bbdrummer/sshfs-mount-k8s

By bbdrummer

•Updated 8 months ago

SSHFS Mount for k8s - Alpine-based image to help mounting remote directories via SSHFS in k8s pods

Image

Networking

Databases & storage

1.0K

Overview Tags

bbdrummer/sshfs-mount-k8s repository overview

⁠SSHFS Mount for Kubernetes

A lightweight Alpine-based Docker image for mounting remote directories via SSHFS in Kubernetes pods.

⁠Features

✅ Lightweight: Based on Alpine Linux (~10MB)
✅ Secure: SSH key authentication only
✅ Auto-reconnect: Handles network interruptions gracefully
✅ Health checks: Continuous mount verification
✅ Configurable: Environment variables for all settings
✅ Production-ready: Proper error handling and logging

⁠Usage

⁠Environment Variables

Variable	Required	Default	Description
`REMOTE_HOST`	Yes	-	SSH server hostname or IP
`REMOTE_USER`	Yes	-	SSH username
`REMOTE_PATH`	Yes	-	Remote directory path to mount
`MOUNT_POINT`	No	`/books`	Local mount point
`SSH_KEY_PATH`	No	`/ssh-key/ssh-privatekey`	Path to SSH private key
`SSHFS_OPTIONS`	No	See below	SSHFS mount options

Default SSHFS Options:

allow_other,default_permissions,ro,reconnect,ServerAliveInterval=15,ServerAliveCountMax=3

⁠Kubernetes Deployment Example

apiVersion: apps/v1
kind: Deployment
metadata:
  name: ebook-browser
  namespace: ebook-browser
spec:
  replicas: 1
  selector:
    matchLabels:
      app: ebook-browser
  template:
    metadata:
      labels:
        app: ebook-browser
    spec:
      securityContext:
        fsGroup: 1001
      
      initContainers:
        - name: sshfs-mount
          image: bbdrummer/sshfs-mount-k8s:latest
          securityContext:
            privileged: true
            capabilities:
              add:
                - SYS_ADMIN
          env:
            - name: REMOTE_HOST
              value: "your-server.com"
            - name: REMOTE_USER
              value: "bookuser"
            - name: REMOTE_PATH
              value: "/data/ebooks"
            - name: MOUNT_POINT
              value: "/books"
          volumeMounts:
            - name: books
              mountPath: /books
              mountPropagation: Bidirectional
            - name: ssh-key
              mountPath: /ssh-key
              readOnly: true
      
      containers:
        - name: ebook-browser
          image: your-app:latest
          volumeMounts:
            - name: books
              mountPath: /books
              readOnly: true
      
      volumes:
        - name: books
          emptyDir: {}
        - name: ssh-key
          secret:
            secretName: ebook-ssh-key
            defaultMode: 0600

⁠Creating SSH Secret

# Generate SSH key pair
ssh-keygen -t ed25519 -f ebook-ssh-key -N "" -C "ebook-browser@kubernetes"

# Add public key to remote server
ssh-copy-id -i ebook-ssh-key.pub [email protected]

# Create Kubernetes secret
kubectl create secret generic ebook-ssh-key \
  --from-file=ssh-privatekey=ebook-ssh-key \
  --namespace=ebook-browser

# Clean up local keys
rm ebook-ssh-key ebook-ssh-key.pub

⁠Building Locally

docker build -t sshfs-mount-k8s:latest .
docker run --rm --privileged \
  -e REMOTE_HOST=your-server.com \
  -e REMOTE_USER=user \
  -e REMOTE_PATH=/data \
  -v /path/to/ssh-key:/ssh-key:ro \
  sshfs-mount-k8s:latest

⁠Troubleshooting

⁠Mount fails with "Permission denied"

Ensure SSH key is properly added to remote server's authorized_keys
Check file permissions on the SSH key (should be 600)
Verify the remote user has access to the remote path

⁠Mount disappears after some time

Check network connectivity between pod and SSH server
Increase ServerAliveInterval and ServerAliveCountMax values
Review pod logs for connection errors

⁠"Operation not permitted" errors

Ensure the container has privileged: true security context
Add SYS_ADMIN capability if privileged mode is restricted

⁠Checking logs

# Check init container logs
kubectl logs -n ebook-browser deployment/ebook-browser -c sshfs-mount

# Check if mount is active
kubectl exec -n ebook-browser deployment/ebook-browser -c ebook-browser -- mountpoint /books

⁠Security Considerations

⚠️ Requires privileged mode for FUSE mounting
🔒 Use dedicated SSH user with minimal permissions
🔑 Store SSH keys in Kubernetes Secrets only
🔐 Consider using ro (read-only) mount option
🔥 Implement network policies to restrict SSH access
📝 Rotate SSH keys regularly

⁠Production Recommendations

Use read-only mounts (ro option) when possible
Single replica: SSHFS is not designed for concurrent mounts from multiple pods
Dedicated SSH user: Create a user with chroot jail and restricted permissions
Monitor mount health: Set up alerts for mount failures
Connection pooling: Use SSH ControlMaster for better performance
Network reliability: Ensure stable, low-latency connection to SSH server

⁠License

Same as the parent project.

Tag summary

Recent tags

Content type