DOCSEARCHbyAlgolia
Submit Docs

KubeStellar

repository·main·Indexed 20 days ago

https://github.com/kubestellar/kubestellar

A CNCF Sandbox project that simplifies multi-cluster Kubernetes management by allowing developers to define binding policies between clusters and workloads. The project includes utilities such as kflex-get-kubeconfig for fetching ControlPlane kubeconfigs and the kubectl-rbac-flatten plugin for auditing RBAC privileges.

Tokens
73.5K
Snippets
178
Records
325
Agent score
71%

What's inside KubeStellar

  1. What is KubeStellar?

    main

    KubeStellar is a multi-cluster deployment platform for Kubernetes objects. It allows users to manage deployments across multiple clusters using simple binding policies while maintaining a 'Pure-Kube' experience, meaning objects are deployed in their native Kubernetes format without being wrapped in proprietary abstractions.

    Key capabilities include:

    • Object Management via WDS: Creation, updates, and deletions of objects in managed clusters are orchestrated from the Workload Deployment Service (WDS).
    • OCM Transport: Uses Open Cluster Management (OCM) as the transport layer, utilizing standard OCM agents (Klusterlet).
    • Automated Lifecycle: Objects are automatically re-evaluated when binding policies change and are removed from clusters if the binding policy no longer matches the target clusters.
    • Resiliency: All components run within Kubernetes to ensure continued operation during component restarts.

  2. Understand the Kubestellar documentation websites

    main

    Kubestellar documentation is available via two primary web addresses:

    1. https://kubestellar.io: The main landing page, which redirects to the documentation site.
    2. https://docs.kubestellar.io: The official documentation site, hosted via GitHub Pages and based on the github.com/kubestellar/kubestellar/ repository.

    Contributors can also host their own version of the documentation at https://${repo_owner}.github.io/${fork_name} by properly configuring their fork. This is recommended for generating previews of documentation changes before merging them into the main branch.

  3. Identify KubeStellar core components and repositories

    main

    The KubeStellar ecosystem consists of several key repositories that work together to provide multi-cluster configuration management. Depending on your needs, you may need to interact with different codebases:

    Core Logic and Control Planes

    • kubestellar/kubestellar: The primary repository containing the core KubeStellar controllers and business logic.
    • kubestellar/kubeflex: A flexible framework for hosting control planes, frequently used in conjunction with KubeStellar.
    • kubestellar/ocm-transport-plugin: Provides the transport plugin integration specifically for Open Cluster Management (OCM).

    Infrastructure and Community

    • kubestellar/infra: Contains infrastructure configurations, Prow jobs, and CI/CD automation scripts.
    • kubestellar/community: Houses community governance documents, meeting notes, and membership information.

  4. Explore the KubeStellar Ecosystem

    main

    KubeStellar consists of a core orchestration engine and several sub-projects that extend its functionality through UIs, AI tooling, and community content:

    • kubestellar (Core Engine): Handles BindingPolicy, WDS, ITS, and WEC workload propagation.
    • console: An AI-powered web dashboard for monitoring clusters, deploying workloads, and managing GPU resources. You can try it in demo mode at console.kubestellar.io.
    • console-marketplace: Provides 153+ community card presets (e.g., ArgoCD, OPA, Falco, LLM-d).
    • console-kb: An AI knowledge base containing community missions and operational runbooks.
    • kubestellar-mcp: An MCP server that enables natural-language cluster operations via AI agents like Claude, Cursor, Windsurf, and VS Code.

  5. Use the kubectl-rbac-flatten command to audit RBAC privileges

    main

    kubectl-rbac-flatten is a kubectl plugin that reads RoleBinding and ClusterRoleBinding objects to compute and print the outer product of subjects and rules. It is designed to help you search for exactly why a specific subject is allowed to perform a specific action, making RBAC auditing and troubleshooting easier.

    Core Concept: The Privilege Grant

    The tool breaks down RBAC into atomic tuples representing a single privilege grant, consisting of:

    • Subject: The user, ServiceAccount, or group being granted access.
    • Verb: The action (e.g., get, list, create, *).
    • Object: Either an API object (resource, name, namespace) or a non-resource URL path.
    • Role-ism: The Role or ClusterRole defining the permissions.
    • Binding: The RoleBinding or ClusterRoleBinding connecting the subject to the role.
    # Example: Find out who can list nodes
go run ./cmd/kubectl-rbac-flatten \
    --show-role=false \
    --resources=nodes \
    --verbs=list \
    >/tmp/can-list-nodes.txt 2>/tmp/errs.txt

  6. Where to find KubeStellar documentation

    main

    The official documentation for KubeStellar is no longer hosted in the kubestellar/kubestellar repository. All documentation, including guides and API references, has been moved to a dedicated repository: https://github.com/kubestellar/docs.

    Important: Do not open issues or Pull Requests related to documentation within the kubestellar/kubestellar repository; they will be closed without review.

  7. What is the KubeStellar galaxy?

    main

    The galaxy is a secondary repository containing KubeStellar-related tools, packages, and integrations that are not part of the core KubeStellar releases. It serves as a space for experimental code, community project integrations, and additional modules that extend KubeStellar's capabilities beyond its core scope.

    Note: All code in the galaxy repository is considered experimental and is provided on an as-is basis.

  9. What is KubeStellar?

    main

    KubeStellar is a CNCF Sandbox project designed for multi-cluster configuration management across Edge, Multi-Cloud, and Hybrid Cloud environments. It simplifies the deployment and configuration of applications across multiple Kubernetes clusters by providing a seamless experience similar to managing a single cluster.

    Instead of configuring clusters individually, developers define a binding policy between clusters and Kubernetes objects. KubeStellar then uses standard single-cluster tooling to deploy and configure each cluster based on these policies. This approach is ideal for:

    • Separating environments (dev, test, staging).
    • Isolating groups, teams, or departments.
    • Meeting enterprise security and data governance requirements.
    • Enhancing resiliency across different clouds.
    • Running applications on the edge or in disconnected environments.

  10. What is a Workload Description Space (WDS)?

    main

    A Workload Description Space (WDS) is the primary interface in KubeStellar for defining and managing workloads for multi-cluster deployment. It functions as a Kubernetes API server that provides:

    • Workload Storage: Stores workload definitions in native Kubernetes format.
    • Control Object Storage: Stores objects that define workload distribution, including BindingPolicy, Binding, Status Collector, CombinedStatus, and CustomTransform.
    • Status Tracking: Stores status information regarding deployed workloads.
    • User Interface: Acts as the main entry point for users to interact with the KubeStellar system.

  11. What is KubeFlex and how does it work with KubeStellar

    main

    KubeFlex is a Kubernetes-based platform that serves as a foundational technology for KubeStellar. It provides lightweight Kubernetes API Server instances and controllers as a service, offering a flexible architecture for storage backends and API Server builds.

    In a KubeStellar deployment, users interact with the API server of the hosting cluster to manage control planes. KubeFlex uses a ControlPlane Custom Resource Definition (CRD) to represent and manage these individual control planes.

  12. What is an Inventory and Transport Space (ITS)?

    main

    An Inventory and Transport Space (ITS) is a core KubeStellar component that functions as an Open Cluster Management (OCM) "hub". It acts as a Kubernetes-like API server with storage to manage the lifecycle of workloads across clusters.

    An ITS provides two primary functions:

    1. Inventory Space: Maintains a registry of all available Workload Execution Clusters (WECs) using ManagedCluster.v1.cluster.open-cluster-management.io objects.
    2. Transport Space: Handles the movement of workloads from Workload Description Spaces (WDSes) to the appropriate WECs.

    Key technical responsibilities of an ITS include:

    • Storing WEC inventory information.
    • Maintaining a customization-properties namespace containing ConfigMaps for WEC-specific properties.
    • Managing mailbox namespaces (one per WEC) that hold ManifestWork objects.
    • Running the OCM Cluster Manager to synchronize objects with WECs.