k8s-config-connector VS swarmsible

If your company is k8s centric and the developers are most comfortable with k8s, you might want to focus more on something specific to k8s such as helm, or even if you don't get into helm you may want to use config connector in your yaml to manage GCP resources in an IaC compliant method. You can manage k8s resources with terraform, but if your developers are currently comfortable working directly with k8s you are going to see significant pushback getting them to add terraform as a middleware. You probably still want to manage your GKE clusters and VPCs with terraform since you can't really use config connector.

Config Connector [1] is also an option in this space for GCP, it supports many GCP resources and thus far our experience with it has been largely positive.

[1] https://cloud.google.com/config-connector/docs/overview

We use it heavily with GCP's Kubernetes Config Connector to provision architecture. It could similarly be used for Cloud Functions, etc. given a repo URL that GCP can access. GitOps + operator pattern is a pretty powerful mechanism to let k8s continuously seek state towards your ideal. https://cloud.google.com/config-connector/docs/overview

For K8s, we were using Cloud Composer to do it for us but wanted more fine control over CI/CD, so we decided to go with Airflow on K8s. That's all hosted in GKE now and deployed using ArgoCD with helm. This also led down the IaC rabbit hole which has been a ton of fun too. We use the GCP ConfigConnector resources for that which is a little challenging at first, but gets a lot easier as time goes on.

Terraform is 90% of cloud IaC. But there are newer Kubernetes Operators like Config Connector that can create cloud specific resources.

It works particularly well with Google Config Connector as then it's all just manifests.

We use Docker Swarm for our deployments, so I will answer the questions based on that.

We have built some tooling around setting up and maintaining the swarm using ansible [0]. We also added some Hetzner flavour to that [1] which allows us to automatically spin up completely new clusters in a really short amount of time.

deploy from source repo:

- We use Azure DevOps pipelines that automate deployments based on environment configs living in an encrypted state in Git repos. We use [2] and [3] to make it easier to organize the deployments using `docker stack deploy` under the hood.

keep software up to date:

- We are currently looking into CVE scanners that export into prometheus to give us an idea of what we should update

load balancing:

- depending on the project, Hetzner LB or Cloudflare

handle scaling:

- manually, but i would love to build some autoscaler for swarm that interacts with our tooling [0] and [1]

automate backups:

- docker swarm cronjobs either via jobs with restart condition and a delay or [4]

maintain security:

- Hetzner LB is front facing. Communication is done via encrypted networks inside Hetzner private cloud networks

- [0] https://github.com/neuroforgede/swarmsible

Pretty much the same as our goto for projects at work: Hetzner + Docker (Swarm) with some Ansible to orchestrate things

We have built some automation around cluster management over at https://github.com/neuroforgede/swarmsible.

I used to do everything in ansible, but Docker Stacks are just so much nicer to use.

In any case automation is king. I don't have to remember stuff if I can just look at some IaC Code :).

Our tooling can be found here https://github.com/neuroforgede/swarmsible . It is not yet documented tbh, but most things are pretty straight forward to use if you have used ansible, docker etc already.

Story of one of the projects I am involved in:

We came from Ansible managed deployments of vanilla docker with nginx as single node ingress with another load balancer on top of that.

Worked fine, but HA for containers that are only allowed to exist once in the stack was one thing that caused us headaches.

Then, we had a workshop for Rancher RKE. Looked promising at the start, but operating it became a headache as we didn't have enough people in the project team to maintain it. Certificates expiring was an issue and the fact that you actually kinda had to baby-sit the cluster was a turn off.

We killed the switch to kubernetes.

In the meantime we were toying around with Docker Swarm for smaller scale deployments and inhouse infrastructure. We didn't find anything to not like and are currently moving into that direction.

How we do things in Swarm:

1. Monitoring using an updated Swarmprom stack (https://github.com/neuroforgede/swarmsible/tree/master/envir...)

For anyone interested in this, check out: https://github.com/neuroforgede/swarmsible/blob/master/environments/test/test-swarm/stacks/02_monitoring/README.md