Added Kubernetes TLS
This commit is contained in:
Joao Gilberto Magalhaes
parent
60bf71f6fb
commit
912be51399
5 changed files with 147 additions and 35 deletions
|
|
@ -95,6 +95,12 @@ class Functions:
|
|||
Functions.log(source, Functions.ERROR, "%s" % (e))
|
||||
|
||||
|
||||
class Consts:
|
||||
easyhaproxy_config = "/etc/haproxy/easyconfig.yml"
|
||||
haproxy_config = "/etc/haproxy/haproxy.cfg"
|
||||
certs_letsencrypt = "/certs/letsencrypt"
|
||||
certs_haproxy = "/certs/haproxy"
|
||||
|
||||
class DaemonizeHAProxy:
|
||||
def __init__(self):
|
||||
self.process = None
|
||||
|
|
|
|||
21
src/main.py
21
src/main.py
|
|
@ -1,24 +1,19 @@
|
|||
from functions import Functions, DaemonizeHAProxy, Certbot
|
||||
from functions import Functions, DaemonizeHAProxy, Certbot, Consts
|
||||
from processor import ProcessorInterface
|
||||
import os
|
||||
import time
|
||||
from deepdiff import DeepDiff
|
||||
|
||||
easyhaproxy_config = "/etc/haproxy/easyconfig.yml"
|
||||
haproxy_config = "/etc/haproxy/haproxy.cfg"
|
||||
certs_letsencrypt = "/certs/letsencrypt"
|
||||
certs_haproxy = "/certs/haproxy"
|
||||
|
||||
def start():
|
||||
processor_obj = ProcessorInterface.factory(os.getenv("EASYHAPROXY_DISCOVER"))
|
||||
if processor_obj is None:
|
||||
exit(1)
|
||||
|
||||
os.makedirs(certs_letsencrypt, exist_ok=True)
|
||||
os.makedirs(certs_haproxy, exist_ok=True)
|
||||
os.makedirs(Consts.certs_letsencrypt, exist_ok=True)
|
||||
os.makedirs(Consts.certs_haproxy, exist_ok=True)
|
||||
|
||||
processor_obj.save_config(haproxy_config)
|
||||
processor_obj.save_certs(certs_haproxy)
|
||||
processor_obj.save_config(Consts.haproxy_config)
|
||||
processor_obj.save_certs(Consts.certs_haproxy)
|
||||
letsencrypt_certs_found = processor_obj.get_letsencrypt_hosts()
|
||||
Functions.log(Functions.EASYHAPROXY_LOG, Functions.DEBUG, 'Found hosts: %s' % ", ".join(processor_obj.get_hosts())) # Needs to after save_config
|
||||
|
||||
|
|
@ -26,7 +21,7 @@ def start():
|
|||
haproxy = DaemonizeHAProxy()
|
||||
haproxy.haproxy("start")
|
||||
|
||||
certbot = Certbot(certs_letsencrypt, os.getenv("EASYHAPROXY_LETSENCRYPT_EMAIL"))
|
||||
certbot = Certbot(Consts.certs_letsencrypt, os.getenv("EASYHAPROXY_LETSENCRYPT_EMAIL"))
|
||||
|
||||
while True:
|
||||
time.sleep(10)
|
||||
|
|
@ -38,8 +33,8 @@ def start():
|
|||
processor_obj.refresh()
|
||||
if DeepDiff(old_parsed, processor_obj.get_parsed_object()) != {} or not haproxy.is_alive():
|
||||
Functions.log(Functions.EASYHAPROXY_LOG, Functions.DEBUG, 'New configuration found. Reloading...')
|
||||
processor_obj.save_config(haproxy_config)
|
||||
processor_obj.save_certs(certs_haproxy)
|
||||
processor_obj.save_config(Consts.haproxy_config)
|
||||
processor_obj.save_certs(Consts.certs_haproxy)
|
||||
letsencrypt_certs_found = processor_obj.get_letsencrypt_hosts()
|
||||
Functions.log(Functions.EASYHAPROXY_LOG, Functions.DEBUG, 'Found hosts: %s' % ", ".join(processor_obj.get_hosts())) # Needs to after save_config
|
||||
old_haproxy = haproxy
|
||||
|
|
|
|||
|
|
@ -1,9 +1,10 @@
|
|||
from easymapping import HaproxyConfigGenerator
|
||||
from functions import Functions
|
||||
from functions import Functions, Consts
|
||||
import yaml
|
||||
import sys
|
||||
import os
|
||||
import json
|
||||
import base64
|
||||
import docker
|
||||
from kubernetes import client, config
|
||||
from kubernetes.client.rest import ApiException
|
||||
|
|
@ -131,8 +132,10 @@ class Swarm(ProcessorInterface):
|
|||
class Kubernetes(ProcessorInterface):
|
||||
def __init__(self, filename = None):
|
||||
config.load_incluster_config()
|
||||
#config.verify_ssl=False
|
||||
self.api_instance = client.CoreV1Api()
|
||||
self.v1 = client.NetworkingV1Api()
|
||||
self.cert_cache = {}
|
||||
super().__init__()
|
||||
|
||||
def _check_annotation(self, annotations, key):
|
||||
|
|
@ -145,36 +148,58 @@ class Kubernetes(ProcessorInterface):
|
|||
ret = self.v1.list_ingress_for_all_namespaces(watch=False)
|
||||
|
||||
self.parsed_object = {}
|
||||
for i in ret.items:
|
||||
if i.metadata.annotations['kubernetes.io/ingress.class'] != "easyhaproxy-ingress":
|
||||
for ingress in ret.items:
|
||||
if ingress.metadata.annotations['kubernetes.io/ingress.class'] != "easyhaproxy-ingress":
|
||||
continue
|
||||
|
||||
letsencrypt = self._check_annotation(i.metadata.annotations, "easyhaproxy.letsencrypt")
|
||||
redirect_ssl = self._check_annotation(i.metadata.annotations, "easyhaproxy.redirect_ssl")
|
||||
redirect = self._check_annotation(i.metadata.annotations, "easyhaproxy.redirect")
|
||||
ssl_hosts = []
|
||||
|
||||
letsencrypt = self._check_annotation(ingress.metadata.annotations, "easyhaproxy.letsencrypt")
|
||||
redirect_ssl = self._check_annotation(ingress.metadata.annotations, "easyhaproxy.redirect_ssl")
|
||||
redirect = self._check_annotation(ingress.metadata.annotations, "easyhaproxy.redirect")
|
||||
|
||||
data = {}
|
||||
#ingress_name = i.metadata.name
|
||||
data["creation_timestamp"] = i.metadata.creation_timestamp.strftime("%x %X")
|
||||
data["resource_version"] = i.metadata.resource_version
|
||||
data["namespace"] = i.metadata.namespace
|
||||
for rule in i.spec.rules:
|
||||
data["creation_timestamp"] = ingress.metadata.creation_timestamp.strftime("%x %X")
|
||||
data["resource_version"] = ingress.metadata.resource_version
|
||||
data["namespace"] = ingress.metadata.namespace
|
||||
|
||||
if ingress.spec.tls is not None:
|
||||
for tls in ingress.spec.tls:
|
||||
try:
|
||||
secret = self.api_instance.read_namespaced_secret(tls.secret_name, ingress.metadata.namespace)
|
||||
if "tls.crt" not in secret.data or "tls.key" not in secret.data:
|
||||
continue
|
||||
|
||||
if tls.secret_name not in self.cert_cache or self.cert_cache[tls.secret_name] != secret.data:
|
||||
self.cert_cache[tls.secret_name] = secret.data
|
||||
Functions.save(
|
||||
"{0}/{1}.pem".format(Consts.certs_haproxy, tls.secret_name),
|
||||
base64.b64decode(secret.data["tls.crt"]).decode('ascii') + "\n" + base64.b64decode(secret.data["tls.key"]).decode('ascii')
|
||||
)
|
||||
|
||||
ssl_hosts.extend(tls.hosts)
|
||||
except Exception as e:
|
||||
pass
|
||||
|
||||
for rule in ingress.spec.rules:
|
||||
rule_data = {}
|
||||
port_number = rule.http.paths[0].backend.service.port.number
|
||||
definition = rule.host.replace(".", "-")
|
||||
rule_data["easyhaproxy.%s_%s.host" % (definition, port_number)] = rule.host
|
||||
rule_data["easyhaproxy.%s_%s.port" % (definition, port_number)] = "80"
|
||||
rule_data["easyhaproxy.%s_%s.localport" % (definition, port_number)] = port_number
|
||||
definition = "easyhaproxy.%s_%s" % (rule.host.replace(".", "-"), port_number)
|
||||
rule_data["%s.host" % (definition)] = rule.host
|
||||
rule_data["%s.port" % (definition)] = "80"
|
||||
rule_data["%s.localport" % (definition)] = port_number
|
||||
if rule.host in ssl_hosts:
|
||||
rule_data["%s.ssl" % (definition)] = 'true'
|
||||
if redirect_ssl is not None:
|
||||
rule_data["easyhaproxy.%s_%s.redirect_ssl" % (definition, port_number)] = 'true'
|
||||
rule_data["%s.redirect_ssl" % (definition)] = 'true'
|
||||
if letsencrypt is not None:
|
||||
rule_data["easyhaproxy.%s_%s.letsencrypt" % (definition, port_number)] = 'true'
|
||||
rule_data["%s.letsencrypt" % (definition)] = 'true'
|
||||
if redirect is not None:
|
||||
rule_data["easyhaproxy.%s_%s.redirect" % (definition, port_number)] = redirect
|
||||
rule_data["%s.redirect" % (definition)] = redirect
|
||||
|
||||
service_name = rule.http.paths[0].backend.service.name
|
||||
try:
|
||||
api_response = self.api_instance.read_namespaced_service(service_name, i.metadata.namespace)
|
||||
api_response = self.api_instance.read_namespaced_service(service_name, ingress.metadata.namespace)
|
||||
cluster_ip = api_response.spec.cluster_ip
|
||||
except ApiException as e:
|
||||
cluster_ip = None
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue