Knative install on hetzner-k3s

[stormwalkerec]

Create cluster as per normal.

Follow the Knative Serving with YAML Guide

Select Kourier & install

When complete, exec this patches (edit to your needs):

kubectl patch service kourier \
  --namespace kourier-system \
  --type merge \
  --patch '{"metadata":{"annotations":{"load-balancer.hetzner.cloud/location":"fsn1","load-balancer.hetzner.cloud/use-private-ip":"true","load-balancer.hetzner.cloud/name":"knative-lb","load-balancer.hetzner.cloud/hostname":"knative.domain.com","load-balancer.hetzner.cloud/uses-proxyprotocol":"true"}}}'

//patch kourier to understand proxy protocol
kubectl patch configmap/config-kourier \
  -n knative-serving \
  --type merge \
  -p '{"data":{"enable-proxy-protocol":"true"}}'

I want cert manager to auto manage everything, and use letsencrypt with DNS challenge.

#Install cert manager

kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.11.0/cert-manager.yaml

As I'm using cloudflare, will continue using that as example. mod as needed
Make a cloudflare access token

create cloudflare/cloudflare-secret.yaml file:

apiVersion: v1
kind: Secret
metadata:
  name: cloudflare-api-token-secret
  namespace: cert-manager
type: Opaque
stringData:
  api-token: "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"

run the command

kubectl apply -f cloudflare/cloudflare-secret.yaml

create letsencrypt-issuer.yaml file:

apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt-issuer
spec:
  acme:
    server: https://acme-v02.api.letsencrypt.org/directory
    # This will register an issuer with LetsEncrypt.  Replace
    # with your admin email address.
    email: [email protected]
    privateKeySecretRef:
      # Set privateKeySecretRef to any unused secret name.
      name: letsencrypt-issuer
    solvers:
      - dns01:
          cloudflare:
            apiTokenSecretRef:
              name: cloudflare-api-token-secret
              key: api-token

run:

kubectl apply -f letsencrypt-issuer.yaml

kubectl apply -f https://github.com/knative/net-certmanager/releases/download/knative-v1.10.0/release.yaml

kubectl patch --namespace knative-serving configmap config-network -p '{"data": {"namespace-wildcard-cert-selector": "{\"matchExpressions\": [{\"key\":\"networking.knative.dev/disableWildcardCert\", \"operator\": \"NotIn\", \"values\":[\"true\"]}]}"}}'

edit and add (there is an entry in _example, need to add under _example

kubectl edit configmap config-certmanager -n knative-serving

#edit
issuerRef: |
    kind: ClusterIssuer
    name: letsencrypt-issuer

edit and add

kubectl edit configmap config-network -n knative-serving

apiVersion: v1
kind: ConfigMap
metadata:
  name: config-network
  namespace: knative-serving
data:
   ...
   autoTLS: Enabled
   ...
   ...
   httpProtocol: Redirected
   ...

You can now install one of the many test scripts.

I use this hello world go img (support x86-64 & arm:

kn service create hello1 --port 8080 --image csantanapr/helloworld-go:latest

kubectl get ksvc

Enjoy !!

[vitobotta]

Thanks! I am sure someone will find it useful. I will play again with knative when I have time. I tried it a while ago but it was still not mature enough and I built an abstraction on top of k8s for our backend at Brella. There were some limitations etc so we couldn't use it. But curious to see how the project has evolved since then.