Compare commits

...

4 commits
cicd ... main

Author SHA1 Message Date
fcb8af9af1 remove useless logs
All checks were successful
ci / docker (push) Successful in 1m17s
Signed-off-by: Frank Villaro-Dixon <frank@villaro-dixon.eu>
2024-09-02 17:17:01 +02:00
73556d37ec fix cleanup
Signed-off-by: Frank Villaro-Dixon <frank@villaro-dixon.eu>
2024-09-02 17:16:33 +02:00
e763978b4a be dual stack
All checks were successful
ci / docker (push) Successful in 1m9s
Signed-off-by: Frank Villaro-Dixon <frank@villaro-dixon.eu>
2024-09-02 11:41:22 +02:00
7e023a2af2 "Improve" readme
All checks were successful
ci / docker (push) Successful in 1m7s
Signed-off-by: Frank Villaro-Dixon <frank@villaro-dixon.eu>
2024-08-28 01:20:06 +02:00
3 changed files with 46 additions and 7 deletions

View file

@ -27,6 +27,46 @@ You'll need to edit the kubeconfig file and change the api host to be your local
## How to use it
### Pod
Launch a pod (through a deployment, or sts, or something else) on your cluster.
You can use the following image `forge.k3s.fr/frank/kube-escape:latest`
Don't forget to give it the following env values:
- WEBSOCKET_ROOT_URL
- WS_ID: facultative, can auto generate itself
Then look at its logs and you'll see the ws url to use when connecting to it
### WS Proxy
You should spawn a WS proxy that will receive connections from the client and the pod.
It should be accessible by both.
You can override the command of the image and use `./proxy.py`
### Client
Launch your client with:
```bash
./client.py <ws_URL_given_by_pod>
```
This will open a listening socket on localhost port 6443
### Kubectl
Change your kubeconfig's server to `https://localhost:6443`
And then, enjoy!
## Considerations
### Security ### Security
I guess you could proxy your websockets through an HTTPs endpoint. Wouldn't be bad. I guess you could proxy your websockets through an HTTPs endpoint. Wouldn't be bad.
@ -35,4 +75,4 @@ However, the kubeapi proto is already over TLS, so it wouldn't add much value.
### Compression ### Compression
Sadly it's not really possible (efficient-wise) to compress TLS data as it looks Sadly it's not really possible (efficient-wise) to compress TLS data as it looks
random-ish. random-ish.

7
pod.py
View file

@ -16,7 +16,7 @@ async def handle_socket_read(socketid, tcpreader, ws):
print(f"New socket: {socketid}. Waiting on recv") print(f"New socket: {socketid}. Waiting on recv")
while True: while True:
data = await tcpreader.read(2024) data = await tcpreader.read(2024)
print(f"TCP@{socketid} Received {len(data)} bytes") #print(f"TCP@{socketid} Received {len(data)} bytes")
if data == b'': if data == b'':
print(f"TCP@{socketid} Connection closed") print(f"TCP@{socketid} Connection closed")
c = conn.WSMsg(socketid, conn.MsgType.DISCONNECT) c = conn.WSMsg(socketid, conn.MsgType.DISCONNECT)
@ -24,7 +24,7 @@ async def handle_socket_read(socketid, tcpreader, ws):
break break
c = conn.WSMsg(socketid, conn.MsgType.DATA, data) c = conn.WSMsg(socketid, conn.MsgType.DATA, data)
print(f'TCP>WS: {c}') #print(f'TCP>WS: {c}')
await ws.send(c.to_bytes()) await ws.send(c.to_bytes())
except Exception as e: except Exception as e:
@ -62,9 +62,8 @@ async def handle_ws_incoming(cfg, ws, sockets):
elif c.msg == conn.MsgType.DATA: elif c.msg == conn.MsgType.DATA:
tcpreader, tcpwriter = sockets[socketid] tcpreader, tcpwriter = sockets[socketid]
print(f'WS>TCP: {c}') #print(f'WS>TCP: {c}')
tcpwriter.write(c.payload) tcpwriter.write(c.payload)
print('written')
def get_config(): def get_config():

View file

@ -29,12 +29,12 @@ async def handler(websocket):
print(f"Connection closed: {e}") print(f"Connection closed: {e}")
finally: finally:
# Unregister the client # Unregister the client
connected_clients.remove(websocket) connected_clients.get(websocket.request.path, set()).remove(websocket)
async def main(): async def main():
# Start the WebSocket server # Start the WebSocket server
ws_port = os.environ.get("WS_PORT", 9999) ws_port = os.environ.get("WS_PORT", 9999)
server = await websockets.asyncio.server.serve(handler, "::", ws_port) server = await websockets.asyncio.server.serve(handler, "", ws_port)
print(f"WebSocket server listening on ws://[::]:{ws_port}") print(f"WebSocket server listening on ws://[::]:{ws_port}")
await server.wait_closed() await server.wait_closed()