85 lines
1.8 KiB
YAML
85 lines
1.8 KiB
YAML
---
|
|
# Lightweight nginx that reverse-proxies to the Kubernetes API server.
|
|
# Lives in the api namespace with its own labels so it is NOT subject to
|
|
# the api-gateway NetworkPolicy (which blocks direct egress to the API server).
|
|
# The gateway loader connects to this service instead of 10.96.0.1:443.
|
|
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: kube-api-proxy-config
|
|
namespace: api
|
|
data:
|
|
nginx.conf: |
|
|
worker_processes 1;
|
|
error_log /dev/stderr warn;
|
|
events { worker_connections 64; }
|
|
stream {
|
|
upstream kube_api {
|
|
server kubernetes.default.svc.cluster.local:443;
|
|
}
|
|
server {
|
|
listen 8443;
|
|
proxy_pass kube_api;
|
|
}
|
|
}
|
|
---
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: kube-api-proxy
|
|
namespace: api
|
|
labels:
|
|
app: kube-api-proxy
|
|
spec:
|
|
replicas: 1
|
|
selector:
|
|
matchLabels:
|
|
app: kube-api-proxy
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: kube-api-proxy
|
|
spec:
|
|
automountServiceAccountToken: false
|
|
containers:
|
|
- name: nginx
|
|
image: nginx:1.27-alpine
|
|
ports:
|
|
- containerPort: 8443
|
|
volumeMounts:
|
|
- name: config
|
|
mountPath: /etc/nginx/nginx.conf
|
|
subPath: nginx.conf
|
|
readOnly: true
|
|
resources:
|
|
requests:
|
|
cpu: 10m
|
|
memory: 16Mi
|
|
limits:
|
|
cpu: 50m
|
|
memory: 32Mi
|
|
securityContext:
|
|
readOnlyRootFilesystem: false
|
|
allowPrivilegeEscalation: false
|
|
capabilities:
|
|
drop: ["ALL"]
|
|
volumes:
|
|
- name: config
|
|
configMap:
|
|
name: kube-api-proxy-config
|
|
---
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: kube-api-proxy
|
|
namespace: api
|
|
labels:
|
|
app: kube-api-proxy
|
|
spec:
|
|
selector:
|
|
app: kube-api-proxy
|
|
ports:
|
|
- port: 8443
|
|
targetPort: 8443
|
|
protocol: TCP
|