ssh-session-mcp/docs/examples/ssh-session-mcp.k8s.distributed.example.yaml at main · Zw-awa/ssh-session-mcp · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
# SPDX-FileCopyrightText: 2026 Zw-awa
# SPDX-License-Identifier: Apache-2.0

apiVersion: v1
kind: ConfigMap
metadata:
  name: ssh-session-mcp-distributed-config
data:
  ssh-session-mcp.config.json: |
    {
      "defaults": {
        "stateDir": "/workspace/state",
        "viewerHost": "0.0.0.0",
        "viewerPort": 8793,
        "viewerMode": "browser",
        "viewerSingletonScope": "connection",
        "autoOpenTerminal": false,
        "mode": "safe",
        "logMode": "stderr",
        "runtimeMode": "distributed",
        "store": "redis",
        "authMode": "proxy",
        "trustProxy": true,
        "authUserHeader": "x-forwarded-user",
        "authRoleHeader": "x-forwarded-role"
      },
      "defaultDevice": "DEVICE_A_ID",
      "devices": [
        {
          "id": "DEVICE_A_ID",
          "label": "Distributed Kubernetes Target",
          "host": "DEVICE_A_HOST",
          "port": 22,
          "user": "DEVICE_A_USER",
          "auth": {
            "passwordEnv": "DEVICE_A_PASSWORD"
          }
        }
      ]
    }
---
apiVersion: v1
kind: Secret
metadata:
  name: ssh-session-mcp-distributed-secrets
type: Opaque
stringData:
  DEVICE_A_PASSWORD: change-me
  SSH_MCP_REDIS_URL: redis://redis.default.svc.cluster.local:6379/0
---
apiVersion: v1
kind: Service
metadata:
  name: ssh-session-mcp-distributed
spec:
  selector:
    app: ssh-session-mcp-distributed
  ports:
    - name: viewer
      port: 8793
      targetPort: 8793
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: ssh-session-mcp-distributed
spec:
  replicas: 2
  selector:
    matchLabels:
      app: ssh-session-mcp-distributed
  template:
    metadata:
      labels:
        app: ssh-session-mcp-distributed
    spec:
      containers:
        - name: ssh-session-mcp
          image: docker.io/zwawa/ssh-session-mcp:latest
          imagePullPolicy: IfNotPresent
          env:
            - name: SSH_MCP_CONFIG
              value: /workspace/ssh-session-mcp.config.json
            - name: SSH_MCP_STATE_DIR
              value: /workspace/state
            - name: SSH_MCP_RUNTIME_MODE
              value: distributed
            - name: SSH_MCP_STORE
              value: redis
            - name: SSH_MCP_NODE_ID
              valueFrom:
                fieldRef:
                  fieldPath: metadata.name
            - name: SSH_MCP_PUBLIC_BASE_URL
              value: https://ssh-mcp.example.com
            - name: SSH_MCP_AUTH_MODE
              value: proxy
            - name: SSH_MCP_TRUST_PROXY
              value: "true"
            - name: SSH_MCP_AUTH_USER_HEADER
              value: x-forwarded-user
            - name: SSH_MCP_AUTH_ROLE_HEADER
              value: x-forwarded-role
            - name: SSH_MCP_LOG_MODE
              value: stderr
            - name: VIEWER_PORT
              value: "8793"
            - name: VIEWER_HOST
              value: 0.0.0.0
          envFrom:
            - secretRef:
                name: ssh-session-mcp-distributed-secrets
          ports:
            - containerPort: 8793
              name: viewer
          readinessProbe:
            httpGet:
              path: /readyz
              port: viewer
            initialDelaySeconds: 5
            periodSeconds: 10
          livenessProbe:
            httpGet:
              path: /livez
              port: viewer
            initialDelaySeconds: 10
            periodSeconds: 20
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            capabilities:
              drop:
                - ALL
          volumeMounts:
            - name: config
              mountPath: /workspace/ssh-session-mcp.config.json
              subPath: ssh-session-mcp.config.json
              readOnly: true
            - name: state
              mountPath: /workspace/state
            - name: tmp
              mountPath: /tmp
      volumes:
        - name: config
          configMap:
            name: ssh-session-mcp-distributed-config
        - name: state
          emptyDir: {}
        - name: tmp
          emptyDir: {}

# Notes:
# - Put a trusted reverse proxy or ingress in front of this Deployment and configure it
#   to inject x-forwarded-user and x-forwarded-role before requests reach the pods.
# - Distributed v0 does not proxy cross-node traffic. Route REMOTE_OWNER requests to the
#   owner node URL returned by the application.