  data:
    - secretKey: database-password
      remoteRef:
        key: secret/data/myapp
        property: db_password

vCluster - Virtual Clusters​

Role: Lightweight cluster virtualization

vCluster creates virtual Kubernetes clusters that run inside regular Kubernetes clusters, providing isolation with minimal overhead.

Key Features:

  • Full Kubernetes API Compatibility: Works with any Kubernetes tool
  • Resource Efficiency: Much lighter than full clusters
  • Isolation: Separate namespaces, RBAC, and networking
  • Multi-Tenancy: Multiple teams on same infrastructure

Configuration Example:

# vCluster values
apiVersion: v1
kind: ConfigMap
metadata:
  name: vcluster-config
data:
  values.yaml: |
    vcluster:
      image: rancher/k3s:v1.28.2-k3s1
    syncer:
      extraArgs:
        - --out-kube-config-server=https://my-vcluster.example.com
    storage:
      size: 5Gi

Supporting Components​

K3d - Local Development​

Role: Lightweight Kubernetes for local development

K3d runs K3s (lightweight Kubernetes) in Docker containers, perfect for local development and testing.

Key Features:

  • Docker-based: Runs entirely in Docker containers
  • Fast Startup: Clusters start in seconds
  • Port Mapping: Easy access to services
  • Load Balancer: Built-in load balancer support

Kustomize - Configuration Management​

Role: Template-free configuration customization

Kustomize provides a declarative approach to customize Kubernetes manifests without templates.

Key Features:

  • Overlay Pattern: Base configurations with environment-specific overlays
  • Patch Support: Strategic merge patches and JSON patches
  • Built into kubectl: Native Kubernetes support
  • No Templates: Pure YAML approach

Helm - Package Management​

Role: Kubernetes package manager

Helm manages complex Kubernetes applications through charts and templates.

Key Features:

  • Chart Repository: Centralized package distribution
  • Templating: Go template engine for customization
  • Release Management: Track and manage deployments
  • Dependency Management: Handle complex application dependencies

Component Integration​

GitOps Flow​

Component Dependencies​

Customization Points​

Module-Level Customization​

Each component can be customized through its module configuration:

# modules/argo-cd/kustomization.yaml
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization

helmCharts:
  - name: argo-cd
    repo: https://argoproj.github.io/argo-helm
    version: 5.46.8
    namespace: argocd
    valuesFile: values.yaml
    
patches:
  - target:
      kind: Service
      name: argocd-server
    patch: |-
      - op: add
        path: /metadata/annotations
        value:
          service.beta.kubernetes.io/aws-load-balancer-type: nlb

Stack-Level Integration​

Components are integrated at the stack level:

# stacks/k8s-essentials/manifests/kustomization.yaml
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization

resources:
  - ../../../modules/ingress-nginx
  - ../../../modules/cert-manager
  - ../../../modules/external-dns

patches:
  - target:
      kind: ClusterIssuer
      name: letsencrypt-prod
    patch: |-
      - op: replace
        path: /spec/acme/email
        value: [email protected]

Monitoring and Observability​

Optional Components​

KubeZero can be extended with monitoring and observability tools:

  • Prometheus: Metrics collection and alerting
  • Grafana: Visualization and dashboards
  • Jaeger: Distributed tracing
  • Fluentd/Fluent Bit: Log aggregation
  • Elastic Stack: Search and analytics

Integration Example​

# modules/monitoring/kustomization.yaml
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization

helmCharts:
  - name: kube-prometheus-stack
    repo: https://prometheus-community.github.io/helm-charts
    version: 55.5.0
    namespace: monitoring
    valuesFile: values.yaml

Security Considerations​

Component Security​

Each component implements security best practices:

  • ArgoCD: RBAC, SSO integration, private repositories
  • Crossplane: Provider credentials, RBAC for resources
  • Ingress: Rate limiting, authentication, WAF integration
  • Cert-Manager: Automated certificate rotation
  • ESO: Secure secret transit, least privilege access

Network Security​

Performance Optimization​

Resource Management​

  • Resource Limits: All components have appropriate resource limits
  • Horizontal Pod Autoscaler: Automatic scaling based on metrics
  • Vertical Pod Autoscaler: Automatic resource optimization
  • Cluster Autoscaler: Node-level scaling

Caching and Optimization​

  • ArgoCD: Application caching and batching
  • Ingress: Connection pooling and caching
  • DNS: Caching and optimization
  • Image Caching: Efficient image pulls

Next Steps​

Understanding these components and how they work together is crucial for effectively using and extending KubeZero.