https://www.puppet.com/community logo
Join Slack
Powered by
# voxpupuli
  • y
    I had a “write a Bolt plan to setup k8s cluster in VMs based on the-hard-way” in my todo but I’m too lazy these days 😞
  • y
    I had a “write a Bolt plan to setup k8s cluster in VMs” in my todo but I’m too lazy these days 😞
  • y
    I had a “write a Bolt plan to setup k8s cluster in VMs based on the-hard-way” in my todo but I’m too lazy these days 😞
  • y
    hm.. just curious how IRC users see a message edits 🤔
  • v
    3 messages
  • v
    all slightly different
  • y
    weird.. sorry 😄
  • v
    The generate_ca parameter will indeed generate CA on every node where it's set. The recommended use is to set it on one node, let it generate the secrets, and then copy those over to all other master/etcd nodes.
  • r
    but the "copy over" is not in the module and one has to handle it for oneself?
  • r
    okay, thats a thing i have to get done for my setup. atm i have a single.head control-plane. but this will change in later stages
  • v
    Puppet doesn't have a good method to do any such copying automatically, no
  • y
    yeah.. that’s why Puppet Bolt might be a better solution for k8s provisioning..
  • y
    btw, alt names might affect things after copying certs from 1st node
  • v
    You only copy the CA data, certificates are generated and signed per node
  • y
    though “cluster name” should work
  • y
    ah, I see
  • r
    atm we only can provide pathes where to look for certs? in other setups/software i have the possibility to specify the content of the certs. would this be a thing we can implement? so pre-create the certs to use. put them (encrypted) as text-block in hiera and let puppet deploy them?
  • b
    Bolt or Vault are probably good solutions here
  • v
    The only necessary secrets are the k8s CA, aggregator CA, and service account key. As well as the etcd client and peer CAs. The rest of the certificates should be generated and signed on the master nodes
  • v
    @Robert The module is written to handle user provided secrets, it's how we deploy our multi-master clusters. Just create file resources for those files and don't set generate_ca
  • y
    Vault is another option, yes.. there is vaultbot and key-keeper to provision certs from the vault
  • s
    This message was deleted.
    y
    r
    • 3
    • 11
  • v
  • v
    And the k8s module will automatically use the secrets as provided, without any extra configuration necessary
  • r
    nice. will adapt this
  • v
    For my multi-master k8s at home, I'm just using hiera-eyaml parameters which I deploy to files in a similar manner
  • r
    yeah like i said, i also want to put the content of the files into eyaml.
  • v
    I have a PR open at the moment though to improve this experience, since I ran into some issues on certain OS combinations where it wouldn't converge in a single puppet run
  • r
    what is thet title? it translates one word into german as Fadennudel, which makes no sense 😄
  • v
    "Добрый Кот" giggle
1...409410411...648Latest