Support cluster-external Kubernetes client. #1159
Conversation
timoreimann
changed the title
timoreimann
force-pushed
the
external-k8s-client
branch
from
f3e8750
to
8faeb95
Compare
| # Traefik will use env variable KUBERNETES_SERVICE_HOST | ||
| # and KUBERNETES_SERVICE_PORT_HTTPS as endpoint | ||
| # When deployed as a replication controller in Kubernetes, Traefik will use | ||
| # the environment variables KUBERNETES_SERVICE_HOST and KUBERNETES_SERVICE_PORT |
There was a problem hiding this comment.
Note that I changed KUBERNETES_SERVICE_PORT_HTTPS to KUBERNETES_SERVICE_PORT because that's what client-go uses for its check.
timoreimann
force-pushed
the
external-k8s-client
branch
3 times, most recently
from
d44bd8c
to
e626bc3
Compare
timoreimann
force-pushed
the
external-k8s-client
branch
2 times, most recently
from
4033c03
to
9b64552
Compare
|
I feel like this should be a new backend ? i.e. we should have kubernetes-proxy as well as kubernetes-ingress |
|
@Russell-IO not sure I understand. You mean backends as in where Traefik sends payload traffic to? This PR is about how Traefik should connect to the Kubernetes API server. Maybe I'm missing something. |
|
I don't think it requires a new backend. Instead of expecting traefik to run IN kubernetes to access the API server, this will allow traefik to run OUTSIDE of kubernetes, and still access the api server. There are some scenarios where this will completely break, such as the API server returning pod network IPs, which may not be accessible from outside the cluster. Despite that, I think that since it uses the same client, just different config, there should be no need for a different backend or tests, since they should be identical. |
|
@errm did you have a chance to look at this PR yet? Thanks! |
timoreimann
force-pushed
the
external-k8s-client
branch
4 times, most recently
from
0ff31e6
to
f674849
Compare
There was a problem hiding this comment.
Thanks @ttr :)
Could you also complete docs/toml.md?
Other than that, LGTM!
|
@emilevauge thanks for checking if I'm alive but I was not near this PR :D |
|
For a moment, I thought someone had hijacked my Github account. Then I realized the Slack / Github username mismatch. :-) @ttr I guess that means I have to do the documentation update myself then. ;-) |
|
"read source code" is not enough ? :)
Have fun
…On 6 March 2017 19:06:48 GMT+00:00, Timo Reimann ***@***.***> wrote:
For a moment, I thought someone had hijacked my Github account. Then I
realized the Slack / Github username mismatch. :-)
@ttr I guess that means I have to do the documentation update myself
then. ;-)
--
You are receiving this because you were mentioned.
Reply to this email directly or view it on GitHub:
#1159 (comment)
--
Sent from my Android device with K-9 Mail. Please excuse my brevity.
|
timoreimann
force-pushed
the
external-k8s-client
branch
from
18a4fde
to
d764445
Compare
|
@emilevauge I updated toml.md. WDYT? |
Detect whether in-cluster or cluster-external Kubernetes client should
be used based on the KUBERNETES_SERVICE_{HOST,PORT} environment
variables.
Adds bearer token and CA certificate file path parameters.
timoreimann
force-pushed
the
external-k8s-client
branch
from
d764445
to
07b8ea5
Compare
Detect whether in-cluster or cluster-external Kubernetes client should
be used based on the KUBERNETES_SERVICE_{HOST,PORT} environment
variables.
Adds bearer token and CA certificate file path parameters.
ldez
added
kind/enhancement
Detect whether in-cluster or cluster-external Kubernetes client should be used based on the
KUBERNETES_SERVICE_{HOST,PORT}environment variables.My main motivation for this PR was to enable connecting to a Kubernetes cluster via
kubectl proxy, which technically is not an in-cluster usage.Given a bearer token and CA cert files, it's also possible to connect without a proxy while running outside of a cluster.
I will add some more tests once we agree on the general direction of this PR.
/cc @emilevauge @errm @dtomcej