added istio ingress proxy

README.md

@@ -1,25 +1,38 @@
-# nginx-ingress-proxy
+# ingress-proxy
 
 This is an ingress proxy to direct traffic to the ingress controller in small cloud environments without the need for a load balancer.
 
 This proxy runs in the host network of the kubernetes master on the ports `80` and `443`.
 
-Traffic is then redirected to the nginx ingress controller using the proxy protocol.
+Traffic is then redirected to the ingress controller using the proxy protocol.
 
 ## Usage
 
-**Note:** replace `MASTERNODE` with the hostname of your master node.
+**Note:** replace `my-master` with the hostname of your master node.
+
+### Ingress-Nginx
 
 ```
-curl -s -O https://git.giftfish.de/ston1th/nginx-ingress-proxy/raw/branch/master/nginx-ingress-proxy.yaml
+curl -s -O https://git.giftfish.de/ston1th/ingress-proxy/raw/branch/master/nginx-ingress-proxy.yaml
 
 sed -i 's/MASTERNODE/my-master/' nginx-ingress-proxy.yaml
 
 kubectl apply -f nginx-ingress-proxy.yaml
 ```
 
+### Istio Ingress Gateway
+
+```
+curl -s -O https://git.giftfish.de/ston1th/ingress-proxy/raw/branch/master/istio-ingress-proxy.yaml
+
+sed -i 's/MASTERNODE/my-master/' istio-ingress-proxy.yaml
+
+kubectl apply -f istio-ingress-proxy.yaml
+```
+
 ## Cleanup
 
 ```
 kubectl delete -f nginx-ingress-proxy.yaml
+kubectl delete -f istio-ingress-proxy.yaml
 ```

build.sh

@@ -1,7 +1,11 @@
 #!/bin/sh
-file=nginx-ingress-proxy.yaml
+build() {
-rm -f $file 2>/dev/null
+  local file="$1-ingress-proxy.yaml"
-for f in $(ls config/*.yaml); do
+  rm -f $file 2>/dev/null
-  echo "# $f" >> $file
+  for f in $(ls config/$1/*.yaml); do
-  cat $f >> $file
+    echo "# $f" >> $file
-done
+    cat $f >> $file
+  done
+}
+build nginx
+build istio

config/istio/100-serviceaccount.yaml

@@ -0,0 +1,6 @@
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: ingress-proxy
+  namespace: istio-system

config/istio/200-role.yaml

@@ -0,0 +1,15 @@
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: ingress-proxy
+  namespace: istio-system
+rules:
+- apiGroups: [""]
+  resources: ["configmaps"]
+  resourceNames: ["ingress-proxy-config"]
+  verbs: ["get"]
+- apiGroups: ["policy"]
+  resources: ["podsecuritypolicies"]
+  resourceNames: ["ingress-proxy"]
+  verbs: ["use"]

config/istio/200-rolebinding.yaml

@@ -0,0 +1,13 @@
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: ingress-proxy
+  namespace: istio-system
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: ingress-proxy
+subjects:
+- kind: ServiceAccount
+  name: ingress-proxy

config/istio/300-psp.yaml

@@ -2,7 +2,7 @@
 apiVersion: policy/v1beta1
 kind: PodSecurityPolicy
 metadata:
-  name: nginx-ingress-proxy
+  name: ingress-proxy
   annotations:
     seccomp.security.alpha.kubernetes.io/allowedProfileNames: 'docker/default,runtime/default'
     apparmor.security.beta.kubernetes.io/allowedProfileNames: 'runtime/default'

config/istio/deployment.yaml

@@ -0,0 +1,51 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: ingress-proxy
+  namespace: istio-system
+  labels:
+    app: ingress-proxy
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: ingress-proxy
+  template:
+    metadata:
+      labels:
+        app: ingress-proxy
+    spec:
+      serviceAccountName: ingress-proxy
+      nodeSelector:
+        kubernetes.io/hostname: MASTERNODE
+      tolerations:
+      - operator: Exists
+        effect: NoSchedule
+      containers:
+      - name: nginx
+        image: nginx@sha256:2911ad2d54f4cf4dc7ad21af122c1eefce16836a34be751c63351ca1fb452d57 # nginx:mainline-alpine
+        volumeMounts:
+        - name: ingress-proxy-config
+          mountPath: /etc/nginx
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop: ["ALL"]
+            add:
+            - SETUID
+            - SETGID
+            - NET_BIND_SERVICE
+        ports:
+        - name: http
+          containerPort: 80
+          hostPort: 80
+          protocol: TCP
+        - name: https
+          containerPort: 443
+          hostPort: 443
+          protocol: TCP
+      volumes:
+      - name: ingress-proxy-config
+        configMap:
+          name: ingress-proxy-config

config/istio/ingress-proxy-configmap.yaml

@@ -0,0 +1,31 @@
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: ingress-proxy
+  namespace: istio-system
+data:
+  nginx.conf: |
+    user nginx;
+    worker_processes auto;
+    events {
+      worker_connections  1024;
+    }
+    stream {
+      upstream stream_backend_80 {
+        server istio-ingressgateway.istio-system.svc:80;
+      }
+      upstream stream_backend_443 {
+        server istio-ingressgateway.istio-system.svc:443;
+      }
+      server {
+        listen 80;
+        proxy_pass stream_backend_80;
+        proxy_protocol on;
+      }
+      server {
+        listen 443;
+        proxy_pass stream_backend_443;
+        proxy_protocol on;
+      }
+    }

config/istio/istio-proxy-protocol.yaml

@@ -0,0 +1,18 @@
+---
+apiVersion: networking.istio.io/v1alpha3
+kind: EnvoyFilter
+metadata:
+  name: proxy-protocol
+  namespace: istio-system
+spec:
+  workloadSelector:
+    labels:
+      istio: ingressgateway
+  configPatches:
+  - applyTo: LISTENER
+    patch:
+      operation: MERGE
+      value:
+        listener_filters:
+        - name: envoy.listener.proxy_protocol
+        - name: envoy.listener.tls_inspector

config/nginx/100-serviceaccount.yaml

@@ -2,5 +2,5 @@
 apiVersion: v1
 kind: ServiceAccount
 metadata:
-  name: nginx-ingress-proxy
+  name: ingress-proxy
   namespace: ingress-nginx

config/nginx/200-role.yaml

@@ -2,14 +2,14 @@
 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
 metadata:
-  name: nginx-ingress-proxy
+  name: ingress-proxy
   namespace: ingress-nginx
 rules:
 - apiGroups: [""]
   resources: ["configmaps"]
-  resourceNames: ["nginx-ingress-proxy-config"]
+  resourceNames: ["ingress-proxy-config"]
   verbs: ["get"]
 - apiGroups: ["policy"]
   resources: ["podsecuritypolicies"]
-  resourceNames: ["nginx-ingress-proxy"]
+  resourceNames: ["ingress-proxy"]
   verbs: ["use"]

config/nginx/200-rolebinding.yaml

@@ -2,12 +2,12 @@
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
 metadata:
-  name: nginx-ingress-proxy
+  name: ingress-proxy
   namespace: ingress-nginx
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: Role
-  name: nginx-ingress-proxy
+  name: ingress-proxy
 subjects:
 - kind: ServiceAccount
-  name: nginx-ingress-proxy
+  name: ingress-proxy

config/nginx/300-psp.yaml

@@ -0,0 +1,36 @@
+---
+apiVersion: policy/v1beta1
+kind: PodSecurityPolicy
+metadata:
+  name: ingress-proxy
+  annotations:
+    seccomp.security.alpha.kubernetes.io/allowedProfileNames: 'docker/default,runtime/default'
+    apparmor.security.beta.kubernetes.io/allowedProfileNames: 'runtime/default'
+    seccomp.security.alpha.kubernetes.io/defaultProfileName: 'runtime/default'
+    apparmor.security.beta.kubernetes.io/defaultProfileName: 'runtime/default'
+spec:
+  allowedCapabilities:
+  - SETUID
+  - SETGID
+  - NET_BIND_SERVICE
+  requiredDropCapabilities: ["ALL"]
+  privileged: false
+  allowPrivilegeEscalation: false
+  readOnlyRootFilesystem: false
+  volumes:
+  - 'secret'
+  - 'configMap'
+  hostNetwork: true
+  hostIPC: false
+  hostPID: false
+  runAsUser:
+    rule: 'RunAsAny'
+  seLinux:
+    rule: 'RunAsAny'
+  supplementalGroups:
+    rule: 'RunAsAny'
+  fsGroup:
+    rule: 'RunAsAny'
+  hostPorts:
+  - min: 80
+    max: 443

config/nginx/deployment.yaml

@@ -2,21 +2,21 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  name: nginx-ingress-proxy
+  name: ingress-proxy
   namespace: ingress-nginx
   labels:
-    app: nginx-ingress-proxy
+    app: ingress-proxy
 spec:
   replicas: 1
   selector:
     matchLabels:
-      app: nginx-ingress-proxy
+      app: ingress-proxy
   template:
     metadata:
       labels:
-        app: nginx-ingress-proxy
+        app: ingress-proxy
     spec:
-      serviceAccountName: nginx-ingress-proxy
+      serviceAccountName: ingress-proxy
       nodeSelector:
         kubernetes.io/hostname: MASTERNODE
       tolerations:
@@ -26,7 +26,7 @@ spec:
       - name: nginx
         image: nginx@sha256:2911ad2d54f4cf4dc7ad21af122c1eefce16836a34be751c63351ca1fb452d57 # nginx:mainline-alpine
         volumeMounts:
-        - name: nginx-ingress-proxy-config
+        - name: ingress-proxy-config
           mountPath: /etc/nginx
         securityContext:
           allowPrivilegeEscalation: false
@@ -46,6 +46,6 @@ spec:
           hostPort: 443
           protocol: TCP
       volumes:
-      - name: nginx-ingress-proxy-config
+      - name: ingress-proxy-config
         configMap:
-          name: nginx-ingress-proxy-config
+          name: ingress-proxy-config

config/nginx/ingress-proxy-configmap.yaml

@@ -2,7 +2,7 @@
 apiVersion: v1
 kind: ConfigMap
 metadata:
-  name: nginx-ingress-proxy-config
+  name: ingress-proxy
   namespace: ingress-nginx
 data:
   nginx.conf: |

istio-ingress-proxy.yaml

@@ -0,0 +1,177 @@
+# config/istio/100-serviceaccount.yaml
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: ingress-proxy
+  namespace: istio-system
+# config/istio/200-rolebinding.yaml
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: ingress-proxy
+  namespace: istio-system
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: ingress-proxy
+subjects:
+- kind: ServiceAccount
+  name: ingress-proxy
+# config/istio/200-role.yaml
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: ingress-proxy
+  namespace: istio-system
+rules:
+- apiGroups: [""]
+  resources: ["configmaps"]
+  resourceNames: ["ingress-proxy-config"]
+  verbs: ["get"]
+- apiGroups: ["policy"]
+  resources: ["podsecuritypolicies"]
+  resourceNames: ["ingress-proxy"]
+  verbs: ["use"]
+# config/istio/300-psp.yaml
+---
+apiVersion: policy/v1beta1
+kind: PodSecurityPolicy
+metadata:
+  name: ingress-proxy
+  annotations:
+    seccomp.security.alpha.kubernetes.io/allowedProfileNames: 'docker/default,runtime/default'
+    apparmor.security.beta.kubernetes.io/allowedProfileNames: 'runtime/default'
+    seccomp.security.alpha.kubernetes.io/defaultProfileName: 'runtime/default'
+    apparmor.security.beta.kubernetes.io/defaultProfileName: 'runtime/default'
+spec:
+  allowedCapabilities:
+  - SETUID
+  - SETGID
+  - NET_BIND_SERVICE
+  requiredDropCapabilities: ["ALL"]
+  privileged: false
+  allowPrivilegeEscalation: false
+  readOnlyRootFilesystem: false
+  volumes:
+  - 'secret'
+  - 'configMap'
+  hostNetwork: true
+  hostIPC: false
+  hostPID: false
+  runAsUser:
+    rule: 'RunAsAny'
+  seLinux:
+    rule: 'RunAsAny'
+  supplementalGroups:
+    rule: 'RunAsAny'
+  fsGroup:
+    rule: 'RunAsAny'
+  hostPorts:
+  - min: 80
+    max: 443
+# config/istio/deployment.yaml
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: ingress-proxy
+  namespace: istio-system
+  labels:
+    app: ingress-proxy
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: ingress-proxy
+  template:
+    metadata:
+      labels:
+        app: ingress-proxy
+    spec:
+      serviceAccountName: ingress-proxy
+      nodeSelector:
+        kubernetes.io/hostname: MASTERNODE
+      tolerations:
+      - operator: Exists
+        effect: NoSchedule
+      containers:
+      - name: nginx
+        image: nginx@sha256:2911ad2d54f4cf4dc7ad21af122c1eefce16836a34be751c63351ca1fb452d57 # nginx:mainline-alpine
+        volumeMounts:
+        - name: ingress-proxy-config
+          mountPath: /etc/nginx
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop: ["ALL"]
+            add:
+            - SETUID
+            - SETGID
+            - NET_BIND_SERVICE
+        ports:
+        - name: http
+          containerPort: 80
+          hostPort: 80
+          protocol: TCP
+        - name: https
+          containerPort: 443
+          hostPort: 443
+          protocol: TCP
+      volumes:
+      - name: ingress-proxy-config
+        configMap:
+          name: ingress-proxy-config
+# config/istio/ingress-proxy-configmap.yaml
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: ingress-proxy
+  namespace: istio-system
+data:
+  nginx.conf: |
+    user nginx;
+    worker_processes auto;
+    events {
+      worker_connections  1024;
+    }
+    stream {
+      upstream stream_backend_80 {
+        server istio-ingressgateway.istio-system.svc:80;
+      }
+      upstream stream_backend_443 {
+        server istio-ingressgateway.istio-system.svc:443;
+      }
+      server {
+        listen 80;
+        proxy_pass stream_backend_80;
+        proxy_protocol on;
+      }
+      server {
+        listen 443;
+        proxy_pass stream_backend_443;
+        proxy_protocol on;
+      }
+    }
+# config/istio/istio-proxy-protocol.yaml
+---
+apiVersion: networking.istio.io/v1alpha3
+kind: EnvoyFilter
+metadata:
+  name: proxy-protocol
+  namespace: istio-system
+spec:
+  workloadSelector:
+    labels:
+      istio: ingressgateway
+  configPatches:
+  - applyTo: LISTENER
+    patch:
+      operation: MERGE
+      value:
+        listener_filters:
+        - name: envoy.listener.proxy_protocol
+        - name: envoy.listener.tls_inspector

nginx-ingress-proxy.yaml

@@ -1,46 +1,46 @@
-# config/100-serviceaccount.yaml
+# config/nginx/100-serviceaccount.yaml
 ---
 apiVersion: v1
 kind: ServiceAccount
 metadata:
-  name: nginx-ingress-proxy
+  name: ingress-proxy
   namespace: ingress-nginx
-# config/200-rolebinding.yaml
+# config/nginx/200-rolebinding.yaml
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
 metadata:
-  name: nginx-ingress-proxy
+  name: ingress-proxy
   namespace: ingress-nginx
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: Role
-  name: nginx-ingress-proxy
+  name: ingress-proxy
 subjects:
 - kind: ServiceAccount
-  name: nginx-ingress-proxy
+  name: ingress-proxy
-# config/200-role.yaml
+# config/nginx/200-role.yaml
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
 metadata:
-  name: nginx-ingress-proxy
+  name: ingress-proxy
   namespace: ingress-nginx
 rules:
 - apiGroups: [""]
   resources: ["configmaps"]
-  resourceNames: ["nginx-ingress-proxy-config"]
+  resourceNames: ["ingress-proxy-config"]
   verbs: ["get"]
 - apiGroups: ["policy"]
   resources: ["podsecuritypolicies"]
-  resourceNames: ["nginx-ingress-proxy"]
+  resourceNames: ["ingress-proxy"]
   verbs: ["use"]
-# config/300-psp.yaml
+# config/nginx/300-psp.yaml
 ---
 apiVersion: policy/v1beta1
 kind: PodSecurityPolicy
 metadata:
-  name: nginx-ingress-proxy
+  name: ingress-proxy
   annotations:
     seccomp.security.alpha.kubernetes.io/allowedProfileNames: 'docker/default,runtime/default'
     apparmor.security.beta.kubernetes.io/allowedProfileNames: 'runtime/default'
@@ -72,26 +72,26 @@ spec:
   hostPorts:
   - min: 80
     max: 443
-# config/deployment.yaml
+# config/nginx/deployment.yaml
 ---
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  name: nginx-ingress-proxy
+  name: ingress-proxy
   namespace: ingress-nginx
   labels:
-    app: nginx-ingress-proxy
+    app: ingress-proxy
 spec:
   replicas: 1
   selector:
     matchLabels:
-      app: nginx-ingress-proxy
+      app: ingress-proxy
   template:
     metadata:
       labels:
-        app: nginx-ingress-proxy
+        app: ingress-proxy
     spec:
-      serviceAccountName: nginx-ingress-proxy
+      serviceAccountName: ingress-proxy
       nodeSelector:
         kubernetes.io/hostname: MASTERNODE
       tolerations:
@@ -101,7 +101,7 @@ spec:
       - name: nginx
         image: nginx@sha256:2911ad2d54f4cf4dc7ad21af122c1eefce16836a34be751c63351ca1fb452d57 # nginx:mainline-alpine
         volumeMounts:
-        - name: nginx-ingress-proxy-config
+        - name: ingress-proxy-config
           mountPath: /etc/nginx
         securityContext:
           allowPrivilegeEscalation: false
@@ -121,15 +121,15 @@ spec:
           hostPort: 443
           protocol: TCP
       volumes:
-      - name: nginx-ingress-proxy-config
+      - name: ingress-proxy-config
         configMap:
-          name: nginx-ingress-proxy-config
+          name: ingress-proxy-config
-# config/nginx-configmap.yaml
+# config/nginx/ingress-proxy-configmap.yaml
 ---
 apiVersion: v1
 kind: ConfigMap
 metadata:
-  name: nginx-ingress-proxy-config
+  name: ingress-proxy
   namespace: ingress-nginx
 data:
   nginx.conf: |
@@ -156,7 +156,7 @@ data:
         proxy_protocol on;
       }
     }
-# config/nginx-configuration.yaml
+# config/nginx/nginx-configuration.yaml
 ---
 apiVersion: v1
 kind: ConfigMap