Kubernetes

kubernetes Runs apps as pods on the Kubernetes cluster Pando runs in, one namespace per app.

Setup

Prepare the cluster

Use a network plugin that enforces NetworkPolicy, such as Calico or Cilium.

Grant the ServiceAccount pando in the namespace pando these permissions, as deploy/kubernetes/rbac.yaml does:

Where	Resources	Verbs
Cluster	namespaces	get, list, create, delete
Cluster	serviceaccounts	get
Cluster	rolebindings	create
Cluster	clusterroles pando-app-manager	bind
Cluster	nodes, pods	get, list, watch
Cluster	persistentvolumes	get, patch
Cluster	runtimeclasses	get
Cluster	metrics.k8s.io pods, nodes	list
Each app namespace, through ClusterRole pando-app-manager	pods, pods/log, pods/exec, services, configmaps, secrets, persistentvolumeclaims, resourcequotas, networkpolicies	get, list, watch, create, update, patch, delete
Namespace pando-edge	deployments, services, secrets, poddisruptionbudgets, networkpolicies	get, list, create, update, delete
Namespace pando-edge	pods	list

Run kubectl get servicecidr kubernetes and copy CIDRS.
Run kubectl cluster-info dump | grep -m1 -- --cluster-cidr and copy the pod range. On a managed cluster, copy it from the cluster's network settings.

Open rbac.yaml Open the RBAC guide

Settings pod_cidr, service_cidr

Choose an egress gateway image
Settings egress_gateway_image

Settings (24)

pod_cidrPod address rangeRequired

The range the cluster assigns pods. Apps may not open connections into it.

string · For example 10.244.0.0/16

service_cidrService address rangeRequired

The range the cluster assigns Services. Apps may not open connections into it.

string · For example 10.96.0.0/12

egress_gateway_imageEgress gateway image

Any image with Pando's binary at /usr/local/bin/pando. Empty, apps that restrict egress can't be deployed.

string · For example ghcr.io/trypando/pando:latest

kubeconfigKubeconfig fileAdvanced

A kubeconfig file, for running Pando outside the cluster during development. Pando's proxy reaches apps by cluster DNS names, so in production Pando runs inside the cluster.

string · Default The cluster Pando runs in

contextKubeconfig contextAdvanced

The context in the kubeconfig file to use.

string · Default The file's current context

pando_namespacePando's namespaceAdvanced

Where Pando's server pods run. Apps admit connections only from Pando's server pods in this namespace.

string · Default pando

pando_servicePando's ServiceAdvanced

The Service in front of Pando's server pods, in Pando's namespace. The edge sends traffic to it.

string · Default pando

service_accountPando's ServiceAccountAdvanced

The ServiceAccount Pando's server pods run as, in Pando's namespace. It is bound to the app namespace role in each app namespace.

string · Default pando

proxy_portProxy portAdvanced

The port Pando's proxy listens on in its pods.

int · Default 8080

app_roleApp namespace roleAdvanced

The ClusterRole bound to Pando's ServiceAccount in each app namespace.

string · Default pando-app-manager

cluster_domainCluster domainAdvanced

The cluster's DNS domain, which Service names end in.

string · Default cluster.local

api_server_cidrAPI server addressAdvanced

Only needed when the API server's address is inside the pod or Service range: the edge reads its routes from it.

string · Default Reached by the rule for addresses outside the cluster

storage_classStorage classAdvanced

The StorageClass app volumes are made with.

string · Default The cluster's default class

volume_size_bytesVolume sizeAdvanced

Bytes for a volume whose app does not say how large it is.

int · Default 10737418240 (10 GiB)

runtime_classRuntimeClassAdvanced

A RuntimeClass to run apps under. One whose handler is gVisor (runsc) or Kata makes this a sandboxed runtime, which host policy can require.

string · Default The cluster's default

node_selectorNode selectorAdvanced

Run apps only on nodes with these labels, as key=value pairs separated by commas.

string · Default Every schedulable node

helper_imageHelper imageAdvanced

Runs the network policy check, the port observer and volume backups. Any image with a shell, tar, wget and httpd.

string · Default busybox:1.37

api_qpsAPI requests a secondAdvanced

The most requests a second each Pando replica makes to the cluster's API.

int · Default 200

api_burstAPI request burstAdvanced

How many requests a replica may make at once above that rate. At least the requests a second.

int · Default 400

edge_namespaceEdge namespaceAdvanced

The namespace the edge runs in: the Traefik that takes ports 80 and 443 and passes traffic to Pando.

string · Default pando-edge

edge_replicasEdge replicasAdvanced

How many copies of the edge run, spread across nodes. At least 2.

int · Default 2

edge_service_typeEdge Service typeAdvanced

LoadBalancer — The cluster's load balancer publishes ports 80 and 443.
NodePort — Every node listens on the node ports below, and a load balancer outside the cluster points at them.

one of the values above · Default LoadBalancer

edge_http_node_portEdge HTTP node portAdvanced

The port every node listens on for the edge's HTTP.

int · Default 30080 · Used when edge_service_type is NodePort

edge_https_node_portEdge HTTPS node portAdvanced

The port every node listens on for the edge's HTTPS.

int · Default 30443 · Used when edge_service_type is NodePort