104 lines
2.7 KiB
YAML
104 lines
2.7 KiB
YAML
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: ssh-reverse-tunnel
|
|
spec:
|
|
replicas: 1
|
|
selector:
|
|
matchLabels:
|
|
app: ssh-reverse-tunnel
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: ssh-reverse-tunnel
|
|
spec:
|
|
imagePullSecrets:
|
|
- name: regcred
|
|
volumes:
|
|
- name: ssh-writable
|
|
emptyDir: {}
|
|
- name: ssh-key
|
|
secret:
|
|
secretName: ssh-id-rsa
|
|
items:
|
|
- key: id_rsa
|
|
path: id_rsa
|
|
containers:
|
|
- name: tunnel
|
|
image: registry.spiritofweb.ru/ssh-tunnel:2
|
|
ports:
|
|
- name: socks5-tcp
|
|
containerPort: 1080
|
|
protocol: TCP
|
|
- name: mongo-tcp
|
|
containerPort: 27017
|
|
protocol: TCP
|
|
env:
|
|
- name: REMOTE_USER
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: ssh-creds
|
|
key: username
|
|
- name: REMOTE_HOST
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: ssh-creds
|
|
key: remote_host
|
|
command: ["/bin/sh", "-c"]
|
|
args:
|
|
- |
|
|
set -eu
|
|
|
|
mkdir -p /root/.ssh
|
|
printf "Host *\n StrictHostKeyChecking no\n UserKnownHostsFile /dev/null\n" > /root/.ssh/config
|
|
chmod 600 /root/.ssh/config
|
|
|
|
cp /tmp/ssh-id/id_rsa /root/.ssh/id_rsa
|
|
chmod 600 /root/.ssh/id_rsa
|
|
|
|
exec autossh -M 0 -N \
|
|
-o "ServerAliveInterval=30" \
|
|
-o "ExitOnForwardFailure=yes" \
|
|
-o "StrictHostKeyChecking=no" \
|
|
-o "UserKnownHostsFile=/dev/null" \
|
|
-i /root/.ssh/id_rsa \
|
|
-R 30080:kultmost-api.kultmost:80 \
|
|
-L :6379:localhost:6379 \
|
|
-L :27017:localhost:27017 \
|
|
-R 30300:10.1.77.0:30300 \
|
|
"${REMOTE_USER}@${REMOTE_HOST}"
|
|
volumeMounts:
|
|
- name: ssh-writable
|
|
mountPath: /root/.ssh
|
|
- name: ssh-key
|
|
mountPath: /tmp/ssh-id
|
|
readOnly: true
|
|
resources:
|
|
limits:
|
|
cpu: "100m"
|
|
memory: "128Mi"
|
|
restartPolicy: Always
|
|
---
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: kultmost-ssh
|
|
namespace: kultmost
|
|
spec:
|
|
selector:
|
|
app: ssh-reverse-tunnel
|
|
ports:
|
|
- name: mongo-tcp
|
|
protocol: TCP
|
|
port: 27017
|
|
targetPort: 27017
|
|
- name: redis-tcp
|
|
protocol: TCP
|
|
port: 6379
|
|
targetPort: 6379
|
|
- name: socks5-tcp
|
|
protocol: TCP
|
|
port: 1080
|
|
targetPort: 1080
|
|
type: ClusterIP
|