Add k8sniff

contrib/k8sniff/.dockerignore

@@ -0,0 +1,3 @@
+.wercker/
+vendor/
+Dockerfile

contrib/k8sniff/Dockerfile

@@ -1,19 +1,10 @@
-FROM keppel.eu-de-1.cloud.sap/ccloud-dockerhub-mirror/library/golang:1.16-alpine3.13
+FROM golang:1.22 as builder
 
 WORKDIR /go/src/github.com/kubermatic/k8sniff
+ADD . .
+RUN CGO_ENABLED=0 go build -ldflags '-s' -o /go/bin/k8sniff .
 
-RUN apk add --no-cache curl git \
-    && curl https://raw.githubusercontent.com/golang/dep/master/install.sh | sh
-ARG VERSION=master
-RUN git clone https://github.com/kubermatic/k8sniff.git . \
-    && git checkout $VERSION
-
-RUN dep ensure
-
-RUN go build -v -o k8sniff .
-
-FROM alpine:3.9
+FROM alpine
 LABEL source_repository="https://github.com/sapcc/kubernikus"
-
-RUN apk add --no-cache ca-certificates
-COPY --from=0 /go/src/github.com/kubermatic/k8sniff /pipeline/source/k8sniff
+COPY --from=builder /go/bin/k8sniff /pipeline/source/k8sniff
+CMD ["/pipeline/source/k8sniff"]

contrib/k8sniff/LICENSE

@@ -0,0 +1,19 @@
+The MIT License
+
+Permission is hereby granted, free of charge, to any person obtaining a
+copy of this software and associated documentation files (the "Software"),
+to deal in the Software without restriction, including without limitation
+the rights to use, copy, modify, merge, publish, distribute, sublicense,
+and/or sell copies of the Software, and to permit persons to whom the
+Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+DEALINGS IN THE SOFTWARE.

contrib/k8sniff/Makefile

@@ -1,7 +1,8 @@
-IMAGE:= sapcc/k8sniff
-VERSION := e7435d989925e8559b0e5ca26da69f84a1035c32
+IMAGE:=keppel.eu-de-1.cloud.sap/ccloud/k8sniff
+VERSION:=$(shell git rev-parse --verify HEAD)
 
 build:
-	docker build --build-arg VERSION=$(VERSION) -t $(IMAGE):$(VERSION) .
+	docker build --network=host -t $(IMAGE):$(VERSION) .
+
 push:
 	docker push $(IMAGE):$(VERSION)

contrib/k8sniff/README.md

@@ -0,0 +1,73 @@
+<img src="logo/logo.png" alt="K8SNIff" width="50%"/>
+
+Forked from https://github.com/kubermatic/k8sniff
+
+K8SNIff - tcp ingress controller with SNI support
+=====
+
+K8SNIff is a small ingress server that will accept incoming TLS connections and parse
+TLS Client Hello messages for the SNI Extension. If one is found, we'll go
+ahead and forward that connection to a Kubernetes service with a matching Ingress resource.
+
+sniff config
+------------
+
+The following config will K8SNIff listen on port `8443` and listen on Ingress resources
+
+```json
+{
+    "bind": {
+        "host": "localhost",
+        "port": 8443
+    },
+    "kubernetes": {}
+}
+
+```
+The example ingress connect any requests to `foo` to service `foo` with port `443` and any requests to `bar` to service `bar` with port `443`. If nothing matches this, it will send the traffic to the default backend with the service `bar` on port `443`.
+
+```yaml
+apiVersion: extensions/v1beta1
+kind: Ingress
+metadata:
+  name: tcp
+  annotations:
+    kubernetes.io/ingress.class: k8sniff
+spec:
+  backend:
+    serviceName: bar
+    servicePort: 443
+  rules:
+  - host: foo
+    http:
+      paths:
+      - backend:
+          serviceName: foo
+          servicePort: 443
+  - host: bar
+    http:
+      paths:
+      - backend:
+          serviceName: bar
+          servicePort: 443
+```
+
+The requested domain name are interpreted as regular expressions. Each server and name will be checked in the order they appear in the file, stopping with the first match. If there is no match, then the request is sent to the first server with default `backend` set.
+
+using the parser
+----------------
+
+```
+import (
+    "fmt"
+
+    " kubermatic/k8sniff/parser"
+)
+
+func main() {
+    listener, err := net.Listen("tcp", "localhost:2222")
+    if err != nil {
+        return err
+    }
+}
+```

contrib/k8sniff/config.go

@@ -0,0 +1,156 @@
+/* {{{ Copyright (c) Paul R. Tagliamonte <[email protected]>, 2015
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE. }}} */
+
+package main
+
+import (
+	"encoding/json"
+	"errors"
+	"fmt"
+	"os"
+	"strings"
+	"sync"
+
+	"github.com/golang/glog"
+
+	"k8s.io/client-go/kubernetes"
+	"k8s.io/client-go/tools/cache"
+)
+
+const (
+	maxTCPPort = 65535
+)
+
+type Config struct {
+	Bind       Bind
+	Metrics    Metrics
+	Servers    []Server
+	Kubernetes *Kubernetes
+	proxy      *Proxy
+	lock       sync.Mutex
+
+	serviceController cache.Controller
+	serviceStore      cache.Store
+	ingressController cache.Controller
+	ingressStore      cache.Store
+}
+
+// Valid returns an if the config is invalid
+func (c *Config) Valid() error {
+	if len(c.Servers) > 0 && c.Kubernetes != nil {
+		return errors.New("Cannot set .Servers and .Kubernetes in config file")
+	}
+
+	if err := c.Metrics.Valid(); err != nil {
+		return err
+	}
+
+	return nil
+}
+
+type Kubernetes struct {
+	Kubeconfig   string
+	Client       *kubernetes.Clientset
+	IngressClass string
+}
+
+// Metrics contains the port & path for the
+// prometheus endpoint
+type Metrics struct {
+	Host string
+	Port int
+	Path string
+}
+
+type Bind struct {
+	Host string
+	Port int
+}
+
+type Server struct {
+	Default bool
+	Regexp  bool
+	Host    string
+	Names   []string
+	Port    int
+}
+
+// Valid returns an error if the metrics config is invalid
+func (m Metrics) Valid() error {
+	if m.Port > maxTCPPort {
+		return fmt.Errorf("Configured metrics port is above %d: port=%d", maxTCPPort, m.Port)
+	}
+
+	return nil
+}
+
+func LoadConfig(path string) (*Config, error) {
+	glog.V(5).Infof("Loading config from: %s", path)
+
+	fd, err := os.Open(path)
+	if err != nil {
+		return nil, err
+	}
+	config := Config{}
+	err = json.NewDecoder(fd).Decode(&config)
+	if err != nil {
+		return nil, err
+	}
+
+	if err = config.Valid(); err != nil {
+		return nil, err
+	}
+
+	config.setDefaultsIfUnset()
+
+	glog.V(5).Infof("Read config: %v", config)
+
+	return &config, err
+}
+
+func (c *Config) setDefaultsIfUnset() {
+	if c.Bind.Port == 0 {
+		c.Bind.Port = 8443
+	}
+
+	if c.Bind.Host == "" {
+		glog.V(5).Infof("Bind host not set. Using default: 0.0.0.0")
+		c.Bind.Host = "0.0.0.0"
+	}
+
+	if c.Metrics.Host == "" {
+		glog.V(5).Infof("Metrics host not set. Using default: 0.0.0.0")
+		c.Metrics.Host = c.Bind.Host
+	}
+
+	if c.Metrics.Port == 0 {
+		glog.V(5).Infof("Metrics port not set. Using default: 9091")
+		c.Metrics.Port = 9091
+	}
+
+	if c.Metrics.Path == "" {
+		glog.V(5).Infof("Metrics path not set. Using default: /metrics")
+		c.Metrics.Path = "/metrics"
+	}
+	if !strings.HasPrefix(c.Metrics.Path, "/") {
+		c.Metrics.Path = "/" + c.Metrics.Path
+	}
+
+}

contrib/k8sniff/go.mod

@@ -0,0 +1,57 @@
+module github.com/sapcc/kubernikus
+
+go 1.22
+
+require (
+	github.com/golang/glog v1.2.1
+	github.com/kubermatic/k8sniff v0.0.0-20171019092931-e7435d989925
+	github.com/prometheus/client_golang v1.19.0
+	k8s.io/api v0.29.4
+	k8s.io/apimachinery v0.29.4
+	k8s.io/client-go v0.29.4
+)
+
+require (
+	github.com/beorn7/perks v1.0.1 // indirect
+	github.com/cespare/xxhash/v2 v2.2.0 // indirect
+	github.com/davecgh/go-spew v1.1.1 // indirect
+	github.com/emicklei/go-restful/v3 v3.11.0 // indirect
+	github.com/go-logr/logr v1.3.0 // indirect
+	github.com/go-openapi/jsonpointer v0.19.6 // indirect
+	github.com/go-openapi/jsonreference v0.20.2 // indirect
+	github.com/go-openapi/swag v0.22.3 // indirect
+	github.com/gogo/protobuf v1.3.2 // indirect
+	github.com/golang/protobuf v1.5.4 // indirect
+	github.com/google/gnostic-models v0.6.8 // indirect
+	github.com/google/go-cmp v0.6.0 // indirect
+	github.com/google/gofuzz v1.2.0 // indirect
+	github.com/google/uuid v1.3.0 // indirect
+	github.com/imdario/mergo v0.3.6 // indirect
+	github.com/josharian/intern v1.0.0 // indirect
+	github.com/json-iterator/go v1.1.12 // indirect
+	github.com/mailru/easyjson v0.7.7 // indirect
+	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
+	github.com/modern-go/reflect2 v1.0.2 // indirect
+	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
+	github.com/prometheus/client_model v0.5.0 // indirect
+	github.com/prometheus/common v0.48.0 // indirect
+	github.com/prometheus/procfs v0.12.0 // indirect
+	github.com/spf13/pflag v1.0.5 // indirect
+	golang.org/x/net v0.23.0 // indirect
+	golang.org/x/oauth2 v0.16.0 // indirect
+	golang.org/x/sys v0.18.0 // indirect
+	golang.org/x/term v0.18.0 // indirect
+	golang.org/x/text v0.14.0 // indirect
+	golang.org/x/time v0.3.0 // indirect
+	google.golang.org/appengine v1.6.7 // indirect
+	google.golang.org/protobuf v1.33.0 // indirect
+	gopkg.in/inf.v0 v0.9.1 // indirect
+	gopkg.in/yaml.v2 v2.4.0 // indirect
+	gopkg.in/yaml.v3 v3.0.1 // indirect
+	k8s.io/klog/v2 v2.110.1 // indirect
+	k8s.io/kube-openapi v0.0.0-20231010175941-2dd684a91f00 // indirect
+	k8s.io/utils v0.0.0-20230726121419-3b25d923346b // indirect
+	sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd // indirect
+	sigs.k8s.io/structured-merge-diff/v4 v4.4.1 // indirect
+	sigs.k8s.io/yaml v1.3.0 // indirect
+)