You should have 3 names when you're willing to do a blue/green deployment.
Two set of names, one for blue, one for green, which will works as is, and a production entrypoint which will point to either the blue name or green name.
The point of a blue/green deployment is to be able to test the full deploy before switching the clients entry point, so your ...
If you want a DNS lookup of one domain to resolve to another one, you have 2 options.
Modify the Container /etc/hosts file. By default any DNS lookup is done there. You schould do that in the Dockerfile.
Modify /etc/hosts in a Dockerfile
Maintain your own DNS servers with all mapping records. On container runtime just pass the DNS server.
ibuildthecloud9 gave me the right hint. Since the github issue doesn't describe how to midify the dns, I figured it out and want to document it here in case someone need to change it, too. It's stored in the configmap coredns as Corefile:
proxy . 18.104.22.168
You need to replace this by your dns server (192.168.0.19 in my case). It could be done manually using ...
There are two parts to owning a domain. The registration, and the hosting of the DNS entries. As you are transferring the domain registration, AWS needs to know whose service do you want to use for managing your DNS host names and other settings.
As a sensible default, select option (1) as this will keep everything managed with the current registrar / ...
There is a comprehensive document about k8s' DNS. According to this document one could validate whether the DNS is working by running:
- image: busybox
If you’re talking about using a Route 53 ALIAS record, you cannot set the TTL on it, for this reason. It defaults to a low value, and is managed by AWS for you (to the world it appears as an A record, and it will change often).
If you’re using a CNAME, then you can set whatever TTL you like. The TTL of the DNS record for the load balancer’s domain will be ...
No, Kubernetes will load-balance requests to a ClusterIP across all Pods with matching labels (and passing readiness checks). It won't keep traffic within the same Node.
Q: So how does the NodeLocal DNS Cache achieve to keep DNS requests local to the Node?
A: When using the NodeLocal DNS Cache, it is necessary to pass a extra arg to the Kubelet of each ...
This looks to be answered on offcail docs here
NodeLocal DNSCache improves Cluster DNS performance by running a dns caching agent on cluster nodes as a DaemonSet.
With this architecture, Pods will reach out to the dns caching agent running on the same node, thereby avoiding iptables DNAT rules and connection tracking.
Having a local cache will help improve ...
Is it possible to query Amazon DNS server from our corporate network trough the VPN tunnel?
Directly? No. The recursive resolver available by default when you create a VPC can only be accessed by an IP address in that VPC. This is a restriction that Amazon imposes.
What you can do is create a forwarder using the Route 53 Resolver service or software like ...
People often use dnsmasq for this. You can wildcard sub-domains like this fairly easily for local testing using it.
Here's an example - https://qiita.com/bmj0114/items/9c24d863bcab1a634503 but there are plenty online.
The /etc/resolv.conf is injected as a bind mount in containers by the docker engine with settings local to that docker engine. An empty file in the parent filesystem is an artifact of that bind mount. You can safely ignore that.
If a_file is not being created, check that the file is not in a volume. Temporary (anonymous) volumes are created with the ...
Usually to access an external API you can just use its URL. But you can create a Service for it if you like, the type of service should be ExternalName as described in the documentation https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types
A service in kubernetes is (mostly) used for internal communication. If you want to access an external resource by domain/ip you can just do so. If you have an IP address and you would like to have some sort of domain connected to it, you could you am service with the external name field set to the up address (we use that for database purposes). An endpoint ...
You can use dns.resolver or dns.rdatatype and update in Python like below:
for i in dns.resolver.query('blah.com', 'TXT').answer.response:
update.replace(% i , 60, dns.rdatatype.TXT, '" NEW RECORD"')
Here is an entry point to get you started, the route53 change resource record sets call can be used to update or insert one or many records on a domain.
On the agent I needed to set the server ip set to puppet in
I had accidentally put it on the agents ip address and then been incorrectly assuming i'd done something wrong on the master rather than the agent.
(server ip) (domian name) puppet
Sounds like the problem has been resolved by deleting all of the kube-proxy pods, which is an aggressive solution but if it works then good work!
Best I can offer you is a collection of links about diagnosing Kubernetes problems:
Troubleshooting Kubernetes Networking Issues
Troubleshooting GKE (GKE Specific but still useful)
When I lookup your domain thuijls.net on MXToolBox I get the following messageL
Dns record not found
They explain this to mean:
More Information About Dns Record Published
We did not find a SPF (TXT) record for the domain. Either you are using the deprecated type "SPF" record (in which case you will see a warning message for this alongside this ...
Both are completely correct. It can differ organisation by organisation.
Also, once you start using one of the domain namespace type, you will gradually remember the format and no issues will come. However, I can see one issue here which is related to SSL.
If you go with any one of the above mentioned namespaces, you need to generate multiple SSL ...
To answer your question, ill first try to give simple explanations for each policy to help with the confusion (https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/routing-policy.html).
Simple: a basic routing policy that randomly sends a user to one of
Failover: You have a primary (active) route and a secondary (passive)
route. When ...
I needed to whitelist Host, Origin and Referer in the Whitelist Headers section.
I've had more issues with CloudFront, wrote a blog post about it, maybe someone will find it helpful: https://medium.com/@justynazet/placing-a-craft-cms-application-behind-the-cloudfront-1602027ff72b
As the issue is happening only with /admin URL, this might be related with cookies which are being passed to the backend application's /admin URL.
You may need to check with CraftCMS team (or some other forums) and get the list of cookies which are being used by the /admin URL. You can whitelist those cookies in cloudfront specifically for /admin URL.
We have not been able to figure out what the problem is or what a solution could be.
The workaround is actually not using the 10.0.2.0 subnet, so I will add that as an answer as requested in the comments.
If someone finds the real issue and solution here, I will gladly accept that answer though.
Can you obtain a secure certificate for someone else's domain or subdomain without their help - hopefully not.
One of the core security pillars of a secure certificate is that it ensures that you are actually connected (through an encrypted connection) to the the site you wanted to connect to. For this purpose the minimum check every certificate issuer ...
As I understand it you need to establish a network service (I.e, compose file), though if you are working with a docker file (e.g, ver. docker 1.x < 2) you typically issue a command or execute a script. In either case, I’ll need to create a new network service and bridge ports (I.e, expose port) to make them accessible:
A <-> B -> C
Check out the ...