https://rdc-incubator.github.io/kt-docs/#/
https://alibaba.github.io/kt-connect/#/zh-cn/
https://github.com/alibaba/kt-connect
https://my.oschina.net/u/4494662/blog/4667485
https://developer.aliyun.com/article/751321?scm=20140722.184.2.173

权限：

  1. # permissions for ktctl command
  2. apiVersion: rbac.authorization.k8s.io/v1
  3. kind: ClusterRole
  4. metadata:
  5.   name: kt:ns:dev
  6. rules:
  7. - apiGroups:
  8.   - ""
  9.   resources:
  10.   - pods
  11.   - pods/exec
  12.   - pods/portforward
  13.   - pods/proxy
  14.   verbs:
  15.   - create
  16.   - delete
  17.   - deletecollection
  18.   - get
  19.   - list
  20.   - patch
  21.   - update
  22.   - watch
  23. - apiGroups:
  24.   - ""
  25.   resources:
  26.   - configmaps
  27.   - services
  28.   - services/proxy
  29.   verbs:
  30.   - create
  31.   - delete
  32.   - deletecollection
  33.   - get
  34.   - list
  35.   - patch
  36.   - update
  37.   - watch
  38. - apiGroups:
  39.   - ""
  40.   resources:
  41.   - events
  42.   - namespaces/status
  43.   - pods/status
  44.   verbs:
  45.   - get
  46.   - list
  47.   - watch
  48. - apiGroups:
  49.   - ""
  50.   resources:
  51.   - namespaces
  52.   - nodes
  53.   verbs:
  54.   - get
  55.   - list
  56.   - watch
  57. - apiGroups:
  58.   - apps
  59.   resources:
  60.   - deployments
  61.   - deployments/rollback
  62.   - deployments/scale
  63.   verbs:
  64.   - create
  65.   - delete
  66.   - deletecollection
  67.   - get
  68.   - list
  69.   - patch
  70.   - update
  71.   - watch
  72. - apiGroups:
  73.   - extensions
  74.   resources:
  75.   - deployments
  76.   - deployments/rollback
  77.   - deployments/scale
  78.   verbs:
  79.   - create
  80.   - delete
  81.   - deletecollection
  82.   - get
  83.   - list
  84.   - patch
  85.   - update
  86.   - watch
  1. [root@liwm .kube]# ktctl connect --method=vpn
  2. 12:05AM INF Connect Start At 485
  3. 12:05AM INF Client address 192.168.61.150
  4. 12:05AM INF deploy shadow deployment kt-connect-daemon-hwvyz in namespace default
  6. 12:05AM INF pod label: kt=kt-connect-daemon-hwvyz
  7. 12:05AM INF pod: kt-connect-daemon-hwvyz-7c9c885f97-5vwdq is running,but not ready
  8. 12:05AM INF pod: kt-connect-daemon-hwvyz-7c9c885f97-5vwdq is running,but not ready
  9. 12:05AM INF Shadow pod: kt-connect-daemon-hwvyz-7c9c885f97-5vwdq is ready.
  10. Forwarding from 127.0.0.1:2222 -> 22
  11. Forwarding from [::1]:2222 -> 22
  12. 12:05AM INF port-forward start at pid: 500
  13. Traceback (most recent call last):
  14.   File "/usr/bin/sshuttle", line 5, in <module>
  15.     from sshuttle.cmdline import main
  16.   File "/usr/lib/python2.7/site-packages/sshuttle/cmdline.py", line 5, in <module>
  17.     import sshuttle.client as client
  18.   File "/usr/lib/python2.7/site-packages/sshuttle/client.py", line 302
  19.     assert(not re.search(rb'[^-\w\.]', hostname))
  20.                                     ^
  21. SyntaxError: invalid syntax
  22. 12:05AM INF vpn(sshuttle) start at pid: 514
  23. 12:05AM INF KT proxy start successful
  24. 12:05AM INF vpn(sshuttle) finished
#
  1. [root@UR-20210425NAMA home]# ktctl --debug --image=192.168.13.79:6278/base-image/kt-connect-shadow --namespace=ur-ks-test connect --method=socks5
  2. 10:17AM INF Connect Start At 3390
  3. 10:17AM INF Client address 10.0.51.172
  4. 10:17AM INF deploy shadow deployment kt-connect-daemon-baxis in namespace ur-ks-test
  6. 10:17AM INF pod label: kt=kt-connect-daemon-baxis
  7. 10:17AM INF pod: kt-connect-daemon-baxis-6bb69548c-kc96j is running,but not ready
  8. 10:17AM INF pod: kt-connect-daemon-baxis-6bb69548c-kc96j is running,but not ready
  9. 10:17AM INF pod: kt-connect-daemon-baxis-6bb69548c-kc96j is running,but not ready
  10. 10:17AM INF pod: kt-connect-daemon-baxis-6bb69548c-kc96j is running,but not ready
  11. 10:17AM INF Shadow pod: kt-connect-daemon-baxis-6bb69548c-kc96j is ready.
  12. 10:17AM DBG Child, os.Args = [ktctl --debug --image=192.168.13.79:6278/base-image/kt-connect-shadow --namespace=ur-ks-test connect --method=socks5]
  13. 10:17AM DBG Child, cmd.Args = [kubectl --kubeconfig=/root/.kube/config -n ur-ks-test port-forward kt-connect-daemon-baxis-6bb69548c-kc96j 2222:22]
  14. Forwarding from 127.0.0.1:2222 -> 22
  15. Forwarding from [::1]:2222 -> 22
  16. 10:17AM INF port-forward start at pid: 3411
  17. 10:17AM INF ==============================================================
  18. 10:17AM INF Start SOCKS5 Proxy: export http_proxy=socks5://127.0.0.1:2223
  19. 10:17AM INF ==============================================================
  20. 10:17AM DBG Child, os.Args = [ktctl --debug --image=192.168.13.79:6278/base-image/kt-connect-shadow --namespace=ur-ks-test connect --method=socks5]
  21. 10:17AM DBG Child, cmd.Args = [ssh -oStrictHostKeyChecking=no -oUserKnownHostsFile=/dev/null -i /root/.kt_id_rsa -D 2223 root@127.0.0.1 -p2222 sh loop.sh]
  22. Handling connection for 2222
  23. Warning: Permanently added '[127.0.0.1]:2222' (ECDSA) to the list of known hosts.
  24. 10:17AM INF vpn(ssh) start at pid: 3432
  25. 10:17AM INF KT proxy start successful