tunnel-server: add basic deployment guide #405
Conversation
| ## Requirements | ||
|
|
||
| - A Kubernetes cluster | ||
| - An ingress solution to make K8S Services accesible from your network (e.g, Traefik). In this example, we'll use your cloud provider's load balancer. |
There was a problem hiding this comment.
The "An ingress solution" might be confusing here due to the ambiguity with k8s ingress resources.
Since Traefik and cloud provider load balancer (based on k8s service-> loadbalancer) work at different layers (l4 vs l7), and the sentence imply that we're using the cloud provider's load balancer instead (which is incorrect, since we'll need service->loadbalancer endpoint to expose traefik if we were to use it).
In addition, cloud providers has both solutions for l4 and l7 integrated with Kubernetes (via k8s service->loadbalancer and k8s gateway/ingress) so it's not clear which one are we referring to.
| - Google Cloud: [GKE](https://cloud.google.com/kubernetes-engine/docs/concepts/service-load-balancer) | ||
| - Azure: [AKS](https://learn.microsoft.com/en-us/azure/aks/load-balancer-standard) | ||
|
|
||
| Another approach would be to use a 3rd-party ingress solution like [Traefik](https://doc.traefik.io/traefik/user-guides/crd-acme/). |
There was a problem hiding this comment.
Traefik CRD won't solve the problem of configuring dns.
In k8s, there's external dns (https://github.com/kubernetes-sigs/external-dns) which works with many dns providers, but I didn't see wildcard support
There was a problem hiding this comment.
Looks awesome, added few notes.
In the future, it might be worth having an example with k8s gateway APIs which means there's no need for stunnel/sslh.
TLSRoute can be used for the ssh traffic, and HTTPRoute for the HTTP traffic. (although in this case routing will be based on hostname and not on ALPN)
royra
force-pushed
the
tunnel-server-deployment-docs
branch
from
f409353 to
77de072
Compare
[Is this a bugfix/feature/doc-improvement?]
This is a
By submitting this pull request I confirm I've read and complied with the below requirements 🖖
If this is a bug fix or feature: