Dustin C. Hatch
5e251153c7
*cert-manager* manages certificates. More specifically, it is an ACME client, which generates certificate-signing requests, submits them to a certificate authority, and stores the signed certificate in Kubernetes secrets. The certificates it manages are defined by Kubernetes Custom Resources, either defined manually or automatically for Ingress resources with particular annotations. The *cert-manager* deployment consists primarily of two services: *cert-manager* itself, which monitors Kubernetes resources and manages certificate requests, and the *cert-manager-webhook*, which validates Kubernetes resources for *cert-manager*. There is also a third component, *cainjector*, we do not need it. The primary configuration for *cert-manager* is done through Issuer and ClusterIssuer resources. These define how certificates are issued: the certificate authority to use and how to handle ACME challenges. For our purposes, we will be using ZeroSSL to issue certificates, verified via the DNS.01 challenge through BIND running on the gateway firewall.
Dustin's Kubernetes Cluster
This repository contains resources for deploying and managing my on-premises Kubernetes cluster
Cluster Setup
The cluster primarily consists of libvirt/QEMU+KVM virtual machines. The Control Plane nodes are VMs, as are the x86_64 worker nodes. Eventually, I would like to add Raspberry Pi or Pine64 machines as aarch64 nodes.
All machines run Fedora, using only Fedora builds of the Kubernetes components
(kubeadm, kubectl, and kubeadm).
See Cluster Setup for details.
Jenkins Agents
One of the main use cases for the Kubernetes cluster is to provide dynamic agents for Jenkins. Using the Kubernetes Plugin, Jenkins will automatically launch worker nodes as Kubernetes pods.
See Jenkins Kubernetes Integration for details.
Persistent Storage
Persistent storage for pods is provided by Longhorn. Longhorn runs within the cluster and provisions storage on worker nodes to make available to pods over iSCSI.
See Persistent Storage Using Longorn for details.