From 9cfbfcbbfe92b27bfdae63f5aa8f7c788c4386d8 Mon Sep 17 00:00:00 2001 From: irozet Date: Mon, 29 Oct 2018 17:24:43 +0300 Subject: [PATCH] [stable/openvpn] adding ability to keep certificates in chart values (#7916) * Additing an option to create extra route for Kubernetes service network Signed-off-by: Irina Rozet * bump chart version Signed-off-by: Irina Rozet * bump minor update version Signed-off-by: Irina Rozet * [stable/openvpn] fixing typo in openvpn.OVPN_K8S_SVC_SUBNET value name Signed-off-by: Irina Rozet * [stable/openvpn] fix openvpn.OVPN_K8S_SVC_NETWORK and openvpn.OVPN_K8S_SVC_SUBNET names in values.yaml Signed-off-by: Irina Rozet * [stable/openvpn] adding ability to keep certificates in chart values Signed-off-by: Irina Rozet * passing certificates in secret rather than values Signed-off-by: Irina Rozet * remove wrong values from from doc Signed-off-by: Irina Rozet * fix typo Signed-off-by: Irina Rozet --- stable/openvpn/Chart.yaml | 2 +- stable/openvpn/README.md | 18 +++++++++++++++++- .../openvpn/templates/openvpn-deployment.yaml | 15 ++++++++++++++- stable/openvpn/values.yaml | 5 +++++ 4 files changed, 37 insertions(+), 3 deletions(-) diff --git a/stable/openvpn/Chart.yaml b/stable/openvpn/Chart.yaml index 04adc9e960..1875da7d06 100755 --- a/stable/openvpn/Chart.yaml +++ b/stable/openvpn/Chart.yaml @@ -3,7 +3,7 @@ description: A Helm chart to install an openvpn server inside a kubernetes clust generation is also part of the deployment, and this chart will generate client keys as needed. name: openvpn -version: 3.9.2 +version: 3.10.0 appVersion: 1.1.0 maintainers: - name: jfelten diff --git a/stable/openvpn/README.md b/stable/openvpn/README.md index ce9a42444d..c21ddd253f 100644 --- a/stable/openvpn/README.md +++ b/stable/openvpn/README.md @@ -93,6 +93,22 @@ If openvpn.OVPN_K8S_SVC_NETWORK and openvpn.OVPN_K8S_SVC_SUBNET are defined, an ### Certificates -New certificates are generated with each deployment. +New certificates are generated with each deployment, if *keystoreSecret* is not defined. If persistence is enabled certificate data will be persisted across pod restarts. Otherwise new client certs will be needed after each deployment or pod restart. + +Certificates can be passed in secret, which name is specified in *openvpn.keystoreSecret* value. +Create secret as follows: + +```bash +kubectl create secret generic openvpn-keystore-secret --from-file=./server.key --from-file=./ca.crt --from-file=./server.crt --from-file=./dh.pem +``` + +You can deploy temporary openvpn chart, create secret from generated certificates, and then re-deploy openvpn, providing the secret. +Certificates can be found in openvpn pod in the following files: + + `/etc/openvpn/certs/pki/private/server.key` + `/etc/openvpn/certs/pki/ca.crt` + `/etc/openvpn/certs/pki/issued/server.crt` + `/etc/openvpn/certs/pki/dh.pem` + diff --git a/stable/openvpn/templates/openvpn-deployment.yaml b/stable/openvpn/templates/openvpn-deployment.yaml index 35f259c904..871b8c5133 100644 --- a/stable/openvpn/templates/openvpn-deployment.yaml +++ b/stable/openvpn/templates/openvpn-deployment.yaml @@ -53,7 +53,7 @@ spec: subPath: {{ .Values.persistence.subPath }} {{- end }} name: certs - readOnly: false + readOnly: {{ if .Values.openvpn.keystoreSecret }}true{{ else }}false{{ end }} volumes: - name: openvpn configMap: @@ -63,6 +63,19 @@ spec: {{- if .Values.persistence.enabled }} persistentVolumeClaim: claimName: {{ if .Values.persistence.existingClaim }}{{ .Values.persistence.existingClaim }}{{- else }}{{ template "openvpn.fullname" . }}{{- end }} + {{- else if .Values.openvpn.keystoreSecret }} + secret: + secretName: "{{ .Values.openvpn.keystoreSecret }}" + defaultMode: 448 + items: + - key: "server.key" + path: "pki/private/server.key" + - key: "ca.crt" + path: "pki/ca.crt" + - key: "server.crt" + path: "pki/issued/server.crt" + - key: "dh.pem" + path: "pki/dh.pem" {{- else }} emptyDir: {} {{- end -}} diff --git a/stable/openvpn/values.yaml b/stable/openvpn/values.yaml index 05e2da15b1..82a5cb773a 100644 --- a/stable/openvpn/values.yaml +++ b/stable/openvpn/values.yaml @@ -68,6 +68,11 @@ openvpn: # OVPN_K8S_SVC_NETWORK: # Kubernetes service network subnet (optional). # OVPN_K8S_SVC_SUBNET: + # Server certificate data + # keystoreSecret: + # secret with openvpn certificates. If specified, certificates are taken from the secret + # create secret with such command: + # kubectl create secret generic openvpn-keystore-secret --from-file=./server.key --from-file=./ca.crt --from-file=./server.crt --from-file=./dh.pem # Push a `dhcp-option DOMAIN` config dhcpOptionDomain: true # Redirect all client traffic through VPN