mirror of
https://github.com/edgelesssys/constellation.git
synced 2024-12-18 12:24:32 -05:00
473001be55
* vpn: ship our own container image The container image used in the VPN chart should be reproducible and stable. We're sticking close to the original nixery.dev version by building the image with nix ourselves, and then publishing the single layer from the result with Bazel OCI rules. The resulting image should be handled similar to s3proxy: it's built as a part of the Constellation release process and then consumed from a Helm chart in our registry. Co-authored-by: Malte Poll <1780588+malt3@users.noreply.github.com>
49 lines
1.4 KiB
Bash
Executable File
49 lines
1.4 KiB
Bash
Executable File
#!/bin/sh
|
|
|
|
set -u
|
|
|
|
signaled() {
|
|
exit 143
|
|
}
|
|
|
|
trap signaled INT TERM
|
|
|
|
all_ips() {
|
|
kubectl get pods "${VPN_FRONTEND_POD}" -o go-template --template '{{ range .status.podIPs }}{{ printf "%s " .ip }}{{ end }}'
|
|
echo "${VPN_PEER_CIDRS}"
|
|
}
|
|
|
|
cep_patch() {
|
|
for ip in $(all_ips); do printf '{"ipv4": "%s"}' "${ip}"; done | jq -s -c -j |
|
|
jq '[{op: "replace", path: "/status/networking/addressing", value: . }]'
|
|
}
|
|
|
|
# Format the space-separated CIDRs into a JSON array.
|
|
vpn_cidrs=$(for ip in ${VPN_PEER_CIDRS}; do printf '"%s" ' "${ip}"; done | jq -s -c -j)
|
|
|
|
masq_patch() {
|
|
kubectl -n kube-system get configmap ip-masq-agent -o json |
|
|
jq -r .data.config |
|
|
jq "{ masqLinkLocal: .masqLinkLocal, nonMasqueradeCIDRs: ((.nonMasqueradeCIDRs - ${vpn_cidrs}) + ${vpn_cidrs}) }" |
|
|
jq '@json | [{op: "replace", path: "/data/config", value: . }]'
|
|
}
|
|
|
|
reconcile_masq() {
|
|
if ! kubectl -n kube-system get configmap ip-masq-agent > /dev/null; then
|
|
# We don't know enough to create an ip-masq-agent.
|
|
return 0
|
|
fi
|
|
|
|
kubectl -n kube-system patch configmap ip-masq-agent --type json --patch "$(masq_patch)" > /dev/null
|
|
}
|
|
|
|
while true; do
|
|
# Reconcile CiliumEndpoint to advertise VPN CIDRs.
|
|
kubectl patch ciliumendpoint "${VPN_FRONTEND_POD}" --type json --patch "$(cep_patch)" > /dev/null
|
|
|
|
# Reconcile ip-masq-agent configuration to exclude VPN traffic.
|
|
reconcile_masq
|
|
|
|
sleep 10
|
|
done
|