#kubernetes - May 2019 | Slack Archive

kubernetes

56 messages

Archive: https://archive.sweetops.com/kubernetes/

Apr 2019

May 2019

Jun 2019

nutellinoitalmost 7 years ago

@Mark Grube we use Rancher for users permission management in front of EKS

Danalmost 7 years ago

Has anyone made their GKE nodes static with Terraform?

johncblandiialmost 7 years ago

I think I’m missing a step with this new eks cluster. applying the configmap keeps giving me an unauthorized.

The aws-iam-authenticator call is working as expected so I have access, but applying the file does not work

Jeremy G (Cloud Posse)almost 7 years ago

I have a cluster in AWS in 3 availability zones, with 3 masters, but only 2 nodes. kops put both nodes in the same AZ? Is this a bug? How do I get kops to spread the nodes evenly across AZs?

wbrown43almost 7 years ago

@wbrown43 has joined the channel

johncblandiialmost 7 years ago

Is there a clean way to get the security group created for an LB so I can assign it to the workers SG to approve traffic?

Ryan Smithalmost 7 years ago

Dang, how do we get Curtis Mattoon into cloud posse slack? https://github.com/cmattoon/aws-ssm/pull/29

Ryan Smithalmost 7 years ago

This tool works pretty good. But just curious if you peeps have any other methods for dynamically added k8s secrets from SSM

Erik Osterman (Cloud Posse)almost 7 years ago

not from SSM

Erik Osterman (Cloud Posse)almost 7 years ago

have you seen @mumoshu’s ASM operator?

Ryan Smithalmost 7 years ago

nope, I shall take a look-see

Erik Osterman (Cloud Posse)almost 7 years ago

i think extending that to support SSM would be nice

Erik Osterman (Cloud Posse)almost 7 years ago

or creating a separte one

Ryan Smithalmost 7 years ago

https://github.com/mumoshu/aws-secret-operator (for the others in the channel)

Ryan Smithalmost 7 years ago

Why not use AWS SSM Parameter Store as a primary source of secrets?

Pros:

Parameter Store has an efficient API to batch get multiple secrets sharing a same prefix.

Cons:

Its API rate limit is way too low. This has been discussed in several places in the Internet:

Ryan Smithalmost 7 years ago

However, they just updated the rate limit to 1k req/s

Ryan Smithalmost 7 years ago

so it might be a non-issue now

Ryan Smithalmost 7 years ago

Also, you can set the limit and incur costs. Haven't actually clicked this before.. lets see what happens

Ryan Smithalmost 7 years ago

🤷‍♂️

Ryan Smithalmost 7 years ago(edited)

Ohhh, this is how to you get 1k: https://docs.aws.amazon.com/systems-manager/latest/userguide/parameter-store-throughput.html

You can increase the limit to 1,000 TPS on the Settings tab. Increasing the throughput limit incurs a charge on your AWS account.

Ryan Smithalmost 7 years ago

$0.05 per 10,000 Parameter Store API interactions k.. I'll stop spamming

Erik Osterman (Cloud Posse)almost 7 years ago

that's great; didn't know they increased the limit

mumoshualmost 7 years ago(edited)

I thought secretsmanager had the same amount of charge 🤔

Ryan Smithalmost 7 years ago

secretmanager i think is $1/mo/secret. Lemme google a littttle

Ryan Smithalmost 7 years ago

whoops.. $0.40/mo

Ryan Smithalmost 7 years ago

PER SECRET PER MONTH
$0.40 per secret per month. For secrets that are stored for less than a month, the price is prorated (based on the number of hours.)

PER 10,000 API CALLS
$0.05 per 10,000 API calls.

Ryan Smithalmost 7 years ago

🙌

lorenalmost 7 years ago

Also good to cache your secrets, to avoid extra API calls and rate limits... https://aws.amazon.com/about-aws/whats-new/2019/05/Secrets-Manager-Client-Side-Caching-Libraries-in-Python-NET-Go/

Ryan Smithalmost 7 years ago

https://github.com/cmattoon/aws-ssm/pull/30 fixing a bug in aws-ssm if anyone else was considering to use it

Exequiel Barrireroalmost 7 years ago

https://www.sentialabs.io/2018/10/21/Integrating-EKS-with-other-AWS-services.html

Exequiel Barrireroalmost 7 years ago

Exequiel Barrireroalmost 7 years ago(edited)

Interesting approach for -> Deploying API Gateway in front of EKS / K8s Kops Clusters inside VPC private subnets 🤝
And many other useful info about Integrating EKS with other AWS Services 🙂

davidvasandanialmost 7 years ago

https://github.com/containership/konstellate

Vidhi Virmanialmost 7 years ago(edited)

I am trying to setup kubernetes dashboard on AWS EKS cluster. I am able to setup the dashboard but facing a small issue with certs. I want to use aws certificate arn with the dashoard as an argument with command

kubectl apply -f <https://raw.githubusercontent.com/kubernetes/dashboard/v1.10.1/src/deploy/recommended/kubernetes-dashboard.yaml>

is this possible?

nutellinoitalmost 7 years ago

To anyone that is tempted to use t3a or m5a instances on an EKS cluster, don’t

nutellinoitalmost 7 years ago

https://github.com/awslabs/amazon-eks-ami/issues/262

nutellinoitalmost 7 years ago

there is an incompatibility on calculating number of eni available

endofcakealmost 7 years ago

https://reactiveops.com/blog/introducing-polaris-keeping-your-kubernetes-clusters-healthy

timduhenchanteralmost 7 years ago(edited)

Scale on queue depth

https://github.com/kedacore/keda

Issifalmost 7 years ago

https://github.com/reactiveops/polaris

Sandeep Kumaralmost 7 years ago

How do we generate a wildcard certificate using kubernetes kind:managedCertificate, trying with below method but not successful
apiVersion: networking.gke.io/v1beta1
kind: ManagedCertificate
metadata:
name: example-certificate
spec:
domains:
- *.example.net

Please let me know if there is any documentation/suggestions to create a wild card certificate with expiry date mentioned in it

sarkisalmost 7 years ago

^ Polaris looks really interesting... I'm going to try to get it going this weekend see if it's useful... any thoughts on it yet if someones already set it up?

sarkisalmost 7 years ago

Couldn't wait for the weekend testing it now... it offers some nice checks... I can see this becoming more and more useful as more checks/best practices are added ...

James D. Bohrmanalmost 7 years ago

Hey all! I'm having an issue building my example-voting-app with Codefresh.

I added the variable for KUBE_CONTEXT but I keep getting an error that throws:



error: no context exists with the name: "gke_example-voting-app-240610_us-east1-c_example-votin
g-app".                                                                                        
[SYSTEM] Error: Failed to run freestyle step: Running Helm Upgrade; caused by NonZeroExitCodeEr
ror: Container for step title: Running Helm Upgrade, step type: freestyle, operation: Freestyle

James D. Bohrmanalmost 7 years ago

I ran kubectl get context in my GKE shell and got:


gke_example-voting-app-240610_us-east1-c_example-voting-app

James D. Bohrmanalmost 7 years ago

I put that as my KUBE_CONTEXT variable and can't figure what I'm doing wrong.
The docs say to put KUBE_CONTEXT as "Your friendly Kubernetes Cluster Name"
I've also tried "example-voting-app" as the context variable. Which is the EKS cluster name. No dice there either.

aaratnover 6 years ago(edited)

Can anyone help me with aws alb loadbalancer with helm chart ? Any samples that I can refer ?

sarkisover 6 years ago

https://github.com/flant/werf

Pablo Costaover 6 years ago

https://aws.amazon.com/about-aws/whats-new/2019/05/amazon-eks-simplifies-kubernetes-cluster-authentication/

bye bye aws-iam-authenticator

Erik Osterman (Cloud Posse)over 6 years ago

Public/Free Office Hours with Cloud Posse starting now!!

https://zoom.us/j/684901853

btaiover 6 years ago

anyone try federation yet?

Kevin Gimbelover 6 years ago

Hey all, I've a question and I can't seem to find an answer. I'm running an AWS EKS cluster with two Nodes, each Node in EKS has a restriction of 20 Pods per Node. The Nodes are auto scaled and shut down each night and started in the morning since it's just a test / staging system at the moment. However, one Node is always full (20/20 Capacity) while the other runs 4/20. We want to run a DaemonSet with filebeat for log aggregation but cannot ensure it runs on both nodes because one is full.

Is there a way I can (easily) ensure the DaemonSet is scheduled before all other pods? Or can I reserve a spot / space on a Node for a specific Pod, Deployment, or DaemonSet?

Vidhi Virmaniover 6 years ago

Hi all,

Is there anyone who has setup kubernetes dashboard on EKS using istio ingress gateway?
I am facing some issues where my dashboard crash after 4 mins. I am not sure if its a good idea to use istio ingress gateway to run kubernetes-dashboard. Any help is appreciated

Vidhi Virmaniover 6 years ago

It is fixed now. I had to provide few configs in istio

Erik Osterman (Cloud Posse)over 6 years ago

@Vidhi Virmani how are you securing it?

Issifover 6 years ago

https://github.com/claranet/kcs

April 2019 Browse by date June 2019