System Architecture#

Runabot Addon System & Access Control#

Runabot provides isolated sandboxed “addons” for bot connectivity, including the SSH Addon. Addons run in their own namespaces but share the cluster NetworkPolicy rules.

The SSH Jump Host Operator is integrated natively within runabot-api and manages BotSsh CustomResources in the cluster.

graph TD
    subgraph K8s Cluster
        User[[Developer/User]] -->|TCP:2222| SSHJumpHost(SSH Jump Host\nssh namespace)
        
        subgraph SSH Namespace
            SSHJumpHost -->|manages| SSHTokens[authorized_keys\nPID:1 Reconciler]
            SSHOperator(ssh-operator\nPID:1) -->|Reconciles| BotSshCRD((BotSsh CRD))
        end
        
        subgraph Runabot API
            APIServer(runabot-api) -->|RPC: CreateAddon| BotSshCRD
        end
        
        subgraph Bot Namespace
            SSHD(openssh-server\nTCP:18789 / TCP:2222)
            Bot(Bot Process)
            User -->|ProxyJump| SSHD
        end
        
        SSHJumpHost -->|TCP:2222| SSHD
    end

The Addon Operator strictly enforces the single instance rule so that a user may only deploy a single global jump host.