• 1 Post
  • 21 Comments
Joined 1 year ago
cake
Cake day: January 13th, 2024

help-circle
  • Ingress controllers usually use the standard k8s services. In fact metal-lb allows workloads (like the nginx ingress controller) in the cluster to use services of type LoadBalancer, which is the default configuration. This results in an actual IP being made available to your ingress controller.


  • boblintoSelfhosted@lemmy.worldQuestions regarding k8s ingress
    link
    fedilink
    English
    arrow-up
    2
    ·
    edit-2
    6 days ago

    To get nginx ingress to use the external clients IP, you can configure the ingress controllers traffic policy. Using the helm chart, I used these values:

    controller:
              service:
                # this has a bunch of downsides, but allows source-ip based access white/deny listing.
                externalTrafficPolicy: Local
    

    For the ingress IP, I configured metal-lb to receive traffic on a static IP (using IP4AddressPool and L2Advertisement CRDs from metal-lb), which is then used for the port forwarding. I’ve never tested it because I only have a single worker node, but I expect the metal-lb controller will continue receiving traffic to that same static IP if a node goes down.











  • To be honest, it’s still a little hectic for me, but I feel the most notable change is that you can avoid being countered / masterstriked. By positioning your weapon, you can block, perfect block (allows you to strike back) or masterstrike which remains unblockable. There is now an interesting back and forth between blocking, striking back and being blocked, which can go on forever - until someone has no stamina left or someone pulls off a masterstrike.





  • boblintoLinuxsucks@lemmy.worldsudo makes no sense
    link
    fedilink
    English
    arrow-up
    14
    ·
    7 months ago

    The prompt for your password is to prevent someone that happens upon your unlocked computer to take it over. Also I think knowing which commands can be run as superuser by a given user is considered a security issue, hiding that info behind a password prompt should at least help.

    You can turn just turn the prompt off by adding NOPASSWD to your account in the sudoers file(s).