{"action":"created","issue":{"url":"https://api.github.com/repos/mozmeao/infra/issues/414","repository_url":"https://api.github.com/repos/mozmeao/infra","labels_url":"https://api.github.com/repos/mozmeao/infra/issues/414/labels{/name}","comments_url":"https://api.github.com/repos/mozmeao/infra/issues/414/comments","events_url":"https://api.github.com/repos/mozmeao/infra/issues/414/events","html_url":"https://github.com/mozmeao/infra/issues/414","id":249771032,"number":414,"title":"SSL/TLS for MDN","user":{"login":"escattone","id":3743693,"avatar_url":"https://avatars2.githubusercontent.com/u/3743693?v=4","gravatar_id":"","url":"https://api.github.com/users/escattone","html_url":"https://github.com/escattone","followers_url":"https://api.github.com/users/escattone/followers","following_url":"https://api.github.com/users/escattone/following{/other_user}","gists_url":"https://api.github.com/users/escattone/gists{/gist_id}","starred_url":"https://api.github.com/users/escattone/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/escattone/subscriptions","organizations_url":"https://api.github.com/users/escattone/orgs","repos_url":"https://api.github.com/users/escattone/repos","events_url":"https://api.github.com/users/escattone/events{/privacy}","received_events_url":"https://api.github.com/users/escattone/received_events","type":"User","site_admin":false},"labels":[{"id":542068517,"url":"https://api.github.com/repos/mozmeao/infra/labels/AWS","name":"AWS","color":"c5def5","default":false},{"id":533338629,"url":"https://api.github.com/repos/mozmeao/infra/labels/k8s%20infra","name":"k8s infra","color":"fbca04","default":false},{"id":533342751,"url":"https://api.github.com/repos/mozmeao/infra/labels/MDN","name":"MDN","color":"1d76db","default":false},{"id":601480222,"url":"https://api.github.com/repos/mozmeao/infra/labels/Q3","name":"Q3","color":"fef2c0","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":{"url":"https://api.github.com/repos/mozmeao/infra/milestones/8","html_url":"https://github.com/mozmeao/infra/milestone/8","labels_url":"https://api.github.com/repos/mozmeao/infra/milestones/8/labels","id":2599042,"number":8,"title":"MDN AWS hosting","description":"- first push is for maintenance mode Kuma running in AWS with MySQL running in K8s\r\n- second push is for prod Kuma running in AWS with MySQL hosted by RDS","creator":{"login":"metadave","id":58244,"avatar_url":"https://avatars3.githubusercontent.com/u/58244?v=4","gravatar_id":"","url":"https://api.github.com/users/metadave","html_url":"https://github.com/metadave","followers_url":"https://api.github.com/users/metadave/followers","following_url":"https://api.github.com/users/metadave/following{/other_user}","gists_url":"https://api.github.com/users/metadave/gists{/gist_id}","starred_url":"https://api.github.com/users/metadave/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/metadave/subscriptions","organizations_url":"https://api.github.com/users/metadave/orgs","repos_url":"https://api.github.com/users/metadave/repos","events_url":"https://api.github.com/users/metadave/events{/privacy}","received_events_url":"https://api.github.com/users/metadave/received_events","type":"User","site_admin":false},"open_issues":22,"closed_issues":16,"state":"open","created_at":"2017-06-22T18:32:25Z","updated_at":"2017-08-15T17:19:21Z","due_on":"2017-09-30T07:00:00Z","closed_at":null},"comments":2,"created_at":"2017-08-11T23:34:44Z","updated_at":"2017-08-15T21:41:36Z","closed_at":null,"body":"How are we going to handle SSL/TLS for MDN? Probably setup the AWS load balancers in the K8s cluster with certs, terminating SSL there and then everything after that is HTTP? The certs will be different for dev, stage and prod, but  can we have load balancers with different certs within the same cluster? If so, it would have to be possible to select a specific (dev) load balancer when creating the dev \"web\" service?"},"comment":{"url":"https://api.github.com/repos/mozmeao/infra/issues/comments/322597906","html_url":"https://github.com/mozmeao/infra/issues/414#issuecomment-322597906","issue_url":"https://api.github.com/repos/mozmeao/infra/issues/414","id":322597906,"user":{"login":"escattone","id":3743693,"avatar_url":"https://avatars2.githubusercontent.com/u/3743693?v=4","gravatar_id":"","url":"https://api.github.com/users/escattone","html_url":"https://github.com/escattone","followers_url":"https://api.github.com/users/escattone/followers","following_url":"https://api.github.com/users/escattone/following{/other_user}","gists_url":"https://api.github.com/users/escattone/gists{/gist_id}","starred_url":"https://api.github.com/users/escattone/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/escattone/subscriptions","organizations_url":"https://api.github.com/users/escattone/orgs","repos_url":"https://api.github.com/users/escattone/repos","events_url":"https://api.github.com/users/escattone/events{/privacy}","received_events_url":"https://api.github.com/users/escattone/received_events","type":"User","site_admin":false},"created_at":"2017-08-15T21:41:36Z","updated_at":"2017-08-15T21:41:36Z","body":"I learned two things from talking to @metadave today:\r\n1. AWS ELB's are created dynamically when a service type of `LoadBalancer` is specified when creating a K8s service (for some reason, I thought a pool of them had to be created manually for a K8s cluster).\r\n2. We can specify the cert for the dynamically-created AWS ELB via an annotation on the K8s service.\r\n\r\nRegarding the second point, see below for the actual templatized YAML that we'll use for MDN's `web` service (all of MDN's other services are of type `ClusterIP` and so are internal to the cluster).\r\n```\r\nkind: Service\r\napiVersion: v1\r\nmetadata:\r\n  name: {{ SERVICE_NAME }}\r\n  annotations:\r\n    service.beta.kubernetes.io/aws-load-balancer-backend-protocol: http\r\n    service.beta.kubernetes.io/aws-load-balancer-ssl-cert: {{ SERVICE_CERT_ARN }}\r\nspec:\r\n  type: {{ SERVICE_TYPE }}\r\n  selector:\r\n    app: {{ SERVICE_NAME }}\r\n  ports:\r\n    - port: {{ SERVICE_PORT }}\r\n      targetPort: {{ SERVICE_TARGET_PORT }}\r\n      protocol: {{ SERVICE_PROTOCOL }}\r\n```\r\nWe don't need to specify the first annotation, since `http` is the default value for `service.beta.kubernetes.io/aws-load-balancer-backend-protocol`, but it might be good to be explicit."}}
{"actor":{"display_login":"escattone"}}