feat: have VPN use a hostPath for the configfile instead of configmap (#953)

* feat: have VPN use a hostPath for the configfile instead of configmap

* whoopsies

* fix some tests and actually append configFile mount to persistence

* addon -> addons

charts/library/common/templates/addons/vpn/_secret.tpl

@@ -1,19 +0,0 @@
-{{/*
-The OpenVPN config secret to be included.
-*/}}
-{{- define "common.addon.vpn.secret" -}}
-{{- if and .Values.addons.vpn.configFile (not .Values.addons.vpn.configFileSecret) }}
----
-apiVersion: v1
-kind: Secret
-metadata:
-  name: {{ include "common.names.fullname" . }}-vpnconfig
-  labels:
-  {{- include "common.labels" $ | nindent 4 }}
-stringData:
-  {{- with .Values.addons.vpn.configFile }}
-  vpnConfigfile: |-
-    {{- . | nindent 4}}
-  {{- end }}
-{{- end -}}
-{{- end -}}

charts/library/common/templates/addons/vpn/_vpn.tpl

@@ -18,11 +18,7 @@ It will include / inject the required templates based on the given values.
     {{- $configmap | nindent 0 -}}
   {{- end -}}
 
-  {{/* Include the secret if not empty */}}
+  {{- $_ := set .Values.persistence "vpnConfig" .Values.addons.vpn.configFile -}}
-  {{- $secret := include "common.addon.vpn.secret" . -}}
-  {{- if $secret -}}
-    {{- $secret | nindent 0 -}}
-  {{- end -}}
 
   {{/* Append the vpn scripts volume to the volumes */}}
   {{- $scriptVolume := include "common.addon.vpn.scriptsVolumeSpec" . | fromYaml -}}

charts/library/common/templates/addons/vpn/openvpn/_container.tpl

@@ -25,9 +25,9 @@ envFrom:
       name: {{ include "common.names.fullname" . }}-openvpn
     {{- end }}
 {{- end }}
-{{- if or .Values.addons.vpn.configFile .Values.addons.vpn.configFileSecret .Values.addons.vpn.scripts.up .Values.addons.vpn.scripts.down .Values.addons.vpn.additionalVolumeMounts .Values.persistence.shared.enabled }}
+{{- if or .Values.addons.vpn.configFile .Values.addons.vpn.scripts.up .Values.addons.vpn.scripts.down .Values.addons.vpn.additionalVolumeMounts .Values.persistence.shared.enabled }}
 volumeMounts:
-{{- if or .Values.addons.vpn.configFile .Values.addons.vpn.configFileSecret }}
+{{- if or .Values.addons.vpn.configFile }}
   - name: vpnconfig
     mountPath: /vpn/vpn.conf
     subPath: vpnConfigfile
@@ -42,14 +42,9 @@ volumeMounts:
     mountPath: /vpn/down.sh
     subPath: down.sh
 {{- end }}
-{{- if .Values.persistence.shared.enabled }}
   - mountPath: {{ .Values.persistence.shared.mountPath }}
     name: shared
 {{- end }}
-{{- with .Values.addons.vpn.additionalVolumeMounts }}
-  {{- toYaml . | nindent 2 }}
-{{- end }}
-{{- end }}
 {{- with .Values.addons.vpn.livenessProbe }}
 livenessProbe:
   {{- toYaml . | nindent 2 }}

charts/library/common/templates/addons/vpn/wireguard/_container.tpl

@@ -16,9 +16,9 @@ env:
     value: {{ $v | quote }}
 {{- end }}
 {{- end }}
-{{- if or .Values.addons.vpn.configFile .Values.addons.vpn.configFileSecret .Values.addons.vpn.scripts.up .Values.addons.vpn.scripts.down .Values.addons.vpn.additionalVolumeMounts .Values.persistence.shared.enabled }}
+{{- if or .Values.addons.vpn.configFile .Values.addons.vpn.scripts.up .Values.addons.vpn.scripts.down .Values.addons.vpn.additionalVolumeMounts .Values.persistence.shared.enabled }}
 volumeMounts:
-{{- if or .Values.addons.vpn.configFile .Values.addons.vpn.configFileSecret }}
+{{- if or .Values.addons.vpn.configFile }}
   - name: vpnconfig
     mountPath: /etc/wireguard/wg0.conf
     subPath: vpnConfigfile
@@ -33,14 +33,9 @@ volumeMounts:
     mountPath: /config/down.sh
     subPath: down.sh
 {{- end }}
-{{- if .Values.persistence.shared.enabled }}
   - mountPath: {{ .Values.persistence.shared.mountPath }}
     name: shared
 {{- end }}
-{{- with .Values.addons.vpn.additionalVolumeMounts }}
-  {{- toYaml . | nindent 2 }}
-{{- end }}
-{{- end }}
 {{- with .Values.addons.vpn.livenessProbe }}
 livenessProbe:
   {{- toYaml . | nindent 2 }}

charts/library/common/tests/addon_vpn_test.go

@@ -62,68 +62,3 @@ func (suite *AddonVpnTestSuite) TestContainer() {
         })
     }
 }
-
-func (suite *AddonVpnTestSuite) TestConfiguration() {
-    tests := map[string]struct {
-        values             []string
-        expectSecret       bool
-        expectedSecretName string
-    }{
-        "InlineConfig":   {values: append(suite.baseValues, "addons.vpn.configFile=test"), expectSecret: true, expectedSecretName: "common-test-vpnconfig"},
-        "ExistingSecret": {values: append(suite.baseValues, "addons.vpn.configFileSecret=test-secret"), expectSecret: false, expectedSecretName: "test-secret"},
-    }
-    for name, tc := range tests {
-        suite.Suite.Run(name, func() {
-            err := suite.Chart.Render(nil, tc.values, nil)
-            if err != nil {
-                suite.FailNow(err.Error())
-            }
-
-            secretManifest := suite.Chart.Manifests.Get("Secret", tc.expectedSecretName)
-            if tc.expectSecret {
-                suite.Assertions.NotEmpty(secretManifest)
-            } else {
-                suite.Assertions.Empty(secretManifest)
-            }
-
-            deploymentManifest := suite.Chart.Manifests.Get("Deployment", "common-test")
-            suite.Assertions.NotEmpty(deploymentManifest)
-
-            containers := deploymentManifest.Path("spec.template.spec.containers").Children()
-            var vpnContainer *gabs.Container
-            for _, container := range containers {
-                containerName := container.Path("name").Data().(string)
-                if containerName == "openvpn" {
-                    vpnContainer = container
-                    break
-                }
-            }
-            suite.Assertions.NotEmpty(vpnContainer)
-
-            volumeMounts := vpnContainer.Path("volumeMounts").Children()
-            var vpnConfigVolumeMount *gabs.Container
-            for _, volumeMount := range volumeMounts {
-                volumeMountName := volumeMount.Path("name").Data().(string)
-                if volumeMountName == "vpnconfig" {
-                    vpnConfigVolumeMount = volumeMount
-                    break
-                }
-            }
-            suite.Assertions.NotEmpty(vpnConfigVolumeMount)
-            suite.Assertions.EqualValues("/vpn/vpn.conf", vpnConfigVolumeMount.Path("mountPath").Data())
-            suite.Assertions.EqualValues("vpnConfigfile", vpnConfigVolumeMount.Path("subPath").Data())
-
-            volumes := deploymentManifest.Path("spec.template.spec.volumes").Children()
-            var vpnConfigVolume *gabs.Container
-            for _, volume := range volumes {
-                volumeName := volume.Path("name").Data().(string)
-                if volumeName == "vpnconfig" {
-                    vpnConfigVolume = volume
-                    break
-                }
-            }
-            suite.Assertions.NotEmpty(vpnConfigVolume)
-
-        })
-    }
-}

charts/library/common/tests/pod_test.go

@@ -138,7 +138,7 @@ func (suite *PodTestSuite) TestPersistenceItems() {
         values          *string
         expectedVolumes []string
     }{
-        "Default":       {values: nil, expectedVolumes: nil},
+        "Default":       {values: nil, expectedVolumes: []string{"shared"}},
         "MultipleItems": {values: &values, expectedVolumes: []string{"config", "cache", "data", "custom-mount"}},
     }
     for name, tc := range tests {
@@ -277,7 +277,7 @@ func (suite *PodTestSuite) TestHostPathVolumes() {
         values          *string
         expectedVolumes []string
     }{
-        "Default":       {values: nil, expectedVolumes: nil},
+        "Default":       {values: nil, expectedVolumes: []string{"shared"}},
         "MultipleItems": {values: &values, expectedVolumes: []string{"hostpathmounts-data", "hostpathmounts-with-type"}},
     }
     for name, tc := range tests {

charts/library/common/values.yaml

@@ -521,7 +521,7 @@ persistence:
   # [[ref]]https://kubernetes.io/docs/concepts/storage/volumes/#emptydir)
   # @default -- See below
   shared:
-    enabled: false
+    enabled: true
     type: emptyDir
     mountPath: /shared
 
@@ -680,59 +680,27 @@ addons:
       # TZ: UTC
 
     # -- Provide a customized vpn configuration file to be used by the VPN.
-    configFile:  # |-
+    configFile:
-      # Some Example Config
+      enabled: false
-      # remote greatvpnhost.com 8888
+      type: hostPath
-      # auth-user-pass
+      # -- Which path on the host should be mounted.
-      # Cipher AES
+      hostPath: /vpn/vpn.conf
+      noMount: true
+      # -- Specifying a hostPathType adds a check before trying to mount the path.
+      # See Kubernetes documentation for options.
+      hostPathType: "File"
 
-    # -- Reference an existing secret that contains the VPN configuration file
-    # The chart expects it to be present under the `vpnConfigfile` key.
-    configFileSecret:
 
     # -- Provide custom up/down scripts that can be used by the vpn configuration.
     # @default -- See values.yaml
     scripts:
-      up:  # |-
+      up: |-
-        # #!/bin/bash
+        #!/bin/bash
-        # echo "connected" > /shared/vpnstatus
+        echo "connected" > /shared/vpnstatus
-      down:  # |-
+      down: |-
-        # #!/bin/bash
+        #!/bin/bash
-        # echo "disconnected" > /shared/vpnstatus
+        echo "disconnected" > /shared/vpnstatus
 
-    additionalVolumeMounts: []
-
-    # -- Optionally specify a livenessProbe, e.g. to check if the connection is still
-    # being protected by the VPN
-    livenessProbe: {}
-      # exec:
-      #   command:
-      #     - sh
-      #     - -c
-      #     - if [ $(curl -s https://ipinfo.io/country) == 'US' ]; then exit 0; else exit $?; fi
-      # initialDelaySeconds: 30
-      # periodSeconds: 60
-      # failureThreshold: 1
-
-    # If set to true, will deploy a network policy that blocks all outbound
-    # traffic except traffic specified as allowed
-    networkPolicy:
-      enabled: false
-
-      # The egress configuration for your network policy, All outbound traffic
-      # From the pod will be blocked unless specified here. Your cluster must
-      # have a CNI that supports network policies (Canal, Calico, etc...)
-      # https://kubernetes.io/docs/concepts/services-networking/network-policies/
-      # https://github.com/ahmetb/kubernetes-network-policy-recipes
-      egress:
-        # - to:
-        #   - ipBlock:
-        #       cidr: 0.0.0.0/0
-        #   ports:
-        #   - port: 53
-        #     protocol: UDP
-        #   - port: 53
-        #     protocol: TCP
 
   # -- The common library supports adding a code-server add-on to access files. It can be configured under this key.
   # For more info, check out [our docs](http://docs.k8s-at-home.com/our-helm-charts/common-library-add-ons/#code-server)