Kubernetes on paper.archive

kubernetes cert-manager

Wed, 13 May 2020 11:18:00 +0000

A nice.. module that helps you serve https on an ingress in kubernetes.

Installing cert manager (1)

Reference https://cert-manager.io/docs/installation/kubernetes/

1
2

kubectl create namespace cert-manager
kubectl apply --validate=false -f https://github.com/jetstack/cert-manager/releases/download/v0.13.1/cert-manager.yaml

Installing cert manager (with helm)

$ kubectl apply --validate=false -f https://raw.githubusercontent.com/jetstack/cert-manager/v0.13.1/deploy/manifests/00-crds.yaml
$ kubectl create namespace cert-manager
$ helm repo add jetstack https://charts.jetstack.io
$ helm repo update

# Helm v3+
$ helm install \
  cert-manager jetstack/cert-manager \
  --namespace cert-manager \
  --version v0.13.1

# Helm v2
$ helm install \
  --name cert-manager \
  --namespace cert-manager \
  --version v0.13.1 \
  jetstack/cert-manager

Verify the install

`1`	`kubectl get pods --namespace cert-manager`

Honestly I just followed https://cert-manager.io/docs/installation/kubernetes/ as-is.
The important parts: staging and prod are separate, and Issuer and ClusterIssuer are different things. An Issuer can’t issue across namespaces, so use ClusterIssuer if you can.
Use staging only to test your setup. Once it works, switch to prod to get a real certificate.

cert manager issuser example

Replace email: test@test.com with a real email
Nothing else really needs touching.

apiVersion: cert-manager.io/v1alpha2
kind: ClusterIssuer
metadata:
  name: letsencrypt-staging
spec:
  acme:
    # The ACME server URL
    server: https://acme-staging-v02.api.letsencrypt.org/directory
    # Email address used for ACME registration
    email: test@test.com
    # Name of a secret used to store the ACME account private key
    privateKeySecretRef:
      name: letsencrypt-staging
    # Enable the HTTP-01 challenge provider
    solvers:
    # An empty 'selector' means that this solver matches all domains
    - selector: {}
      http01:
        ingress:
          class: nginx

---
apiVersion: cert-manager.io/v1alpha2
kind: ClusterIssuer
metadata:
  name: letsencrypt-prod
spec:
  acme:
    # The ACME server URL
    server: https://acme-v02.api.letsencrypt.org/directory
    # Email address used for ACME registration
    email: test@test.com
    # Name of a secret used to store the ACME account private key
    privateKeySecretRef:
      name: letsencrypt-prod
    # Enable the HTTP-01 challenge provider
    solvers:
    - http01:
        ingress:
          class: nginx

Applying it to kubernetes-dashboard

Replace the www.test.com; part with the domain you want.
Once the issuance test passes, change

cert-manager.io/cluster-issuer: "letsencrypt-staging"

kubernetes glusterfs integration

Wed, 13 May 2020 11:18:00 +0000

Trying to install glusterfs-kubernetes

Open gluster-kubernetes/deploy/gk-deploy and fix the line below (it uses an argument that was removed from kubectl)

1
2
3

# deprecated "--show-all" parameter
#heketi_pod=$(${CLI} get pod --no-headers --show-all --selector="heketi" | awk '{print $1}')
heketi_pod=$(${CLI} get pod --no-headers --selector="heketi" | awk '{print $1}')

# daemonset을 설치하기 위해
# 노드별로 아래 경로를 비워야함
rm -rf /var/lib/misc/glusterfsd /var/lib/glusterd /var/log/glusterfs /etc/glusterfs /var/lib/heketi

#uninstall
./gk-deploy -g --user-key userkey --admin-key adminkey -n glusterfs --abort

#install
./gk-deploy -g --user-key userkey --admin-key adminkey -n glusterfs

When adding a new glusterfs node, edit topology.json and

`1`	`heketi-cli topology load --json=to.json --user admin --secret adminkey`

1
2

디스크 확인
lsblk

lvm help

kubernetes ingress - proxying to a specific url

Wed, 13 May 2020 11:18:00 +0000

When the ingress is exposed externally but the server handling it is not a service inside kubernetes but a separate external server, set proxy_pass like below. (Really, if you get creative, anything nginx supports should work.)

kind: Ingress
apiVersion: extensions/v1beta1
metadata:
  name: gitlab.test.com
  namespace: nginx-ingress
  annotations:
    kubernetes.io/ingress.class: nginx
    nginx.ingress.kubernetes.io/proxy-connect-timeout: '3600'
    nginx.ingress.kubernetes.io/proxy-read-timeout: '3600'
    nginx.ingress.kubernetes.io/proxy-send-timeout: '3600'
    nginx.ingress.kubernetes.io/send-timeout: '3600'
    nginx.ingress.kubernetes.io/server-snippet: |
      location ~ / {
         proxy_pass http://10.10.10.101:8084;
      }
spec:
  rules:
    - host: gitlab.test.com
      http:
        paths:
          - path: /
            backend:
              serviceName: nginx-ingress-default-backend
              servicePort: 8080
status:
  loadBalancer:
    ingress:
      - {}

The serviceName above is not a real service, it’s a dummy.
The annotations are added because of websockets. (Not needed if you don’t use websockets)

    nginx.ingress.kubernetes.io/proxy-connect-timeout: '3600'
    nginx.ingress.kubernetes.io/proxy-read-timeout: '3600'
    nginx.ingress.kubernetes.io/proxy-send-timeout: '3600'
    nginx.ingress.kubernetes.io/send-timeout: '3600'