init k8s

plugin/kubernetes/apis/sshpiper/v1beta1/doc.go

@@ -0,0 +1,3 @@
+// +k8s:deepcopy-gen=package
+// +groupName=sshpiper
+package v1beta1

plugin/kubernetes/apis/sshpiper/v1beta1/register.go

@@ -0,0 +1,36 @@
+package v1beta1
+
+import (
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+)
+
+// SchemeGroupVersion is group version used to register these objects
+var SchemeGroupVersion = schema.GroupVersion{
+	Group:   "sshpiper.com",
+	Version: "v1beta1",
+}
+
+// Resource takes an unqualified resource and returns a Group qualified GroupResource
+func Resource(resource string) schema.GroupResource {
+	return SchemeGroupVersion.WithResource(resource).GroupResource()
+}
+
+var (
+	// localSchemeBuilder and AddToScheme will stay in k8s.io/kubernetes.
+	SchemeBuilder      = runtime.NewSchemeBuilder(addKnownTypes)
+	localSchemeBuilder = &SchemeBuilder
+	AddToScheme        = localSchemeBuilder.AddToScheme
+)
+
+// Adds the list of known types to the given scheme.
+func addKnownTypes(scheme *runtime.Scheme) error {
+	scheme.AddKnownTypes(SchemeGroupVersion,
+		&Pipe{},
+		&PipeList{},
+	)
+
+	metav1.AddToGroupVersion(scheme, SchemeGroupVersion)
+	return nil
+}

plugin/kubernetes/apis/sshpiper/v1beta1/types.go

@@ -0,0 +1,42 @@
+package v1beta1
+
+import (
+	corev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+// +genclient
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+type Pipe struct {
+	metav1.TypeMeta   `json:",inline"`
+	metav1.ObjectMeta `json:"metadata,omitempty"`
+
+	Spec PipeSpec `json:"spec"`
+}
+
+type PipeSpec struct {
+	From []FromSpec `json:"from"`
+	To   ToSpec     `json:"to"`
+}
+
+type FromSpec struct {
+	Username           string `json:"username"`
+	UsernameRegexMatch bool   `json:"username_regex_match,omitempty"`
+	AuthorizedKeysData string `json:"authorized_keys_data,omitempty"`
+}
+
+type ToSpec struct {
+	Username         string                      `json:"username,omitempty"`
+	Host             string                      `json:"host"`
+	PrivateKeySecret corev1.LocalObjectReference `json:"private_key_secret,omitempty"`
+	KnownHostsData   string                      `json:"known_hosts_data,omitempty"`
+	IgnoreHostkey    bool                        `json:"ignore_hostkey,omitempty"`
+}
+
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+type PipeList struct {
+	metav1.TypeMeta `json:",inline"`
+	metav1.ListMeta `json:"metadata"`
+
+	Items []Pipe `json:"items"`
+}

plugin/kubernetes/apis/sshpiper/v1beta1/zz_generated.deepcopy.go

@@ -0,0 +1,125 @@
+//go:build !ignore_autogenerated
+// +build !ignore_autogenerated
+
+// Code generated by deepcopy-gen. DO NOT EDIT.
+
+package v1beta1
+
+import (
+	runtime "k8s.io/apimachinery/pkg/runtime"
+)
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *FromSpec) DeepCopyInto(out *FromSpec) {
+	*out = *in
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new FromSpec.
+func (in *FromSpec) DeepCopy() *FromSpec {
+	if in == nil {
+		return nil
+	}
+	out := new(FromSpec)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Pipe) DeepCopyInto(out *Pipe) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
+	in.Spec.DeepCopyInto(&out.Spec)
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Pipe.
+func (in *Pipe) DeepCopy() *Pipe {
+	if in == nil {
+		return nil
+	}
+	out := new(Pipe)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *Pipe) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *PipeList) DeepCopyInto(out *PipeList) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ListMeta.DeepCopyInto(&out.ListMeta)
+	if in.Items != nil {
+		in, out := &in.Items, &out.Items
+		*out = make([]Pipe, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PipeList.
+func (in *PipeList) DeepCopy() *PipeList {
+	if in == nil {
+		return nil
+	}
+	out := new(PipeList)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *PipeList) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *PipeSpec) DeepCopyInto(out *PipeSpec) {
+	*out = *in
+	if in.From != nil {
+		in, out := &in.From, &out.From
+		*out = make([]FromSpec, len(*in))
+		copy(*out, *in)
+	}
+	out.To = in.To
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PipeSpec.
+func (in *PipeSpec) DeepCopy() *PipeSpec {
+	if in == nil {
+		return nil
+	}
+	out := new(PipeSpec)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ToSpec) DeepCopyInto(out *ToSpec) {
+	*out = *in
+	out.PrivateKeySecret = in.PrivateKeySecret
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ToSpec.
+func (in *ToSpec) DeepCopy() *ToSpec {
+	if in == nil {
+		return nil
+	}
+	out := new(ToSpec)
+	in.DeepCopyInto(out)
+	return out
+}

plugin/kubernetes/crd.yaml

@@ -0,0 +1,75 @@
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  name: pipes.sshpiper.com
+spec:
+  group: sshpiper.com
+  names:
+    kind: Pipe
+    listKind: PipeList
+    plural: pipes
+    singular: pipe
+  scope: Namespaced
+  versions:
+  - name: v1beta1
+    schema:
+      openAPIV3Schema:
+        properties:
+          apiVersion:
+            description: 'APIVersion defines the versioned schema of this representation
+              of an object. Servers should convert recognized schemas to the latest
+              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
+            type: string
+          kind:
+            description: 'Kind is a string value representing the REST resource this
+              object represents. Servers may infer this from the endpoint the client
+              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
+            type: string
+          metadata:
+            type: object
+          spec:
+            properties:
+              from:
+                items:
+                  properties:
+                    authorized_keys_data:
+                      type: string
+                    username:
+                      type: string
+                    username_regex_match:
+                      type: boolean
+                  required:
+                  - username
+                  type: object
+                type: array
+              to:
+                properties:
+                  host:
+                    type: string
+                  ignore_hostkey:
+                    type: boolean
+                  known_hosts_data:
+                    type: string
+                  private_key_secret:
+                    description: LocalObjectReference contains enough information
+                      to let you locate the referenced object inside the same namespace.
+                    properties:
+                      name:
+                        description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                          TODO: Add other useful fields. apiVersion, kind, uid?'
+                        type: string
+                    type: object
+                  username:
+                    type: string
+                required:
+                - host
+                type: object
+            required:
+            - from
+            - to
+            type: object
+        required:
+        - spec
+        type: object
+    served: true
+    storage: true

plugin/kubernetes/generated/clientset/versioned/clientset.go

@@ -0,0 +1,105 @@
+// Code generated by client-gen. DO NOT EDIT.
+
+package versioned
+
+import (
+	"fmt"
+	"net/http"
+
+	sshpiperv1beta1 "github.com/tg123/sshpiper/plugin/kubernetes/generated/clientset/versioned/typed/sshpiper/v1beta1"
+	discovery "k8s.io/client-go/discovery"
+	rest "k8s.io/client-go/rest"
+	flowcontrol "k8s.io/client-go/util/flowcontrol"
+)
+
+type Interface interface {
+	Discovery() discovery.DiscoveryInterface
+	SshpiperV1beta1() sshpiperv1beta1.SshpiperV1beta1Interface
+}
+
+// Clientset contains the clients for groups. Each group has exactly one
+// version included in a Clientset.
+type Clientset struct {
+	*discovery.DiscoveryClient
+	sshpiperV1beta1 *sshpiperv1beta1.SshpiperV1beta1Client
+}
+
+// SshpiperV1beta1 retrieves the SshpiperV1beta1Client
+func (c *Clientset) SshpiperV1beta1() sshpiperv1beta1.SshpiperV1beta1Interface {
+	return c.sshpiperV1beta1
+}
+
+// Discovery retrieves the DiscoveryClient
+func (c *Clientset) Discovery() discovery.DiscoveryInterface {
+	if c == nil {
+		return nil
+	}
+	return c.DiscoveryClient
+}
+
+// NewForConfig creates a new Clientset for the given config.
+// If config's RateLimiter is not set and QPS and Burst are acceptable,
+// NewForConfig will generate a rate-limiter in configShallowCopy.
+// NewForConfig is equivalent to NewForConfigAndClient(c, httpClient),
+// where httpClient was generated with rest.HTTPClientFor(c).
+func NewForConfig(c *rest.Config) (*Clientset, error) {
+	configShallowCopy := *c
+
+	if configShallowCopy.UserAgent == "" {
+		configShallowCopy.UserAgent = rest.DefaultKubernetesUserAgent()
+	}
+
+	// share the transport between all clients
+	httpClient, err := rest.HTTPClientFor(&configShallowCopy)
+	if err != nil {
+		return nil, err
+	}
+
+	return NewForConfigAndClient(&configShallowCopy, httpClient)
+}
+
+// NewForConfigAndClient creates a new Clientset for the given config and http client.
+// Note the http client provided takes precedence over the configured transport values.
+// If config's RateLimiter is not set and QPS and Burst are acceptable,
+// NewForConfigAndClient will generate a rate-limiter in configShallowCopy.
+func NewForConfigAndClient(c *rest.Config, httpClient *http.Client) (*Clientset, error) {
+	configShallowCopy := *c
+	if configShallowCopy.RateLimiter == nil && configShallowCopy.QPS > 0 {
+		if configShallowCopy.Burst <= 0 {
+			return nil, fmt.Errorf("burst is required to be greater than 0 when RateLimiter is not set and QPS is set to greater than 0")
+		}
+		configShallowCopy.RateLimiter = flowcontrol.NewTokenBucketRateLimiter(configShallowCopy.QPS, configShallowCopy.Burst)
+	}
+
+	var cs Clientset
+	var err error
+	cs.sshpiperV1beta1, err = sshpiperv1beta1.NewForConfigAndClient(&configShallowCopy, httpClient)
+	if err != nil {
+		return nil, err
+	}
+
+	cs.DiscoveryClient, err = discovery.NewDiscoveryClientForConfigAndClient(&configShallowCopy, httpClient)
+	if err != nil {
+		return nil, err
+	}
+	return &cs, nil
+}
+
+// NewForConfigOrDie creates a new Clientset for the given config and
+// panics if there is an error in the config.
+func NewForConfigOrDie(c *rest.Config) *Clientset {
+	cs, err := NewForConfig(c)
+	if err != nil {
+		panic(err)
+	}
+	return cs
+}
+
+// New creates a new Clientset for the given RESTClient.
+func New(c rest.Interface) *Clientset {
+	var cs Clientset
+	cs.sshpiperV1beta1 = sshpiperv1beta1.New(c)
+
+	cs.DiscoveryClient = discovery.NewDiscoveryClient(c)
+	return &cs
+}

plugin/kubernetes/generated/clientset/versioned/doc.go

@@ -0,0 +1,4 @@
+// Code generated by client-gen. DO NOT EDIT.
+
+// This package has the automatically generated clientset.
+package versioned

plugin/kubernetes/generated/clientset/versioned/fake/clientset_generated.go

@@ -0,0 +1,69 @@
+// Code generated by client-gen. DO NOT EDIT.
+
+package fake
+
+import (
+	clientset "github.com/tg123/sshpiper/plugin/kubernetes/generated/clientset/versioned"
+	sshpiperv1beta1 "github.com/tg123/sshpiper/plugin/kubernetes/generated/clientset/versioned/typed/sshpiper/v1beta1"
+	fakesshpiperv1beta1 "github.com/tg123/sshpiper/plugin/kubernetes/generated/clientset/versioned/typed/sshpiper/v1beta1/fake"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/watch"
+	"k8s.io/client-go/discovery"
+	fakediscovery "k8s.io/client-go/discovery/fake"
+	"k8s.io/client-go/testing"
+)
+
+// NewSimpleClientset returns a clientset that will respond with the provided objects.
+// It's backed by a very simple object tracker that processes creates, updates and deletions as-is,
+// without applying any validations and/or defaults. It shouldn't be considered a replacement
+// for a real clientset and is mostly useful in simple unit tests.
+func NewSimpleClientset(objects ...runtime.Object) *Clientset {
+	o := testing.NewObjectTracker(scheme, codecs.UniversalDecoder())
+	for _, obj := range objects {
+		if err := o.Add(obj); err != nil {
+			panic(err)
+		}
+	}
+
+	cs := &Clientset{tracker: o}
+	cs.discovery = &fakediscovery.FakeDiscovery{Fake: &cs.Fake}
+	cs.AddReactor("*", "*", testing.ObjectReaction(o))
+	cs.AddWatchReactor("*", func(action testing.Action) (handled bool, ret watch.Interface, err error) {
+		gvr := action.GetResource()
+		ns := action.GetNamespace()
+		watch, err := o.Watch(gvr, ns)
+		if err != nil {
+			return false, nil, err
+		}
+		return true, watch, nil
+	})
+
+	return cs
+}
+
+// Clientset implements clientset.Interface. Meant to be embedded into a
+// struct to get a default implementation. This makes faking out just the method
+// you want to test easier.
+type Clientset struct {
+	testing.Fake
+	discovery *fakediscovery.FakeDiscovery
+	tracker   testing.ObjectTracker
+}
+
+func (c *Clientset) Discovery() discovery.DiscoveryInterface {
+	return c.discovery
+}
+
+func (c *Clientset) Tracker() testing.ObjectTracker {
+	return c.tracker
+}
+
+var (
+	_ clientset.Interface = &Clientset{}
+	_ testing.FakeClient  = &Clientset{}
+)
+
+// SshpiperV1beta1 retrieves the SshpiperV1beta1Client
+func (c *Clientset) SshpiperV1beta1() sshpiperv1beta1.SshpiperV1beta1Interface {
+	return &fakesshpiperv1beta1.FakeSshpiperV1beta1{Fake: &c.Fake}
+}

plugin/kubernetes/generated/clientset/versioned/fake/doc.go

@@ -0,0 +1,4 @@
+// Code generated by client-gen. DO NOT EDIT.
+
+// This package has the automatically generated fake clientset.
+package fake

plugin/kubernetes/generated/clientset/versioned/fake/register.go

@@ -0,0 +1,40 @@
+// Code generated by client-gen. DO NOT EDIT.
+
+package fake
+
+import (
+	sshpiperv1beta1 "github.com/tg123/sshpiper/plugin/kubernetes/apis/sshpiper/v1beta1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	schema "k8s.io/apimachinery/pkg/runtime/schema"
+	serializer "k8s.io/apimachinery/pkg/runtime/serializer"
+	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
+)
+
+var scheme = runtime.NewScheme()
+var codecs = serializer.NewCodecFactory(scheme)
+
+var localSchemeBuilder = runtime.SchemeBuilder{
+	sshpiperv1beta1.AddToScheme,
+}
+
+// AddToScheme adds all types of this clientset into the given scheme. This allows composition
+// of clientsets, like in:
+//
+//   import (
+//     "k8s.io/client-go/kubernetes"
+//     clientsetscheme "k8s.io/client-go/kubernetes/scheme"
+//     aggregatorclientsetscheme "k8s.io/kube-aggregator/pkg/client/clientset_generated/clientset/scheme"
+//   )
+//
+//   kclientset, _ := kubernetes.NewForConfig(c)
+//   _ = aggregatorclientsetscheme.AddToScheme(clientsetscheme.Scheme)
+//
+// After this, RawExtensions in Kubernetes types will serialize kube-aggregator types
+// correctly.
+var AddToScheme = localSchemeBuilder.AddToScheme
+
+func init() {
+	v1.AddToGroupVersion(scheme, schema.GroupVersion{Version: "v1"})
+	utilruntime.Must(AddToScheme(scheme))
+}

plugin/kubernetes/generated/clientset/versioned/scheme/doc.go

@@ -0,0 +1,4 @@
+// Code generated by client-gen. DO NOT EDIT.
+
+// This package contains the scheme of the automatically generated clientset.
+package scheme

plugin/kubernetes/generated/clientset/versioned/scheme/register.go

@@ -0,0 +1,40 @@
+// Code generated by client-gen. DO NOT EDIT.
+
+package scheme
+
+import (
+	sshpiperv1beta1 "github.com/tg123/sshpiper/plugin/kubernetes/apis/sshpiper/v1beta1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	schema "k8s.io/apimachinery/pkg/runtime/schema"
+	serializer "k8s.io/apimachinery/pkg/runtime/serializer"
+	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
+)
+
+var Scheme = runtime.NewScheme()
+var Codecs = serializer.NewCodecFactory(Scheme)
+var ParameterCodec = runtime.NewParameterCodec(Scheme)
+var localSchemeBuilder = runtime.SchemeBuilder{
+	sshpiperv1beta1.AddToScheme,
+}
+
+// AddToScheme adds all types of this clientset into the given scheme. This allows composition
+// of clientsets, like in:
+//
+//   import (
+//     "k8s.io/client-go/kubernetes"
+//     clientsetscheme "k8s.io/client-go/kubernetes/scheme"
+//     aggregatorclientsetscheme "k8s.io/kube-aggregator/pkg/client/clientset_generated/clientset/scheme"
+//   )
+//
+//   kclientset, _ := kubernetes.NewForConfig(c)
+//   _ = aggregatorclientsetscheme.AddToScheme(clientsetscheme.Scheme)
+//
+// After this, RawExtensions in Kubernetes types will serialize kube-aggregator types
+// correctly.
+var AddToScheme = localSchemeBuilder.AddToScheme
+
+func init() {
+	v1.AddToGroupVersion(Scheme, schema.GroupVersion{Version: "v1"})
+	utilruntime.Must(AddToScheme(Scheme))
+}

plugin/kubernetes/generated/clientset/versioned/typed/sshpiper/v1beta1/doc.go

@@ -0,0 +1,4 @@
+// Code generated by client-gen. DO NOT EDIT.
+
+// This package has the automatically generated typed clients.
+package v1beta1

plugin/kubernetes/generated/clientset/versioned/typed/sshpiper/v1beta1/fake/doc.go

@@ -0,0 +1,4 @@
+// Code generated by client-gen. DO NOT EDIT.
+
+// Package fake has the automatically generated clients.
+package fake

plugin/kubernetes/generated/clientset/versioned/typed/sshpiper/v1beta1/fake/fake_pipe.go

@@ -0,0 +1,114 @@
+// Code generated by client-gen. DO NOT EDIT.
+
+package fake
+
+import (
+	"context"
+
+	v1beta1 "github.com/tg123/sshpiper/plugin/kubernetes/apis/sshpiper/v1beta1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	labels "k8s.io/apimachinery/pkg/labels"
+	schema "k8s.io/apimachinery/pkg/runtime/schema"
+	types "k8s.io/apimachinery/pkg/types"
+	watch "k8s.io/apimachinery/pkg/watch"
+	testing "k8s.io/client-go/testing"
+)
+
+// FakePipes implements PipeInterface
+type FakePipes struct {
+	Fake *FakeSshpiperV1beta1
+	ns   string
+}
+
+var pipesResource = schema.GroupVersionResource{Group: "sshpiper", Version: "v1beta1", Resource: "pipes"}
+
+var pipesKind = schema.GroupVersionKind{Group: "sshpiper", Version: "v1beta1", Kind: "Pipe"}
+
+// Get takes name of the pipe, and returns the corresponding pipe object, and an error if there is any.
+func (c *FakePipes) Get(ctx context.Context, name string, options v1.GetOptions) (result *v1beta1.Pipe, err error) {
+	obj, err := c.Fake.
+		Invokes(testing.NewGetAction(pipesResource, c.ns, name), &v1beta1.Pipe{})
+
+	if obj == nil {
+		return nil, err
+	}
+	return obj.(*v1beta1.Pipe), err
+}
+
+// List takes label and field selectors, and returns the list of Pipes that match those selectors.
+func (c *FakePipes) List(ctx context.Context, opts v1.ListOptions) (result *v1beta1.PipeList, err error) {
+	obj, err := c.Fake.
+		Invokes(testing.NewListAction(pipesResource, pipesKind, c.ns, opts), &v1beta1.PipeList{})
+
+	if obj == nil {
+		return nil, err
+	}
+
+	label, _, _ := testing.ExtractFromListOptions(opts)
+	if label == nil {
+		label = labels.Everything()
+	}
+	list := &v1beta1.PipeList{ListMeta: obj.(*v1beta1.PipeList).ListMeta}
+	for _, item := range obj.(*v1beta1.PipeList).Items {
+		if label.Matches(labels.Set(item.Labels)) {
+			list.Items = append(list.Items, item)
+		}
+	}
+	return list, err
+}
+
+// Watch returns a watch.Interface that watches the requested pipes.
+func (c *FakePipes) Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) {
+	return c.Fake.
+		InvokesWatch(testing.NewWatchAction(pipesResource, c.ns, opts))
+
+}
+
+// Create takes the representation of a pipe and creates it.  Returns the server's representation of the pipe, and an error, if there is any.
+func (c *FakePipes) Create(ctx context.Context, pipe *v1beta1.Pipe, opts v1.CreateOptions) (result *v1beta1.Pipe, err error) {
+	obj, err := c.Fake.
+		Invokes(testing.NewCreateAction(pipesResource, c.ns, pipe), &v1beta1.Pipe{})
+
+	if obj == nil {
+		return nil, err
+	}
+	return obj.(*v1beta1.Pipe), err
+}
+
+// Update takes the representation of a pipe and updates it. Returns the server's representation of the pipe, and an error, if there is any.
+func (c *FakePipes) Update(ctx context.Context, pipe *v1beta1.Pipe, opts v1.UpdateOptions) (result *v1beta1.Pipe, err error) {
+	obj, err := c.Fake.
+		Invokes(testing.NewUpdateAction(pipesResource, c.ns, pipe), &v1beta1.Pipe{})
+
+	if obj == nil {
+		return nil, err
+	}
+	return obj.(*v1beta1.Pipe), err
+}
+
+// Delete takes name of the pipe and deletes it. Returns an error if one occurs.
+func (c *FakePipes) Delete(ctx context.Context, name string, opts v1.DeleteOptions) error {
+	_, err := c.Fake.
+		Invokes(testing.NewDeleteActionWithOptions(pipesResource, c.ns, name, opts), &v1beta1.Pipe{})
+
+	return err
+}
+
+// DeleteCollection deletes a collection of objects.
+func (c *FakePipes) DeleteCollection(ctx context.Context, opts v1.DeleteOptions, listOpts v1.ListOptions) error {
+	action := testing.NewDeleteCollectionAction(pipesResource, c.ns, listOpts)
+
+	_, err := c.Fake.Invokes(action, &v1beta1.PipeList{})
+	return err
+}
+
+// Patch applies the patch and returns the patched pipe.
+func (c *FakePipes) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts v1.PatchOptions, subresources ...string) (result *v1beta1.Pipe, err error) {
+	obj, err := c.Fake.
+		Invokes(testing.NewPatchSubresourceAction(pipesResource, c.ns, name, pt, data, subresources...), &v1beta1.Pipe{})
+
+	if obj == nil {
+		return nil, err
+	}
+	return obj.(*v1beta1.Pipe), err
+}

plugin/kubernetes/generated/clientset/versioned/typed/sshpiper/v1beta1/fake/fake_sshpiper_client.go

@@ -0,0 +1,24 @@
+// Code generated by client-gen. DO NOT EDIT.
+
+package fake
+
+import (
+	v1beta1 "github.com/tg123/sshpiper/plugin/kubernetes/generated/clientset/versioned/typed/sshpiper/v1beta1"
+	rest "k8s.io/client-go/rest"
+	testing "k8s.io/client-go/testing"
+)
+
+type FakeSshpiperV1beta1 struct {
+	*testing.Fake
+}
+
+func (c *FakeSshpiperV1beta1) Pipes(namespace string) v1beta1.PipeInterface {
+	return &FakePipes{c, namespace}
+}
+
+// RESTClient returns a RESTClient that is used to communicate
+// with API server by this client implementation.
+func (c *FakeSshpiperV1beta1) RESTClient() rest.Interface {
+	var ret *rest.RESTClient
+	return ret
+}

plugin/kubernetes/generated/clientset/versioned/typed/sshpiper/v1beta1/generated_expansion.go

@@ -0,0 +1,5 @@
+// Code generated by client-gen. DO NOT EDIT.
+
+package v1beta1
+
+type PipeExpansion interface{}

plugin/kubernetes/generated/clientset/versioned/typed/sshpiper/v1beta1/pipe.go

@@ -0,0 +1,162 @@
+// Code generated by client-gen. DO NOT EDIT.
+
+package v1beta1
+
+import (
+	"context"
+	"time"
+
+	v1beta1 "github.com/tg123/sshpiper/plugin/kubernetes/apis/sshpiper/v1beta1"
+	scheme "github.com/tg123/sshpiper/plugin/kubernetes/generated/clientset/versioned/scheme"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	types "k8s.io/apimachinery/pkg/types"
+	watch "k8s.io/apimachinery/pkg/watch"
+	rest "k8s.io/client-go/rest"
+)
+
+// PipesGetter has a method to return a PipeInterface.
+// A group's client should implement this interface.
+type PipesGetter interface {
+	Pipes(namespace string) PipeInterface
+}
+
+// PipeInterface has methods to work with Pipe resources.
+type PipeInterface interface {
+	Create(ctx context.Context, pipe *v1beta1.Pipe, opts v1.CreateOptions) (*v1beta1.Pipe, error)
+	Update(ctx context.Context, pipe *v1beta1.Pipe, opts v1.UpdateOptions) (*v1beta1.Pipe, error)
+	Delete(ctx context.Context, name string, opts v1.DeleteOptions) error
+	DeleteCollection(ctx context.Context, opts v1.DeleteOptions, listOpts v1.ListOptions) error
+	Get(ctx context.Context, name string, opts v1.GetOptions) (*v1beta1.Pipe, error)
+	List(ctx context.Context, opts v1.ListOptions) (*v1beta1.PipeList, error)
+	Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error)
+	Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts v1.PatchOptions, subresources ...string) (result *v1beta1.Pipe, err error)
+	PipeExpansion
+}
+
+// pipes implements PipeInterface
+type pipes struct {
+	client rest.Interface
+	ns     string
+}
+
+// newPipes returns a Pipes
+func newPipes(c *SshpiperV1beta1Client, namespace string) *pipes {
+	return &pipes{
+		client: c.RESTClient(),
+		ns:     namespace,
+	}
+}
+
+// Get takes name of the pipe, and returns the corresponding pipe object, and an error if there is any.
+func (c *pipes) Get(ctx context.Context, name string, options v1.GetOptions) (result *v1beta1.Pipe, err error) {
+	result = &v1beta1.Pipe{}
+	err = c.client.Get().
+		Namespace(c.ns).
+		Resource("pipes").
+		Name(name).
+		VersionedParams(&options, scheme.ParameterCodec).
+		Do(ctx).
+		Into(result)
+	return
+}
+
+// List takes label and field selectors, and returns the list of Pipes that match those selectors.
+func (c *pipes) List(ctx context.Context, opts v1.ListOptions) (result *v1beta1.PipeList, err error) {
+	var timeout time.Duration
+	if opts.TimeoutSeconds != nil {
+		timeout = time.Duration(*opts.TimeoutSeconds) * time.Second
+	}
+	result = &v1beta1.PipeList{}
+	err = c.client.Get().
+		Namespace(c.ns).
+		Resource("pipes").
+		VersionedParams(&opts, scheme.ParameterCodec).
+		Timeout(timeout).
+		Do(ctx).
+		Into(result)
+	return
+}
+
+// Watch returns a watch.Interface that watches the requested pipes.
+func (c *pipes) Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) {
+	var timeout time.Duration
+	if opts.TimeoutSeconds != nil {
+		timeout = time.Duration(*opts.TimeoutSeconds) * time.Second
+	}
+	opts.Watch = true
+	return c.client.Get().
+		Namespace(c.ns).
+		Resource("pipes").
+		VersionedParams(&opts, scheme.ParameterCodec).
+		Timeout(timeout).
+		Watch(ctx)
+}
+
+// Create takes the representation of a pipe and creates it.  Returns the server's representation of the pipe, and an error, if there is any.
+func (c *pipes) Create(ctx context.Context, pipe *v1beta1.Pipe, opts v1.CreateOptions) (result *v1beta1.Pipe, err error) {
+	result = &v1beta1.Pipe{}
+	err = c.client.Post().
+		Namespace(c.ns).
+		Resource("pipes").
+		VersionedParams(&opts, scheme.ParameterCodec).
+		Body(pipe).
+		Do(ctx).
+		Into(result)
+	return
+}
+
+// Update takes the representation of a pipe and updates it. Returns the server's representation of the pipe, and an error, if there is any.
+func (c *pipes) Update(ctx context.Context, pipe *v1beta1.Pipe, opts v1.UpdateOptions) (result *v1beta1.Pipe, err error) {
+	result = &v1beta1.Pipe{}
+	err = c.client.Put().
+		Namespace(c.ns).
+		Resource("pipes").
+		Name(pipe.Name).
+		VersionedParams(&opts, scheme.ParameterCodec).
+		Body(pipe).
+		Do(ctx).
+		Into(result)
+	return
+}
+
+// Delete takes name of the pipe and deletes it. Returns an error if one occurs.
+func (c *pipes) Delete(ctx context.Context, name string, opts v1.DeleteOptions) error {
+	return c.client.Delete().
+		Namespace(c.ns).
+		Resource("pipes").
+		Name(name).
+		Body(&opts).
+		Do(ctx).
+		Error()
+}
+
+// DeleteCollection deletes a collection of objects.
+func (c *pipes) DeleteCollection(ctx context.Context, opts v1.DeleteOptions, listOpts v1.ListOptions) error {
+	var timeout time.Duration
+	if listOpts.TimeoutSeconds != nil {
+		timeout = time.Duration(*listOpts.TimeoutSeconds) * time.Second
+	}
+	return c.client.Delete().
+		Namespace(c.ns).
+		Resource("pipes").
+		VersionedParams(&listOpts, scheme.ParameterCodec).
+		Timeout(timeout).
+		Body(&opts).
+		Do(ctx).
+		Error()
+}
+
+// Patch applies the patch and returns the patched pipe.
+func (c *pipes) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts v1.PatchOptions, subresources ...string) (result *v1beta1.Pipe, err error) {
+	result = &v1beta1.Pipe{}
+	err = c.client.Patch(pt).
+		Namespace(c.ns).
+		Resource("pipes").
+		Name(name).
+		SubResource(subresources...).
+		VersionedParams(&opts, scheme.ParameterCodec).
+		Body(data).
+		Do(ctx).
+		Into(result)
+	return
+}

plugin/kubernetes/generated/clientset/versioned/typed/sshpiper/v1beta1/sshpiper_client.go

@@ -0,0 +1,91 @@
+// Code generated by client-gen. DO NOT EDIT.
+
+package v1beta1
+
+import (
+	"net/http"
+
+	v1beta1 "github.com/tg123/sshpiper/plugin/kubernetes/apis/sshpiper/v1beta1"
+	"github.com/tg123/sshpiper/plugin/kubernetes/generated/clientset/versioned/scheme"
+	rest "k8s.io/client-go/rest"
+)
+
+type SshpiperV1beta1Interface interface {
+	RESTClient() rest.Interface
+	PipesGetter
+}
+
+// SshpiperV1beta1Client is used to interact with features provided by the sshpiper group.
+type SshpiperV1beta1Client struct {
+	restClient rest.Interface
+}
+
+func (c *SshpiperV1beta1Client) Pipes(namespace string) PipeInterface {
+	return newPipes(c, namespace)
+}
+
+// NewForConfig creates a new SshpiperV1beta1Client for the given config.
+// NewForConfig is equivalent to NewForConfigAndClient(c, httpClient),
+// where httpClient was generated with rest.HTTPClientFor(c).
+func NewForConfig(c *rest.Config) (*SshpiperV1beta1Client, error) {
+	config := *c
+	if err := setConfigDefaults(&config); err != nil {
+		return nil, err
+	}
+	httpClient, err := rest.HTTPClientFor(&config)
+	if err != nil {
+		return nil, err
+	}
+	return NewForConfigAndClient(&config, httpClient)
+}
+
+// NewForConfigAndClient creates a new SshpiperV1beta1Client for the given config and http client.
+// Note the http client provided takes precedence over the configured transport values.
+func NewForConfigAndClient(c *rest.Config, h *http.Client) (*SshpiperV1beta1Client, error) {
+	config := *c
+	if err := setConfigDefaults(&config); err != nil {
+		return nil, err
+	}
+	client, err := rest.RESTClientForConfigAndClient(&config, h)
+	if err != nil {
+		return nil, err
+	}
+	return &SshpiperV1beta1Client{client}, nil
+}
+
+// NewForConfigOrDie creates a new SshpiperV1beta1Client for the given config and
+// panics if there is an error in the config.
+func NewForConfigOrDie(c *rest.Config) *SshpiperV1beta1Client {
+	client, err := NewForConfig(c)
+	if err != nil {
+		panic(err)
+	}
+	return client
+}
+
+// New creates a new SshpiperV1beta1Client for the given RESTClient.
+func New(c rest.Interface) *SshpiperV1beta1Client {
+	return &SshpiperV1beta1Client{c}
+}
+
+func setConfigDefaults(config *rest.Config) error {
+	gv := v1beta1.SchemeGroupVersion
+	config.GroupVersion = &gv
+	config.APIPath = "/apis"
+	config.NegotiatedSerializer = scheme.Codecs.WithoutConversion()
+
+	if config.UserAgent == "" {
+		config.UserAgent = rest.DefaultKubernetesUserAgent()
+	}
+
+	return nil
+}
+
+// RESTClient returns a RESTClient that is used to communicate
+// with API server by this client implementation.
+func (c *SshpiperV1beta1Client) RESTClient() rest.Interface {
+	if c == nil {
+		return nil
+	}
+	return c.restClient
+}

plugin/kubernetes/generated/listers/sshpiper/v1beta1/expansion_generated.go

@@ -0,0 +1,11 @@
+// Code generated by lister-gen. DO NOT EDIT.
+
+package v1beta1
+
+// PipeListerExpansion allows custom methods to be added to
+// PipeLister.
+type PipeListerExpansion interface{}
+
+// PipeNamespaceListerExpansion allows custom methods to be added to
+// PipeNamespaceLister.
+type PipeNamespaceListerExpansion interface{}

plugin/kubernetes/generated/listers/sshpiper/v1beta1/pipe.go

@@ -0,0 +1,83 @@
+// Code generated by lister-gen. DO NOT EDIT.
+
+package v1beta1
+
+import (
+	v1beta1 "github.com/tg123/sshpiper/plugin/kubernetes/apis/sshpiper/v1beta1"
+	"k8s.io/apimachinery/pkg/api/errors"
+	"k8s.io/apimachinery/pkg/labels"
+	"k8s.io/client-go/tools/cache"
+)
+
+// PipeLister helps list Pipes.
+// All objects returned here must be treated as read-only.
+type PipeLister interface {
+	// List lists all Pipes in the indexer.
+	// Objects returned here must be treated as read-only.
+	List(selector labels.Selector) (ret []*v1beta1.Pipe, err error)
+	// Pipes returns an object that can list and get Pipes.
+	Pipes(namespace string) PipeNamespaceLister
+	PipeListerExpansion
+}
+
+// pipeLister implements the PipeLister interface.
+type pipeLister struct {
+	indexer cache.Indexer
+}
+
+// NewPipeLister returns a new PipeLister.
+func NewPipeLister(indexer cache.Indexer) PipeLister {
+	return &pipeLister{indexer: indexer}
+}
+
+// List lists all Pipes in the indexer.
+func (s *pipeLister) List(selector labels.Selector) (ret []*v1beta1.Pipe, err error) {
+	err = cache.ListAll(s.indexer, selector, func(m interface{}) {
+		ret = append(ret, m.(*v1beta1.Pipe))
+	})
+	return ret, err
+}
+
+// Pipes returns an object that can list and get Pipes.
+func (s *pipeLister) Pipes(namespace string) PipeNamespaceLister {
+	return pipeNamespaceLister{indexer: s.indexer, namespace: namespace}
+}
+
+// PipeNamespaceLister helps list and get Pipes.
+// All objects returned here must be treated as read-only.
+type PipeNamespaceLister interface {
+	// List lists all Pipes in the indexer for a given namespace.
+	// Objects returned here must be treated as read-only.
+	List(selector labels.Selector) (ret []*v1beta1.Pipe, err error)
+	// Get retrieves the Pipe from the indexer for a given namespace and name.
+	// Objects returned here must be treated as read-only.
+	Get(name string) (*v1beta1.Pipe, error)
+	PipeNamespaceListerExpansion
+}
+
+// pipeNamespaceLister implements the PipeNamespaceLister
+// interface.
+type pipeNamespaceLister struct {
+	indexer   cache.Indexer
+	namespace string
+}
+
+// List lists all Pipes in the indexer for a given namespace.
+func (s pipeNamespaceLister) List(selector labels.Selector) (ret []*v1beta1.Pipe, err error) {
+	err = cache.ListAllByNamespace(s.indexer, s.namespace, selector, func(m interface{}) {
+		ret = append(ret, m.(*v1beta1.Pipe))
+	})
+	return ret, err
+}
+
+// Get retrieves the Pipe from the indexer for a given namespace and name.
+func (s pipeNamespaceLister) Get(name string) (*v1beta1.Pipe, error) {
+	obj, exists, err := s.indexer.GetByKey(s.namespace + "/" + name)
+	if err != nil {
+		return nil, err
+	}
+	if !exists {
+		return nil, errors.NewNotFound(v1beta1.Resource("pipe"), name)
+	}
+	return obj.(*v1beta1.Pipe), nil
+}

plugin/kubernetes/kubernetes.go

@@ -0,0 +1,217 @@
+package main
+
+import (
+	"bytes"
+	"context"
+	"encoding/base64"
+	"fmt"
+	"net"
+	"regexp"
+
+	gocache "github.com/patrickmn/go-cache"
+	"github.com/tg123/sshpiper/libplugin"
+	piperv1beta1 "github.com/tg123/sshpiper/plugin/kubernetes/apis/sshpiper/v1beta1"
+	sshpiper "github.com/tg123/sshpiper/plugin/kubernetes/generated/clientset/versioned"
+	piperlister "github.com/tg123/sshpiper/plugin/kubernetes/generated/listers/sshpiper/v1beta1"
+	"golang.org/x/crypto/ssh"
+	"golang.org/x/crypto/ssh/knownhosts"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/fields"
+	"k8s.io/apimachinery/pkg/labels"
+	"k8s.io/client-go/kubernetes"
+	corev1 "k8s.io/client-go/kubernetes/typed/core/v1"
+	"k8s.io/client-go/tools/cache"
+	"k8s.io/client-go/tools/clientcmd"
+)
+
+type plugin struct {
+	k8sclient corev1.CoreV1Interface
+	lister    piperlister.PipeLister
+	stop      chan<- struct{}
+	cache     *gocache.Cache
+}
+
+func newKubernetesPlugin() (*plugin, error) {
+	kubeConfig := clientcmd.NewNonInteractiveDeferredLoadingClientConfig(
+		clientcmd.NewDefaultClientConfigLoadingRules(),
+		&clientcmd.ConfigOverrides{},
+	)
+
+	config, err := kubeConfig.ClientConfig()
+	if err != nil {
+		return nil, err
+	}
+
+	ns, _, err := kubeConfig.Namespace()
+	if err != nil {
+		return nil, err
+	}
+
+	k8sclient, err := kubernetes.NewForConfig(config)
+	if err != nil {
+		return nil, err
+	}
+
+	piperclient, err := sshpiper.NewForConfig(config)
+	if err != nil {
+		return nil, err
+	}
+
+	listWatcher := cache.NewListWatchFromClient(piperclient.SshpiperV1beta1().RESTClient(), "pipes", ns, fields.Everything())
+	store := cache.NewIndexer(cache.MetaNamespaceKeyFunc, cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc})
+	lister := piperlister.NewPipeLister(store)
+	reflector := cache.NewReflector(listWatcher, &piperv1beta1.Pipe{}, store, 0)
+
+	stop := make(chan struct{})
+	go reflector.Run(stop)
+
+	return &plugin{
+		k8sclient: k8sclient.CoreV1(),
+		lister:    lister,
+		stop:      stop,
+	}, nil
+}
+
+func (p *plugin) Stop() {
+	p.stop <- struct{}{}
+}
+
+func (p *plugin) list() ([]*piperv1beta1.Pipe, error) {
+	return p.lister.List(labels.Everything())
+}
+
+func (p *plugin) supportedMethods() ([]string, error) {
+	pipes, err := p.list()
+	if err != nil {
+		return nil, err
+	}
+
+	set := make(map[string]bool)
+
+	for _, pipe := range pipes {
+		for _, from := range pipe.Spec.From {
+			if from.AuthorizedKeysData != "" {
+				set["publickey"] = true // found authorized_keys, so we support publickey
+			} else {
+				set["password"] = true // no authorized_keys, so we support password
+			}
+		}
+	}
+
+	var methods []string
+	for k := range set {
+		methods = append(methods, k)
+	}
+	return methods, nil
+}
+
+func (p *plugin) verifyHostKey(conn libplugin.ConnMetadata, hostname, netaddr string, key []byte) error {
+	item, found := p.cache.Get(conn.UniqueID())
+
+	if !found {
+		return fmt.Errorf("connection expired")
+	}
+
+	pipe := item.(*piperv1beta1.Pipe)
+	to := pipe.Spec.To
+
+	data, err := base64.StdEncoding.DecodeString(to.KnownHostsData)
+	if err != nil {
+		return err
+	}
+
+	hostKeyCallback, err := knownhosts.NewFromReader(bytes.NewBuffer(data))
+	if err != nil {
+		return err
+	}
+
+	pub, err := ssh.ParsePublicKey(key)
+	if err != nil {
+		return err
+	}
+
+	addr, err := net.ResolveTCPAddr("tcp", netaddr)
+	if err != nil {
+		return err
+	}
+
+	return hostKeyCallback(hostname, addr, pub)
+}
+
+func (p *plugin) createUpstream(conn libplugin.ConnMetadata, pipe *piperv1beta1.Pipe, originPassword string) (*libplugin.Upstream, error) {
+	to := pipe.Spec.To
+	host, port, err := libplugin.SplitHostPortForSSH(to.Host)
+	if err != nil {
+		return nil, err
+	}
+
+	u := &libplugin.Upstream{
+		Host:          host,
+		Port:          int32(port),
+		UserName:      to.Username,
+		IgnoreHostKey: to.IgnoreHostkey,
+	}
+
+	if originPassword != "" {
+		u.Auth = libplugin.CreatePasswordAuth([]byte(originPassword))
+		return u, p.cache.Add(conn.UniqueID(), pipe, gocache.DefaultExpiration)
+	}
+
+	secret, err := p.k8sclient.Secrets(pipe.Namespace).Get(context.Background(), to.PrivateKeySecret.Name, metav1.GetOptions{})
+	if err != nil {
+		return nil, err
+	}
+
+	data := secret.Data["privatekey"]
+	if data != nil {
+		return u, p.cache.Add(conn.UniqueID(), pipe, gocache.DefaultExpiration)
+	}
+
+	return nil, fmt.Errorf("no password or private key found")
+}
+
+func (p *plugin) findAndCreateUpstream(conn libplugin.ConnMetadata, password string, publicKey []byte) (*libplugin.Upstream, error) {
+	user := conn.User()
+
+	pipes, err := p.list()
+	if err != nil {
+		return nil, err
+	}
+
+	for _, pipe := range pipes {
+		for _, from := range pipe.Spec.From {
+			matched := from.Username == user
+
+			if from.UsernameRegexMatch {
+				matched, _ = regexp.MatchString(from.Username, user)
+			}
+
+			if !matched {
+				continue
+			}
+
+			if publicKey == nil && password != "" {
+				return p.createUpstream(conn, pipe, password)
+			}
+
+			rest, err := base64.StdEncoding.DecodeString(from.AuthorizedKeysData)
+			if err != nil {
+				return nil, err
+			}
+
+			var authedPubkey ssh.PublicKey
+			for len(rest) > 0 {
+				authedPubkey, _, _, rest, err = ssh.ParseAuthorizedKey(rest)
+				if err != nil {
+					return nil, err
+				}
+
+				if bytes.Equal(authedPubkey.Marshal(), publicKey) {
+					return p.createUpstream(conn, pipe, "")
+				}
+			}
+		}
+	}
+
+	return nil, fmt.Errorf("no matching pipe for username [%v] found", user)
+}

plugin/kubernetes/main.go

@@ -0,0 +1,38 @@
+package main
+
+import (
+	"github.com/tg123/sshpiper/libplugin"
+	"github.com/urfave/cli/v2"
+)
+
+func main() {
+	libplugin.CreateAndRunPluginTemplate(&libplugin.PluginTemplate{
+		Name:  "kubernetes",
+		Usage: "sshpiperd kubernetes plugin",
+		CreateConfig: func(c *cli.Context) (*libplugin.SshPiperPluginConfig, error) {
+			plugin, err := newKubernetesPlugin()
+			if err != nil {
+				return nil, err
+			}
+
+			return &libplugin.SshPiperPluginConfig{
+
+				NextAuthMethodsCallback: func(_ libplugin.ConnMetadata) ([]string, error) {
+					return plugin.supportedMethods()
+				},
+
+				PasswordCallback: func(conn libplugin.ConnMetadata, password []byte) (*libplugin.Upstream, error) {
+					return plugin.findAndCreateUpstream(conn, string(password), nil)
+				},
+
+				PublicKeyCallback: func(conn libplugin.ConnMetadata, key []byte) (*libplugin.Upstream, error) {
+					return plugin.findAndCreateUpstream(conn, "", key)
+				},
+
+				VerifyHostKeyCallback: func(conn libplugin.ConnMetadata, hostname, netaddr string, key []byte) error {
+					return plugin.verifyHostKey(conn, hostname, netaddr, key)
+				},
+			}, nil
+		},
+	})
+}

plugin/kubernetes/sample.yaml

@@ -0,0 +1,195 @@
+# sshpiper service
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: sshpiper
+spec:
+  selector:
+    app: sshpiper
+  ports:
+    - protocol: TCP
+      port: 2222
+---
+apiVersion: v1
+data:
+  server_key: |
+    LS0tLS1CRUdJTiBPUEVOU1NIIFBSSVZBVEUgS0VZLS0tLS0KYjNCbGJuTnphQzFyWlhrdGRqRUFBQUFBQkc1dmJtVUFBQUFFYm05dVpRQUFBQUFBQUFBQkFBQUJsd0FBQUFkemMyZ3RjbgpOaEFBQUFBd0VBQVFBQUFZRUFxNEVNbmlFR3ZXTXNSNEdqWDc4UWRNcUxjVHlhRTNWSUlLMU5KdmpZaDFnUUtyZnU3OUI2Ckx2N3ZpOUl0SHNjQmRGTEhEYW5od0ZzdWw4MjRibkJ0dlgya3ZjbzY0eFpKcC9nZ0R2NUhUV2svQ0Fkek5TTWxTVjlERXIKcW9kTUlEYmJ1WWxoSXBBNEVKeVpqbEFmQWFtTlFtZGdHVmtMdzlVN1NiN3BPUnovWlVRZ0NkcU1KQjU4NlYzYmRoZGVudgp3NVQ4WnhnZGlQMzlhblpkdjV3TTQyOU8vT2Rjb0VEcFpxWDlpYVJUbGdwdUZBOWp0b1IrbzNyRjZzNFUyNS9XbXdHeHU1CnNaQVdncjBBTjgwSTZEVEZjN0cvUG9nSFpUek5ZcGNzdHZiY21leXV1bmFnUE83RXA5OWt3dEQ5UVdCUDFFZXFrSk0wdjAKL1ViT1l3aDY4QnIzT2t5SXVPak9CTU5OYkRpRkU2eXFENlI4bTY1MWpSZHg1eFVnckpjQjEzK2pzbi9sVFo0LzQ1L3VQQQpBNy8xUy9sV0V5OHRHdzVNSVZPWUd4L2h2cXdVSmJnUndCc1NVNExsUEVLRXp3d1FHeEw1b09QaWdJYmszNUhYaWowd2J0CjB4TWRiOHgybVl2Mzl4ZDZBWGllTGVGc1VLYmtZbW1USmhmRlJkSjdBQUFGaUltZ2Z3MkpvSDhOQUFBQUIzTnphQzF5YzIKRUFBQUdCQUt1QkRKNGhCcjFqTEVlQm8xKy9FSFRLaTNFOG1oTjFTQ0N0VFNiNDJJZFlFQ3EzN3UvUWVpNys3NHZTTFI3SApBWFJTeHcycDRjQmJMcGZOdUc1d2JiMTlwTDNLT3VNV1NhZjRJQTcrUjAxcFB3Z0hjelVqSlVsZlF4SzZxSFRDQTIyN21KCllTS1FPQkNjbVk1UUh3R3BqVUpuWUJsWkM4UFZPMG0rNlRrYy8yVkVJQW5hakNRZWZPbGQyM1lYWHA3OE9VL0djWUhZajkKL1dwMlhiK2NET052VHZ6blhLQkE2V2FsL1lta1U1WUtiaFFQWTdhRWZxTjZ4ZXJPRk51ZjFwc0JzYnViR1FGb0s5QURmTgpDT2cweFhPeHZ6NklCMlU4eldLWExMYjIzSm5zcnJwMm9EenV4S2ZmWk1MUS9VRmdUOVJIcXBDVE5MOVAxR3ptTUlldkFhCjl6cE1pTGpvemdURFRXdzRoUk9zcWcra2ZKdXVkWTBYY2VjVklLeVhBZGQvbzdKLzVVMmVQK09mN2p3QU8vOVV2NVZoTXYKTFJzT1RDRlRtQnNmNGI2c0ZDVzRFY0FiRWxPQzVUeENoTThNRUJzUythRGo0b0NHNU4rUjE0bzlNRzdkTVRIVy9NZHBtTAo5L2NYZWdGNG5pM2hiRkNtNUdKcGt5WVh4VVhTZXdBQUFBTUJBQUVBQUFHQWE2ZDc5aDZoRG15Y05ONkpZT2FjTzlPUUtDCnAwUk5hUHlnTSt0TUhybVRtTUhHU00xWGcxMmg0bzI4bTRqT002Wkh3NWVyZ3lmdjQ5aHdpWlJxbklHUFF2WHZyOGIrTmoKcE00NXdXK1g3bDJzTlN3SUEwam1kT0laUmo1bzA3R2RXVm95YzdFK2tYYUVZRWxiSnhaQ2U4QmZ6QjgrZFRYVUFTRVQ2SApRMVNTZEV5SkYrWlpwYXFGbWk5U1BSUjZUcTNnZzlUN0Z4aUxaMlJrZTZuVFlsV1BaYnpLQ21JZW5kR0pRRlRFc2NOTWlqClJIQk1sUnNpS3hnNytDSVlNYXhva0o4MUI3N2lJUTFTVmRzaXpnVTZ5eklERDRPOGlqTVdmVVVaZ3FoY3FYTnp6T3NpZTEKRXVEdkk1ZlpVNGRuVU1MdmxEZGMxUGUyS09BSVFTVnlrNCtHWGFMZEl0SzE4TnhjdmEvM255SVNKMWFCQXV4YkNRQkdRYQpycmRZUitNdndJdkRlbndyTUs0bWtWR2w2NnBySTZRdW56bU9vN01OUXlkODlLQ1RBblJjWlhVNCtkZnZWaVJubFRlK3VZCnZtbE5sc1hhOEpRZjlvRlV3a1VLZmxRdnovZ0NrdXFqdkNsamxrZThxM3VTa05MMXhDTVpQRkJSTEd4WWdlWjNEeEFBQUEKd0RrakpPQjlVMXNMRDFrUzc4ZlNObm9tbGRXaFFQeGxKa1JYUk80MjJqYXZ5OThMb1JWOWpNU2N0R3JpODljTHFFcEV5dApsSHVVTjNJSU1rU1RVcFhtS3NNVXB2SnBZMmpHYUs2SlhKMGR1VG4rbDNQd3gzVU05TW0zOFY4R3BablFWMmMydmlXeTNqCmU2c1hrWDVwV01WRHpqZHd1b0c4c1JrYTZ1TnM0d1N3a0RKdXIrLzh4WnczM0k1eVJCd2M3bHBBczZBMVUvNnZDVGJiQ0kKb0QwMWcvTEtldVpHRjNYcWRLMXhqc2xTZmR5TERBMGNLYzRITXpnUkYwckVGMWtBQUFBTUVBMDAyL3lsaEkzVXdPRU01LwpjQUlBanJSZC9FQjdMUE5zVldGNjdaZEFMVXRrRmVVMGlsY3ZaaUxJMlMwYkJqVXUwUWtCMW5SU3pFamdGSTVldGY5eWs4CnRiSHFGa1htUnNwbGtKUEhRU09QL1ByMWNzb1o0QXlGWWhJOE9ucHkzNVVyNnZlNGQxeHR6RURLWmdMOWo5QTlFKzdwUUgKdWVZZ3pvTUJacXNhcGdsaXJjWDhtQXRiREQ2SFdOMjlrZm1VYjlRYi91aURFb3h2WmtVMmhvVTNZOHI4YXN3dVhCU3JTaAp5TkdQQjQxSitpelUyM0pQS0IyeVZ5VS9SNlRaaWZBQUFBd1FEUHlCOUFoNUNucEVRUGY3WCtIU29jVzJYUis4L3BJM0NSCmpyT0diS0dMUGhaMldxeUlaOW5WRmRoSmY4TXgyVlVzeHJyL3paUGlzd1ZiZ2pkczE0d0EzYUJrT2RwbkhHbWFTM0lCRUgKN2g5d0NlaFl6Z0htS0t0T1oxRWhSWjFaQmEzU0dnMlp2d3lXRVBOM0RRK0l0QUsyaWllQm9UbFpmS0pieWpwWEhNL2tPcApmSUZFVm5QbTFDa1dyb3NBOGlVUXBWMzhWbGk0ZXAyWU95NVJCMFo3UGlyek5PSFdsTHFicEVWV0F2QjVPU3ljV0lGWTBrCkJZdnB3Q01zMEZES1VBQUFBTlltOXNhV0Z1UUhWaWRXNTBkUUVDQXdRRkJnPT0KLS0tLS1FTkQgT1BFTlNTSCBQUklWQVRFIEtFWS0tLS0tCg==
+kind: Secret
+metadata:
+  name: sshpiper-server-key
+type: Opaque
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: sshpiper-deployment
+  labels:
+    app: sshpiper
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: sshpiper
+  template:
+    metadata:
+      labels:
+        app: sshpiper
+    spec:
+      serviceAccountName: sshpiper-account
+      containers:
+      - name: sshpiper
+        image: sshpiper
+        imagePullPolicy: Never
+        ports:
+        - containerPort: 2222
+        # command: ['/bin/sh', '-c', 'sleep 1d']
+        env:
+        - name: PLUGIN
+          value: "kubernetes"
+        - name: SSHPIPERD_SERVER_KEY
+          value: "/serverkey/ssh_host_rsa_key"
+        - name: SSHPIPERD_LOG_LEVEL
+          value: "trace"
+        volumeMounts:
+        - name: sshpiper-server-key
+          mountPath: "/serverkey/"
+          readOnly: true          
+      volumes:
+      - name: sshpiper-server-key
+        secret:
+          secretName: sshpiper-server-key
+          items:
+          - key: server_key
+            path: ssh_host_rsa_key
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: sshpiper-reader
+rules:
+- apiGroups: [""]
+  resources: ["secrets"]
+  verbs: ["get"]
+- apiGroups: ["sshpiper.com"]
+  resources: ["pipes"]
+  verbs: ["get", "list", "watch"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: read-sshpiper
+subjects:
+- kind: ServiceAccount
+  name: sshpiper-account
+roleRef:
+  kind: Role
+  name: sshpiper-reader
+  apiGroup: rbac.authorization.k8s.io
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: sshpiper-account
+
+# pipe to a password based sshd
+---
+apiVersion: sshpiper.com/v1beta1
+kind: Pipe
+metadata:
+  name: pipe-password
+spec:
+  from:
+  - username: "password_simple"
+  to:
+    host: host-password:2222
+    username: "user"
+    ignore_hostkey: true
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: host-password
+spec:
+  selector:
+    app: host-password
+  ports:
+    - protocol: TCP
+      port: 2222
+---
+apiVersion: v1
+kind: Pod
+metadata:
+  name: host-password
+  labels:
+    app: host-password
+spec:
+  containers:
+  - name: host-password
+    image: lscr.io/linuxserver/openssh-server:latest
+    ports:
+    - containerPort: 2222
+    env:
+    - name: PASSWORD_ACCESS
+      value: "true"
+    - name: USER_PASSWORD
+      value: "pass"
+    - name: USER_NAME
+      value: "user"
+
+
+# pipe to a key based sshd
+---
+apiVersion: v1
+data:
+  privatekey: |
+    LS0tLS1CRUdJTiBPUEVOU1NIIFBSSVZBVEUgS0VZLS0tLS0KYjNCbGJuTnphQzFyWlhrdGRqRUFBQUFBQkc1dmJtVUFBQUFFYm05dVpRQUFBQUFBQUFBQkFBQUJsd0FBQUFkemMyZ3RjbgpOaEFBQUFBd0VBQVFBQUFZRUExYzZJYW5VVTdrK3ZrcjJuSEVYUFhwb3I2ZStBc2xhenRXM29scXhqcnRJRnN1bktIQXBLCkhSVUYydEtvdWIzR0R1VTErTlBqNzRNREpUV0wwTUMyNTdiNTFNUnlOaCsxTXBnU2tDdG84dWhZN2ZvUVJMeFFVV3dvaTkKTnZXRVlpUk4zM3hqR05vTE9LNUwrWmMxNmpDWm9OaDZwOEFKN09hQ1ZsZFU2UlZkaFFhUERScndEbDNGR3R6YnBQNXdpcgpWYnE1MnFleHFHUTl2d2dJU2Nic1cxdnUyTm5CckxmT3hGK0JMSlBLZkVCZmdZdVVaUS9RTE5ybTVYT1d5REtWd09LNjBDCm5PWUVhdzdhaDZJMzFxclhhMEtrSllOYVFUaXg4bnU1VWtYSDhZUnU2bU84YzcySjVGc2R0eWp0clMyK1ZncnFSdmxlMEUKU1JhTEdNTHJRUUtxYVRLVFV1dEZuNVJQcHNwbEZYL3FiUzU5NkVReFJHcGFOWkNaTXBuZXJzcWZnVDJZS3hrazdmZzh4MAp5TUtDZlVhTU1BVlUxTnJDczlkMW9UL3VreW4vTmlJY296cktYaW8yem95MUNDUDdTK091Ty8rMS9WV2pyN3llVUxlYkR3CkhYTUpPNTBqMzVDUksvMVBRb1oxRFNoSitoOVhqWnR1bldhWk80WWxBQUFGaU9PZ2RDRGpvSFFnQUFBQUIzTnphQzF5YzIKRUFBQUdCQU5YT2lHcDFGTzVQcjVLOXB4eEZ6MTZhSytudmdMSldzN1Z0Nkphc1k2N1NCYkxweWh3S1NoMFZCZHJTcUxtOQp4ZzdsTmZqVDQrK0RBeVUxaTlEQXR1ZTIrZFRFY2pZZnRUS1lFcEFyYVBMb1dPMzZFRVM4VUZGc0tJdlRiMWhHSWtUZDk4Cll4amFDeml1Uy9tWE5lb3dtYURZZXFmQUNlem1nbFpYVk9rVlhZVUdqdzBhOEE1ZHhScmMyNlQrY0lxMVc2dWRxbnNhaGsKUGI4SUNFbkc3RnRiN3RqWndheTN6c1JmZ1N5VHlueEFYNEdMbEdVUDBDemE1dVZ6bHNneWxjRGl1dEFwem1CR3NPMm9laQpOOWFxMTJ0Q3BDV0RXa0U0c2ZKN3VWSkZ4L0dFYnVwanZITzlpZVJiSGJjbzdhMHR2bFlLNmtiNVh0QkVrV2l4akM2MEVDCnFta3lrMUxyUlorVVQ2YktaUlYvNm0wdWZlaEVNVVJxV2pXUW1US1ozcTdLbjRFOW1Dc1pKTzM0UE1kTWpDZ24xR2pEQUYKVk5UYXdyUFhkYUUvN3BNcC96WWlIS002eWw0cU5zNk10UWdqKzB2anJqdi90ZjFWbzYrOG5sQzNtdzhCMXpDVHVkSTkrUQprU3Y5VDBLR2RRMG9TZm9mVjQyYmJwMW1tVHVHSlFBQUFBTUJBQUVBQUFHQUZmK05DNThHUzBySm5zaUNwQ2NPb2dZczFJCkgrOU5wMDNRcjA3bVBJVWRsc0dxOXhTeGRIN3R3VjRTRGhtVkxNU1FZT1dvNjZtZzhaeUw5TXBtcmRwdE90dXRXSGhzZ1cKWmFFOTc3VjNzOTV5SC9JbHNGekx5c1RkR3gzakMrc1RaWkNOQ01oYWNSbG9CZ2NzcTdFbUJ6dmhmbjd0Q1VkTnAydUpsOQp0QW10dUowbkpNc0x2ZjZwNUF5clVMdVpLcnhrTlRFZ3RFL1RWcklQZWJtck9yNSs1NmtiYzk5UjVvV000V3hWWmpkQXRQCmlFMnJOQWEvZlkzOFNjbHR6eVZkRU5YZlhiYlBiR3hMenFWUjFoTWwyeDdkOXBGTE1IRDJxRmNhalpiOWx0SzJnOXkxTmcKRWdOU3F3cE5UK2VYWTIxRnBFc0tXbzVWM0xTeG1ENUdsQkdPc2hLZFVOdDRqRFdjR2xVekNJUWduaU5RME5JQ3pIZTBOWQpqWk1TK3lyb1VOV0tNYVJob1d5aVJVcWJENGpXUHVMbGdYbjhNVnJ6MXluK1Y3TkN2SVpYNG5KZWIreXhpUndFRVFTT1hBCmQzcE4yRk1yVEpVeXRVanQ1dU9lOUtEQlA5Q3Myc0ZJcG5tM2dmUFNVSlNEc2tWdHRXZ1ZHVFNPRFRsYVRqR241aEFBQUEKd0VwS3VFWE5aeDIyclkwWmJLZW5KQ3F0Z1dyYUtBUEVjVDA3azJKeXl4ck5zazhFSlJKNjBCL1pja2ZDTS95UTErcVVTSgpBbnhvS0NXWjdyaEdWcE1KbEVKN3ZGcWExbFBDb1Nld3VGM0FRRjgzVDQybVhQTC9nTlVqekxvVTdCR3ZMZ2VxNzU0azFGCnJwK28yb0tzd2N5ZHMwZnlyTFdCdFlsZmFyUVVINmYwTzBiUUZWUlFjMkRjTyt5Y243UFVVSDAzcHEwZ094cXpQKzZOVEQKTjliMWNIMUE3eFlPL0ZDRDZuNnhEQ0hjSmVNRnFDb1hsbTRFWUpDUnY5Z0ZLYW9BQUFBTUVBL0lqdmw0VlpjNnFvYzh2Qwp4NlA3WGVUbzFyKzZEa1B3cXFoY25PRnBIMDJZeGVtM1Z3RDdCM1BieXZybmhVTkFyQ0VyMXh5eU05SlFLY1ZESnB0NEpzCmlsZVp1N1BLb09JdWw4MytHeGxSQ2daSHJwbDdQYld0TURRVmh5M3FQQTRjTERONmo2TDRRcm0xVUxjUm1PSU8xRzdtSHMKdStySnFPNURoZmI5MS80SlRIQWxJdWI5a0ZGM0hQMnlHZUEyRDBSWjRtVUd2RlYySUVMUXhWMXRnZ2xiOHIyNWdFSUhycwpOQmlnMXR3anFIcmlqWmMrQlVvMUNvRVhpWFk0bE5BQUFBd1FEWXZZOFpsSUdPenRKcVo4MkQrckh1QWx1eEZiNFh1bUJCClVwUWVybktLNVplME9kcWhrQ1VEN2QzQWk4RkZ4MlZ4STVMWTRqcDZWb01KaUY1MlRrVFE4ZXVKM3prYW1qL3UreDNxbzgKYjB5d0VIZWc0akFsSUoxSXYwNFArT1pPc3o5Y20zS2gwMk9uQXg2b1FpT29TTXYwMXFtdDlPMm5xRVU1V2N2VkEvUUZjTApYblJNeVpFOEg2MzJqMjZPU2hRM09vUk55aFZqeEJ2SzRpVUJXK3R3ek82YnFuVXlEaEtxaDIyVHVrSDErUkMzZ2RZcnFHCnNKYTE3RkF2ay94RGtBQUFBTlltOXNhV0Z1UUhWaWRXNTBkUUVDQXdRRkJnPT0KLS0tLS1FTkQgT1BFTlNTSCBQUklWQVRFIEtFWS0tLS0tCg==
+kind: Secret
+metadata:
+  name: host-publickey-key
+type: Opaque
+---
+apiVersion: sshpiper.com/v1beta1
+kind: Pipe
+metadata:
+  name: pipe-publickey
+spec:
+  from:
+  - username: ".*" # catch all    
+    username_regex_match: true
+    authorized_keys_data: "c3NoLXJzYSBBQUFBQjNOemFDMXljMkVBQUFBREFRQUJBQUFCZ1FEWndMdmN5eXFoWFhWZkxRU1hEdkFOMVQwZWQyNEVSRGFVUGdWS2xZaE5sR1RPNTh1TW1tc1gvOUc0SlRzZGlWSHFvR29OSDZ1a0Y4ZFNNMG1nWmdNT0dNdTE2VHdld2xqd01GcksrS1NZYTVaYzQ2Vnk1N2F6MFpFbml2WlZwY1RhdXpndHZwUTRjOXNhd3dVY2M5M0Y1eHdlZnNuTEl5eTJVc0s0SXhOeGFSV1NPMFdvanJGL3A2di9SaE1aeXZkcXlYUk9aVVl3aFRiUE1OZE1ZblROanY3YmVHL3dlR1Y3Wkhpc25TTzhiUDNjYStMVllkeVJINXhlMmp6Vm5HMmNjOHl5MUZZbjJOaHRLaUo5c1k5VFlCbndlSi8xNXZjbE9UY2xRMVBBa3pGZGt4WDM4aWM0VlhKNDhFREYwenR2cVdQeVpNQ2ZCQ2N4TGpHZVBwUW0xR1hRWU9udmthTEJPU1NNcDltRW9SZmUyZENmNjE4b3B1TTFjcEhxT2s2Z2RwZ3BKNXh5dzdFcUxVNWRVNmVYS1RrcCtoYXM4S01yRjN5SWo5R0drbFo3clNteENEWWVLMnZmY0FvT0RuWENuMjBBT2ZjMUdQZW5nSmJhL1ZUN3JiTmRUek4vZTYrTG15WHhmQThmbEVBN3VaUHF5WWtKKzVpTEFUYUdnTE09IGJvbGlhbkB1YnVudHUK"
+  to:
+    host: host-publickey:2222
+    username: "user"
+    private_key_secret:
+      name: host-publickey-key
+    ignore_hostkey: true
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: host-publickey
+spec:
+  selector:
+    app: host-publickey
+  ports:
+    - protocol: TCP
+      port: 2222
+---
+apiVersion: v1
+kind: Pod
+metadata:
+  name: host-publickey
+  labels:
+    app: host-publickey
+spec:
+  containers:
+  - name: host-publickey
+    image: lscr.io/linuxserver/openssh-server:latest
+    ports:
+    - containerPort: 2222
+    env:
+    - name: USER_NAME
+      value: "user"
+    - name: PUBLIC_KEY
+      value: "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDVzohqdRTuT6+SvaccRc9emivp74CyVrO1beiWrGOu0gWy6cocCkodFQXa0qi5vcYO5TX40+PvgwMlNYvQwLbntvnUxHI2H7UymBKQK2jy6Fjt+hBEvFBRbCiL029YRiJE3ffGMY2gs4rkv5lzXqMJmg2HqnwAns5oJWV1TpFV2FBo8NGvAOXcUa3Nuk/nCKtVurnap7GoZD2/CAhJxuxbW+7Y2cGst87EX4Esk8p8QF+Bi5RlD9As2ublc5bIMpXA4rrQKc5gRrDtqHojfWqtdrQqQlg1pBOLHye7lSRcfxhG7qY7xzvYnkWx23KO2tLb5WCupG+V7QRJFosYwutBAqppMpNS60WflE+mymUVf+ptLn3oRDFEalo1kJkymd6uyp+BPZgrGSTt+DzHTIwoJ9RowwBVTU2sKz13WhP+6TKf82IhyjOspeKjbOjLUII/tL4647/7X9VaOvvJ5Qt5sPAdcwk7nSPfkJEr/U9ChnUNKEn6H1eNm26dZpk7hiU="

plugin/kubernetes/tools.go

@@ -0,0 +1,6 @@
+//go:build tools
+// +build tools
+
+package tools
+
+import _ "k8s.io/code-generator"

plugin/kubernetes/update-codegen.sh

@@ -0,0 +1,26 @@
+#!/usr/bin/env bash
+ 
+set -o errexit
+set -o nounset
+set -o pipefail
+
+go mod vendor
+ 
+SCRIPT_ROOT=$(dirname "${BASH_SOURCE[0]}")
+REPO_ROOT=$(realpath "${SCRIPT_ROOT}/../../")
+CODEGEN_PKG=${REPO_ROOT}/vendor/k8s.io/code-generator
+ 
+# generate the code with:
+# --output-base    because this script should also be able to run inside the vendor dir of
+#                  k8s.io/kubernetes. The output-base is needed for the generators to output into the vendor dir
+#                  instead of the $GOPATH directly. For normal projects this can be dropped.
+# generators deepcopy,client,informer,lister
+chmod +x "${CODEGEN_PKG}"/generate-groups.sh
+"${CODEGEN_PKG}"/generate-groups.sh \
+  "deepcopy,client,lister" \
+  github.com/tg123/sshpiper/plugin/kubernetes/generated \
+  github.com/tg123/sshpiper/plugin/kubernetes/apis \
+  sshpiper:v1beta1 \
+  --go-header-file /dev/null \
+  --trim-path-prefix github.com/tg123/sshpiper/plugin/kubernetes/
+