mirror of
https://github.com/helm/charts.git
synced 2026-08-21 21:38:03 +00:00
3668d3c252
* [stable/openvpn] Add ability to use images from private registries. Signed-off-by: JustinStGermain <justinstgermain@j2.localdomain> * [stable/openvpn] Update chart version. Signed-off-by: JustinStGermain <justinstgermain@j2.localdomain> Co-authored-by: JustinStGermain <justinstgermain@j2.localdomain>
141 lines
4.4 KiB
YAML
141 lines
4.4 KiB
YAML
# Default values for openvpn.
|
|
# This is a YAML-formatted file.
|
|
# Declare variables to be passed into your templates.
|
|
replicaCount: 1
|
|
|
|
updateStrategy: {}
|
|
# type: RollingUpdate
|
|
# rollingUpdate:
|
|
# maxSurge: 1
|
|
# maxUnavailable: 0
|
|
|
|
# For supporting pulling from private registries
|
|
imagePullSecretName:
|
|
|
|
image:
|
|
repository: jfelten/openvpn-docker
|
|
tag: 1.1.0
|
|
pullPolicy: IfNotPresent
|
|
service:
|
|
type: LoadBalancer
|
|
externalPort: 443
|
|
internalPort: 443
|
|
# hostPort: 443
|
|
externalIPs: []
|
|
nodePort: 32085
|
|
# clusterIP: None
|
|
# LoadBalancerSourceRanges: 0.0.0.0/0
|
|
# loadBalancerIP: 10.0.0.1
|
|
|
|
## Here annotations can be added to the openvpn service
|
|
# annotations:
|
|
# external-dns.alpha.kubernetes.io/hostname: vpn.example.com
|
|
annotations: {}
|
|
## Here annotations can be added to the openvpn pod
|
|
# podAnnotations:
|
|
# backup.ark.heptio.com/backup-volumes: certs
|
|
podAnnotations: {}
|
|
|
|
# Add privileged init container to enable IPv4 forwarding
|
|
ipForwardInitContainer: false
|
|
|
|
resources:
|
|
limits:
|
|
cpu: 300m
|
|
memory: 128Mi
|
|
requests:
|
|
cpu: 300m
|
|
memory: 128Mi
|
|
|
|
readinessProbe:
|
|
initialDelaySeconds: 5
|
|
periodSeconds: 5
|
|
successThreshold: 2
|
|
|
|
persistence:
|
|
enabled: true
|
|
# subPath: openvpn
|
|
## A manually managed Persistent Volume and Claim
|
|
## Requires persistence.enabled: true
|
|
## If defined, PVC must be created manually before volume will be bound
|
|
# existingClaim:
|
|
|
|
## openvpn data Persistent Volume Storage Class
|
|
## If defined, storageClassName: <storageClass>
|
|
## If set to "-", storageClassName: "", which disables dynamic provisioning
|
|
## If undefined (the default) or set to null, no storageClassName spec is
|
|
## set, choosing the default provisioner. (gp2 on AWS, standard on
|
|
## GKE, AWS & OpenStack)
|
|
##
|
|
# storageClass: "-"
|
|
accessMode: ReadWriteOnce
|
|
size: 2M
|
|
openvpn:
|
|
# Network allocated for openvpn clients (default: 10.240.0.0).
|
|
OVPN_NETWORK: 10.240.0.0
|
|
# Network subnet allocated for openvpn client (default: 255.255.0.0).
|
|
OVPN_SUBNET: 255.255.0.0
|
|
# Protocol used by openvpn tcp or udp (default: udp).
|
|
OVPN_PROTO: tcp
|
|
# Kubernetes pod network (optional).
|
|
OVPN_K8S_POD_NETWORK: "10.0.0.0"
|
|
# Kubernetes pod network subnet (optional).
|
|
OVPN_K8S_POD_SUBNET: "255.0.0.0"
|
|
# Kubernetes service network (optional).
|
|
# Define openvpn.OVPN_K8S_SVC_NETWORK and openvpn.OVPN_K8S_SVC_SUBNET if it's needed to create a separate route to Kubernates service subnet
|
|
# OVPN_K8S_SVC_NETWORK:
|
|
# Kubernetes service network subnet (optional).
|
|
# OVPN_K8S_SVC_SUBNET:
|
|
# Set default route which openvpn figures basing on network routes inside openvpn pod
|
|
DEFAULT_ROUTE_ENABLED: true
|
|
# Server certificate data
|
|
# keystoreSecret:
|
|
# secret with openvpn certificates. If specified, certificates are taken from the secret
|
|
# create secret with such command:
|
|
# kubectl create secret generic openvpn-keystore-secret --from-file=./server.key --from-file=./ca.crt --from-file=./server.crt --from-file=./dh.pem [--from-file=./crl.pem] [--from-file=./ta.key]
|
|
# Push a `dhcp-option DOMAIN` config
|
|
dhcpOptionDomain: true
|
|
# Redirect all client traffic through VPN
|
|
redirectGateway: true
|
|
# Use/generate certificate revocation list
|
|
useCrl: false
|
|
# Use/generate a ta.key (https://openvpn.net/community-resources/hardening-openvpn-security/)
|
|
taKey: false
|
|
# Override default cipher
|
|
# cipher: AES-256-CBC
|
|
# Lines appended to the end of the server configuration file
|
|
# serverConf: |
|
|
# max-clients 100
|
|
# client-to-client
|
|
|
|
# Lines appended to the end of the client configuration file
|
|
# Example: if all of your clients are Ubuntu (18.04+) you may need to install
|
|
# the update-systemd-resolved package (apt install update-systemd-resolved) then
|
|
# set the following to make sure systemd-resolved routes DNS requests correctly:
|
|
# clientConf: |
|
|
# script-security 2
|
|
# up /etc/openvpn/update-systemd-resolved
|
|
# up-restart
|
|
# down /etc/openvpn/update-systemd-resolved
|
|
# down-pre
|
|
|
|
# Enable istio support for openvpn connections
|
|
istio:
|
|
enabled: false
|
|
proxy:
|
|
port: 15001
|
|
iptablesExtra: []
|
|
# - -A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
|
|
# - -A FORWARD -m conntrack --ctstate NEW -d 10.240.0.0/255.255.0.0 -j ACCEPT
|
|
# - -A FORWARD -j REJECT
|
|
|
|
# Enable CCD support
|
|
ccd:
|
|
enabled: false
|
|
config: {}
|
|
# johndoe: "ifconfig-push 10.240.100.10 10.240.100.11"
|
|
# janedoe: "ifconfig-push 10.240.100.20 10.240.100.21"
|
|
|
|
nodeSelector: {}
|
|
tolerations: []
|