init

2026-10-27 14:29:43 +03:00
commit 1769946c99
24 changed files with 3762 additions and 0 deletions
@@ -0,0 +1,110 @@
+#!/bin/bash
+# Генерирует манифест временного прокси <исходный куб> -> DST для инстанса и проверяет его dry-run (не применяет).
+#   loopctl proxy make loop084756df3606 loop-2   -> state/proxy/<поддомен>-proxy-loop2.yaml
+# Контроллер берётся из текущего ingress инстанса: traefik-* (traefik-enterprise-clients, traefik-loop2) или nginx.
+set -euo pipefail
+ID=${1:?loop id}
+SRC=${2:?исходный куб, например loop-2}
+. "$(dirname "$0")/../lib/common.sh"
+LB=$(dst_lb); [ -n "$LB" ] || { echo "не резолвится $DST_DNS" >&2; exit 1; }
+
+ING=$(kubectl --context "$SRC" -n loop get ingress "$ID" -o json)
+HOST=$(jq -r '.spec.rules[0].host' <<<"$ING")
+CLASS=$(jq -r '.spec.ingressClassName // .metadata.annotations["kubernetes.io/ingress.class"]' <<<"$ING")
+TLS=$(jq -r '.spec.tls[0].secretName' <<<"$ING")
+NAME=${HOST%%.*}-proxy; [[ $NAME =~ ^[a-z] ]] || NAME=p$NAME # имя k8s не может начинаться с цифры (1kk)
+mkdir -p "$STATE/proxy"
+OUT=$STATE/proxy/$NAME-${SRC//-/}.yaml
+echo "$HOST  class=$CLASS  tls=$TLS  -> $OUT"
+
+backend() { # общий Service + Endpoints на LB целевого куба
+cat <<EOF
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: $NAME
+  namespace: loop
+  annotations:
+$1
+spec:
+  ports:
+    - name: https
+      port: 443
+      targetPort: 443
+---
+apiVersion: v1
+kind: Endpoints
+metadata:
+  name: $NAME
+  namespace: loop
+subsets:
+  - addresses:
+      - ip: $LB
+    ports:
+      - name: https
+        port: 443
+EOF
+}
+
+ingress() { # $1 класс, $2 аннотации
+cat <<EOF
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: $NAME
+  namespace: loop
+  annotations:
+$2
+spec:
+  ingressClassName: $1
+  tls:
+    - hosts:
+        - $HOST
+      secretName: $TLS
+  rules:
+    - host: $HOST
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: $NAME
+                port:
+                  number: 443
+EOF
+}
+
+{
+echo "# Временный прокси $HOST: $SRC -> $DST ($LB). Откат: kubectl --context $SRC delete -f $OUT"
+case $CLASS in
+  traefik-*)
+    cat <<EOF
+---
+apiVersion: traefik.io/v1alpha1
+kind: ServersTransport
+metadata:
+  name: $NAME
+  namespace: loop
+spec:
+  serverName: $HOST
+EOF
+    backend "    traefik.ingress.kubernetes.io/service.serversscheme: https
+    traefik.ingress.kubernetes.io/service.serverstransport: loop-$NAME@kubernetescrd"
+    ingress "$CLASS" "    {}" ;;
+  nginx)
+    backend "    {}"
+    ingress nginx "    nginx.ingress.kubernetes.io/backend-protocol: HTTPS
+    nginx.ingress.kubernetes.io/upstream-vhost: $HOST
+    nginx.ingress.kubernetes.io/proxy-ssl-server-name: \"on\"
+    nginx.ingress.kubernetes.io/proxy-ssl-name: $HOST
+    nginx.ingress.kubernetes.io/proxy-body-size: 1000M
+    nginx.ingress.kubernetes.io/proxy-read-timeout: \"3600\"
+    nginx.ingress.kubernetes.io/proxy-send-timeout: \"3600\"" ;;
+  *) echo "неизвестный класс ingress: $CLASS" >&2; exit 1 ;;
+esac
+} > "$OUT"
+
+kubectl --context "$SRC" apply --dry-run=server -f "$OUT"