improv: improve dns and vpn values.yaml syntaxis (#970)

* improv: improve dns and vpn values.yaml syntaxis

* hmm

* fix tests

* no message

charts/library/common/Chart.yaml

@@ -18,4 +18,4 @@ maintainers:
 name: common
 sources: null
 type: library
-version: 7.0.3
+version: 7.0.4

charts/library/common/templates/_all.tpl

@@ -11,7 +11,7 @@ Main entrypoint for the common library chart. It will render all underlying temp
   {{- end -}}
 
   {{- /* Enable VPN add-on if required */ -}}
-  {{- if .Values.addons.vpn.enabled }}
+  {{- if ne "disabled" .Values.addons.vpn.type -}}
     {{- include "common.addon.vpn" . }}
   {{- end -}}
 

charts/library/common/templates/addons/vpn/_vpn.tpl

@@ -3,7 +3,7 @@ Template to render VPN addon
 It will include / inject the required templates based on the given values.
 */}}
 {{- define "common.addon.vpn" -}}
-{{- if .Values.addons.vpn.enabled -}}
+{{- if ne "disabled" .Values.addons.vpn.type -}}
   {{- if eq "openvpn" .Values.addons.vpn.type -}}
     {{- include "common.addon.openvpn" . }}
   {{- end -}}

charts/library/common/templates/addons/vpn/openvpn/_container.tpl

@@ -5,12 +5,24 @@ The OpenVPN sidecar container to be inserted.
 name: openvpn
 image: "{{ .Values.openvpnImage.repository }}:{{ .Values.openvpnImage.tag }}"
 imagePullPolicy: {{ .Values.openvpnImage.pullPolicy }}
-{{- with .Values.addons.vpn.securityContext }}
 securityContext:
+  capabilities:
+    add:
+      - NET_ADMIN
+      - SYS_MODULE
+{{- with .Values.addons.vpn.securityContext }}
   {{- toYaml . | nindent 2 }}
 {{- end }}
-{{- with .Values.addons.vpn.env }}
 env:
+{{- range $envList := .Values.addons.vpn.envList }}
+  {{- if and $envList.name $envList.value }}
+  - name: {{ $envList.name }}
+    value: {{ $envList.value | quote }}
+  {{- else }}
+  {{- fail "Please specify name/value for VPN environment variable" }}
+  {{- end }}
+{{- end}}
+{{- with .Values.addons.vpn.env }}
 {{- range $k, $v := . }}
   - name: {{ $k }}
     value: {{ $v | quote }}

charts/library/common/templates/addons/vpn/wireguard/_container.tpl

@@ -5,16 +5,46 @@ The Wireguard sidecar container to be inserted.
 name: wireguard
 image: "{{ .Values.wireguardImage.repository }}:{{ .Values.wireguardImage.tag }}"
 imagePullPolicy: {{ .Values.wireguardImage.pullPolicy }}
-{{- with .Values.addons.vpn.securityContext }}
 securityContext:
+  runAsUser: 568
+  runAsGroup: 568
+  fsGroup: 568
+  capabilities:
+    add:
+      - NET_ADMIN
+      - SYS_MODULE
+{{- with .Values.addons.vpn.securityContext }}
   {{- toYaml . | nindent 2 }}
 {{- end }}
-{{- with .Values.addons.vpn.env }}
 env:
+{{- range $envList := .Values.addons.vpn.envList }}
+  {{- if and $envList.name $envList.value }}
+  - name: {{ $envList.name }}
+    value: {{ $envList.value | quote }}
+  {{- else }}
+  {{- fail "Please specify name/value for VPN environment variable" }}
+  {{- end }}
+{{- end}}
+{{- with .Values.addons.vpn.env }}
 {{- range $k, $v := . }}
   - name: {{ $k }}
     value: {{ $v | quote }}
 {{- end }}
+  - name: SEPARATOR
+    value: ";"
+{{- if .Values.addons.vpn.wireguard.KILLSWITCH }}
+  - name: KILLSWITCH
+    value: "true"
+{{- if .Values.addons.vpn.wireguard.KILLSWITCH_EXCLUDEDNETWORKS_IPV4 }}
+  - name: KILLSWITCH_EXCLUDEDNETWORKS_IPV4
+    value: {{ .Values.addons.vpn.wireguard.KILLSWITCH_EXCLUDEDNETWORKS_IPV4 | quote }}
+{{- end }}
+{{- if .Values.addons.vpn.wireguard.KILLSWITCH_EXCLUDEDNETWORKS_IPV6 }}
+  - name: KILLSWITCH_EXCLUDEDNETWORKS_IPV4
+    value: {{ .Values.addons.vpn.wireguard.KILLSWITCH_EXCLUDEDNETWORKS_IPV6 | quote }}
+{{- end }}
+{{- end }}
+
 {{- end }}
 {{- if or .Values.addons.vpn.configFile .Values.addons.vpn.scripts.up .Values.addons.vpn.scripts.down .Values.addons.vpn.additionalVolumeMounts .Values.persistence.shared.enabled }}
 volumeMounts:

charts/library/common/templates/lib/controller/_pod.tpl

@@ -30,10 +30,21 @@ dnsPolicy: ClusterFirstWithHostNet
   {{- else }}
 dnsPolicy: ClusterFirst
   {{- end }}
-  {{- with .Values.dnsConfig }}
+{{- if or .Values.dnsConfig.options .Values.dnsConfig.nameservers .Values.dnsConfig.searches }}
 dnsConfig:
-    {{- toYaml . | nindent 2 }}
+  {{- with .Values.dnsConfig.options }}
+  options:
+    {{- toYaml . | nindent 4 }}
   {{- end }}
+  {{- with .Values.dnsConfig.nameservers }}
+  nameservers: []
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  {{- with .Values.dnsConfig.searches }}
+  searches: []
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+{{- end }}
 enableServiceLinks: {{ .Values.enableServiceLinks }}
   {{- with .Values.termination.gracePeriodSeconds }}
 terminationGracePeriodSeconds: {{ . }}
@@ -51,7 +62,6 @@ initContainers:
     {{- end }}
     {{- tpl (toYaml $initContainers) $ | nindent 2 }}
   {{- end }}
-
 containers:
   {{- include "common.controller.mainContainer" . | nindent 2 }}
   {{- with .Values.additionalContainers }}

charts/library/common/tests/addon_vpn_test.go

@@ -17,7 +17,7 @@ type AddonVpnTestSuite struct {
 func (suite *AddonVpnTestSuite) SetupSuite() {
     suite.Chart = helmunit.New("common-test", "../../common-test")
     suite.Chart.UpdateDependencies()
-    suite.baseValues = []string{"addons.vpn.enabled=true"}
+    suite.baseValues = []string{"addons.vpn.type=openvpn"}
 }
 
 // We need this function to kick off the test suite, otherwise

charts/library/common/values.yaml

@@ -237,10 +237,10 @@ hostNetwork: false
 dnsPolicy:  # ClusterFirst
 
 # -- Optional DNS settings, configuring the ndots option may resolve nslookup issues on some Kubernetes setups.
-dnsConfig: {}
+dnsConfig:
-#   options:
+  options: []
-#     - name: ndots
+  nameservers: []
-#       value: "1"
+  searches: []
 
 # -- Enable/disable the generation of environment variables for services.
 # [[ref]](https://kubernetes.io/docs/concepts/services-networking/connect-applications-service/#accessing-the-service)
@@ -686,11 +686,9 @@ addons:
   # For more info, check out [our docs](http://docs.k8s-at-home.com/our-helm-charts/common-library-add-ons/#wireguard-vpn)
   # @default -- See values.yaml
   vpn:
-    # -- Enable running a VPN in the pod to route traffic through a VPN
-    enabled: false
 
-    # -- Specify the VPN type. Valid options are openvpn or wireguard
+    # -- Specify the VPN type. Valid options are disabled, openvpn or wireguard
-    type: openvpn
+    type: disabled
 
     # -- OpenVPN specific configuration
     # @default -- See below
@@ -700,23 +698,27 @@ addons:
       # -- Optionally specify an existing secret that contains the credentials.
       # Credentials should be stored under the `VPN_AUTH` key
       authSecret:  # my-vpn-secret
-    # -- WireGuard specific configuration
-    # @default -- See below
-    wireguard: {}
 
-    # -- Set the VPN container securityContext
+    wireguard:
+      KILLSWITCH: true
+      KILLSWITCH_EXCLUDEDNETWORKS_IPV4:
+        - 192.168.0.0.1
+    # -- Set the VPN container specific securityContext
     # @default -- See values.yaml
-    securityContext:
+    securityContext: {}
-      capabilities:
-        add:
-          - NET_ADMIN
-          - SYS_MODULE
 
     # -- All variables specified here will be added to the vpn sidecar container
     # See the documentation of the VPN image for all config values
     env: {}
       # TZ: UTC
 
+    # -- All variables specified here will be added to the vpn sidecar container
+    # See the documentation of the VPN image for all config values
+    envList: []
+      # name: someenv
+      # value: somevalue
+
+
     # -- Provide a customized vpn configuration file to be used by the VPN.
     configFile:
       enabled: false