Notes from episode 10 of TGIK: Ingress with TLS

Over the past few months I’ve been trying to learn everything there is to know about Kubernetes. Kubernetes is an amazing technology for deploying and scaling containers though it comes with a cost. It’s an incredibly complex piece of software and there are a ton of bells and whistles to become familiar with. One way that I’ve found for coming up to speed is Joe Beda’s weekly TGIK live broadcast. This occurs each Friday at 4PM EST and is CHOCK full of fantastic information. In episode ten Joe discusses Ingress and kube-lego. You can watch it here:

Here are some of my takeways from the episode:

• Ingress is an API object that manages external access to one or more services in a cluster.
• API groups are used to break up the API into small units. These units can be extended, deprecated, etc. without impacting other APIs.
• Pod priorities allow you to ensure that pods continue to run at the expense of lower priority pods. Priorities also impact the scheduling order.
• GeoDNS allows you deliver an answer to a questions that takes into account the users location.
• A service type of LoadBalancer is used to configure an external load balancer (e.g., AWS ELB).
• Several ingress controllers are currently available:
  • Nginx
  • HAProxy
  • Heptio’s contour controller
  • Traefik
  • Linkerd
  • Several others
• Ingress controllers take a set of objects and configure the ingress controller. The Ingress controller runs separate from kube-controller-manager.
• You can show labels with the “–show-labels” option:
  $ kubectl get nodes -o wide --show-labels
• Ingress controllers use config maps to publish status. Controllers also perform a leader election so only one controller updates the status.
• Ingress controllers are configured with the service name to forward requests to.
• Ingress rules contain the criteria (e.g., hostname of prefetch.net, URI, etc.) used to forward requests.
• The nginx Ingress controller reads the Ingress objects, translates them to nginx configuration files and then reloads nginx to pick up the changes.
• The nginx Ingress controller is also responsible for starting the nginx daemon processes.
• You can observe the status of an ingress controller with the logs command:
  $ kubectl logs -n kube-system ingress-controller-xxx-xxxx
• The nginx configuration is part of the GitHub ingress-nginx project. Sample configurations can be retreived from the deploy directory.
• The Ingress object is baked into Kubernetes.
• Ingress works across all namespaces.
• The kube-lego project (now known as cert-manager) can be used to automate the installationand renewal of Let’s Encrypt certificates.

Things I need to learn more about:

• Set up an nginx ingress controller.
• Study the objects that are created and how the controller interacts with services.
• Play around with cert-manager to provision Let’s Encrypt certificates.

This article was posted by Matty on 2018-02-16 15:00:00 -0500 -0500