Allow tunnel to ssh ports

[lalyos]

I wondered if its possible to expose both http and ssh ports of a pod.
In my case I deployed gitea which has both.

After making the tunnel work by manually changing the tunnel configuration, I figgured what was missing:

• in case of http(s) protocol the path make sense
• for ssh (and probably for tcp) type it shouldn't be set

With a simple check I made the controller successfully expose my gitea ssh service via a cloudflare tunnel.

Example

Here is an ingress with all details:

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    cloudflare-tunnel-ingress-controller.strrl.dev/backend-protocol: "ssh"
  name: gitea-ssh
  namespace: gitea
spec:
  ingressClassName: cloudflare-tunnel
  rules:
  - host: ssh.mydomain.com
    http:
      paths:
        - path: '/*'
          pathType: ImplementationSpecific
          backend:
            service:
              name: gitea-ssh
              port:
                number: 2222

I was using the official helm chart to deploy gitea, and first the svc had a couple of issue:

• it was headless (ClusteIp: None) which is not supported
• there was a port mapping 22->2222 (port:22, targetPort:2222) which is convenient inside the cluster, so one can ssh with a servicename, skipping the port spec, but it did not work

The final relevant chart values to fix the service:

helm upgrade -i  \
  gitea \
  --repo https://dl.gitea.io/charts  \
  gitea \
  --version 10.6.0 \
  --namepace gitea \
  --create-namespace \
  --values values-gitea.yaml

The content of values-gitea.yaml

service:
  http:
    clusterIP:
  ssh:
    clusterIP:
    port: 2222
    targetPort: 2222

[lalyos]

In case somebody want to test it, I've pushed my image to dockerhub.

helm upgrade -i \
  cf-tunnel \
  --repo https://helm.strrl.dev cloudflare-tunnel-ingress-controller \
  --namespace cloudflare-ingress \
  --create-namespace \
  --values values-cf-tunnel.yaml

Where values-cf-tunnel.yaml:

image:
  repository: lalyos/cloudflare-tunnel-ingress-controller

cloudflare:
  accountId: 888888888888faeb6fd019aaaaaa
  apiToken: qYBe_khasdkjhasdakhsdCPPU
  tunnelName: k8s-ssh-ing
ingressClass:
  name: cloudflare-tunnel
  isDefaultClass: true

[STRRL]

Closing in favor of a fresh implementation: the idea is right (non-HTTP protocols like ssh/tcp must not carry a path in the tunnel rule), but this branch predates large changes to transform.go and only handles ssh. We are landing a generalized version that omits Path for all non-http(s) backend protocols, with tests — credit to this PR for identifying the issue. Thanks @lalyos!