lensapp / bored-agent

BoreD Agent

Agent for BoreD tunnel daemon.

How to make a new release

1. Bump the version in package.json
2. Create a PR and get it merged to main
3. Switch to main branch on your local machine and get the latest
4. Tag it: git tag v0.5.0
5. Push the tag: git push origin v0.5.0

License

Copyright (c) 2021 Mirantis, Inc.

Licensed under the MIT license.

bored-agent's Issues

[Feature Request] Wrap bored-agent in a helm chart

Currently the only supported method to add a the bored-agent to a cluster for Lens Connect is through the Lens Desktop App. The kubernetes directory does not include all of the components that are deployed on a cluster in the lens-platform namespace. To fix this, a helm chart would work with the resources that are already there and also include the one time jobs that run on initial deployment of the bored-agent.

DNS broken in kubernetes version 1.21.14

Setup:

• Mac iOS M1
• Lens: 6.0.2-latest.20220908.1

Steps to reproduce:

• Enable Lens Teamwork (Lens Pro subscription)
• Create new space
• Start/Run locally ldk with Kubernetes version1.21.14
• Switch to created space using space switcher on top right
• Try adding ldk to space
• Error message:

[2022-09-09 12:08:27.092 +0000] INFO: [MAIN] ~~ BoreD Agent v0.8.0 ~~
[2022-09-09 12:08:46.506 +0000] INFO: [MAIN] ~~ BoreD Agent v0.8.0 ~~
[2022-09-09 12:09:04.639 +0000] ERROR: [MAIN] failed to create certificates Error: failed to read cert secret: RequestError: getaddrinfo EAI_AGAIN kubernetes.default.svc

Reported by @msa0311
It's working on my windows system

Add impersonation

Close TLS sockets when websocket disconnects

Configure bored agent to use a proxy

Configure bored agent to use a proxy

Using Space's teams as user groups

Would be great if I could just create a Team, put some user on it and create a ClusterRoleBinding for the team's group, instead of adding the users on the RBAC separately. I don't know if this feature already exists but I didn't found about it on the docs.

TCP streams should be disabled by default

TCP stream capability is a bit unexpected, it should be only available if enabled via env.

Unhandled error in sendAfterClose

This error causes the pod to restart.

Retry fetching bored-server public key

It seems to be tried to be fetched only once, which could cause the agent being stuck if the first fetch fails.

Add some retries to the fetching.

https://github.com/lensapp/bored-agent/blob/main/src/agent-proxy.ts#L104

Latest release (0.7.0) is missing image

Probably a bug in GHA config.

Agent is crashing if kubernetes api closes the socket in the middle of writing

events.js:352
      throw er; // Unhandled 'error' event
      ^

Error [ERR_STREAM_WRITE_AFTER_END]: write after end
    at TLSSocket.Writable.write (internal/streams/writable.js:292:11)
    at StreamImpersonator.ondata (internal/streams/readable.js:726:22)
    at StreamImpersonator.emit (events.js:375:28)
    at addChunk (internal/streams/readable.js:290:12)
    at readableAddChunk (internal/streams/readable.js:265:9)
    at StreamImpersonator.Readable.push (internal/streams/readable.js:204:10)
    at StreamImpersonator.Transform.push (internal/streams/transform.js:166:32)
    at StreamImpersonator._transform (/app/dist/src/stream-impersonator.js:69:22)
    at StreamImpersonator.Transform._read (internal/streams/transform.js:205:10)
    at StreamImpersonator.Transform._write (internal/streams/transform.js:193:12)
Emitted 'error' event on TLSSocket instance at:
    at TLSSocket.onerror (internal/streams/readable.js:745:14)
    at TLSSocket.emit (events.js:375:28)
    at emitErrorNT (internal/streams/destroy.js:106:8)
    at processTicksAndRejections (internal/process/task_queues.js:82:21) {
  code: 'ERR_STREAM_WRITE_AFTER_END'
}

Validate token audience

Jwt token aud should match to connected BoreD server address.

Whitelist IPs

• Example implementation: craigbthompson@a87dbc0 (but needs x-forwarded-for)
• Note: ensure the environment variable is not lost during auto update, see https://app.k8slens.dev/bored-agent/v2/bored-agent.yml