135 lines
3.5 KiB
YAML
135 lines
3.5 KiB
YAML
# ==============================================================================
|
|
# EXAMPLE: Cloudflare IP Restoration Plugin for Kubernetes
|
|
# ==============================================================================
|
|
#
|
|
# WHAT THIS DEMONSTRATES:
|
|
# - Restoring original visitor IPs when behind Cloudflare CDN
|
|
# - Using ConfigMaps to mount Cloudflare IP ranges
|
|
# - Detecting requests from Cloudflare IP ranges
|
|
# - Accurate client IP logging for applications behind Cloudflare
|
|
#
|
|
# REQUIREMENTS (run these first):
|
|
# ```bash
|
|
# # 1. Ensure EasyHAProxy is installed in your cluster
|
|
# kubectl create namespace easyhaproxy
|
|
# kubectl apply -f https://raw.githubusercontent.com/byjg/docker-easy-haproxy/5.0.0/deploy/kubernetes/easyhaproxy-daemonset.yml
|
|
#
|
|
# # 2. Download Cloudflare IP ranges
|
|
# curl -s https://www.cloudflare.com/ips-v4 > cloudflare_ips.lst
|
|
# curl -s https://www.cloudflare.com/ips-v6 >> cloudflare_ips.lst
|
|
#
|
|
# # 3. Create ConfigMap with Cloudflare IPs
|
|
# kubectl create configmap cloudflare-ips \
|
|
# --from-file=cloudflare_ips.lst=cloudflare_ips.lst \
|
|
# -n easyhaproxy
|
|
#
|
|
# # 4. Mount the ConfigMap in EasyHAProxy deployment:
|
|
# # Edit your EasyHAProxy deployment and add:
|
|
# # volumeMounts:
|
|
# # - name: cloudflare-ips
|
|
# # mountPath: /etc/haproxy/cloudflare_ips.lst
|
|
# # subPath: cloudflare_ips.lst
|
|
# # volumes:
|
|
# # - name: cloudflare-ips
|
|
# # configMap:
|
|
# # name: cloudflare-ips
|
|
# ```
|
|
#
|
|
# HOW TO START:
|
|
# ```bash
|
|
# kubectl apply -f cloudflare.yml
|
|
# ```
|
|
#
|
|
# HOW TO VERIFY IT'S WORKING:
|
|
# ```bash
|
|
# # Check resources are created
|
|
# kubectl get deployment,service,ingress -l app=webapp
|
|
#
|
|
# # Test via port-forward
|
|
# kubectl port-forward -n easyhaproxy deployment/easyhaproxy 8080:80
|
|
# curl -H "Host: myapp.example.local" http://localhost:8080
|
|
# # Expected: 200 OK with "App Behind Cloudflare"
|
|
#
|
|
# # In production behind Cloudflare, the plugin will restore real client IPs
|
|
# # from the CF-Connecting-IP header
|
|
# ```
|
|
#
|
|
# CLEAN UP:
|
|
# ```bash
|
|
# kubectl delete -f cloudflare.yml
|
|
# ```
|
|
#
|
|
# ==============================================================================
|
|
|
|
---
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: webapp-service
|
|
namespace: default
|
|
spec:
|
|
ports:
|
|
- port: 8080
|
|
targetPort: 8080
|
|
selector:
|
|
app: webapp
|
|
type: ClusterIP
|
|
|
|
---
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: webapp
|
|
namespace: default
|
|
spec:
|
|
replicas: 3
|
|
selector:
|
|
matchLabels:
|
|
app: webapp
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: webapp
|
|
spec:
|
|
containers:
|
|
- name: webapp
|
|
image: byjg/static-httpserver
|
|
ports:
|
|
- containerPort: 8080
|
|
env:
|
|
- name: TITLE
|
|
value: "App Behind Cloudflare"
|
|
resources:
|
|
limits:
|
|
cpu: '0.1'
|
|
memory: '64Mi'
|
|
requests:
|
|
cpu: '0.05'
|
|
memory: '32Mi'
|
|
|
|
---
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: Ingress
|
|
metadata:
|
|
annotations:
|
|
# Enable Cloudflare plugin
|
|
easyhaproxy.plugins: "cloudflare"
|
|
|
|
# Optional: Specify custom IP list path
|
|
# easyhaproxy.plugin.cloudflare.ip_list_path: "/etc/haproxy/cloudflare_ips.lst"
|
|
name: webapp-ingress-cloudflare
|
|
namespace: default
|
|
spec:
|
|
# Use ingressClassName instead of the deprecated annotation
|
|
# For backward compatibility, annotation kubernetes.io/ingress.class is still supported
|
|
ingressClassName: easyhaproxy-ingress
|
|
rules:
|
|
- host: myapp.example.local
|
|
http:
|
|
paths:
|
|
- backend:
|
|
service:
|
|
name: webapp-service
|
|
port:
|
|
number: 8080
|
|
pathType: ImplementationSpecific
|