Should use https://github.com/kubernetes/kubernetes/tree/master/cluster/addons/dns and setup DNS, accessible from both inside and outside the pods.
Description
Description
| Status | Subtype | Assigned | Task | ||
|---|---|---|---|---|---|
| Restricted Task | |||||
| Resolved | Bstorm | T246122 Upgrade the Toolforge Kubernetes cluster to v1.16 | |||
| Restricted Task | |||||
| Resolved | • bd808 | T232536 Toolforge Kubernetes internal API down, causing `webservice` and other tooling to fail | |||
| Resolved | Bstorm | T236565 "tools" Cloud VPS project jessie deprecation | |||
| Resolved | aborrero | T101651 Set up toolsbeta more fully to help make testing easier | |||
| Resolved | Bstorm | T166949 Homedir/UID info breaks after a while in Tools Kubernetes (can't read replica.my.cnf) | |||
| Resolved | Bstorm | T246059 Add admin account creation to maintain-kubeusers | |||
| Resolved | Bstorm | T154504 Make webservice backend default to kubernetes | |||
| Declined | None | T245230 Investigate cpu/ram requests and limits for DaemonSets pods | |||
| Resolved | Bstorm | T214513 Deploy and migrate tools to a Kubernetes v1.15 or newer cluster | |||
| Resolved | yuvipanda | T111885 Initial Deployment of Kubernetes to Tool Labs | |||
| Resolved | Bstorm | T111914 Setup DNS for kubernetes services |
Event Timeline
Comment Actions
Our test cluster's DNS ran into https://github.com/kubernetes/kubernetes/issues/2996 - let's see how this one fares!
Comment Actions
Also need to decide if we're ok using their pre-built images or want to build our own.
Comment Actions
Since the primary use case for this is T111916, and there are alternatives there, we could skip this for the initial setup.
Comment Actions
We need to somehow mount the ca cert from the host to the pods and it'll be all good.
Comment Actions
x509: cannot validate certificate for 192.168.0.1 because it doesn't contain any IP SANs
because kube2sky attempts to contact kubernetes via the IP that's made available via the environment variable, but that's ofcourse not part of the SAN for the SSL certificate that's issued to that...
Comment Actions
This is effectively done in the new cluster which uses CoreDNS throughout. It is not accessible outside the cluster, but it really shouldn't be as currently designed unless we make the decision to start peering Calico up the stack.