- Go 68.8%
- Dockerfile 18.4%
- Shell 7.6%
- Go Template 5.2%
| Filename | Latest commit message | Latest commit date |
|---|---|---|
Mikhail Lukianchenko
1664a08500
All checks were successful
release / pin (push) Has been skipped
test / chart (push) Successful in 7s
release / plan (push) Successful in 3s
test / go (push) Successful in 11s
release / image (push) Successful in 10s
release / chart (push) Successful in 6s
release / release (push) Successful in 1s
The chart goes to oci://sarak.sh/mikluko/charts/kuberex rather than next
to the image: a chart named kuberex pushed beside it would take the
image's own reference, sarak.sh/mikluko/kuberex:<version>. charts/ is the
path the other sarak.sh charts use.
stateVolume defaults to empty, with the template falling back to an
emptyDir: a default emptyDir would merge with a hostPath set in values and
render a volume with two sources.
kubeconform cannot compile the Cilium schema from the CRDs catalog (Go's
regexp rejects its \uXXXX escapes) and reports it as missing, so CI
rewrites them to \x{XXXX} before validating.
For [Helm chart for kuberex](#12).
Reviewed-on: #15
|
||
| .forgejo/workflows | ||
| apt | ||
| chart | ||
| cmd/record-base-bump | ||
| rootfs/usr/local/bin | ||
| .dockerignore | ||
| .gitignore | ||
| CHANGELOG.md | ||
| Dockerfile | ||
| go.mod | ||
| go.sum | ||
| README.md | ||
kuberex
kuberex is the wiring that runs the Superlogical Rex server on Kubernetes.
It ships as the container image sarak.sh/mikluko/kuberex, for linux/amd64 and linux/arm64.
What the image holds
The image is built on debian:trixie and installs two packages at versions pinned in the Dockerfile:
| Package | Apt channel | Pin |
|---|---|---|
rex |
snapshot at https://pkgs.superlogical.com/rex/apt |
REX_VERSION |
claude-code |
stable at https://downloads.claude.ai/claude-code/apt |
CLAUDE_CODE_VERSION |
A new Rex or Claude Code version reaches the pod as a new image release.
Run it
The container runs as rex (uid and gid 999) and starts the Rex server on the tailnet as an embedded Tailscale node.
It needs no added capabilities, and the server starts on a read-only root filesystem when these paths are writable:
| Path | Holds |
|---|---|
/var/lib/rex |
Rex state, the tailnet node state and the home of rex |
/run/rex |
the server sockets |
The server takes its tailnet settings from the environment:
| Variable | Meaning |
|---|---|
TS_HOSTNAME |
tailnet hostname, default kuberex |
TS_AUTHKEY_FILE |
file holding a one-time join key |
TS_CONTROL_URL |
control server, default Tailscale's |
Deploy it with Helm
The chart oci://sarak.sh/mikluko/charts/kuberex is released with the image, at the same version, and runs one server pod as above.
values.yaml in chart/ documents every value; these are the ones a deployment sets:
| Value | Meaning |
|---|---|
stateVolume |
volume source of /var/lib/rex, default an emptyDir |
tailscale.hostname |
TS_HOSTNAME |
tailscale.controlURL |
TS_CONTROL_URL |
tailscale.authKey.existingSecret |
Secret with the join key, mounted as TS_AUTHKEY_FILE |
networkPolicy.enabled |
CiliumNetworkPolicy: egress to DNS, kube-apiserver and world |
nodeSelector, tolerations |
placement of the pod |
helm install rex oci://sarak.sh/mikluko/charts/kuberex --version 0.4.0 \
--set tailscale.authKey.existingSecret=rex-tailscale \
--set stateVolume.hostPath.path=/srv/rex