Multi-Cloud Architecture: Strategy, Challenges, and Implementation

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54

# This manifest runs unchanged on EKS, GKE, or AKS
apiVersion: apps/v1
kind: Deployment
metadata:
  name: order-service
  labels:
    app: order-service
    environment: production
spec:
  replicas: 3
  selector:
    matchLabels:
      app: order-service
  template:
    metadata:
      labels:
        app: order-service
    spec:
      containers:
        - name: order-service
          image: registry.example.com/order-service:v2.3.1
          ports:
            - containerPort: 8080
          resources:
            requests:
              cpu: "100m"
              memory: "256Mi"
            limits:
              cpu: "500m"
              memory: "512Mi"
          livenessProbe:
            httpGet:
              path: /health
              port: 8080
            initialDelaySeconds: 10
            periodSeconds: 5
          env:
            - name: DATABASE_URL
              valueFrom:
                secretKeyRef:
                  name: order-service-secrets
                  key: database-url
---
apiVersion: v1
kind: Service
metadata:
  name: order-service
spec:
  selector:
    app: order-service
  ports:
    - port: 80
      targetPort: 8080
  type: ClusterIP

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64

# Deploy an application to multiple clusters using Argo CD ApplicationSet
apiVersion: argoproj.io/v1alpha1
kind: ApplicationSet
metadata:
  name: order-service
  namespace: argocd
spec:
  generators:
    # Generate applications for each cluster
    - clusters:
        selector:
          matchLabels:
            environment: production
  template:
    metadata:
      name: 'order-service-{{name}}'
    spec:
      project: production
      source:
        repoURL: https://github.com/org/order-service
        targetRevision: main
        path: k8s/overlays/{{metadata.labels.cloud}}
      destination:
        server: '{{server}}'
        namespace: order-service
      syncPolicy:
        automated:
          prune: true
          selfHeal: true
        syncOptions:
          - CreateNamespace=true
          - ApplyOutOfSyncOnly=true
 
---
# Cluster secrets define target clusters
# Each cluster registered as a secret in argocd namespace
apiVersion: v1
kind: Secret
metadata:
  name: prod-aws-us-east-1
  namespace: argocd
  labels:
    argocd.argoproj.io/secret-type: cluster
    environment: production
    cloud: aws
    region: us-east-1
type: Opaque
stringData:
  name: prod-aws-us-east-1
  server: https://eks.us-east-1.example.com
  config: |
    {
      "execProviderConfig": {
        "command": "aws",
        "args": ["eks", "get-token", "--cluster-name", "prod-cluster"],
        "env": {
          "AWS_REGION": "us-east-1"
        }
      },
      "tlsClientConfig": {
        "insecure": false,
        "caData": "<base64-ca-cert>"
      }
    }

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130

# Multi-cloud Kubernetes cluster provisioning
# Demonstrates unified approach with cloud-specific implementations
 
# Provider configurations
provider "aws" {
  region = var.aws_region
  alias  = "aws"
}
 
provider "google" {
  project = var.gcp_project
  region  = var.gcp_region
  alias   = "gcp"
}
 
provider "azurerm" {
  features {}
  alias = "azure"
}
 
# Variable to select which cloud to deploy to
variable "cloud_provider" {
  type        = string
  description = "Target cloud provider: aws, gcp, or azure"
  validation {
    condition     = contains(["aws", "gcp", "azure"], var.cloud_provider)
    error_message = "cloud_provider must be aws, gcp, or azure."
  }
}
 
# Locals for cloud-specific configuration
locals {
  is_aws   = var.cloud_provider == "aws"
  is_gcp   = var.cloud_provider == "gcp"
  is_azure = var.cloud_provider == "azure"
}
 
# AWS EKS Cluster
module "eks" {
  source  = "terraform-aws-modules/eks/aws"
  version = "~> 19.0"
  count   = local.is_aws ? 1 : 0
  
  providers = {
    aws = aws.aws
  }
 
  cluster_name    = var.cluster_name
  cluster_version = "1.28"
 
  vpc_id     = module.aws_vpc[0].vpc_id
  subnet_ids = module.aws_vpc[0].private_subnets
 
  eks_managed_node_groups = {
    primary = {
      instance_types = ["m6i.large"]
      min_size       = 2
      max_size       = 10
      desired_size   = 3
    }
  }
 
  tags = local.common_tags
}
 
# GCP GKE Cluster
resource "google_container_cluster" "gke" {
  provider = google.gcp
  count    = local.is_gcp ? 1 : 0
 
  name     = var.cluster_name
  location = var.gcp_region
 
  # Enable Autopilot for managed node management
  enable_autopilot = true
 
  network    = google_compute_network.vpc[0].name
  subnetwork = google_compute_subnetwork.subnet[0].name
 
  # Workload Identity for pod authentication
  workload_identity_config {
    workload_pool = "${var.gcp_project}.svc.id.goog"
  }
 
  # Private cluster configuration
  private_cluster_config {
    enable_private_nodes    = true
    enable_private_endpoint = false
    master_ipv4_cidr_block  = "172.16.0.0/28"
  }
}
 
# Azure AKS Cluster
resource "azurerm_kubernetes_cluster" "aks" {
  provider            = azurerm.azure
  count               = local.is_azure ? 1 : 0
  
  name                = var.cluster_name
  location            = var.azure_region
  resource_group_name = azurerm_resource_group.rg[0].name
  dns_prefix          = var.cluster_name
 
  default_node_pool {
    name       = "default"
    node_count = 3
    vm_size    = "Standard_D2_v2"
    vnet_subnet_id = azurerm_subnet.aks[0].id
  }
 
  identity {
    type = "SystemAssigned"
  }
 
  network_profile {
    network_plugin = "azure"
    network_policy = "calico"
  }
 
  tags = local.common_tags
}
 
# Unified output regardless of cloud
output "cluster_endpoint" {
  description = "Kubernetes cluster API endpoint"
  value = coalesce(
    try(module.eks[0].cluster_endpoint, null),
    try(google_container_cluster.gke[0].endpoint, null),
    try(azurerm_kubernetes_cluster.aks[0].kube_config[0].host, null)
  )
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92

# Crossplane Composition: Abstract 'Database' that maps to cloud-specific implementations
apiVersion: apiextensions.crossplane.io/v1
kind: CompositeResourceDefinition
metadata:
  name: xdatabases.example.org
spec:
  group: example.org
  names:
    kind: XDatabase
    plural: xdatabases
  claimNames:
    kind: Database
    plural: databases
  versions:
    - name: v1alpha1
      served: true
      referenceable: true
      schema:
        openAPIV3Schema:
          type: object
          properties:
            spec:
              type: object
              properties:
                parameters:
                  type: object
                  properties:
                    size:
                      type: string
                      enum: [small, medium, large]
                    engine:
                      type: string
                      enum: [postgres, mysql]
                    cloud:
                      type: string
                      enum: [aws, gcp, azure]
                  required:
                    - size
                    - engine
                    - cloud
 
---
apiVersion: apiextensions.crossplane.io/v1
kind: Composition
metadata:
  name: xdatabases-aws
  labels:
    crossplane.io/xrd: xdatabases.example.org
    cloud: aws
spec:
  compositeTypeRef:
    apiVersion: example.org/v1alpha1
    kind: XDatabase
  resources:
    - name: rds-instance
      base:
        apiVersion: rds.aws.crossplane.io/v1beta1
        kind: Instance
        spec:
          forProvider:
            region: us-west-2
            dbInstanceClass: db.t3.medium
            allocatedStorage: 20
            engine: postgres
            engineVersion: "14"
            masterUsername: admin
            skipFinalSnapshotBeforeDeletion: true
          providerConfigRef:
            name: aws-provider
      patches:
        - type: FromCompositeFieldPath
          fromFieldPath: spec.parameters.size
          toFieldPath: spec.forProvider.dbInstanceClass
          transforms:
            - type: map
              map:
                small: db.t3.micro
                medium: db.t3.medium
                large: db.r6g.large
 
---
# Users request a database without knowing cloud specifics
apiVersion: example.org/v1alpha1
kind: Database
metadata:
  name: orders-db
  namespace: production
spec:
  parameters:
    size: medium
    engine: postgres
    cloud: aws

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95

# Istio multi-cluster configuration
# Cluster 1 (AWS EKS) - Primary with shared control plane identity
apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
metadata:
  name: istio-control-plane
  namespace: istio-system
spec:
  profile: default
  
  values:
    global:
      meshID: multi-cloud-mesh
      multiCluster:
        clusterName: cluster-aws-east
      network: network-aws
      
    pilot:
      env:
        # Enable endpoint discovery across clusters
        PILOT_ENABLE_CROSS_CLUSTER_WORKLOAD_ENTRY: "true"
  
  components:
    ingressGateways:
      - name: istio-eastwestgateway
        label:
          istio: eastwestgateway
          app: istio-eastwestgateway
        enabled: true
        k8s:
          env:
            - name: ISTIO_META_REQUESTED_NETWORK_VIEW
              value: network-aws
          service:
            ports:
              - name: status-port
                port: 15021
                targetPort: 15021
              - name: tls
                port: 15443
                targetPort: 15443
              - name: tls-istiod
                port: 15012
                targetPort: 15012
              - name: tls-webhook
                port: 15017
                targetPort: 15017
 
---
# ServiceEntry to expose remote cluster services
apiVersion: networking.istio.io/v1alpha3
kind: ServiceEntry
metadata:
  name: gcp-services
  namespace: istio-system
spec:
  hosts:
    - "*.cluster-gcp-west.global"
  location: MESH_INTERNAL
  ports:
    - name: http
      number: 80
      protocol: HTTP
    - name: grpc
      number: 443
      protocol: GRPC
  resolution: DNS
  endpoints:
    - address: istio-eastwestgateway.istio-system.svc.cluster.local
      network: network-gcp
      ports:
        http: 15443
 
---
# Virtual Service for cross-cluster traffic splitting
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: order-service
  namespace: production
spec:
  hosts:
    - order-service
  http:
    - route:
        # 80% to local (AWS) cluster
        - destination:
            host: order-service
            subset: aws
          weight: 80
        # 20% to GCP cluster for canary
        - destination:
            host: order-service.cluster-gcp-west.global
            subset: gcp
          weight: 20

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70

# Dapr provides cloud-agnostic building blocks
# Applications call Dapr APIs; Dapr handles cloud-specific integration
 
# State Store component - AWS DynamoDB
apiVersion: dapr.io/v1alpha1
kind: Component
metadata:
  name: statestore
  namespace: production
spec:
  type: state.aws.dynamodb
  version: v1
  metadata:
    - name: region
      value: "us-east-1"
    - name: table
      value: "app-state"
    - name: accessKey
      secretKeyRef:
        name: aws-credentials
        key: access-key
    - name: secretKey
      secretKeyRef:
        name: aws-credentials
        key: secret-key
 
---
# Same application code works with GCP Firestore
# by swapping the component configuration
 
apiVersion: dapr.io/v1alpha1
kind: Component
metadata:
  name: statestore
  namespace: production
spec:
  type: state.gcp.firestore
  version: v1
  metadata:
    - name: project_id
      value: "my-gcp-project"
    - name: type
      value: "service_account"
    - name: private_key_id
      secretKeyRef:
        name: gcp-credentials
        key: private-key-id
 
---
# Pub/Sub component - abstracted from cloud specifics
apiVersion: dapr.io/v1alpha1
kind: Component
metadata:
  name: pubsub
  namespace: production
spec:
  type: pubsub.kafka  # Or pubsub.aws.snssqs, pubsub.gcp.pubsub
  version: v1
  metadata:
    - name: brokers
      value: "kafka-cluster.production.svc:9092"
    - name: consumerGroup
      value: "order-service"
 
---
# Application code is cloud-agnostic
# Just calls Dapr sidecar HTTP/gRPC API
 
# curl http://localhost:3500/v1.0/state/statestore -X POST -d '[{"key":"id","value":"data"}]'
# curl http://localhost:3500/v1.0/publish/pubsub/orders -X POST -d '{"orderId":"123"}'