Tunnel-cloud

Tunnel-cloud Sample config

tunnel/tunnel-cloud.yaml

  1. ---
  2. apiVersion: rbac.authorization.k8s.io/v1
  3. kind: ClusterRole
  4. metadata:
  5. name: tunnel-cloud
  6. namespace: edge-system
  7. rules:
  8. - apiGroups: [""]
  9. resources: ["configmaps"]
  10. verbs: ["get", "update"]
  11. - apiGroups: [""]
  12. resources: ["endpoints"]
  13. verbs: ["get"]
  14. - apiGroups: [""]
  15. resources: ["services"]
  16. verbs: ["get"]
  17. ---
  18. apiVersion: rbac.authorization.k8s.io/v1
  19. kind: RoleBinding
  20. metadata:
  21. name: tunnel-cloud
  22. namespace: edge-system
  23. roleRef:
  24. apiGroup: rbac.authorization.k8s.io
  25. kind: ClusterRole
  26. name: tunnel-cloud
  27. subjects:
  28. - kind: ServiceAccount
  29. name: tunnel-cloud
  30. namespace: edge-system
  31. ---
  32. apiVersion: v1
  33. kind: ServiceAccount
  34. metadata:
  35. name: tunnel-cloud
  36. namespace: edge-system
  37. ---
  38. apiVersion: v1
  39. kind: ConfigMap
  40. metadata:
  41. name: tunnel-cloud-conf
  42. namespace: edge-system
  43. data:
  44. tunnel_cloud.toml: |
  45. [mode]
  46. [mode.cloud]
  47. [mode.cloud.stream]
  48. [mode.cloud.stream.server]
  49. grpcport = 9000
  50. logport = 51010
  51. key = "/etc/superedge/tunnel/certs/tunnel-cloud-server.key"
  52. cert = "/etc/superedge/tunnel/certs/tunnel-cloud-server.crt"
  53. tokenfile = "/etc/superedge/tunnel/token/token"
  54. [mode.cloud.stream.dns]
  55. configmap="tunnel-nodes"
  56. hosts = "/etc/superedge/tunnel/nodes/hosts"
  57. service = "tunnel-cloud"
  58. [mode.cloud.tcp]
  59. "0.0.0.0:6443" = "127.0.0.1:6443"
  60. [mode.cloud.https]
  61. cert ="/etc/superedge/tunnel/certs/apiserver-kubelet-server.crt"
  62. key = "/etc/superedge/tunnel/certs/apiserver-kubelet-server.key"
  63. [mode.cloud.https.addr]
  64. "10250" = "127.0.0.1:10250"
  65. "10300" = "127.0.0.1:10250"
  66. ---
  67. apiVersion: v1
  68. kind: ConfigMap
  69. metadata:
  70. name: tunnel-cloud-token
  71. namespace: edge-system
  72. data:
  73. token: |
  74. default:{{.TunnelCloudEdgeToken}}
  75. ---
  76. apiVersion: v1
  77. data:
  78. tunnel-cloud-server.crt: '{{.TunnelPersistentConnectionServerCrt}}'
  79. tunnel-cloud-server.key: '{{.TunnelPersistentConnectionServerKey}}'
  80. apiserver-kubelet-server.crt: '{{.TunnelProxyServerCrt}}'
  81. apiserver-kubelet-server.key: '{{.TunnelProxyServerKey}}'
  82. kind: Secret
  83. metadata:
  84. name: tunnel-cloud-cert
  85. namespace: edge-system
  86. type: Opaque
  87. ---
  88. apiVersion: v1
  89. kind: Service
  90. metadata:
  91. name: tunnel-cloud
  92. namespace: edge-system
  93. spec:
  94. ports:
  95. - name: proxycloud
  96. port: 9000
  97. protocol: TCP
  98. targetPort: 9000
  99. selector:
  100. app: tunnel-cloud
  101. type: NodePort
  102. ---
  103. apiVersion: apps/v1
  104. kind: Deployment
  105. metadata:
  106. labels:
  107. app: tunnel-cloud
  108. name: tunnel-cloud
  109. namespace: edge-system
  110. spec:
  111. selector:
  112. matchLabels:
  113. app: tunnel-cloud
  114. template:
  115. metadata:
  116. labels:
  117. app: tunnel-cloud
  118. spec:
  119. serviceAccount: tunnel-cloud
  120. serviceAccountName: tunnel-cloud
  121. containers:
  122. - name: tunnel-cloud
  123. image: superedge/tunnel:v0.3.0
  124. imagePullPolicy: IfNotPresent
  125. livenessProbe:
  126. httpGet:
  127. path: /cloud/healthz
  128. port: 51010
  129. initialDelaySeconds: 10
  130. periodSeconds: 60
  131. timeoutSeconds: 3
  132. successThreshold: 1
  133. failureThreshold: 1
  134. command:
  135. - /usr/local/bin/tunnel
  136. args:
  137. - --m=cloud
  138. - --c=/etc/superedge/tunnel/conf/tunnel_cloud.toml
  139. - --log-dir=/var/log/tunnel
  140. - --alsologtostderr
  141. env:
  142. - name: POD_IP
  143. valueFrom:
  144. fieldRef:
  145. apiVersion: v1
  146. fieldPath: status.podIP
  147. - name: POD_NAMESPACE
  148. valueFrom:
  149. fieldRef:
  150. apiVersion: v1
  151. fieldPath: metadata.namespace
  152. volumeMounts:
  153. - name: token
  154. mountPath: /etc/superedge/tunnel/token
  155. - name: certs
  156. mountPath: /etc/superedge/tunnel/certs
  157. - name: hosts
  158. mountPath: /etc/superedge/tunnel/nodes
  159. - name: conf
  160. mountPath: /etc/superedge/tunnel/conf
  161. ports:
  162. - containerPort: 9000
  163. name: tunnel
  164. protocol: TCP
  165. - containerPort: 7000
  166. name: gateway
  167. protocol: TCP
  168. - containerPort: 10250
  169. name: kubelet
  170. protocol: TCP
  171. - containerPort: 6443
  172. name: apiserver
  173. protocol: TCP
  174. resources:
  175. limits:
  176. cpu: 50m
  177. memory: 100Mi
  178. requests:
  179. cpu: 10m
  180. memory: 20Mi
  181. volumes:
  182. - name: token
  183. configMap:
  184. name: tunnel-cloud-token
  185. - name: certs
  186. secret:
  187. secretName: tunnel-cloud-cert
  188. - name: hosts
  189. configMap:
  190. name: tunnel-nodes
  191. - name: conf
  192. configMap:
  193. name: tunnel-cloud-conf
  194. nodeSelector:
  195. node-role.kubernetes.io/master: ""
  196. tolerations:
  197. - key: "node-role.kubernetes.io/master"
  198. operator: "Exists"
  199. effect: "NoSchedule"

Last modified June 15, 2021 : Fixed error links and paths (fef537b)