mathstodon.xyz is one of the many independent Mastodon servers you can use to participate in the fediverse.
A Mastodon instance for maths people. We have LaTeX rendering in the web interface!

Server stats:

2.8K
active users

#certmanager

1 post1 participant0 posts today
Replied in thread

It is now already Tuesday morning but everything is back online.

✅ #Pihole is back up so #DNS resolution works again and the rest of the family can use the internet!
✅ NFS provisioners can provide persistent volumes,
✅ #CertManager issues HTTPS certificates,
✅ #Unifi controller is back up to allow me to actually make changes to my network config (such as, say, change DNS settings when pihole is down... )
✅ #HomeAssistant automates away,
✅ #Nextcloud is seeing sunnier days,
✅ #Photoprism <3

I'm going to be at #kubecon. At the maintainers summit beforehand, at the contribfest, and at the #headlamp project pavilion.

Contribfest session: kccnceu2025.sched.com/event/1t

I'm looking forward to connecting with folks working on different projects. People have been quite busy building out Headlamp Kubernetes UIs for ecosystem tooling and standards like #gatewayapi #prometheus #keda #flux #minikube #backstage #inspektorgadget #flagger and #certmanager

kccnceu2025.sched.comKubeCon + CloudNativeCon Europe 2025: 🚨 Contribfest: Make Your Own UI for Kube...View more about this event at KubeCon + CloudNativeCon Europe 2025

So I've managed to finally get #Traefik working with #CertManager.

It took lots of frustration, a sidequest around attempting replace Traefik with the #Cilium Gateway API implementation, to lots of annoyance and frustration, broken iptables, but we finally got back to pretty much where we started and things started to fall in place from here.

So the good news is by separating certificates from Traefik, we can now get Traefik doing HA. Why you ask? Just cause.

I've just merged a huge PR to my #Orked (O-tomated RKE Distribution - GREAT NAME I KNOW) that makes it easier than ever for anyone to set up a production-ready #RKE2 #Kubernetes cluster in their #homelab.

With this collection of scripts, all you need to do is just provision the nodes required, including a login/management node, and run the scripts right from the login node to configure all of the other nodes to make up the cluster. This setup includes:

- Configuring the Login node with any required or essential dependencies (such as
#Helm, #Docker, #k9s, #kubens, #kubectx, etc.)

- Setup passwordless
#SSH access from the Login node to the rest of the Kubernetes nodes

- Update the
hosts file for strictly necessary name resolution on the Login node and between the Kubernetes nodes

- Necessary, best practice configurations for all of the Kubernetes nodes including networking configuration, disabling unnecessary services, disabling swap, loading required modules, etc.

- Installation and configuration of RKE2 on all the Kubernetes nodes and joining them together as a cluster

- Installation and configuration of
#Longhorn storage, including formatting/configuring their virtual disks on the Worker nodes

- Deployment and configuration of
#MetalLB as the cluster's load-balancer

- Deployment and configuration of
#Ingress #NGINX as the ingress controller and reverse proxy for the cluster - this helps manage external access to the services in the cluster

- Setup and configuration of
#cert-manager to obtain and renew #LetsEncrypt certs automatically - supports both #DNS and HTTP validation with #Cloudflare

- Installation and configuration of
#csi-driver-smb which adds support for integrating your external SMB storage to the Kubernetes cluster

Besides these, there are also some other
helper scripts to make certain related tasks easy such as a script to set a unique static IP address and hostname, and another to toggle #SELinux enforcement to on or off - should you need to turn it off (temporarily).

If you already have an existing RKE2 cluster, there's a step-by-step guide on how you could use it to easily configure and join additional nodes to your cluster if you're planning on expanding.

Orked currently expects and supports
#RockyLinux 8+ (should also support any other #RHEL distros such as #AlmaLinux), but I am planning to improve the project over time by adding more #Linux distros, #IPv6 support, and possibly even #K3s for a more lightweight #RaspberryPi cluster for example.

I've used this exact setup to deploy and manage vital services to hundreds of unique clients/organisations that I've become
obsessed with sharing it to everyone and making it easier to get started. If this is something that interests you, feel free to check it out!

If you're wondering what to deploy on a Kubernetes cluster - feel free to also check out my
#mika helm chart repo 🥳

🔗 https://github.com/irfanhakim-as/orked

🔗 https://github.com/irfanhakim-as/charts

O-tomated RKE Distribution (Orked) is a collection of scripts that aims to easily and reliably set up a production-ready Kubernetes cluster based on RKE2, with Longhorn storage, that is highly perf...
GitHubGitHub - irfanhakim-as/orked at stop-clusterO-tomated RKE Distribution (Orked) is a collection of scripts that aims to easily and reliably set up a production-ready Kubernetes cluster based on RKE2, with Longhorn storage, that is highly perf...
Continued thread

So far it seems to be a spec for how to define and then use standard naming (and naturally tokens/certs) to identify and then of course authenticate workloads #KubeCon

Best of all, a quick Google shows that there are already people playing with #SPIFFE and #OpenPolicyAgent

github.com/spiffe/spire-tutori

This session is showing off integration with #CertManager

GitHubspire-tutorials/opa-policy.rego at main · spiffe/spire-tutorialsContribute to spiffe/spire-tutorials development by creating an account on GitHub.