From 06e2db06032fbf95320a14201f402b1679ad98c7 Mon Sep 17 00:00:00 2001 From: Enno Boland Date: Sun, 21 Jul 2019 17:30:52 +0200 Subject: [PATCH] [stable/openvpn]: add support for connecting to istio services. (#15515) * [stable/openvpn] add support for connecting to istio services. Signed-off-by: Enno Boland * [stable/openvpn] document openvpn.istio.enabled variable Signed-off-by: Enno Boland * [stable/openvpn] make envoy port configurable. Signed-off-by: Enno Boland * [stable/openvpn] use ISTIO_INBOUND instead of default PREROUTING chain. this makes openvpn fail while starting if this pod lack istio instead of rejecting packages at runtime. Signed-off-by: Enno Boland * [stable/openvpn] bump version Signed-off-by: Enno Boland --- stable/openvpn/Chart.yaml | 2 +- stable/openvpn/README.md | 2 ++ stable/openvpn/templates/config-openvpn.yaml | 4 ++++ stable/openvpn/values.yaml | 5 +++++ 4 files changed, 12 insertions(+), 1 deletion(-) diff --git a/stable/openvpn/Chart.yaml b/stable/openvpn/Chart.yaml index b30ac741a5..8ed2c2c378 100755 --- a/stable/openvpn/Chart.yaml +++ b/stable/openvpn/Chart.yaml @@ -3,7 +3,7 @@ description: A Helm chart to install an openvpn server inside a kubernetes clust generation is also part of the deployment, and this chart will generate client keys as needed. name: openvpn -version: 3.13.3 +version: 3.13.4 appVersion: 1.1.0 maintainers: - name: jfelten diff --git a/stable/openvpn/README.md b/stable/openvpn/README.md index 4176002674..242a5322f0 100644 --- a/stable/openvpn/README.md +++ b/stable/openvpn/README.md @@ -104,6 +104,8 @@ Parameter | Description | Default `openvpn.useCrl` | Use/generate a certificate revocation list (crl.pem) | `false` `openvpn.taKey` | Use/generate a ta.key file for hardening security | `false` `openvpn.cipher` | Override the default cipher | `nil` (OpenVPN default) +`openvpn.istio.enabled` | Enables istio support for openvpn clients | `false` +`openvpn.istio.proxy.port` | Istio proxy port | `15001` `nodeSelector` | Node labels for pod assignment | `{}` This chart has been engineered to use kube-dns and route all network traffic to kubernetes pods and services, diff --git a/stable/openvpn/templates/config-openvpn.yaml b/stable/openvpn/templates/config-openvpn.yaml index 5de28f0d64..c1593edda1 100644 --- a/stable/openvpn/templates/config-openvpn.yaml +++ b/stable/openvpn/templates/config-openvpn.yaml @@ -124,6 +124,10 @@ data: } /etc/openvpn/setup/setup-certs.sh +{{ if .Values.openvpn.istio.enabled }} + iptables -t nat -A ISTIO_INBOUND -s {{ .Values.openvpn.OVPN_NETWORK }}/{{ .Values.openvpn.OVPN_SUBNET }} -i tun0 -p tcp -j REDIRECT --to-ports {{ .Values.openvpn.istio.proxy.port }} +{{ end }} + iptables -t nat -A POSTROUTING -s {{ .Values.openvpn.OVPN_NETWORK }}/{{ .Values.openvpn.OVPN_SUBNET }} -o eth0 -j MASQUERADE mkdir -p /dev/net if [ ! -c /dev/net/tun ]; then diff --git a/stable/openvpn/values.yaml b/stable/openvpn/values.yaml index b87fc6c756..e3b0b14f94 100644 --- a/stable/openvpn/values.yaml +++ b/stable/openvpn/values.yaml @@ -91,5 +91,10 @@ openvpn: # conf: | # max-clients 100 # client-to-client + # Enable istio support for openvpn connections + istio: + enabled: false + proxy: + port: 15001 nodeSelector: {}