diff --git a/charts/library/common/templates/addons/vpn/_secret.tpl b/charts/library/common/templates/addons/vpn/_secret.tpl deleted file mode 100644 index 43e1c27084c..00000000000 --- a/charts/library/common/templates/addons/vpn/_secret.tpl +++ /dev/null @@ -1,19 +0,0 @@ -{{/* -The OpenVPN config secret to be included. -*/}} -{{- define "common.addon.vpn.secret" -}} -{{- if and .Values.addons.vpn.configFile (not .Values.addons.vpn.configFileSecret) }} ---- -apiVersion: v1 -kind: Secret -metadata: - name: {{ include "common.names.fullname" . }}-vpnconfig - labels: - {{- include "common.labels" $ | nindent 4 }} -stringData: - {{- with .Values.addons.vpn.configFile }} - vpnConfigfile: |- - {{- . | nindent 4}} - {{- end }} -{{- end -}} -{{- end -}} diff --git a/charts/library/common/templates/addons/vpn/_vpn.tpl b/charts/library/common/templates/addons/vpn/_vpn.tpl index 0cf13254ace..fc25c63b461 100644 --- a/charts/library/common/templates/addons/vpn/_vpn.tpl +++ b/charts/library/common/templates/addons/vpn/_vpn.tpl @@ -18,11 +18,7 @@ It will include / inject the required templates based on the given values. {{- $configmap | nindent 0 -}} {{- end -}} - {{/* Include the secret if not empty */}} - {{- $secret := include "common.addon.vpn.secret" . -}} - {{- if $secret -}} - {{- $secret | nindent 0 -}} - {{- end -}} + {{- $_ := set .Values.persistence "vpnConfig" .Values.addons.vpn.configFile -}} {{/* Append the vpn scripts volume to the volumes */}} {{- $scriptVolume := include "common.addon.vpn.scriptsVolumeSpec" . | fromYaml -}} diff --git a/charts/library/common/templates/addons/vpn/openvpn/_container.tpl b/charts/library/common/templates/addons/vpn/openvpn/_container.tpl index c6d9412b418..b06793a9b48 100644 --- a/charts/library/common/templates/addons/vpn/openvpn/_container.tpl +++ b/charts/library/common/templates/addons/vpn/openvpn/_container.tpl @@ -25,9 +25,9 @@ envFrom: name: {{ include "common.names.fullname" . }}-openvpn {{- end }} {{- end }} -{{- if or .Values.addons.vpn.configFile .Values.addons.vpn.configFileSecret .Values.addons.vpn.scripts.up .Values.addons.vpn.scripts.down .Values.addons.vpn.additionalVolumeMounts .Values.persistence.shared.enabled }} +{{- if or .Values.addons.vpn.configFile .Values.addons.vpn.scripts.up .Values.addons.vpn.scripts.down .Values.addons.vpn.additionalVolumeMounts .Values.persistence.shared.enabled }} volumeMounts: -{{- if or .Values.addons.vpn.configFile .Values.addons.vpn.configFileSecret }} +{{- if or .Values.addons.vpn.configFile }} - name: vpnconfig mountPath: /vpn/vpn.conf subPath: vpnConfigfile @@ -42,14 +42,9 @@ volumeMounts: mountPath: /vpn/down.sh subPath: down.sh {{- end }} -{{- if .Values.persistence.shared.enabled }} - mountPath: {{ .Values.persistence.shared.mountPath }} name: shared {{- end }} -{{- with .Values.addons.vpn.additionalVolumeMounts }} - {{- toYaml . | nindent 2 }} -{{- end }} -{{- end }} {{- with .Values.addons.vpn.livenessProbe }} livenessProbe: {{- toYaml . | nindent 2 }} diff --git a/charts/library/common/templates/addons/vpn/wireguard/_container.tpl b/charts/library/common/templates/addons/vpn/wireguard/_container.tpl index b6e14940ef2..36b3026035c 100644 --- a/charts/library/common/templates/addons/vpn/wireguard/_container.tpl +++ b/charts/library/common/templates/addons/vpn/wireguard/_container.tpl @@ -16,9 +16,9 @@ env: value: {{ $v | quote }} {{- end }} {{- end }} -{{- if or .Values.addons.vpn.configFile .Values.addons.vpn.configFileSecret .Values.addons.vpn.scripts.up .Values.addons.vpn.scripts.down .Values.addons.vpn.additionalVolumeMounts .Values.persistence.shared.enabled }} +{{- if or .Values.addons.vpn.configFile .Values.addons.vpn.scripts.up .Values.addons.vpn.scripts.down .Values.addons.vpn.additionalVolumeMounts .Values.persistence.shared.enabled }} volumeMounts: -{{- if or .Values.addons.vpn.configFile .Values.addons.vpn.configFileSecret }} +{{- if or .Values.addons.vpn.configFile }} - name: vpnconfig mountPath: /etc/wireguard/wg0.conf subPath: vpnConfigfile @@ -33,14 +33,9 @@ volumeMounts: mountPath: /config/down.sh subPath: down.sh {{- end }} -{{- if .Values.persistence.shared.enabled }} - mountPath: {{ .Values.persistence.shared.mountPath }} name: shared {{- end }} -{{- with .Values.addons.vpn.additionalVolumeMounts }} - {{- toYaml . | nindent 2 }} -{{- end }} -{{- end }} {{- with .Values.addons.vpn.livenessProbe }} livenessProbe: {{- toYaml . | nindent 2 }} diff --git a/charts/library/common/tests/addon_vpn_test.go b/charts/library/common/tests/addon_vpn_test.go index 40c8a11abc9..cd67c451219 100644 --- a/charts/library/common/tests/addon_vpn_test.go +++ b/charts/library/common/tests/addon_vpn_test.go @@ -62,68 +62,3 @@ func (suite *AddonVpnTestSuite) TestContainer() { }) } } - -func (suite *AddonVpnTestSuite) TestConfiguration() { - tests := map[string]struct { - values []string - expectSecret bool - expectedSecretName string - }{ - "InlineConfig": {values: append(suite.baseValues, "addons.vpn.configFile=test"), expectSecret: true, expectedSecretName: "common-test-vpnconfig"}, - "ExistingSecret": {values: append(suite.baseValues, "addons.vpn.configFileSecret=test-secret"), expectSecret: false, expectedSecretName: "test-secret"}, - } - for name, tc := range tests { - suite.Suite.Run(name, func() { - err := suite.Chart.Render(nil, tc.values, nil) - if err != nil { - suite.FailNow(err.Error()) - } - - secretManifest := suite.Chart.Manifests.Get("Secret", tc.expectedSecretName) - if tc.expectSecret { - suite.Assertions.NotEmpty(secretManifest) - } else { - suite.Assertions.Empty(secretManifest) - } - - deploymentManifest := suite.Chart.Manifests.Get("Deployment", "common-test") - suite.Assertions.NotEmpty(deploymentManifest) - - containers := deploymentManifest.Path("spec.template.spec.containers").Children() - var vpnContainer *gabs.Container - for _, container := range containers { - containerName := container.Path("name").Data().(string) - if containerName == "openvpn" { - vpnContainer = container - break - } - } - suite.Assertions.NotEmpty(vpnContainer) - - volumeMounts := vpnContainer.Path("volumeMounts").Children() - var vpnConfigVolumeMount *gabs.Container - for _, volumeMount := range volumeMounts { - volumeMountName := volumeMount.Path("name").Data().(string) - if volumeMountName == "vpnconfig" { - vpnConfigVolumeMount = volumeMount - break - } - } - suite.Assertions.NotEmpty(vpnConfigVolumeMount) - suite.Assertions.EqualValues("/vpn/vpn.conf", vpnConfigVolumeMount.Path("mountPath").Data()) - suite.Assertions.EqualValues("vpnConfigfile", vpnConfigVolumeMount.Path("subPath").Data()) - - volumes := deploymentManifest.Path("spec.template.spec.volumes").Children() - var vpnConfigVolume *gabs.Container - for _, volume := range volumes { - volumeName := volume.Path("name").Data().(string) - if volumeName == "vpnconfig" { - vpnConfigVolume = volume - break - } - } - suite.Assertions.NotEmpty(vpnConfigVolume) - - }) - } -} diff --git a/charts/library/common/tests/pod_test.go b/charts/library/common/tests/pod_test.go index a00ab7f192b..ca9ccaccd02 100644 --- a/charts/library/common/tests/pod_test.go +++ b/charts/library/common/tests/pod_test.go @@ -138,7 +138,7 @@ func (suite *PodTestSuite) TestPersistenceItems() { values *string expectedVolumes []string }{ - "Default": {values: nil, expectedVolumes: nil}, + "Default": {values: nil, expectedVolumes: []string{"shared"}}, "MultipleItems": {values: &values, expectedVolumes: []string{"config", "cache", "data", "custom-mount"}}, } for name, tc := range tests { @@ -277,7 +277,7 @@ func (suite *PodTestSuite) TestHostPathVolumes() { values *string expectedVolumes []string }{ - "Default": {values: nil, expectedVolumes: nil}, + "Default": {values: nil, expectedVolumes: []string{"shared"}}, "MultipleItems": {values: &values, expectedVolumes: []string{"hostpathmounts-data", "hostpathmounts-with-type"}}, } for name, tc := range tests { diff --git a/charts/library/common/values.yaml b/charts/library/common/values.yaml index b6e97818137..8bce73c6c1d 100644 --- a/charts/library/common/values.yaml +++ b/charts/library/common/values.yaml @@ -521,7 +521,7 @@ persistence: # [[ref]]https://kubernetes.io/docs/concepts/storage/volumes/#emptydir) # @default -- See below shared: - enabled: false + enabled: true type: emptyDir mountPath: /shared @@ -680,59 +680,27 @@ addons: # TZ: UTC # -- Provide a customized vpn configuration file to be used by the VPN. - configFile: # |- - # Some Example Config - # remote greatvpnhost.com 8888 - # auth-user-pass - # Cipher AES + configFile: + enabled: false + type: hostPath + # -- Which path on the host should be mounted. + hostPath: /vpn/vpn.conf + noMount: true + # -- Specifying a hostPathType adds a check before trying to mount the path. + # See Kubernetes documentation for options. + hostPathType: "File" - # -- Reference an existing secret that contains the VPN configuration file - # The chart expects it to be present under the `vpnConfigfile` key. - configFileSecret: # -- Provide custom up/down scripts that can be used by the vpn configuration. # @default -- See values.yaml scripts: - up: # |- - # #!/bin/bash - # echo "connected" > /shared/vpnstatus - down: # |- - # #!/bin/bash - # echo "disconnected" > /shared/vpnstatus + up: |- + #!/bin/bash + echo "connected" > /shared/vpnstatus + down: |- + #!/bin/bash + echo "disconnected" > /shared/vpnstatus - additionalVolumeMounts: [] - - # -- Optionally specify a livenessProbe, e.g. to check if the connection is still - # being protected by the VPN - livenessProbe: {} - # exec: - # command: - # - sh - # - -c - # - if [ $(curl -s https://ipinfo.io/country) == 'US' ]; then exit 0; else exit $?; fi - # initialDelaySeconds: 30 - # periodSeconds: 60 - # failureThreshold: 1 - - # If set to true, will deploy a network policy that blocks all outbound - # traffic except traffic specified as allowed - networkPolicy: - enabled: false - - # The egress configuration for your network policy, All outbound traffic - # From the pod will be blocked unless specified here. Your cluster must - # have a CNI that supports network policies (Canal, Calico, etc...) - # https://kubernetes.io/docs/concepts/services-networking/network-policies/ - # https://github.com/ahmetb/kubernetes-network-policy-recipes - egress: - # - to: - # - ipBlock: - # cidr: 0.0.0.0/0 - # ports: - # - port: 53 - # protocol: UDP - # - port: 53 - # protocol: TCP # -- The common library supports adding a code-server add-on to access files. It can be configured under this key. # For more info, check out [our docs](http://docs.k8s-at-home.com/our-helm-charts/common-library-add-ons/#code-server)