From eaea7474a4abfd6dbd93d4e274261e4215b3bcb7 Mon Sep 17 00:00:00 2001 From: Kjeld Schouten Date: Sat, 1 Feb 2025 23:18:31 +0100 Subject: [PATCH] remove old openvpn and wireguard --- .../templates/addons/openvpn/_openvpn.tpl | 51 ------------- .../addons/openvpn/_openvpnContainer.tpl | 39 ---------- .../templates/addons/openvpn/_secret.tpl | 9 --- .../templates/addons/openvpn/_volume.tpl | 62 ---------------- .../templates/addons/wireguard/_secret.tpl | 9 --- .../templates/addons/wireguard/_volume.tpl | 62 ---------------- .../templates/addons/wireguard/_wireguard.tpl | 49 ------------- .../addons/wireguard/_wireguardContainer.tpl | 24 ------- .../library/common/templates/loader/_init.tpl | 10 --- charts/library/common/values.yaml | 72 ------------------- 10 files changed, 387 deletions(-) delete mode 100644 charts/library/common/templates/addons/openvpn/_openvpn.tpl delete mode 100644 charts/library/common/templates/addons/openvpn/_openvpnContainer.tpl delete mode 100644 charts/library/common/templates/addons/openvpn/_secret.tpl delete mode 100644 charts/library/common/templates/addons/openvpn/_volume.tpl delete mode 100644 charts/library/common/templates/addons/wireguard/_secret.tpl delete mode 100644 charts/library/common/templates/addons/wireguard/_volume.tpl delete mode 100644 charts/library/common/templates/addons/wireguard/_wireguard.tpl delete mode 100644 charts/library/common/templates/addons/wireguard/_wireguardContainer.tpl diff --git a/charts/library/common/templates/addons/openvpn/_openvpn.tpl b/charts/library/common/templates/addons/openvpn/_openvpn.tpl deleted file mode 100644 index 9b97db2610a..00000000000 --- a/charts/library/common/templates/addons/openvpn/_openvpn.tpl +++ /dev/null @@ -1,51 +0,0 @@ -{{/* -Template to render VPN addon -It will include / inject the required templates based on the given values. -*/}} -{{- define "tc.v1.common.addon.openvpn" -}} -{{- if ne "disabled" .Values.addons.vpn.type -}} - - - {{- if .Values.addons.vpn.config -}} - {{/* Append the vpn config secret to the secrets */}} - {{- $secret := include "tc.v1.common.addon.openvpn.secret" . | fromYaml -}} - {{- if $secret -}} - {{- $_ := set .Values.secret "vpnconfig" $secret -}} - {{- end -}} - {{- end }} - - {{- if or .Values.addons.vpn.configFile .Values.addons.vpn.config .Values.addons.vpn.existingSecret -}} - {{/* Append the vpn config to the persistence */}} - {{- $configper := include "tc.v1.common.addon.openvpn.volume.config" . | fromYaml -}} - {{- if $configper -}} - {{- $_ := set .Values.persistence "vpnconfig" $configper -}} - {{- end -}} - {{- end -}} - - {{/* Ensure target Selector defaults to main pod even if unset */}} - {{- $targetSelector := list "main" -}} - {{- if $.Values.addons.vpn.targetSelector -}} - {{- $targetSelector = $.Values.addons.vpn.targetSelector -}} - {{- end -}} - - {{/* Append the vpn container to the containers */}} - {{- range $targetSelector -}} - {{- $container := dict -}} - {{- $containerModify := dict -}} - {{- $container = $.Values.addons.vpn.openvpn.container -}} - {{- $containerModify = include "tc.v1.common.addon.openvpn.containerModify" $ | fromYaml -}} - - - {{- if $container.enabled -}} - {{- range $targetSelector -}} - {{- $mergedContainer := mustMergeOverwrite $container $containerModify -}} - {{- $workload := get $.Values.workload . -}} - {{- $_ := set $workload.podSpec.containers "vpn" $mergedContainer -}} - {{- end -}} - {{- end -}} - {{- end -}} - - - -{{- end -}} -{{- end -}} diff --git a/charts/library/common/templates/addons/openvpn/_openvpnContainer.tpl b/charts/library/common/templates/addons/openvpn/_openvpnContainer.tpl deleted file mode 100644 index 5c95e893817..00000000000 --- a/charts/library/common/templates/addons/openvpn/_openvpnContainer.tpl +++ /dev/null @@ -1,39 +0,0 @@ -{{/* -The gluetun sidecar container to be inserted. -*/}} -{{- define "tc.v1.common.addon.openvpn.containerModify" -}} - - -env: -{{- with $.Values.addons.vpn.env }} - {{- . | toYaml | nindent 2 }} -{{- end }} - {{- if and $.Values.addons.vpn.openvpn.username $.Values.addons.vpn.openvpn.password }} - VPN_AUTH: {{ (printf "%v;%v" $.Values.addons.vpn.openvpn.username $.Values.addons.vpn.openvpn.password) }} - {{- end -}} -{{- if $.Values.addons.vpn.killSwitch }} -{{- $ipv4list := $.Values.addons.vpn.excludedNetworks_IPv4 }} - -{{- if $.Values.chartContext.podCIDR }} -{{- $ipv4list = append $ipv4list $.Values.chartContext.podCIDR }} -{{- end }} -{{- if $.Values.chartContext.svcCIDR }} -{{- $ipv4list = append $ipv4list $.Values.chartContext.svcCIDR }} -{{- end }} - - FIREWALL: "ON" - {{- range $index, $value := $ipv4list }} - ROUTE_{{ add $index 1 }}: {{ $value | quote }} - {{- end }} -{{- if $.Values.addons.vpn.excludedNetworks_IPv6 }} - {{- $excludednetworksv6 := "" -}} - {{- range $.Values.addons.vpn.excludedNetworks_IPv4 -}} - {{- $excludednetworksv6 = ( printf "%v;%v" $excludednetworksv6 . ) -}} - {{- end }} - {{- range $index, $value := $.Values.addons.vpn.excludedNetworks_IPv6 }} - ROUTE6_{{ add $index 1 }}: {{ $value | quote }} - {{- end }} -{{- end }} -{{- end -}} - -{{- end -}} diff --git a/charts/library/common/templates/addons/openvpn/_secret.tpl b/charts/library/common/templates/addons/openvpn/_secret.tpl deleted file mode 100644 index fd3d97781e4..00000000000 --- a/charts/library/common/templates/addons/openvpn/_secret.tpl +++ /dev/null @@ -1,9 +0,0 @@ -{{/* -The OpenVPN config secret to be included. -*/}} -{{- define "tc.v1.common.addon.openvpn.secret" -}} -enabled: true -data: - vpn.conf: |- - {{- .Values.addons.vpn.config | nindent 4 }} -{{- end -}} diff --git a/charts/library/common/templates/addons/openvpn/_volume.tpl b/charts/library/common/templates/addons/openvpn/_volume.tpl deleted file mode 100644 index 7ee32d26cdd..00000000000 --- a/charts/library/common/templates/addons/openvpn/_volume.tpl +++ /dev/null @@ -1,62 +0,0 @@ - - -{{/* -The volume (referencing VPN config) to be inserted into persistence. -*/}} -{{- define "tc.v1.common.addon.openvpn.volume.config" -}} -{{- "/vpn" := (include "tc.v1.common.addon.openvpn.volume.basePath" .) }} -{{- $mountPath := "/vpn" }} - -enabled: true -{{- if or .Values.addons.vpn.config .Values.addons.vpn.existingSecret }} -type: secret -defaultMode: "0777" -items: - - key: vpn.conf - path: vpn.conf -{{- if .Values.addons.vpn.existingSecret }} -objectName: {{ .Values.addons.vpn.existingSecret }} -expandObjectName: false -{{- else }} -objectName: vpnconfig -expandObjectName: true -{{- end -}} -{{- else }} -{{- $mountPath = (printf "%s/vpn.conf" "/vpn") }} -type: hostPath -hostPath: {{ .Values.addons.vpn.configFile | default "/vpn" }} -hostPathType: "File" -autoPermissions: - enabled: true - chown: true - user: 568 - group: 568 -{{- end }} -targetSelector: - {{- range .Values.addons.vpn.targetSelector }} - {{ . }}: - vpn: - mountPath: {{ $mountPath }} - {{- end -}} -{{- end -}} - -{{/* -The volume (referencing VPN config folder) to be inserted into persistence. -*/}} -{{- define "tc.v1.common.addon.openvpn.volume.folder" -}} -{{- "/vpn" := (include "tc.v1.common.addon.openvpn.volume.basePath" .) }} -enabled: true -type: hostPath -hostPath: {{ .Values.addons.vpn.configFolder | quote }} -autoPermissions: - enabled: true - chown: true - user: 568 - group: 568 -targetSelector: - {{- range .Values.addons.vpn.targetSelector }} - {{ . }}: - vpn: - mountPath: {{ "/vpn" }} - {{- end -}} -{{- end -}} diff --git a/charts/library/common/templates/addons/wireguard/_secret.tpl b/charts/library/common/templates/addons/wireguard/_secret.tpl deleted file mode 100644 index 3a2227c1591..00000000000 --- a/charts/library/common/templates/addons/wireguard/_secret.tpl +++ /dev/null @@ -1,9 +0,0 @@ -{{/* -The OpenVPN config secret to be included. -*/}} -{{- define "tc.v1.common.addon.wireguard.secret" -}} -enabled: true -data: - vpn.conf: |- - {{- .Values.addons.vpn.config | nindent 4 }} -{{- end -}} diff --git a/charts/library/common/templates/addons/wireguard/_volume.tpl b/charts/library/common/templates/addons/wireguard/_volume.tpl deleted file mode 100644 index 86748ecf525..00000000000 --- a/charts/library/common/templates/addons/wireguard/_volume.tpl +++ /dev/null @@ -1,62 +0,0 @@ - - -{{/* -The volume (referencing VPN config) to be inserted into persistence. -*/}} -{{- define "tc.v1.common.addon.wireguard.volume.config" -}} -{{- "/etc/wireguard" := (include "tc.v1.common.addon.wireguard.volume.basePath" .) }} -{{- $mountPath := "/etc/wireguard" }} - -enabled: true -{{- if or .Values.addons.vpn.config .Values.addons.vpn.existingSecret }} -type: secret -defaultMode: "0777" -items: - - key: vpn.conf - path: vpn.conf -{{- if .Values.addons.vpn.existingSecret }} -objectName: {{ .Values.addons.vpn.existingSecret }} -expandObjectName: false -{{- else }} -objectName: vpnconfig -expandObjectName: true -{{- end -}} -{{- else }} -{{- $mountPath = (printf "%s/vpn.conf" "/etc/wireguard") }} -type: hostPath -hostPath: {{ .Values.addons.vpn.configFile | default "/vpn" }} -hostPathType: "File" -autoPermissions: - enabled: true - chown: true - user: 568 - group: 568 -{{- end }} -targetSelector: - {{- range .Values.addons.vpn.targetSelector }} - {{ . }}: - vpn: - mountPath: {{ $mountPath }} - {{- end -}} -{{- end -}} - -{{/* -The volume (referencing VPN config folder) to be inserted into persistence. -*/}} -{{- define "tc.v1.common.addon.wireguard.volume.folder" -}} -{{- "/etc/wireguard" := (include "tc.v1.common.addon.wireguard.volume.basePath" .) }} -enabled: true -type: hostPath -hostPath: {{ .Values.addons.vpn.configFolder | quote }} -autoPermissions: - enabled: true - chown: true - user: 568 - group: 568 -targetSelector: - {{- range .Values.addons.vpn.targetSelector }} - {{ . }}: - vpn: - mountPath: {{ "/etc/wireguard" }} - {{- end -}} -{{- end -}} diff --git a/charts/library/common/templates/addons/wireguard/_wireguard.tpl b/charts/library/common/templates/addons/wireguard/_wireguard.tpl deleted file mode 100644 index ef86f922c3a..00000000000 --- a/charts/library/common/templates/addons/wireguard/_wireguard.tpl +++ /dev/null @@ -1,49 +0,0 @@ -{{/* -Template to render VPN addon -It will include / inject the required templates based on the given values. -*/}} -{{- define "tc.v1.common.addon.wireguard" -}} -{{- if ne "disabled" .Values.addons.vpn.type -}} - - - {{- if .Values.addons.vpn.config -}} - {{/* Append the vpn config secret to the secrets */}} - {{- $secret := include "tc.v1.common.addon.wireguard.secret" . | fromYaml -}} - {{- if $secret -}} - {{- $_ := set .Values.secret "vpnconfig" $secret -}} - {{- end -}} - {{- end }} - - {{- if or .Values.addons.vpn.configFile .Values.addons.vpn.config .Values.addons.vpn.existingSecret -}} - {{/* Append the vpn config to the persistence */}} - {{- $configper := include "tc.v1.common.addon.wireguard.volume.config" . | fromYaml -}} - {{- if $configper -}} - {{- $_ := set .Values.persistence "vpnconfig" $configper -}} - {{- end -}} - {{- end -}} - - {{/* Ensure target Selector defaults to main pod even if unset */}} - {{- $targetSelector := list "main" -}} - {{- if $.Values.addons.vpn.targetSelector -}} - {{- $targetSelector = $.Values.addons.vpn.targetSelector -}} - {{- end -}} - - {{/* Append the vpn container to the containers */}} - {{- range $targetSelector -}} - {{- $container := dict -}} - {{- $containerModify := dict -}} - {{- $container = $.Values.addons.vpn.wireguard.container -}} - {{- $containerModify = include "tc.v1.common.addon.wireguard.containerModify" $ | fromYaml -}} - - - {{- if $container.enabled -}} - {{- range $targetSelector -}} - {{- $mergedContainer := mustMergeOverwrite $container $containerModify -}} - {{- $workload := get $.Values.workload . -}} - {{- $_ := set $workload.podSpec.containers "vpn" $mergedContainer -}} - {{- end -}} - {{- end -}} - {{- end -}} - -{{- end -}} -{{- end -}} diff --git a/charts/library/common/templates/addons/wireguard/_wireguardContainer.tpl b/charts/library/common/templates/addons/wireguard/_wireguardContainer.tpl deleted file mode 100644 index 40094e1bccb..00000000000 --- a/charts/library/common/templates/addons/wireguard/_wireguardContainer.tpl +++ /dev/null @@ -1,24 +0,0 @@ -{{/* -The gluetun sidecar container to be inserted. -*/}} -{{- define "tc.v1.common.addon.wireguard.containerModify" -}} -env: - SEPARATOR: ";" - IPTABLES_BACKEND: "nft" -{{- if $.Values.addons.vpn.killSwitch }} - KILLSWITCH: "true" - {{- $excludednetworksv4 := ( printf "%v;%v" $.Values.chartContext.podCIDR $.Values.chartContext.svcCIDR ) -}} - {{- range $.Values.addons.vpn.excludedNetworks_IPv4 -}} - {{- $excludednetworksv4 = ( printf "%v;%v" $excludednetworksv4 . ) -}} - {{- end }} - KILLSWITCH_EXCLUDEDNETWORKS_IPV4: {{ $excludednetworksv4 | quote }} -{{- if $.Values.addons.vpn.excludedNetworks_IPv6 -}} - {{- $excludednetworksv6 := "" -}} - {{- range $.Values.addons.vpn.excludedNetworks_IPv4 -}} - {{- $excludednetworksv6 = ( printf "%v;%v" $excludednetworksv6 . ) -}} - {{- end }} - KILLSWITCH_EXCLUDEDNETWORKS_IPV6: {{ $.Values.addons.vpn.excludedNetworks_IPv6 | quote }} -{{- end -}} -{{- end -}} - -{{- end -}} diff --git a/charts/library/common/templates/loader/_init.tpl b/charts/library/common/templates/loader/_init.tpl index 0667996d5e5..c1e00c52df7 100644 --- a/charts/library/common/templates/loader/_init.tpl +++ b/charts/library/common/templates/loader/_init.tpl @@ -43,16 +43,6 @@ {{- include "tc.v1.common.addon.tailscale" . }} {{- end -}} - {{/* Enable openvpn add-on if required */}} - {{- if .Values.addons.openvpn.enabled -}} - {{- include "tc.v1.common.addon.openvpn" . }} - {{- end -}} - - {{/* Enable wireguard add-on if required */}} - {{- if .Values.addons.wireguard.enabled -}} - {{- include "tc.v1.common.addon.wireguard" . }} - {{- end -}} - {{/* Enable netshoot add-on if required */}} {{- if .Values.addons.netshoot.enabled }} {{- include "tc.v1.common.addon.netshoot" . }} diff --git a/charts/library/common/values.yaml b/charts/library/common/values.yaml index 2b7104ba49d..8739f7ec6ad 100644 --- a/charts/library/common/values.yaml +++ b/charts/library/common/values.yaml @@ -856,40 +856,6 @@ addons: - NET_ADMIN - NET_RAW - MKNOD - wireguard: - enabled: true - targetSelector: - - main - # -- you can directly specify the config file here - config: "" - ## Only for Wireguard and OpenVPN - killSwitch: true - excludedNetworks_IPv4: [] - excludedNetworks_IPv6: [] - container: - enabled: true - imageSelector: wireguardImage - probes: - liveness: - enabled: false - readiness: - enabled: false - startup: - enabled: false - resources: - excludeExtra: true - securityContext: - runAsUser: 568 - runAsGroup: 568 - readOnlyRootFilesystem: false - allowPrivilegeEscalation: true - capabilities: - add: - - AUDIT_WRITE - - NET_ADMIN - - SETUID - - SETGID - - SYS_MODULE # -- Tailscale specific configuration # @default -- See below @@ -936,44 +902,6 @@ addons: # -- Annotations for tailscale sidecar annotations: {} - # -- OpenVPN specific configuration - # @default -- See below - openvpn: - enabled: true - targetSelector: - - main - # -- Credentials to connect to the VPN Service (used with -a) - # Only using password is enough - username: "" - password: "" - # -- you can directly specify the config file here - config: "" - ## Only for Wireguard and OpenVPN - killSwitch: true - excludedNetworks_IPv4: [] - excludedNetworks_IPv6: [] - container: - enabled: true - imageSelector: openvpnImage - probes: - liveness: - enabled: false - readiness: - enabled: false - startup: - enabled: false - resources: - excludeExtra: true - securityContext: - runAsUser: 0 - runAsGroup: 0 - capabilities: - add: - - NET_ADMIN - - NET_RAW - - MKNOD - - SYS_MODULE - # -- The common library supports adding a code-server add-on to access files. It can be configured under this key. # @default -- See values.yaml codeserver: