Repository navigation
feat(k3s): DNS, developer certificate and run-time Helm values for local clusters - #2265
Open
edmondshtogu wants to merge 1 commit into
Open
edmondshtogu wants to merge 1 commit into
edmondshtogu wants to merge 1 commit into
Conversation
Contributor
|
🚀 Dogfood this PR with:
curl -fsSL https://raw.githubusercontent.com/CommunityToolkit/Aspire/main/eng/scripts/dogfood-pr.sh | bash -s -- 2265Or
iex "& { $(irm https://raw.githubusercontent.com/CommunityToolkit/Aspire/main/eng/scripts/dogfood-pr.ps1) } 2265" |
…cal clusters Pods resolve names through CoreDNS, which forwards to the node's resolver — inside a container, Docker's embedded DNS on a loopback address pods cannot reach. So a pod could resolve neither another Aspire container nor host.docker.internal, and the README's advice to use it did not work. WithHostAlias looks each container up on the Aspire network and writes it into the coredns-custom ConfigMap; WithCoreDnsCustomization adds files to the same ConfigMap. servicelb and metrics-server were disabled with fixed arguments nothing could undo, and K3sClusterOptions is not consumed by any API. WithEnabledComponent takes a default back: a LoadBalancer that binds the node's ports, an HPA. WithIngressDeveloperCertificate makes the AppHost's trusted developer certificate Traefik's default, and stores it in each Helm release's namespace so charts can serve and trust it. AddHelmRelease accepts a chart directory, building its dependencies inside the Helm container. WithHelmValue accepts a parameter, an expression or an endpoint, carried as an environment variable so a secret never lands in the generated script; the polyglot export is one union-typed withHelmValue. WithDataVolume now keeps the server node's name and password, so a recreated container rejoins as the same node instead of orphaning its volumes. Every Helm release and manifest waits for the DNS and certificate steps. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Makes a k3s cluster usable as a local install target for real charts: workloads can reach the AppHost's
other resources, the ingress serves a trusted certificate, and charts can be installed from a directory with
values resolved at run time.
Pods could not reach Aspire resources
Pods resolve through CoreDNS, which forwards to the node's resolver — Docker's embedded DNS on
127.0.0.11,unreachable from a pod's network namespace. From a pod,
nslookup host.docker.internalandnslookup postgresboth return NXDOMAIN, so the README's "Reaching Aspire services from k3s pods" did not work.
WithHostAlias(resource, hostName?)resolves the container on the Aspire network at every start and writesa
hostsblock into thecoredns-customConfigMap (k3s's documented extension point), then restarts CoreDNS.WithCoreDnsCustomization(fileName, content)adds a.overrideor.serverfile to the same ConfigMap.Components disabled with no way back
--disable=servicelband--disable=metrics-serverwere fixed arguments, andK3sClusterOptionsis notconsumed by any API.
WithEnabledComponent(component)removes a disable;WithDisabledComponentno longerrepeats a flag.
Developer certificate on the ingress
WithIngressDeveloperCertificate()stores the AppHost's developer certificate as the TLS Secretaspire-developer-certificateinkube-systemand in every Helm release's namespace, and makes it thedefault of the bundled Traefik (
TLSStore default). Hosts under*.dev.localhostthen open without a warning,and charts can name the Secret for their ingress and mount its
tls.crtto trust it.Helm
AddHelmReleaseaccepts a chart directory, mounted read-only and copied inside the container, where everyHTTP repository in
Chart.yamlis added andhelm dependency buildruns. A version is refused for it.WithHelmValueoverloads take a parameter, aReferenceExpressionor anEndpointReference. The value is anenvironment variable escaped for
--setinside the container, so secrets stay out of the generated script.The polyglot export stays one
withHelmValue, with a union-typed value.Persistent clusters
WithDataVolumealso pins--node-nameto the resource name and keeps/etc/rancher/nodein a secondvolume. Before, a recreated container — a k3s upgrade, a changed argument — registered as a new node and
volumes bound to the old one stayed
Pending.Every Helm release and manifest of the cluster waits for the DNS and certificate containers, whatever order
they are declared in.
PR Checklist
Other information
WithDataVolume, the server node is registered under the resource name. Anexisting persistent cluster re-registers once under the new name.
mainfor every PR (GHSA-qhrr-8q5h-9q3h, MessagePack viaAspire.Hosting);fixed separately in fix: suppress GHSA-qhrr-8q5h-9q3h, which every project inherits from … #2266. This PR's checks go green once that merges.
TypeScript SDK exposes
withEnabledComponent,withHostAlias,withCoreDnsCustomization,withIngressDeveloperCertificateand the union-typedwithHelmValue.served on 443 with the trusted developer certificate.