-
Notifications
You must be signed in to change notification settings - Fork 23
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Upate K1 Tooling: fix root bash + add ngrok + modify ssh-debug manife…
…st (#117) * fix k1-tooling for root (wrong path for powerline-go) and upgrade k1 to 1.7.2 * refactor ssh debug container and add k1 tooling + NGROK usage docu
- Loading branch information
Showing
9 changed files
with
125 additions
and
32 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,15 +1,20 @@ | ||
| ## SSH Debug Client | ||
|
|
||
| For quickly ssh to nodes in an internal network you could deploy this manifest. | ||
| Create or add your key to the provided [`./secrect.ssh.key.yaml`](./secrect.ssh.key.yaml) file and trigger the deployment: | ||
| Create or add your key to the provided [`./secrect.ssh.files.yaml`](./secrect.ssh.files.yaml) file and trigger the deployment: | ||
|
|
||
| ```bash | ||
| # create ssh secret from id_rsa,id_rsa.pub under `.ssh`folder: | ||
| kubectl create secret generic --from-file ./.ssh/ ssh-key -n default --dry-run -o yaml > ./secrect.ssh.key.yaml | ||
| kubectl create secret generic --from-file ./.ssh/ ssh-files --dry-run -o yaml > ./secrect.ssh.files.yaml | ||
|
|
||
| #deploy manifests | ||
| kubectl apply -f ./ | ||
| #for k1 | ||
| kubectl apply -f ./deployment.ssh.k1.debug.yaml -f ./secrect.ssh.files.yaml | ||
|
|
||
| #alternative | ||
| kubectl apply -f ./deployment.ssh.debug.yaml -f ./secrect.ssh.files.yaml | ||
| ``` | ||
|
|
||
| Use now `kubectl exec -it` to login to container, and connect to the nodes ip's of the kvirt vmi's: | ||
| ```bash | ||
| #at seed cluster | ||
|
|
@@ -18,4 +23,28 @@ kubectl get vmi -A | |
| kubectl exec -it -n default ssh-debug-xx-xxx bash | ||
| # e.g. for ubuntu worker node | ||
| ssh ubuntu@IP-OF-VMI | ||
| ``` | ||
| ``` | ||
|
|
||
| ### Use NGROK Tunnel | ||
|
|
||
| We could NGROK to open an external tunnel to e.g. a secured network to get an SSH Tunnel into the cluster. To get required tokens go to the [NGROK Dashboard > Your Authtoken](https://dashboard.ngrok.com/get-started/your-authtoken) and then create an Edge Gateway [NGROK Dashboard > Edges > New Edge > TCP](https://dashboard.ngrok.com/cloud-edge/edges) | ||
|
|
||
| To setup a ngrok tunnel inside the containers, uncomment the lines at [`deployment.ssh.k1.debug.yaml`](./deployment.ssh.k1.debug.yaml): | ||
| ```yaml | ||
| #Optional: your ngrok command to join | ||
| ngrok config add-authtoken xxxx-YOUR-TOKEN-xxxx | ||
| ngrok tunnel --log stdout --label edge=xxxx-your-edge-label 22 | ||
| ``` | ||
|
|
||
| For the logs, check: | ||
| ```bash | ||
| kubectl logs deployments/ssh-debug-k1-admin -f | ||
| ``` | ||
| Now after the tunnel is up you could use the public IP and ssh into the private cluster network: | ||
| ```bash | ||
| # e.g. your ngrok IP: 8.tcp.eu.ngrok.io:21197 | ||
| ssh -t [email protected] -p 21197 | ||
| ``` | ||
|
|
||
| **NOTE:** The tunnel could get used for other use cases like a https connection. See [Ngrok Docs](https://ngrok.com/docs) | ||
|
|
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,62 @@ | ||
| apiVersion: apps/v1 | ||
| kind: Deployment | ||
| metadata: | ||
| labels: | ||
| app.kubernetes.io/name: ssh-debug-k1-admin | ||
| name: ssh-debug-k1-admin | ||
| spec: | ||
| strategy: | ||
| type: Recreate | ||
| replicas: 1 | ||
| selector: | ||
| matchLabels: | ||
| app.kubernetes.io/name: ssh-debug-k1-admin | ||
| template: | ||
| metadata: | ||
| labels: | ||
| app.kubernetes.io/name: ssh-debug-k1-admin | ||
| spec: | ||
| terminationGracePeriodSeconds: 0 | ||
| containers: | ||
| - args: | ||
| - /bin/bash | ||
| - -c | ||
| - | | ||
| mkdir -p /root/.ssh | ||
| ls -lah /tmp/.ssh | ||
| cp /tmp/.ssh/* /root/.ssh/ | ||
| chmod 0600 /root/.ssh/* | ||
| ls -lah /root/.ssh | ||
| service ssh restart | ||
| #Optional: your ngrok command to join | ||
| #ngrok config add-authtoken xxxx-YOUR-TOKEN-xxxx | ||
| #ngrok tunnel --log stdout --label edge=xxxx-your-edge-label 22 | ||
| image: quay.io/kubermatic-labs/kubeone-tooling:1.7.2-2024-02-14 | ||
| name: k1-admin | ||
| stdin: true | ||
| stdinOnce: true | ||
| tty: true | ||
| readinessProbe: | ||
| tcpSocket: | ||
| port: 22 | ||
| securityContext: | ||
| runAsNonRoot: false | ||
| runAsUser: 0 | ||
| volumeMounts: | ||
| - mountPath: /tmp/.ssh | ||
| name: ssh-files | ||
| tolerations: | ||
| - effect: NoExecute | ||
| key: node.kubernetes.io/not-ready | ||
| operator: Exists | ||
| tolerationSeconds: 300 | ||
| - effect: NoExecute | ||
| key: node.kubernetes.io/unreachable | ||
| operator: Exists | ||
| tolerationSeconds: 300 | ||
| volumes: | ||
| - name: ssh-files | ||
| secret: | ||
| secretName: ssh-files | ||
|
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,11 @@ | ||
| apiVersion: v1 | ||
| kind: Secret | ||
| metadata: | ||
| name: ssh-files | ||
| stringData: | ||
| # id_rsa: | | ||
| #TODO-PRIVATE-SSH-KEY | ||
| # id_rsa.pub: | | ||
| #TODO--PUBLIC-SSH-KEY | ||
| authorized_keys: |- | ||
| # add your ssh public-key |
This file was deleted.
Oops, something went wrong.