Bootstrapping Kubernetes Google Cloud Platform without scripts
Published in 2017, this chronicle by @kelseyhightower details the mechanics of building a profitable, self-funded business without venture backing.
Core Principles for Independent Builders:
Charging customers from day one acts as the ultimate filter for building software that solves genuine, high-urgency problems.
Keeping fixed overhead low and leveraging lean infrastructure allows founders to stay alive until market tailwinds kick in.
Small, repetitive improvements in customer retention and conversion rates yield massive returns over multi-year horizons.
Community Debate Themes:
The community focused on B2B customer acquisition channels, cold email vs SEO distribution, and balancing full-time employment with side-project development.
CATEGORY Bootstrapping & MRR →
HISTORICAL ERA Cloud & Mobile Era (2014–2019)
COMMUNITY SCORE 153 points
TOTAL DISCUSSIONS 25 comments
Is it me, or does it seem weird to encrypt your secrets by uploading the secret key to GCP (contained in the config .yaml file)? I assume the controller instances are operated by Google in this[1] example.
Moreover, is there any sensible way at all to encrypt secrets without baking the secret key into your image? I can’t think of any.
I want to deploy an app that makes use of one or more fairly important secrets, but I haven’t found a sensible way to make it auto-scale while keeping the secrets on-premise.
As far as I can see, the only sensible solution is to create in-cloud/off-premise secret keys that can only be accessed by images signed with an on-premise secret key.
So,
1. Create secret key on an offline, on-premise machine
2. Produce application image, transfer to offline machine, sign with on-premise secret key
3. Create off-premise (in-cloud) secret, which can only be accessed by images signed with the on-premise secret key
4. Upload app image and signature to the cloud, allowing only this image access to the in-cloud secret
[1] https://github.com/kelseyhightower/kubernetes-the-hard-way/blob/1.7.4/docs/06-data-encryption-keys.md ↗
Going through the previous version of this tutorial really helped me, even though we're doing IBM Cloud private on-prem + Bluemix Container Service (don't ask.)
It works pretty well with Cloud Shell, in case you have corporate firewall issues. If your session is interrupted, run the commands that set the region and region zone again.
I can confirm that it costs about $6/day that the machines are provisioned, and is well worth it, but remember to run all the clean-up steps in the last chapter when you're done or if you're not going to finish it right away.
This is great. I have been looking at Kubernetes for sometime and have struggled with adapting it to our deployment model. A lot of the tools and tutorials want someone to sit and run commands in order to start controllers and worker nodes but that doesn't make sense in our automated environment. What we really want is a way to bake AMIs etc that have everything ready to go and when we do a deployment or scale out it is as simple as starting an instance. This collection of labs lays a lot of that out and I think this is something we can work with.
I can highly recommend OpenShift and its Ansible deployment scripts. Documentation is very well-written and complete.
It takes care of all the annoying parts of Kubernetes and even has services like a full-featured Docker registry with ACLs and so on, a Docker build system and even a centralized logging mechanism (all optional, of course).
Running it in production. Couldn't be happier.
I did something similar off of CoreOS's tutorial. So while I'm missing a lot of understanding of the newer functionality, going through this was worth it.