Tunnel-cloud

Tunnel-cloud 配置示例

tunnel/tunnel-cloud.yaml 

  1. ---
  2. apiVersion: rbac.authorization.k8s.io/v1
  3. kind: ClusterRole
  4. metadata:
  5.   name: tunnel-cloud
  6.   namespace: edge-system
  7. rules:
  8.   - apiGroups: [""]
  9.     resources: ["configmaps"]
  10.     verbs: ["get", "update"]
  11.   - apiGroups: [""]
  12.     resources: ["endpoints"]
  13.     verbs: ["get"]
  14.   - apiGroups: [""]
  15.     resources: ["services"]
  16.     verbs: ["get"]
  17. ---
  18. apiVersion: rbac.authorization.k8s.io/v1
  19. kind: RoleBinding
  20. metadata:
  21.   name: tunnel-cloud
  22.   namespace: edge-system
  23. roleRef:
  24.   apiGroup: rbac.authorization.k8s.io
  25.   kind: ClusterRole
  26.   name: tunnel-cloud
  27. subjects:
  28.   - kind: ServiceAccount
  29.     name: tunnel-cloud
  30.     namespace: edge-system
  31. ---
  32. apiVersion: v1
  33. kind: ServiceAccount
  34. metadata:
  35.   name: tunnel-cloud
  36.   namespace: edge-system
  37. ---
  38. apiVersion: v1
  39. kind: ConfigMap
  40. metadata:
  41.   name: tunnel-cloud-conf
  42.   namespace: edge-system
  43. data:
  44.   tunnel_cloud.toml: |
  45.     [mode]
  46.         [mode.cloud]
  47.             [mode.cloud.stream]
  48.                 [mode.cloud.stream.server]
  49.                     grpcport = 9000
  50.                     logport = 51010
  51.                     key = "/etc/superedge/tunnel/certs/tunnel-cloud-server.key"
  52.                     cert = "/etc/superedge/tunnel/certs/tunnel-cloud-server.crt"
  53.                     tokenfile = "/etc/superedge/tunnel/token/token"
  54.                 [mode.cloud.stream.dns]
  55.                      configmap="tunnel-nodes"
  56.                      hosts = "/etc/superedge/tunnel/nodes/hosts"
  57.                      service = "tunnel-cloud"
  58.             [mode.cloud.tcp]
  59.                 "0.0.0.0:6443" = "127.0.0.1:6443"
  60.             [mode.cloud.https]
  61.                 cert ="/etc/superedge/tunnel/certs/apiserver-kubelet-server.crt"
  62.                 key = "/etc/superedge/tunnel/certs/apiserver-kubelet-server.key"
  63.                 [mode.cloud.https.addr]
  64.                     "10250" = "127.0.0.1:10250"
  65.                     "10300" = "127.0.0.1:10250"    
  66. ---
  67. apiVersion: v1
  68. kind: ConfigMap
  69. metadata:
  70.   name: tunnel-cloud-token
  71.   namespace: edge-system
  72. data:
  73.   token: |
  74.         default:{{.TunnelCloudEdgeToken}}
  75. ---
  76. apiVersion: v1
  77. data:
  78.   tunnel-cloud-server.crt: '{{.TunnelPersistentConnectionServerCrt}}'
  79.   tunnel-cloud-server.key: '{{.TunnelPersistentConnectionServerKey}}'
  80.   apiserver-kubelet-server.crt: '{{.TunnelProxyServerCrt}}'
  81.   apiserver-kubelet-server.key: '{{.TunnelProxyServerKey}}'
  82. kind: Secret
  83. metadata:
  84.   name: tunnel-cloud-cert
  85.   namespace: edge-system
  86. type: Opaque
  87. ---
  88. apiVersion: v1
  89. kind: Service
  90. metadata:
  91.   name: tunnel-cloud
  92.   namespace: edge-system
  93. spec:
  94.   ports:
  95.     - name: proxycloud
  96.       port: 9000
  97.       protocol: TCP
  98.       targetPort: 9000
  99.   selector:
  100.     app: tunnel-cloud
  101.   type: NodePort
  102. ---
  103. apiVersion: apps/v1
  104. kind: Deployment
  105. metadata:
  106.   labels:
  107.     app: tunnel-cloud
  108.   name: tunnel-cloud
  109.   namespace: edge-system
  110. spec:
  111.   selector:
  112.     matchLabels:
  113.       app: tunnel-cloud
  114.   template:
  115.     metadata:
  116.       labels:
  117.         app: tunnel-cloud
  118.     spec:
  119.       serviceAccount: tunnel-cloud
  120.       serviceAccountName: tunnel-cloud
  121.       containers:
  122.         - name: tunnel-cloud
  123.           image: superedge/tunnel:v0.3.0
  124.           imagePullPolicy: IfNotPresent
  125.           livenessProbe:
  126.             httpGet:
  127.               path: /cloud/healthz
  128.               port: 51010
  129.             initialDelaySeconds: 10
  130.             periodSeconds: 60
  131.             timeoutSeconds: 3
  132.             successThreshold: 1
  133.             failureThreshold: 1
  134.           command:
  135.             - /usr/local/bin/tunnel
  136.           args:
  137.             - --m=cloud
  138.             - --c=/etc/superedge/tunnel/conf/tunnel_cloud.toml
  139.             - --log-dir=/var/log/tunnel
  140.             - --alsologtostderr
  141.           env:
  142.             - name: POD_IP
  143.               valueFrom:
  144.                 fieldRef:
  145.                   apiVersion: v1
  146.                   fieldPath: status.podIP
  147.             - name: POD_NAMESPACE
  148.               valueFrom:
  149.                 fieldRef:
  150.                   apiVersion: v1
  151.                   fieldPath: metadata.namespace
  152.           volumeMounts:
  153.             - name: token
  154.               mountPath: /etc/superedge/tunnel/token
  155.             - name: certs
  156.               mountPath: /etc/superedge/tunnel/certs
  157.             - name: hosts
  158.               mountPath: /etc/superedge/tunnel/nodes
  159.             - name: conf
  160.               mountPath: /etc/superedge/tunnel/conf
  161.           ports:
  162.             - containerPort: 9000
  163.               name: tunnel
  164.               protocol: TCP
  165.             - containerPort: 7000
  166.               name: gateway
  167.               protocol: TCP
  168.             - containerPort: 10250
  169.               name: kubelet
  170.               protocol: TCP
  171.             - containerPort: 6443
  172.               name: apiserver
  173.               protocol: TCP
  174.           resources:
  175.             limits:
  176.               cpu: 50m
  177.               memory: 100Mi
  178.             requests:
  179.               cpu: 10m
  180.               memory: 20Mi
  181.       volumes:
  182.         - name: token
  183.           configMap:
  184.             name: tunnel-cloud-token
  185.         - name: certs
  186.           secret:
  187.             secretName: tunnel-cloud-cert
  188.         - name: hosts
  189.           configMap:
  190.             name: tunnel-nodes
  191.         - name: conf
  192.           configMap:
  193.             name: tunnel-cloud-conf
  194.       nodeSelector:
  195.         node-role.kubernetes.io/master: ""
  196.       tolerations:
  197.         - key: "node-role.kubernetes.io/master"
  198.           operator: "Exists"
  199.           effect: "NoSchedule"

最后修改 June 15, 2021 : Fixed error links and paths (fef537b)