Skip to content

Commit 31ab37e

Browse files
jcpunkjcpunk
committed
feat: add read-only proxy
1 parent 03b43ad commit 31ab37e

File tree

8 files changed

+409
-0
lines changed

8 files changed

+409
-0
lines changed

‎charts/kubernetes-dashboard/templates/config/ro-proxy.yaml

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
# Copyright 2017 The Kubernetes Authors.
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# http://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
15+
{{- if .Values.roProxy.enabled }}
16+
apiVersion: v1
17+
kind: ConfigMap
18+
metadata:
19+
labels:
20+
{{- include "kubernetes-dashboard.labels" . | nindent 4 }}
21+
annotations:
22+
{{- include "kubernetes-dashboard.annotations" . | nindent 4 }}
23+
name: {{ template "kubernetes-dashboard.name" . }}-{{ .Values.roProxy.role }}-nginx-conf
24+
data:
25+
nginx.conf: |
26+
pid /tmp/nginx.pid;
27+
error_log /dev/stderr info;
28+
events {
29+
worker_connections 1024;
30+
}
31+
include /etc/nginx/conf.d/*.conf;
32+
---
33+
apiVersion: v1
34+
kind: ConfigMap
35+
metadata:
36+
labels:
37+
{{- include "kubernetes-dashboard.labels" . | nindent 4 }}
38+
annotations:
39+
{{- include "kubernetes-dashboard.annotations" . | nindent 4 }}
40+
name: {{ template "kubernetes-dashboard.name" . }}-{{ .Values.roProxy.role }}-nginx-templates
41+
data:
42+
proxy.conf.template: |
43+
http {
44+
client_body_temp_path /tmp/client_temp;
45+
proxy_temp_path /tmp/proxy_temp_path;
46+
fastcgi_temp_path /tmp/fastcgi_temp;
47+
uwsgi_temp_path /tmp/uwsgi_temp;
48+
scgi_temp_path /tmp/scgi_temp;
49+
server {
50+
listen 8080;
51+
access_log /dev/stdout;
52+
location / {
53+
proxy_pass https://{{ template "kong.fullname" (index $.Subcharts "kong") }}-proxy.{{ .Release.Namespace }}.svc;
54+
proxy_ssl_verify off;
55+
proxy_set_header Host $host;
56+
proxy_set_header X-Real-IP $remote_addr;
57+
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
58+
proxy_ssl_session_reuse on;
59+
proxy_set_header Authorization "Bearer ${DASHBOARD_SERVICE_TOKEN}";
60+
}
61+
}
62+
}
63+
{{ end }}

‎charts/kubernetes-dashboard/templates/deployments/ro-proxy.yaml

Lines changed: 131 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,131 @@
1+
# Copyright 2017 The Kubernetes Authors.
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# http://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
15+
{{- if .Values.roProxy.enabled }}
16+
apiVersion: apps/v1
17+
kind: Deployment
18+
metadata:
19+
labels:
20+
{{- include "kubernetes-dashboard.labels" . | nindent 4 }}
21+
app.kubernetes.io/name: {{ template "kubernetes-dashboard.name" . }}-{{ .Values.roProxy.role }}
22+
app.kubernetes.io/version: {{ .Values.api.image.tag }}
23+
app.kubernetes.io/component: {{ .Values.roProxy.role }}
24+
annotations:
25+
{{- include "kubernetes-dashboard.annotations" . | nindent 4 }}
26+
{{- with .Values.roProxy.annotations }}
27+
{{- toYaml . | nindent 4 }}
28+
{{- end }}
29+
name: {{ template "kubernetes-dashboard.name" . }}-{{ .Values.roProxy.role }}
30+
spec:
31+
replicas: {{ .Values.roProxy.scaling.replicas }}
32+
revisionHistoryLimit: {{ .Values.roProxy.scaling.revisionHistoryLimit }}
33+
selector:
34+
matchLabels:
35+
{{- include "kubernetes-dashboard.matchLabels" . | nindent 6 }}
36+
app.kubernetes.io/name: {{ template "kubernetes-dashboard.name" . }}-{{ .Values.roProxy.role }}
37+
template:
38+
metadata:
39+
labels:
40+
{{- include "kubernetes-dashboard.labels" . | nindent 8 }}
41+
{{- with .Values.roProxy.labels }}
42+
{{ toYaml . | nindent 8 }}
43+
{{- end }}
44+
app.kubernetes.io/name: {{ template "kubernetes-dashboard.name" . }}-{{ .Values.roProxy.role }}
45+
app.kubernetes.io/version: {{ .Values.roProxy.image.tag }}
46+
app.kubernetes.io/component: {{ .Values.roProxy.role }}
47+
annotations:
48+
{{- with .Values.roProxy.annotations }}
49+
{{ toYaml . | nindent 8 }}
50+
{{- end }}
51+
spec:
52+
serviceAccountName: {{ template "kubernetes-dashboard.name" . }}-{{ .Values.roProxy.role }}
53+
containers:
54+
- name: {{ template "kubernetes-dashboard.name" . }}-{{ .Values.roProxy.role }}
55+
image: "{{ .Values.roProxy.image.repository }}:{{ .Values.roProxy.image.tag }}"
56+
imagePullPolicy: {{ .Values.app.image.pullPolicy }}
57+
{{- with .Values.roProxy.containers.ports }}
58+
ports:
59+
{{ toYaml . | nindent 12 }}
60+
{{- end }}
61+
env:
62+
- name: DASHBOARD_SERVICE_TOKEN
63+
valueFrom:
64+
secretKeyRef:
65+
name: {{ template "kubernetes-dashboard.name" . }}-{{ .Values.roProxy.role }}-token
66+
key: token
67+
volumeMounts:
68+
- name: nginx-rendered-templates
69+
mountPath: /etc/nginx/conf.d
70+
- name: nginx-templates
71+
mountPath: /etc/nginx/templates
72+
- name: nginx-conf
73+
mountPath: /etc/nginx/nginx.conf
74+
subPath: nginx.conf
75+
{{- with .Values.roProxy.containers.volumeMounts }}
76+
{{ toYaml . | nindent 12 }}
77+
{{- end }}
78+
{{- with .Values.app.security.containerSecurityContext }}
79+
securityContext:
80+
{{ toYaml . | nindent 12 }}
81+
{{- end }}
82+
{{- with .Values.roProxy.containers.resources }}
83+
resources:
84+
{{ toYaml . | nindent 12 }}
85+
{{- end }}
86+
{{- with .Values.app.image.pullSecrets }}
87+
imagePullSecrets:
88+
{{- range . }}
89+
- name: {{ . }}
90+
{{- end }}
91+
{{- end }}
92+
automountServiceAccountToken: {{ .Values.roProxy.automountServiceAccountToken }}
93+
94+
{{- with .Values.app.security.securityContext }}
95+
securityContext:
96+
{{ toYaml . | nindent 8 }}
97+
{{- end }}
98+
99+
volumes:
100+
- name: nginx-conf
101+
configMap:
102+
name: {{ template "kubernetes-dashboard.name" . }}-{{ .Values.roProxy.role }}-nginx-conf
103+
- name: nginx-templates
104+
configMap:
105+
name: {{ template "kubernetes-dashboard.name" . }}-{{ .Values.roProxy.role }}-nginx-templates
106+
- name: nginx-rendered-templates
107+
emptyDir:
108+
sizeLimit: 5Mi
109+
{{- with .Values.roProxy.volumes }}
110+
{{ toYaml . | nindent 8 }}
111+
{{- end }}
112+
113+
{{- with .Values.app.priorityClassName }}
114+
priorityClassName: {{ . }}
115+
{{- end }}
116+
117+
{{- if or .Values.roProxy.nodeSelector .Values.app.scheduling.nodeSelector }}
118+
nodeSelector:
119+
{{- with .Values.roProxy.nodeSelector }}
120+
{{ toYaml . | nindent 8 }}
121+
{{- end }}
122+
{{- with .Values.app.scheduling.nodeSelector }}
123+
{{ toYaml . | nindent 8 }}
124+
{{- end }}
125+
{{- end }}
126+
127+
{{- with .Values.app.tolerations }}
128+
tolerations:
129+
{{ toYaml . | nindent 8 }}
130+
{{- end }}
131+
{{ end }}

‎charts/kubernetes-dashboard/templates/rbac/ro-user/clusterrole.yaml

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
# Copyright 2017 The Kubernetes Authors.
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# http://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
15+
{{- if .Values.roProxy.enabled }}
16+
apiVersion: rbac.authorization.k8s.io/v1
17+
kind: ClusterRole
18+
metadata:
19+
labels:
20+
{{- include "kubernetes-dashboard.labels" . | nindent 4 }}
21+
rbac.authorization.k8s.io/aggregate-to-cluster-view: "true"
22+
name: {{ template "kubernetes-dashboard.name" . }}-{{ .Values.roProxy.role }}-resources
23+
rules:
24+
- apiGroups:
25+
- ""
26+
resources:
27+
- nodes
28+
- persistentvolumes
29+
verbs:
30+
- get
31+
- list
32+
- watch
33+
- apiGroups:
34+
- storage.k8s.io
35+
resources:
36+
- storageclasses
37+
- volumeattachments
38+
verbs:
39+
- get
40+
- list
41+
- watch
42+
- apiGroups:
43+
- rbac.authorization.k8s.io
44+
resources:
45+
- clusterrolebindings
46+
- clusterroles
47+
- roles
48+
- rolebindings
49+
verbs:
50+
- get
51+
- list
52+
- watch
53+
---
54+
apiVersion: rbac.authorization.k8s.io/v1
55+
kind: ClusterRole
56+
metadata:
57+
labels:
58+
{{- include "kubernetes-dashboard.labels" . | nindent 4 }}
59+
name: {{ template "kubernetes-dashboard.name" . }}-{{ .Values.roProxy.role }}
60+
aggregationRule:
61+
clusterRoleSelectors:
62+
- matchLabels:
63+
rbac.authorization.k8s.io/aggregate-to-view: "true"
64+
- matchLabels:
65+
rbac.authorization.k8s.io/aggregate-to-cluster-view: "true"
66+
{{ end }}

‎charts/kubernetes-dashboard/templates/rbac/ro-user/clusterrolebinding.yaml

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
# Copyright 2017 The Kubernetes Authors.
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# http://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
15+
{{- if .Values.roProxy.enabled }}
16+
apiVersion: rbac.authorization.k8s.io/v1
17+
kind: ClusterRoleBinding
18+
metadata:
19+
labels:
20+
{{- include "kubernetes-dashboard.labels" . | nindent 4 }}
21+
name: {{ template "kubernetes-dashboard.name" . }}-{{ .Values.roProxy.role }}
22+
roleRef:
23+
apiGroup: rbac.authorization.k8s.io
24+
kind: ClusterRole
25+
name: {{ template "kubernetes-dashboard.name" . }}-{{ .Values.roProxy.role }}
26+
subjects:
27+
- kind: ServiceAccount
28+
name: {{ template "kubernetes-dashboard.name" . }}-{{ .Values.roProxy.role }}
29+
namespace: {{ .Release.Namespace }}
30+
{{ end }}

‎charts/kubernetes-dashboard/templates/rbac/ro-user/secret.yaml

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
# Copyright 2017 The Kubernetes Authors.
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# http://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
15+
{{- if .Values.roProxy.enabled }}
16+
apiVersion: v1
17+
kind: Secret
18+
metadata:
19+
annotations:
20+
kubernetes.io/service-account.name: {{ template "kubernetes-dashboard.name" . }}-{{ .Values.roProxy.role }}
21+
labels:
22+
{{- include "kubernetes-dashboard.labels" . | nindent 4 }}
23+
name: {{ template "kubernetes-dashboard.name" . }}-{{ .Values.roProxy.role }}-token
24+
namespace: {{ .Release.Namespace }}
25+
type: kubernetes.io/service-account-token
26+
{{ end }}

‎charts/kubernetes-dashboard/templates/rbac/ro-user/serviceaccount.yaml

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
# Copyright 2017 The Kubernetes Authors.
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# http://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
15+
{{- if .Values.roProxy.enabled }}
16+
apiVersion: v1
17+
kind: ServiceAccount
18+
metadata:
19+
labels:
20+
{{- include "kubernetes-dashboard.labels" . | nindent 4 }}
21+
name: {{ template "kubernetes-dashboard.name" . }}-{{ .Values.roProxy.role }}
22+
namespace: {{ .Release.Namespace }}
23+
automountServiceAccountToken: false
24+
{{ end }}

‎charts/kubernetes-dashboard/templates/services/ro-proxy.yaml

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
# Copyright 2017 The Kubernetes Authors.
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# http://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
15+
{{- if .Values.roProxy.enabled }}
16+
apiVersion: v1
17+
kind: Service
18+
metadata:
19+
labels:
20+
{{- include "kubernetes-dashboard.labels" . | nindent 4 }}
21+
name: kubernetes-dashboard-read-only-proxy
22+
spec:
23+
selector:
24+
{{- include "kubernetes-dashboard.labels" . | nindent 4 }}
25+
{{- with .Values.roProxy.labels }}
26+
{{ toYaml . | nindent 4 }}
27+
{{- end }}
28+
app.kubernetes.io/name: {{ template "kubernetes-dashboard.name" . }}-{{ .Values.roProxy.role }}
29+
app.kubernetes.io/version: {{ .Values.roProxy.image.tag }}
30+
app.kubernetes.io/component: {{ .Values.roProxy.role }}
31+
ports:
32+
- protocol: TCP
33+
port: 80
34+
targetPort: 8080
35+
{{ end }}

0 commit comments

Comments
 (0)