Gravitational Blog

Gravitational | Security and Software Engineers | Seattle, Toronto, Oakland | Full Time | ONSITE | https://gravitational.com Come here to write open-source software in Go. We are hiring in Seattle, Toronto or Oakland. We have very little technical debt, check out our code on github.com/gravitational What we're working with/on: * Go AKA Golang. * Linux, infrastructure security. * Kubernetes. * JavaScript. The full list of our open positions: https://gravitational.breezy.hr/ We offer: * Competitive salary and equity. * 401k with company match. * Offsite retreat for everyone once a year. * Excellent health insurance.

Gravitational (YC S15) | Multiple Positions | Seattle, Toronto, Oakland | https://gravitational.com Do you enjoy building and selling security and deployment tools for other engineers? Join us to hack on open source software in Seattle, Toronto or Oakland. Most of our code is Go, we have very little technical debt, our codebase is clean and small. Selling our products is fun. Here is our tech stack: * Go. * Linux. * Kubernetes. We are looking for sales, marketing and QA automation engineers and managers to join the team. The full list of our open positions and application instructions: https://gravitational.breezy.hr/ We offer: * Competitive salary and equity. * 401k with company match. * Christmas bonus. * Offsite retreat for everyone once a year. * Excellent health insurance.

Also looks very much like Gravitational Teleport [0], which has been amazing to use. Teleport has a lot of advantages over Boundary right now based on it's architecture. But Hashi does a good job of iterating quickly, so I'd guess as with most of their products, it evolves quickly. [0] https://gravitational.com/teleport/ Disclaimer: I have no affiliation with any of these companies.

We love OpenSSH, and you can even setup Teleport in Recording mode. https://gravitational.com/teleport/docs/architecture/teleport_proxy/#r… but there are many good reasons to use the Teleport Library. https://gravitational.com/blog/openssh-vs-teleport/

https://gravitational.com/teleport/docs/ Is another great tool for getting off SSH. Similarly if you're in AWS and not using Session Manager, you're missing out on a huge value add: https://docs.aws.amazon.com/systems-manager/latest/userguide/session-m…

1. Is Gravity a fully open source software (with commercial support) or an Open Core software? If the latter, please point to a feature matrix or relevant part of documentation. 2. How Gravity solution (and/or approach) is different from a similar offering by Replicated? EDIT: Oops, sorry, just found the answer to my Q1: about halfway down on the following page: https://gravitational.com/gravity. However, some information on pricing structure and approximate numbers would be appreciated. Replicated is more transparent in this regard. :-) Q2 still stands. Looking forward to hearing from you.

Please check Gravitational's excellent Teleport. Privileged access management for elastic infrastructure. https://gravitational.com/teleport https://github.com/gravitational/teleport

Depending on what you're looking for, if it's just an environment to play around with, minikube is a good option: https://github.com/kubernetes/minikube And as another poster stated, kubeadm is a good way to get started on a VM or local system by following this guide: https://kubernetes.io/docs/setup/independent/install-kubeadm/ And last, possibly not what you're looking for but worth mentioning, there are commercial options available such as gravitational telekube which includes among other features a way to consistently install kubernetes amongst different environments and providers https://gravitational.com/telekube/. *Please be aware though that I'm affiliated with gravitational and work on telekube

As a follow up - I would now also take a _very_ serious look at Teleport [1] for managing SSH. [1]: https://gravitational.com/teleport/

Elixir is great for stateless apps. So are a bunch of other platforms. Elixir is exceptional at stateful apps. And it is true, many of those things are now handled through K8S. However, K8S doesn't handle everything and requires a lot more ceremony and infrastructure than what you can get within the Elixir/Erlang ecosystem. I think there might be a way to work with Elixir + K8S in a way specific to the domain you are working with. Not everyone needs to be able to hot-reload code without dropping live connections, but if if you do, and you want to deploy on K8S, then you can try writing a K8S operator that encapsulates that idea. However: https://gravitational.com/blog/running-postgresql-on-kubernetes/ (which is more about how every distributed system requires deep domain knowledge, not just specifically about PostgreSQL) I have not deployed Elixir on GCP. I have deployed other things though, and I can tell you the private networking is much better set up than AWS. As far as distributing nodes, you can do that with any of the cloud providers.

Gravitational | Senior Devops Engineer, Senior Backend Engineer | Oakland and Toronto | ONSITE, REMOTE (for those with remote experience), https://gravitational.com/ About us: We are well-funded, early stage systems & cloud startup headquartered in Oakland. We are an experienced team: we founded Mailgun [1] which was acquired by Rackspace, we created Vulcand [2] and some other cool stuff at Rackspace [3] and are the authors of Teleport [4], Teleconsole [5] and Telekube [6]. We love Linux and low level systems programming and we love helping open source communities and other engineers build great solutions. Additional detail: https://github.com/gravitational/careers Contact: [email protected] [1] https://www.mailgun.com [2] https://github.com/vulcand/vulcand [3] https://www.rackspace.com/en-us/cloud/servers/onmetal/specs [4] https://github.com/gravitational/teleport [5] https://www.teleconsole.com/ [6] http://gravitational.com/telekube/

Teleport (https://gravitational.com/teleport/) has been fairly useful, basically a ssh bastion solution with short term (hours) keys. They have an open source tier. Downside is that the company is really small, support is scarce after the check clears, and all their future development seems geared towards kuberneetes and IOT. So if you just want a reliable bastion with key management they aren’t really interested in your demographic.

https://gravitational.com/blog/how-to-ssh-properly/ Signing certificates for hosts and users. Never deal with authorized_keys files ever again.

> Moto > Through automation, anything is possible. Did you mean ‘motto’? I like what you’ve published so far, I might mention on articles you surface like “SCP is insecure and slow”[0] that it was written by a company with a competing product to sell you, in this case Gravitational. [0] https://gravitational.com/blog/scp-familiar-simple-insecure-slow/

https://gravitational.com/teleport/how-it-works/audit-logging-for-ssh-… Their audit log can include a lot more in a more structured format, including wire activity and even std{in,out,err}.

Can you get your certificate without using a browser? The description in the "how it works" sections here [1] describes it launching a browser for that step. If it has to use a browser, can it be a non-GUI browser like Lynx or Links? [1] https://gravitational.com/teleport/how-it-works/certificate-based-auth…

Seems like this mainly notes changes in this release. https://gravitational.com/teleport is the landing page with more feature details. I think a short list of features interesting to me is: * SSH CA integrated with whatever SSO you have, removing need to distribute SSH authorized_keys files. * SSH Bastion & Server with audit logging. Record sessions, who did what. Needed for many security-sensitive environments. * Reverse-tunnel mode, where devices without public IPs (or a vpn) can connect to your bastion server. Useful if you're deploying computers "in the field" that you want remote access to, without needing additional VPN or port forwarding, etc.

Thank you Abe! The kind comments are appreciated! So far we have gotten positive feedback. While this feature does not protect against root doing something malicious, it does allow admins to capture what root was doing up until they did something malicious and link that information to an identity (if using SSO). Along with this feature we rolled out a Workflow API [1] that can be used to request role elevation. Once you add in session termination (which we are aiming for in the next release), you will have a powerful set of features that will allow you to start users out with limited access to your cluster with the ability to request more privileges and potentially automatically termination your session (and user) if you're found to be doing some malicious. [1] https://gravitational.com/blog/workflow_api/

Requiring a dedicated volume with at least 50 GB of space and 1500 privisioned IOPS just for etcd [1] seems excessive to me. How big a cluster, e.g. how many nodes and pods, is this for? [1]: https://gravitational.com/gravity/docs/ver/6.x/requirements/#etcd-disk

Graviton here - Teleport and Gravity actually both have open source editions (which are naturally free) that you're welcome to download. https://gravitational.com/teleport/download/

I think this will be a due to multiple authors and the curse of the expert. Kubernetes is fairly gigantic now and continuing to spurt out in all sorts of directions, feature-wise. "The full-time job of keeping up with Kubernetes"[0] was published in February 2018 and nothing's slowed down. [0] https://gravitational.com/blog/kubernetes-release-cycle/# (and the HN discussion at the time: https://news.ycombinator.com/item?id=16285192)

Seems fixed now. Link for the lazy: https://gravitational.com/blog/aws_vs_colocation/

Gravitational blog posts[1] I've participated in are generally in these topic areas. Any more specific requests? [1] https://gravitational.com/blog/

thanks, where did you find the link for: https://gravitational.com/gravity/documentation

https://gravitational.com/gravity/documentation is 404ing https://gravitational.com/gravity/docs/overview/ working fine.

> Kubernetes, right now, supports some workloads really really well, like stateless workloads that are CPU intensive that can be easily scaled horizontally, with easy to understand patterns that we currently put behind load balancers. > Other workloads, Kubernetes just doesn’t support well and likely will not support well in the near future because it’s really hard to do. It’s not magic, as some of the hype surrounding it would have you believe. https://gravitational.com/blog/running-postgresql-on-kubernetes/

I thought that this was the case too, but OP had a link (https://gravitational.com/blog/running-postgresql-on-kubernetes/) to previous post that got me worried.

This article feels the need to repurpose the term "on-premises" to mean "self-hosted". From a previous article [0]: In the SaaS context, “on-premise” historically meant deploying a separate instance of your SaaS application to your customer’s server room or data center, behind their firewall. More recently, this term may also include deploying to the customer’s private cloud at a cloud provider like Amazon Web Services or Azure I'm a bit baffled this is necessary. You go from two terms that are widely understood to now having to add a disclaimer every time you say "on-premises". 0 - https://gravitational.com/blog/time-to-reconsider-going-onprem/

Have you looked at ScaleFT? https://www.scaleft.com They apply BeyondCorp style management for both server and web access. There is also Teleport by Gravitational: https://gravitational.com/teleport/

Docker images are pretty much the standard for on-premise SaaS products. Consider Replicated (https://help.replicated.com/categories/getting-started/) or Gravitational Telekube (https://gravitational.com/docs/overview/) for packaging and management.