Using K8GB with a GSS-TSIG compatible DNS provider

Sample solution: Azure based private deployment with Windows DNS integration

In this sample solution we will create a common hub and spoke architecture with two private AKS clusters in different regions. The same pattern can be used with any other Kubernetes distribution and any other DNS provider that supports GSS-TSIG.

Here we provide an example of k8gb deployment in Azure environment with Windows DNS as edgeDNS provider.

Reference Setup

The reference setup includes two private AKS clusters that can be deployed on two different regions for load balancing or to provide a failover solution.

GLSB with K8gb on Windows DNS

The solution design can be found here.

Configurable resources:

Run the sample

Deploy infrastructure

This action will create resource groups, vnets, peering between vnets and private AKS clusters to run all required workloads

make deploy-infra

Setup clusters

Install required Ingress controller in both clusters in order to deploy K8GB and demo application

make setup-clusters

Configure GSS-TSIG authentication for DNS updates

Before deploying K8GB and the demo workload, ensure required configurations on Windows DNS

Domain Controller config

Network Policy - Kerberos auth

DNS Secure Updates

DNS Zone Transfers

K8GB / ExternalDNS configuration

  enabled: true
    - host: AD-DC.k8gb.local #when using gssTsig, use the FQDN of the host, not an IP
    - port: 53
      enabled: false
      enabled: false
        - tsig-secret-alg: hmac-sha256
        - tsig-keyname: externaldns-key
      enabled: true
        - kerberos-username: ad-user-account
        - kerberos-password: ad-user-account-password
        - kerberos-realm: cloud.lab

Install K8gb

This action will install K8gb in both clusters using the provided sample values.yaml for each cluster. Please ensure that the are correctly updated before execution

make deploy-k8gb

Install demo app

Deploys the sample Podinfo workload with failover GLSB configured using annotations in the Ingress resource samples. Ensure that the hosts on the samples are correctly updated before execution

make deploy-demo

Destroy lab

make destroy-infra