[stable/openvpn]: add support for connecting to istio services. (#15515)

* [stable/openvpn] add support for connecting to istio services.

Signed-off-by: Enno Boland <mail@eboland.de>

* [stable/openvpn] document openvpn.istio.enabled variable

Signed-off-by: Enno Boland <mail@eboland.de>

* [stable/openvpn] make envoy port configurable.

Signed-off-by: Enno Boland <mail@eboland.de>

* [stable/openvpn] use ISTIO_INBOUND instead of default PREROUTING chain.

this makes openvpn fail while starting if this pod lack istio instead of
rejecting packages at runtime.

Signed-off-by: Enno Boland <mail@eboland.de>

* [stable/openvpn] bump version

Signed-off-by: Enno Boland <mail@eboland.de>

stable/openvpn/Chart.yaml

@@ -3,7 +3,7 @@ description: A Helm chart to install an openvpn server inside a kubernetes clust
   generation is also part of the deployment, and this chart will generate client keys
   as needed.
 name: openvpn
-version: 3.13.3
+version: 3.13.4
 appVersion: 1.1.0
 maintainers:
 - name: jfelten

stable/openvpn/README.md

@@ -104,6 +104,8 @@ Parameter | Description | Default
 `openvpn.useCrl`               | Use/generate a certificate revocation list (crl.pem)                 | `false`
 `openvpn.taKey`                | Use/generate a ta.key file for hardening security                    | `false`
 `openvpn.cipher`               | Override the default cipher                                          | `nil` (OpenVPN default)
+`openvpn.istio.enabled`        | Enables istio support for openvpn clients                            | `false`
+`openvpn.istio.proxy.port`     | Istio proxy port                                                     | `15001`
 `nodeSelector`                 | Node labels for pod assignment                                       | `{}`
 
 This chart has been engineered to use kube-dns and route all network traffic to kubernetes pods and services,

stable/openvpn/templates/config-openvpn.yaml

@@ -124,6 +124,10 @@ data:
       }
 
       /etc/openvpn/setup/setup-certs.sh
+{{ if .Values.openvpn.istio.enabled }}
+      iptables -t nat -A ISTIO_INBOUND -s {{ .Values.openvpn.OVPN_NETWORK }}/{{ .Values.openvpn.OVPN_SUBNET }} -i tun0 -p tcp -j REDIRECT --to-ports {{ .Values.openvpn.istio.proxy.port }}
+{{ end }}
+
       iptables -t nat -A POSTROUTING -s {{ .Values.openvpn.OVPN_NETWORK }}/{{ .Values.openvpn.OVPN_SUBNET }} -o eth0 -j MASQUERADE
       mkdir -p /dev/net
       if [ ! -c /dev/net/tun ]; then

stable/openvpn/values.yaml

@@ -91,5 +91,10 @@ openvpn:
   # conf: |
   #  max-clients 100
   #  client-to-client
+  # Enable istio support for openvpn connections
+  istio:
+    enabled: false
+    proxy:
+      port: 15001
 
 nodeSelector: {}