Let’s Encrypt, OAuth 2, and Kubernetes Ingress
eng.fromatob.com
Let’s Encrypt, OAuth 2, and Kubernetes Ingress
1–10 of 31 posts
Re: Let’s Encrypt, OAuth 2, and Kubernetes Ingress
#2That's cool, I've done pretty much the same thing for our internal services. I noticed you use the github org for oauth2proxy.
In our setup, I wanted to add authentication to a few dozen sub domains, but use a single oauth2proxy instance. Github Oauth makes this kind of gross, the callback must point to the same subdomain you're trying to authenticate. But it does allow something like /oauth2/callback/route.to.this.instead
In the end, to achieve what I wanted (a single oauth2proxy for multiple internal services) I had to - fork oauth2proxy and make a few small changes to the redirect-url implementation - create a small service with takes oauth.acme.co/oauth2/callback/subdomain.acme.co and redirects to subdomain.acme.co to comply with GitHub' oauth requirements - created a small reverse proxy in Go which does something similar to nginx_auth_request. I had a few specific reasons to do this (like proxying websockets and supporting JWT directly) https://gist.github.com/groob/ea563ea1f3092449cd75eeb78213cd...
I hope that someone ends up writing a k8s ingress controller specific to this use case.
Re: Let’s Encrypt, OAuth 2, and Kubernetes Ingress
#3That's cool, I've done pretty much the same thing for our internal services. I noticed you use the github org for oauth2proxy. In our setup, I wanted to add authentication to a few dozen sub domains, but use a single oauth2proxy instance. Github Oauth makes this kind of gross, the callback must point to the same subdomain you're trying to authenticate. But it does allow something like /oauth2/callback/route.to.this.i…
Please check https://github.com/kubernetes/ingress/pull/190
Re: Let’s Encrypt, OAuth 2, and Kubernetes Ingress
#4That's cool, I've done pretty much the same thing for our internal services. I noticed you use the github org for oauth2proxy. In our setup, I wanted to add authentication to a few dozen sub domains, but use a single oauth2proxy instance. Github Oauth makes this kind of gross, the callback must point to the same subdomain you're trying to authenticate. But it does allow something like /oauth2/callback/route.to.this.i…
Please check https://github.com/kubernetes/ingress/pull/190
Very nice! I remember talking with you regarding some of this in k8s slack when I was trying to figure out how to wire it all up.
Thank you for all the work you do on the ingress project by the way.
Re: Let’s Encrypt, OAuth 2, and Kubernetes Ingress
#5Discovered kube-lego via Google a few weeks ago and I am really excited to try it with my next product. Thanks for this post.
Re: Let’s Encrypt, OAuth 2, and Kubernetes Ingress
#6Question for the author: We just migrated some stuff to GCP as well but do not use kubernetes. For managing infrasructure we only use packer, bash, and google cloud deployment yaml files (similar to the kubernetes manifest).
Why do you still need saltstack and how do you find terraform? Why do you need terraform (I suppose it is for your non kubernetes infrastructure?)?
Re: Let’s Encrypt, OAuth 2, and Kubernetes Ingress
#7Question for the author: We just migrated some stuff to GCP as well but do not use kubernetes. For managing infrasructure we only use packer, bash, and google cloud deployment yaml files (similar to the kubernetes manifest). Why do you still need saltstack and how do you find terraform? Why do you need terraform (I suppose it is for your non kubernetes infrastructure?)?
For the moment at least, it's much more comfortable for us to keep our databases outside of kubernetes, so we use saltstack(masterless), packer, and terraform to manage them. We also use terraform to manage all of our DNS, which is split between Route53 and the GCP DNS service.
Re: Let’s Encrypt, OAuth 2, and Kubernetes Ingress
#8Question for the author: We just migrated some stuff to GCP as well but do not use kubernetes. For managing infrasructure we only use packer, bash, and google cloud deployment yaml files (similar to the kubernetes manifest). Why do you still need saltstack and how do you find terraform? Why do you need terraform (I suppose it is for your non kubernetes infrastructure?)?
For the moment at least, it's much more comfortable for us to keep our databases outside of kubernetes, so we use saltstack(masterless), packer, and terraform to manage them. We also use terraform to manage all of our DNS, which is split between Route53 and the GCP DNS service.
Thanks! I have been meaning to give terraform a try to replace some of our custom gcloud + gcloud deployment descriptors. Also so that we don't need a separate docker compose version for development (I'm assuming in theory you can run terraform to do what docker compose does?).
Re: Let’s Encrypt, OAuth 2, and Kubernetes Ingress
#9Suggestion to anybody reading this: don't use a DaemonSet for this. This really ought to be a Deployment of nginx-ingress resources behind a service exposed as `type: LoadBalancer` (if you're in a cloud-provider that supports LoadBalancer services). Then just create DNS aliases and configure nginx to do session affinity if needed, etc. Not only will it be able to scale with your load instead of cluster size, but you can actually update it in a rolling update already; DaemonSets cannot yet do that.
Really the most important part, though, is that DaemonSets are for services that need to run on each host. Like a log collection service [1] or prometheus node exporter [2].
[1] https://github.com/kubernetes/kubernetes/tree/master/cluster...
Re: Let’s Encrypt, OAuth 2, and Kubernetes Ingress
#10That's impressive but also quite some effort. Feels like premature optimization when looking at the (rather low) traffic of fromAtoB. On the other side, it's always good to have a scalable deployment when dealing with RoR apps.