Kubernetes Certificate Manager
Infrastructure
kubernetes certificate management
SHOW HN2016
186points
19comments
#149of 2,264 in 2016
Top 7%of 2016 by points
How HN took it
LovedMost comments that take a side are positive
4 positive, 6 neutral or asking, 2 mixed, 0 critical, out of 12 comments about the project. Thread score +0.30.
Idea: 2 for, 0 againstDesign: 1 for, 0 againstExecution: 1 for, 0 against
The thread, comment by comment
Each row is a top-level comment and its replies, in HN's order. Select a cell to open that comment on HN.
positive neutral or mixed critical about another commenter or something else the maker
What HN said
What people liked
Solves cert friction in Kubernetes clusters
From 2 comments
I was wondering when someone would try that. I built a k8s cluster from the CoreOS tutorials. Generating certs had contributed to the friction.
hosh on HNVery cool. Just started looking for a solution here, and wasn't sold on the Ingress-based approach of kube-lego; I want to be able to do HTTPS-to-the-Pod, so terminating on the…
theptip on HN
Good example of extending Kubernetes
From 2 comments
I actually clicked the link hoping to see a good example of how to extend Kubernetes and I was not disappointed. I'm thinking of writing a plugin that registers DNS names based…
oxplot on HNVery cool. Just started looking for a solution here, and wasn't sold on the Ingress-based approach of kube-lego; I want to be able to do HTTPS-to-the-Pod, so terminating on the…
theptip on HN
Works well for test environments
From 1 comment
I'm using this for rolling out test environments and so far it works amazingly well. Wildcard DNS record to an ELB, and with just the one kube-lego pod + the one single ingress…
plange on HN
Objections
Tied to Google Cloud DNS
From 2 comments
What needs to be done for this to not have the Google requirements?
jsprogrammer on HNThis requires a registered DNS domain managed by Google Cloud DNS -- I wonder how much work it would take to make that also work with AWS Route53?
whatnotests on HN
Requires a registered domain managed by Google Cloud DNS
From 1 comment
This requires a registered DNS domain managed by Google Cloud DNS -- I wonder how much work it would take to make that also work with AWS Route53?
whatnotests on HN
Requests
Support for more DNS providers such as Cloudflare and Azure
From 2 comments
I'd really like to add support for Azure and Cloudflare (I'm very familiar with the Go SDK for Azure and have written a dynamic dns client for Cloudflare previously). I think…
colemickens on HNUser feedback and clear demand for other DNS providers. Once I have that I'll consider refactoring the DNS backend to support anything with an API or some sort of plugin system.…
kelseyhightower on HN
Support for AWS Route53
From 1 comment
This requires a registered DNS domain managed by Google Cloud DNS -- I wonder how much work it would take to make that also work with AWS Route53?
whatnotests on HN
Questions
What is needed to remove the Google requirement
From 1 comment
What needs to be done for this to not have the Google requirements?
jsprogrammer on HN
Can the setup be explained in more detail
From 1 comment
Can you explain this a little more? I am going to try this out this weekend. It does sound like the holy grail!
dstroot on HN
Alternatives named
kube-lego
From 2 comments
I've been using kube-lego [0] to request/renew certs from LE. It doesn't handle the DNS for you automatically, which has the benefit of working outside of GKE and downside of…
trevorhartman on HNI think kube-cert-manager is a bit more flexible. I'm using kube-lego now but I'd like to switch to kube-cert-manager. kube-lego seems fairly integrated with Ingress, since it…
colemickens on HN
lego
From 2 comments
Have you looked into https://github.com/xenolf/lego ? This project already have support for many DNS providers.
tamalsaha001 on HNThe logic that lego has could certainly be coopted here but having a declarative config for the certificate using ThirdPartyResource is the right way to go IMHO. Also, lego is a…
ian-lewis on HN
Marathon/Mesos Let's Encrypt tool
From 1 comment
This is cool. I also wrote a Marathon/Mesos version, without the vendor lock-in: https://mesosphere.com/blog/2016/04/06/lets-encrypt-dcos/
brndnmtthws on HN