DeploymentACME API

[AmitKumarDas]

ProblemStatement

Composing a Kubernetes Deployment around ACME

Resources Involved:

• Deployment
• Service
• Ingress
• Issuer
• Certificate

Notes

• If you own a custom domain, you can sign certificates using certbot and then create a DNS record that points to the provisioned NLB DNS name
• ingress-nginx-controller provides an HTTP proxy service supported by your cloud provider’s load balancer
• kubectl get svc -A | grep ingress // ingress kubernetes service is of type LoadBalancer
• External IP is allocated to the ingress controller service
• Assign a DNS Name
  • External IP is the one to which all incoming traffic should be routed
  • To enable this, add it to a DNS zone you control, for example as www.example.com
  • Learn how to assign a DNS entry to an IP address
  • Can be automated as well e.g. via external-dns from k8s.io/sigs
  • Verify the record count e.g. this is w.r.t Route53

References

• https://github.com/thinktecture/ssl-with-cert-manager
• https://cert-manager.io/docs/configuration/acme/
• https://cert-manager.io/docs/faq/
• https://cert-manager.io/docs/usage/ingress/
• https://cert-manager.io/docs/configuration/acme/http01/externalloadbalancer/
• https://aws.amazon.com/blogs/containers/setting-up-end-to-end-tls-encryption-on-amazon-eks-with-the-new-aws-load-balancer-controller/
• https://cert-manager.io/docs/tutorials/acme/ingress/

[AmitKumarDas]

Out Of Scope

• Managing cluster components (Terraform or others can do this)
• Managing Kubernetes operators (Terraform &/ Helm &/ iarc or others can do this)

Design Notes

Persona: Scripter

• clite generate -f deployment.yaml # generates all artifacts based on the annotations found in Deployment

Persona: Operator

• Operator deploys controller-lite image in a Kubernetes cluster
• controller-lite implements DeploymentACME controller
• DeploymentACME controller watches Deployment resource
• DeploymentACME controller applies related ACME resources in the Kubernetes cluster

Persona: Dev

• User supplies a minimal Deployment specs with annotations that triggers resource generation

Development Notes

• Annotations on native Kubernetes resource will be the only way to trigger & manage composition API(s)
• controller-lite binary can be used as a cli
• controller-lite binary can expose several Kubernetes controllers
• controller-lite can be imported as a go library
• Composition controller can be one of the consumers of composition APIs
• Composition controller should only watch native Kubernetes resources e.g. Deployment, StatefulSet, or DaemonSet
• ConfigMaps should not be used
• Templating should not be used
• Annotations will be the only way to provide configuration needs
• New CustomResources will not be defined
• controller-lite binary should expose every composition API & corresponding version as a gated feature

Testing Notes

• Ability to run tests from any machine connected to Kubernetes cluster
• Ability to ship an image that can run the tests from within any Kubernetes cluster
• Tests should be invocable from an end users' environments
• Tests should be provider agnostic
• Tests should certify if composer operator runs without issues in end users' environment
• Tests should help meet the compliance needs of end users
• Tests API should provide the diff between end user test run vs. open source test run
• Tests API should provide the diff between two test runs
• Tests API should provide the ability to fetch test run results
• Tests API should provide web hook capability to provide test run results

[AmitKumarDas]

Intent

# Annotations to create a ACME related resources corresponding to this Deployment
kind: Deployment
metadata:
  annotations:
    controller-lite/reconciler-provider: controller-lite # Worker, etc. # understood by controller-lite controller
    controller-lite/is-reconciled: "true" # default
    controller-lite/reconcile-interval: "30mts" # optional
    controller-lite/composer: deployment-acme # only one type supported in this resource i.e. Deployment
    deployment-acme.controller-lite/garbage-collected: "true" # default
    deployment-acme.controller-lite/version: "v1" # optional
    port-mapping.deployment-acme.controller-lite/myapp: "8080:8080"
    port-type.deployment-acme.controller-lite/myapp: "TCP" # default