diff --git a/stable/openvpn/Chart.yaml b/stable/openvpn/Chart.yaml index 36c0c8ba46..43c590dabd 100755 --- a/stable/openvpn/Chart.yaml +++ b/stable/openvpn/Chart.yaml @@ -3,7 +3,7 @@ description: A Helm chart to install an openvpn server inside a kubernetes clust generation is also part of the deployment, and this chart will generate client keys as needed. name: openvpn -version: 3.13.0 +version: 3.13.1 appVersion: 1.1.0 maintainers: - name: jfelten diff --git a/stable/openvpn/README.md b/stable/openvpn/README.md index d0edc15bc6..4176002674 100644 --- a/stable/openvpn/README.md +++ b/stable/openvpn/README.md @@ -101,6 +101,7 @@ Parameter | Description | Default `openvpn.dhcpOptionDomain` | Push a `dhcp-option DOMAIN` config | `true` `openvpn.conf` | Arbitrary lines appended to the end of the server configuration file | `nil` `openvpn.redirectGateway` | Redirect all client traffic through VPN | `true` +`openvpn.useCrl` | Use/generate a certificate revocation list (crl.pem) | `false` `openvpn.taKey` | Use/generate a ta.key file for hardening security | `false` `openvpn.cipher` | Override the default cipher | `nil` (OpenVPN default) `nodeSelector` | Node labels for pod assignment | `{}` @@ -122,7 +123,7 @@ Certificates can be passed in secret, which name is specified in *openvpn.keysto Create secret as follows: ```bash -kubectl create secret generic openvpn-keystore-secret --from-file=./server.key --from-file=./ca.crt --from-file=./server.crt --from-file=./dh.pem [--from-file=./ta.key] +kubectl create secret generic openvpn-keystore-secret --from-file=./server.key --from-file=./ca.crt --from-file=./server.crt --from-file=./dh.pem [--from-file=./crl.pem] [--from-file=./ta.key] ``` You can deploy temporary openvpn chart, create secret from generated certificates, and then re-deploy openvpn, providing the secret. @@ -133,6 +134,12 @@ Certificates can be found in openvpn pod in the following files: `/etc/openvpn/certs/pki/issued/server.crt` `/etc/openvpn/certs/pki/dh.pem` +If openvpn.useCrl is set: + + `/etc/openvpn/certs/pki/crl.pem` + And optionally (see openvpn.taKey setting): `/etc/openvpn/certs/pki/ta.key` + +Note: using mounted secret makes creation of new client certificates impossible inside openvpn pod, since easyrsa needs to write in certs directory, which is read-only. diff --git a/stable/openvpn/templates/config-openvpn.yaml b/stable/openvpn/templates/config-openvpn.yaml index 2f0b800386..6baad992b0 100644 --- a/stable/openvpn/templates/config-openvpn.yaml +++ b/stable/openvpn/templates/config-openvpn.yaml @@ -15,6 +15,22 @@ data: if [ -e "$SERVER_CERT" ] then echo "found existing certs - reusing" + {{- if .Values.openvpn.useCrl }} + if [ ! -e ${EASY_RSA_LOC}/pki/crl.pem ] + then + echo "generating missed crl file" + ./easyrsa gen-crl + cp ${EASY_RSA_LOC}/pki/crl.pem ${EASY_RSA_LOC}/crl.pem + chmod 644 ${EASY_RSA_LOC}/crl.pem + fi + {{- end }} + {{- if .Values.openvpn.taKey }} + if [ ! -e ${EASY_RSA_LOC}/pki/ta.key ] + then + echo "generating missed ta.key" + openvpn --genkey --secret ${EASY_RSA_LOC}/pki/ta.key + fi + {{- end }} else cp -R /usr/share/easy-rsa/* $EASY_RSA_LOC cd $EASY_RSA_LOC @@ -22,9 +38,11 @@ data: echo "ca\n" | ./easyrsa build-ca nopass ./easyrsa build-server-full server nopass ./easyrsa gen-dh + {{- if .Values.openvpn.useCrl }} ./easyrsa gen-crl cp ${EASY_RSA_LOC}/pki/crl.pem ${EASY_RSA_LOC}/crl.pem # Note: the pki/ directory is inaccessible after openvpn drops privileges, so we cp crl.pem to ${EASY_RSA_LOC} to allow CRL updates without a restart chmod 644 ${EASY_RSA_LOC}/crl.pem + {{- end }} {{- if .Values.openvpn.taKey }} openvpn --genkey --secret ${EASY_RSA_LOC}/pki/ta.key {{- end }} @@ -141,7 +159,9 @@ data: openvpn.conf: |- server {{ .Values.openvpn.OVPN_NETWORK }} {{ .Values.openvpn.OVPN_SUBNET }} verb 3 +{{ if .Values.openvpn.useCrl }} crl-verify /etc/openvpn/certs/crl.pem +{{ end }} key /etc/openvpn/certs/pki/private/server.key ca /etc/openvpn/certs/pki/ca.crt cert /etc/openvpn/certs/pki/issued/server.crt diff --git a/stable/openvpn/templates/openvpn-deployment.yaml b/stable/openvpn/templates/openvpn-deployment.yaml index 47f0943b12..123b98e6f7 100644 --- a/stable/openvpn/templates/openvpn-deployment.yaml +++ b/stable/openvpn/templates/openvpn-deployment.yaml @@ -79,6 +79,10 @@ spec: path: "pki/issued/server.crt" - key: "dh.pem" path: "pki/dh.pem" + {{- if .Values.openvpn.useCrl }} + - key: "crl.pem" + path: "crl.pem" + {{- end }} {{- if .Values.openvpn.taKey }} - key: "ta.key" path: "pki/ta.key" diff --git a/stable/openvpn/values.yaml b/stable/openvpn/values.yaml index efb5643aaf..b87fc6c756 100644 --- a/stable/openvpn/values.yaml +++ b/stable/openvpn/values.yaml @@ -76,11 +76,13 @@ openvpn: # keystoreSecret: # secret with openvpn certificates. If specified, certificates are taken from the secret # create secret with such command: - # kubectl create secret generic openvpn-keystore-secret --from-file=./server.key --from-file=./ca.crt --from-file=./server.crt --from-file=./dh.pem + # kubectl create secret generic openvpn-keystore-secret --from-file=./server.key --from-file=./ca.crt --from-file=./server.crt --from-file=./dh.pem [--from-file=./crl.pem] [--from-file=./ta.key] # Push a `dhcp-option DOMAIN` config dhcpOptionDomain: true # Redirect all client traffic through VPN redirectGateway: true + # Use/generate certificate revocation list + useCrl: false # Use/generate a ta.key (https://openvpn.net/community-resources/hardening-openvpn-security/) taKey: false # Override default cipher