[{"data":1,"prerenderedAt":253},["ShallowReactive",2],{"project-12159249":3},{"id":4,"name":5,"line":6,"line_source":7,"title":8,"url":9,"domain":10,"maker":11,"posted_at":12,"year":13,"points":14,"comments":15,"rank_in_year":16,"shown_in_year":17,"top":18,"tier":19,"category":20,"subcategory":21,"format":22,"keywords":23,"reception":28,"sentiment":29,"stance_mix":30,"scored_comments":35,"aspects":36,"strip":41,"post_text":44,"what":45,"said":78,"maker_in_thread":171,"shape":180,"grid":184,"attempts":215,"same_week":216,"maker_shows":42,"maker_hidden":245,"reader_version":246,"card":247},"12159249","Kubernetes Certificate Manager","Native Let's Encrypt Integration","title","Show HN: Kubernetes Certificate Manager – Native Let's Encrypt Integration","https:\u002F\u002Fgithub.com\u002Fkelseyhightower\u002Fkube-cert-manager","github.com","kelseyhightower",1469459957,2016,186,19,149,2264,7,"notable","infrastructure","kubernetes certificate management","other",[24,25,26,27],"kubernetes","let's encrypt","tls certificates","dns01 challenge","loved",0.304,{"positive":31,"neutral":32,"mixed":33,"critical":34},4,6,2,0,12,{"design":37,"execution":39,"idea":40},{"positive":38,"critical":34},1,{"positive":38,"critical":34},{"positive":33,"critical":34},[34,42,43,42,42,34,34,34,42,34,42,42,42,34,34,42,43,43,43],3,5,null,{"problem":46,"audience":44,"pricing":44,"motivation":56,"time_to_build":44,"stack":63,"openness":75,"stage":76,"team_size":77},{"value":47,"source":48,"evidence":49},"Getting and renewing TLS certificates in Kubernetes via Let's Encrypt","inferred",[50,52],{"id":51},"post",{"id":53,"by":54,"text":55},"12159627","hosh","I was wondering when someone would try that. I built a k8s cluster from the CoreOS tutorials. Generating certs had contributed to the friction.",{"value":57,"source":58,"evidence":59},"Vet the idea of using DNS-01 challenges and get the UX right","maker",[60],{"id":61,"by":11,"text":62},"12159400","User feedback and clear demand for other DNS providers. Once I have that I'll consider refactoring the DNS backend to support anything with an API or some sort of plugin system.…",[64,71],{"value":65,"source":48,"evidence":66},"Go",[67],{"id":68,"by":69,"text":70},"12160434","colemickens","I'd really like to add support for Azure and Cloudflare (I'm very familiar with the Go SDK for Azure and have written a dynamic dns client for Cloudflare previously). I think…",{"value":72,"source":48,"evidence":73},"Kubernetes",[74],{"id":51},"open_source","prototype","unknown",{"praise":79,"objections":104,"requests":120,"questions":130,"alternatives":142},[80,89,97],{"value":81,"source":82,"evidence":83},"Solves cert friction in Kubernetes clusters","commenter",[84,85],{"id":53,"by":54,"text":55},{"id":86,"by":87,"text":88},"12162771","theptip","Very cool. Just started looking for a solution here, and wasn't sold on the Ingress-based approach of kube-lego; I want to be able to do HTTPS-to-the-Pod, so terminating on the…",{"value":90,"source":82,"evidence":91},"Good example of extending Kubernetes",[92,96],{"id":93,"by":94,"text":95},"12163549","oxplot","I actually clicked the link hoping to see a good example of how to extend Kubernetes and I was not disappointed. I'm thinking of writing a plugin that registers DNS names based…",{"id":86,"by":87,"text":88},{"value":98,"source":82,"evidence":99},"Works well for test environments",[100],{"id":101,"by":102,"text":103},"12160487","plange","I'm using this for rolling out test environments and so far it works amazingly well. Wildcard DNS record to an ELB, and with just the one kube-lego pod + the one single ingress…",[105,116],{"value":106,"source":82,"evidence":107},"Tied to Google Cloud DNS",[108,112],{"id":109,"by":110,"text":111},"12159379","jsprogrammer","What needs to be done for this to not have the Google requirements?",{"id":113,"by":114,"text":115},"12162088","whatnotests","This requires a registered DNS domain managed by Google Cloud DNS -- I wonder how much work it would take to make that also work with AWS Route53?",{"value":117,"source":82,"evidence":118},"Requires a registered domain managed by Google Cloud DNS",[119],{"id":113,"by":114,"text":115},[121,126],{"value":122,"source":82,"evidence":123},"Support for more DNS providers such as Cloudflare and Azure",[124,125],{"id":68,"by":69,"text":70},{"id":61,"by":11,"text":62},{"value":127,"source":82,"evidence":128},"Support for AWS Route53",[129],{"id":113,"by":114,"text":115},[131,135],{"value":132,"source":82,"evidence":133},"What is needed to remove the Google requirement",[134],{"id":109,"by":110,"text":111},{"value":136,"source":82,"evidence":137},"Can the setup be explained in more detail",[138],{"id":139,"by":140,"text":141},"12161156","dstroot","Can you explain this a little more? I am going to try this out this weekend. It does sound like the holy grail!",[143,153,164],{"value":144,"source":82,"evidence":145},"kube-lego",[146,150],{"id":147,"by":148,"text":149},"12159863","trevorhartman","I've been using kube-lego [0] to request\u002Frenew certs from LE. It doesn't handle the DNS for you automatically, which has the benefit of working outside of GKE and downside of…",{"id":151,"by":69,"text":152},"12160446","I think kube-cert-manager is a bit more flexible. I'm using kube-lego now but I'd like to switch to kube-cert-manager. kube-lego seems fairly integrated with Ingress, since it…",{"value":154,"source":82,"evidence":155},"lego",[156,160],{"id":157,"by":158,"text":159},"12159668","tamalsaha001","Have you looked into https:\u002F\u002Fgithub.com\u002Fxenolf\u002Flego ? This project already have support for many DNS providers.",{"id":161,"by":162,"text":163},"12160737","ian-lewis","The logic that lego has could certainly be coopted here but having a declarative config for the certificate using ThirdPartyResource is the right way to go IMHO. Also, lego is a…",{"value":165,"source":82,"evidence":166},"Marathon\u002FMesos Let's Encrypt tool",[167],{"id":168,"by":169,"text":170},"12159523","brndnmtthws","This is cool. I also wrote a Marathon\u002FMesos version, without the vendor lock-in: https:\u002F\u002Fmesosphere.com\u002Fblog\u002F2016\u002F04\u002F06\u002Flets-encrypt-dcos\u002F",{"comments":31,"answered":38,"key":172},[173,176,179],{"id":174,"text":175},"12167916","I'm proposing an exec based plugin system for the Kubernetes Certificate Manager. Ideally this will make it easy to support any DNS provider written in any language. The goal is…",{"id":177,"text":178},"12173242","I've updated the Kubernetes Certificate Manager based on the dns01 exec plugins proposal. I've also pulled out all native support for DNS providers and now the Google DNS…",{"id":61,"text":62},{"commenters":181,"max_depth":31,"maker_replies":31,"first_comment_mins":182,"lifespan_hours":183},13,20,48,[185,187,189,191,193,196,197,199,200,201,203,204,205,206,209,211,212,213,214],[147,34,34,186,148,34],"other\u002Fneutral\u002Fnone",[151,34,42,188,69,34],"project\u002Fmixed\u002Fdesign",[101,34,43,190,102,34],"project\u002Fpositive\u002Fexecution",[139,34,42,192,140,34],"maker\u002Fneutral\u002Fnone",[194,34,42,195,162,34],"12160764","project\u002Fneutral\u002Fdesign",[168,38,34,186,169,34],[174,33,34,198,11,38],"project\u002Fpositive\u002Fdesign",[177,33,34,198,11,38],[109,42,42,195,110,34],[61,42,34,202,11,38],"project\u002Fneutral\u002Fidea",[157,42,42,195,158,34],[161,42,42,188,162,34],[68,42,42,202,69,34],[207,42,34,208,11,38],"12160964","project\u002Fpositive\u002Fidea",[210,42,34,186,69,34],"12164143",[113,31,42,195,114,34],[53,43,43,208,54,34],[86,32,43,198,87,34],[93,18,43,208,94,34],[],[217,222,227,232,236,241],{"id":218,"name":219,"points":220,"category":221},"12166687","Web Design in 4 minutes",1624,"learning_science",{"id":223,"name":224,"points":225,"category":226},"12136011","Riko",283,"languages",{"id":228,"name":229,"points":230,"category":231},"12163689","github-widget",176,"dev_tools",{"id":233,"name":234,"points":235,"category":226},"12175830","sha256-simd",156,{"id":237,"name":238,"points":239,"category":240},"12166370","EventQL",90,"data",{"id":242,"name":243,"points":244,"category":231},"12137698","kilo",85,false,"v2",{"id":248,"name":5,"line":6,"ai":245,"cat":20,"year":13,"points":14,"comments":15,"rec":28,"s":249,"top":18,"kw":250,"maker":11,"domain":10,"tier":19,"attempts":34,"strip":251,"url":9,"mix":252,"praise":81,"objection":106,"sub":21},12159249,0.3,[24,25,26,27],"0353300030333003555",[31,32,33,34],1794036546178]