7e817a021e
All checks were successful
Blog Deployment / Check-Rebuild (push) Successful in 13s
Blog Deployment / Build (push) Has been skipped
Blog Deployment / Deploy-Staging (push) Successful in 21s
Blog Deployment / Test-Staging (push) Successful in 5s
Blog Deployment / Merge (push) Successful in 8s
Blog Deployment / Deploy-Production (push) Successful in 12s
Blog Deployment / Test-Production (push) Successful in 3s
Blog Deployment / Clean (push) Has been skipped
Blog Deployment / Notify (push) Successful in 4s
139 lines
3.4 KiB
Markdown
139 lines
3.4 KiB
Markdown
---
|
||
slug:
|
||
title: Template
|
||
description:
|
||
date:
|
||
draft: true
|
||
tags:
|
||
categories:
|
||
---
|
||
|
||
## Intro
|
||
|
||
After have created a Kubernetes cluster in my homelab with `kubeadm` in [that post]({{< ref "post/8-create-manual-kubernetes-cluster-kubeadm" >}}), my next goal is to expose a simple pod externally, reachable with an URL and secured with a TLS certificate verified by Let's Encrypt.
|
||
|
||
To achieve that, I will need several components:
|
||
- Service: TODO add oneline description
|
||
- Ingress: TODO add oneline description
|
||
- Ingress Controller: TODO add oneline description
|
||
- TLS Certificates: TODO add oneline description
|
||
|
||
---
|
||
## Helm
|
||
|
||
For these components to work, I will have to install new products. To install them, I will use Helm
|
||
### Why Helm
|
||
explain install Helm
|
||
### Install Helm
|
||
|
||
|
||
---
|
||
## Kubernetes Services
|
||
|
||
TODO add why we need service
|
||
|
||
### What is a Kubernetes Service
|
||
|
||
explain what is a Service and its purpose
|
||
### Different Services
|
||
|
||
give the list of differents services
|
||
#### ClusterIP
|
||
|
||
explain what ClusterIP services are
|
||
#### NodePort
|
||
|
||
explain what NodePort services are
|
||
#### LoadBalancer
|
||
|
||
explain what LoadBalancer services are
|
||
|
||
---
|
||
## Expose a `LoadBalancer` Service with BGP
|
||
|
||
At first, I was thinking of using **MetalLB** to expose the IP of my services to my home network. This is what I used in the past when I was using my ISP box as router. After reading this post, [Use Cilium BGP integration with OPNsense](https://devopstales.github.io/kubernetes/cilium-opnsense-bgp/), I could do it differently using **BGP** with my OPNsense router.
|
||
### What Is BGP?
|
||
|
||
BGP (Border Gateway Protocol) is a routing protocol used to exchange network routes between systems. In the Kubernetes homelab context, BGP allows your Kubernetes nodes to advertise IPs directly to your **network router or firewall**. Your **router then knows** how to reach the IPs managed by your cluster.
|
||
|
||
So instead of MetalLB managing IP allocation and ARP replies, your nodes directly tell your router: “Hey, I own 192.168.1.240”.
|
||
### Legacy MetalLB Approach
|
||
|
||
Without BGP, MetalLB in Layer 2 mode works like this:
|
||
- Assigns a LoadBalancer IP (e.g., `192.168.1.240`) from a pool.
|
||
- One node responds to **ARP** for that IP on your LAN.
|
||
|
||
I know that MetalLB can also work with BGP, but what if my CNI (Cilium) can handle it out of the box?
|
||
### BGP with Cilium
|
||
|
||
With Cilium + BGP, you get:
|
||
- Cilium’s agent on the node advertises LoadBalancer IPs over BGP.
|
||
- Your router learns that IP and routes to the correct node.
|
||
- No need for MetalLB.
|
||
|
||
### BGP Setup
|
||
|
||
#### On OPNsense
|
||
|
||
#### In Cilium
|
||
|
||
### Deploying a LoadBalancer with BGP
|
||
#### Using an IP Address
|
||
#### Using a URL
|
||
|
||
---
|
||
## Kubernetes Ingress
|
||
|
||
TODO add why we need service
|
||
### What is a Kubernetes Ingress
|
||
|
||
explain what is an Ingress and its purpose
|
||
|
||
### How Ingress Work
|
||
|
||
|
||
---
|
||
## Ingress Controller
|
||
|
||
### What is an Ingress Controller
|
||
|
||
explain what is an Ingress Controller and its purpose
|
||
|
||
### Which Ingress Controller to Use
|
||
|
||
comparison between ingress controller
|
||
which one I picked and why
|
||
### Install NGINX Ingress Controller
|
||
|
||
detail installation of NGINX Ingress Controller
|
||
verify ingress controller service
|
||
### Associate a Service to an Ingress
|
||
|
||
|
||
oneline to explain how to use https
|
||
|
||
---
|
||
## Secure Connection with TLS
|
||
|
||
to use https
|
||
|
||
### Cert-Manager
|
||
|
||
#### Install Cert-Manager
|
||
|
||
install with helm
|
||
#### Setup Cert-Manager
|
||
|
||
verify clusterissuer
|
||
|
||
### Add TLS in an Ingress
|
||
|
||
ingress tls code
|
||
|
||
verify
|
||
|
||
---
|
||
## Conclusion
|
||
|
||
|