Its TLS and not SSL. Its TLS for a long time now...
And yes be aware that through this, it works fine but you are also exposing your internal infrastructure details through dns.
I'm not seeing a big issue, just be aware of it.
Automatic SSL Certificates for internal IP's for home k8 setup using LetsEncrypt
21–30 of 94 posts
Re: Automatic SSL Certificates for internal IP's for home k8 setup using LetsEncrypt
#22Instead of using hacky fragile methods , use
https://github.com/FiloSottile/mkcert
to automate setting up local CA and making it trusted.
Re: Automatic SSL Certificates for internal IP's for home k8 setup using LetsEncrypt
#23split dns is typically the solution for this, is it not?
Re: Automatic SSL Certificates for internal IP's for home k8 setup using LetsEncrypt
#24I’ve tried to set up kubernetes at home a couple of times and I always freak out at the amount of layers and “just run this” style of tutorials. Am I crazy? I’ve heard guix has some kind of container management thing. I’ve been thinking about trying it anyway.
Ubuntu with Microk8s is very simple. Basically a few lines of commands, well documented and addons exist as well for most use cases.
MetalLB for your loadbalancing needs, prometheus/grafana etc.
And microk8s supports multiply nodes now as well.
Re: Automatic SSL Certificates for internal IP's for home k8 setup using LetsEncrypt
#25[deleted]
Re: Automatic SSL Certificates for internal IP's for home k8 setup using LetsEncrypt
#26Earlier quoted context omitted.
You'd actually end up with a 'split horizon' setup wherein LetsEncrypt (and the public) see those DNS names with the external gateway's IP and ping that for the validation files. Your options at that point are a central 'well known' directory that different hosts can write to (I recommend sshfs), different directories on one host that are checked for any valid file in any of them (by default) or by hostname match in…
In this case, I don’t think there is a gateway involved at all. I believe Let’s encrypt is verifying the authors domains by (essentially) querying their selected DNS provider to prove ownership over a domain, which resolved to a private IP. So iiuc there is no split horizon, it’s just that the sites would only work for the author.
I think you are half correct. The gateway has nothing to do with verifying the file during a DNS challenge. However, the IP of the machine requesting the cert IS saved with that cert information and made public. Let's encrypt will even warn you during the verification process.
Re: Automatic SSL Certificates for internal IP's for home k8 setup using LetsEncrypt
#27I’ve tried to set up kubernetes at home a couple of times and I always freak out at the amount of layers and “just run this” style of tutorials. Am I crazy? I’ve heard guix has some kind of container management thing. I’ve been thinking about trying it anyway.
k8s needs a control plane, that needs security, hence all the tokens, certs (which need internal and external IPs and FQDNs), also it needs to set up an overlay network (so you need to configure the CNI provider, sysctl stuff for ebtables and iptables/nftables to work correctly), and DNS, and a dashboard would be nice too. oh, and unless you use k3s or something that budles a container runtime (CRI provider) you need to setup one (eg docker).
it's understandably complex, even if many parts are pretty standard (eg. the sysctl stuff, and installing dependencies is basically dnf/yum/apt/apk or exit and let the user do it).
since the most error prone parts were/are setting up the TLS stuff that got automated first (in the form of kubeadm install), and the rest just remains in "run this" form.
but the k3s installer is just a one liner call to a bash script. though then you have to make sure to include the magic env vars to get what you want.
Re: Automatic SSL Certificates for internal IP's for home k8 setup using LetsEncrypt
#28Instead of using hacky fragile methods , use https://github.com/FiloSottile/mkcert to automate setting up local CA and making it trusted.
mkcert may work fine if you're the only person using those network resources on a single machine, ever. Otherwise you've just traded yourself a trust management problem: Now you need to secure the key of that CA and distribute the CA certificate to all devices that should be trusting it. This may or may not be trivial.
The fundamental problem is that this CA that you generated gets basically the same trust level as a public CA, but it's just sitting there on your machine. An attacker could use it to generate certificates for almost every site and your devices would trust them. That's probably ok if only your machine trusts that CA since if the attacker rooted your box to the point that they gained access to that CA key, all is lost anyways. In a network with other devices - maybe even not under your direct control - that tradeoff looks substantially different.
Re: Automatic SSL Certificates for internal IP's for home k8 setup using LetsEncrypt
#29It's not a certificate for internal ip address, it's a certificate for host name. Ip address is irrelevant here.
Re: Automatic SSL Certificates for internal IP's for home k8 setup using LetsEncrypt
#30I’ve tried to set up kubernetes at home a couple of times and I always freak out at the amount of layers and “just run this” style of tutorials. Am I crazy? I’ve heard guix has some kind of container management thing. I’ve been thinking about trying it anyway.
"Kubernetes at home" called "Docker Swarm".
I've been using it couple of years for many types of workloads and it's been a pleasant experience.
Ansible + docker-compose.yml to manage apps on 1-3 servers. You just install docker and that's it. Swarm configuration is 95% similar to compose file you use locally if you're into developing with Docker.
It has couple of edges if you try to use it for complex setups but for apps with < 5 devs and < 10 services it's really simple. You can still migrate to K8s when you hire dedicated DevOps team because you're running containers and all your setup documented in docker-compose file.