apiserver-network-proxy
Created due to kubernetes/org#715.
See the KEP proposal for architecture and details.
Community, discussion, contribution, and support
Learn how to engage with the Kubernetes community on the community page.
You can reach the maintainers of this project at:
Code of conduct
Participation in the Kubernetes community is governed by the Kubernetes Code of Conduct.
Releases
To reduce version-skew risk, it is recommended to match apiserver-network-proxy server & client minor release versions. With Kubernetes, this means:
- Kubernetes v1.27+:
0.1.Xtags,masterbranch - Kubernetes versions v1.23 to v1.27:
0.0.Xtags,release-0.0branch - Kubernetes versions up to v1.23: apiserver-network-proxy versions up to
v0.0.30. Refer to the kubernetes go.mod file for the specific release version.
Build
Please make sure you have the REGISTRY and PROJECT_ID environment variables set. For local builds these can be set to anything. For image builds these determine the location of your image. For GCE the registry should be gcr.io and PROJECT_ID should be the project you want to use the images in.
Mockgen
The mockgen tool must be installed on your system.
Protoc
Proto definitions are compiled with protoc. Please ensure you have protoc installed (Instructions) and the protoc-gen-go and protoc-gen-go-grpc libraries at the appropriate version.
Currently, we are using [email protected]
go get google.golang.org/protobuf/cmd/[email protected]
Currently, we are using [email protected]
go get google.golang.org/grpc/cmd/[email protected]
Local builds
make clean
make certs
make gen
make buildBuild images
make docker-buildExamples
The current examples run two actual services as well as a sample client on one end and a sample destination for requests on the other.
- Proxy service: The proxy service takes the API server requests and forwards them appropriately.
- Agent service: The agent service connects to the proxy and then allows traffic to be forwarded to it.
GRPC Client using mTLS Proxy with dial back Agent
Frontend client =HTTP over GRPC=> (:8090) proxy (:8091) <=GRPC= agent =HTTP=> http-test-server(:8000)
| ^
| Tunnel |
+---------------------------------------------------------------+
- Start Simple test HTTP Server (Sample destination)
./bin/http-test-server- Start proxy service
./bin/proxy-server --server-ca-cert=certs/frontend/issued/ca.crt --server-cert=certs/frontend/issued/proxy-frontend.crt --server-key=certs/frontend/private/proxy-frontend.key --cluster-ca-cert=certs/agent/issued/ca.crt --cluster-cert=certs/agent/issued/proxy-frontend.crt --cluster-key=certs/agent/private/proxy-frontend.key- Start agent service
./bin/proxy-agent --ca-cert=certs/agent/issued/ca.crt --agent-cert=certs/agent/issued/proxy-agent.crt --agent-key=certs/agent/private/proxy-agent.key- Run client (mTLS enabled sample client)
./bin/proxy-test-client --ca-cert=certs/frontend/issued/ca.crt --client-cert=certs/frontend/issued/proxy-client.crt --client-key=certs/frontend/private/proxy-client.keyGRPC+UDS Client using Proxy with dial back Agent
Frontend client =HTTP over GRPC+UDS=> (/tmp/uds-proxy) proxy (:8091) <=GRPC= agent =HTTP=> SimpleHTTPServer(:8000)
| ^
| Tunnel |
+----------------------------------------------------------------------------+
- Start Simple test HTTP Server (Sample destination)
./bin/http-test-server- Start proxy service
./bin/proxy-server --server-port=0 --uds-name=/tmp/uds-proxy --cluster-ca-cert=certs/agent/issued/ca.crt --cluster-cert=certs/agent/issued/proxy-frontend.crt --cluster-key=certs/agent/private/proxy-frontend.key- Start agent service
./bin/proxy-agent --ca-cert=certs/agent/issued/ca.crt --agent-cert=certs/agent/issued/proxy-agent.crt --agent-key=certs/agent/private/proxy-agent.key- Run client (mTLS enabled sample client)
./bin/proxy-test-client --proxy-port=0 --proxy-uds=/tmp/uds-proxy --proxy-host=""HTTP-Connect Client using mTLS Proxy with dial back Agent (Either curl OR test client)
Frontend client =HTTP-CONNECT=> (:8090) proxy (:8091) <=GRPC= agent =HTTP=> SimpleHTTPServer(:8000)
| ^
| Tunnel |
+-------------------------------------------------------------+
- Start SimpleHTTPServer (Sample destination)
./bin/http-test-server- Start proxy service
./bin/proxy-server --mode=http-connect --server-ca-cert=certs/frontend/issued/ca.crt --server-cert=certs/frontend/issued/proxy-frontend.crt --server-key=certs/frontend/private/proxy-frontend.key --cluster-ca-cert=certs/agent/issued/ca.crt --cluster-cert=certs/agent/issued/proxy-frontend.crt --cluster-key=certs/agent/private/proxy-frontend.key- Start agent service
./bin/proxy-agent --ca-cert=certs/agent/issued/ca.crt --agent-cert=certs/agent/issued/proxy-agent.crt --agent-key=certs/agent/private/proxy-agent.key- Run client (mTLS & http-connect enabled sample client)
./bin/proxy-test-client --mode=http-connect --proxy-host=127.0.0.1 --ca-cert=certs/frontend/issued/ca.crt --client-cert=certs/frontend/issued/proxy-client.crt --client-key=certs/frontend/private/proxy-client.key- Run curl client (curl using a mTLS http-connect proxy)
curl -v -p --proxy-key certs/frontend/private/proxy-client.key --proxy-cert certs/frontend/issued/proxy-client.crt --proxy-cacert certs/frontend/issued/ca.crt --proxy-cert-type PEM -x https://127.0.0.1:8090 http://localhost:8000/successRunning on kubernetes
See following README.md
Clients
apiserver-network-proxy components are intended to run as standalone binaries and should not be imported as a library. Clients communicating with the network proxy can import the konnectivity-client module.