From 86ce997b7006894da424578cf3e5ebfdec48125e Mon Sep 17 00:00:00 2001 From: John Felten Date: Wed, 10 May 2017 14:49:39 -0700 Subject: [PATCH] [stable/openvpn] added persistent volumes for openvpn certs (#526) * added persistent volumes for openvpn certs * PR-526 review changes * bumping version per review comments * made variable capitalization consistent per review comments * updated image tag --- stable/openvpn/Chart.yaml | 6 +++- stable/openvpn/README.md | 5 +-- stable/openvpn/templates/NOTES.txt | 2 +- stable/openvpn/templates/certs-pvc.yaml | 24 +++++++++++++ stable/openvpn/templates/config-openvpn.yaml | 35 +++++++++++-------- .../openvpn/templates/openvpn-deployment.yaml | 13 ++++++- stable/openvpn/values.yaml | 9 +++-- 7 files changed, 72 insertions(+), 22 deletions(-) create mode 100644 stable/openvpn/templates/certs-pvc.yaml diff --git a/stable/openvpn/Chart.yaml b/stable/openvpn/Chart.yaml index 0e5f28de55..a2b3980eb5 100755 --- a/stable/openvpn/Chart.yaml +++ b/stable/openvpn/Chart.yaml @@ -1,7 +1,7 @@ apiVersion: v1 description: A Helm chart to install an openvpn server inside a kubernetes cluster. Certificate generation is also part of the deployment, and this chart will generate client keys as needed. name: openvpn -version: 1.0.2 +version: 1.1.0 maintainers: - name: John Felten email: john.felten@gmail.com @@ -15,4 +15,8 @@ keywords: - connectivity - encryption home: https://openvpn.net/index.php/open-source.html +sources: + - https://github.com/jfelten/openvpn-docker + - https://github.com/kubernetes/charts/tree/master/stable/openvpn + - https://github.com/jfelten/helm-charts diff --git a/stable/openvpn/README.md b/stable/openvpn/README.md index c59364cac1..8bfc1a8150 100644 --- a/stable/openvpn/README.md +++ b/stable/openvpn/README.md @@ -29,7 +29,8 @@ POD_NAME=`kubectl get pods --namespace {{ .Release.Namespace }} -l type=openvpn && SERVICE_IP=`kubectl get svc $SERVICE_NAME --namespace {{ .Release.Namespace }} -o jsonpath='{.status.loadBalancer.ingress[0].ip}'` \ && KEY_NAME=kubeVPN \ && kubectl exec --namespace {{ .Release.Namespace }} -it $POD_NAME /etc/openvpn/setup/newClientCert.sh $KEY_NAME $SERVICE_IP \ -&& kubectl exec --namespace {{ .Release.Namespace }} -it $POD_NAME cat /usr/share/easy-rsa/pki/$KEY_NAME.ovpn > $KEY_NAME.ovpn +&& kubectl exec --namespace {{ .Release.Namespace }} -it $POD_NAME cat /etc/openvpn/certs/pki/$KEY_NAME.ovpn > $KEY_NAME.ovpn + ``` Be sure to change KEY_NAME if generating additional keys. Import the .ovpn file into your favorite openvpn tool like tunnelblick and verify connectivity. @@ -40,7 +41,7 @@ All configuration is in the values.yaml file, and can be overwritten via the hel ### Certificates -New certificates are generated with each deployment. This chart was developed as a way to quickly set up a personal vpn. Supporting multiple users would require persistent storage of certificates to avoid unncessary regeneration. This will be added later if there is interest in multi-user support. +New certificates are generated with each deployment. If persistence is enabled certificate data will be persisted across pod restarts. Otherwise new client certs will be needed after each deployment or pod restart. ### Important values * service.externalPort: 443 - external LoadBalancer port diff --git a/stable/openvpn/templates/NOTES.txt b/stable/openvpn/templates/NOTES.txt index 482d82e40f..52540bfceb 100644 --- a/stable/openvpn/templates/NOTES.txt +++ b/stable/openvpn/templates/NOTES.txt @@ -16,6 +16,6 @@ POD_NAME=`kubectl get pods --namespace {{ .Release.Namespace }} -l type=openvpn && SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} $SERVICE_NAME -o jsonpath='{.status.loadBalancer.ingress[0].ip}') \ && KEY_NAME=kubeVPN \ && kubectl --namespace {{ .Release.Namespace }} exec -it $POD_NAME /etc/openvpn/setup/newClientCert.sh $KEY_NAME $SERVICE_IP \ -&& kubectl --namespace {{ .Release.Namespace }} exec -it $POD_NAME cat /usr/share/easy-rsa/pki/$KEY_NAME.ovpn > $KEY_NAME.ovpn +&& kubectl --namespace {{ .Release.Namespace }} exec -it $POD_NAME cat /etc/openvpn/certs/pki/$KEY_NAME.ovpn > $KEY_NAME.ovpn Copy the resulting $KEY_NAME.ovpn file to your open vpn client (ex: in tunnelblick, just double click on the file). Do this for each user that needs to connect to the VPN. Change KEY_NAME for each additional user. diff --git a/stable/openvpn/templates/certs-pvc.yaml b/stable/openvpn/templates/certs-pvc.yaml new file mode 100644 index 0000000000..5f546ab9a1 --- /dev/null +++ b/stable/openvpn/templates/certs-pvc.yaml @@ -0,0 +1,24 @@ +{{- if .Values.persistence.enabled }} + +kind: PersistentVolumeClaim +apiVersion: v1 +metadata: + name: {{ template "fullname" . }} + labels: + app: {{ template "fullname" . }} + chart: "{{ .Chart.Name }}-{{ .Chart.Version }}" + release: "{{ .Release.Name }}" + heritage: "{{ .Release.Service }}" + annotations: + {{- if .Values.persistence.storageClass }} + volume.beta.kubernetes.io/storage-class: {{ .Values.persistence.storageClass | quote }} + {{- else }} + volume.alpha.kubernetes.io/storage-class: default + {{- end }} +spec: + accessModes: + - {{ .Values.persistence.accessMode | quote }} + resources: + requests: + storage: {{ .Values.persistence.size | quote }} +{{- end }} diff --git a/stable/openvpn/templates/config-openvpn.yaml b/stable/openvpn/templates/config-openvpn.yaml index 00cf72df8e..881ef58255 100644 --- a/stable/openvpn/templates/config-openvpn.yaml +++ b/stable/openvpn/templates/config-openvpn.yaml @@ -5,16 +5,24 @@ metadata: data: setup-certs.sh: |- #!/bin/bash - EASY_RSA_LOC="/usr/share/easy-rsa" - cd $EASY_RSA_LOC - ./easyrsa init-pki - echo "ca\n" | ./easyrsa build-ca nopass - ./easyrsa build-server-full server nopass - ./easyrsa gen-dh + EASY_RSA_LOC="/etc/openvpn/certs" + SERVER_CERT="${EASY_RSA_LOC}/pki/issued/server.crt" + if [ -e "$SERVER_CERT" ] + then + echo "found existing certs - reusing" + else + cp -R /usr/share/easy-rsa/* $EASY_RSA_LOC + cd $EASY_RSA_LOC + ./easyrsa init-pki + echo "ca\n" | ./easyrsa build-ca nopass + ./easyrsa build-server-full server nopass + ./easyrsa gen-dh + fi + newClientCert.sh: |- #!/bin/bash - EASY_RSA_LOC="/usr/share/easy-rsa" + EASY_RSA_LOC="/etc/openvpn/certs" cd $EASY_RSA_LOC MY_IP_ADDR="$2" ./easyrsa build-client-full $1 nopass @@ -39,12 +47,10 @@ data: remote ${MY_IP_ADDR} {{ .Values.service.externalPort }} {{ .Values.openvpn.OVPN_PROTO }} EOF - cat ${EASY_RSA_LOC}/pki/$1.ovpn + cat pki/$1.ovpn configure.sh: |- #!/bin/sh - #TODO(jfelten): create an official docker image with these installed - apk update && apk add openssl easy-rsa openvpn iptables bash /etc/openvpn/setup/setup-certs.sh iptables -t nat -A POSTROUTING -s {{ .Values.openvpn.OVPN_NETWORK }}/{{ .Values.openvpn.OVPN_SUBNET }} -o eth0 -j MASQUERADE mkdir -p /dev/net @@ -71,11 +77,10 @@ data: openvpn.conf: |- server {{ .Values.openvpn.OVPN_NETWORK }} {{ .Values.openvpn.OVPN_SUBNET }} verb 3 - - key /usr/share/easy-rsa/pki/private/server.key - ca /usr/share/easy-rsa/pki/ca.crt - cert /usr/share/easy-rsa/pki/issued/server.crt - dh /usr/share/easy-rsa/pki/dh.pem + key /etc/openvpn/certs/pki/private/server.key + ca /etc/openvpn/certs/pki/ca.crt + cert /etc/openvpn/certs/pki/issued/server.crt + dh /etc/openvpn/certs/pki/dh.pem key-direction 0 keepalive 10 60 diff --git a/stable/openvpn/templates/openvpn-deployment.yaml b/stable/openvpn/templates/openvpn-deployment.yaml index be3d218e0e..11ef3e695b 100644 --- a/stable/openvpn/templates/openvpn-deployment.yaml +++ b/stable/openvpn/templates/openvpn-deployment.yaml @@ -6,6 +6,7 @@ metadata: heritage: {{.Release.Service | quote }} release: {{.Release.Name | quote }} chart: "{{.Chart.Name}}-{{.Chart.Version}}" + spec: replicas: {{ .Values.replicaCount }} template: @@ -40,8 +41,18 @@ spec: - mountPath: /etc/openvpn/setup name: openvpn readOnly: false + - mountPath: /etc/openvpn/certs + name: certs + readOnly: false volumes: - name: openvpn configMap: name: {{ template "fullname" . }} - "defaultMode": 0775 + defaultMode: 0775 + - name: certs + {{- if .Values.persistence.enabled }} + persistentVolumeClaim: + claimName: {{ template "fullname" . }} + {{- else }} + emptyDir: {} + {{- end -}} diff --git a/stable/openvpn/values.yaml b/stable/openvpn/values.yaml index c2d6babc19..955a679bdb 100644 --- a/stable/openvpn/values.yaml +++ b/stable/openvpn/values.yaml @@ -3,8 +3,8 @@ # Declare variables to be passed into your templates. replicaCount: 1 image: - repository: alpine - tag: 3.4 + repository: jfelten/openvpn-docker + tag: 1.1.0 pullPolicy: IfNotPresent service: name: openvpn @@ -18,6 +18,11 @@ resources: requests: cpu: 300m memory: 128Mi +persistence: + enabled: true + #StorageClass: generic + accessMode: ReadWriteOnce + size: 2M openvpn: # Network allocated for openvpn clients (default: 10.240.0.0). OVPN_NETWORK: 10.240.0.0