198 lines
No EOL
4.8 KiB
YAML
198 lines
No EOL
4.8 KiB
YAML
# sshpiper service
|
|
---
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: sshpiper
|
|
spec:
|
|
selector:
|
|
app: sshpiper
|
|
ports:
|
|
- protocol: TCP
|
|
port: 2222
|
|
---
|
|
apiVersion: v1
|
|
data:
|
|
server_key: |
|
|
LS0tLS1CRUdJTiBPUEVOU1NIIFBSSVZBVEUgS0VZLS0tLS0KYjNCbGJuTnphQzFyWlhrdGRqRUFBQUFBQkc1dmJtVUFBQUFFYm05dVpRQUFBQUFBQUFBQkFBQUFNd0FBQUF0emMyZ3RaVwpReU5UVXhPUUFBQUNCWUhWV01lNzVDZ3Rzdm5rOWlTekJFU3hSdjdMb3U3K0tVbndmb3VnNzcxZ0FBQUpEQnArS0d3YWZpCmhnQUFBQXR6YzJndFpXUXlOVFV4T1FBQUFDQllIVldNZTc1Q2d0c3ZuazlpU3pCRVN4UnY3TG91NytLVW53Zm91Zzc3MWcKQUFBRUJKSDU3eTFaRTUxbVo2a2VsWUR0eDQ1ajBhZGdsUk5CY0pZOE94YTY4TEJWZ2RWWXg3dmtLQzJ5K2VUMkpMTUVSTApGRy9zdWk3djRwU2ZCK2k2RHZ2V0FBQUFEV0p2YkdsaGJrQjFZblZ1ZEhVPQotLS0tLUVORCBPUEVOU1NIIFBSSVZBVEUgS0VZLS0tLS0K
|
|
kind: Secret
|
|
metadata:
|
|
name: sshpiper-server-key
|
|
type: Opaque
|
|
---
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: sshpiper-deployment
|
|
labels:
|
|
app: sshpiper
|
|
spec:
|
|
replicas: 1
|
|
selector:
|
|
matchLabels:
|
|
app: sshpiper
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: sshpiper
|
|
spec:
|
|
serviceAccountName: sshpiper-account
|
|
containers:
|
|
- name: sshpiper
|
|
imagePullPolicy: IfNotPresent
|
|
image: farmer1992/sshpiperd:latest
|
|
ports:
|
|
- containerPort: 2222
|
|
env:
|
|
- name: PLUGIN
|
|
value: "kubernetes"
|
|
- name: SSHPIPERD_SERVER_KEY
|
|
value: "/serverkey/ssh_host_ed25519_key"
|
|
- name: SSHPIPERD_LOG_LEVEL
|
|
value: "trace"
|
|
volumeMounts:
|
|
- name: sshpiper-server-key
|
|
mountPath: "/serverkey/"
|
|
readOnly: true
|
|
volumes:
|
|
- name: sshpiper-server-key
|
|
secret:
|
|
secretName: sshpiper-server-key
|
|
items:
|
|
- key: server_key
|
|
path: ssh_host_ed25519_key
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: Role
|
|
metadata:
|
|
name: sshpiper-reader
|
|
rules:
|
|
- apiGroups: [""]
|
|
resources: ["secrets"]
|
|
verbs: ["get"]
|
|
- apiGroups: ["sshpiper.com"]
|
|
resources: ["pipes"]
|
|
verbs: ["get", "list", "watch"]
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: RoleBinding
|
|
metadata:
|
|
name: read-sshpiper
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: sshpiper-account
|
|
roleRef:
|
|
kind: Role
|
|
name: sshpiper-reader
|
|
apiGroup: rbac.authorization.k8s.io
|
|
---
|
|
apiVersion: v1
|
|
kind: ServiceAccount
|
|
metadata:
|
|
name: sshpiper-account
|
|
|
|
# pipe to a password based sshd
|
|
---
|
|
apiVersion: sshpiper.com/v1beta1
|
|
kind: Pipe
|
|
metadata:
|
|
name: pipe-password
|
|
spec:
|
|
from:
|
|
- username: "password_simple"
|
|
to:
|
|
host: host-password:2222
|
|
username: "user"
|
|
ignore_hostkey: true
|
|
---
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: host-password
|
|
spec:
|
|
selector:
|
|
app: host-password
|
|
ports:
|
|
- protocol: TCP
|
|
port: 2222
|
|
---
|
|
apiVersion: v1
|
|
kind: Pod
|
|
metadata:
|
|
name: host-password
|
|
labels:
|
|
app: host-password
|
|
spec:
|
|
containers:
|
|
- name: host-password
|
|
imagePullPolicy: IfNotPresent
|
|
image: lscr.io/linuxserver/openssh-server:latest
|
|
ports:
|
|
- containerPort: 2222
|
|
env:
|
|
- name: PASSWORD_ACCESS
|
|
value: "true"
|
|
- name: USER_PASSWORD
|
|
value: "pass"
|
|
- name: USER_NAME
|
|
value: "user"
|
|
|
|
|
|
# pipe to a key based sshd
|
|
---
|
|
apiVersion: v1
|
|
data:
|
|
ssh-privatekey: |
|
|
LS0tLS1CRUdJTiBPUEVOU1NIIFBSSVZBVEUgS0VZLS0tLS0KYjNCbGJuTnphQzFyWlhrdGRqRUFBQUFBQkc1dmJtVUFBQUFFYm05dVpRQUFBQUFBQUFBQkFBQUFNd0FBQUF0emMyZ3RaVwpReU5UVXhPUUFBQUNEVVJreDk5dWF3MUtkZHJhWmNMcEI1a2ZNcld3dlV6MmZQT29BckxjcHo5UUFBQUpDK2owK1N2bzlQCmtnQUFBQXR6YzJndFpXUXlOVFV4T1FBQUFDRFVSa3g5OXVhdzFLZGRyYVpjTHBCNWtmTXJXd3ZVejJmUE9vQXJMY3B6OVEKQUFBRURjUWdkaDJ6MnIvNmJscTB6aUoxbDZzNklBWDhDKzlRSGZBSDkzMWNITk85UkdUSDMyNXJEVXAxMnRwbHd1a0htUgo4eXRiQzlUUFo4ODZnQ3N0eW5QMUFBQUFEV0p2YkdsaGJrQjFZblZ1ZEhVPQotLS0tLUVORCBPUEVOU1NIIFBSSVZBVEUgS0VZLS0tLS0K
|
|
kind: Secret
|
|
metadata:
|
|
name: host-publickey-key
|
|
type: kubernetes.io/ssh-auth
|
|
---
|
|
apiVersion: sshpiper.com/v1beta1
|
|
kind: Pipe
|
|
metadata:
|
|
name: pipe-publickey
|
|
annotations:
|
|
privatekey_field_name: ssh-privatekey # this is optional, default is ssh-privatekey
|
|
spec:
|
|
from:
|
|
- username: ".*" # catch all
|
|
username_regex_match: true
|
|
authorized_keys_data: "c3NoLWVkMjU1MTkgQUFBQUMzTnphQzFsWkRJMU5URTVBQUFBSU5SR1RIMzI1ckRVcDEydHBsd3VrSG1SOHl0YkM5VFBaODg2Z0NzdHluUDEK"
|
|
to:
|
|
host: host-publickey:2222
|
|
username: "user"
|
|
private_key_secret:
|
|
name: host-publickey-key
|
|
ignore_hostkey: true
|
|
---
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: host-publickey
|
|
spec:
|
|
selector:
|
|
app: host-publickey
|
|
ports:
|
|
- protocol: TCP
|
|
port: 2222
|
|
---
|
|
apiVersion: v1
|
|
kind: Pod
|
|
metadata:
|
|
name: host-publickey
|
|
labels:
|
|
app: host-publickey
|
|
spec:
|
|
containers:
|
|
- name: host-publickey
|
|
image: lscr.io/linuxserver/openssh-server:latest
|
|
imagePullPolicy: IfNotPresent
|
|
ports:
|
|
- containerPort: 2222
|
|
env:
|
|
- name: USER_NAME
|
|
value: "user"
|
|
- name: PUBLIC_KEY
|
|
value: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINRGTH325rDUp12tplwukHmR8ytbC9TPZ886gCstynP1" |