spire VS external-dns

CI/CD pipeline is GitHub Actions which run SSH commands on our servers that execute deployment scripts: https://github.com/bugout-dev/spire/blob/main/deploy/deploy....

We use systemd to manage services.

We use Ansible to set up servers.

Our infrastructure spans AWS, Google Cloud, and servers in a datacenter.

The second one is a combination of tools: External DNS, cert-manager, and NGINX ingress. Using these as a stack, you can quickly deploy an application, making it available through a DNS with a TLS without much effort via simple annotations. When I first discovered External DNS, I was amazed at its quality.

One of the reasons why I chose Hetzner was that it WAS supported by the ExternalDNS project. I didn't quite understand why the Hetzner provider was pulled, but I saw that an attempt of re-adding it was refused, on the ground that the upcoming webhook architecture would have allowed to better maintain providers.

So here’s the solution I have taken for our current stack. EKS and its dependencies are created through terraform using the eks module as well as provision a route53 subdomain and a wildcard cert. Once we have that created, I have installed this deployment into the cluster via the helm module: https://kubernetes-sigs.github.io/aws-load-balancer-controller/v2.4/. This allows me to use kuberentes resources (load balancers or ingress objects) and it will handle all the provisioning of load balancers and security groups for me, based on my application yaml and annotations. We also use https://github.com/kubernetes-sigs/external-dns to manage all of our specific host names for the applications through annotations. So to generally put, terraform manages out Kubernetes clusters, and Kubernetes manages the deployment of anything needed for the application including volumes, load balancers, hostnames though Kubernetes system deployments

Disclaimer: I work for AWS but had nothing to do with this blog post (I'm seeing it for the first time with everyone else here).

I think this is an unfair summary of the post. Of course, using Kubernetes to orchestrate other AWS services is going to be a go-to example on the _AWS_ blog, but there is plenty of vendor-agnostic software doing similar things: DNS Records[1], Databases[2], even using Kubernetes CRDs to deploy Kubernetes[3].

The idea of using Kubernetes as an API to orchestrate external resources doesn't inherently lock you into any single vendor.

1: https://github.com/kubernetes-sigs/external-dns

For the average developer an Ingress is substantially simpler to understand. For an expert such as yourself there are additional annotations which may be added, to use nginx specfic features. However the big win using the nginx ingress controller is integration with other Kubernetes features like cert manager and External DNS

In the latest version v0.13.2 add support for pi-hole as a dns provider:

external-dns

I can then set annotations on the Ingress resource to tell external-dns to flip the proxy switch on the DNS record in Cloudflare: