DevOps/truecharts
2
0
Fork 0
Code Issues Pull Requests Actions 12 Packages Projects Releases 1 Wiki Activity

feat: have VPN use a hostPath for the configfile instead of configmap (#953)

Browse Source 
* feat: have VPN use a hostPath for the configfile instead of configmap

* whoopsies

* fix some tests and actually append configFile mount to persistence

* addon -> addons
This commit is contained in:
Kjeld Schouten-Lebbing
2021-09-10 14:07:50 +02:00
committed by GitHub
parent 76d1d303fd
commit 3c8418b803
7 changed files with 23 additions and 153 deletions
Download Patch File Download Diff File Expand all files Collapse all files
charts/library/common/templates/addons/vpn/_secret.tpl
-19
View File
@@ -1,19 +0,0 @@
{{/*
The OpenVPN config secret to be included.
*/}}
{{- define "common.addon.vpn.secret" -}}
{{- if and .Values.addons.vpn.configFile (not .Values.addons.vpn.configFileSecret) }}
---
apiVersion: v1
kind: Secret
metadata:
name: {{ include "common.names.fullname" . }}-vpnconfig
labels:
{{- include "common.labels" $ | nindent 4 }}
stringData:
{{- with .Values.addons.vpn.configFile }}
vpnConfigfile: |-
{{- . | nindent 4}}
{{- end }}
{{- end -}}
{{- end -}}
charts/library/common/templates/addons/vpn/_vpn.tpl
+1 -5
View File
@@ -18,11 +18,7 @@ It will include / inject the required templates based on the given values.
{{- $configmap | nindent 0 -}}
{{- end -}}
{{/* Include the secret if not empty */}}
{{- $secret := include "common.addon.vpn.secret" . -}}
{{- if $secret -}}
{{- $secret | nindent 0 -}}
{{- end -}}
{{- $_ := set .Values.persistence "vpnConfig" .Values.addons.vpn.configFile -}}
{{/* Append the vpn scripts volume to the volumes */}}
{{- $scriptVolume := include "common.addon.vpn.scriptsVolumeSpec" . | fromYaml -}}
charts/library/common/templates/addons/vpn/openvpn/_container.tpl
+2 -7
View File
@@ -25,9 +25,9 @@ envFrom:
name: {{ include "common.names.fullname" . }}-openvpn
{{- end }}
{{- end }}
{{- if or .Values.addons.vpn.configFile .Values.addons.vpn.configFileSecret .Values.addons.vpn.scripts.up .Values.addons.vpn.scripts.down .Values.addons.vpn.additionalVolumeMounts .Values.persistence.shared.enabled }}
{{- if or .Values.addons.vpn.configFile .Values.addons.vpn.scripts.up .Values.addons.vpn.scripts.down .Values.addons.vpn.additionalVolumeMounts .Values.persistence.shared.enabled }}
volumeMounts:
{{- if or .Values.addons.vpn.configFile .Values.addons.vpn.configFileSecret }}
{{- if or .Values.addons.vpn.configFile }}
- name: vpnconfig
mountPath: /vpn/vpn.conf
subPath: vpnConfigfile
@@ -42,14 +42,9 @@ volumeMounts:
mountPath: /vpn/down.sh
subPath: down.sh
{{- end }}
{{- if .Values.persistence.shared.enabled }}
- mountPath: {{ .Values.persistence.shared.mountPath }}
name: shared
{{- end }}
{{- with .Values.addons.vpn.additionalVolumeMounts }}
{{- toYaml . | nindent 2 }}
{{- end }}
{{- end }}
{{- with .Values.addons.vpn.livenessProbe }}
livenessProbe:
{{- toYaml . | nindent 2 }}
charts/library/common/templates/addons/vpn/wireguard/_container.tpl
+2 -7
View File
@@ -16,9 +16,9 @@ env:
value: {{ $v | quote }}
{{- end }}
{{- end }}
{{- if or .Values.addons.vpn.configFile .Values.addons.vpn.configFileSecret .Values.addons.vpn.scripts.up .Values.addons.vpn.scripts.down .Values.addons.vpn.additionalVolumeMounts .Values.persistence.shared.enabled }}
{{- if or .Values.addons.vpn.configFile .Values.addons.vpn.scripts.up .Values.addons.vpn.scripts.down .Values.addons.vpn.additionalVolumeMounts .Values.persistence.shared.enabled }}
volumeMounts:
{{- if or .Values.addons.vpn.configFile .Values.addons.vpn.configFileSecret }}
{{- if or .Values.addons.vpn.configFile }}
- name: vpnconfig
mountPath: /etc/wireguard/wg0.conf
subPath: vpnConfigfile
@@ -33,14 +33,9 @@ volumeMounts:
mountPath: /config/down.sh
subPath: down.sh
{{- end }}
{{- if .Values.persistence.shared.enabled }}
- mountPath: {{ .Values.persistence.shared.mountPath }}
name: shared
{{- end }}
{{- with .Values.addons.vpn.additionalVolumeMounts }}
{{- toYaml . | nindent 2 }}
{{- end }}
{{- end }}
{{- with .Values.addons.vpn.livenessProbe }}
livenessProbe:
{{- toYaml . | nindent 2 }}
charts/library/common/tests/addon_vpn_test.go
-65
View File
@@ -62,68 +62,3 @@ func (suite *AddonVpnTestSuite) TestContainer() {
})
}
}
func (suite *AddonVpnTestSuite) TestConfiguration() {
tests := map[string]struct {
values []string
expectSecret bool
expectedSecretName string
}{
"InlineConfig": {values: append(suite.baseValues, "addons.vpn.configFile=test"), expectSecret: true, expectedSecretName: "common-test-vpnconfig"},
"ExistingSecret": {values: append(suite.baseValues, "addons.vpn.configFileSecret=test-secret"), expectSecret: false, expectedSecretName: "test-secret"},
}
for name, tc := range tests {
suite.Suite.Run(name, func() {
err := suite.Chart.Render(nil, tc.values, nil)
if err != nil {
suite.FailNow(err.Error())
}
secretManifest := suite.Chart.Manifests.Get("Secret", tc.expectedSecretName)
if tc.expectSecret {
suite.Assertions.NotEmpty(secretManifest)
} else {
suite.Assertions.Empty(secretManifest)
}
deploymentManifest := suite.Chart.Manifests.Get("Deployment", "common-test")
suite.Assertions.NotEmpty(deploymentManifest)
containers := deploymentManifest.Path("spec.template.spec.containers").Children()
var vpnContainer *gabs.Container
for _, container := range containers {
containerName := container.Path("name").Data().(string)
if containerName == "openvpn" {
vpnContainer = container
break
}
}
suite.Assertions.NotEmpty(vpnContainer)
volumeMounts := vpnContainer.Path("volumeMounts").Children()
var vpnConfigVolumeMount *gabs.Container
for _, volumeMount := range volumeMounts {
volumeMountName := volumeMount.Path("name").Data().(string)
if volumeMountName == "vpnconfig" {
vpnConfigVolumeMount = volumeMount
break
}
}
suite.Assertions.NotEmpty(vpnConfigVolumeMount)
suite.Assertions.EqualValues("/vpn/vpn.conf", vpnConfigVolumeMount.Path("mountPath").Data())
suite.Assertions.EqualValues("vpnConfigfile", vpnConfigVolumeMount.Path("subPath").Data())
volumes := deploymentManifest.Path("spec.template.spec.volumes").Children()
var vpnConfigVolume *gabs.Container
for _, volume := range volumes {
volumeName := volume.Path("name").Data().(string)
if volumeName == "vpnconfig" {
vpnConfigVolume = volume
break
}
}
suite.Assertions.NotEmpty(vpnConfigVolume)
})
}
}
charts/library/common/tests/pod_test.go
+2 -2
View File
@@ -138,7 +138,7 @@ func (suite *PodTestSuite) TestPersistenceItems() {
values *string
expectedVolumes []string
}{
"Default": {values: nil, expectedVolumes: nil},
"Default": {values: nil, expectedVolumes: []string{"shared"}},
"MultipleItems": {values: &values, expectedVolumes: []string{"config", "cache", "data", "custom-mount"}},
}
for name, tc := range tests {
@@ -277,7 +277,7 @@ func (suite *PodTestSuite) TestHostPathVolumes() {
values *string
expectedVolumes []string
}{
"Default": {values: nil, expectedVolumes: nil},
"Default": {values: nil, expectedVolumes: []string{"shared"}},
"MultipleItems": {values: &values, expectedVolumes: []string{"hostpathmounts-data", "hostpathmounts-with-type"}},
}
for name, tc := range tests {
charts/library/common/values.yaml
+16 -48
View File
@@ -521,7 +521,7 @@ persistence:
# [[ref]]https://kubernetes.io/docs/concepts/storage/volumes/#emptydir)
# @default -- See below
shared:
enabled: false
enabled: true
type: emptyDir
mountPath: /shared
@@ -680,59 +680,27 @@ addons:
# TZ: UTC
# -- Provide a customized vpn configuration file to be used by the VPN.
configFile: # |-
# Some Example Config
# remote greatvpnhost.com 8888
# auth-user-pass
# Cipher AES
configFile:
enabled: false
type: hostPath
# -- Which path on the host should be mounted.
hostPath: /vpn/vpn.conf
noMount: true
# -- Specifying a hostPathType adds a check before trying to mount the path.
# See Kubernetes documentation for options.
hostPathType: "File"
# -- Reference an existing secret that contains the VPN configuration file
# The chart expects it to be present under the `vpnConfigfile` key.
configFileSecret:
# -- Provide custom up/down scripts that can be used by the vpn configuration.
# @default -- See values.yaml
scripts:
up: # |-
# #!/bin/bash
# echo "connected" > /shared/vpnstatus
down: # |-
# #!/bin/bash
# echo "disconnected" > /shared/vpnstatus
up: |-
#!/bin/bash
echo "connected" > /shared/vpnstatus
down: |-
#!/bin/bash
echo "disconnected" > /shared/vpnstatus
additionalVolumeMounts: []
# -- Optionally specify a livenessProbe, e.g. to check if the connection is still
# being protected by the VPN
livenessProbe: {}
# exec:
# command:
# - sh
# - -c
# - if [ $(curl -s https://ipinfo.io/country) == 'US' ]; then exit 0; else exit $?; fi
# initialDelaySeconds: 30
# periodSeconds: 60
# failureThreshold: 1
# If set to true, will deploy a network policy that blocks all outbound
# traffic except traffic specified as allowed
networkPolicy:
enabled: false
# The egress configuration for your network policy, All outbound traffic
# From the pod will be blocked unless specified here. Your cluster must
# have a CNI that supports network policies (Canal, Calico, etc...)
# https://kubernetes.io/docs/concepts/services-networking/network-policies/
# https://github.com/ahmetb/kubernetes-network-policy-recipes
egress:
# - to:
# - ipBlock:
# cidr: 0.0.0.0/0
# ports:
# - port: 53
# protocol: UDP
# - port: 53
# protocol: TCP
# -- The common library supports adding a code-server add-on to access files. It can be configured under this key.
# For more info, check out [our docs](http://docs.k8s-at-home.com/our-helm-charts/common-library-add-ons/#code-server)