sshkube 0.1.0__py3-none-any.whl

sshkube/__main__.py

@@ -0,0 +1,254 @@
+''' Usage:
+# saves this server for future use
+sshkube -s sshkube.dev.maayanlab.cloud install
+
+# launches socks5 proxy and configures kubectl
+$(sshkube init)
+# now you can use kubectl/helm
+kubectl get nodes
+helm list
+
+# alternatively you can do
+sshkube run kubectl get nodes
+sshkube run helm list
+'''
+import os
+import sys
+import click
+import pathlib
+import subprocess
+import dotenv
+
+dotenv.load_dotenv()
+workdir = pathlib.Path(os.environ.get('SSHKUBE_CONFIG', '~/.sshkube/')).expanduser()
+dotenv.load_dotenv(workdir/'.env')
+
+@click.group()
+@click.version_option()
+def cli(): pass
+
+def get_free_port():
+  import socket
+  sock = socket.socket()
+  sock.bind(('', 0))
+  _, port = sock.getsockname()
+  sock.close()
+  return port
+
+def wait_for_port(port, timeout=1, backoff=1, retries=3):
+  import time, socket
+  for i in range(retries):
+    if i > 0: time.sleep(backoff)
+    try:
+      sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+      sock.settimeout(timeout)
+      result = sock.connect_ex(('', port))
+      if result == 0: return
+    except socket.error:
+      pass
+    finally:
+      sock.close()
+  raise RuntimeError(f"Proxy server didn't start!")
+
+class PidFile:
+  pidfile = workdir/'pid'
+  def __init__(self, *, pid, port):
+    self.pid = pid
+    self.port = port
+
+  @staticmethod
+  def read():
+    if PidFile.pidfile.exists():
+      pid, _, port = PidFile.pidfile.read_text().partition(':')
+      pidfile = PidFile(pid=int(pid), port=int(port))
+      if pidfile.running:
+        return pidfile
+      else:
+        PidFile.pidfile.unlink()
+
+  def write(self):
+    if PidFile.pidfile.exists(): raise RuntimeError('PID file already exists')
+    PidFile.pidfile.parent.mkdir(parents=True, exist_ok=True)
+    PidFile.pidfile.write_text(f"{self.pid}:{self.port}")
+
+  @property
+  def running(self):
+    import os
+    try: os.kill(self.pid, 0)
+    except OSError: return False
+    else: return True
+
+  def kill(self):
+    import os, signal
+    os.kill(self.pid, signal.SIGINT)
+    PidFile.pidfile.unlink()
+
+def make_ssh_cmd(*, server, cmd=[], flags=[]):
+  return ['ssh', *flags, server, *cmd]
+
+@cli.command()
+@click.option('-s', '--server', envvar='SSHKUBE_SERVER', type=str, required=True)
+@click.option('-u', '--user', type=str, default='')
+@click.option('-i', '--identity-file', type=str, default='')
+@click.option('--verify', type=int, default=1)
+@click.option('-v', '--verbose', type=bool, is_flag=True, default=False)
+def install(*, server, user, identity_file, verify, verbose):
+  _install(server=server, user=user, identity_file=identity_file, verify=verify, verbose=verbose)
+
+def _install(*, server, user, identity_file, verify, verbose):
+  # instal sshkube server
+  workdir.mkdir(parents=True, exist_ok=True)
+  dotenv.set_key(workdir/'.env', 'SSHKUBE_SERVER', server)
+
+  # include sshkube config in sshconfig
+  ssh_dir = pathlib.Path('~/.ssh/').expanduser()
+  ssh_dir.mkdir(parents=True, exist_ok=True, mode=700)
+  add_ssh_config = f"Include {str(workdir/'config')}"
+  ssh_config = (ssh_dir/'config').read_text() if (ssh_dir/'config').exists() else ''
+  if add_ssh_config not in ssh_config.splitlines():
+    ssh_config = add_ssh_config + '\n' + ssh_config
+    (ssh_dir/'config').write_text(ssh_config)
+
+  # create sshkube sshconfig
+  (workdir/'config').write_text('\n'.join(filter(None, [
+    f"Host {server}",
+    user and f"    User {user}",
+    identity_file and f"    IdentityFile {identity_file}",
+    identity_file and f"    IdentitiesOnly yes",
+    f"    ProxyCommand env PYTHONPATH={':'.join(sys.path)} {sys.executable} -m {__package__} openssl -s {server} --verify={verify}",
+  ]))+'\n')
+
+  # verify connection
+  try:
+    subprocess.check_call(make_ssh_cmd(server=server, flags=['-v'] if verbose else [], cmd=['echo', 'Success!']), stdout=sys.stdout, stderr=sys.stderr)
+  except subprocess.CalledProcessError as e:
+    raise click.UsageError('Failed to connect, check all options and any above errors') from e
+
+
+@cli.command()
+@click.option('-s', '--server', envvar='SSHKUBE_SERVER', type=str, required=True)
+def kubeconfig(*, server):
+  _kubeconfig(server=server)
+
+def _kubeconfig(*, server):
+  ''' get kube config from remote
+  '''
+  try:
+    kube_config = subprocess.check_output(make_ssh_cmd(server=server, cmd=['cat', '~/.kube/config']))
+  except subprocess.CalledProcessError:
+    raise click.UsageError('Failed to get kubeconfig')
+  else:
+    (workdir/'kube.config').write_bytes(kube_config)
+
+@cli.command()
+@click.option('-s', '--server', envvar='SSHKUBE_SERVER', type=str, required=True)
+@click.option('-f', '--force', type=bool, is_flag=True)
+def start_server(*, server, force):
+  ''' Inspired by adb start-server
+  '''
+  _start_server(server=server, force=force)
+
+def _start_server(*, server, force):
+  pid = PidFile.read()
+  if pid:
+    if force:
+      _kill_server()
+    else:
+      return
+  #
+  port = get_free_port()
+  proc = subprocess.Popen(make_ssh_cmd(server=server, flags=[f"-ND{port}"]), start_new_session=True)
+  try:
+    wait_for_port(port)
+    PidFile(pid=proc.pid, port=port).write()
+  except RuntimeError as e:
+    proc.kill()
+    raise click.UsageError('Proxy server failed to start..') from e
+  else:
+    try:
+      _kubeconfig(server=server)
+    except RuntimeError as e:
+      proc.kill()
+      raise click.UsageError('Failed to get kubeconfig from server..') from e
+
+@cli.command()
+def kill_server():
+  _kill_server()
+
+def _kill_server():
+  ''' Inspired by adb kill-server
+  '''
+  pid = PidFile.read()
+  if pid: pid.kill()
+  (workdir/'kube.config').unlink(missing_ok=True)
+
+@cli.command()
+@click.option('-s', '--server', envvar='SSHKUBE_SERVER', type=str, required=True)
+def init(*, server):
+  _init(server=server)
+
+def _init(*, server):
+  '''
+  Usage: eval "$(sshkube init)"
+  '''
+  pid = PidFile.read()
+  if pid is None:
+    _start_server(server=server, force=False)
+    pid = PidFile.read()
+    assert pid is not None
+  #
+  print(
+    f"export KUBECONFIG={workdir/'kube.config'}",
+    f"export HTTPS_PROXY=socks5://127.0.0.1:{pid.port}",
+    sep='\n',
+  )
+
+@cli.command(context_settings=dict(
+  ignore_unknown_options=True,
+  allow_interspersed_args=False,
+))
+@click.option('-s', '--server', envvar='SSHKUBE_SERVER', type=str, required=True)
+@click.argument('args', nargs=-1, type=click.UNPROCESSED)
+def run(*, server, args):
+  _run(server=server, args=args)
+
+def _run(*, server, args):
+  '''
+  Usage: sshkube run kubectl help
+  '''
+  pid = PidFile.read()
+  if pid is None:
+    _start_server(server=server, force=False)
+    pid = PidFile.read()
+    assert pid is not None
+  #
+  import os, shutil
+  cmd = shutil.which('env')
+  os.execv(cmd, [
+    cmd,
+    f"KUBECONFIG={workdir/'kube.config'}",
+    f"HTTPS_PROXY=socks5://127.0.0.1:{pid.port}",
+    *args,
+  ])
+
+@cli.command()
+@click.option('-s', '--server', envvar='SSHKUBE_SERVER', type=str, required=True)
+@click.option('--verify', type=int, default=1)
+def openssl(*, server, verify):
+  _openssl(server=server, verify=verify)
+
+def _openssl(*, server, verify):
+  import shutil
+  socat = shutil.which('socat')
+  if socat:
+    subprocess.run([socat, '-', f"openssl:{server}:443,verify={verify}"])
+  else:
+    import asyncio
+    asyncio.new_event_loop().run_until_complete(_async_openssl(server=server, verify=verify))
+
+async def _async_openssl(*, server, verify):
+  from sshkube import socat
+  await socat.socat(socat.cat(), socat.openssl(host=server, port=443, verify=verify))
+
+if __name__ == '__main__':
+  cli()

sshkube/socat.py

@@ -0,0 +1,40 @@
+''' This is a python implementation of the features of the unix `socat` CLI
+`cat` is what you'd get with `-` on the socat cli
+`openssl` is what you'd get with `openssl:servername:port,verify`
+
+Thus together you'd use:
+await socat.socat(cat(), openssl(host,port))
+'''
+import sys
+import asyncio
+
+async def cat():
+  loop = asyncio.get_event_loop()
+  reader = asyncio.StreamReader()
+  protocol = asyncio.StreamReaderProtocol(reader)
+  await loop.connect_read_pipe(lambda: protocol, sys.stdin)
+  w_transport, w_protocol = await loop.connect_write_pipe(asyncio.streams.FlowControlMixin, sys.stdout)
+  writer = asyncio.StreamWriter(w_transport, w_protocol, reader, loop)
+  return reader, writer
+
+async def openssl(*, host: str, port: int, verify=True):
+  import ssl
+  context = ssl.create_default_context() if verify else ssl._create_unverified_context()
+  reader, writer = await asyncio.open_connection(host, port, ssl=context, server_hostname=host)
+  return reader, writer
+
+async def pipe(reader: asyncio.StreamReader, writer: asyncio.StreamWriter, b=8192):
+  try:
+    while True:
+      msg = await reader.read(b)
+      if not msg: break
+      writer.write(msg)
+  finally:
+    writer.close()
+
+async def socat(left, right, b=8192, u=False, U=False):
+  left_reader, left_writer = await left
+  right_reader, right_writer = await right
+  async with asyncio.TaskGroup() as tg:
+    if not U: tg.create_task(pipe(left_reader, right_writer, b=b))
+    if not u: tg.create_task(pipe(right_reader, left_writer, b=b))

sshkube-0.1.0.dist-info/LICENSE

@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

sshkube-0.1.0.dist-info/METADATA

@@ -0,0 +1,77 @@
+Metadata-Version: 2.3
+Name: sshkube
+Version: 0.1.0
+Summary: Access kubernetes clusters over ssh
+Author: Daniel J. B. Clarke
+Author-email: u8sand@gmail.com
+Requires-Python: >=3.10
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Requires-Dist: click (>=8.2.1,<9.0.0)
+Requires-Dist: python-dotenv (>=1.1.1,<2.0.0)
+Description-Content-Type: text/markdown
+
+# sshkube
+
+Configure access to a kubernetes cluster over ssh:
+- ssh public key used to authenticate users to the ssh server
+- kubeconfig is available on the ssh server
+- all kubectl commands run on the host but routed through an SSH facilitated SOCKS5 HTTPS proxy
+
+## SSH Server
+- An ssh server enables login by users with public keys fetched from github
+- The server contains a .kube/config file usable for accessing the kubernetes cluster
+- The server has tcp forwarding enabled
+
+## SSHKube Client Library
+- A python CLI
+- SSHs to the ssh server and obtains the .kube/config file
+- Runs a SOCKS5 proxy server as a daemon
+- prepares environment variables for kubectl to route requests through the SOCKS5 proxy server
+
+## Install on Cluster
+```bash
+# create demo cluster
+k3d cluster create -a1 -p "80:80@loadbalancer" -p "443:443@loadbalancer"
+
+DOMAIN=sshkube.localhost.u8sand.net
+
+# install the sshkube chart
+#   users specified line-by-line in githubUsers will be able to authenticate against the cluster
+#   storage is used for ssh host keys persistence
+#   ingress is used to forward ssl connections to the given domain to the ssh server
+helm install --create-namespace -n sshkube sshkube ./charts/sshkube/ -f - << EOF
+ingress:
+  type: traefik
+  domain: ${DOMAIN}
+  certResolver: null
+storage:
+  class: local-path
+githubUsers: |
+  u8sand
+EOF
+# by default, users you configure will be given a namespace and exclusive access to that namespace
+# cluster admins can give the user broader access if necessary, e.g.
+kubectl create clusterrolebinding u8sand --clusterrole=cluster-admin --serviceaccount=u8sand:u8sand
+
+# any user that has been granted access can use sshkube like so:
+
+# the client library can be configured to use the public server we've deployed
+# specify your github username and github identity file
+sshkube install -s ${DOMAIN} -u u8sand -i ~/.ssh/id_ed25519
+
+# we can run commands through ssh
+sshkube run kubectl get secret
+
+# or, preferred we "activate" our environment and use local kubectl
+#  this will allow us to also use port-forward
+eval "$(sshkube init)"
+kubectl get secret
+
+# clean up
+k3d cluster delete
+```
+

sshkube-0.1.0.dist-info/RECORD

@@ -0,0 +1,8 @@
+sshkube/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+sshkube/__main__.py,sha256=TIW5ba4WICn_vUtsDaPb69vwY9NOINPDWHbXwGvaJ-U,7423
+sshkube/socat.py,sha256=c1xqB6zDeYbzu1VFXrNL_kCniPh2kxA7m87aHg5Spew,1501
+sshkube-0.1.0.dist-info/LICENSE,sha256=xx0jnfkXJvxRnG63LTGOxlggYnIysveWIZ6H3PNdCrQ,11357
+sshkube-0.1.0.dist-info/METADATA,sha256=hYVO-ZLXQlaGNua0hLmgTDcus9MGu4jRfG0hUpNUyu0,2692
+sshkube-0.1.0.dist-info/WHEEL,sha256=b4K_helf-jlQoXBBETfwnf4B04YC67LOev0jo4fX5m8,88
+sshkube-0.1.0.dist-info/entry_points.txt,sha256=09SlnNuEa0NwCRcwrDW51pKMEmNyDUSn5GXlyHtKDlY,48
+sshkube-0.1.0.dist-info/RECORD,,

sshkube-0.1.0.dist-info/WHEEL

@@ -0,0 +1,4 @@
+Wheel-Version: 1.0
+Generator: poetry-core 2.1.3
+Root-Is-Purelib: true
+Tag: py3-none-any

sshkube-0.1.0.dist-info/entry_points.txt

@@ -0,0 +1,3 @@
+[console_scripts]
+sshkube=sshkube.__main__:cli
+