From 65bd5fa09f1531a3f050d4ce47907781d4f6f028 Mon Sep 17 00:00:00 2001 From: StevenMcElligott <89483932+StevenMcElligott@users.noreply.github.com> Date: Wed, 29 Jun 2022 06:18:48 -0400 Subject: [PATCH] feat(wg-easy): Add WG-Easy Chart (#2982) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * Add WG-Easy Chart Initial run of creating my own chart from "scratch". Let's see if it runs, especially with the sysctl * Apply suggestions from code review Thanks for fixing the icons lol Co-authored-by: Stavros Kois <47820033+stavros-k@users.noreply.github.com> * Apply suggestions from code review * Update charts/incubator/wg-easy/Chart.yaml * its always that enable :D * Update values.yaml Hopefully fixing the quotation marks fixes the sysctls error, otherwise I'm putting this in the wrong place lol * Remove the likely unnecessary sysctl Let’s see how it runs without net.ipv4.conf.all.src_valid_mark since you can’t set it kubernetes * Update values.yaml * Fixed the repository for wg-easy Had wrong URL and their latest version was changed 4 hours ago * Added missing env-vars to wg-easy Needs WG_HOST and PASSWORD, the rest people can add themselves * Update charts/incubator/wg-easy/values.yaml * recommit * emtpy space * Added PUID and PGID to values Added more stuff to see if the container will pass tests * Fixed trailing spaces * identation * Update charts/incubator/wg-easy/values.yaml Co-authored-by: Stavros Kois <47820033+stavros-k@users.noreply.github.com> * Update charts/incubator/wg-easy/values.yaml Co-authored-by: Stavros Kois <47820033+stavros-k@users.noreply.github.com> * Update charts/incubator/wg-easy/questions.yaml Co-authored-by: Stavros Kois <47820033+stavros-k@users.noreply.github.com> --- charts/incubator/wg-easy/Chart.yaml | 30 ++ charts/incubator/wg-easy/questions.yaml | 362 ++++++++++++++++++ .../incubator/wg-easy/templates/common.yaml | 1 + charts/incubator/wg-easy/values.yaml | 45 +++ 4 files changed, 438 insertions(+) create mode 100644 charts/incubator/wg-easy/Chart.yaml create mode 100644 charts/incubator/wg-easy/questions.yaml create mode 100644 charts/incubator/wg-easy/templates/common.yaml create mode 100644 charts/incubator/wg-easy/values.yaml diff --git a/charts/incubator/wg-easy/Chart.yaml b/charts/incubator/wg-easy/Chart.yaml new file mode 100644 index 00000000000..df9f59a0af5 --- /dev/null +++ b/charts/incubator/wg-easy/Chart.yaml @@ -0,0 +1,30 @@ +apiVersion: v2 +appVersion: "latest" +dependencies: +- name: common + repository: https://library-charts.truecharts.org + version: 10.1.4 +deprecated: false +description: The easiest way to run WireGuard VPN + Web-based Admin UI. +home: https://github.com/truecharts/apps/tree/master/charts/stable/wg-easy +icon: https://truecharts.org/_static/img/appicons/wg-easy.png +keywords: +- wg-easy +- wireguard +- weejewel +kubeVersion: '>=1.16.0-0' +maintainers: +- email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org +name: wg-easy +sources: +- https://hub.docker.com/r/weejewel/wg-easy +- https://github.com/WeeJeWel/wg-easy +type: application +version: 0.0.1 +annotations: + truecharts.org/catagories: | + - networking + truecharts.org/SCALE-support: "true" + truecharts.org/grade: U diff --git a/charts/incubator/wg-easy/questions.yaml b/charts/incubator/wg-easy/questions.yaml new file mode 100644 index 00000000000..f01b6a1a958 --- /dev/null +++ b/charts/incubator/wg-easy/questions.yaml @@ -0,0 +1,362 @@ +# Include{groups} +portals: + open: + protocols: + - "$kubernetes-resource_configmap_portal_protocol" + host: + - "$kubernetes-resource_configmap_portal_host" + ports: + - "$kubernetes-resource_configmap_portal_port" +questions: + - variable: portal + group: "Container Image" + label: "Configure Portal Button" + schema: + type: dict + hidden: true + attrs: + - variable: enabled + label: "Enable" + description: "enable the portal button" + schema: + hidden: true + editable: false + type: boolean + default: true +# Include{global} + + - variable: controller + group: "Controller" + label: "" + schema: + additional_attrs: true + type: dict + attrs: + - variable: advanced + label: "Show Advanced Controller Settings" + schema: + type: boolean + default: false + show_subquestions_if: true + subquestions: + - variable: type + description: "Please specify type of workload to deploy" + label: "(Advanced) Controller Type" + schema: + type: string + default: "deployment" + required: true + enum: + - value: "deployment" + description: "Deployment" + - value: "statefulset" + description: "Statefulset" + - value: "daemonset" + description: "Daemonset" + - variable: replicas + description: "Number of desired pod replicas" + label: "Desired Replicas" + schema: + type: int + default: 1 + required: true + - variable: strategy + description: "Please specify type of workload to deploy" + label: "(Advanced) Update Strategy" + schema: + type: string + default: "Recreate" + required: true + enum: + - value: "Recreate" + description: "Recreate: Kill existing pods before creating new ones" + - value: "RollingUpdate" + description: "RollingUpdate: Create new pods and then kill old ones" + - value: "OnDelete" + description: "(Legacy) OnDelete: ignore .spec.template changes" +# Include{controllerExpert} + - variable: env + group: "Container Configuration" + label: "Image Environment" + schema: + additional_attrs: true + type: dict + attrs: + - variable: WG_HOST + label: "WG_HOST" + description: "The public hostname of your VPN server." + schema: + type: string + required: true + default: "" + - variable: secretEnv + group: "Container Configuration" + label: "Image Secrets" + schema: + additional_attrs: true + type: dict + attrs: + - variable: PASSWORD + label: "ADMIN_PASSWORD" + schema: + type: string + private: true + required: true + default: "" +# Include{containerConfig} + + - variable: service + group: "Networking and Services" + label: "Configure Service(s)" + schema: + additional_attrs: true + type: dict + attrs: + - variable: main + label: "Main Service" + description: "The Primary service on which the healthcheck runs, often the webUI" + schema: + additional_attrs: true + type: dict + attrs: +# Include{serviceSelector} + - variable: main + label: "Web GUI port configuration" + schema: + additional_attrs: true + type: dict + attrs: + - variable: port + label: "Port" + description: "This port exposes the container port on the service" + schema: + type: int + default: 51821 + required: true + - variable: advanced + label: "Show Advanced settings" + schema: + type: boolean + default: false + show_subquestions_if: true + subquestions: + - variable: enabled + label: "Enable the port" + schema: + type: boolean + default: true + - variable: protocol + label: "Port Type" + schema: + type: string + default: "TCP" + enum: + - value: HTTP + description: "HTTP" + - value: "HTTPS" + description: "HTTPS" + - value: TCP + description: "TCP" + - value: "UDP" + description: "UDP" + - variable: nodePort + label: "Node Port (Optional)" + description: "This port gets exposed to the node. Only considered when service type is NodePort, Simple or LoadBalancer" + schema: + type: int + min: 9000 + max: 65535 + - variable: targetPort + label: "Target Port" + description: "The internal(!) port on the container the Application runs on" + schema: + type: int + default: 51821 + - variable: vpn + label: "Wireguard Internal" + description: "Wireguard Internal Port" + schema: + additional_attrs: true + type: dict + attrs: +# Include{serviceSelector} + - variable: vpn + label: "Wireguard Interal Port" + description: "Omada Controller or EAP Discovery Utility discovers Omada devices." + schema: + additional_attrs: true + type: dict + attrs: + - variable: port + label: "Port" + description: "This port exposes the container port on the service" + schema: + type: int + default: 51820 + required: true + - variable: advanced + label: "Show Advanced settings" + schema: + type: boolean + default: false + show_subquestions_if: true + subquestions: + - variable: protocol + label: "Port Type" + schema: + type: string + default: "UDP" + enum: + - value: HTTP + description: "HTTP" + - value: "HTTPS" + description: "HTTPS" + - value: TCP + description: "TCP" + - value: "UDP" + description: "UDP" + - variable: nodePort + label: "Node Port (Optional)" + description: "This port gets exposed to the node. Only considered when service type is NodePort, Simple or LoadBalancer" + schema: + type: int + min: 9000 + max: 65535 + - variable: targetPort + label: "Target Port" + description: "The internal(!) port on the container the Application runs on" + schema: + type: int + default: 51820 + + - variable: serviceexpert + group: "Networking and Services" + label: "Show Expert Config" + schema: + type: boolean + default: false + show_subquestions_if: true + subquestions: + - variable: hostNetwork + group: "Networking and Services" + label: "Host-Networking (Complicated)" + schema: + type: boolean + default: false + +# Include{serviceExpert} + +# Include{serviceList} + + - variable: persistence + label: "Integrated Persistent Storage" + description: "Integrated Persistent Storage" + group: "Storage and Persistence" + schema: + additional_attrs: true + type: dict + attrs: + - variable: config + label: "App Config Storage" + description: "Stores the Application Configuration." + schema: + additional_attrs: true + type: dict + attrs: +# Include{persistenceBasic} +# Include{persistenceAdvanced} +# Include{persistenceList} + + - variable: ingress + label: "" + group: "Ingress" + schema: + additional_attrs: true + type: dict + attrs: + - variable: main + label: "Main Ingress" + schema: + additional_attrs: true + type: dict + attrs: +# Include{ingressDefault} + +# Include{ingressTLS} + +# Include{ingressTraefik} + +# Include{ingressExpert} + +# Include{ingressList} + +# Include{security} + + - variable: advancedSecurity + label: "Show Advanced Security Settings" + group: "Security and Permissions" + schema: + type: boolean + default: false + show_subquestions_if: true + subquestions: + - variable: securityContext + label: "Security Context" + schema: + additional_attrs: true + type: dict + attrs: + - variable: privileged + label: "Privileged mode" + schema: + type: boolean + default: false + - variable: readOnlyRootFilesystem + label: "ReadOnly Root Filesystem" + schema: + type: boolean + default: false + - variable: allowPrivilegeEscalation + label: "Allow Privilege Escalation" + schema: + type: boolean + default: false + - variable: runAsNonRoot + label: "runAsNonRoot" + schema: + type: boolean + default: false +# Include{securityContextAdvanced} + + - variable: podSecurityContext + group: "Security and Permissions" + label: "Pod Security Context" + schema: + additional_attrs: true + type: dict + attrs: + - variable: runAsUser + label: "runAsUser" + description: "The UserID of the user running the application" + schema: + type: int + default: 0 + - variable: runAsGroup + label: "runAsGroup" + description: "The groupID this App of the user running the application" + schema: + type: int + default: 0 + - variable: fsGroup + label: "fsGroup" + description: "The group that should own ALL storage." + schema: + type: int + default: 568 +# Include{podSecurityContextAdvanced} + +# Include{resources} + +# Include{advanced} + +# Include{addons} diff --git a/charts/incubator/wg-easy/templates/common.yaml b/charts/incubator/wg-easy/templates/common.yaml new file mode 100644 index 00000000000..c1a366e1cf0 --- /dev/null +++ b/charts/incubator/wg-easy/templates/common.yaml @@ -0,0 +1 @@ +{{ include "tc.common.loader.all" . }} diff --git a/charts/incubator/wg-easy/values.yaml b/charts/incubator/wg-easy/values.yaml new file mode 100644 index 00000000000..b4d0adc60bc --- /dev/null +++ b/charts/incubator/wg-easy/values.yaml @@ -0,0 +1,45 @@ +image: + repository: weejewel/wg-easy + pullPolicy: IfNotPresent + tag: latest@sha256:fb997c869e6117e05102c38e8ea52788f7fc29f11c7e7b81cf9ed7d4504c9ac0 + +securityContext: + readOnlyRootFilesystem: false + runAsNonRoot: false + capabilities: + add: + - NET_ADMIN + - SYS_MODULE + +security: + PUID: 0 + +podSecurityContext: + runAsUser: 0 + runAsGroup: 0 + +secretEnv: + PASSWORD: "secretpass" + +env: + WG_HOST: "hostname" + +service: + main: + ports: + main: + targetPort: 51821 + port: 51821 + vpn: + enabled: true + ports: + vpn: + enabled: true + protocol: UDP + port: 51820 + targetPort: 51820 + +persistence: + config: + enabled: true + mountPath: "/etc/wireguard"