kubernetes.yaml

---
# We are creating a new namespace that ContainerSSH will run in.
apiVersion: v1
kind: Namespace
metadata:
  name: containerssh
---
# We are creating a new namespace we can use to launch guest containers. This will be locked down.
apiVersion: v1
kind: Namespace
metadata:
  name: containerssh-guests
---
# Let's apply a network policy for the containerssh-guests namespace so guests can't connect any network resources.
# This might not work if your CNI doesn't support network policies (e.g. Docker Desktop)
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: containerssh-guest-policy
  namespace: containerssh-guests
spec:
  podSelector: {}
  policyTypes:
    - Ingress
    - Egress
---
# Let's create a ConfigMap that contains the ContainerSSH configuration
apiVersion: v1
kind: ConfigMap
metadata:
  name: containerssh-config
  namespace: containerssh
data:
  config.yaml: |
    # Let's log on the debug level so we can see what's going on.
    log:
      level: debug
    ssh:
      hostkeys:
        # This points to the host key we will create in the next step.
        - /etc/containerssh/ssh_host_rsa_key
        - /etc/containerssh/ssh_host_ed25519_key
        - /etc/containerssh/ssh_host_ecdsa_key
    auth:
      # The authentication server will be running in the same pod, so we use 127.0.0.1
      url: http://127.0.0.1:8080
    # We run the guest containers in the same Kubernetes cluster as ContainerSSH is running in
    backend: kubernetes
    kubernetes:
      connection:
        host: kubernetes.default.svc
        cacertFile: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
        bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token
      pod:
        metadata:
          namespace: containerssh-guests
        spec:
          containers:
            - name: shell
              image: containerssh/containerssh-guest-image
              ## Further options to lock down the execution.
              ## See https://containerssh.io/reference/kubernetes/ for mre options
              #
              # securityContext:
              #    runAsNonRoot: true
              #    runAsUser: 1000
              # resources:
              #   limits:
              #     memory: "128Mi"
              #     cpu: "500m"
---
# We create a secret that holds the host key.
# This is hard-coded for the example, for production you'd need to generate
# a new host key with openssl genrsa and then base64-encode it.
apiVersion: v1
kind: Secret
metadata:
  name: containerssh-hostkey
  namespace: containerssh
data:
  ssh_host_rsa_key: |
    @@SSH_HOST_RSA_KEY@@
  ssh_host_ed25519_key: |
    @@SSH_HOST_ED25519_KEY@@
  ssh_host_ecdsa_key: |
    @@SSH_HOST_ECDSA_KEY@@
---
# We are creating a new service account that can be used to launch new containers.
apiVersion: v1
kind: ServiceAccount
metadata:
  name: containerssh
  namespace: containerssh
automountServiceAccountToken: true
---
# We are creating a new role that will let the service account launch pods in the containerssh-guests namespace.
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: containerssh
  namespace: containerssh-guests
rules:
  - apiGroups:
      - ""
    resources:
      - pods
      - pods/logs
      - pods/exec
    verbs:
      - '*'
---
# We are creating a role binding that binds the containerssh service account to the containerssh role.
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: containerssh
  namespace: containerssh-guests
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: containerssh
subjects:
  - kind: ServiceAccount
    name: containerssh
    namespace: containerssh
---
# Now we are creating a deployment that runs ContainerSSH.
apiVersion: apps/v1
kind: Deployment
metadata:
  name: containerssh
  namespace: containerssh
  labels:
    app: containerssh
spec:
  replicas: 1
  selector:
    matchLabels:
      app: containerssh
  template:
    metadata:
      labels:
        app: containerssh
    spec:
      # We are using the containerssh service account
      serviceAccountName: containerssh
      containers:
        # Run ContainerSSH
        - name: containerssh
          image: containerssh/containerssh:0.4
          securityContext:
            # Read only container
            readOnlyRootFilesystem: true
          ports:
            - containerPort: 2222
          volumeMounts:
              # Mount the host keys
            - name: hostkey
              mountPath: /etc/containerssh/ssh_host_rsa_key
              subPath: ssh_host_rsa_key
              readOnly: true
            - name: hostkey
              mountPath: /etc/containerssh/ssh_host_ed25519_key
              subPath: ssh_host_ed25519_key
              readOnly: true
            - name: hostkey
              mountPath: /etc/containerssh/ssh_host_ecdsa_key
              subPath: ssh_host_ecdsa_key
              readOnly: true
              # Mount the config file
            - name: config
              mountPath: /etc/containerssh/config.yaml
              subPath: config.yaml
              readOnly: true
        # Run the auth-config test server for authentication
        - name: containerssh-authconfig
          image: containerssh/containerssh-test-authconfig:0.4
          securityContext:
            readOnlyRootFilesystem: true
      # Don't allow containers running as root (ContainerSSH doesn't need it)
      securityContext:
        runAsNonRoot: true
      volumes:
        - name: hostkey
          secret:
            secretName: containerssh-hostkey
        - name: config
          configMap:
            name: containerssh-config
---
# Create a service that makes the SSH service public on port 22
apiVersion: v1
kind: Service
metadata:
  name: containerssh
  namespace: containerssh
spec:
  selector:
    app: containerssh
  ports:
    - protocol: TCP
      port: 2222
      targetPort: 2222
  type: LoadBalancer