Install Relay Server on Kubernetes

Deploy Camouflage relay servers on Kubernetes for production-grade, scalable infrastructure.

Prerequisites

• Kubernetes cluster 1.19 or later
• kubectl configured
• Helm 3.0 or later (recommended)
• Ingress controller (nginx, traefik, etc.)
• cert-manager for SSL certificates (recommended)

Installation Methods

Option 1: Helm Chart (Recommended)

1. Add Helm Repository

helm repo add camouflage https://charts.camouflage.network
helm repo update

2. Create Values File

Create values.yaml:

relay:
  replicaCount: 3

  image:
    repository: camouflagenetworks/camouflage-relay
    tag: "latest"
    pullPolicy: IfNotPresent

  service:
    type: LoadBalancer
    quicPort: 61700
    httpsPort: 443

  resources:
    limits:
      cpu: 2000m
      memory: 4Gi
    requests:
      cpu: 1000m
      memory: 2Gi

  autoscaling:
    enabled: true
    minReplicas: 3
    maxReplicas: 10
    targetCPUUtilizationPercentage: 70

ingress:
  enabled: true
  className: nginx
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt-prod
  hosts:
    - host: relay.yourdomain.com
      paths:
        - path: /
          pathType: Prefix
  tls:
    - secretName: camouflage-relay-tls
      hosts:
        - relay.yourdomain.com

config:
  logLevel: info
  maxConnections: 10000
  metricsEnabled: true

monitoring:
  prometheus:
    enabled: true
    serviceMonitor:
      enabled: true

3. Install Chart

helm install camouflage-relay camouflage/relay \
  --namespace camouflage \
  --create-namespace \
  --values values.yaml

Option 2: Manual Deployment with Manifests

1. Create Namespace

kubectl create namespace camouflage

2. Create ConfigMap

Create relay-config.yaml:

apiVersion: v1
kind: ConfigMap
metadata:
  name: relay-config
  namespace: camouflage
data:
  relay.yaml: |
    server:
      listen_addr: "0.0.0.0:61700"
      public_addr: "relay.yourdomain.com:61700"
      max_connections: 10000

    tls:
      cert_file: "/etc/camouflage/ssl/tls.crt"
      key_file: "/etc/camouflage/ssl/tls.key"

    logging:
      level: "info"
      format: "json"

    metrics:
      enabled: true
      port: 9090

Apply:

kubectl apply -f relay-config.yaml

3. Create Deployment

Create relay-deployment.yaml:

apiVersion: apps/v1
kind: Deployment
metadata:
  name: camouflage-relay
  namespace: camouflage
  labels:
    app: camouflage-relay
spec:
  replicas: 3
  selector:
    matchLabels:
      app: camouflage-relay
  template:
    metadata:
      labels:
        app: camouflage-relay
    spec:
      containers:
      - name: relay
        image: camouflagenetworks/camouflage-relay:latest
        ports:
        - containerPort: 443
          name: https
          protocol: TCP
        - containerPort: 61700
          name: quic
          protocol: UDP
        - containerPort: 9090
          name: metrics
          protocol: TCP
        env:
        - name: RELAY_LOG_LEVEL
          value: "info"
        volumeMounts:
        - name: config
          mountPath: /etc/camouflage/config
        - name: tls
          mountPath: /etc/camouflage/ssl
          readOnly: true
        resources:
          limits:
            cpu: 2000m
            memory: 4Gi
          requests:
            cpu: 1000m
            memory: 2Gi
        livenessProbe:
          httpGet:
            path: /health
            port: 443
            scheme: HTTPS
          initialDelaySeconds: 30
          periodSeconds: 10
        readinessProbe:
          httpGet:
            path: /health
            port: 443
            scheme: HTTPS
          initialDelaySeconds: 5
          periodSeconds: 5
      volumes:
      - name: config
        configMap:
          name: relay-config
      - name: tls
        secret:
          secretName: camouflage-relay-tls

Apply:

kubectl apply -f relay-deployment.yaml

4. Create Service

Create relay-service.yaml:

apiVersion: v1
kind: Service
metadata:
  name: camouflage-relay
  namespace: camouflage
  labels:
    app: camouflage-relay
spec:
  type: LoadBalancer
  ports:
  - port: 443
    targetPort: 443
    protocol: TCP
    name: https
  - port: 61700
    targetPort: 61700
    protocol: UDP
    name: quic
  - port: 9090
    targetPort: 9090
    protocol: TCP
    name: metrics
  selector:
    app: camouflage-relay

Apply:

kubectl apply -f relay-service.yaml

5. Create Ingress

Create relay-ingress.yaml:

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: camouflage-relay
  namespace: camouflage
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt-prod
    nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
spec:
  ingressClassName: nginx
  tls:
  - hosts:
    - relay.yourdomain.com
    secretName: camouflage-relay-tls
  rules:
  - host: relay.yourdomain.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: camouflage-relay
            port:
              number: 443

Apply:

kubectl apply -f relay-ingress.yaml

SSL Certificate Management

Using cert-manager

1. Install cert-manager

kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.13.0/cert-manager.yaml

2. Create ClusterIssuer

apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt-prod
spec:
  acme:
    server: https://acme-v02.api.letsencrypt.org/directory
    email: admin@yourdomain.com
    privateKeySecretRef:
      name: letsencrypt-prod
    solvers:
    - http01:
        ingress:
          class: nginx

Apply:

kubectl apply -f cluster-issuer.yaml

Certificates will be automatically provisioned via the Ingress annotations.

Horizontal Pod Autoscaling

Create hpa.yaml:

apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
  name: camouflage-relay-hpa
  namespace: camouflage
spec:
  scaleTargetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: camouflage-relay
  minReplicas: 3
  maxReplicas: 10
  metrics:
  - type: Resource
    resource:
      name: cpu
      target:
        type: Utilization
        averageUtilization: 70
  - type: Resource
    resource:
      name: memory
      target:
        type: Utilization
        averageUtilization: 80

Apply:

kubectl apply -f hpa.yaml

Monitoring

Prometheus ServiceMonitor

apiVersion: monitoring.coreos.com/v1
kind: ServiceMonitor
metadata:
  name: camouflage-relay
  namespace: camouflage
  labels:
    app: camouflage-relay
spec:
  selector:
    matchLabels:
      app: camouflage-relay
  endpoints:
  - port: metrics
    interval: 30s
    path: /metrics

Management Commands

Check Deployment Status

kubectl get deployment -n camouflage
kubectl get pods -n camouflage
kubectl get svc -n camouflage

View Logs

# All pods
kubectl logs -n camouflage -l app=camouflage-relay -f

# Specific pod
kubectl logs -n camouflage <pod-name> -f

Scale Deployment

kubectl scale deployment camouflage-relay -n camouflage --replicas=5

Update Image

kubectl set image deployment/camouflage-relay \
  relay=camouflagenetworks/camouflage-relay:latest \
  -n camouflage

Rollback

kubectl rollout undo deployment/camouflage-relay -n camouflage

Troubleshooting

Check Pod Status

kubectl describe pod <pod-name> -n camouflage

Check Events

kubectl get events -n camouflage --sort-by='.lastTimestamp'

Access Pod Shell

kubectl exec -it <pod-name> -n camouflage -- /bin/sh

Check Service Endpoints

kubectl get endpoints -n camouflage

Production Best Practices

1. Resource Limits - Always set resource limits and requests
2. Multiple Replicas - Run at least 3 replicas for high availability
3. Pod Disruption Budget - Ensure availability during updates
4. Network Policies - Restrict traffic to necessary ports
5. Security Context - Run containers as non-root user
6. Persistent Logs - Configure log aggregation (ELK, Loki)
7. Monitoring - Enable Prometheus metrics and alerting

Next Steps

• Docker Installation
• Docker Compose Installation