initial commit

docker/motd

@@ -0,0 +1,33 @@
+
+  ╔════════════════════════════════════════════════════════════════╗
+  ║                                                                ║
+  ║   ██╗     ███████╗██╗  ██╗   ██╗  ██╗ █████╗ ███████╗         ║
+  ║   ██║     ██╔════╝██║ ██╔╝   ██║ ██╔╝██╔══██╗██╔════╝         ║
+  ║   ██║     █████╗  █████╔╝    █████╔╝ ╚█████╔╝███████╗         ║
+  ║   ██║     ██╔══╝  ██╔═██╗    ██╔═██╗ ██╔══██╗╚════██║         ║
+  ║   ███████╗██║     ██║  ██╗   ██║  ██╗╚█████╔╝███████║         ║
+  ║   ╚══════╝╚═╝     ╚═╝  ╚═╝   ╚═╝  ╚═╝ ╚════╝ ╚══════╝         ║
+  ║              Kubernetes Management Pod - Jump Box             ║
+  ║                                                                ║
+  ╠════════════════════════════════════════════════════════════════╣
+  ║  Toolbelt                                                      ║
+  ║    - kubectl : cluster operations and troubleshooting          ║
+  ║    - lfk     : LFK kubernetes management                       ║
+  ║    - k9s     : interactive cluster navigation                  ║
+  ║    - helm    : chart install, upgrade, and rollback            ║
+  ║    - plus    : kubectx, kubens, jq, yq, and more               ║
+  ║                                                                ║
+  ╠════════════════════════════════════════════════════════════════╣
+  ║  Quick start                                                   ║
+  ║    kubectl get pods -A                                         ║
+  ║    k9s                                                         ║
+  ║    helm list -A                                                ║
+  ║    lfk --help                                                  ║
+  ║                                                                ║
+  ╠════════════════════════════════════════════════════════════════╣
+  ║  Access                                                        ║
+  ║    web ssh : browser session backed by local sshd              ║
+  ║    users   : admin (passwordless sudo) | user (no sudo)        ║
+  ║                                                                ║
+  ╚════════════════════════════════════════════════════════════════╝
+

docker/nginx/webssh.conf

@@ -0,0 +1,40 @@
+map $http_upgrade $connection_upgrade {
+    default upgrade;
+    '' close;
+}
+
+server {
+    listen 3000;
+    listen [::]:3000;
+    server_name _;
+
+    location = / {
+        return 302 $scheme://$http_host/ssh/host/127.0.0.1;
+    }
+
+    location = /ssh {
+        return 302 $scheme://$http_host/ssh/host/127.0.0.1;
+    }
+
+    location = /ssh/host {
+        return 302 $scheme://$http_host/ssh/host/127.0.0.1;
+    }
+
+    location ~ ^/ssh/host/(?!127\.0\.0\.1(?:/|$)).+ {
+        return 302 $scheme://$http_host/ssh/host/127.0.0.1;
+    }
+
+    location / {
+        proxy_pass http://127.0.0.1:3001;
+        proxy_http_version 1.1;
+        proxy_set_header Host $http_host;
+        proxy_set_header X-Forwarded-Host $http_host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection $connection_upgrade;
+        proxy_read_timeout 3600;
+        proxy_send_timeout 3600;
+    }
+}

docker/profile/20-k8s-tools-completion.sh

@@ -0,0 +1,19 @@
+#!/bin/sh
+
+# Enable kubectl and helm completion for interactive bash sessions.
+if [ -n "${BASH_VERSION:-}" ]; then
+  if [ -r /usr/share/bash-completion/bash_completion ]; then
+    . /usr/share/bash-completion/bash_completion
+  fi
+
+  if [ -r /etc/bash_completion.d/kubectl ]; then
+    . /etc/bash_completion.d/kubectl
+  fi
+
+  if [ -r /etc/bash_completion.d/helm ]; then
+    . /etc/bash_completion.d/helm
+  fi
+fi
+
+alias k=kubectl
+complete -F __start_kubectl k

docker/sshd/10-lfk-base.conf

@@ -0,0 +1,16 @@
+Port 22
+Protocol 2
+PermitRootLogin no
+PubkeyAuthentication yes
+HostKey /var/lib/k8s-mgmt-pod/ssh_host_rsa_key
+HostKey /var/lib/k8s-mgmt-pod/ssh_host_ecdsa_key
+HostKey /var/lib/k8s-mgmt-pod/ssh_host_ed25519_key
+AuthorizedKeysFile .ssh/authorized_keys
+UsePAM yes
+X11Forwarding no
+AllowTcpForwarding no
+AllowAgentForwarding no
+PermitEmptyPasswords no
+PrintMotd no
+ClientAliveInterval 300
+ClientAliveCountMax 2