kacerrandClaude Opus 5.5
7f2073f94b
The optional proxmox-token Secret (token, ca.pem) mounted at /etc/proxy-operator/proxmox, make proxmox-token-secret with content checks that never print the token, a commented proxmox-home entry in both providers configs, and config/samples/proxy_proxmox.yaml. TestLoadConfig_proxmoxSampleEntry loads the commented entry from both files, and a second test ties the sample Proxy's placement to it. docs/proxmox-provider.md is the user guide: prerequisites and privileges, cluster setup, config reference, placement, what lands on Proxmox, logging, tracing, timeouts, health check, error classes, known gaps and testing. providers-existing.md gains the proxmox column and section; architecture.md, the README, providers.md and CLAUDE.md gain their rows. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
116 lines
5.9 KiB
YAML
116 lines
5.9 KiB
YAML
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: providers-config
|
|
namespace: system
|
|
labels:
|
|
app.kubernetes.io/name: egress-proxies-operator
|
|
app.kubernetes.io/managed-by: kustomize
|
|
data:
|
|
# Mounted at /etc/proxy-operator/providers.yaml (--providers-config).
|
|
# The default ships only the kubernetes-pod provider so the operator runs
|
|
# out of the box; add gcp entries (type: gcp, gcp.project: ...) or kvm
|
|
# entries (type: kvm, hosts reached over SSH) for real egress fleets —
|
|
# see config/samples/providers-config.yaml.
|
|
providers.yaml: |
|
|
providers:
|
|
- name: kubernetes
|
|
type: kubernetes
|
|
- name: kvm-home
|
|
type: kvm
|
|
kvm:
|
|
# SSH to each host with the libvirt unix socket forwarded through the
|
|
# connection; nothing to open on the hypervisors beyond sshd. Both
|
|
# files come from the optional kvm-ssh Secret mounted by
|
|
# config/manager/manager.yaml — see docs/kvm-provider.md.
|
|
sshKeyFile: /etc/proxy-operator/kvm/id_ed25519
|
|
knownHostsFile: /etc/proxy-operator/kvm/known_hosts
|
|
# insecureIgnoreHostKey: true # skip host-key checks (not recommended)
|
|
# diskSizeGb: 10 # per-VM overlay; cloud-init grows the root fs into it
|
|
# vendorData: | # extra vendor-data; the qemu-guest-agent bootstrap is merged
|
|
# #cloud-config # into each Proxy's cloud-config, not configured here
|
|
# ...
|
|
images:
|
|
# placement.image names a key here (or is an https:// URL directly).
|
|
# Fetched into each host's pool on first use and cached there as
|
|
# base-<key>.qcow2; do not change an entry while Proxies use it.
|
|
debian-13:
|
|
url: https://cloud.debian.org/images/cloud/trixie/latest/debian-13-generic-amd64.qcow2
|
|
# sha256: "<64 hex>" # optional; verified after download
|
|
# firmware: uefi # default; "bios" only for images with no EFI partition
|
|
# # (Debian 13 hangs in GRUB under BIOS headless: Debian bug #1111240)
|
|
ubuntu-24.04:
|
|
url: https://cloud-images.ubuntu.com/noble/current/noble-server-cloudimg-amd64.img
|
|
machineTypes: # placement.machineType names a key here
|
|
small: {vcpus: 1, memoryMiB: 1024}
|
|
medium: {vcpus: 2, memoryMiB: 2048}
|
|
hosts: # placement.zone names a host; optional with one host
|
|
- name: beelink
|
|
address: beelink.tail8c69c.ts.net:22
|
|
user: novakj # must be in the libvirt group
|
|
bridge: br0 # to a LAN with DHCP; the VM's IP comes from there
|
|
# socket: /var/run/libvirt/libvirt-sock
|
|
# pool: default
|
|
# kvm2 takes the same block shape as kvm: an entry ports by changing
|
|
# type to kvm2 and the block name to kvm2. kvm2 does not adopt domains
|
|
# made by kvm, so delete those Proxies first. It caches its base images
|
|
# under base-<entry>-<key>.<format>, so it downloads its own copy rather
|
|
# than sharing kvm's; budget the pool space. See docs/kvm2-provider.md.
|
|
- name: kvm2-home
|
|
type: kvm2
|
|
kvm2:
|
|
sshKeyFile: /etc/proxy-operator/kvm/id_ed25519
|
|
knownHostsFile: /etc/proxy-operator/kvm/known_hosts
|
|
# insecureIgnoreHostKey: true
|
|
# diskSizeGb: 10
|
|
# installGuestAgent: false
|
|
# vendorData: |
|
|
# #cloud-config
|
|
# ...
|
|
images:
|
|
debian-13:
|
|
url: https://cloud.debian.org/images/cloud/trixie/latest/debian-13-generic-amd64.qcow2
|
|
# sha256: "<64 hex>"
|
|
# firmware: uefi
|
|
ubuntu-24.04:
|
|
url: https://cloud-images.ubuntu.com/noble/current/noble-server-cloudimg-amd64.img
|
|
machineTypes:
|
|
small: {vcpus: 1, memoryMiB: 1024}
|
|
medium: {vcpus: 2, memoryMiB: 2048}
|
|
hosts:
|
|
- name: beelink
|
|
address: beelink.tail8c69c.ts.net:22
|
|
user: novakj
|
|
bridge: br0
|
|
# socket: /var/run/libvirt/libvirt-sock
|
|
# pool: default
|
|
# proxmox clones a prepared template on a Proxmox VE cluster through its
|
|
# REST API and seeds it with a NoCloud ISO uploaded to isoStorage; it needs
|
|
# no SSH. Both files come from the optional proxmox-token Secret mounted by
|
|
# config/manager/manager.yaml. The url's host must be a name or address in
|
|
# the node certificate. See docs/proxmox-provider.md.
|
|
# - name: proxmox-home
|
|
# type: proxmox
|
|
# proxmox:
|
|
# url: https://192.168.0.8:8006
|
|
# tokenFile: /etc/proxy-operator/proxmox/token
|
|
# caFile: /etc/proxy-operator/proxmox/ca.pem
|
|
# # insecureSkipTLSVerify: true # instead of caFile; logged as a warning
|
|
# nodes: [pv1-1] # placement.zone names a node; optional with one node
|
|
# isoStorage: proxy-seeds # iso content; the token needs Datastore.Allocate here
|
|
# # storage: local-lvm # clone target; default is the template's disk storage
|
|
# # bridge: vmbr0 # replaces the cloned net0's bridge
|
|
# vlanTag: 4 # set on the cloned net0, MAC kept
|
|
# # vmidRange: {min: 100000, max: 199999}
|
|
# # requestTimeoutSeconds: 30
|
|
# # installGuestAgent: false
|
|
# # vendorData: |
|
|
# # #cloud-config
|
|
# # ...
|
|
# templates: # placement.image names a key; add keys, never repoint one
|
|
# debian-13: {vmid: 9001}
|
|
# machineTypes: # placement.machineType names a key here
|
|
# small: {cores: 1, memoryMiB: 1024}
|
|
# medium: {cores: 2, memoryMiB: 2048, diskGiB: 10}
|
|
|