sshpiper/plugin/kubernetes/sample.yaml
2022-10-24 23:37:38 +00:00

196 lines
No EOL
12 KiB
YAML

# sshpiper service
---
apiVersion: v1
kind: Service
metadata:
name: sshpiper
spec:
selector:
app: sshpiper
ports:
- protocol: TCP
port: 2222
---
apiVersion: v1
data:
server_key: |
LS0tLS1CRUdJTiBPUEVOU1NIIFBSSVZBVEUgS0VZLS0tLS0KYjNCbGJuTnphQzFyWlhrdGRqRUFBQUFBQkc1dmJtVUFBQUFFYm05dVpRQUFBQUFBQUFBQkFBQUJsd0FBQUFkemMyZ3RjbgpOaEFBQUFBd0VBQVFBQUFZRUFxNEVNbmlFR3ZXTXNSNEdqWDc4UWRNcUxjVHlhRTNWSUlLMU5KdmpZaDFnUUtyZnU3OUI2Ckx2N3ZpOUl0SHNjQmRGTEhEYW5od0ZzdWw4MjRibkJ0dlgya3ZjbzY0eFpKcC9nZ0R2NUhUV2svQ0Fkek5TTWxTVjlERXIKcW9kTUlEYmJ1WWxoSXBBNEVKeVpqbEFmQWFtTlFtZGdHVmtMdzlVN1NiN3BPUnovWlVRZ0NkcU1KQjU4NlYzYmRoZGVudgp3NVQ4WnhnZGlQMzlhblpkdjV3TTQyOU8vT2Rjb0VEcFpxWDlpYVJUbGdwdUZBOWp0b1IrbzNyRjZzNFUyNS9XbXdHeHU1CnNaQVdncjBBTjgwSTZEVEZjN0cvUG9nSFpUek5ZcGNzdHZiY21leXV1bmFnUE83RXA5OWt3dEQ5UVdCUDFFZXFrSk0wdjAKL1ViT1l3aDY4QnIzT2t5SXVPak9CTU5OYkRpRkU2eXFENlI4bTY1MWpSZHg1eFVnckpjQjEzK2pzbi9sVFo0LzQ1L3VQQQpBNy8xUy9sV0V5OHRHdzVNSVZPWUd4L2h2cXdVSmJnUndCc1NVNExsUEVLRXp3d1FHeEw1b09QaWdJYmszNUhYaWowd2J0CjB4TWRiOHgybVl2Mzl4ZDZBWGllTGVGc1VLYmtZbW1USmhmRlJkSjdBQUFGaUltZ2Z3MkpvSDhOQUFBQUIzTnphQzF5YzIKRUFBQUdCQUt1QkRKNGhCcjFqTEVlQm8xKy9FSFRLaTNFOG1oTjFTQ0N0VFNiNDJJZFlFQ3EzN3UvUWVpNys3NHZTTFI3SApBWFJTeHcycDRjQmJMcGZOdUc1d2JiMTlwTDNLT3VNV1NhZjRJQTcrUjAxcFB3Z0hjelVqSlVsZlF4SzZxSFRDQTIyN21KCllTS1FPQkNjbVk1UUh3R3BqVUpuWUJsWkM4UFZPMG0rNlRrYy8yVkVJQW5hakNRZWZPbGQyM1lYWHA3OE9VL0djWUhZajkKL1dwMlhiK2NET052VHZ6blhLQkE2V2FsL1lta1U1WUtiaFFQWTdhRWZxTjZ4ZXJPRk51ZjFwc0JzYnViR1FGb0s5QURmTgpDT2cweFhPeHZ6NklCMlU4eldLWExMYjIzSm5zcnJwMm9EenV4S2ZmWk1MUS9VRmdUOVJIcXBDVE5MOVAxR3ptTUlldkFhCjl6cE1pTGpvemdURFRXdzRoUk9zcWcra2ZKdXVkWTBYY2VjVklLeVhBZGQvbzdKLzVVMmVQK09mN2p3QU8vOVV2NVZoTXYKTFJzT1RDRlRtQnNmNGI2c0ZDVzRFY0FiRWxPQzVUeENoTThNRUJzUythRGo0b0NHNU4rUjE0bzlNRzdkTVRIVy9NZHBtTAo5L2NYZWdGNG5pM2hiRkNtNUdKcGt5WVh4VVhTZXdBQUFBTUJBQUVBQUFHQWE2ZDc5aDZoRG15Y05ONkpZT2FjTzlPUUtDCnAwUk5hUHlnTSt0TUhybVRtTUhHU00xWGcxMmg0bzI4bTRqT002Wkh3NWVyZ3lmdjQ5aHdpWlJxbklHUFF2WHZyOGIrTmoKcE00NXdXK1g3bDJzTlN3SUEwam1kT0laUmo1bzA3R2RXVm95YzdFK2tYYUVZRWxiSnhaQ2U4QmZ6QjgrZFRYVUFTRVQ2SApRMVNTZEV5SkYrWlpwYXFGbWk5U1BSUjZUcTNnZzlUN0Z4aUxaMlJrZTZuVFlsV1BaYnpLQ21JZW5kR0pRRlRFc2NOTWlqClJIQk1sUnNpS3hnNytDSVlNYXhva0o4MUI3N2lJUTFTVmRzaXpnVTZ5eklERDRPOGlqTVdmVVVaZ3FoY3FYTnp6T3NpZTEKRXVEdkk1ZlpVNGRuVU1MdmxEZGMxUGUyS09BSVFTVnlrNCtHWGFMZEl0SzE4TnhjdmEvM255SVNKMWFCQXV4YkNRQkdRYQpycmRZUitNdndJdkRlbndyTUs0bWtWR2w2NnBySTZRdW56bU9vN01OUXlkODlLQ1RBblJjWlhVNCtkZnZWaVJubFRlK3VZCnZtbE5sc1hhOEpRZjlvRlV3a1VLZmxRdnovZ0NrdXFqdkNsamxrZThxM3VTa05MMXhDTVpQRkJSTEd4WWdlWjNEeEFBQUEKd0RrakpPQjlVMXNMRDFrUzc4ZlNObm9tbGRXaFFQeGxKa1JYUk80MjJqYXZ5OThMb1JWOWpNU2N0R3JpODljTHFFcEV5dApsSHVVTjNJSU1rU1RVcFhtS3NNVXB2SnBZMmpHYUs2SlhKMGR1VG4rbDNQd3gzVU05TW0zOFY4R3BablFWMmMydmlXeTNqCmU2c1hrWDVwV01WRHpqZHd1b0c4c1JrYTZ1TnM0d1N3a0RKdXIrLzh4WnczM0k1eVJCd2M3bHBBczZBMVUvNnZDVGJiQ0kKb0QwMWcvTEtldVpHRjNYcWRLMXhqc2xTZmR5TERBMGNLYzRITXpnUkYwckVGMWtBQUFBTUVBMDAyL3lsaEkzVXdPRU01LwpjQUlBanJSZC9FQjdMUE5zVldGNjdaZEFMVXRrRmVVMGlsY3ZaaUxJMlMwYkJqVXUwUWtCMW5SU3pFamdGSTVldGY5eWs4CnRiSHFGa1htUnNwbGtKUEhRU09QL1ByMWNzb1o0QXlGWWhJOE9ucHkzNVVyNnZlNGQxeHR6RURLWmdMOWo5QTlFKzdwUUgKdWVZZ3pvTUJacXNhcGdsaXJjWDhtQXRiREQ2SFdOMjlrZm1VYjlRYi91aURFb3h2WmtVMmhvVTNZOHI4YXN3dVhCU3JTaAp5TkdQQjQxSitpelUyM0pQS0IyeVZ5VS9SNlRaaWZBQUFBd1FEUHlCOUFoNUNucEVRUGY3WCtIU29jVzJYUis4L3BJM0NSCmpyT0diS0dMUGhaMldxeUlaOW5WRmRoSmY4TXgyVlVzeHJyL3paUGlzd1ZiZ2pkczE0d0EzYUJrT2RwbkhHbWFTM0lCRUgKN2g5d0NlaFl6Z0htS0t0T1oxRWhSWjFaQmEzU0dnMlp2d3lXRVBOM0RRK0l0QUsyaWllQm9UbFpmS0pieWpwWEhNL2tPcApmSUZFVm5QbTFDa1dyb3NBOGlVUXBWMzhWbGk0ZXAyWU95NVJCMFo3UGlyek5PSFdsTHFicEVWV0F2QjVPU3ljV0lGWTBrCkJZdnB3Q01zMEZES1VBQUFBTlltOXNhV0Z1UUhWaWRXNTBkUUVDQXdRRkJnPT0KLS0tLS1FTkQgT1BFTlNTSCBQUklWQVRFIEtFWS0tLS0tCg==
kind: Secret
metadata:
name: sshpiper-server-key
type: Opaque
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: sshpiper-deployment
labels:
app: sshpiper
spec:
replicas: 1
selector:
matchLabels:
app: sshpiper
template:
metadata:
labels:
app: sshpiper
spec:
serviceAccountName: sshpiper-account
containers:
- name: sshpiper
imagePullPolicy: IfNotPresent
image: farmer1992/sshpiperd:latest
ports:
- containerPort: 2222
env:
- name: PLUGIN
value: "kubernetes"
- name: SSHPIPERD_SERVER_KEY
value: "/serverkey/ssh_host_rsa_key"
- name: SSHPIPERD_LOG_LEVEL
value: "trace"
volumeMounts:
- name: sshpiper-server-key
mountPath: "/serverkey/"
readOnly: true
volumes:
- name: sshpiper-server-key
secret:
secretName: sshpiper-server-key
items:
- key: server_key
path: ssh_host_rsa_key
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
name: sshpiper-reader
rules:
- apiGroups: [""]
resources: ["secrets"]
verbs: ["get"]
- apiGroups: ["sshpiper.com"]
resources: ["pipes"]
verbs: ["get", "list", "watch"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: read-sshpiper
subjects:
- kind: ServiceAccount
name: sshpiper-account
roleRef:
kind: Role
name: sshpiper-reader
apiGroup: rbac.authorization.k8s.io
---
apiVersion: v1
kind: ServiceAccount
metadata:
name: sshpiper-account
# pipe to a password based sshd
---
apiVersion: sshpiper.com/v1beta1
kind: Pipe
metadata:
name: pipe-password
spec:
from:
- username: "password_simple"
to:
host: host-password:2222
username: "user"
ignore_hostkey: true
---
apiVersion: v1
kind: Service
metadata:
name: host-password
spec:
selector:
app: host-password
ports:
- protocol: TCP
port: 2222
---
apiVersion: v1
kind: Pod
metadata:
name: host-password
labels:
app: host-password
spec:
containers:
- name: host-password
imagePullPolicy: IfNotPresent
image: lscr.io/linuxserver/openssh-server:latest
ports:
- containerPort: 2222
env:
- name: PASSWORD_ACCESS
value: "true"
- name: USER_PASSWORD
value: "pass"
- name: USER_NAME
value: "user"
# pipe to a key based sshd
---
apiVersion: v1
data:
privatekey: |
LS0tLS1CRUdJTiBPUEVOU1NIIFBSSVZBVEUgS0VZLS0tLS0KYjNCbGJuTnphQzFyWlhrdGRqRUFBQUFBQkc1dmJtVUFBQUFFYm05dVpRQUFBQUFBQUFBQkFBQUJsd0FBQUFkemMyZ3RjbgpOaEFBQUFBd0VBQVFBQUFZRUExYzZJYW5VVTdrK3ZrcjJuSEVYUFhwb3I2ZStBc2xhenRXM29scXhqcnRJRnN1bktIQXBLCkhSVUYydEtvdWIzR0R1VTErTlBqNzRNREpUV0wwTUMyNTdiNTFNUnlOaCsxTXBnU2tDdG84dWhZN2ZvUVJMeFFVV3dvaTkKTnZXRVlpUk4zM3hqR05vTE9LNUwrWmMxNmpDWm9OaDZwOEFKN09hQ1ZsZFU2UlZkaFFhUERScndEbDNGR3R6YnBQNXdpcgpWYnE1MnFleHFHUTl2d2dJU2Nic1cxdnUyTm5CckxmT3hGK0JMSlBLZkVCZmdZdVVaUS9RTE5ybTVYT1d5REtWd09LNjBDCm5PWUVhdzdhaDZJMzFxclhhMEtrSllOYVFUaXg4bnU1VWtYSDhZUnU2bU84YzcySjVGc2R0eWp0clMyK1ZncnFSdmxlMEUKU1JhTEdNTHJRUUtxYVRLVFV1dEZuNVJQcHNwbEZYL3FiUzU5NkVReFJHcGFOWkNaTXBuZXJzcWZnVDJZS3hrazdmZzh4MAp5TUtDZlVhTU1BVlUxTnJDczlkMW9UL3VreW4vTmlJY296cktYaW8yem95MUNDUDdTK091Ty8rMS9WV2pyN3llVUxlYkR3CkhYTUpPNTBqMzVDUksvMVBRb1oxRFNoSitoOVhqWnR1bldhWk80WWxBQUFGaU9PZ2RDRGpvSFFnQUFBQUIzTnphQzF5YzIKRUFBQUdCQU5YT2lHcDFGTzVQcjVLOXB4eEZ6MTZhSytudmdMSldzN1Z0Nkphc1k2N1NCYkxweWh3S1NoMFZCZHJTcUxtOQp4ZzdsTmZqVDQrK0RBeVUxaTlEQXR1ZTIrZFRFY2pZZnRUS1lFcEFyYVBMb1dPMzZFRVM4VUZGc0tJdlRiMWhHSWtUZDk4Cll4amFDeml1Uy9tWE5lb3dtYURZZXFmQUNlem1nbFpYVk9rVlhZVUdqdzBhOEE1ZHhScmMyNlQrY0lxMVc2dWRxbnNhaGsKUGI4SUNFbkc3RnRiN3RqWndheTN6c1JmZ1N5VHlueEFYNEdMbEdVUDBDemE1dVZ6bHNneWxjRGl1dEFwem1CR3NPMm9laQpOOWFxMTJ0Q3BDV0RXa0U0c2ZKN3VWSkZ4L0dFYnVwanZITzlpZVJiSGJjbzdhMHR2bFlLNmtiNVh0QkVrV2l4akM2MEVDCnFta3lrMUxyUlorVVQ2YktaUlYvNm0wdWZlaEVNVVJxV2pXUW1US1ozcTdLbjRFOW1Dc1pKTzM0UE1kTWpDZ24xR2pEQUYKVk5UYXdyUFhkYUUvN3BNcC96WWlIS002eWw0cU5zNk10UWdqKzB2anJqdi90ZjFWbzYrOG5sQzNtdzhCMXpDVHVkSTkrUQprU3Y5VDBLR2RRMG9TZm9mVjQyYmJwMW1tVHVHSlFBQUFBTUJBQUVBQUFHQUZmK05DNThHUzBySm5zaUNwQ2NPb2dZczFJCkgrOU5wMDNRcjA3bVBJVWRsc0dxOXhTeGRIN3R3VjRTRGhtVkxNU1FZT1dvNjZtZzhaeUw5TXBtcmRwdE90dXRXSGhzZ1cKWmFFOTc3VjNzOTV5SC9JbHNGekx5c1RkR3gzakMrc1RaWkNOQ01oYWNSbG9CZ2NzcTdFbUJ6dmhmbjd0Q1VkTnAydUpsOQp0QW10dUowbkpNc0x2ZjZwNUF5clVMdVpLcnhrTlRFZ3RFL1RWcklQZWJtck9yNSs1NmtiYzk5UjVvV000V3hWWmpkQXRQCmlFMnJOQWEvZlkzOFNjbHR6eVZkRU5YZlhiYlBiR3hMenFWUjFoTWwyeDdkOXBGTE1IRDJxRmNhalpiOWx0SzJnOXkxTmcKRWdOU3F3cE5UK2VYWTIxRnBFc0tXbzVWM0xTeG1ENUdsQkdPc2hLZFVOdDRqRFdjR2xVekNJUWduaU5RME5JQ3pIZTBOWQpqWk1TK3lyb1VOV0tNYVJob1d5aVJVcWJENGpXUHVMbGdYbjhNVnJ6MXluK1Y3TkN2SVpYNG5KZWIreXhpUndFRVFTT1hBCmQzcE4yRk1yVEpVeXRVanQ1dU9lOUtEQlA5Q3Myc0ZJcG5tM2dmUFNVSlNEc2tWdHRXZ1ZHVFNPRFRsYVRqR241aEFBQUEKd0VwS3VFWE5aeDIyclkwWmJLZW5KQ3F0Z1dyYUtBUEVjVDA3azJKeXl4ck5zazhFSlJKNjBCL1pja2ZDTS95UTErcVVTSgpBbnhvS0NXWjdyaEdWcE1KbEVKN3ZGcWExbFBDb1Nld3VGM0FRRjgzVDQybVhQTC9nTlVqekxvVTdCR3ZMZ2VxNzU0azFGCnJwK28yb0tzd2N5ZHMwZnlyTFdCdFlsZmFyUVVINmYwTzBiUUZWUlFjMkRjTyt5Y243UFVVSDAzcHEwZ094cXpQKzZOVEQKTjliMWNIMUE3eFlPL0ZDRDZuNnhEQ0hjSmVNRnFDb1hsbTRFWUpDUnY5Z0ZLYW9BQUFBTUVBL0lqdmw0VlpjNnFvYzh2Qwp4NlA3WGVUbzFyKzZEa1B3cXFoY25PRnBIMDJZeGVtM1Z3RDdCM1BieXZybmhVTkFyQ0VyMXh5eU05SlFLY1ZESnB0NEpzCmlsZVp1N1BLb09JdWw4MytHeGxSQ2daSHJwbDdQYld0TURRVmh5M3FQQTRjTERONmo2TDRRcm0xVUxjUm1PSU8xRzdtSHMKdStySnFPNURoZmI5MS80SlRIQWxJdWI5a0ZGM0hQMnlHZUEyRDBSWjRtVUd2RlYySUVMUXhWMXRnZ2xiOHIyNWdFSUhycwpOQmlnMXR3anFIcmlqWmMrQlVvMUNvRVhpWFk0bE5BQUFBd1FEWXZZOFpsSUdPenRKcVo4MkQrckh1QWx1eEZiNFh1bUJCClVwUWVybktLNVplME9kcWhrQ1VEN2QzQWk4RkZ4MlZ4STVMWTRqcDZWb01KaUY1MlRrVFE4ZXVKM3prYW1qL3UreDNxbzgKYjB5d0VIZWc0akFsSUoxSXYwNFArT1pPc3o5Y20zS2gwMk9uQXg2b1FpT29TTXYwMXFtdDlPMm5xRVU1V2N2VkEvUUZjTApYblJNeVpFOEg2MzJqMjZPU2hRM09vUk55aFZqeEJ2SzRpVUJXK3R3ek82YnFuVXlEaEtxaDIyVHVrSDErUkMzZ2RZcnFHCnNKYTE3RkF2ay94RGtBQUFBTlltOXNhV0Z1UUhWaWRXNTBkUUVDQXdRRkJnPT0KLS0tLS1FTkQgT1BFTlNTSCBQUklWQVRFIEtFWS0tLS0tCg==
kind: Secret
metadata:
name: host-publickey-key
type: Opaque
---
apiVersion: sshpiper.com/v1beta1
kind: Pipe
metadata:
name: pipe-publickey
spec:
from:
- username: ".*" # catch all
username_regex_match: true
authorized_keys_data: "c3NoLXJzYSBBQUFBQjNOemFDMXljMkVBQUFBREFRQUJBQUFCZ1FEWndMdmN5eXFoWFhWZkxRU1hEdkFOMVQwZWQyNEVSRGFVUGdWS2xZaE5sR1RPNTh1TW1tc1gvOUc0SlRzZGlWSHFvR29OSDZ1a0Y4ZFNNMG1nWmdNT0dNdTE2VHdld2xqd01GcksrS1NZYTVaYzQ2Vnk1N2F6MFpFbml2WlZwY1RhdXpndHZwUTRjOXNhd3dVY2M5M0Y1eHdlZnNuTEl5eTJVc0s0SXhOeGFSV1NPMFdvanJGL3A2di9SaE1aeXZkcXlYUk9aVVl3aFRiUE1OZE1ZblROanY3YmVHL3dlR1Y3Wkhpc25TTzhiUDNjYStMVllkeVJINXhlMmp6Vm5HMmNjOHl5MUZZbjJOaHRLaUo5c1k5VFlCbndlSi8xNXZjbE9UY2xRMVBBa3pGZGt4WDM4aWM0VlhKNDhFREYwenR2cVdQeVpNQ2ZCQ2N4TGpHZVBwUW0xR1hRWU9udmthTEJPU1NNcDltRW9SZmUyZENmNjE4b3B1TTFjcEhxT2s2Z2RwZ3BKNXh5dzdFcUxVNWRVNmVYS1RrcCtoYXM4S01yRjN5SWo5R0drbFo3clNteENEWWVLMnZmY0FvT0RuWENuMjBBT2ZjMUdQZW5nSmJhL1ZUN3JiTmRUek4vZTYrTG15WHhmQThmbEVBN3VaUHF5WWtKKzVpTEFUYUdnTE09IGJvbGlhbkB1YnVudHUK"
to:
host: host-publickey:2222
username: "user"
private_key_secret:
name: host-publickey-key
ignore_hostkey: true
---
apiVersion: v1
kind: Service
metadata:
name: host-publickey
spec:
selector:
app: host-publickey
ports:
- protocol: TCP
port: 2222
---
apiVersion: v1
kind: Pod
metadata:
name: host-publickey
labels:
app: host-publickey
spec:
containers:
- name: host-publickey
image: lscr.io/linuxserver/openssh-server:latest
imagePullPolicy: IfNotPresent
ports:
- containerPort: 2222
env:
- name: USER_NAME
value: "user"
- name: PUBLIC_KEY
value: "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDVzohqdRTuT6+SvaccRc9emivp74CyVrO1beiWrGOu0gWy6cocCkodFQXa0qi5vcYO5TX40+PvgwMlNYvQwLbntvnUxHI2H7UymBKQK2jy6Fjt+hBEvFBRbCiL029YRiJE3ffGMY2gs4rkv5lzXqMJmg2HqnwAns5oJWV1TpFV2FBo8NGvAOXcUa3Nuk/nCKtVurnap7GoZD2/CAhJxuxbW+7Y2cGst87EX4Esk8p8QF+Bi5RlD9As2ublc5bIMpXA4rrQKc5gRrDtqHojfWqtdrQqQlg1pBOLHye7lSRcfxhG7qY7xzvYnkWx23KO2tLb5WCupG+V7QRJFosYwutBAqppMpNS60WflE+mymUVf+ptLn3oRDFEalo1kJkymd6uyp+BPZgrGSTt+DzHTIwoJ9RowwBVTU2sKz13WhP+6TKf82IhyjOspeKjbOjLUII/tL4647/7X9VaOvvJ5Qt5sPAdcwk7nSPfkJEr/U9ChnUNKEn6H1eNm26dZpk7hiU="