Kubernetes

Five posts, and they are really one story told from two directions: a K3s cluster on an Intel NUC at home, and OpenShift at a bank. Both ran into the same wall, which was never the orchestrator itself but the layer where it meets the network and the certificate store.

So: wildcard certificates that modern browsers would actually accept, DNS challenges so those certificates could be issued at all, Traefik middleware to redirect HTTP to HTTPS on selected services without breaking the ACME challenges, PKCS12 keystores for a Spring Boot app sitting behind an OpenShift re-encrypt route, and the real visitor IP arriving as the ingress controller's own address instead of the visitor's.

These are from 2021 and 2022. The concepts have held up; the YAML has not necessarily. Check your Traefik major version and your cert-manager API version before pasting anything, because both moved after these were written.

2021–2022 / 5 posts