How to expose Linkerd dashboard on GKE?

[samstride]

Hey Folks,

I have linkerd deployed in a namespace called linkerd.

With the help of the internet, I have an ingress setup with GKE managed certs in default namespace as follows:

apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
  name: company-ingress
  annotations:
    kubernetes.io/ingress.global-static-ip-name: redacted
    networking.gke.io/managed-certificates: redacted
    kubernetes.io/ingress.allow-http: "false"
spec:
  rules:
    - host: api.company.io
      http:
        paths:
          - backend:
              serviceName: voting-service # <- voting-service is a service in default namespace
              servicePort: 9000
    - host: linkerd.company.io
      http:
        paths:
          - backend:
              serviceName: linkerd
              servicePort: 8084
---
apiVersion: v1
kind: Service
metadata:
  name: linkerd
spec:
  type: ExternalName
  externalName: linkerd-web.linkerd.svc.cluster.local
  ports:
    - port: 8084

I am looking at the docs and I was hoping I could use the single ingress in default to access linkerd-web in linkerd.

Was wondering if anyone has tried this or can help me out with the yaml? Cheers.

[cpretzer]

Hi @samstride I attempted to set this up in my environment, but the backend for the Ingress never became healthy. It probably has something to do with my configuration.

That being said, I think you can accomplish this with just the basic ingress configuration that you have. I don't know that you need the ExternalName service, but I'm not 100% sure about that.

Have you tried just this:

apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
  name: company-ingress
  annotations:
    kubernetes.io/ingress.global-static-ip-name: redacted
    networking.gke.io/managed-certificates: redacted
    kubernetes.io/ingress.allow-http: "false"
spec:
  rules:
    - host: api.company.io
      http:
        paths:
          - backend:
              serviceName: voting-service # <- voting-service is a service in default namespace
              servicePort: 9000
    - host: linkerd.company.io
      http:
        paths:
          - backend:
              serviceName: linkerd-web
              servicePort: 8084

[samstride]

@cpretzer , Yup, I tried that already and again now and this is the error message:

Warning  Translate  52s (x14 over 114s)  loadbalancer-controller  Translation failed: invalid ingress spec: could not find service "default/linkerd-web"

My understanding is that the ingress in default namespace cannot access linkerd-web in a different linkerd namespace and hence the ExternalName service is required?

[cpretzer]

@samstride I did a bit of research and it looks like GKE doesn't support the ExternalName approach.

It sounds like it might work if you deploy your own ingress like ambassador or nginx, but I'm not sure about the GKE ingress.

[samstride]

Hmmm, looks like no support for now. @cpretzer , with an nginx ingress, my initial analysis is that I might need to extra things for cert management?

[samstride]

@cpretzer , I deleted existing ingress, and created a new ingress in namespace linkerd.

apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
  name: company-ingress
  annotations:
    kubernetes.io/ingress.global-static-ip-name: redacted
    networking.gke.io/managed-certificates: redacted
    kubernetes.io/ingress.allow-http: "false"
spec:
  rules:
    - host: linkerd.company.io
      http:
        paths:
          - backend:
              serviceName: linkerd-web
              servicePort: 8084

I also changed the service type to NodePort on linkerd-web.

Still doesn't work.

It turns out that the GKE ingress looks for a HTTP 200 at "/". Hmmm, any ideas how to solve that one?

[cpretzer]

hi @samstride

It looks like the GKE ingress can be configured to use a readiness probe from a container.

Have you looked in to that configuration?

[samstride]

@cpretzer , Assuming a GKE cluster has just linkerd installed in namespace linkerd, what readiness probe in linkerd namespace should I be using?