this post was submitted on 07 May 2024
19 points (95.2% liked)
Homelab
687 readers
3 users here now
founded 1 year ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
Upgrades to services - that’s why I run dev namespaces and copy over my production shares to dev and utilize zfs snapshotting.
I haven’t set up testing yet and only just started with prometheus monitoring but so far things run pretty well.
Oh, dev namespaces are a good idea. Do you have a dev domain then too?
I toyed with dev domain but ended up using namespace.tld and postfixing -dev to my namespace so it works out to service.tld and service-dev.tld.
Ah okay that makes sense, you’re using the internal cluster domain to route to services
I have automated traefik to route the traffic, it sets the dns and ingress route. I’m also doing as you suggested for service to service connections.
That makes sense!
Have you played with anything like Istio to secure in-cluster communications? I think Hashicorp Consul can do something similar to encrypt service to service communications.
I looked into it but I felt at the time it was too complex, maybe I’ll look at it again. Currently I am using wireguard for all cluster node-to-node traffic. It seemed like a reasonable tradeoff at the time, but it is at the network layer instead of application, so I really should revisit that at some point.
Yeah it very adds some extra complexity and it’s more important for if you are hosting in public clouds anyways IMO.