akri VS cert-manager

akri: AdmissionErrors and if it actually mounts something the process cant access the device for some reason.

If you're talking about hardware attached to nodes, Akri might be of interest: https://github.com/project-akri/akri

Fun hands on use-case/story. Trying to connect sensors & actuators sounds fun! It's clear that they need some kind of infra/platform that they can run on-prem, & this feels like a lock.

There's a new Dynamic Resource api in k8s 1.26 that feels potentially well suited to managing their various kinds of node-attached resources in a pretty broad/generic/cloudy way. Taking the cloud from anonymous compute/storage nodes to an all encompassing management system for whatever we have is an interesting next step. I rather doubt we'll see folks like this spend the 3x effort to pioneer use of these abstractions but over time it should start to emerge & become more regular. https://kubernetes.io/docs/concepts/scheduling-eviction/dyna...

There's also a really neat really nice CNCF Sandbox project Akri which performs semi-similar-ish functions as Dynamic Resources. One of the examples they use as a goto is managing a fleet of OVNIF cameras, like, security cameras. https://github.com/project-akri/akri

On another topic, appreciate this article talking about the mixed human/robot workflows. Good to consider! I worked at a great & interesting data-warehouse company a long time ago that had some very complex long running ETL pipelines & limited compute resources (good number of boxes... pre-cloud era!), and a lot of time-sensitivity. The company used Jira to manage the ETL end to end, with custom workflows where work would gate, process, get checked through various stages, with processors updating the ticket as work advanced or to report % complete. Intensely sharp choice not to build it ourselves, to use a tool for tracking work, even though the code (robots) we built were doing 9/10ths the work. Fun to see a similar topic discussed here.

Good problem setup, interesting view here. Would appreciate a little more technical specifics, but still fun to see.

You need something to act as the runner queue to schedule the nodes, so perhaps you could pull them into a k8s cluster and auto-scale oh the load queue. Using something like this to tag the nodes what special devices might be attached on certain nodes https://github.com/deislabs/akri

Some notes on Plex/Emby/Kodi and transcoding. If you want true transcoding with GPU acceleration, you have to have Nvidia GPU or be a k8s device plugin genius. The whole idea of mounting elastic devices in k8s is fairly new and rather complex. In the mean time transcoding is best done on a beefy device with a proper CPU (eg i7) or specifically Nvidia GPU because there are numerous pre-made plugins. I just run Plex and Emby on an old ATX gaming machine without GPU acceleration and it works totally fine. They were barely usable for just me when running on the RPis, wouldn't recommend it unless you can figure out how to mount the correct devices in the pod using a custom raspberry pi device plugin . . . lol good luck! - Arm labs device manager: https://community.arm.com/developer/research/b/articles/posts/a-smarter-device-manager-for-kubernetes-on-the-edge - Deis labs Akri device manager: https://github.com/deislabs/akri - Nvidia GPU plugin: https://github.com/NVIDIA/k8s-device-plugin

cert-manager

The second one is a combination of tools: External DNS, cert-manager, and NGINX ingress. Using these as a stack, you can quickly deploy an application, making it available through a DNS with a TLS without much effort via simple annotations. When I first discovered External DNS, I was amazed at its quality.

On top of its core components, SpinKube depends on cert-manager. cert-Manager is responsible for provisioning and managing TLS certificates that are used by the admission webhook system of the Spin Operator. Let’s install cert-manager and KWasm using the commands shown here:

terraform { required_providers { kubectl = { source = "gavinbunney/kubectl" version = "1.14.0" } } } # The reference to the current project or a AWS project data "google_client_config" "provider" {} # The reference to the current cluster or EKS data "google_container_cluster" "my_cluster" { name = var.cluster_name location = var.cluster_location } # We configure the kubectl provider to use those values for authenticating provider "kubectl" { host = data.google_container_cluster.my_cluster.endpoint token = data.google_client_config.provider.access_token cluster_ca_certificate = base64decode(data.google_container_cluster.my_cluster.master_auth[0].cluster_ca_certificate) } #Download the multiple manifests file. data "http" "cert_manager_crds" { url = "https://github.com/cert-manager/cert-manager/releases/download/v${var.cert_manager_version}/cert-manager.crds.yaml" } data "kubectl_file_documents" "cert_manager_crds" { content = data.http.cert_manager_crds.response_body lifecycle { precondition { condition = 200 == data.http.cert_manager_crds.status_code error_message = "Status code invalid" } } } # We use the for_each or else this kubectl_manifest will only import the first manifest in the file. resource "kubectl_manifest" "cert_manager_crds" { for_each = data.kubectl_file_documents.cert_manager_crds.manifests yaml_body = each.value }

SSL certificates thanks to Cloudflare and cert-manager

kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/${CERT_MANAGER_VERSION}/cert-manager.crds.yaml

put the Sub-CA inside hashicorp vault to be used for automatic signing of services like https://cert-manager.io/ inside our k8s clusters.

install-cert-manager: desc: Install cert-manager deps: - init-cluster cmds: - kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/{{.CERT_MANAGER_VERSION}}/cert-manager.yaml - echo "Waiting for cert-manager to be ready" && sleep 25 status: - kubectl -n cert-manager get pods | grep Running | wc -l | grep -q 3

I've been pretty frustrated with how private CAs are supported. Your private root CA can be maliciously used to MITM every domain on the Internet, even though you intend to use it for only a couple domain names. Most people forget to set Name Constraints when they create these and many helper tools lack support [1][2]. Worse, browser support for Name Constraints has been slow [3] and support isn't well tracked [4]. Public CAs give you certificate transparency and you can subscribe to events to detect mis-issuance. Some hosted private CAs like AWS's offer logs [5], but DIY setups don't.

Even still, there are a lot of folks happily using private CAs, they aren't the target audience for this initial release.

[1] https://github.com/FiloSottile/mkcert/issues/302

[2] https://github.com/cert-manager/cert-manager/issues/3655

[3] https://alexsci.com/blog/name-non-constraint/

[4] https://github.com/Netflix/bettertls/issues/19

[5] https://docs.aws.amazon.com/privateca/latest/userguide/secur...

the Cert Manager