<colemickens>
I missed a lot of good chat today...
<colemickens>
I love it all.
Ox4A6F has quit [Read error: Connection reset by peer]
Ox4A6F has joined #nixos-kubernetes
johanot has joined #nixos-kubernetes
<johanot>
I'm close to a PR replacing KubeDNS with CoreDNS. AFAIK CoreDNS is the new standard for Kubernetes DNS addon from version 1.11 and beyond. Do you have any inputs on this? Any reasons why we might keep support for KubeDNS?
<colemickens>
I'm not aware of any. Seems like a welcome change.
<colemickens>
(I'd be curious for any words about your plans for the module rewrite, given that it's not tied to the release now, etc.)
<johanot>
colemickens: So.. https://github.com/NixOS/nixpkgs/pull/45670 is still open, and I was really hoping to progress that at some point. But the problem is mainly, that it depends on changes cloudflare certmgr, which.. looks kind of dead. The maintainers seems uninterested in responding to my requests. Basically, my top priority is to implement a fully secure kubernetes module. The current one is only
<johanot>
50% TLS-enabled.
<colemickens>
oh right, I keep seeing you nudge it along but I have them as separate concerns in my head.
<colemickens>
makes sense, it's too bad they don't seem more responsive. thanks for the thoughts.
<Ox4A6F>
I had to init a v1.11.3 cluster with --feature-gates=CoreDNS=false, because some network plugin was misbehaving.
<johanot>
Ox4A6F: oh? which network plugins?
<Ox4A6F>
romana
<colemickens>
how does that work? I assumed CNI plugins wouldn't work out of box since they tend to try to drop statically binaries on the host and have kubelet exec them?
<colemickens>
or are you doing the romana agent bits with nixos config?
<colemickens>
just curious, I've started packaging kube-router into nixpkgs/module because of my perception of this problem, it'd be nice to use off the shelf CNI plugins w/o modification
<johanot>
colemickens: We use kube-router here and already have a module. Just haven't gotten around upstreaming yet
<johanot>
Most funky thing about kube-router is that it assumes that /etc is writable :P
<colemickens>
I feel like the luckiest guy in IRC. Thank you for sharing!
<srhb>
A lot of the troubles of cni went away when johanot changed us over to kube-router
<srhb>
It has warts, but it's waaaay better than the usual methods
<srhb>
And easier to change, too.
<johanot>
colemickens: anytime! I would like become co-maintainer on that in case you upstream to nixpkgs.
<johanot>
srhb: First couple of versions we had here were kinda buggy, but it quickly improved. Especially because the maintainer overthere takes issues and PRs on kube-router seriously. :)
<srhb>
Yeah, it's so much easier to do anything when upstream is responsive.