search

ngrok / kubernetes-ingress-controller

The official ngrok Ingress Controller for Kubernetes
https://ngrok.com
MIT License
183 stars 20 forks source link

Can I expose the k8s control plane itself? #307

Closed russorat closed 8 months ago

russorat commented 9 months ago

Description

My main question is this, the ingress controller is great for exposing a Kubernetes service, but is there a clean/recommended way to expose the control plane itself? Ideally, I'd love to run kubectl commands outside of my home network on my home cluster, using ngrok. Also would love to deploy to my home cluster with a CICD tool like CircleCI. If you have some time, please let me know your thoughts. Again, thanks for the service!

Use Case

No response

Related issues

No response

jrobsonchase commented 9 months ago

I've managed to get this working with a TLS edge and the following tunnel resource definition:

apiVersion: ingress.k8s.ngrok.com/v1alpha1
kind: Tunnel
metadata:
  finalizers:
  - k8s.ngrok.com/finalizer
  name: k8s-control
  namespace: ngrok-ingress-controller
  resourceVersion: "900"
spec:
  backend:
    protocol: TCP
  forwardsTo: kubernetes.default.svc:443
  labels:
    edge: k8s-control # replace with your label as needed

The TLS edge needs to have TLS termination set to "pass through", since mutual tls is generally how clients are authenticated:

2023-10-04-124405_1141x330_scrot

and you need to tell kubectl to skip verification of the server certificate via either the insecure-skip-tls-verify cluster setting in the kubeconfig file, or via the --insecure-skip-tls-verify cli option. This is because the server certificate common name won't match the ngrok domain that the client connects to.

jrobsonchase commented 8 months ago

This is soon to get even easier with first-class TLS edge support. Stay tuned!

CK-Ward commented 8 months ago

TLS Edge support is complete.