lens VS cert-manager

Intentional. As you called out, they're moving to a more premium model. https://github.com/lensapp/lens/issues/6823

Improve Extension loading capabilities #6749

I think this thread is a little less flame-y: https://github.com/lensapp/lens/issues/6819

Hey, so I thought I remembered your username. This isn’t the first interaction we’ve had, or I’ve seen you have, that follows this similar pattern. In fact it’s the third example from you under this post!

It’s not a particularly pleasant experience to discuss anything with you, as after you make a particularly vapid and usually ice-cold take that is rebuffed, you seem to just try to make snarky replies rather than engage.

Understand that if you post your takes here they may be discussed and challenged, and if you don’t want this then I would refrain from initially commenting.

In response to your comment: They do. All Kubernetes resources are typed with JSON-schema definitions. Because of course they are, how else would kubernetes validate anything. https://kubernetesjsonschema.dev/

Anyone who’s used k8s at all knows this, if only from the error messages. From this you get autocompletion and a wide ecosystem of gui configuration tools. I like lens (https://k8slens.dev/).

Lens is no longer free but the upstream openlens is free see https://github.com/lensapp/lens

Surprised none of y'all mentioned Lens

The issue he’s complaining about has been fixed: https://github.com/lensapp/lens/issues/1588

There are many ways you can see if instances are underutilized, using some open source tools such as k9s cli or Lens (if measuring the utilization of VMs which are part of Kubernetes clusters). Or the cloud providers console to see the memory and compute consumption of the provisioned VMs.

With some experience and a user interface like Lens, debugging becomes easier. And there are great monitoring solutions for production use. But this is still a big hurdle for beginners taking their first steps with Kubernetes.

You can also use cert-manager to automatically obtain and renew certificates.

# deploy cert-manager (MoeLove) ➜ kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.11.0/cert-manager.yaml # deploy ARC (MoeLove) ➜ helm repo add actions-runner-controller https://actions-runner-controller.github.io/actions-runner-controller (MoeLove) ➜ helm upgrade --install --namespace actions-runner-system --create-namespace\ --set=authSecret.create=true\ --set=authSecret.github_token="REPLACE_YOUR_TOKEN_HERE"\ --wait actions-runner-controller actions-runner-controller/actions-runner-controller # create runner (MoeLove) ➜ cat <

When paired with Cert Manager, and using Vultr for my DNS server, I can issue valid LetsEncrypt certificates with a DNS01 challenge. So I don't need to worry about having an application being open to the internet on port 80 in order to avoid browser warnings.

Link to GitHub Repository

I can't parse out whether k8s is in or out of scope for your constraints, but either way cert-manager works well, supports the usual suspects as well as an "external" provider and quite a few of the major vendors have gotten on-board the ACME train, including - surprisingly enough - DigiCert

[email protected]:~$ kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.10.1/cert-manager.yaml namespace/cert-manager created customresourcedefinition.apiextensions.k8s.io/clusterissuers.cert-manager.io created customresourcedefinition.apiextensions.k8s.io/challenges.acme.cert-manager.io created customresourcedefinition.apiextensions.k8s.io/certificaterequests.cert-manager.io created customresourcedefinition.apiextensions.k8s.io/issuers.cert-manager.io created customresourcedefinition.apiextensions.k8s.io/certificates.cert-manager.io created customresourcedefinition.apiextensions.k8s.io/orders.acme.cert-manager.io created serviceaccount/cert-manager-cainjector created serviceaccount/cert-manager created serviceaccount/cert-manager-webhook created configmap/cert-manager-webhook created clusterrole.rbac.authorization.k8s.io/cert-manager-cainjector created clusterrole.rbac.authorization.k8s.io/cert-manager-controller-issuers created clusterrole.rbac.authorization.k8s.io/cert-manager-controller-clusterissuers created clusterrole.rbac.authorization.k8s.io/cert-manager-controller-certificates created clusterrole.rbac.authorization.k8s.io/cert-manager-controller-orders created clusterrole.rbac.authorization.k8s.io/cert-manager-controller-challenges created clusterrole.rbac.authorization.k8s.io/cert-manager-controller-ingress-shim created clusterrole.rbac.authorization.k8s.io/cert-manager-view created clusterrole.rbac.authorization.k8s.io/cert-manager-edit created clusterrole.rbac.authorization.k8s.io/cert-manager-controller-approve:cert-manager-io created clusterrole.rbac.authorization.k8s.io/cert-manager-controller-certificatesigningrequests created clusterrole.rbac.authorization.k8s.io/cert-manager-webhook:subjectaccessreviews created clusterrolebinding.rbac.authorization.k8s.io/cert-manager-cainjector created clusterrolebinding.rbac.authorization.k8s.io/cert-manager-controller-issuers created clusterrolebinding.rbac.authorization.k8s.io/cert-manager-controller-clusterissuers created clusterrolebinding.rbac.authorization.k8s.io/cert-manager-controller-certificates created clusterrolebinding.rbac.authorization.k8s.io/cert-manager-controller-orders created clusterrolebinding.rbac.authorization.k8s.io/cert-manager-controller-challenges created clusterrolebinding.rbac.authorization.k8s.io/cert-manager-controller-ingress-shim created clusterrolebinding.rbac.authorization.k8s.io/cert-manager-controller-approve:cert-manager-io created clusterrolebinding.rbac.authorization.k8s.io/cert-manager-controller-certificatesigningrequests created clusterrolebinding.rbac.authorization.k8s.io/cert-manager-webhook:subjectaccessreviews created role.rbac.authorization.k8s.io/cert-manager-cainjector:leaderelection created role.rbac.authorization.k8s.io/cert-manager:leaderelection created role.rbac.authorization.k8s.io/cert-manager-webhook:dynamic-serving created rolebinding.rbac.authorization.k8s.io/cert-manager-cainjector:leaderelection created rolebinding.rbac.authorization.k8s.io/cert-manager:leaderelection created rolebinding.rbac.authorization.k8s.io/cert-manager-webhook:dynamic-serving created service/cert-manager created service/cert-manager-webhook created deployment.apps/cert-manager-cainjector created deployment.apps/cert-manager created deployment.apps/cert-manager-webhook created mutatingwebhookconfiguration.admissionregistration.k8s.io/cert-manager-webhook created validatingwebhookconfiguration.admissionregistration.k8s.io/cert-manager-webhook created

Ingresses are a little weird. We can really easily add a self-signed cert to your Ingress if you don't care that much. If you care slightly more, you're likely going to need to use a TLS cert manager like certmanager. I know, you're like "oh great, more helm charts to install. Good news, this one is pretty easy. If you do this, you can use the secret it makes in the Ingress configuration just like the self-signed cert.

NB : the Kubernetes community is doing a great job and your ssl certificate enrolment problem is solved with projects like cert-manager. ( https://github.com/cert-manager/cert-manager )

cert-manager

$ kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.8.2/cert-manager.yaml  ✔  namespace/cert-manager created customresourcedefinition.apiextensions.k8s.io/certificaterequests.cert-manager.io created customresourcedefinition.apiextensions.k8s.io/certificates.cert-manager.io created customresourcedefinition.apiextensions.k8s.io/challenges.acme.cert-manager.io created customresourcedefinition.apiextensions.k8s.io/clusterissuers.cert-manager.io created customresourcedefinition.apiextensions.k8s.io/issuers.cert-manager.io created customresourcedefinition.apiextensions.k8s.io/orders.acme.cert-manager.io created serviceaccount/cert-manager-cainjector created serviceaccount/cert-manager created serviceaccount/cert-manager-webhook created configmap/cert-manager-webhook created clusterrole.rbac.authorization.k8s.io/cert-manager-cainjector created clusterrole.rbac.authorization.k8s.io/cert-manager-controller-issuers created clusterrole.rbac.authorization.k8s.io/cert-manager-controller-clusterissuers created clusterrole.rbac.authorization.k8s.io/cert-manager-controller-certificates created clusterrole.rbac.authorization.k8s.io/cert-manager-controller-orders created clusterrole.rbac.authorization.k8s.io/cert-manager-controller-challenges created clusterrole.rbac.authorization.k8s.io/cert-manager-controller-ingress-shim created clusterrole.rbac.authorization.k8s.io/cert-manager-view created clusterrole.rbac.authorization.k8s.io/cert-manager-edit created clusterrole.rbac.authorization.k8s.io/cert-manager-controller-approve:cert-manager-io created clusterrole.rbac.authorization.k8s.io/cert-manager-controller-certificatesigningrequests created clusterrole.rbac.authorization.k8s.io/cert-manager-webhook:subjectaccessreviews created clusterrolebinding.rbac.authorization.k8s.io/cert-manager-cainjector created clusterrolebinding.rbac.authorization.k8s.io/cert-manager-controller-issuers created clusterrolebinding.rbac.authorization.k8s.io/cert-manager-controller-clusterissuers created clusterrolebinding.rbac.authorization.k8s.io/cert-manager-controller-certificates created clusterrolebinding.rbac.authorization.k8s.io/cert-manager-controller-orders created clusterrolebinding.rbac.authorization.k8s.io/cert-manager-controller-challenges created clusterrolebinding.rbac.authorization.k8s.io/cert-manager-controller-ingress-shim created clusterrolebinding.rbac.authorization.k8s.io/cert-manager-controller-approve:cert-manager-io created clusterrolebinding.rbac.authorization.k8s.io/cert-manager-controller-certificatesigningrequests created clusterrolebinding.rbac.authorization.k8s.io/cert-manager-webhook:subjectaccessreviews created role.rbac.authorization.k8s.io/cert-manager-cainjector:leaderelection created role.rbac.authorization.k8s.io/cert-manager:leaderelection created role.rbac.authorization.k8s.io/cert-manager-webhook:dynamic-serving created rolebinding.rbac.authorization.k8s.io/cert-manager-cainjector:leaderelection created rolebinding.rbac.authorization.k8s.io/cert-manager:leaderelection created rolebinding.rbac.authorization.k8s.io/cert-manager-webhook:dynamic-serving created service/cert-manager created service/cert-manager-webhook created deployment.apps/cert-manager-cainjector created deployment.apps/cert-manager created deployment.apps/cert-manager-webhook created mutatingwebhookconfiguration.admissionregistration.k8s.io/cert-manager-webhook created validatingwebhookconfiguration.admissionregistration.k8s.io/cert-manager-webhook created $ kubectl get po,svc -A  ✔   NAMESPACE NAME READY STATUS RESTARTS AGE kube-system pod/local-path-provisioner-7b7dc8d6f5-8cwd8 1/1 Running 0 8m46s kube-system pod/coredns-b96499967-cc7fw 1/1 Running 0 8m46s kube-system pod/svclb-traefik-baea9d36-vjxzg 2/2 Running 0 8m34s kube-system pod/helm-install-traefik-crd-ghbn2 0/1 Completed 0 8m46s kube-system pod/svclb-traefik-baea9d36-2vw6x 2/2 Running 0 8m34s kube-system pod/helm-install-traefik-fc9xw 0/1 Completed 1 8m46s kube-system pod/svclb-traefik-baea9d36-g42x2 2/2 Running 0 8m34s kube-system pod/traefik-56cfcbb99f-5qgvd 1/1 Running 0 8m34s kube-system pod/metrics-server-84f8d4c4fc-wx8bl 1/1 Running 0 8m46s cert-manager pod/cert-manager-cainjector-5987875fc7-g94ft 1/1 Running 0 55s cert-manager pod/cert-manager-6dd9658548-slxrp 1/1 Running 0 55s cert-manager pod/cert-manager-webhook-7b4c5f579b-76x57 1/1 Running 0 55s NAMESPACE NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE default service/kubernetes ClusterIP 10.43.0.1 443/TCP 9m2s kube-system service/kube-dns ClusterIP 10.43.0.10 53/UDP,53/TCP,9153/TCP 8m58s kube-system service/metrics-server ClusterIP 10.43.21.66 443/TCP 8m57s kube-system service/traefik LoadBalancer 10.43.170.138 174.138.1.202,188.166.109.175,188.166.88.194 80:32630/TCP,443:30841/TCP 8m35s cert-manager service/cert-manager ClusterIP 10.43.182.103 9402/TCP 57s cert-manager service/cert-manager-webhook ClusterIP 10.43.136.111 443/TCP 56s