Skip to content

Commit bc428f7

Browse files
nefelim4agnefelim4ag
committed
feat(chart): store ssh keys in k8s secrets
1 parent 2bf1af0 commit bc428f7

File tree

7 files changed

+116
-41
lines changed

7 files changed

+116
-41
lines changed

‎charts/k8s-ssh-bastion/Chart.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
apiVersion: v1
2-
appVersion: 0.4.0
2+
appVersion: 0.4.1
33
description: A Helm chart for k8s bastion
44
name: k8s-ssh-bastion
5-
version: 0.4.0
5+
version: 0.5.0

‎charts/k8s-ssh-bastion/templates/deployment.yaml‎

Lines changed: 48 additions & 37 deletions
Original file line numberDiff line numberDiff line change
@@ -23,18 +23,11 @@ spec:
2323
- /bin/bash
2424
- -ec
2525
- |
26-
for file in /etc/ssh_origin/*; do
27-
NAME=$(basename $file)
28-
install -Dm0600 /etc/ssh_origin/$NAME /etc/ssh/$NAME
29-
done
30-
3126
cd /etc/ssh
32-
for key_type in dsa rsa ecdsa ed25519; do
33-
lengh=4096
34-
[ $key_type == "dsa" ] && lengh=1024
35-
[ $key_type == "ecdsa" ] && lengh=256
36-
test -f ssh_host_${key_type}_key || \
37-
ssh-keygen -q -N "" -t ${key_type} -b $lengh -f ./ssh_host_${key_type}_key
27+
for ssh_key in /etc/ssh/ssh_host_*_key; do
28+
if [ ! -f ${ssh_key}.pub ]; then
29+
ssh-keygen -y -f ${ssh_key} > ${ssh_key}.pub
30+
fi
3831
done
3932
4033
USER_UID=1000
@@ -56,21 +49,39 @@ spec:
5649
5750
/usr/sbin/sshd -D -e -E /proc/1/fd/1
5851
lifecycle: {{ .Values.lifecycle | toJson }}
52+
resources: {{ .Values.resources | toJson }}
5953
ports:
6054
- name: ssh
6155
containerPort: 1022
6256
protocol: TCP
6357
volumeMounts:
6458
- name: config-volume
6559
mountPath: /etc/users
66-
- name: sshd-configs-persistent
67-
mountPath: /etc/ssh
68-
- name: sshd-configs-origin
69-
mountPath: /etc/ssh_origin
7060
- name: usr-share-initscripts
7161
mountPath: /usr/share/initscripts
72-
resources:
73-
{{ toYaml .Values.resources | indent 12 }}
62+
{{- range $key, $value := .Values.ssh }}
63+
- name: sshd-configs
64+
mountPath: /etc/ssh/{{ $key }}
65+
subPath: {{ $key }}
66+
{{- end }}
67+
- name: {{ .Release.Name }}-rsa
68+
mountPath: /etc/ssh/ssh_host_rsa_key
69+
subPath: ssh_host_rsa_key
70+
- name: {{ .Release.Name }}-ecdsa
71+
mountPath: /etc/ssh/ssh_host_ecdsa_key
72+
subPath: ssh_host_ecdsa_key
73+
- name: {{ .Release.Name }}-ed25519
74+
mountPath: /etc/ssh/ssh_host_ed25519_key
75+
subPath: ssh_host_ed25519_key
76+
- name: {{ .Release.Name }}-rsa
77+
mountPath: /etc/ssh/ssh_host_rsa_key.pub
78+
subPath: ssh_host_rsa_key.pub
79+
- name: {{ .Release.Name }}-ecdsa
80+
mountPath: /etc/ssh/ssh_host_ecdsa_key.pub
81+
subPath: ssh_host_ecdsa_key.pub
82+
- name: {{ .Release.Name }}-ed25519
83+
mountPath: /etc/ssh/ssh_host_ed25519_key.pub
84+
subPath: ssh_host_ed25519_key.pub
7485
hostNetwork: {{ .Values.hostNetwork }}
7586
{{- with .Values.dnsConfig }}
7687
dnsConfig: {{ . | toJson }}
@@ -86,16 +97,30 @@ spec:
8697
- name: config-volume
8798
configMap:
8899
name: {{ .Release.Name }}
89-
- name: sshd-configs-persistent
90-
persistentVolumeClaim:
91-
claimName: {{ .Release.Name }}-etc-ssh
92-
- name: sshd-configs-origin
100+
- name: sshd-configs
93101
configMap:
94-
name: {{ .Release.Name }}-etc-ssh-origin
102+
name: {{ .Release.Name }}-etc-ssh
103+
defaultMode: 0600
95104
- name: usr-share-initscripts
96105
configMap:
97106
name: {{ .Release.Name }}-usr-share-initscripts
98107
defaultMode: 0755
108+
- name: {{ .Release.Name }}-dsa
109+
secret:
110+
secretName: {{ .Release.Name }}-dsa
111+
defaultMode: 0600
112+
- name: {{ .Release.Name }}-rsa
113+
secret:
114+
secretName: {{ .Release.Name }}-rsa
115+
defaultMode: 0600
116+
- name: {{ .Release.Name }}-ecdsa
117+
secret:
118+
secretName: {{ .Release.Name }}-ecdsa
119+
defaultMode: 0600
120+
- name: {{ .Release.Name }}-ed25519
121+
secret:
122+
secretName: {{ .Release.Name }}-ed25519
123+
defaultMode: 0600
99124
---
100125
apiVersion: v1
101126
kind: ConfigMap
@@ -108,7 +133,7 @@ data:
108133
apiVersion: v1
109134
kind: ConfigMap
110135
metadata:
111-
name: {{ .Release.Name }}-etc-ssh-origin
136+
name: {{ .Release.Name }}-etc-ssh
112137
data:
113138
{{ tpl (toYaml .Values.ssh) $ | indent 2 }}
114139

@@ -120,17 +145,3 @@ metadata:
120145
name: {{ .Release.Name }}-usr-share-initscripts
121146
data:
122147
{{ tpl (toYaml .Values.initscripts) $ | indent 2 }}
123-
124-
---
125-
# Used to store ssh host keys & other stuff
126-
apiVersion: v1
127-
kind: PersistentVolumeClaim
128-
metadata:
129-
name: {{ .Release.Name }}-etc-ssh
130-
spec:
131-
storageClassName: "{{ .Values.storageClass }}" # Empty string must be explicitly set otherwise default StorageClass will be set
132-
accessModes:
133-
- ReadWriteMany
134-
resources:
135-
requests:
136-
storage: 1Gi

‎charts/k8s-ssh-bastion/templates/jobs.yaml‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
apiVersion: batch/v1
2+
kind: Job
3+
metadata:
4+
name: "{{ .Release.Name }}-{{ .Release.Revision }}"
5+
spec:
6+
ttlSecondsAfterFinished: 300
7+
template:
8+
spec:
9+
serviceAccountName: {{ .Release.Name }}
10+
containers:
11+
- name: ssh-keygen
12+
image: "{{ .Values.image.repository }}:{{ tpl .Values.image.tag $ }}"
13+
imagePullPolicy: {{ .Values.image.pullPolicy }}
14+
command:
15+
- /bin/bash
16+
- -ec
17+
- |
18+
cd /etc/ssh
19+
for key_type in rsa ecdsa ed25519; do
20+
if kubectl -n k8s-bastion get secrets {{ .Release.Name }}-${key_type} -o name; then
21+
continue
22+
fi
23+
lengh=4096
24+
[ $key_type == "ecdsa" ] && lengh=256
25+
test -f ssh_host_${key_type}_key || \
26+
ssh-keygen -q -N "" -t ${key_type} -b $lengh -f ./ssh_host_${key_type}_key
27+
kubectl create secret generic {{ .Release.Name }}-${key_type} \
28+
--from-file=ssh_host_${key_type}_key=./ssh_host_${key_type}_key \
29+
--from-file=ssh_host_${key_type}_key.pub=./ssh_host_${key_type}_key.pub
30+
done
31+
volumeMounts:
32+
- name: opt
33+
mountPath: /etc/ssh
34+
volumes:
35+
- name: opt
36+
emptyDir: {}
37+
restartPolicy: Never
38+
backoffLimit: 4

‎charts/k8s-ssh-bastion/templates/role-binding.yaml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
apiVersion: rbac.authorization.k8s.io/v1
2+
kind: RoleBinding
3+
metadata:
4+
name: {{ .Release.Name }}
5+
subjects:
6+
- kind: ServiceAccount
7+
name: {{ .Release.Name }}
8+
namespace: {{ .Release.Namespace }}
9+
roleRef:
10+
apiGroup: rbac.authorization.k8s.io
11+
kind: Role
12+
name: {{ .Release.Name }}

‎charts/k8s-ssh-bastion/templates/role.yaml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
apiVersion: rbac.authorization.k8s.io/v1
2+
kind: Role
3+
metadata:
4+
name: {{ .Release.Name }}
5+
rules:
6+
- verbs:
7+
- create
8+
- get
9+
apiGroups:
10+
- ''
11+
resources:
12+
- secrets

‎charts/k8s-ssh-bastion/templates/service-account.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
apiVersion: v1
2+
kind: ServiceAccount
3+
metadata:
4+
name: {{ .Release.Name }}

‎charts/k8s-ssh-bastion/values.yaml‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -54,8 +54,6 @@ topologySpreadConstraints:
5454
matchLabels:
5555
app.kubernetes.io/instance: "{{ .Release.Name }}"
5656

57-
storageClass: "efs"
58-
5957
initscripts: {}
6058
# install-tools.sh: |
6159
# #!/bin/bash

0 commit comments

Comments
 (0)