mirror of
https://github.com/jmcorgan/fips.git
synced 2026-08-10 16:43:12 +00:00
Kieran
8c349f524e
Adds a complete Kubernetes sidecar setup under testing/k8s/ that runs FIPS as a sidecar container, injecting the mesh TUN interface (fips0) into any co-located app container via shared pod network namespace. - Multi-stage Dockerfile builds fips and fipsctl from source (debian trixie / rust slim-trixie), producing a minimal runtime image with iproute2, iptables, dnsmasq, and the two binaries - entrypoint.sh generates fips.yaml from environment variables, rewrites /etc/resolv.conf to route .fips DNS through dnsmasq, applies optional iptables isolation, clamps TCP MSS, then starts dnsmasq and execs the daemon - pod.yaml annotated example Pod manifest with Secret, sysctl tuning, readiness/liveness probes, and resource limits - scripts/build.sh convenience wrapper for docker build - testing/k8s/.dockerignore keeps the build context small - README.md usage guide covering quick start, isolation modes, env vars, multi-peer JSON config, troubleshooting
38 lines
1.0 KiB
Bash
Executable File
38 lines
1.0 KiB
Bash
Executable File
#!/bin/bash
|
|
# Build the FIPS Kubernetes sidecar Docker image.
|
|
# The build happens entirely inside Docker (multi-arch friendly).
|
|
# Usage: ./scripts/build.sh [--tag TAG] [-- <extra docker buildx args>]
|
|
set -e
|
|
|
|
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
|
|
DOCKER_DIR="$(cd "$SCRIPT_DIR/.." && pwd)"
|
|
PROJECT_ROOT="$(cd "$DOCKER_DIR/../.." && pwd)"
|
|
|
|
IMAGE_TAG="fips-k8s-sidecar:latest"
|
|
while [[ $# -gt 0 ]]; do
|
|
case "$1" in
|
|
--tag) IMAGE_TAG="$2"; shift 2 ;;
|
|
--) shift; break ;;
|
|
*) echo "Unknown option: $1" >&2; exit 1 ;;
|
|
esac
|
|
done
|
|
|
|
if [ ! -f "$PROJECT_ROOT/Cargo.toml" ]; then
|
|
echo "Error: Cannot find Cargo.toml at $PROJECT_ROOT" >&2
|
|
echo "Expected layout: <project-root>/testing/k8s/scripts/build.sh" >&2
|
|
exit 1
|
|
fi
|
|
|
|
echo "Building Docker image: $IMAGE_TAG"
|
|
docker build \
|
|
-t "$IMAGE_TAG" \
|
|
-f "$DOCKER_DIR/Dockerfile" \
|
|
"$@" \
|
|
"$PROJECT_ROOT"
|
|
|
|
echo ""
|
|
echo "Done. Image: $IMAGE_TAG"
|
|
echo ""
|
|
echo "Push to your registry, then apply the example manifest:"
|
|
echo " kubectl apply -f testing/k8s/pod.yaml"
|