Skip to content

Instantly share code, notes, and snippets.

@scholzj
Last active January 19, 2022 08:46
Show Gist options
  • Save scholzj/6cfcf9f63f73b54eaebf60738cfdbfae to your computer and use it in GitHub Desktop.
Save scholzj/6cfcf9f63f73b54eaebf60738cfdbfae to your computer and use it in GitHub Desktop.
Strimzi Zookeeper backdoor
###########
###########
#
# You can find newer version in https://github.com/scholzj/zoo-entrance
#
###########
###########
apiVersion: apps/v1
kind: Deployment
metadata:
name: zoo-entrance
labels:
app: zoo-entrance
spec:
replicas: 1
selector:
matchLabels:
app: zoo-entrance
strategy:
type: Recreate
template:
metadata:
labels:
app: zoo-entrance
spec:
containers:
- name: tls-sidecar
image: 'docker.io/scholzj/zoo-entrance-stunnel:latest'
ports:
- containerPort: 2181
name: zoo
protocol: TCP
env:
- name: TLS_SIDECAR_LOG_LEVEL
value: notice
- name: STRIMZI_ZOOKEEPER_CONNECT
value: 'my-cluster-zookeeper-client:2181'
imagePullPolicy: Always
livenessProbe:
exec:
command:
- /opt/stunnel/stunnel_healthcheck.sh
- '2181'
failureThreshold: 3
initialDelaySeconds: 15
periodSeconds: 10
successThreshold: 1
timeoutSeconds: 5
readinessProbe:
exec:
command:
- /opt/stunnel/stunnel_healthcheck.sh
- '2181'
failureThreshold: 3
initialDelaySeconds: 15
periodSeconds: 10
successThreshold: 1
timeoutSeconds: 5
volumeMounts:
- mountPath: /etc/tls-sidecar/eo-certs/
name: eo-certs
- mountPath: /etc/tls-sidecar/cluster-ca-certs/
name: cluster-ca-certs
restartPolicy: Always
terminationGracePeriodSeconds: 30
volumes:
- name: eo-certs
secret:
defaultMode: 288
secretName: my-cluster-entity-operator-certs
- name: cluster-ca-certs
secret:
defaultMode: 288
secretName: my-cluster-cluster-ca-cert
---
apiVersion: v1
kind: Service
metadata:
labels:
app: zoo-entrance
name: zoo-entrance
spec:
ports:
- name: zoo
port: 2181
protocol: TCP
targetPort: 2181
selector:
app: zoo-entrance
type: ClusterIP
---
apiVersion: extensions/v1beta1
kind: NetworkPolicy
metadata:
labels:
app: zoo-entrance
name: zoo-entrance
spec:
ingress:
- from:
- podSelector:
matchLabels:
app: zoo-entrance
ports:
- port: 2181
protocol: TCP
podSelector:
matchLabels:
strimzi.io/name: my-cluster-zookeeper
policyTypes:
- Ingress
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment