[stable/openvpn] added persistent volumes for openvpn certs (#526)

* added persistent volumes for openvpn certs

* PR-526 review changes

* bumping version per review comments

* made variable capitalization consistent per review comments

* updated image tag

stable/openvpn/Chart.yaml

@@ -1,7 +1,7 @@
 apiVersion: v1
 description: A Helm chart to install an openvpn server inside a kubernetes cluster.  Certificate generation is also part of the deployment, and this chart will generate client keys as needed.
 name: openvpn
-version: 1.0.2
+version: 1.1.0
 maintainers:
   - name: John Felten
     email: john.felten@gmail.com
@@ -15,4 +15,8 @@ keywords:
   - connectivity
   - encryption
 home: https://openvpn.net/index.php/open-source.html
+sources:
+  - https://github.com/jfelten/openvpn-docker
+  - https://github.com/kubernetes/charts/tree/master/stable/openvpn
+  - https://github.com/jfelten/helm-charts
 

stable/openvpn/README.md

@@ -29,7 +29,8 @@ POD_NAME=`kubectl get pods --namespace {{ .Release.Namespace }} -l type=openvpn
 && SERVICE_IP=`kubectl get svc $SERVICE_NAME --namespace {{ .Release.Namespace }} -o jsonpath='{.status.loadBalancer.ingress[0].ip}'` \
 && KEY_NAME=kubeVPN \
 && kubectl exec --namespace {{ .Release.Namespace }} -it $POD_NAME /etc/openvpn/setup/newClientCert.sh $KEY_NAME $SERVICE_IP \
-&& kubectl exec --namespace {{ .Release.Namespace }} -it $POD_NAME cat /usr/share/easy-rsa/pki/$KEY_NAME.ovpn > $KEY_NAME.ovpn
+&& kubectl exec --namespace {{ .Release.Namespace }} -it $POD_NAME cat /etc/openvpn/certs/pki/$KEY_NAME.ovpn > $KEY_NAME.ovpn
+
 ```
 
 Be sure to change KEY_NAME if generating additional keys.  Import the .ovpn file into your favorite openvpn tool like tunnelblick and verify connectivity.
@@ -40,7 +41,7 @@ All configuration is in the values.yaml file, and can be overwritten via the hel
 
 ### Certificates
 
-New certificates are generated with each deployment.  This chart was developed as a way to quickly set up a personal vpn.  Supporting multiple users would require persistent storage of certificates to avoid unncessary regeneration.  This will be added later if there is interest in multi-user support.
+New certificates are generated with each deployment.  If persistence is enabled certificate data will be persisted across pod restarts.  Otherwise new client certs will be needed after each deployment or pod restart.
 
 ### Important values
 * service.externalPort: 443 - external LoadBalancer port

stable/openvpn/templates/NOTES.txt

@@ -16,6 +16,6 @@ POD_NAME=`kubectl get pods --namespace {{ .Release.Namespace }} -l type=openvpn
 && SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} $SERVICE_NAME -o jsonpath='{.status.loadBalancer.ingress[0].ip}') \
 && KEY_NAME=kubeVPN \
 && kubectl --namespace {{ .Release.Namespace }} exec -it $POD_NAME /etc/openvpn/setup/newClientCert.sh $KEY_NAME $SERVICE_IP \
-&& kubectl --namespace {{ .Release.Namespace }} exec -it $POD_NAME cat /usr/share/easy-rsa/pki/$KEY_NAME.ovpn > $KEY_NAME.ovpn
+&& kubectl --namespace {{ .Release.Namespace }} exec -it $POD_NAME cat /etc/openvpn/certs/pki/$KEY_NAME.ovpn > $KEY_NAME.ovpn
 
 Copy the resulting $KEY_NAME.ovpn file to your open vpn client (ex: in tunnelblick, just double click on the file).  Do this for each user that needs to connect to the VPN.  Change KEY_NAME for each additional user.

stable/openvpn/templates/certs-pvc.yaml

@@ -0,0 +1,24 @@
+{{- if .Values.persistence.enabled }}
+
+kind: PersistentVolumeClaim
+apiVersion: v1
+metadata:
+  name: {{ template "fullname" . }}
+  labels:
+    app: {{ template "fullname" . }}
+    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
+    release: "{{ .Release.Name }}"
+    heritage: "{{ .Release.Service }}"
+  annotations:
+    {{- if .Values.persistence.storageClass }}
+    volume.beta.kubernetes.io/storage-class: {{ .Values.persistence.storageClass | quote }}
+    {{- else }}
+    volume.alpha.kubernetes.io/storage-class: default
+    {{- end }}
+spec:
+  accessModes:
+    - {{ .Values.persistence.accessMode | quote }}
+  resources:
+    requests:
+      storage: {{ .Values.persistence.size | quote }}
+{{- end }}

stable/openvpn/templates/config-openvpn.yaml

@@ -5,16 +5,24 @@ metadata:
 data:
   setup-certs.sh: |-
     #!/bin/bash
-    EASY_RSA_LOC="/usr/share/easy-rsa"
-    cd $EASY_RSA_LOC
-    ./easyrsa init-pki
-    echo "ca\n" | ./easyrsa build-ca nopass
-    ./easyrsa build-server-full server nopass
-    ./easyrsa gen-dh
+    EASY_RSA_LOC="/etc/openvpn/certs"
+    SERVER_CERT="${EASY_RSA_LOC}/pki/issued/server.crt"
+    if [ -e "$SERVER_CERT" ]
+    then
+      echo "found existing certs - reusing"
+    else
+      cp -R /usr/share/easy-rsa/* $EASY_RSA_LOC
+      cd $EASY_RSA_LOC
+      ./easyrsa init-pki
+      echo "ca\n" | ./easyrsa build-ca nopass
+      ./easyrsa build-server-full server nopass
+      ./easyrsa gen-dh 
+    fi
+    
     
   newClientCert.sh: |-
       #!/bin/bash
-      EASY_RSA_LOC="/usr/share/easy-rsa"
+      EASY_RSA_LOC="/etc/openvpn/certs"
       cd $EASY_RSA_LOC
       MY_IP_ADDR="$2"
       ./easyrsa build-client-full $1 nopass
@@ -39,12 +47,10 @@ data:
       remote ${MY_IP_ADDR} {{ .Values.service.externalPort }} {{ .Values.openvpn.OVPN_PROTO }}
       </connection>
       EOF
-      cat ${EASY_RSA_LOC}/pki/$1.ovpn
+      cat pki/$1.ovpn
       
   configure.sh: |-
       #!/bin/sh
-      #TODO(jfelten): create an official docker image with these installed 
-      apk update && apk add openssl easy-rsa openvpn iptables bash
       /etc/openvpn/setup/setup-certs.sh
       iptables -t nat -A POSTROUTING -s {{ .Values.openvpn.OVPN_NETWORK }}/{{ .Values.openvpn.OVPN_SUBNET }} -o eth0 -j MASQUERADE
       mkdir -p /dev/net
@@ -71,11 +77,10 @@ data:
   openvpn.conf: |-
       server {{ .Values.openvpn.OVPN_NETWORK }} {{ .Values.openvpn.OVPN_SUBNET }}
       verb 3
-      
-      key /usr/share/easy-rsa/pki/private/server.key
-      ca /usr/share/easy-rsa/pki/ca.crt
-      cert /usr/share/easy-rsa/pki/issued/server.crt
-      dh /usr/share/easy-rsa/pki/dh.pem
+      key /etc/openvpn/certs/pki/private/server.key
+      ca /etc/openvpn/certs/pki/ca.crt
+      cert /etc/openvpn/certs/pki/issued/server.crt
+      dh /etc/openvpn/certs/pki/dh.pem
       
       key-direction 0
       keepalive 10 60

stable/openvpn/templates/openvpn-deployment.yaml

@@ -6,6 +6,7 @@ metadata:
     heritage: {{.Release.Service | quote }}
     release: {{.Release.Name | quote }}
     chart: "{{.Chart.Name}}-{{.Chart.Version}}"
+
 spec:
   replicas: {{ .Values.replicaCount }}
   template:
@@ -40,8 +41,18 @@ spec:
           - mountPath: /etc/openvpn/setup
             name: openvpn
             readOnly: false
+          - mountPath: /etc/openvpn/certs
+            name: certs
+            readOnly: false
       volumes:
       - name: openvpn
         configMap:
           name: {{ template "fullname" . }}
-          "defaultMode": 0775
+          defaultMode: 0775
+      - name: certs
+        {{- if .Values.persistence.enabled }}
+        persistentVolumeClaim:
+          claimName: {{ template "fullname" . }}
+        {{- else }}
+          emptyDir: {}
+        {{- end -}}

stable/openvpn/values.yaml

@@ -3,8 +3,8 @@
 # Declare variables to be passed into your templates.
 replicaCount: 1
 image:
-  repository: alpine
-  tag: 3.4
+  repository: jfelten/openvpn-docker
+  tag: 1.1.0
   pullPolicy: IfNotPresent
 service:
   name: openvpn
@@ -18,6 +18,11 @@ resources:
   requests:
     cpu: 300m
     memory: 128Mi
+persistence: 
+  enabled: true
+  #StorageClass: generic
+  accessMode: ReadWriteOnce
+  size: 2M
 openvpn: 
     # Network allocated for openvpn clients (default: 10.240.0.0).
     OVPN_NETWORK: 10.240.0.0