You should post a link to your article in the community blog post section of the external-dns GitHub readme https://github.com/kubernetes-sigs/external-dns
Kubernetes, ingress-Nginx, cert-manager and external-DNS
11–20 of 25 posts
Re: Kubernetes, ingress-Nginx, cert-manager and external-DNS
#12Why is Kubernetes so absurdly complicated? The notion that you need an 'ingress' pod AND an external load-balancer, just to be able to respond to internet traffic - and not even all internet traffic (only HTTPS) - is truly staggering. Is this honestly the best ops solution we can come up? Setting up k8s reminds me of trying to configure Sendmail.
> The notion that you need an 'ingress' pod AND an external load-balancer, just to be able to respond to internet traffic - and not even all internet traffic (only HTTPS) - is truly staggering. If you are on a cloud provider, the load balancer abstraction is handled for you by AWS load balancer or Google Compute load balancer so really a non-factor. I own and run a DevOps consulting company[1], and clients of course…
> so really a non-factor.
As long as money is a non-factor, sure. If the idea is "just pay the cloudy tax" then I'd rather be on something like Heroku that actually makes my life easier, not harder.
Re: Kubernetes, ingress-Nginx, cert-manager and external-DNS
#13Earlier quoted context omitted.
> The notion that you need an 'ingress' pod AND an external load-balancer, just to be able to respond to internet traffic - and not even all internet traffic (only HTTPS) - is truly staggering. If you are on a cloud provider, the load balancer abstraction is handled for you by AWS load balancer or Google Compute load balancer so really a non-factor. I own and run a DevOps consulting company[1], and clients of course…
> so really a non-factor. As long as money is a non-factor, sure. If the idea is "just pay the cloudy tax" then I'd rather be on something like Heroku that actually makes my life easier, not harder.
Ok, then just use a single cloud load balancer which points to Traefik running inside Kubernetes. Then you can run as many deployments / containers behind it as you wish.
Re: Kubernetes, ingress-Nginx, cert-manager and external-DNS
#14Earlier quoted context omitted.
> so really a non-factor. As long as money is a non-factor, sure. If the idea is "just pay the cloudy tax" then I'd rather be on something like Heroku that actually makes my life easier, not harder.
Ok, then just use a single cloud load balancer which points to Traefik running inside Kubernetes. Then you can run as many deployments / containers behind it as you wish.
Yeah, that's what I said: you need a load balancer, and traefik (or one of a dozen other ingress things that do basically the same thing - have fun choosing) just to be able to respond to HTTPS requests.
Re: Kubernetes, ingress-Nginx, cert-manager and external-DNS
#15I always hope to see cost as part of these types of articles. If I'm not mistaken, they just set up $200+/mo minimum in services. Or at least document how to tear them down if someone is just following along to experiment.
I've added a Discussion section that provides information on cost and how to tear things down.
Re: Kubernetes, ingress-Nginx, cert-manager and external-DNS
#16Question to those that use GCP/AWS and cert-manager....why not use a managed certificates service that both now offer? I found cert-manager to be the biggest pain point in my cluster (albeit this was 18 months ago)
I've added some information on why we made the choices we did in the Discussion section. Briefly, the GCP managed certs are only available with the native GKE load balancer solution. For costs reasons, we use nginx-ingress rather than the native solution.
Re: Kubernetes, ingress-Nginx, cert-manager and external-DNS
#17Why is Kubernetes so absurdly complicated? The notion that you need an 'ingress' pod AND an external load-balancer, just to be able to respond to internet traffic - and not even all internet traffic (only HTTPS) - is truly staggering. Is this honestly the best ops solution we can come up? Setting up k8s reminds me of trying to configure Sendmail.
There's a lot of stuff in this thread. I've addressed some of them briefly by adding a Discussion section to the post. I'll go into a bit more depth here.
It is important to identity where the complexity is coming from. The post describes how to spin up various resources in a common IaaS provider. Does it appear complicated? Well, everything is relative. Is what is described in the post more or less complicated than purchasing physical servers, racking them, networking them, installing an operating system, configuring the servers, configuring the services running on those services, setting up and configuring a firewall, configuring a network proxy, managing access to theses components, etc.? We've not even gotten to anything Kubernetes-specific here. The complexity is there, we are really just talking about how and where the complexity manifests itself. If you aren't managing a lot of services with distinct requirements, you can avoid complexity by using a more "concierge" application service like Heroku, Elastic Beanstalk, App Engine, or Firebase. The trade-off is less control over the environment and increased costs at scale, i.e., running one service is cheaper on these app services, running 100 will be more expensive.
If you decide you do need flexibility or your scale is such that Kubernetes makes sense, then be aware that the complexity is not in Kubernetes requirements for running an application. The complexity comes from the inherent complexities in running an application and the overhead in mapping common application requirements to the Kubernetes application model. Things like load balancers, TLS certificates, and DNS are part of the former and will be part of any solution. You must mentally map how you have traditionally managed applications to the Kubernetes concepts of deployments, pods, services, and ingresses. This can be challenging and confusing. Other runtime platforms, e.g., Docker Swarm, Cloud Foundry, and Mesos, have similar concepts and require similar mental effort. The reason that Kubernetes has won the open source platform competition is because its application model solves a large number of use cases, its abstractions provide an excellent balance between granularity, complexity, & flexibility, and it provides a platform upon which higher-order, i.e., simplified or "rolled-up", solutions can be created. Your relative familiarity and comfort with other runtime solutions should not cloud your judgement about which is best, and any consideration of best must consider more than just perceived "complexity".
Re: Kubernetes, ingress-Nginx, cert-manager and external-DNS
#18Why is Kubernetes so absurdly complicated? The notion that you need an 'ingress' pod AND an external load-balancer, just to be able to respond to internet traffic - and not even all internet traffic (only HTTPS) - is truly staggering. Is this honestly the best ops solution we can come up? Setting up k8s reminds me of trying to configure Sendmail.
It is complicated. This article doesn't explain things conceptually... it's more copy-and-paste and very GCP specific. It also doesn't explain how to use any of the stuff you set up, like cert-manager or the ingress. How about a sample app deployment? Also, you don't "need" an ingress if you just want to expose a single service. A service can use a load balancer directly. You don't need an "external" load balancer: y…
While certain aspects of the article are GCP specific, part of the motivation of using ingress-nginx and cert-manager is to make the solution more generically applicable to _any_ Kubernetes cluster. The specific commands used to spin up the infrastructure, the workload identity configuration so cert-manager and external-dns can manage DNS records, and the specific configuration of external-dns are specific to this implementation, but the concepts and approach are generally applicable.
There are many resources already available explaining how to deploy applications to Kubernetes. I don't think this article would be significantly enhanced by adding another example of that. I have added some links to other tutorials if people are interested.
While it is true that ingresses are not required, they do provide a useful abstraction, can afford significant cost savings, and can improve security over load balancer services. I would recommend becoming familiar with them and using them.
Re: Kubernetes, ingress-Nginx, cert-manager and external-DNS
#19Earlier quoted context omitted.
Ok, then just use a single cloud load balancer which points to Traefik running inside Kubernetes. Then you can run as many deployments / containers behind it as you wish.
Yeah, that's what I said: you need a load balancer, and traefik (or one of a dozen other ingress things that do basically the same thing - have fun choosing) just to be able to respond to HTTPS requests.
I've added some discussion/clarification of these issues in the post and addressed the issues in more detail in another comment: https://news.ycombinator.com/item?id=24224189 .
Re: Kubernetes, ingress-Nginx, cert-manager and external-DNS
#20Why is Kubernetes so absurdly complicated? The notion that you need an 'ingress' pod AND an external load-balancer, just to be able to respond to internet traffic - and not even all internet traffic (only HTTPS) - is truly staggering. Is this honestly the best ops solution we can come up? Setting up k8s reminds me of trying to configure Sendmail.
There's a lot of stuff in this thread. I've addressed some of them briefly by adding a Discussion section to the post. I'll go into a bit more depth here. It is important to identity where the complexity is coming from. The post describes how to spin up various resources in a common IaaS provider. Does it appear complicated? Well, everything is relative. Is what is described in the post more or less complicated than…
For a contrary perspective: https://www.youtube.com/watch?v=GkmyNBUugg8
"I don't like non-essential complexity, and as far as I can tell, Kubernetes is deliberate complexity."