From 91c96f2697171b0e52ff4b1d33d12b5703b35c40 Mon Sep 17 00:00:00 2001 From: Luke Addison Date: Thu, 29 Aug 2019 22:41:00 +0100 Subject: [PATCH] [stable/openvpn] Fix CRL keystore secret permissions (#15555) * Allow CRL PEM file to be read by anyone Signed-off-by: Luke Addison * Fix CRL file check Signed-off-by: Luke Addison * Change keystore mountpoint and chown CRL to nobody:nogroup Signed-off-by: Luke Addison * Preserve crl.pem permissions on copy Signed-off-by: Luke Addison * Revert mount path change Signed-off-by: Luke Addison * Fix directory location Signed-off-by: Luke Addison * Use octal format Signed-off-by: Luke Addison * Bump chart version Signed-off-by: Luke Addison --- stable/openvpn/Chart.yaml | 2 +- stable/openvpn/templates/config-openvpn.yaml | 4 ++-- stable/openvpn/templates/openvpn-deployment.yaml | 1 + 3 files changed, 4 insertions(+), 3 deletions(-) diff --git a/stable/openvpn/Chart.yaml b/stable/openvpn/Chart.yaml index 1584351e2f..4ebbf95aee 100755 --- a/stable/openvpn/Chart.yaml +++ b/stable/openvpn/Chart.yaml @@ -3,7 +3,7 @@ description: A Helm chart to install an openvpn server inside a kubernetes clust generation is also part of the deployment, and this chart will generate client keys as needed. name: openvpn -version: 3.13.8 +version: 3.13.9 appVersion: 1.1.0 maintainers: - name: jasongwartz diff --git a/stable/openvpn/templates/config-openvpn.yaml b/stable/openvpn/templates/config-openvpn.yaml index aaa69a40ea..6c045f71ea 100644 --- a/stable/openvpn/templates/config-openvpn.yaml +++ b/stable/openvpn/templates/config-openvpn.yaml @@ -11,12 +11,13 @@ data: setup-certs.sh: |- #!/bin/bash EASY_RSA_LOC="/etc/openvpn/certs" + cd $EASY_RSA_LOC SERVER_CERT="${EASY_RSA_LOC}/pki/issued/server.crt" if [ -e "$SERVER_CERT" ] then echo "found existing certs - reusing" {{- if .Values.openvpn.useCrl }} - if [ ! -e ${EASY_RSA_LOC}/pki/crl.pem ] + if [ ! -e ${EASY_RSA_LOC}/crl.pem ] then echo "generating missed crl file" ./easyrsa gen-crl @@ -33,7 +34,6 @@ data: {{- end }} else cp -R /usr/share/easy-rsa/* $EASY_RSA_LOC - cd $EASY_RSA_LOC ./easyrsa init-pki echo "ca\n" | ./easyrsa build-ca nopass ./easyrsa build-server-full server nopass diff --git a/stable/openvpn/templates/openvpn-deployment.yaml b/stable/openvpn/templates/openvpn-deployment.yaml index 928d9ae8af..d15976788a 100644 --- a/stable/openvpn/templates/openvpn-deployment.yaml +++ b/stable/openvpn/templates/openvpn-deployment.yaml @@ -98,6 +98,7 @@ spec: {{- if .Values.openvpn.useCrl }} - key: "crl.pem" path: "crl.pem" + mode: 0644 {{- end }} {{- if .Values.openvpn.taKey }} - key: "ta.key"