Skip to content

Commit accec3e

Browse files
jcpunkjcpunk
committed
feat: add read-only proxy
1 parent 03b43ad commit accec3e

File tree

8 files changed

+411
-0
lines changed

8 files changed

+411
-0
lines changed

‎charts/kubernetes-dashboard/templates/config/ro-proxy.yaml

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
# Copyright 2017 The Kubernetes Authors.
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# http://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
15+
{{- if .Values.roProxy.enabled }}
16+
apiVersion: v1
17+
kind: ConfigMap
18+
metadata:
19+
labels:
20+
{{- include "kubernetes-dashboard.labels" . | nindent 4 }}
21+
annotations:
22+
{{- include "kubernetes-dashboard.annotations" . | nindent 4 }}
23+
name: {{ template "kubernetes-dashboard.name" . }}-{{ .Values.roProxy.role }}-nginx-conf
24+
data:
25+
nginx.conf: |
26+
pid /tmp/nginx.pid;
27+
error_log /dev/stderr info;
28+
events {
29+
worker_connections 1024;
30+
}
31+
include /etc/nginx/conf.d/*.conf;
32+
---
33+
apiVersion: v1
34+
kind: ConfigMap
35+
metadata:
36+
labels:
37+
{{- include "kubernetes-dashboard.labels" . | nindent 4 }}
38+
annotations:
39+
{{- include "kubernetes-dashboard.annotations" . | nindent 4 }}
40+
name: {{ template "kubernetes-dashboard.name" . }}-{{ .Values.roProxy.role }}-nginx-templates
41+
data:
42+
proxy.conf.template: |
43+
http {
44+
client_body_temp_path /tmp/client_temp;
45+
proxy_temp_path /tmp/proxy_temp_path;
46+
fastcgi_temp_path /tmp/fastcgi_temp;
47+
uwsgi_temp_path /tmp/uwsgi_temp;
48+
scgi_temp_path /tmp/scgi_temp;
49+
server {
50+
listen 8080;
51+
access_log /dev/stdout;
52+
location / {
53+
proxy_pass https://{{ template "kong.fullname" (index $.Subcharts "kong") }}-proxy.{{ .Release.Namespace }}.svc;
54+
proxy_ssl_verify off;
55+
proxy_set_header Host $host;
56+
proxy_set_header X-Real-IP $remote_addr;
57+
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
58+
proxy_ssl_session_reuse on;
59+
proxy_set_header Authorization "Bearer ${DASHBOARD_SERVICE_TOKEN}";
60+
}
61+
}
62+
}
63+
{{ end }}

‎charts/kubernetes-dashboard/templates/deployments/ro-proxy.yaml

Lines changed: 133 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,133 @@
1+
# Copyright 2017 The Kubernetes Authors.
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# http://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
15+
{{- if .Values.roProxy.enabled }}
16+
apiVersion: apps/v1
17+
kind: Deployment
18+
metadata:
19+
labels:
20+
{{- include "kubernetes-dashboard.labels" . | nindent 4 }}
21+
app.kubernetes.io/name: {{ template "kubernetes-dashboard.name" . }}-{{ .Values.roProxy.role }}
22+
app.kubernetes.io/version: {{ .Values.api.image.tag }}
23+
app.kubernetes.io/component: {{ .Values.roProxy.role }}
24+
annotations:
25+
{{- include "kubernetes-dashboard.annotations" . | nindent 4 }}
26+
{{- with .Values.roProxy.annotations }}
27+
{{- toYaml . | nindent 4 }}
28+
{{- end }}
29+
name: {{ template "kubernetes-dashboard.name" . }}-{{ .Values.roProxy.role }}
30+
spec:
31+
replicas: {{ .Values.roProxy.scaling.replicas }}
32+
revisionHistoryLimit: {{ .Values.roProxy.scaling.revisionHistoryLimit }}
33+
selector:
34+
matchLabels:
35+
{{- include "kubernetes-dashboard.matchLabels" . | nindent 6 }}
36+
app.kubernetes.io/name: {{ template "kubernetes-dashboard.name" . }}-{{ .Values.roProxy.role }}
37+
template:
38+
metadata:
39+
labels:
40+
{{- include "kubernetes-dashboard.labels" . | nindent 8 }}
41+
{{- with .Values.roProxy.labels }}
42+
{{ toYaml . | nindent 8 }}
43+
{{- end }}
44+
app.kubernetes.io/name: {{ template "kubernetes-dashboard.name" . }}-{{ .Values.roProxy.role }}
45+
app.kubernetes.io/version: {{ .Values.roProxy.image.tag }}
46+
app.kubernetes.io/component: {{ .Values.roProxy.role }}
47+
annotations:
48+
{{- with .Values.roProxy.annotations }}
49+
{{ toYaml . | nindent 8 }}
50+
{{- end }}
51+
spec:
52+
serviceAccountName: {{ template "kubernetes-dashboard.name" . }}-{{ .Values.roProxy.role }}
53+
containers:
54+
- name: {{ template "kubernetes-dashboard.name" . }}-{{ .Values.roProxy.role }}
55+
image: "{{ .Values.roProxy.image.repository }}:{{ .Values.roProxy.image.tag }}"
56+
imagePullPolicy: {{ .Values.app.image.pullPolicy }}
57+
{{- with .Values.roProxy.containers.ports }}
58+
ports:
59+
{{ toYaml . | nindent 12 }}
60+
{{- end }}
61+
env:
62+
- name: DASHBOARD_SERVICE_TOKEN
63+
valueFrom:
64+
secretKeyRef:
65+
name: {{ template "kubernetes-dashboard.name" . }}-{{ .Values.roProxy.role }}-token
66+
key: token
67+
volumeMounts:
68+
- name: nginx-rendered-templates
69+
mountPath: /etc/nginx/conf.d
70+
- name: nginx-templates
71+
mountPath: /etc/nginx/templates
72+
readOnly: true
73+
- name: nginx-conf
74+
mountPath: /etc/nginx/nginx.conf
75+
subPath: nginx.conf
76+
readOnly: true
77+
{{- with .Values.roProxy.containers.volumeMounts }}
78+
{{ toYaml . | nindent 12 }}
79+
{{- end }}
80+
{{- with .Values.app.security.containerSecurityContext }}
81+
securityContext:
82+
{{ toYaml . | nindent 12 }}
83+
{{- end }}
84+
{{- with .Values.roProxy.containers.resources }}
85+
resources:
86+
{{ toYaml . | nindent 12 }}
87+
{{- end }}
88+
{{- with .Values.app.image.pullSecrets }}
89+
imagePullSecrets:
90+
{{- range . }}
91+
- name: {{ . }}
92+
{{- end }}
93+
{{- end }}
94+
automountServiceAccountToken: {{ .Values.roProxy.automountServiceAccountToken }}
95+
96+
{{- with .Values.app.security.securityContext }}
97+
securityContext:
98+
{{ toYaml . | nindent 8 }}
99+
{{- end }}
100+
101+
volumes:
102+
- name: nginx-conf
103+
configMap:
104+
name: {{ template "kubernetes-dashboard.name" . }}-{{ .Values.roProxy.role }}-nginx-conf
105+
- name: nginx-templates
106+
configMap:
107+
name: {{ template "kubernetes-dashboard.name" . }}-{{ .Values.roProxy.role }}-nginx-templates
108+
- name: nginx-rendered-templates
109+
emptyDir:
110+
sizeLimit: 5Mi
111+
{{- with .Values.roProxy.volumes }}
112+
{{ toYaml . | nindent 8 }}
113+
{{- end }}
114+
115+
{{- with .Values.app.priorityClassName }}
116+
priorityClassName: {{ . }}
117+
{{- end }}
118+
119+
{{- if or .Values.roProxy.nodeSelector .Values.app.scheduling.nodeSelector }}
120+
nodeSelector:
121+
{{- with .Values.roProxy.nodeSelector }}
122+
{{ toYaml . | nindent 8 }}
123+
{{- end }}
124+
{{- with .Values.app.scheduling.nodeSelector }}
125+
{{ toYaml . | nindent 8 }}
126+
{{- end }}
127+
{{- end }}
128+
129+
{{- with .Values.app.tolerations }}
130+
tolerations:
131+
{{ toYaml . | nindent 8 }}
132+
{{- end }}
133+
{{ end }}

‎charts/kubernetes-dashboard/templates/rbac/ro-user/clusterrole.yaml

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
# Copyright 2017 The Kubernetes Authors.
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# http://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
15+
{{- if .Values.roProxy.enabled }}
16+
apiVersion: rbac.authorization.k8s.io/v1
17+
kind: ClusterRole
18+
metadata:
19+
labels:
20+
{{- include "kubernetes-dashboard.labels" . | nindent 4 }}
21+
rbac.authorization.k8s.io/aggregate-to-cluster-view: "true"
22+
name: {{ template "kubernetes-dashboard.name" . }}-{{ .Values.roProxy.role }}-resources
23+
rules:
24+
- apiGroups:
25+
- ""
26+
resources:
27+
- nodes
28+
- persistentvolumes
29+
verbs:
30+
- get
31+
- list
32+
- watch
33+
- apiGroups:
34+
- storage.k8s.io
35+
resources:
36+
- storageclasses
37+
- volumeattachments
38+
verbs:
39+
- get
40+
- list
41+
- watch
42+
- apiGroups:
43+
- rbac.authorization.k8s.io
44+
resources:
45+
- clusterrolebindings
46+
- clusterroles
47+
- roles
48+
- rolebindings
49+
verbs:
50+
- get
51+
- list
52+
- watch
53+
---
54+
apiVersion: rbac.authorization.k8s.io/v1
55+
kind: ClusterRole
56+
metadata:
57+
labels:
58+
{{- include "kubernetes-dashboard.labels" . | nindent 4 }}
59+
name: {{ template "kubernetes-dashboard.name" . }}-{{ .Values.roProxy.role }}
60+
aggregationRule:
61+
clusterRoleSelectors:
62+
- matchLabels:
63+
rbac.authorization.k8s.io/aggregate-to-view: "true"
64+
- matchLabels:
65+
rbac.authorization.k8s.io/aggregate-to-cluster-view: "true"
66+
{{ end }}

‎charts/kubernetes-dashboard/templates/rbac/ro-user/clusterrolebinding.yaml

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
# Copyright 2017 The Kubernetes Authors.
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# http://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
15+
{{- if .Values.roProxy.enabled }}
16+
apiVersion: rbac.authorization.k8s.io/v1
17+
kind: ClusterRoleBinding
18+
metadata:
19+
labels:
20+
{{- include "kubernetes-dashboard.labels" . | nindent 4 }}
21+
name: {{ template "kubernetes-dashboard.name" . }}-{{ .Values.roProxy.role }}
22+
roleRef:
23+
apiGroup: rbac.authorization.k8s.io
24+
kind: ClusterRole
25+
name: {{ template "kubernetes-dashboard.name" . }}-{{ .Values.roProxy.role }}
26+
subjects:
27+
- kind: ServiceAccount
28+
name: {{ template "kubernetes-dashboard.name" . }}-{{ .Values.roProxy.role }}
29+
namespace: {{ .Release.Namespace }}
30+
{{ end }}

‎charts/kubernetes-dashboard/templates/rbac/ro-user/secret.yaml

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
# Copyright 2017 The Kubernetes Authors.
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# http://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
15+
{{- if .Values.roProxy.enabled }}
16+
apiVersion: v1
17+
kind: Secret
18+
metadata:
19+
annotations:
20+
kubernetes.io/service-account.name: {{ template "kubernetes-dashboard.name" . }}-{{ .Values.roProxy.role }}
21+
labels:
22+
{{- include "kubernetes-dashboard.labels" . | nindent 4 }}
23+
name: {{ template "kubernetes-dashboard.name" . }}-{{ .Values.roProxy.role }}-token
24+
namespace: {{ .Release.Namespace }}
25+
type: kubernetes.io/service-account-token
26+
{{ end }}

‎charts/kubernetes-dashboard/templates/rbac/ro-user/serviceaccount.yaml

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
# Copyright 2017 The Kubernetes Authors.
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# http://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
15+
{{- if .Values.roProxy.enabled }}
16+
apiVersion: v1
17+
kind: ServiceAccount
18+
metadata:
19+
labels:
20+
{{- include "kubernetes-dashboard.labels" . | nindent 4 }}
21+
name: {{ template "kubernetes-dashboard.name" . }}-{{ .Values.roProxy.role }}
22+
namespace: {{ .Release.Namespace }}
23+
automountServiceAccountToken: false
24+
{{ end }}

‎charts/kubernetes-dashboard/templates/services/ro-proxy.yaml

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
# Copyright 2017 The Kubernetes Authors.
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# http://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
15+
{{- if .Values.roProxy.enabled }}
16+
apiVersion: v1
17+
kind: Service
18+
metadata:
19+
labels:
20+
{{- include "kubernetes-dashboard.labels" . | nindent 4 }}
21+
name: kubernetes-dashboard-read-only-proxy
22+
spec:
23+
selector:
24+
{{- include "kubernetes-dashboard.labels" . | nindent 4 }}
25+
{{- with .Values.roProxy.labels }}
26+
{{ toYaml . | nindent 4 }}
27+
{{- end }}
28+
app.kubernetes.io/name: {{ template "kubernetes-dashboard.name" . }}-{{ .Values.roProxy.role }}
29+
app.kubernetes.io/version: {{ .Values.roProxy.image.tag }}
30+
app.kubernetes.io/component: {{ .Values.roProxy.role }}
31+
ports:
32+
- protocol: TCP
33+
port: 80
34+
targetPort: 8080
35+
{{ end }}

0 commit comments

Comments
 (0)