Socks and HTTP proxy in Kubernetes with ingress via Traefik (with SNI) or via Nginx, also ExternalDNS

external-dns.yaml

apiVersion: externaldns.k8s.io/v1alpha1
kind: DNSEndpoint
metadata:
  name: proxy
spec:
  endpoints:
  - dnsName: proxy.superhub.io
    recordTTL: 300
    recordType: CNAME
    targets:
    - a7dfffe228ed0466f808cf4750ac68ca-22337b0a1cbc5bd2.elb.us-east-2.amazonaws.com

ghostunnel.sh

ghostunnel client --listen=127.0.0.1:1080 --target=proxy.superhub.io:443 --disable-authentication

http.yaml

---
kind: Service
apiVersion: v1
metadata:
  name: proxy
spec:
  ports:
  - port: 8080
    targetPort: 8888
  selector:
    app: proxy

---
kind: Deployment
apiVersion: apps/v1
metadata:
  name: proxy
spec:
  selector:
    matchLabels:
      app: proxy
  template:
    metadata:
      labels:
        app: proxy
    spec:
      containers:
      - name: proxy
        image: monokal/tinyproxy
        args:
        - ANY
        ports:
        - containerPort: 8888
          protocol: TCP

nginx-values.yaml

# nginx (chart) requires a separate port on loadbalancer
tcp:
  1880: ingress/proxy:8080

socks.yaml

---
kind: Service
apiVersion: v1
metadata:
  name: proxy
spec:
  ports:
  - port: 8080
    targetPort: 1080
  selector:
    app: proxy

---
kind: Deployment
apiVersion: apps/v1
metadata:
  name: proxy
spec:
  selector:
    matchLabels:
      app: proxy
  template:
    metadata:
      labels:
        app: proxy
    spec:
      containers:
      - name: proxy
        image: wernight/dante
        ports:
        - containerPort: 1080
          protocol: TCP

traefik.yaml

# Traefik can route on SNI
# and mutual TLS https://doc.traefik.io/traefik/routing/providers/kubernetes-crd/#kind-tlsoption
---
apiVersion: traefik.containo.us/v1alpha1
kind: TLSOption
metadata:
  name: tls12
spec:
  minVersion: VersionTLS12

---
apiVersion: traefik.containo.us/v1alpha1
kind: IngressRouteTCP
metadata:
  name: proxy
spec:
  entryPoints:
  - websecure
  routes:
  - match: HostSNI(`proxy.superhub.io`)
    services:
    - name: proxy
      port: 8080
  tls:
    certResolver: prod
    options:
      name: tls12