View source for Process/K8s Installation/Ingress

== Resource == 
Ingress Documentation[https://kubernetes.io/docs/concepts/services-networking/ingress/]
* Tool: KOPS 
* Tool: ALB 
* Environment configuration 

 export NAME=bbbxlpworkflow.com
 export KOPS_STATE_STORE=s3://bbb-xlpworkflow-state-store
 export KB=kubernetes-dashboard
 kops export kubecfg --admin


* https://www.poeticoding.com/create-a-high-availability-kubernetes-cluster-on-aws-with-kops/ 

== Structure ==
[[Blog/Kubernetes Ingress with AWS ALB Ingress Controller]]
* ALB is highly integrated with AWS.  
* [[Blog/Choosing the Right Load Balancer on Amazon: AWS Application Load Balancer vs. NGINX Plus]]
** Important Note: on AWS, there are several ways to do Ingress, not necessarily ALB.

= Working Progress = 

== Topic: DNS == 
=== Question: Can I not use Route 53? [https://github.com/kubernetes/kops/issues/794] === 
* Video: How to Use GoDaddy Domains with AWS Route 53 Hosted Zones[https://www.youtube.com/watch?v=zFuluVTsF14]
=== Test DNS === 
[[File:Screen Shot 2021-08-02 at 11.18.55 AM.png|thumb|successfully dig bbbxlpworkflow.com after setting the name server]]

=== Question: How does subdomain work? ===
* Subdomains of a domain share the postfix. 



== Question: how to switch between multiple clusters ? [https://kubernetes.io/docs/tasks/access-application-cluster/configure-access-multiple-clusters/] ==
* Issue: cannot find how to export config 
** <code>  kops export kubecfg dev.yourdomain.com --admin </code> 
** Notice: need admin! Otherwise will have credential fault : <code> not logged in</code> 
** Tutorial:deploying-kubernetes-to-aws-using-kops [https://codefresh.io/kubernetes-tutorial/tutorial-deploying-kubernetes-to-aws-using-kops/]
** Tutorial: how-to-import-state-created-on-another-server[https://stackoverflow.com/questions/48084506/how-to-import-state-created-on-another-server]

== Topic: Credentials == 
* Question: Not sure where is id_rsa in Video: [https://www.notion.so/K8S-a1f3e06e28374728877a0ccabd3620da#7c476e4f80c346be848a68ea60459258]
** Where is .crt and .key [https://kops.sigs.k8s.io/custom_ca/] ? 
** https://www.notion.so/K8S-a1f3e06e28374728877a0ccabd3620da#ea145f73d3894fc0926d0b0f5c5fd445
** Notice: need correct url when describing s3 bucket []
** <code> aws s3 ls s3://bbb-xlpworkflow-state-store/bbbxlpworkflow.com/pki/ </code> 

=== Deadlock: Kops set secret needs context but need context to access kubectl===
* Solved:
**  <code> kops create secret sshpublickey admin -i ~/.ssh/id_rsa.pub --name bbbxlpworkflow.com </code>  
** <code> kops get secrets --name bbbxlpworkflow.com </code>

== Issue: Unable to connect to server: dial tcp 203.0.113.123:443: i/o timeout == 

== Issue: How to manage instance in Kops ? == 
* https://stackoverflow.com/questions/53204326/kops-pause-cluster-should-bring-ec2-instance-cluster-in-stopped-state 
* <code> kops edit ig <ig-name> </code>  and set the max, min argument of master and slave node. 

== Issue: cannot kubectl get nodes == 
* reason network fail
* Kops used kubenet as default
* use Calio network  and worked, by modifying the networking in the kops cluster config file 
** [https://kops.sigs.k8s.io/topology/ Topology]

== Issue: cannot login == 
* https://kops.sigs.k8s.io/cli/kops_export_kubeconfig 
* https://serverfault.com/questions/1053613/kubectl-error-you-must-be-logged-in-to-the-server-unauthorized-when-using-kube
* Possible Solution: 
** These need eksctl [https://aws.amazon.com/blogs/opensource/deploying-aws-iam-authenticator-kubernetes-kops/] [https://aws.amazon.com/blogs/opensource/introducing-fine-grained-iam-roles-service-accounts/] 
** '''Current solution''': download json file [https://raw.githubusercontent.com/kubernetes-sigs/aws-load-balancer-controller/v2.2.0/docs/install/iam_policy.json]
*** Tutorial : [https://github.com/kubernetes/kops/blob/master/docs/iam_roles.md IAM in KOPS] 
*** There are two ways: edit in cluster level and edit in node level. To notice, when updating IAM in kops , special command is required.  [https://github.com/kubernetes/kops/blob/master/docs/iam_roles.md#use-existing-aws-instance-profiles] 
** '''Limitation''' :  can only bind policy to instance role 
*** Question: what is the difference btw service account and ROLE? 
*** Tutorial: https://medium.com/devops-dudes/the-difference-between-an-aws-role-and-an-instance-profile-ae81abd700d
**** Note: For any authentication system, there are 2 key parts 
****# Who am I  (Profiles) 
****# What am I permitted to do ? (Roles) 
**** AWS IAM user includes both and other tools often require both to be setup. 

== Issue: Resource Unavailable == 
[[File:Process-K8s Installation-Ingress-Resource Unavailable.png|500px|none|left]]
* Use <code> kubectl describe </code> to inspect
* Reason: minimum replica unavailable
* Try to update cluster but new pods are not added
* Try <code> kubectl apply -f file.yml </code> but did not redeploy. 
* Solved by 
 kubectl patch -n kube-system deployment aws-load-balancer-controller -p "{\"spec\": {\"template\": {\"metadata\": { \"labels\": { \"redeploy\": \"$(date +%s)\"}}}}}"
** Why ? 

== Topic: Ingress Specification == 
=== Question: How to write host and path precisely? === 



== Topic : Configuring Load Balancer == 
In AWS, we can use its Elastic Loadbalacer or use the ALB controller to create Loadbalancer
* Manually:  [[File:Process-K8s Installation-Ingress-AWS Load Balancer.png|thumb|none]]
* Automatically : 


== Issue: After log out, cannot log in == 
<code> kops error: You must be logged in to the server (Unauthorized) </code> 
Solution: https://stackoverflow.com/questions/59987859/kubectl-error-you-must-be-logged-in-to-the-server-unauthorized

== Issue: Controller cannot build ingress == 
* ALB need Nodeport [https://github.com/kubernetes-sigs/aws-load-balancer-controller/issues/1695] But still not solved. 

== Progress: ALB controller can be built ==

== Issue: cannot reach service, seems alb OK, can dig  ==
* @Aug 6, 2021, 2:38 PM 
* cannot dig echoserver.com → check Route53 → found dont have record
* As the ingress is built, the aws-generated load balancer domain can be dug. ; But to dig any DNS, need to bind the domain in AWS Route53 
* Bind DNS to LB in AWS Route53


== Progress: Debugging Traffic == 
[https://medium.com/@ManagedKube/kubernetes-troubleshooting-ingress-and-services-traffic-flows-547ea867b120 Tutorial]
* Pod Level
** Your application will most likely have some other output, but the general idea here is to make sure the logs look good.
* Service Level: 
** Need to check ENDPOINTS , which indicate that the pods are connected 
** Log: KB dashboard service pods succeed. the endpoints matches 
** 
[[File:Process-K8s Installation-Ingress-service debugging.png|500px]]
[[File:Process-K8s Installation-Ingress-service debugging 2.png|500px]]
** [[To learn ::Need health check ]]
* Ingress : 
** Issue: cannot find the backend pods
* ELB: 
** Question: what's the difference between alb and elb? 
** Issue: try to curl the dashboard ELB's dns, get <code> Client sent an HTTP request to an HTTPS server </code> 
*** try to open 443→ but node security group not allow → so I need to fix in cli or aws..?
*** → try other option: (which is also necessary before moving to HTTPS) change bach to HTTP → fail by now 
* From HTTP to HTTPS 
** https://medium.com/@ManagedKube/kubernetes-troubleshooting-ingress-and-services-traffic-flows-547ea867b120
** Question: what exactly is the effect when we cannot use HTTPS? is it not going

== Progress8.14 == 
* ALB 2048 succeed; 
* Nginx COntroller apple service, curl http://domain/dashboard , 404 not found
* Nginx Controller dashboard service,  curl http://domain/dashboard , 404 not found ; curl https://domain, get curl: (60) SSL certificate problem: self signed certificate
* When added default service, get 502 bad gateway

== Topic: Service accounts == 
Until recently, the only way for a Pod to use the AWS API was to either provision static credentials or assign additional IAM Policies to the Nodes Pods were running on. kOps addons rely on the latter, which has several issues.. 
* ALB requirements [https://kubernetes-sigs.github.io/aws-load-balancer-controller/v2.2/deploy/installation/]
* Solution

== Other Questions: == 
* How does the request flow into k8s thru LB?  
* How does the https resource placed on the web?? 
* Master vs node, still not clear their responsibility...  Like how does their IAM policy differ? like in the ALB case?  
* Do we need to manually configure the master nodes every time??


= Meta =
This contains the issue of the system. 
* A type of object can only place in one place.  Need a way to let it distribute to multiple pages.
* When saving code data, it is better to copy the code instead of screenshot?

== Namespace Management of K8s Installation Task == 
=== Definition === 
* Tree form vs Argumentation form; static vs adaptive form; 

=== Weak Structure === 
Since there are lots of data popping out from the task and the workflow is not investigated yet, it is infeasible to structure them perfectly at the first time.  Therefore, the bottom-up approach is preferred over the top-down approach of structuring.  The unstructured data will be annotated and organized locally before all parts are merged.  


=== Time Centric Data === 
Although all the data emerge chronologically, merging all the data in one channel will increase noise (e.g. user contributions in MediaWiki).  In order to grasp the semantics of time-centric data, we need to assign specific annotations on data items so that we can filter them out.  The structured data types declared in a task are good annotations.

=== Structured Data === 
* The concerning knowledge in K8s domain should be modeled properly.  By annotating the model, we could manage the domain by managing model in PKC. (Topic: how to model more complex knowledge using page and relations?) 
** For example, we can annotate a specific time of a video and assign the proper name to this annotation.  In the future, we can use NLP and HCI to collect the semantics of it. 
* Question: Something that I think I should know for the task.  Due to time limitations, the question should be answered with priority.
** A question should be related to information resources or knowledge so that it is resolved.  Or it could turn into a topic for development. 
* Topic: A developing section of knowledge. 
* Issue: Something which went wrong in a project or a task which needs to be fixed.  Due to time limitations, the issue should have priority.  
* Tutorial, Article:
** link to the content
** annotations
** notes: given the article and the viewpoint of the current task, return its summary.  The summary will probably contribute to knowledge.