kacerrandClaude Opus 5.5
7f2073f94b
The optional proxmox-token Secret (token, ca.pem) mounted at /etc/proxy-operator/proxmox, make proxmox-token-secret with content checks that never print the token, a commented proxmox-home entry in both providers configs, and config/samples/proxy_proxmox.yaml. TestLoadConfig_proxmoxSampleEntry loads the commented entry from both files, and a second test ties the sample Proxy's placement to it. docs/proxmox-provider.md is the user guide: prerequisites and privileges, cluster setup, config reference, placement, what lands on Proxmox, logging, tracing, timeouts, health check, error classes, known gaps and testing. providers-existing.md gains the proxmox column and section; architecture.md, the README, providers.md and CLAUDE.md gain their rows. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
205 lines
8.0 KiB
YAML
205 lines
8.0 KiB
YAML
apiVersion: v1
|
|
kind: Namespace
|
|
metadata:
|
|
labels:
|
|
control-plane: controller-manager
|
|
app.kubernetes.io/name: egress-proxies-operator
|
|
app.kubernetes.io/managed-by: kustomize
|
|
name: system
|
|
---
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: controller-manager
|
|
namespace: system
|
|
labels:
|
|
control-plane: controller-manager
|
|
app.kubernetes.io/name: egress-proxies-operator
|
|
app.kubernetes.io/managed-by: kustomize
|
|
spec:
|
|
selector:
|
|
matchLabels:
|
|
control-plane: controller-manager
|
|
app.kubernetes.io/name: egress-proxies-operator
|
|
replicas: 1
|
|
template:
|
|
metadata:
|
|
annotations:
|
|
kubectl.kubernetes.io/default-container: manager
|
|
labels:
|
|
control-plane: controller-manager
|
|
app.kubernetes.io/name: egress-proxies-operator
|
|
spec:
|
|
# TODO(user): Uncomment the following code to configure the nodeAffinity expression
|
|
# according to the platforms which are supported by your solution.
|
|
# It is considered best practice to support multiple architectures. You can
|
|
# build your manager image using the makefile target docker-buildx.
|
|
# affinity:
|
|
# nodeAffinity:
|
|
# requiredDuringSchedulingIgnoredDuringExecution:
|
|
# nodeSelectorTerms:
|
|
# - matchExpressions:
|
|
# - key: kubernetes.io/arch
|
|
# operator: In
|
|
# values:
|
|
# - amd64
|
|
# - arm64
|
|
# - ppc64le
|
|
# - s390x
|
|
# - key: kubernetes.io/os
|
|
# operator: In
|
|
# values:
|
|
# - linux
|
|
securityContext:
|
|
# Projects are configured by default to adhere to the "restricted" Pod Security Standards.
|
|
# This ensures that deployments meet the highest security requirements for Kubernetes.
|
|
# For more details, see: https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
|
|
runAsNonRoot: true
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
containers:
|
|
- command:
|
|
- /manager
|
|
args:
|
|
- --leader-elect
|
|
- --health-probe-bind-address=:8081
|
|
- --providers-config=/etc/proxy-operator/providers.yaml
|
|
# Structured logs: every line is one JSON object, so `kubectl logs
|
|
# | jq` works. The time encoding is not optional — the JSON encoder
|
|
# defaults to epoch seconds. Verbosity stays at the binary's
|
|
# default (debug, one line per provider API call); add
|
|
# --zap-log-level=info for outcomes only.
|
|
- --zap-encoder=json
|
|
- --zap-time-encoding=rfc3339
|
|
# Add --trace-health-probes to emit one span per health probe
|
|
# (high volume: ~1/s per proxy).
|
|
# Provider health checks (kubectl get providerhealth) run every
|
|
# minute; tune with --provider-check-interval (0 turns them off,
|
|
# otherwise at least 10s) and --provider-check-timeout (15s, or
|
|
# the interval if that is shorter).
|
|
env:
|
|
# Bearer token for the discovery API. Optional: without the
|
|
# Secret the API serves unauthenticated (with a loud warning).
|
|
# Create it with:
|
|
# kubectl -n egress-proxies-operator-system create secret \
|
|
# generic discovery-token --from-literal=token=<your-token>
|
|
- name: DISCOVERY_TOKEN
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: discovery-token
|
|
key: token
|
|
optional: true
|
|
# --- OpenTelemetry tracing ---
|
|
# Tracing is OFF until OTEL_EXPORTER_OTLP_ENDPOINT (or
|
|
# OTEL_TRACES_EXPORTER) is set; without it the operator runs
|
|
# exactly as before. The downward-API vars must stay listed
|
|
# before OTEL_RESOURCE_ATTRIBUTES: $(VAR) expansion only sees
|
|
# earlier-listed vars.
|
|
- name: POD_NAME
|
|
valueFrom:
|
|
fieldRef:
|
|
fieldPath: metadata.name
|
|
- name: POD_NAMESPACE
|
|
valueFrom:
|
|
fieldRef:
|
|
fieldPath: metadata.namespace
|
|
- name: OTEL_SERVICE_NAME
|
|
value: egress-proxies-operator
|
|
- name: OTEL_RESOURCE_ATTRIBUTES
|
|
value: k8s.pod.name=$(POD_NAME),k8s.namespace.name=$(POD_NAMESPACE)
|
|
# Point at an OTLP receiver (Tempo, Jaeger, otel-collector) to
|
|
# enable tracing; http/protobuf (4318) is the default protocol,
|
|
# set OTEL_EXPORTER_OTLP_PROTOCOL=grpc for 4317.
|
|
# - name: OTEL_EXPORTER_OTLP_ENDPOINT
|
|
# value: http://jaeger-collector.observability:4318
|
|
# - name: OTEL_TRACES_SAMPLER
|
|
# value: parentbased_traceidratio
|
|
# - name: OTEL_TRACES_SAMPLER_ARG
|
|
# value: "0.1"
|
|
image: controller:latest
|
|
name: manager
|
|
ports:
|
|
- containerPort: 8081
|
|
name: health
|
|
protocol: TCP
|
|
- containerPort: 8090
|
|
name: discovery
|
|
protocol: TCP
|
|
securityContext:
|
|
readOnlyRootFilesystem: true
|
|
allowPrivilegeEscalation: false
|
|
capabilities:
|
|
drop:
|
|
- "ALL"
|
|
livenessProbe:
|
|
httpGet:
|
|
path: /healthz
|
|
port: 8081
|
|
initialDelaySeconds: 15
|
|
periodSeconds: 20
|
|
readinessProbe:
|
|
httpGet:
|
|
path: /readyz
|
|
port: 8081
|
|
initialDelaySeconds: 5
|
|
periodSeconds: 10
|
|
# TODO(user): Configure the resources accordingly based on the project requirements.
|
|
# More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
|
|
resources:
|
|
limits:
|
|
cpu: 500m
|
|
memory: 128Mi
|
|
requests:
|
|
cpu: 10m
|
|
memory: 64Mi
|
|
volumeMounts:
|
|
- name: providers-config
|
|
mountPath: /etc/proxy-operator
|
|
readOnly: true
|
|
# SSH material for the kvm and kvm2 providers (sshKeyFile /
|
|
# knownHostsFile in the providers config point here). One Secret
|
|
# serves both types. Optional: the mount is empty when the Secret
|
|
# does not exist, and only kvm and kvm2 entries need it. Create it with:
|
|
# kubectl -n egress-proxies-operator-system create secret generic kvm-ssh \
|
|
# --from-file=id_ed25519=<private key> \
|
|
# --from-file=known_hosts=<known_hosts with every host's key>
|
|
- name: kvm-ssh
|
|
mountPath: /etc/proxy-operator/kvm
|
|
readOnly: true
|
|
# API token and CA for the proxmox provider (tokenFile / caFile in
|
|
# the providers config point here). Optional: the mount is empty when
|
|
# the Secret does not exist, and only proxmox entries need it. The
|
|
# token file is read on every request; the CA once, on first use.
|
|
# Create it with:
|
|
# kubectl -n egress-proxies-operator-system create secret generic proxmox-token \
|
|
# --from-file=token=<file holding user@realm!tokenid=secret> \
|
|
# --from-file=ca.pem=<the node's /etc/pve/pve-root-ca.pem>
|
|
# or `make proxmox-token-secret`.
|
|
- name: proxmox-token
|
|
mountPath: /etc/proxy-operator/proxmox
|
|
readOnly: true
|
|
# Scratch space: the root filesystem is read-only, and the kvm
|
|
# provider builds each VM's cloud-init seed ISO through a temp
|
|
# directory (a few hundred KB, deleted right after upload).
|
|
- name: tmp
|
|
mountPath: /tmp
|
|
volumes:
|
|
- name: providers-config
|
|
configMap:
|
|
name: providers-config
|
|
# Shared by the kvm and kvm2 providers; see the mount above.
|
|
- name: kvm-ssh
|
|
secret:
|
|
secretName: kvm-ssh
|
|
optional: true
|
|
# The proxmox provider's token and CA; see the mount above.
|
|
- name: proxmox-token
|
|
secret:
|
|
secretName: proxmox-token
|
|
optional: true
|
|
- name: tmp
|
|
emptyDir:
|
|
sizeLimit: 64Mi
|
|
serviceAccountName: controller-manager
|
|
terminationGracePeriodSeconds: 10
|