sshd-jumpserver.yaml

{{- if .Values.gitAuth.enabled }}
---
apiVersion: v1
kind: Service
metadata:
  name: {{ .Release.Name }}-jumpserver
  {{- if .Values.gitAuth.annotations }}
  annotations:
  {{- range $key, $value := .Values.gitAuth.annotations }}
    {{ $key }}: {{ $value | quote }}
  {{- end }}
  {{- end }}
spec:
  ports:
    - name: ssh
      port: {{ .Values.gitAuth.port }}
      {{- if eq .Values.gitAuth.mode "bridge" }}
      targetPort: 9022
      {{- else }}
      targetPort: 22
      {{- end }}
      
  type: "LoadBalancer"
  externalTrafficPolicy: {{ .Values.gitAuth.externalTrafficPolicy }}
  internalTrafficPolicy: Cluster
{{- if .Values.gitAuth.loadBalancerIP }}
  loadBalancerIP: {{ .Values.gitAuth.loadBalancerIP }}
{{- end }}
{{- if .Values.gitAuth.allowedIps }}
  loadBalancerSourceRanges:
    {{- .Values.gitAuth.allowedIps | toYaml | nindent 2 -}}
{{- end }}
  selector:
    name: {{ .Release.Name }}-jumpserver

---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: {{ .Release.Name }}-jumpserver
spec:
  replicas: {{ .Values.gitAuth.replicas }}
  selector:
    matchLabels:
      name: {{ .Release.Name }}-jumpserver
  template:
    metadata:
      labels:
        name: {{ .Release.Name }}-jumpserver
      annotations:
        configMap-checksum: {{ include (print $.Template.BasePath "/sshd-jumpserver-cm.yaml") . | sha256sum }}
    spec:
      enableServiceLinks: false
      containers:
      - name: {{ .Release.Name }}-jumpserver
        image: {{ .Values.gitAuth.image }}:{{ .Values.gitAuth.imageTag }}
        imagePullPolicy: Always
        ports:
          {{- if eq .Values.gitAuth.mode "bridge" }}
          - containerPort: 9022
            protocol: TCP
          {{- else }}
          - containerPort: 22
          {{- end }}
          
        env:
          {{- if eq .Values.gitAuth.mode "bridge" }}
          - name: HOST_KEY_PATH
            value: {{ .Values.gitAuth.hostKeyPath | quote }}
          - name: AUTHORIZED_KEYS_PATH
            value: /app/authorized_keys
          - name: PORT
            value: "9022"
          {{- end }}
          {{- if .Values.gitAuth.keyserver.enabled }}
          - name: GITAUTH_URL
            value: {{ .Values.gitAuth.keyserver.url | default (printf "https://keys.%s/api/1/git-ssh-keys" .Values.clusterDomain) | quote }}
          - name: GITAUTH_USERNAME
            value: {{ .Values.gitAuth.keyserver.username | default .Values.sshKeyServer.apiUsername | quote }}
          - name: GITAUTH_PASSWORD
            value: {{ .Values.gitAuth.keyserver.password | default .Values.sshKeyServer.apiPassword | quote }}
          - name: GITAUTH_SCOPE
            value: {{ .Values.gitAuth.scope | quote }}
          - name: OUTSIDE_COLLABORATORS
            value: {{ .Values.gitAuth.outsideCollaborators | default true | quote }}
          {{- end }}
        volumeMounts:
        {{- if eq .Values.gitAuth.mode "bridge" }}
        - mountPath: /app/keys
          name: shell-keys
        - mountPath: /app/authorized_keys
          name: sshd-jumphost-configmap
          readOnly: true
          subPath: authorizedKeys
        - mountPath: /app/recordings
          name: recordings
        {{- else }}
        - name: shell-keys
          mountPath: /etc/ssh/keys
        - name: sshd-jumphost-configmap
          mountPath: /etc/ssh/authorized_keys
          subPath: authorizedKeys
          readOnly: true
        {{- end }}
        resources:
          {{- .Values.gitAuth.resources | toYaml | nindent 10 }}
      volumes:
      - name: shell-keys
        persistentVolumeClaim:
          claimName: {{ .Release.Name }}-shell-key
      - name: sshd-jumphost-configmap
        configMap:
          name: {{ .Release.Name }}-sshd-jumphost
      {{- if eq .Values.gitAuth.mode "bridge" }}
      - name: recordings
        persistentVolumeClaim:
          claimName: {{ .Release.Name }}-shell-recordings
      {{- end }}
      {{- if eq .Values.gitAuth.mode "bridge" }}
      serviceAccountName: {{ .Release.Name }}-sshbridge
      {{- end }}
---

apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: {{ .Release.Name }}-shell-key
  labels:
    name: {{ .Release.Name }}-jumpserver
  annotations:
    storage.silta/storage-path: jumpserver
    csi-rclone/umask: "077"
spec:
  {{- if .Values.gitAuth.persistence.storageClassName }}
  storageClassName: {{ .Values.gitAuth.persistence.storageClassName }}
  {{- end }}
  accessModes:
    - {{ .Values.gitAuth.persistence.accessMode }}
  resources:
    requests:
      storage: {{ .Values.gitAuth.persistence.size }}
{{- end }}

{{- if eq .Values.gitAuth.mode "bridge" }}
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  annotations:
    storage.silta/storage-path: shell-recordings
  name: {{ .Release.Name }}-shell-recordings
spec:
  accessModes:
  - {{ .Values.gitAuth.recordings.persistence.accessMode }}
  resources:
    requests:
      storage: {{ .Values.gitAuth.recordings.persistence.size }}
  storageClassName: {{ .Values.gitAuth.recordings.persistence.storageClassName }}
---

apiVersion: v1
kind: ServiceAccount
metadata:
  name: {{ .Release.Name }}-sshbridge
---

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: {{ .Release.Name }}-sshbridge
# allow exec into pods
rules:
- apiGroups:
  - ""
  resources:
  - pods/exec
  verbs:
  - create
  - delete
  - get
  - list
  - watch
- apiGroups:
  - ""
  resources:
  - pods
  verbs:
  - get
  - list
  - watch
# allow endpoint and endpoinslice list for service endpoint discovery
- apiGroups:
  - ""
  resources:
  - endpoints
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - discovery.k8s.io
  resources:
  - endpointslices
  verbs:
  - get
  - list
  - watch
---

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: {{ .Release.Name }}-sshbridge
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: {{ .Release.Name }}-sshbridge
subjects:
- kind: ServiceAccount
  name: {{ .Release.Name }}-sshbridge
  namespace: {{ .Release.Namespace }}
{{- end }}