[stable/openvpn] adding ability to keep certificates in chart values (#7916)

* Additing an option to create extra route for Kubernetes service network

Signed-off-by: Irina Rozet <irina.rozet@ingrammicro.com>

* bump chart version

Signed-off-by: Irina Rozet <irina.rozet@ingrammicro.com>

* bump minor update version

Signed-off-by: Irina Rozet <irina.rozet@ingrammicro.com>

* [stable/openvpn] fixing typo in openvpn.OVPN_K8S_SVC_SUBNET value name

Signed-off-by: Irina Rozet <irina.rozet@ingrammicro.com>

* [stable/openvpn] fix openvpn.OVPN_K8S_SVC_NETWORK and openvpn.OVPN_K8S_SVC_SUBNET names in values.yaml

Signed-off-by: Irina Rozet <irina.rozet@ingrammicro.com>

* [stable/openvpn] adding ability to keep certificates in chart values

Signed-off-by: Irina Rozet <irina.rozet@ingrammicro.com>

* passing certificates in secret rather than values

Signed-off-by: Irina Rozet <irina.rozet@ingrammicro.com>

* remove wrong values from from doc

Signed-off-by: Irina Rozet <irina.rozet@ingrammicro.com>

* fix typo

Signed-off-by: Irina Rozet <irina.rozet@ingrammicro.com>

stable/openvpn/Chart.yaml

@@ -3,7 +3,7 @@ description: A Helm chart to install an openvpn server inside a kubernetes clust
   generation is also part of the deployment, and this chart will generate client keys
   as needed.
 name: openvpn
-version: 3.9.2
+version: 3.10.0
 appVersion: 1.1.0
 maintainers:
 - name: jfelten

stable/openvpn/README.md

@@ -93,6 +93,22 @@ If openvpn.OVPN_K8S_SVC_NETWORK and openvpn.OVPN_K8S_SVC_SUBNET are defined, an
 
 ### Certificates
 
-New certificates are generated with each deployment.
+New certificates are generated with each deployment, if *keystoreSecret* is not defined.
 If persistence is enabled certificate data will be persisted across pod restarts.
 Otherwise new client certs will be needed after each deployment or pod restart.
+
+Certificates can be passed in secret, which name is specified in *openvpn.keystoreSecret* value.
+Create secret as follows:
+
+```bash
+kubectl create secret generic openvpn-keystore-secret --from-file=./server.key --from-file=./ca.crt --from-file=./server.crt --from-file=./dh.pem
+```
+
+You can deploy temporary openvpn chart, create secret from generated certificates, and then re-deploy openvpn, providing the secret.
+Certificates can be found in openvpn pod in the following files:
+
+ `/etc/openvpn/certs/pki/private/server.key`
+ `/etc/openvpn/certs/pki/ca.crt`
+ `/etc/openvpn/certs/pki/issued/server.crt`
+ `/etc/openvpn/certs/pki/dh.pem`
+

stable/openvpn/templates/openvpn-deployment.yaml

@@ -53,7 +53,7 @@ spec:
             subPath: {{ .Values.persistence.subPath }}
             {{- end }}
             name: certs
-            readOnly: false
+            readOnly: {{ if .Values.openvpn.keystoreSecret }}true{{ else }}false{{ end }}
       volumes:
       - name: openvpn
         configMap:
@@ -63,6 +63,19 @@ spec:
         {{- if .Values.persistence.enabled }}
         persistentVolumeClaim:
           claimName: {{ if .Values.persistence.existingClaim }}{{ .Values.persistence.existingClaim }}{{- else }}{{ template "openvpn.fullname" . }}{{- end }}
+        {{- else if .Values.openvpn.keystoreSecret }}
+        secret:
+          secretName: "{{ .Values.openvpn.keystoreSecret }}"
+          defaultMode: 448
+          items:
+          - key: "server.key"
+            path: "pki/private/server.key"
+          - key: "ca.crt"
+            path: "pki/ca.crt"
+          - key: "server.crt"
+            path: "pki/issued/server.crt"
+          - key: "dh.pem"
+            path: "pki/dh.pem"
         {{- else }}
         emptyDir: {}
         {{- end -}}

stable/openvpn/values.yaml

@@ -68,6 +68,11 @@ openvpn:
   # OVPN_K8S_SVC_NETWORK:
   # Kubernetes service network subnet (optional).
   # OVPN_K8S_SVC_SUBNET:
+  # Server certificate data
+  # keystoreSecret:
+  # secret with openvpn certificates. If specified, certificates are taken from the secret
+  # create secret with such command:
+  #    kubectl create secret generic openvpn-keystore-secret --from-file=./server.key --from-file=./ca.crt --from-file=./server.crt --from-file=./dh.pem
   # Push a `dhcp-option DOMAIN` config
   dhcpOptionDomain: true
   # Redirect all client traffic through VPN