Connection refused inside kubernetes cron jobs using snx vpn and paramiko sftp

369 Views Asked by At

I run a python script to download file via sftp using vpn snx vpn and sftp paramiko. I invoke the script via cronjobs,

Here are my cronjobs script:

apiVersion: batch/v1
kind: CronJob
metadata:
  name: file-uploader-a
  labels:
    app: file-uploader
spec:
  schedule: "*/1 0-10 * * *"
  jobTemplate:
    spec:
      parallelism: 1 # How many pods will be instantiated at once.
      completions: 1 # How many containers of the job are instantiated one after the other (sequentially) inside the pod.
      backoffLimit: 5 # Maximum pod restarts in case of failure
      template:
        spec:
          containers:
            - name: file-uploader-a
              image: image-a
              imagePullPolicy: IfNotPresent
              envFrom:
                - configMapRef:
                    name: file-env
                - secretRef:
                    name: file-secret
              securityContext:
                capabilities:
                  add:
                    - CAP_NET_ADMIN
                    - CAP_SYS_MODULE
              command:
                - sh
                - "-c"
                - ". /root/.venv/bin/activate && python -m python.module.a"
          restartPolicy: OnFailure
          terminationGracePeriodSeconds: 8

My Docker file

FROM ubuntu:18.04

ADD scripts/snx_install_800010013.sh /root
ADD scripts/SINAR33-exp-13May2022.pfx /root
ADD scripts/post_install.sh /root
ADD scripts/init_snx.sh /root

ADD requirements.txt /root
RUN cd root && mkdir bss_uploader
RUN cd root/bss_uploader && mkdir temp
ADD bss_uploader /root/bss_uploader

ARG SNX_SERVER
ARG FTP_HOST
ARG DEBIAN_FRONTEND=noninteractive

RUN dpkg --add-architecture i386 && apt-get update && \
  apt-get install bzip2 kmod libstdc++5:i386 \
  libpam0g:i386 libx11-6:i386 expect iptables \
  net-tools iputils-ping iproute2 python3-venv \
  linux-modules-5.4.0-1063-aws python3-pip \
  software-properties-common tmux openssh-client -y

RUN cd /usr/bin && ln -s python3 python

WORKDIR /root

RUN bash -x snx_install_800010013.sh
RUN bash -x post_install.sh $SNX_SERVER $FTP_HOST

post_install.sh script

#!/bin/bash

SNX_SERVER=$1
FTP_HOST=$2

mkdir ~/.ssh && touch ~/.ssh/config
echo -e "Host $FTP_HOST\n\tStrictHostKeyChecking no\n\nHost $SNX_SERVER\n\tStrictHostKeyChecking no" >> ~/.ssh/config
chmod 644 ~/.ssh/config

uname=$(uname -r)
mkdir /lib/modules/$uname

# move kernel modules installed to current
cp -a /lib/modules/5.4.0-1063-aws/. /lib/modules/$uname/

modprobe tun

python -m venv .venv

. .venv/bin/activate && pip install --upgrade pip && pip install -r requirements.txt

init_snx.sh script to init on first run

#!/bin/bash
iptables -t nat -A POSTROUTING -o tunsnx -j MASQUERADE
iptables -A FORWARD -i eth0 -j ACCEPT

SNX_SERVER=$1
SNX_PASSWORD=$2
SNX_COMMAND="snx -s $SNX_SERVER -c /root/SINAR33-exp-13May2022.pfx -g"

/usr/bin/expect <<EOF
spawn $SNX_COMMAND
expect "*?assword:"
send "$SNX_PASSWORD\r"
expect "*Do you accept*"
send "y\r"
expect "SNX - connected."
spawn sleep 4
expect "Waiting up to*"
spawn snx -d
expect "SNX - Disconnecting*"
spawn sleep 2
expect "Waiting up to*"
EOF

When I try to run the script via CronJobs, I got connection refused error while connecting to SFTP. Unable to connect to SFTP error via kubernetes cronjobs

But when i try to run manualy from docker-container (via cli docker container) i got succeed

docker run --name xt_up --cap-add=ALL -t -d image:latest

Connect to sftp to receive file is succeed from docker container

I already tried to add networkPolicies.egress but still got no luck enter image description here

could you please help me regarding this ? thank you and sorry for my bad english

0

There are 0 best solutions below