https://www.puppet.com/community logo
Join Slack
Powered by
# voxpupuli
  • v
    it would be interesting if you could use JQ style queries on JSON
  • v
    jq or jmespath would be cool, yeah
  • v
    i all i wonder if i can get some input on https://github.com/voxpupuli/puppet-dnsquery/pull/131
  • v
    oh, a new release of semantic_puppet, I've been waiting for that for a while :)
  • v
    nice
  • v
    jbond: done
  • v
    ewoud: you probably dont want to keep maintaining the rsync module within vox pupuli?
  • v
    bastelfreak: awesome thanks
  • v
    bastelfreak: not sure, we use it in our Foreman infra so perhaps
  • v
    and now I'm hit by the ensure_packages() present → installed change
  • v
    I'll say I completely underestimated how painful that was
  • v
    I'm now wondering if defined_with_params() should be enhanced to understand aliases
  • v
  • v
  • v
    that special cases it, but I was suggesting to solve it at a deeper level
  • r
    @Ananace what is the _aggregator_ca._ so in puppet-k8s wie have the k8s-ca, the ectd-ca and a third one?
  • v
    The aggregator CA is used for API service proxies, things like the metrics server API
  • r
    this "front-proxy" which is also in the code? i dont know this part. in the other k8s examples this cert stuff is a bit simpler 😅
  • v
    The front-proxy is what's used for requestheader auth, which is for internal user impersonation inside the cluster - so that an internal service can act as separate users
  • v
    You can theoretically skip the aggregator CA, but your cluster will lose functionality, and be much harder to scale to multi-master
  • r
    is there a concept overview or and wiki/blog/article about how this whole setup with how the certs are done? because each answer from you raises more questions. and i dont think i have understood it at all 😞
  • v
  • v
    Basically; The main CA is for certificates that authorize for a single user with their groups, the aggregator CA is for certificates that authorize for any user/group
  • v
    So that you can defer authentication/authorization, or support impersonation
  • r
    okay think have to read the link first. from what i know from kubernetes the hard way, this setup here is much more complex. i triead to match it somehow, but it did not compute for me confusedparrot
  • v
    You can skip the aggregator CA in some simpler setups, it's not a strictly required component in order to start a cluster up. It's not even strictly a required component for scaling a cluster, it just helps.
  • v
    Same as with using serving certs and bootstrap tokens, not strictly required, but it makes scaling a lot easier.
  • r
    okay, so then i got confused from you code snipped yesterday on how to deploy the keys/certs
  • r
    will check in my local setup which certs are minimum needed
  • v
    With the k8s module, it will always create the full complement of CAs and certs, since it results in a more robust result
1...411412413...648Latest