[stable/openvpn] Fix CRL keystore secret permissions (#15555)

* Allow CRL PEM file to be read by anyone

Signed-off-by: Luke Addison <luke.addison@jetstack.io>

* Fix CRL file check

Signed-off-by: Luke Addison <luke.addison@jetstack.io>

* Change keystore mountpoint and chown CRL to nobody:nogroup

Signed-off-by: Luke Addison <luke.addison@jetstack.io>

* Preserve crl.pem permissions on copy

Signed-off-by: Luke Addison <luke.addison@jetstack.io>

* Revert mount path change

Signed-off-by: Luke Addison <luke.addison@jetstack.io>

* Fix directory location

Signed-off-by: Luke Addison <luke.addison@jetstack.io>

* Use octal format

Signed-off-by: Luke Addison <luke.addison@jetstack.io>

* Bump chart version

Signed-off-by: Luke Addison <luke.addison@jetstack.io>

stable/openvpn/Chart.yaml

@@ -3,7 +3,7 @@ description: A Helm chart to install an openvpn server inside a kubernetes clust
   generation is also part of the deployment, and this chart will generate client keys
   as needed.
 name: openvpn
-version: 3.13.8
+version: 3.13.9
 appVersion: 1.1.0
 maintainers:
 - name: jasongwartz

stable/openvpn/templates/config-openvpn.yaml

@@ -11,12 +11,13 @@ data:
   setup-certs.sh: |-
     #!/bin/bash
     EASY_RSA_LOC="/etc/openvpn/certs"
+    cd $EASY_RSA_LOC
     SERVER_CERT="${EASY_RSA_LOC}/pki/issued/server.crt"
     if [ -e "$SERVER_CERT" ]
     then
       echo "found existing certs - reusing"
       {{- if .Values.openvpn.useCrl }}
-      if [ ! -e ${EASY_RSA_LOC}/pki/crl.pem ]
+      if [ ! -e ${EASY_RSA_LOC}/crl.pem ]
       then
         echo "generating missed crl file"
         ./easyrsa gen-crl
@@ -33,7 +34,6 @@ data:
       {{- end }}
     else
       cp -R /usr/share/easy-rsa/* $EASY_RSA_LOC
-      cd $EASY_RSA_LOC
       ./easyrsa init-pki
       echo "ca\n" | ./easyrsa build-ca nopass
       ./easyrsa build-server-full server nopass

stable/openvpn/templates/openvpn-deployment.yaml

@@ -98,6 +98,7 @@ spec:
           {{- if .Values.openvpn.useCrl }}
           - key: "crl.pem"
             path: "crl.pem"
+            mode: 0644
           {{- end }}
           {{- if .Values.openvpn.taKey }}
           - key: "ta.key"