#kubernetes - September 2020

Hello! does anyone store secrets on ansible-vault?

For folks on EKS using alb-ingress-controller — Do you use nginx / nginx-ingress-controller as well? A team member (who has more k8s experience than myself) is suggesting we go ALB => Nginx => Applications. And I’m just wondering if that is overly complex and not needed. As in, is it more standard to have a single ALB Ingress resource that fronts any external application services.

hi has anyone knowledge around the iam role association to pods through service-account in EKS, Im able to do assume the role (assume-role-with-web-identity) of the same account , but now I need to assume a role present in a different account, I already tried out with attaching assume-role policy to my role for that (role present in 2nd account ) and even editing its trust relationships.
Thanks in advance

Does anyone run ingress-nginx at scale(i.e 200k/rps+)? Any recommendations at reaching that scale?

Per-pod SecurityGroups are now a native thing in EKS: https://docs.aws.amazon.com/eks/latest/userguide/security-groups-for-pods.html

No more need for Calico

^^^ For now, it requires EKS 1.17 eks.3 and CNI v1.7.1 or later, and setting ENABLE_POD_ENI=true

No support for t3 😞

quick, hopefully simple question - many applications we deploy with 2 replicas for high availability (should one pod hang/crash, the other is still there to offer the service). I had made the (obviously incorrect) assumption that these pods would always be scheduled on different nodes, but I have observed that is not the case (usually it is, but not always); this leaves us in a bit of a compromised position regarding high availability; should we lose a node that has 2 pods from the same deployment on it, that service is lost for a time.

my question - is it possible to somehow annotate a deployment to indicate pods should be scheduled on different nodes?

Hi, I’m using this great module https://github.com/cloudposse/terraform-aws-eks-workers and would like to change the root volume size, is that possible? Can’t figure out how until now

Hi I'm having a issue with kubectl commands where unable to get the response while running these commands-- kubectl get nodes
error from the server (Timeout): the server was unable to return a response in the time allotted but may still be processing the request (get node)

kubectl top nodes
*Error from the server (service unavailable) the server is currently unable to handle the request
I have two master nodes and and 3 worker nodes with one API server*

can anyone help with this issue to resolve please.and this is not in cloud.

Anyone here with experience with Rancher and Kiosk could tell me if they are not compatible with each other? are they competing products in any way?

and any feedback about Loft users?

I’m looking for a multi tenant , cluster management tool that can help us migrating and to K8s from ECS and make things easier for everyone

hopefully there will be little to no aws cli/console work from developers to do

quick question if i patch a manifest, and after a while i apply again the original manifest will it remove my patches?

Hello, does any one know any ingress controller that can be used in target Group of AWS. We have ALB which send traffic to EC2 instance and for only one service we want to send traffic to Kubernetes pod from that ALB. for that we need one target group which can route traffic from ALB to Kubernetes pod...This target group should updated once pod recycle...

Hey guys, does anyone know why a Kubernetes cluster wouldn’t be creating any pods whatsoever?

Even for new deployments, deleted pods with replicasets, it’s simply stopped creating new pods.

Resolved, was a bad master

Hello 👋🏽 I’m looking for a solution which allows users to use a self-service catalog to deploy (using Helm Charts) a web app.

One such solution I’ve come across has been KubeApps - https://kubeapps.com/

Any one noticed that the default security group for the eks module doesn't seem to be applied to anything? https://github.ada.com/infrastructure/infra-common-aws/blob/master/terraform-aws-eks-cluster/main.tf#L66-L67

maybe I have misunderstood it

Cannot view

oh lol, I linked to a private repo

hello all, I have a couple unrelated (hopefully easy) questions:

1. I am looking at implementing a StatefulSet for an application, mostly to satisfy an ordered startup requirement of the application; I notice that StatefulSets require a headless service which does not do any sort of load balancing for the pods (looks like it's just for DNS name assignment); can I also place a ClusterIP service in front of the statefulset pods and achieve the same thing one would with a Deployment?
2. I deploy an application that has an excessively long startup time, such that the liveness probe for the app has an initial timeout of 3 minutes + the actual failure for the liveness probe is another 3 minutes (meaning a startup failure takes 6 minutes to be detected. If we end up in a startup failure related crash loop, we never seem to trip the crashloopbackoff behavior and end up restarting perpetually until someone intervenes:
• to date, startup probes haven't been available to us on our managed cluster, but I believe they will be soon - would implementing a startup probe change this behavior?
• is there anything else I might be able to do to affect this so we do indeed trip the backoff behavior if this happens (I believe I've read that backoff timers are not configurable today)?
• this application also has a prestop hook that takes several minutes to complete - does this have any impact on the backoff behavior (I potentially have some flexibility here to change things)?

Possible #office-hours question — How are folks managing service env var configuration in K8s with Helm?