From 4241c81fc00907ef9b84f260f5cb1df416a33d02 Mon Sep 17 00:00:00 2001
From: Ultradesu <ultradesu@hexor.cy>
Date: Mon, 8 Dec 2025 18:30:34 +0200
Subject: [PATCH] Reworked pasarguard nodes daemonset.

---
 .../pasarguard/configmap-scripts-ingress.yaml |  9 +++---
 k8s/apps/pasarguard/daemonset-ingress.yaml    | 29 ++++++++++++++++++-
 2 files changed, 33 insertions(+), 5 deletions(-)

diff --git a/k8s/apps/pasarguard/configmap-scripts-ingress.yaml b/k8s/apps/pasarguard/configmap-scripts-ingress.yaml
index c581bb9..306b936 100644
--- a/k8s/apps/pasarguard/configmap-scripts-ingress.yaml
+++ b/k8s/apps/pasarguard/configmap-scripts-ingress.yaml
@@ -13,11 +13,11 @@ data:
     # NODE_NAME is already set via environment variable
     NAMESPACE=$(cat /var/run/secrets/kubernetes.io/serviceaccount/namespace)
 
-    # Get DNS name from node label xray-node-address
-    DNS_NAME=$(kubectl get node "${NODE_NAME}" -o jsonpath='{.metadata.labels.xray-node-address}')
+    # Get DNS name from node label xray-public-address
+    DNS_NAME=$(kubectl get node "${NODE_NAME}" -o jsonpath='{.metadata.labels.xray-public-address}')
 
     if [ -z "${DNS_NAME}" ]; then
-      echo "ERROR: Node ${NODE_NAME} does not have label 'xray-node-address'"
+      echo "ERROR: Node ${NODE_NAME} does not have label 'xray-public-address'"
       exit 1
     fi
 
@@ -112,7 +112,7 @@ data:
 
     echo "Creating Service: ${SERVICE_NAME} for node ${NODE_NAME} (short: ${NODE_SHORT_NAME})"
 
-    # Create Service with pod selector
+    # Create Service with pod selector including node name
     cat <<EOF | kubectl apply -f -
     apiVersion: v1
     kind: Service
@@ -126,6 +126,7 @@ data:
       type: ClusterIP
       selector:
         app: pasarguard-node-ingress
+        node-name: ${NODE_SHORT_NAME}
       ports:
         - name: proxy
           port: 443
diff --git a/k8s/apps/pasarguard/daemonset-ingress.yaml b/k8s/apps/pasarguard/daemonset-ingress.yaml
index 4b28612..e2682bc 100644
--- a/k8s/apps/pasarguard/daemonset-ingress.yaml
+++ b/k8s/apps/pasarguard/daemonset-ingress.yaml
@@ -28,6 +28,9 @@ rules:
   - apiGroups: ["traefik.io", "traefik.containo.us"]
     resources: ["ingressroutetcps"]
     verbs: ["get", "list", "create", "update", "patch", "delete"]
+  - apiGroups: [""]
+    resources: ["pods"]
+    verbs: ["get", "list", "patch", "update"]
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
@@ -88,12 +91,36 @@ spec:
         app: pasarguard-node-ingress
     spec:
       serviceAccountName: pasarguard-node-ingress
+      # Add node name as annotation for service selector creation
+      initContainers:
+        - name: label-pod
+          image: bitnami/kubectl:latest
+          env:
+            - name: POD_NAME
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.name
+            - name: POD_NAMESPACE
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.namespace
+            - name: NODE_NAME
+              valueFrom:
+                fieldRef:
+                  fieldPath: spec.nodeName
+          command:
+            - /bin/bash
+            - -c
+            - |
+              # Add node label to pod
+              NODE_SHORT=$(echo ${NODE_NAME} | cut -d. -f1)
+              kubectl label pod ${POD_NAME} -n ${POD_NAMESPACE} node-name=${NODE_SHORT} --overwrite
       affinity:
         nodeAffinity:
           requiredDuringSchedulingIgnoredDuringExecution:
             nodeSelectorTerms:
             - matchExpressions:
-              - key: xray-node-address
+              - key: xray-public-address
                 operator: Exists
       initContainers:
         - name: init-uuid