Make Developers Happy by Providing Kubernetes Self-Service

Developers don’t always have brilliant ideas during business hours. If a developer needs to deploy a new piece of code in a Kubernetes cluster asap, they’ll need a namespace (AKA soft tenancy) and a deployment pipeline. But:

• If all developers get cluster-role-binding level access in clusters, they may impact other developers using the same cluster.
• The number of developers will likely be much larger than platform/SRE team members, leading to a service ticket bottleneck if everything must go through the platform team.

With Rafay’s workspace administration capabilities, everyone gets exactly what they need.

Not all use cases can be solved with a namespace on a shared cluster. In many cases, developers need a dedicated cluster (AKA hard tenancy). In such cases, instead of filing tickets and further burdening highly stretched platform teams, developers would much rather provision Kubernetes infrastructure themselves. But:

• Developers may not have the skillset needed to drive Terraform, GitOps, Azure DevOps, Gitlab, CircleCI, Jenkins, or Bitbucket pipelines to provision Kubernetes clusters.
• Developers in enterprises usually don’t have access to public cloud consoles.
• Infrastructure-focused git repos may not grant “write” access to developers for governance purposes.

With Rafay’s self-service cluster lifecycle management capabilities, everyone gets exactly what they need.

Although not all developers use kubectl access on an ongoing basis, when things go haywire in production, developers need visibility to figure out what’s happening. This may require them to temporarily access clusters. But:

• Platform teams don’t like exposing KubeAPI endpoints to the Internet, meaning VPNs or jumphosts are needed to enable access.
• Service accounts need to be created and retired as and when developers need access – which isn’t always straightforward.
• All user activity must be audited to ensure compliance.
• Developers accessing production environments must do so in a read-only fashion and must not be able to describe secrets.

This is a massive effort, and most companies don’t have a good way to provide developers with kubectl access, and when they do, there are no guardrails in place.

With Rafay’s zero-trust kubectl access capabilities, everyone gets exactly what they need.