From 0659c44499cf326d5dd10d4c97a5bd36e4f213e0 Mon Sep 17 00:00:00 2001 From: ston1th Date: Sat, 2 May 2020 13:57:59 +0200 Subject: [PATCH] added istio ingress proxy --- README.md | 21 ++- build.sh | 16 +- config/istio/100-serviceaccount.yaml | 6 + config/istio/200-role.yaml | 15 ++ config/istio/200-rolebinding.yaml | 13 ++ config/{ => istio}/300-psp.yaml | 2 +- config/istio/deployment.yaml | 51 +++++ config/istio/ingress-proxy-configmap.yaml | 31 +++ config/istio/istio-proxy-protocol.yaml | 18 ++ config/{ => nginx}/100-serviceaccount.yaml | 2 +- config/{ => nginx}/200-role.yaml | 6 +- config/{ => nginx}/200-rolebinding.yaml | 6 +- config/nginx/300-psp.yaml | 36 ++++ config/{ => nginx}/deployment.yaml | 16 +- .../ingress-proxy-configmap.yaml} | 2 +- config/{ => nginx}/nginx-configuration.yaml | 0 istio-ingress-proxy.yaml | 177 ++++++++++++++++++ nginx-ingress-proxy.yaml | 48 ++--- 18 files changed, 415 insertions(+), 51 deletions(-) create mode 100644 config/istio/100-serviceaccount.yaml create mode 100644 config/istio/200-role.yaml create mode 100644 config/istio/200-rolebinding.yaml rename config/{ => istio}/300-psp.yaml (96%) create mode 100644 config/istio/deployment.yaml create mode 100644 config/istio/ingress-proxy-configmap.yaml create mode 100644 config/istio/istio-proxy-protocol.yaml rename config/{ => nginx}/100-serviceaccount.yaml (73%) rename config/{ => nginx}/200-role.yaml (67%) rename config/{ => nginx}/200-rolebinding.yaml (69%) create mode 100644 config/nginx/300-psp.yaml rename config/{ => nginx}/deployment.yaml (76%) rename config/{nginx-configmap.yaml => nginx/ingress-proxy-configmap.yaml} (94%) rename config/{ => nginx}/nginx-configuration.yaml (100%) create mode 100644 istio-ingress-proxy.yaml diff --git a/README.md b/README.md index 0950ecc..182ce11 100644 --- a/README.md +++ b/README.md @@ -1,25 +1,38 @@ -# nginx-ingress-proxy +# ingress-proxy This is an ingress proxy to direct traffic to the ingress controller in small cloud environments without the need for a load balancer. This proxy runs in the host network of the kubernetes master on the ports `80` and `443`. -Traffic is then redirected to the nginx ingress controller using the proxy protocol. +Traffic is then redirected to the ingress controller using the proxy protocol. ## Usage -**Note:** replace `MASTERNODE` with the hostname of your master node. +**Note:** replace `my-master` with the hostname of your master node. + +### Ingress-Nginx ``` -curl -s -O https://git.giftfish.de/ston1th/nginx-ingress-proxy/raw/branch/master/nginx-ingress-proxy.yaml +curl -s -O https://git.giftfish.de/ston1th/ingress-proxy/raw/branch/master/nginx-ingress-proxy.yaml sed -i 's/MASTERNODE/my-master/' nginx-ingress-proxy.yaml kubectl apply -f nginx-ingress-proxy.yaml ``` +### Istio Ingress Gateway + +``` +curl -s -O https://git.giftfish.de/ston1th/ingress-proxy/raw/branch/master/istio-ingress-proxy.yaml + +sed -i 's/MASTERNODE/my-master/' istio-ingress-proxy.yaml + +kubectl apply -f istio-ingress-proxy.yaml +``` + ## Cleanup ``` kubectl delete -f nginx-ingress-proxy.yaml +kubectl delete -f istio-ingress-proxy.yaml ``` diff --git a/build.sh b/build.sh index 8e78c01..5091b63 100755 --- a/build.sh +++ b/build.sh @@ -1,7 +1,11 @@ #!/bin/sh -file=nginx-ingress-proxy.yaml -rm -f $file 2>/dev/null -for f in $(ls config/*.yaml); do - echo "# $f" >> $file - cat $f >> $file -done +build() { + local file="$1-ingress-proxy.yaml" + rm -f $file 2>/dev/null + for f in $(ls config/$1/*.yaml); do + echo "# $f" >> $file + cat $f >> $file + done +} +build nginx +build istio diff --git a/config/istio/100-serviceaccount.yaml b/config/istio/100-serviceaccount.yaml new file mode 100644 index 0000000..699329d --- /dev/null +++ b/config/istio/100-serviceaccount.yaml @@ -0,0 +1,6 @@ +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + name: ingress-proxy + namespace: istio-system diff --git a/config/istio/200-role.yaml b/config/istio/200-role.yaml new file mode 100644 index 0000000..fd99878 --- /dev/null +++ b/config/istio/200-role.yaml @@ -0,0 +1,15 @@ +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: ingress-proxy + namespace: istio-system +rules: +- apiGroups: [""] + resources: ["configmaps"] + resourceNames: ["ingress-proxy-config"] + verbs: ["get"] +- apiGroups: ["policy"] + resources: ["podsecuritypolicies"] + resourceNames: ["ingress-proxy"] + verbs: ["use"] diff --git a/config/istio/200-rolebinding.yaml b/config/istio/200-rolebinding.yaml new file mode 100644 index 0000000..4f52f7b --- /dev/null +++ b/config/istio/200-rolebinding.yaml @@ -0,0 +1,13 @@ +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: ingress-proxy + namespace: istio-system +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: ingress-proxy +subjects: +- kind: ServiceAccount + name: ingress-proxy diff --git a/config/300-psp.yaml b/config/istio/300-psp.yaml similarity index 96% rename from config/300-psp.yaml rename to config/istio/300-psp.yaml index 37eddb4..e49c82f 100644 --- a/config/300-psp.yaml +++ b/config/istio/300-psp.yaml @@ -2,7 +2,7 @@ apiVersion: policy/v1beta1 kind: PodSecurityPolicy metadata: - name: nginx-ingress-proxy + name: ingress-proxy annotations: seccomp.security.alpha.kubernetes.io/allowedProfileNames: 'docker/default,runtime/default' apparmor.security.beta.kubernetes.io/allowedProfileNames: 'runtime/default' diff --git a/config/istio/deployment.yaml b/config/istio/deployment.yaml new file mode 100644 index 0000000..3018029 --- /dev/null +++ b/config/istio/deployment.yaml @@ -0,0 +1,51 @@ +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + name: ingress-proxy + namespace: istio-system + labels: + app: ingress-proxy +spec: + replicas: 1 + selector: + matchLabels: + app: ingress-proxy + template: + metadata: + labels: + app: ingress-proxy + spec: + serviceAccountName: ingress-proxy + nodeSelector: + kubernetes.io/hostname: MASTERNODE + tolerations: + - operator: Exists + effect: NoSchedule + containers: + - name: nginx + image: nginx@sha256:2911ad2d54f4cf4dc7ad21af122c1eefce16836a34be751c63351ca1fb452d57 # nginx:mainline-alpine + volumeMounts: + - name: ingress-proxy-config + mountPath: /etc/nginx + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: ["ALL"] + add: + - SETUID + - SETGID + - NET_BIND_SERVICE + ports: + - name: http + containerPort: 80 + hostPort: 80 + protocol: TCP + - name: https + containerPort: 443 + hostPort: 443 + protocol: TCP + volumes: + - name: ingress-proxy-config + configMap: + name: ingress-proxy-config diff --git a/config/istio/ingress-proxy-configmap.yaml b/config/istio/ingress-proxy-configmap.yaml new file mode 100644 index 0000000..a859c16 --- /dev/null +++ b/config/istio/ingress-proxy-configmap.yaml @@ -0,0 +1,31 @@ +--- +apiVersion: v1 +kind: ConfigMap +metadata: + name: ingress-proxy + namespace: istio-system +data: + nginx.conf: | + user nginx; + worker_processes auto; + events { + worker_connections 1024; + } + stream { + upstream stream_backend_80 { + server istio-ingressgateway.istio-system.svc:80; + } + upstream stream_backend_443 { + server istio-ingressgateway.istio-system.svc:443; + } + server { + listen 80; + proxy_pass stream_backend_80; + proxy_protocol on; + } + server { + listen 443; + proxy_pass stream_backend_443; + proxy_protocol on; + } + } diff --git a/config/istio/istio-proxy-protocol.yaml b/config/istio/istio-proxy-protocol.yaml new file mode 100644 index 0000000..b41bee1 --- /dev/null +++ b/config/istio/istio-proxy-protocol.yaml @@ -0,0 +1,18 @@ +--- +apiVersion: networking.istio.io/v1alpha3 +kind: EnvoyFilter +metadata: + name: proxy-protocol + namespace: istio-system +spec: + workloadSelector: + labels: + istio: ingressgateway + configPatches: + - applyTo: LISTENER + patch: + operation: MERGE + value: + listener_filters: + - name: envoy.listener.proxy_protocol + - name: envoy.listener.tls_inspector diff --git a/config/100-serviceaccount.yaml b/config/nginx/100-serviceaccount.yaml similarity index 73% rename from config/100-serviceaccount.yaml rename to config/nginx/100-serviceaccount.yaml index 77b0df5..aad213b 100644 --- a/config/100-serviceaccount.yaml +++ b/config/nginx/100-serviceaccount.yaml @@ -2,5 +2,5 @@ apiVersion: v1 kind: ServiceAccount metadata: - name: nginx-ingress-proxy + name: ingress-proxy namespace: ingress-nginx diff --git a/config/200-role.yaml b/config/nginx/200-role.yaml similarity index 67% rename from config/200-role.yaml rename to config/nginx/200-role.yaml index e6eabd3..efa546e 100644 --- a/config/200-role.yaml +++ b/config/nginx/200-role.yaml @@ -2,14 +2,14 @@ apiVersion: rbac.authorization.k8s.io/v1 kind: Role metadata: - name: nginx-ingress-proxy + name: ingress-proxy namespace: ingress-nginx rules: - apiGroups: [""] resources: ["configmaps"] - resourceNames: ["nginx-ingress-proxy-config"] + resourceNames: ["ingress-proxy-config"] verbs: ["get"] - apiGroups: ["policy"] resources: ["podsecuritypolicies"] - resourceNames: ["nginx-ingress-proxy"] + resourceNames: ["ingress-proxy"] verbs: ["use"] diff --git a/config/200-rolebinding.yaml b/config/nginx/200-rolebinding.yaml similarity index 69% rename from config/200-rolebinding.yaml rename to config/nginx/200-rolebinding.yaml index 01852b8..a761d2f 100644 --- a/config/200-rolebinding.yaml +++ b/config/nginx/200-rolebinding.yaml @@ -2,12 +2,12 @@ apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: - name: nginx-ingress-proxy + name: ingress-proxy namespace: ingress-nginx roleRef: apiGroup: rbac.authorization.k8s.io kind: Role - name: nginx-ingress-proxy + name: ingress-proxy subjects: - kind: ServiceAccount - name: nginx-ingress-proxy + name: ingress-proxy diff --git a/config/nginx/300-psp.yaml b/config/nginx/300-psp.yaml new file mode 100644 index 0000000..e49c82f --- /dev/null +++ b/config/nginx/300-psp.yaml @@ -0,0 +1,36 @@ +--- +apiVersion: policy/v1beta1 +kind: PodSecurityPolicy +metadata: + name: ingress-proxy + annotations: + seccomp.security.alpha.kubernetes.io/allowedProfileNames: 'docker/default,runtime/default' + apparmor.security.beta.kubernetes.io/allowedProfileNames: 'runtime/default' + seccomp.security.alpha.kubernetes.io/defaultProfileName: 'runtime/default' + apparmor.security.beta.kubernetes.io/defaultProfileName: 'runtime/default' +spec: + allowedCapabilities: + - SETUID + - SETGID + - NET_BIND_SERVICE + requiredDropCapabilities: ["ALL"] + privileged: false + allowPrivilegeEscalation: false + readOnlyRootFilesystem: false + volumes: + - 'secret' + - 'configMap' + hostNetwork: true + hostIPC: false + hostPID: false + runAsUser: + rule: 'RunAsAny' + seLinux: + rule: 'RunAsAny' + supplementalGroups: + rule: 'RunAsAny' + fsGroup: + rule: 'RunAsAny' + hostPorts: + - min: 80 + max: 443 diff --git a/config/deployment.yaml b/config/nginx/deployment.yaml similarity index 76% rename from config/deployment.yaml rename to config/nginx/deployment.yaml index d69ca03..9e37ed3 100644 --- a/config/deployment.yaml +++ b/config/nginx/deployment.yaml @@ -2,21 +2,21 @@ apiVersion: apps/v1 kind: Deployment metadata: - name: nginx-ingress-proxy + name: ingress-proxy namespace: ingress-nginx labels: - app: nginx-ingress-proxy + app: ingress-proxy spec: replicas: 1 selector: matchLabels: - app: nginx-ingress-proxy + app: ingress-proxy template: metadata: labels: - app: nginx-ingress-proxy + app: ingress-proxy spec: - serviceAccountName: nginx-ingress-proxy + serviceAccountName: ingress-proxy nodeSelector: kubernetes.io/hostname: MASTERNODE tolerations: @@ -26,7 +26,7 @@ spec: - name: nginx image: nginx@sha256:2911ad2d54f4cf4dc7ad21af122c1eefce16836a34be751c63351ca1fb452d57 # nginx:mainline-alpine volumeMounts: - - name: nginx-ingress-proxy-config + - name: ingress-proxy-config mountPath: /etc/nginx securityContext: allowPrivilegeEscalation: false @@ -46,6 +46,6 @@ spec: hostPort: 443 protocol: TCP volumes: - - name: nginx-ingress-proxy-config + - name: ingress-proxy-config configMap: - name: nginx-ingress-proxy-config + name: ingress-proxy-config diff --git a/config/nginx-configmap.yaml b/config/nginx/ingress-proxy-configmap.yaml similarity index 94% rename from config/nginx-configmap.yaml rename to config/nginx/ingress-proxy-configmap.yaml index 9d78799..9baadb4 100644 --- a/config/nginx-configmap.yaml +++ b/config/nginx/ingress-proxy-configmap.yaml @@ -2,7 +2,7 @@ apiVersion: v1 kind: ConfigMap metadata: - name: nginx-ingress-proxy-config + name: ingress-proxy namespace: ingress-nginx data: nginx.conf: | diff --git a/config/nginx-configuration.yaml b/config/nginx/nginx-configuration.yaml similarity index 100% rename from config/nginx-configuration.yaml rename to config/nginx/nginx-configuration.yaml diff --git a/istio-ingress-proxy.yaml b/istio-ingress-proxy.yaml new file mode 100644 index 0000000..d91cea8 --- /dev/null +++ b/istio-ingress-proxy.yaml @@ -0,0 +1,177 @@ +# config/istio/100-serviceaccount.yaml +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + name: ingress-proxy + namespace: istio-system +# config/istio/200-rolebinding.yaml +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: ingress-proxy + namespace: istio-system +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: ingress-proxy +subjects: +- kind: ServiceAccount + name: ingress-proxy +# config/istio/200-role.yaml +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: ingress-proxy + namespace: istio-system +rules: +- apiGroups: [""] + resources: ["configmaps"] + resourceNames: ["ingress-proxy-config"] + verbs: ["get"] +- apiGroups: ["policy"] + resources: ["podsecuritypolicies"] + resourceNames: ["ingress-proxy"] + verbs: ["use"] +# config/istio/300-psp.yaml +--- +apiVersion: policy/v1beta1 +kind: PodSecurityPolicy +metadata: + name: ingress-proxy + annotations: + seccomp.security.alpha.kubernetes.io/allowedProfileNames: 'docker/default,runtime/default' + apparmor.security.beta.kubernetes.io/allowedProfileNames: 'runtime/default' + seccomp.security.alpha.kubernetes.io/defaultProfileName: 'runtime/default' + apparmor.security.beta.kubernetes.io/defaultProfileName: 'runtime/default' +spec: + allowedCapabilities: + - SETUID + - SETGID + - NET_BIND_SERVICE + requiredDropCapabilities: ["ALL"] + privileged: false + allowPrivilegeEscalation: false + readOnlyRootFilesystem: false + volumes: + - 'secret' + - 'configMap' + hostNetwork: true + hostIPC: false + hostPID: false + runAsUser: + rule: 'RunAsAny' + seLinux: + rule: 'RunAsAny' + supplementalGroups: + rule: 'RunAsAny' + fsGroup: + rule: 'RunAsAny' + hostPorts: + - min: 80 + max: 443 +# config/istio/deployment.yaml +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + name: ingress-proxy + namespace: istio-system + labels: + app: ingress-proxy +spec: + replicas: 1 + selector: + matchLabels: + app: ingress-proxy + template: + metadata: + labels: + app: ingress-proxy + spec: + serviceAccountName: ingress-proxy + nodeSelector: + kubernetes.io/hostname: MASTERNODE + tolerations: + - operator: Exists + effect: NoSchedule + containers: + - name: nginx + image: nginx@sha256:2911ad2d54f4cf4dc7ad21af122c1eefce16836a34be751c63351ca1fb452d57 # nginx:mainline-alpine + volumeMounts: + - name: ingress-proxy-config + mountPath: /etc/nginx + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: ["ALL"] + add: + - SETUID + - SETGID + - NET_BIND_SERVICE + ports: + - name: http + containerPort: 80 + hostPort: 80 + protocol: TCP + - name: https + containerPort: 443 + hostPort: 443 + protocol: TCP + volumes: + - name: ingress-proxy-config + configMap: + name: ingress-proxy-config +# config/istio/ingress-proxy-configmap.yaml +--- +apiVersion: v1 +kind: ConfigMap +metadata: + name: ingress-proxy + namespace: istio-system +data: + nginx.conf: | + user nginx; + worker_processes auto; + events { + worker_connections 1024; + } + stream { + upstream stream_backend_80 { + server istio-ingressgateway.istio-system.svc:80; + } + upstream stream_backend_443 { + server istio-ingressgateway.istio-system.svc:443; + } + server { + listen 80; + proxy_pass stream_backend_80; + proxy_protocol on; + } + server { + listen 443; + proxy_pass stream_backend_443; + proxy_protocol on; + } + } +# config/istio/istio-proxy-protocol.yaml +--- +apiVersion: networking.istio.io/v1alpha3 +kind: EnvoyFilter +metadata: + name: proxy-protocol + namespace: istio-system +spec: + workloadSelector: + labels: + istio: ingressgateway + configPatches: + - applyTo: LISTENER + patch: + operation: MERGE + value: + listener_filters: + - name: envoy.listener.proxy_protocol + - name: envoy.listener.tls_inspector diff --git a/nginx-ingress-proxy.yaml b/nginx-ingress-proxy.yaml index 9a516af..c43997d 100644 --- a/nginx-ingress-proxy.yaml +++ b/nginx-ingress-proxy.yaml @@ -1,46 +1,46 @@ -# config/100-serviceaccount.yaml +# config/nginx/100-serviceaccount.yaml --- apiVersion: v1 kind: ServiceAccount metadata: - name: nginx-ingress-proxy + name: ingress-proxy namespace: ingress-nginx -# config/200-rolebinding.yaml +# config/nginx/200-rolebinding.yaml --- apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: - name: nginx-ingress-proxy + name: ingress-proxy namespace: ingress-nginx roleRef: apiGroup: rbac.authorization.k8s.io kind: Role - name: nginx-ingress-proxy + name: ingress-proxy subjects: - kind: ServiceAccount - name: nginx-ingress-proxy -# config/200-role.yaml + name: ingress-proxy +# config/nginx/200-role.yaml --- apiVersion: rbac.authorization.k8s.io/v1 kind: Role metadata: - name: nginx-ingress-proxy + name: ingress-proxy namespace: ingress-nginx rules: - apiGroups: [""] resources: ["configmaps"] - resourceNames: ["nginx-ingress-proxy-config"] + resourceNames: ["ingress-proxy-config"] verbs: ["get"] - apiGroups: ["policy"] resources: ["podsecuritypolicies"] - resourceNames: ["nginx-ingress-proxy"] + resourceNames: ["ingress-proxy"] verbs: ["use"] -# config/300-psp.yaml +# config/nginx/300-psp.yaml --- apiVersion: policy/v1beta1 kind: PodSecurityPolicy metadata: - name: nginx-ingress-proxy + name: ingress-proxy annotations: seccomp.security.alpha.kubernetes.io/allowedProfileNames: 'docker/default,runtime/default' apparmor.security.beta.kubernetes.io/allowedProfileNames: 'runtime/default' @@ -72,26 +72,26 @@ spec: hostPorts: - min: 80 max: 443 -# config/deployment.yaml +# config/nginx/deployment.yaml --- apiVersion: apps/v1 kind: Deployment metadata: - name: nginx-ingress-proxy + name: ingress-proxy namespace: ingress-nginx labels: - app: nginx-ingress-proxy + app: ingress-proxy spec: replicas: 1 selector: matchLabels: - app: nginx-ingress-proxy + app: ingress-proxy template: metadata: labels: - app: nginx-ingress-proxy + app: ingress-proxy spec: - serviceAccountName: nginx-ingress-proxy + serviceAccountName: ingress-proxy nodeSelector: kubernetes.io/hostname: MASTERNODE tolerations: @@ -101,7 +101,7 @@ spec: - name: nginx image: nginx@sha256:2911ad2d54f4cf4dc7ad21af122c1eefce16836a34be751c63351ca1fb452d57 # nginx:mainline-alpine volumeMounts: - - name: nginx-ingress-proxy-config + - name: ingress-proxy-config mountPath: /etc/nginx securityContext: allowPrivilegeEscalation: false @@ -121,15 +121,15 @@ spec: hostPort: 443 protocol: TCP volumes: - - name: nginx-ingress-proxy-config + - name: ingress-proxy-config configMap: - name: nginx-ingress-proxy-config -# config/nginx-configmap.yaml + name: ingress-proxy-config +# config/nginx/ingress-proxy-configmap.yaml --- apiVersion: v1 kind: ConfigMap metadata: - name: nginx-ingress-proxy-config + name: ingress-proxy namespace: ingress-nginx data: nginx.conf: | @@ -156,7 +156,7 @@ data: proxy_protocol on; } } -# config/nginx-configuration.yaml +# config/nginx/nginx-configuration.yaml --- apiVersion: v1 kind: ConfigMap