From 2db56c1e421fd865923fcacf89aa3f6c9317663d Mon Sep 17 00:00:00 2001 From: Kjeld Schouten-Lebbing Date: Sat, 25 Sep 2021 14:40:14 +0200 Subject: [PATCH] Fix remaining VPN addon issues (#1029) * Fix remaining VPN addon issues * fix minor common-test issue --- charts/library/common/Chart.yaml | 2 +- .../addons/vpn/openvpn/_container.tpl | 24 +++++++ .../templates/addons/vpn/openvpn/_secret.tpl | 10 ++- .../addons/vpn/wireguard/_container.tpl | 20 +++--- .../lib/controller/_autopermissions.yaml | 6 +- .../tests/persistentvolumeclaim_test.go | 2 +- charts/library/common/values.yaml | 17 +++-- templates/questions/addons.yaml | 62 ++++++++++++------- 8 files changed, 99 insertions(+), 44 deletions(-) diff --git a/charts/library/common/Chart.yaml b/charts/library/common/Chart.yaml index 076381bf393..8253b4a287d 100644 --- a/charts/library/common/Chart.yaml +++ b/charts/library/common/Chart.yaml @@ -15,4 +15,4 @@ maintainers: name: common sources: null type: library -version: 8.0.0 +version: 8.0.1 diff --git a/charts/library/common/templates/addons/vpn/openvpn/_container.tpl b/charts/library/common/templates/addons/vpn/openvpn/_container.tpl index 49aaea17d78..07cf5ff9c13 100644 --- a/charts/library/common/templates/addons/vpn/openvpn/_container.tpl +++ b/charts/library/common/templates/addons/vpn/openvpn/_container.tpl @@ -6,6 +6,8 @@ name: openvpn image: "{{ .Values.openvpnImage.repository }}:{{ .Values.openvpnImage.tag }}" imagePullPolicy: {{ .Values.openvpnImage.pullPolicy }} securityContext: + runAsUser: 0 + runAsGroup: 0 capabilities: add: - NET_ADMIN @@ -28,6 +30,28 @@ env: value: {{ $v | quote }} {{- end }} {{- end }} + +{{- if .Values.addons.vpn.killSwitch }} + - name: FIREWALL + value: "ON" + - name: ROUTE_1 + value: "172.16.0.0/12" + {{- range $index, $value := .Values.addons.vpn.excludedNetworks_IPv4 }} + - name: ROUTE_{{ add $index 2 }} + value: {{ $value | quote }} + {{- end}} +{{- if .Values.addons.vpn.excludedNetworks_IPv6 }} + {{- $excludednetworksv6 := ""}} + {{- range .Values.addons.vpn.excludedNetworks_IPv4 }} + {{- $excludednetworksv6 = ( printf "%v;%v" $excludednetworksv6 . ) }} + {{- end}} + {{- range $index, $value := .Values.addons.vpn.excludedNetworks_IPv6 }} + - name: ROUTE6_{{ add $index 1 }} + value: {{ $value | quote }} + {{- end}} +{{- end }} +{{- end }} + {{- if or .Values.addons.vpn.openvpn.auth }} envFrom: - secretRef: diff --git a/charts/library/common/templates/addons/vpn/openvpn/_secret.tpl b/charts/library/common/templates/addons/vpn/openvpn/_secret.tpl index f1b622570b7..0bf3fbecc06 100644 --- a/charts/library/common/templates/addons/vpn/openvpn/_secret.tpl +++ b/charts/library/common/templates/addons/vpn/openvpn/_secret.tpl @@ -2,7 +2,6 @@ The OpenVPN credentials secrets to be included. */}} {{- define "common.addon.openvpn.secret" -}} -{{- with .Values.addons.vpn.openvpn.auth }} --- apiVersion: v1 kind: Secret @@ -11,6 +10,11 @@ metadata: labels: {{- include "common.labels" $ | nindent 4 }} data: - VPN_AUTH: {{ . | b64enc }} -{{- end -}} + {{- $vpnauth := "" }} + {{- if .Values.addons.vpn.openvpn.username }} + {{- $vpnauth = ( printf "%v;%v" .Values.addons.vpn.openvpn.username .Values.addons.vpn.openvpn.password ) }} + {{- else }} + {{- $vpnauth = .Values.addons.vpn.openvpn.password }} + {{- end }} + VPN_AUTH: {{ $vpnauth | b64enc }} {{- end -}} diff --git a/charts/library/common/templates/addons/vpn/wireguard/_container.tpl b/charts/library/common/templates/addons/vpn/wireguard/_container.tpl index 25cb0af9d5e..1aa589fa3c7 100644 --- a/charts/library/common/templates/addons/vpn/wireguard/_container.tpl +++ b/charts/library/common/templates/addons/vpn/wireguard/_container.tpl @@ -34,16 +34,22 @@ env: {{- end }} {{- end }} -{{- if .Values.addons.vpn.wireguard.KILLSWITCH }} +{{- if .Values.addons.vpn.killSwitch }} - name: KILLSWITCH value: "true" -{{- if .Values.addons.vpn.wireguard.KILLSWITCH_EXCLUDEDNETWORKS_IPV4 }} + {{- $excludednetworksv4 := "172.16.0.0/12"}} + {{- range .Values.addons.vpn.excludedNetworks_IPv4 }} + {{- $excludednetworksv4 = ( printf "%v;%v" $excludednetworksv4 . ) }} + {{- end}} - name: KILLSWITCH_EXCLUDEDNETWORKS_IPV4 - value: {{ .Values.addons.vpn.wireguard.KILLSWITCH_EXCLUDEDNETWORKS_IPV4 | quote }} -{{- end }} -{{- if .Values.addons.vpn.wireguard.KILLSWITCH_EXCLUDEDNETWORKS_IPV6 }} - - name: KILLSWITCH_EXCLUDEDNETWORKS_IPV4 - value: {{ .Values.addons.vpn.wireguard.KILLSWITCH_EXCLUDEDNETWORKS_IPV6 | quote }} + value: {{ $excludednetworksv4 | quote }} +{{- if .Values.addons.vpn.excludedNetworks_IPv6 }} + {{- $excludednetworksv6 := ""}} + {{- range .Values.addons.vpn.excludedNetworks_IPv4 }} + {{- $excludednetworksv6 = ( printf "%v;%v" $excludednetworksv6 . ) }} + {{- end}} + - name: KILLSWITCH_EXCLUDEDNETWORKS_IPV6 + value: {{ .Values.addons.vpn.excludedNetworks_IPv6 | quote }} {{- end }} {{- end }} diff --git a/charts/library/common/templates/lib/controller/_autopermissions.yaml b/charts/library/common/templates/lib/controller/_autopermissions.yaml index 424e9bb0bde..b1925f897b5 100644 --- a/charts/library/common/templates/lib/controller/_autopermissions.yaml +++ b/charts/library/common/templates/lib/controller/_autopermissions.yaml @@ -27,8 +27,12 @@ before chart installation. command: - "/bin/sh" - "-c" - - "echo 'Automatically correcting permissions...';{{ range $_, $hpm := $hostPathMounts }}chown -R :{{ $group }} {{ $hpm.mountPath | squote }}; chmod -R g+w {{ $hpm.mountPath | squote }};{{ end }}" + - "echo 'Automatically correcting permissions...';{{ if .Values.addons.vpn.configFile }}chown -R 568:568 /vpn/vpn.conf; chmod -R g+w /vpn/vpn.conf;{{ end }}{{ range $_, $hpm := $hostPathMounts }}chown -R :{{ $group }} {{ $hpm.mountPath | squote }}; chmod -R g+w {{ $hpm.mountPath | squote }};{{ end }}" volumeMounts: + {{- if .Values.addons.vpn.configFile }} + - name: vpnconfig + mountPath: /vpn/vpn.conf + {{- end }} {{- range $name, $hpm := $hostPathMounts }} - name: {{ $name }} mountPath: {{ $hpm.mountPath }} diff --git a/charts/library/common/tests/persistentvolumeclaim_test.go b/charts/library/common/tests/persistentvolumeclaim_test.go index a2fa5f89467..0b1d8696c08 100644 --- a/charts/library/common/tests/persistentvolumeclaim_test.go +++ b/charts/library/common/tests/persistentvolumeclaim_test.go @@ -81,7 +81,7 @@ func (suite *PersistenceVolumeClaimTestSuite) TestMetaData() { "app.kubernetes.io/managed-by": "Helm", "app.kubernetes.io/name": "common-test", "app.kubernetes.io/version":"latest", - "helm.sh/chart": "common-test-3.1.2", + "helm.sh/chart": "common-test-3.1.3", } tests := map[string]struct { diff --git a/charts/library/common/values.yaml b/charts/library/common/values.yaml index 88633a0bac9..f054928e345 100644 --- a/charts/library/common/values.yaml +++ b/charts/library/common/values.yaml @@ -698,15 +698,14 @@ addons: # @default -- See below openvpn: # -- Credentials to connect to the VPN Service (used with -a) - auth: # "user;password" - # -- Optionally specify an existing secret that contains the credentials. - # Credentials should be stored under the `VPN_AUTH` key - authSecret: # my-vpn-secret + # Only using password is enough + username: "" + password: "" + + killSwitch: true + excludedNetworks_IPv4: [] + excludedNetworks_IPv6: [] - wireguard: - KILLSWITCH: false - KILLSWITCH_EXCLUDEDNETWORKS_IPV4: - - 192.168.0.0.1 # -- Set the VPN container specific securityContext # @default -- See values.yaml securityContext: {} @@ -725,7 +724,7 @@ addons: # -- Provide a customized vpn configuration file to be used by the VPN. configFile: - enabled: false + enabled: true type: hostPath # -- Which path on the host should be mounted. hostPath: /vpn/vpn.conf diff --git a/templates/questions/addons.yaml b/templates/questions/addons.yaml index ed96295c612..86dadc64f85 100644 --- a/templates/questions/addons.yaml +++ b/templates/questions/addons.yaml @@ -28,35 +28,52 @@ type: dict show_if: [["type", "=", "openvpn"]] attrs: - - variable: auth - label: "authentication credentials" - description: "authentication credentials, seperated by ; example: username;password" + - variable: username + label: "authentication username" + description: "authentication username, optional" schema: type: string default: "" - - variable: wireguard - label: "Wireguard Settings" + - variable: password + label: "authentication password" + description: "authentication credentials" + schema: + type: string + default: "" + required: true + - variable: killSwitch + label: "Enable killswitch" schema: - type: dict - show_if: [["type", "=", "wireguard"]] - attrs: - - variable: KILLSWITCH - label: "Enable killswitch" - schema: - type: boolean - default: false - - variable: KILLSWITCH_EXCLUDEDNETWORKS_IPV4 - label: "Killswitch Excluded IPv4 networks" - description: "list of killswitch excluded ipv4 addresses seperated by ;" + type: boolean + show_if: [["type", "!=", "disabled"]] + default: true + - variable: excludedNetworks_IPv4 + label: "Killswitch Excluded IPv4 networks" + description: "list of killswitch excluded ipv4 addresses" + schema: + type: list + show_if: [["type", "!=", "disabled"]] + default: [] + items: + - variable: networkv4 + label: "IPv4 Network" schema: type: string - default: "172.16.0.0/12" - - variable: KILLSWITCH_EXCLUDEDNETWORKS_IPV6 - label: "Killswitch Excluded IPv6 networks" - description: "list of killswitch excluded ipv4 addresses seperated by ;" + required: true + - variable: excludedNetworks_IPv6 + label: "Killswitch Excluded IPv6 networks" + description: "list of killswitch excluded ipv4 addresses" + schema: + type: list + show_if: [["type", "!=", "disabled"]] + default: [] + items: + - variable: networkv6 + label: "IPv6 Network" schema: type: string - default: "" + required: true + - variable: configFile label: "VPN Config File Location" schema: @@ -89,9 +106,10 @@ hidden: true - variable: hostPath label: "Full path to file" + description: "path to your local VPN config file for example: /mnt/tank/vpn.conf or /mnt/tank/vpn.ovpn" schema: type: string - default: "/mnt/tank/config/YourVPN-Config.conf" + default: "" required: true - variable: envList label: "VPN environment Variables"