first commit

k8s/00-namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: tcp-echo

k8s/30-traefik-entrypoint.yaml

@@ -0,0 +1,23 @@
+# Traefik must have static entrypoints on 9098/9099 before IngressRouteTCP can use them.
+# This is the k3s way (Traefik is installed via the bundled Helm chart). Traefik restarts once when applied.
+# If Traefik was installed with plain Helm instead, use k8s/traefik-values.yaml with `helm upgrade`.
+apiVersion: helm.cattle.io/v1
+kind: HelmChartConfig
+metadata:
+  name: traefik
+  namespace: kube-system
+spec:
+  valuesContent: |-
+    ports:
+      tcpechoa:
+        port: 9098
+        expose:
+          default: true
+        exposedPort: 9098
+        protocol: TCP
+      tcpechob:
+        port: 9099
+        expose:
+          default: true
+        exposedPort: 9099
+        protocol: TCP

k8s/instance-a.yaml

@@ -0,0 +1,87 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: tcp-echo-a
+  namespace: tcp-echo
+  labels:
+    app: tcp-echo
+    instance: a
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: tcp-echo
+      instance: a
+  template:
+    metadata:
+      labels:
+        app: tcp-echo
+        instance: a
+    spec:
+      containers:
+        - name: tcp-echo
+          image: gitea.eitczech.com/public/tcp-echo-server:latest
+          imagePullPolicy: Always
+          env:
+            - name: PORT
+              value: "9098"
+            - name: INSTANCE_ID
+              value: "echo-a"
+          ports:
+            - name: tcp
+              containerPort: 9098
+              protocol: TCP
+          readinessProbe:
+            tcpSocket:
+              port: tcp
+            initialDelaySeconds: 2
+            periodSeconds: 5
+          livenessProbe:
+            tcpSocket:
+              port: tcp
+            initialDelaySeconds: 5
+            periodSeconds: 10
+          resources:
+            requests:
+              cpu: 20m
+              memory: 32Mi
+            limits:
+              cpu: 200m
+              memory: 128Mi
+          securityContext:
+            allowPrivilegeEscalation: false
+            runAsNonRoot: true
+            runAsUser: 1654
+            runAsGroup: 1654
+            capabilities:
+              drop: ["ALL"]
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: tcp-echo-a
+  namespace: tcp-echo
+spec:
+  type: ClusterIP
+  selector:
+    app: tcp-echo
+    instance: a
+  ports:
+    - name: tcp
+      port: 9098
+      targetPort: tcp
+      protocol: TCP
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRouteTCP
+metadata:
+  name: tcp-echo-a
+  namespace: tcp-echo
+spec:
+  entryPoints:
+    - tcpechoa
+  routes:
+    - match: HostSNI(`*`)
+      services:
+        - name: tcp-echo-a
+          port: 9098

k8s/instance-b.yaml

@@ -0,0 +1,87 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: tcp-echo-b
+  namespace: tcp-echo
+  labels:
+    app: tcp-echo
+    instance: b
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: tcp-echo
+      instance: b
+  template:
+    metadata:
+      labels:
+        app: tcp-echo
+        instance: b
+    spec:
+      containers:
+        - name: tcp-echo
+          image: gitea.eitczech.com/public/tcp-echo-server:latest
+          imagePullPolicy: Always
+          env:
+            - name: PORT
+              value: "9099"
+            - name: INSTANCE_ID
+              value: "echo-b"
+          ports:
+            - name: tcp
+              containerPort: 9099
+              protocol: TCP
+          readinessProbe:
+            tcpSocket:
+              port: tcp
+            initialDelaySeconds: 2
+            periodSeconds: 5
+          livenessProbe:
+            tcpSocket:
+              port: tcp
+            initialDelaySeconds: 5
+            periodSeconds: 10
+          resources:
+            requests:
+              cpu: 20m
+              memory: 32Mi
+            limits:
+              cpu: 200m
+              memory: 128Mi
+          securityContext:
+            allowPrivilegeEscalation: false
+            runAsNonRoot: true
+            runAsUser: 1654
+            runAsGroup: 1654
+            capabilities:
+              drop: ["ALL"]
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: tcp-echo-b
+  namespace: tcp-echo
+spec:
+  type: ClusterIP
+  selector:
+    app: tcp-echo
+    instance: b
+  ports:
+    - name: tcp
+      port: 9099
+      targetPort: tcp
+      protocol: TCP
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRouteTCP
+metadata:
+  name: tcp-echo-b
+  namespace: tcp-echo
+spec:
+  entryPoints:
+    - tcpechob
+  routes:
+    - match: HostSNI(`*`)
+      services:
+        - name: tcp-echo-b
+          port: 9099

k8s/kustomization.yaml

@@ -0,0 +1,7 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - 00-namespace.yaml
+  - 30-traefik-entrypoint.yaml
+  - instance-a.yaml
+  - instance-b.yaml

k8s/traefik-values.yaml

@@ -0,0 +1,14 @@
+# For non-k3s installs: helm upgrade traefik traefik/traefik -n <traefik-ns> --reuse-values -f k8s/traefik-values.yaml
+ports:
+  tcpechoa:
+    port: 9098
+    expose:
+      default: true
+    exposedPort: 9098
+    protocol: TCP
+  tcpechob:
+    port: 9099
+    expose:
+      default: true
+    exposedPort: 9099
+    protocol: TCP