[stable/openvpn] issue #14695 adding crl.pem to secret (#14777)

* Additing an option to create extra route for Kubernetes service network

Signed-off-by: Irina Rozet <irina.rozet@ingrammicro.com>

* bump chart version

Signed-off-by: Irina Rozet <irina.rozet@ingrammicro.com>

* bump minor update version

Signed-off-by: Irina Rozet <irina.rozet@ingrammicro.com>

* [stable/openvpn] fixing typo in openvpn.OVPN_K8S_SVC_SUBNET value name

Signed-off-by: Irina Rozet <irina.rozet@ingrammicro.com>

* [stable/openvpn] fix openvpn.OVPN_K8S_SVC_NETWORK and openvpn.OVPN_K8S_SVC_SUBNET names in values.yaml

Signed-off-by: Irina Rozet <irina.rozet@ingrammicro.com>

* [stable/openvpn] adding ability to keep certificates in chart values

Signed-off-by: Irina Rozet <irina.rozet@ingrammicro.com>

* passing certificates in secret rather than values

Signed-off-by: Irina Rozet <irina.rozet@ingrammicro.com>

* remove wrong values from from doc

Signed-off-by: Irina Rozet <irina.rozet@ingrammicro.com>

* fix typo

Signed-off-by: Irina Rozet <irina.rozet@ingrammicro.com>

* [stable/openvpn] adding crl.pem to secret

Signed-off-by: Irina Rozet <irina.rozet@ingrammicro.com>

* [stable/openvpn] making certificate revocation list optional

Signed-off-by: Irina Rozet <irina.rozet@ingrammicro.com>

stable/openvpn/Chart.yaml

@@ -3,7 +3,7 @@ description: A Helm chart to install an openvpn server inside a kubernetes clust
   generation is also part of the deployment, and this chart will generate client keys
   as needed.
 name: openvpn
-version: 3.13.0
+version: 3.13.1
 appVersion: 1.1.0
 maintainers:
 - name: jfelten

stable/openvpn/README.md

@@ -101,6 +101,7 @@ Parameter | Description | Default
 `openvpn.dhcpOptionDomain`     | Push a `dhcp-option DOMAIN` config                                   | `true`
 `openvpn.conf`                 | Arbitrary lines appended to the end of the server configuration file | `nil`
 `openvpn.redirectGateway`      | Redirect all client traffic through VPN                              | `true`
+`openvpn.useCrl`               | Use/generate a certificate revocation list (crl.pem)                 | `false`
 `openvpn.taKey`                | Use/generate a ta.key file for hardening security                    | `false`
 `openvpn.cipher`               | Override the default cipher                                          | `nil` (OpenVPN default)
 `nodeSelector`                 | Node labels for pod assignment                                       | `{}`
@@ -122,7 +123,7 @@ Certificates can be passed in secret, which name is specified in *openvpn.keysto
 Create secret as follows:
 
 ```bash
-kubectl create secret generic openvpn-keystore-secret --from-file=./server.key --from-file=./ca.crt --from-file=./server.crt --from-file=./dh.pem [--from-file=./ta.key]
+kubectl create secret generic openvpn-keystore-secret --from-file=./server.key --from-file=./ca.crt --from-file=./server.crt --from-file=./dh.pem [--from-file=./crl.pem] [--from-file=./ta.key]
 ```
 
 You can deploy temporary openvpn chart, create secret from generated certificates, and then re-deploy openvpn, providing the secret.
@@ -133,6 +134,12 @@ Certificates can be found in openvpn pod in the following files:
  `/etc/openvpn/certs/pki/issued/server.crt`
  `/etc/openvpn/certs/pki/dh.pem`
 
+If openvpn.useCrl is set:
+
+ `/etc/openvpn/certs/pki/crl.pem`
+
 And optionally (see openvpn.taKey setting):
 
  `/etc/openvpn/certs/pki/ta.key`
+
+Note: using mounted secret makes creation of new client certificates impossible inside openvpn pod, since easyrsa needs to write in certs directory, which is read-only.

stable/openvpn/templates/config-openvpn.yaml

@@ -15,6 +15,22 @@ data:
     if [ -e "$SERVER_CERT" ]
     then
       echo "found existing certs - reusing"
+      {{- if .Values.openvpn.useCrl }}
+      if [ ! -e ${EASY_RSA_LOC}/pki/crl.pem ]
+      then
+        echo "generating missed crl file"
+        ./easyrsa gen-crl
+        cp ${EASY_RSA_LOC}/pki/crl.pem ${EASY_RSA_LOC}/crl.pem
+        chmod 644 ${EASY_RSA_LOC}/crl.pem
+      fi
+      {{- end }}
+      {{- if .Values.openvpn.taKey }}
+        if [ ! -e ${EASY_RSA_LOC}/pki/ta.key ]
+        then
+          echo "generating missed ta.key"
+          openvpn --genkey --secret ${EASY_RSA_LOC}/pki/ta.key
+        fi
+      {{- end }}
     else
       cp -R /usr/share/easy-rsa/* $EASY_RSA_LOC
       cd $EASY_RSA_LOC
@@ -22,9 +38,11 @@ data:
       echo "ca\n" | ./easyrsa build-ca nopass
       ./easyrsa build-server-full server nopass
       ./easyrsa gen-dh
+      {{- if .Values.openvpn.useCrl }}
       ./easyrsa gen-crl
       cp ${EASY_RSA_LOC}/pki/crl.pem ${EASY_RSA_LOC}/crl.pem # Note: the pki/ directory is inaccessible after openvpn drops privileges, so we cp crl.pem to ${EASY_RSA_LOC} to allow CRL updates without a restart
       chmod 644 ${EASY_RSA_LOC}/crl.pem
+      {{- end }}
       {{- if .Values.openvpn.taKey }}
       openvpn --genkey --secret ${EASY_RSA_LOC}/pki/ta.key
       {{- end }}
@@ -141,7 +159,9 @@ data:
   openvpn.conf: |-
       server {{ .Values.openvpn.OVPN_NETWORK }} {{ .Values.openvpn.OVPN_SUBNET }}
       verb 3
+{{ if .Values.openvpn.useCrl }}
       crl-verify /etc/openvpn/certs/crl.pem
+{{ end }}
       key /etc/openvpn/certs/pki/private/server.key
       ca /etc/openvpn/certs/pki/ca.crt
       cert /etc/openvpn/certs/pki/issued/server.crt

stable/openvpn/templates/openvpn-deployment.yaml

@@ -79,6 +79,10 @@ spec:
             path: "pki/issued/server.crt"
           - key: "dh.pem"
             path: "pki/dh.pem"
+          {{- if .Values.openvpn.useCrl }}
+          - key: "crl.pem"
+            path: "crl.pem"
+          {{- end }}
           {{- if .Values.openvpn.taKey }}
           - key: "ta.key"
             path: "pki/ta.key"

stable/openvpn/values.yaml

@@ -76,11 +76,13 @@ openvpn:
   # keystoreSecret:
   # secret with openvpn certificates. If specified, certificates are taken from the secret
   # create secret with such command:
-  #    kubectl create secret generic openvpn-keystore-secret --from-file=./server.key --from-file=./ca.crt --from-file=./server.crt --from-file=./dh.pem
+  #    kubectl create secret generic openvpn-keystore-secret --from-file=./server.key --from-file=./ca.crt --from-file=./server.crt --from-file=./dh.pem [--from-file=./crl.pem]  [--from-file=./ta.key]
   # Push a `dhcp-option DOMAIN` config
   dhcpOptionDomain: true
   # Redirect all client traffic through VPN
   redirectGateway: true
+  # Use/generate certificate revocation list
+  useCrl: false
   # Use/generate a ta.key (https://openvpn.net/community-resources/hardening-openvpn-security/)
   taKey: false
   # Override default cipher