111 lines
3.1 KiB
Bash
Executable File
111 lines
3.1 KiB
Bash
Executable File
#!/bin/bash
|
|
# Генерирует манифест временного прокси <исходный куб> -> DST для инстанса и проверяет его dry-run (не применяет).
|
|
# loopctl proxy make loop084756df3606 loop-2 -> state/proxy/<поддомен>-proxy-loop2.yaml
|
|
# Контроллер берётся из текущего ingress инстанса: traefik-* (traefik-enterprise-clients, traefik-loop2) или nginx.
|
|
set -euo pipefail
|
|
ID=${1:?loop id}
|
|
SRC=${2:?исходный куб, например loop-2}
|
|
. "$(dirname "$0")/../lib/common.sh"
|
|
LB=$(dst_lb); [ -n "$LB" ] || { echo "не резолвится $DST_DNS" >&2; exit 1; }
|
|
|
|
ING=$(kubectl --context "$SRC" -n loop get ingress "$ID" -o json)
|
|
HOST=$(jq -r '.spec.rules[0].host' <<<"$ING")
|
|
CLASS=$(jq -r '.spec.ingressClassName // .metadata.annotations["kubernetes.io/ingress.class"]' <<<"$ING")
|
|
TLS=$(jq -r '.spec.tls[0].secretName' <<<"$ING")
|
|
NAME=${HOST%%.*}-proxy; [[ $NAME =~ ^[a-z] ]] || NAME=p$NAME # имя k8s не может начинаться с цифры (1kk)
|
|
mkdir -p "$STATE/proxy"
|
|
OUT=$STATE/proxy/$NAME-${SRC//-/}.yaml
|
|
echo "$HOST class=$CLASS tls=$TLS -> $OUT"
|
|
|
|
backend() { # общий Service + Endpoints на LB целевого куба
|
|
cat <<EOF
|
|
---
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: $NAME
|
|
namespace: loop
|
|
annotations:
|
|
$1
|
|
spec:
|
|
ports:
|
|
- name: https
|
|
port: 443
|
|
targetPort: 443
|
|
---
|
|
apiVersion: v1
|
|
kind: Endpoints
|
|
metadata:
|
|
name: $NAME
|
|
namespace: loop
|
|
subsets:
|
|
- addresses:
|
|
- ip: $LB
|
|
ports:
|
|
- name: https
|
|
port: 443
|
|
EOF
|
|
}
|
|
|
|
ingress() { # $1 класс, $2 аннотации
|
|
cat <<EOF
|
|
---
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: Ingress
|
|
metadata:
|
|
name: $NAME
|
|
namespace: loop
|
|
annotations:
|
|
$2
|
|
spec:
|
|
ingressClassName: $1
|
|
tls:
|
|
- hosts:
|
|
- $HOST
|
|
secretName: $TLS
|
|
rules:
|
|
- host: $HOST
|
|
http:
|
|
paths:
|
|
- path: /
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: $NAME
|
|
port:
|
|
number: 443
|
|
EOF
|
|
}
|
|
|
|
{
|
|
echo "# Временный прокси $HOST: $SRC -> $DST ($LB). Откат: kubectl --context $SRC delete -f $OUT"
|
|
case $CLASS in
|
|
traefik-*)
|
|
cat <<EOF
|
|
---
|
|
apiVersion: traefik.io/v1alpha1
|
|
kind: ServersTransport
|
|
metadata:
|
|
name: $NAME
|
|
namespace: loop
|
|
spec:
|
|
serverName: $HOST
|
|
EOF
|
|
backend " traefik.ingress.kubernetes.io/service.serversscheme: https
|
|
traefik.ingress.kubernetes.io/service.serverstransport: loop-$NAME@kubernetescrd"
|
|
ingress "$CLASS" " {}" ;;
|
|
nginx)
|
|
backend " {}"
|
|
ingress nginx " nginx.ingress.kubernetes.io/backend-protocol: HTTPS
|
|
nginx.ingress.kubernetes.io/upstream-vhost: $HOST
|
|
nginx.ingress.kubernetes.io/proxy-ssl-server-name: \"on\"
|
|
nginx.ingress.kubernetes.io/proxy-ssl-name: $HOST
|
|
nginx.ingress.kubernetes.io/proxy-body-size: 1000M
|
|
nginx.ingress.kubernetes.io/proxy-read-timeout: \"3600\"
|
|
nginx.ingress.kubernetes.io/proxy-send-timeout: \"3600\"" ;;
|
|
*) echo "неизвестный класс ingress: $CLASS" >&2; exit 1 ;;
|
|
esac
|
|
} > "$OUT"
|
|
|
|
kubectl --context "$SRC" apply --dry-run=server -f "$OUT"
|