Kf Cloud Service Broker

Kf Cloud Service Broker is a Service Broker bundle that includes the open source Cloud Service Broker and Google Cloud Brokerpak. It is made available as a public Docker image and ready to deploy as a Kubernetes service in Kf clusters. Once the Kf Cloud Service Broker service is deployed in a cluster, developers can provision Google Cloud backing services through the Kf Cloud Service Broker service, and bind the backing services to Kf Apps.

Requirements

  • Kf Cloud Service Broker requires a Cloud SQL for MySQL instance and a service account for accessing the Cloud SQL for MySQL instance and Google Cloud backing services to be provisioned. Connection from the Kf Cloud Service Broker to the Cloud SQL for MySQL instance goes through the Cloud SQL Auth Proxy.
  • Requests to access Google Cloud services (for example: Cloud SQL for MySQL or Memorystore) are authenticated via Workload Identity.

Override Brokerpak defaults

Brokerpaks are essentially a Terraform plan and related dependencies in a tar file. You can inspect the Terraform plans to see what the defaults are, and then you can tell Kf Cloud Service Broker to override them when creating new services.

For example, the Terraform configuration for Cloud SQL for MySQL includes a variable called authorized_network. If not overridden, the default VPC will be used. If you'd like to override the default, you can pass that during service creation. Here are some examples:

  1. Override the compute region config.

     kf create-service csb-google-postgres small spring-music-postgres-db -c '{"config":"YOUR_COMPUTE_REGION"}'

  2. Override the authorized_network and compute region config.

     kf create-service csb-google-postgres small spring-music-postgres-db -c '{"config":"YOUR_COMPUTE_REGION","authorized_network":"YOUR_CUSTOM_VPC_NAME"}'

Architecture

The following Kf Cloud Service Broker architecture shows how instances are created.

Kf Kf Cloud Service Broker architecture
  • The Kf Cloud Service Broker (CSB) is installed in its own namespace.
  • On installation, a Cloud SQL for MySQL instance must be provided to persist business logic used by Kf Cloud Service Broker. Requests are sent securely from the Kf Cloud Service Broker pod to the Cloud SQL for MySQL instance via the Cloud SQL for MySQL Auth Proxy.
  • On service provisioning, a Kf Service custom resource is created. The reconciler of the Kf Service provisions Google Cloud backing services using the Open Service Broker API.
  • When a request to provision/deprovision backing resources is received, Kf Cloud Service Broker sends resource creation/deletion requests to the corresponding Google Cloud service, and these requests are authenticated with Workload Identity. It also persists the business logics (e.g. mapping of Kf services to backing services, service bindings) to the Cloud SQL for MySQL instance.
  • On backing service creation success, the backing service is bound to an App via VCAP_SERVICES.

What's next?