DevOps/truecharts
2
0
Fork 0
Code Issues Pull Requests Actions 31 Packages Projects Releases 1 Wiki Activity

Fix remaining VPN addon issues (#1029)

Browse Source 
* Fix remaining VPN addon issues

* fix minor common-test issue
This commit is contained in:
Kjeld Schouten-Lebbing
2021-09-25 14:40:14 +02:00
committed by GitHub
parent c0aa278e27
commit 2db56c1e42
8 changed files with 99 additions and 44 deletions
Download Patch File Download Diff File Expand all files Collapse all files
charts/library/common/Chart.yaml
+1 -1
View File
@@ -15,4 +15,4 @@ maintainers:
name: common
sources: null
type: library
version: 8.0.0
version: 8.0.1
charts/library/common/templates/addons/vpn/openvpn/_container.tpl
+24
View File
@@ -6,6 +6,8 @@ name: openvpn
image: "{{ .Values.openvpnImage.repository }}:{{ .Values.openvpnImage.tag }}"
imagePullPolicy: {{ .Values.openvpnImage.pullPolicy }}
securityContext:
runAsUser: 0
runAsGroup: 0
capabilities:
add:
- NET_ADMIN
@@ -28,6 +30,28 @@ env:
value: {{ $v | quote }}
{{- end }}
{{- end }}
{{- if .Values.addons.vpn.killSwitch }}
- name: FIREWALL
value: "ON"
- name: ROUTE_1
value: "172.16.0.0/12"
{{- range $index, $value := .Values.addons.vpn.excludedNetworks_IPv4 }}
- name: ROUTE_{{ add $index 2 }}
value: {{ $value | quote }}
{{- end}}
{{- if .Values.addons.vpn.excludedNetworks_IPv6 }}
{{- $excludednetworksv6 := ""}}
{{- range .Values.addons.vpn.excludedNetworks_IPv4 }}
{{- $excludednetworksv6 = ( printf "%v;%v" $excludednetworksv6 . ) }}
{{- end}}
{{- range $index, $value := .Values.addons.vpn.excludedNetworks_IPv6 }}
- name: ROUTE6_{{ add $index 1 }}
value: {{ $value | quote }}
{{- end}}
{{- end }}
{{- end }}
{{- if or .Values.addons.vpn.openvpn.auth }}
envFrom:
- secretRef:
charts/library/common/templates/addons/vpn/openvpn/_secret.tpl
+7 -3
View File
@@ -2,7 +2,6 @@
The OpenVPN credentials secrets to be included.
*/}}
{{- define "common.addon.openvpn.secret" -}}
{{- with .Values.addons.vpn.openvpn.auth }}
---
apiVersion: v1
kind: Secret
@@ -11,6 +10,11 @@ metadata:
labels:
{{- include "common.labels" $ | nindent 4 }}
data:
VPN_AUTH: {{ . | b64enc }}
{{- end -}}
{{- $vpnauth := "" }}
{{- if .Values.addons.vpn.openvpn.username }}
{{- $vpnauth = ( printf "%v;%v" .Values.addons.vpn.openvpn.username .Values.addons.vpn.openvpn.password ) }}
{{- else }}
{{- $vpnauth = .Values.addons.vpn.openvpn.password }}
{{- end }}
VPN_AUTH: {{ $vpnauth | b64enc }}
{{- end -}}
charts/library/common/templates/addons/vpn/wireguard/_container.tpl
+13 -7
View File
@@ -34,16 +34,22 @@ env:
{{- end }}
{{- end }}
{{- if .Values.addons.vpn.wireguard.KILLSWITCH }}
{{- if .Values.addons.vpn.killSwitch }}
- name: KILLSWITCH
value: "true"
{{- if .Values.addons.vpn.wireguard.KILLSWITCH_EXCLUDEDNETWORKS_IPV4 }}
{{- $excludednetworksv4 := "172.16.0.0/12"}}
{{- range .Values.addons.vpn.excludedNetworks_IPv4 }}
{{- $excludednetworksv4 = ( printf "%v;%v" $excludednetworksv4 . ) }}
{{- end}}
- name: KILLSWITCH_EXCLUDEDNETWORKS_IPV4
value: {{ .Values.addons.vpn.wireguard.KILLSWITCH_EXCLUDEDNETWORKS_IPV4 | quote }}
{{- end }}
{{- if .Values.addons.vpn.wireguard.KILLSWITCH_EXCLUDEDNETWORKS_IPV6 }}
- name: KILLSWITCH_EXCLUDEDNETWORKS_IPV4
value: {{ .Values.addons.vpn.wireguard.KILLSWITCH_EXCLUDEDNETWORKS_IPV6 | quote }}
value: {{ $excludednetworksv4 | quote }}
{{- if .Values.addons.vpn.excludedNetworks_IPv6 }}
{{- $excludednetworksv6 := ""}}
{{- range .Values.addons.vpn.excludedNetworks_IPv4 }}
{{- $excludednetworksv6 = ( printf "%v;%v" $excludednetworksv6 . ) }}
{{- end}}
- name: KILLSWITCH_EXCLUDEDNETWORKS_IPV6
value: {{ .Values.addons.vpn.excludedNetworks_IPv6 | quote }}
{{- end }}
{{- end }}
charts/library/common/templates/lib/controller/_autopermissions.yaml
+5 -1
View File
@@ -27,8 +27,12 @@ before chart installation.
command:
- "/bin/sh"
- "-c"
- "echo 'Automatically correcting permissions...';{{ range $_, $hpm := $hostPathMounts }}chown -R :{{ $group }} {{ $hpm.mountPath | squote }}; chmod -R g+w {{ $hpm.mountPath | squote }};{{ end }}"
- "echo 'Automatically correcting permissions...';{{ if .Values.addons.vpn.configFile }}chown -R 568:568 /vpn/vpn.conf; chmod -R g+w /vpn/vpn.conf;{{ end }}{{ range $_, $hpm := $hostPathMounts }}chown -R :{{ $group }} {{ $hpm.mountPath | squote }}; chmod -R g+w {{ $hpm.mountPath | squote }};{{ end }}"
volumeMounts:
{{- if .Values.addons.vpn.configFile }}
- name: vpnconfig
mountPath: /vpn/vpn.conf
{{- end }}
{{- range $name, $hpm := $hostPathMounts }}
- name: {{ $name }}
mountPath: {{ $hpm.mountPath }}
charts/library/common/tests/persistentvolumeclaim_test.go
+1 -1
View File
@@ -81,7 +81,7 @@ func (suite *PersistenceVolumeClaimTestSuite) TestMetaData() {
"app.kubernetes.io/managed-by": "Helm",
"app.kubernetes.io/name": "common-test",
"app.kubernetes.io/version":"latest",
"helm.sh/chart": "common-test-3.1.2",
"helm.sh/chart": "common-test-3.1.3",
}
tests := map[string]struct {
charts/library/common/values.yaml
+8 -9
View File
@@ -698,15 +698,14 @@ addons:
# @default -- See below
openvpn:
# -- Credentials to connect to the VPN Service (used with -a)
auth: # "user;password"
# -- Optionally specify an existing secret that contains the credentials.
# Credentials should be stored under the `VPN_AUTH` key
authSecret: # my-vpn-secret
# Only using password is enough
username: ""
password: ""
killSwitch: true
excludedNetworks_IPv4: []
excludedNetworks_IPv6: []
wireguard:
KILLSWITCH: false
KILLSWITCH_EXCLUDEDNETWORKS_IPV4:
- 192.168.0.0.1
# -- Set the VPN container specific securityContext
# @default -- See values.yaml
securityContext: {}
@@ -725,7 +724,7 @@ addons:
# -- Provide a customized vpn configuration file to be used by the VPN.
configFile:
enabled: false
enabled: true
type: hostPath
# -- Which path on the host should be mounted.
hostPath: /vpn/vpn.conf