#kubernetes (2019-08)

I’m still explaining that to folks in my org. Every few weeks; lets switch providers b/c we won’t have much work

#vault

Joel Speed from Pusher did a good KubeCon video on what they do with oauth2_proxy, Dex and dashboard

thank you foor the tip!

@Erik Osterman (Cloud Posse) but why?

and how do we have to treat? what’s the best way to do this? i think he meant that if you are on this level you are already accommodated…

kelsey has a theme going on right now to remove some of the sugar coating around kubernetes. it’s been touted up as this magical container platform that solve all our problems. the reality is that like any other piece of software you run, there are tradeoffs. one of the common best practices is to toss traditional DR out the window; no more treating servers (and services) as “pets”, instead treat them as cattle. the crude analogy is with cattle is if they get sick you put them down rather than spend thousands at the vet making them well again. with servers, it’s a little less crude. terminate them and move on. kubernetes makes that very easy, however, there’s still an operator responsible for kubernetes. it’s not “serverless”. So like the Rancher responsible for the cattle, we are in the end responsible the cluster. Not everything will be fully automated in an unattended fashion (or should be).

Been testing that recently

Fairly mixed results in terms of predictably, at least on my side thus far

I had planned to focus on building in support for automated https://github.com/heptio/velero as a fall back plan

Though mit something I will be able to focus on, at least in the current company I’m at

Null resource local exec, with a life cycle hook for destroy

00.00.00.00 - [00.00.00.00] - - [27/Aug/2019:23:58:28 +0000] "PROXY TCP4 00.00.00.00 00.00.00.00 44782 30226" 400 163 "-" "-" 0 0.000 [] [] - - - -...

(edited out the ip addresses)

this is the ingress config:

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  annotations:
    external-dns.alpha.kubernetes.io/hostname: foo.bar
    kubernetes.io/ingress.class: nginx
    nginx.ingress.kubernetes.io/backend-protocol: GRPC
    nginx.ingress.kubernetes.io/ssl-redirect: "true"
    service.beta.kubernetes.io/aws-load-balancer-internal: "true"
    service.beta.kubernetes.io/aws-load-balancer-ssl-cert: foo
  creationTimestamp: "2019-08-27T23:52:59Z"
  generation: 1
  labels:
    service: thanos-sidecar
  name: thanos-sidecar
  namespace: monitoring
  resourceVersion: "foo"
  selfLink: /apis/extensions/v1beta1/namespaces/monitoring/ingresses/thanos-sidecar
  uid: foo
spec:
  rules:
  - host: foo.bar
    http:
      paths:
      - backend:
          serviceName: thanos-sidecar
          servicePort: grpc
status:
  loadBalancer:
    ingress:
    - hostname: foo.bar

Enabled TLS and still getting 400 errors