Managing my Home with Kubernetes, Traefik, and Raspberry Pi’s

  • I wanted to run a home automation platform with Android App support, and had chosen (semi-arbitrarily) Home Assistant.
  • I wanted the web interface to be accessible outside of my home, so I could check and manage devices while away.
  • I wanted my Google Home to be able to control the devices, which required me to have an external HTTPS endpoint.
  • I needed to manage dynamic DNS, since I don’t have a static IP.
  • Setting up a master + single node Kubernetes cluster
  • Deploying my DNS updater as a Kubernetes CronJob object.
  • Deploying Traefik as a Kubernetes Ingress Controller, and configuring it to manage SSL with Let’s Encrypt.

Setting up a Pi Kubernetes Cluster

$ kubectl get nodesNAME         STATUS    ROLES     AGE       VERSION
k8s-master Ready master 2d v1.9.1
k8s-node-1 Ready <none> 2d v1.9.1

DNS and Routing

apiVersion: batch/v1beta1
kind: CronJob
metadata:
name: dns-update
namespace: k8s-home
spec:
schedule: "*/15 * * * *"
concurrencyPolicy: Forbid
jobTemplate:
spec:
template:
spec:
containers:
- name: dns-update
image: evns/rpi-utilities
command: [ "/bin/sh", "-c", "chmod +x /scripts/update.sh && /scripts/update.sh" ]
env:
- name: RECORD_NAME
valueFrom:
secretKeyRef:
name: cloudflare
key: record_name
- name: API_KEY
valueFrom:
secretKeyRef:
name: cloudflare
key: api_key
...
volumeMounts:
- name: config-volume
mountPath: /scripts
volumes:
- name: config-volume
configMap:
name: update-script

Traefik and Let’s Encrypt

# Force HTTPS
[entryPoints]
[entryPoints.http]
address = ":80"
[entryPoints.http.redirect]
entryPoint = "https"
[entryPoints.https]
address = ":443"
[entryPoints.https.tls]
# Let's encrypt configuration
[acme]
email="<my-email>"
storage="/etc/traefik/acme.json"
entryPoint="https"
acmeLogging=true
onDemand=true
onHostRule=true
dnsProvider="cloudflare"
kind: Deployment
apiVersion: extensions/v1beta1
metadata:
name: traefik-ingress-controller
namespace: kube-system
spec:
replicas: 1
selector:
matchLabels:
k8s-app: traefik-ingress-lb
template:
metadata:
labels:
name: traefik-ingress-lb
spec:
serviceAccountName: traefik-ingress-controller
terminationGracePeriodSeconds: 60
containers:
- image: traefik:v1.5
name: traefik-ingress-lb
env:
- name: CLOUDFLARE_EMAIL
valueFrom:
secretKeyRef:
name: cloudflare
key: email
- name: CLOUDFLARE_API_KEY
valueFrom:
secretKeyRef:
name: cloudflare
key: api_key
volumeMounts:
- mountPath: "/config"
name: "config"
- mountPath: "/etc/traefik/acme.json"
name: "acme"
args:
- --configfile=/config/traefik.toml
volumes:
- name: config
configMap:
name: traefik-config
- name: acme
hostPath:
type: FileOrCreate
path: /etc/traefik/acme.json
kind: Service
apiVersion: v1
metadata:
name: traefik-ingress-service
namespace: kube-system
spec:
selector:
k8s-app: traefik-ingress-lb
ports:
- protocol: TCP
port: 80
name: http
- protocol: TCP
port: 443
name: https
externalIPs:
- 192.168.0.101 # This is the node address

PiVPN

Bringing it all Together

What’s next?

--

--

--

Platform Team Lead @monzo

Love podcasts or audiobooks? Learn on the go with our new app.

Recommended from Medium

Analytics is Broken. It’s Time for a Change

HackerRanak : Nested Lists

Goodbye Jenkins (Part 2): Give Flight to your CD with Drone Control

How to easily edit the maximo.properties file for IBM Maximo 7.6.1

Dockerizing ASP.NET with IIS and SQLLocalDB

Another Baseball Simulator… in Python!

Tink- New Cryptographic Library by Google

How will BitDegree get the best courses in the world?

Q/A with Adomas from BitDegree

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store
Chris Evans

Chris Evans

Platform Team Lead @monzo

More from Medium

Production like Kubernetes on Raspberry Pi: Ingress

Using Linux Run Levels for VM termination tasks

Creating the ultimate media server with Docker, Portainer, Plex, and Ubuntu Server

Docker Images vs Containers : Beyond the thin line

Airflow – SFU Professional Master&#39;s Program in Computer Science – Medium