k8s/baseline
k8s/baseline
3
0
Fork 0
Code Issues 1 Pull requests Releases Activity
No description
23 commits 1 branch 0 tags 403 KiB
Python 49%
Jsonnet 48.5%
Shell 2.5%
Find a file
Sebastian Mark 3f6b557c26 FEAT: re-enable and configure alertmanager 
* disable components for k3s
* mute Watchdog alert
* configure pushover

reverts 96ffe5f
2022-02-17 08:14:34 +01:00
files FEAT: replace bitnami prometheus/grafana chart with prometheus-community 2021-12-05 00:21:31 +01:00
vars FEAT: re-enable and configure alertmanager 2022-02-17 08:14:34 +01:00
baseline.yml FEAT: more compact helm chart definition 2022-02-07 10:57:09 +01:00
INSTALL.md DOC: re-enable metrics component for k3s install 2022-02-07 22:43:39 +01:00
logo.png FEAT: add logo 2021-11-30 14:49:29 +01:00
README.md DOC: add fix for missing ingress-nginx servicemonitor 2022-02-06 15:43:50 +01:00

README.md

Kubernetes Baseline

Notes

ingress-nginx servicemonitor

For unknown reasons the servicemonitor is not create on helm install and therefore no metrics will be scraped by prometheus. Use helm upgrade -n ingress-nginx ingress-nginx ingress-nginx/ingress-nginx to force an update of t the release.

Linode

PROXY protocol needs to be enabled for ingress-nginx to see the clients IP in ingress log.

Add the PROXY protocol annotation to the ingress-nginx service:

annotations:
    service.beta.kubernetes.io/linode-loadbalancer-proxy-protocol: v2

Update the ingress-nginx ConfigMap to make nginx expect PROXY protocol data:

data:
  use-proxy-protocol: "true"

cert-manager

However, when you have the PROXY protocol enabled, the external load balancer does modify the traffic, prepending the PROXY line before each TCP connection. If you connect directly to the web server internally, bypassing the external load balancer, then it will receive traffic without the PROXY line.

This is particularly a problem when using cert-manager for provisioning SSL certificates.

After enabling the PROXY protocol cert-manager is unable to perform a self check ("propagation check failed", "failed to perform self check GET request").

hairpin-proxy adds PROXY protocol support for internal-to-LoadBalancer traffic for Kubernetes Ingress users, specifically for cert-manager self-checks (no further configuration needed).