Kubernetes, ingress-Nginx, cert-manager and external-DNS
blog.atomist.com
Kubernetes, ingress-Nginx, cert-manager and external-DNS
1–10 of 25 posts
Re: Kubernetes, ingress-Nginx, cert-manager and external-DNS
#2Why is Kubernetes so absurdly complicated? The notion that you need an 'ingress' pod AND an external load-balancer, just to be able to respond to internet traffic - and not even all internet traffic (only HTTPS) - is truly staggering.
Is this honestly the best ops solution we can come up?
Setting up k8s reminds me of trying to configure Sendmail.
Re: Kubernetes, ingress-Nginx, cert-manager and external-DNS
#3Why is Kubernetes so absurdly complicated? The notion that you need an 'ingress' pod AND an external load-balancer, just to be able to respond to internet traffic - and not even all internet traffic (only HTTPS) - is truly staggering. Is this honestly the best ops solution we can come up? Setting up k8s reminds me of trying to configure Sendmail.
My 2 cents is that Kubernetes introduced a very powerful lifecycle for operating workloads that has enabled the automation of a wide variety of tasks.
But the abstractions are still relatively low level. The Ingress API in particular is a known issue and currently being simplified.
Re: Kubernetes, ingress-Nginx, cert-manager and external-DNS
#4Why is Kubernetes so absurdly complicated? The notion that you need an 'ingress' pod AND an external load-balancer, just to be able to respond to internet traffic - and not even all internet traffic (only HTTPS) - is truly staggering. Is this honestly the best ops solution we can come up? Setting up k8s reminds me of trying to configure Sendmail.
I see kube as providing a set of tools. These are plugable built-in functionalities that you can use to make a functioning application. I think the problem is that it is common to configure these directly, often with unpowerful languages like yaml.
I think they are a great set of tools. However it seems like there should be more framework on top of them to make it an easy user experience. You can argue that this is what Google has done with Cloud Run. They put a simple "run an image exposed to the internet" interface built ontop of the kube foundation.
Re: Kubernetes, ingress-Nginx, cert-manager and external-DNS
#5Why is Kubernetes so absurdly complicated? The notion that you need an 'ingress' pod AND an external load-balancer, just to be able to respond to internet traffic - and not even all internet traffic (only HTTPS) - is truly staggering. Is this honestly the best ops solution we can come up? Setting up k8s reminds me of trying to configure Sendmail.
It's not Kubernetes that's complicated (although it's not exactly simple) the arcane and neolithic processes surrounding DNS and certificate management are the real issue IMO. Both technologies born from an era of static infrastructure and use cases that no longer apply.
No one has come up with alternatives, so we're left to deal with best we can
Re: Kubernetes, ingress-Nginx, cert-manager and external-DNS
#6I always hope to see cost as part of these types of articles. If I'm not mistaken, they just set up $200+/mo minimum in services.
Or at least document how to tear them down if someone is just following along to experiment.
Re: Kubernetes, ingress-Nginx, cert-manager and external-DNS
#7Why is Kubernetes so absurdly complicated? The notion that you need an 'ingress' pod AND an external load-balancer, just to be able to respond to internet traffic - and not even all internet traffic (only HTTPS) - is truly staggering. Is this honestly the best ops solution we can come up? Setting up k8s reminds me of trying to configure Sendmail.
It is complicated. This article doesn't explain things conceptually... it's more copy-and-paste and very GCP specific. It also doesn't explain how to use any of the stuff you set up, like cert-manager or the ingress. How about a sample app deployment?
Also, you don't "need" an ingress if you just want to expose a single service. A service can use a load balancer directly.
You don't need an "external" load balancer: you can use MetalLB.
Re: Kubernetes, ingress-Nginx, cert-manager and external-DNS
#8Why is Kubernetes so absurdly complicated? The notion that you need an 'ingress' pod AND an external load-balancer, just to be able to respond to internet traffic - and not even all internet traffic (only HTTPS) - is truly staggering. Is this honestly the best ops solution we can come up? Setting up k8s reminds me of trying to configure Sendmail.
> The notion that you need an 'ingress' pod AND an external load-balancer, just to be able to respond to internet traffic - and not even all internet traffic (only HTTPS) - is truly staggering.
If you are on a cloud provider, the load balancer abstraction is handled for you by AWS load balancer or Google Compute load balancer so really a non-factor.
I own and run a DevOps consulting company[1], and clients of course want to deploy their software on-prem which becomes significantly harder and more time consuming. Personally, I use MetalLB[2] by the folks at Google which creates a LoadBalancer abstraction and then use Traefik[3] in front of all deployments (containers). Traefik handles creating the SSL certificates using Let's Encrypt either via http or DNS challenge. The benefit here is only a single LoadBalancer is created pointing to Traefik, and then Traefik terminates https and routes to all the deployments (containers).
[1] https://elasticbyte.net [2] https://metallb.universe.tf/ [3] https://containo.us/traefik/
Re: Kubernetes, ingress-Nginx, cert-manager and external-DNS
#9Why is Kubernetes so absurdly complicated? The notion that you need an 'ingress' pod AND an external load-balancer, just to be able to respond to internet traffic - and not even all internet traffic (only HTTPS) - is truly staggering. Is this honestly the best ops solution we can come up? Setting up k8s reminds me of trying to configure Sendmail.
Last year I worked on deploying docker swarm clusters on prem for a client (their request). I loved how simple it was and yet how much you can tailor it, with additional services like traefik, prometheus, etc etc.
Months into the project and we learned how they are obsoleting it to focus on kube. I was devastated. We had a simple yet effective way of deploying clusters, and now we would need entire teams of CKA just to understand what is going on operationally.
I quit the project eventually, but I think they are just going back to VMs + ansible.
Re: Kubernetes, ingress-Nginx, cert-manager and external-DNS
#10Question to those that use GCP/AWS and cert-manager....why not use a managed certificates service that both now offer? I found cert-manager to be the biggest pain point in my cluster (albeit this was 18 months ago)