Compare commits
1 Commits
auto-updat
...
auto-updat
| Author | SHA1 | Date | |
|---|---|---|---|
|
|
a24c506322 |
@@ -23,48 +23,8 @@ spec:
|
|||||||
- matchExpressions:
|
- matchExpressions:
|
||||||
- key: mtproxy
|
- key: mtproxy
|
||||||
operator: Exists
|
operator: Exists
|
||||||
serviceAccountName: mtproxy
|
|
||||||
hostNetwork: true
|
hostNetwork: true
|
||||||
dnsPolicy: ClusterFirstWithHostNet
|
dnsPolicy: ClusterFirstWithHostNet
|
||||||
initContainers:
|
|
||||||
- name: register-proxy
|
|
||||||
image: bitnami/kubectl:latest
|
|
||||||
env:
|
|
||||||
- name: NODE_NAME
|
|
||||||
valueFrom:
|
|
||||||
fieldRef:
|
|
||||||
fieldPath: spec.nodeName
|
|
||||||
- name: SECRET
|
|
||||||
valueFrom:
|
|
||||||
secretKeyRef:
|
|
||||||
name: tgproxy-secret
|
|
||||||
key: SECRET
|
|
||||||
- name: PORT
|
|
||||||
valueFrom:
|
|
||||||
secretKeyRef:
|
|
||||||
name: tgproxy-secret
|
|
||||||
key: PORT
|
|
||||||
command:
|
|
||||||
- /bin/bash
|
|
||||||
- -c
|
|
||||||
- |
|
|
||||||
set -e
|
|
||||||
NAMESPACE=$(cat /var/run/secrets/kubernetes.io/serviceaccount/namespace)
|
|
||||||
SERVER=$(kubectl get node "${NODE_NAME}" -o jsonpath='{.metadata.labels.mtproxy}')
|
|
||||||
if [ -z "${SERVER}" ]; then
|
|
||||||
echo "ERROR: node ${NODE_NAME} has no mtproxy label"
|
|
||||||
exit 1
|
|
||||||
fi
|
|
||||||
LINK="tg://proxy?server=${SERVER}&port=${PORT}&secret=${SECRET}"
|
|
||||||
echo "Registering: ${SERVER} -> ${LINK}"
|
|
||||||
if kubectl get secret mtproxy-links -n "${NAMESPACE}" &>/dev/null; then
|
|
||||||
kubectl patch secret mtproxy-links -n "${NAMESPACE}" \
|
|
||||||
--type merge -p "{\"stringData\":{\"${SERVER}\":\"${LINK}\"}}"
|
|
||||||
else
|
|
||||||
kubectl create secret generic mtproxy-links -n "${NAMESPACE}" \
|
|
||||||
--from-literal="${SERVER}=${LINK}"
|
|
||||||
fi
|
|
||||||
echo "Done"
|
|
||||||
containers:
|
containers:
|
||||||
- name: mtproxy
|
- name: mtproxy
|
||||||
image: ultradesu/mtproxy:v0.02
|
image: ultradesu/mtproxy:v0.02
|
||||||
|
|||||||
@@ -12,7 +12,7 @@ spec:
|
|||||||
data:
|
data:
|
||||||
SECRET: |-
|
SECRET: |-
|
||||||
{{ .secret }}
|
{{ .secret }}
|
||||||
PORT: "30443"
|
PORT: 30443
|
||||||
data:
|
data:
|
||||||
- secretKey: secret
|
- secretKey: secret
|
||||||
sourceRef:
|
sourceRef:
|
||||||
|
|||||||
@@ -3,7 +3,6 @@ kind: Kustomization
|
|||||||
|
|
||||||
resources:
|
resources:
|
||||||
- ./app.yaml
|
- ./app.yaml
|
||||||
- ./rbac.yaml
|
|
||||||
- ./daemonset.yaml
|
- ./daemonset.yaml
|
||||||
- ./external-secrets.yaml
|
- ./external-secrets.yaml
|
||||||
# - ./storage.yaml
|
# - ./storage.yaml
|
||||||
|
|||||||
@@ -1,58 +0,0 @@
|
|||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: ServiceAccount
|
|
||||||
metadata:
|
|
||||||
name: mtproxy
|
|
||||||
labels:
|
|
||||||
app: mtproxy
|
|
||||||
---
|
|
||||||
apiVersion: rbac.authorization.k8s.io/v1
|
|
||||||
kind: ClusterRole
|
|
||||||
metadata:
|
|
||||||
name: mtproxy-node-reader
|
|
||||||
labels:
|
|
||||||
app: mtproxy
|
|
||||||
rules:
|
|
||||||
- apiGroups: [""]
|
|
||||||
resources: ["nodes"]
|
|
||||||
verbs: ["get", "list"]
|
|
||||||
---
|
|
||||||
apiVersion: rbac.authorization.k8s.io/v1
|
|
||||||
kind: ClusterRoleBinding
|
|
||||||
metadata:
|
|
||||||
name: mtproxy-node-reader
|
|
||||||
labels:
|
|
||||||
app: mtproxy
|
|
||||||
roleRef:
|
|
||||||
apiGroup: rbac.authorization.k8s.io
|
|
||||||
kind: ClusterRole
|
|
||||||
name: mtproxy-node-reader
|
|
||||||
subjects:
|
|
||||||
- kind: ServiceAccount
|
|
||||||
name: mtproxy
|
|
||||||
namespace: mtproxy
|
|
||||||
---
|
|
||||||
apiVersion: rbac.authorization.k8s.io/v1
|
|
||||||
kind: Role
|
|
||||||
metadata:
|
|
||||||
name: mtproxy-secret-manager
|
|
||||||
labels:
|
|
||||||
app: mtproxy
|
|
||||||
rules:
|
|
||||||
- apiGroups: [""]
|
|
||||||
resources: ["secrets"]
|
|
||||||
verbs: ["get", "create", "patch"]
|
|
||||||
---
|
|
||||||
apiVersion: rbac.authorization.k8s.io/v1
|
|
||||||
kind: RoleBinding
|
|
||||||
metadata:
|
|
||||||
name: mtproxy-secret-manager
|
|
||||||
labels:
|
|
||||||
app: mtproxy
|
|
||||||
roleRef:
|
|
||||||
apiGroup: rbac.authorization.k8s.io
|
|
||||||
kind: Role
|
|
||||||
name: mtproxy-secret-manager
|
|
||||||
subjects:
|
|
||||||
- kind: ServiceAccount
|
|
||||||
name: mtproxy
|
|
||||||
Reference in New Issue
Block a user