feat(apps): Add openvpn

2026-10-10 00:42:58 +05:30
parent 02cba0952e
commit e98a0e0b17
15 changed files with 449 additions and 0 deletions
@@ -0,0 +1,138 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: openvpn
+  namespace: openvpn
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: openvpn
+  strategy:
+    type: Recreate
+  template:
+    metadata:
+      annotations:
+        openvpn.whyredfire.dev/config-revision: "1"
+      labels:
+        app.kubernetes.io/name: openvpn
+    spec:
+      containers:
+        - args:
+            - |
+              # The sync API serves the PKI to replica servers, which this
+              # setup doesn't use, so lock it with a throwaway token.
+              exec /app/ovpn-admin \
+                --storage.backend=kubernetes.secrets \
+                --listen.port=8080 \
+                --mgmt=main=127.0.0.1:8989 \
+                --ccd \
+                --ccd.path=/mnt/ccd \
+                --easyrsa.path=/mnt/certs \
+                --ovpn.network=10.8.0.0/24 \
+                --ovpn.server=openvpn.whyredfire.dev:27299:udp \
+                --templates.clientconfig-path=/templates/client.conf.tpl \
+                --master.sync-token="$(head -c 32 /dev/urandom | od -An -tx1 | tr -d ' \n')"
+          command:
+            - /bin/sh
+            - -c
+          image: ghcr.io/palark/ovpn-admin/ovpn-admin:master@sha256:8487aec078954ba682fb22cd2882ec3e4faaa03a47cc3e06f786b3ec493ded79
+          name: ovpn-admin
+          ports:
+            - containerPort: 8080
+              name: http
+          readinessProbe:
+            httpGet:
+              path: /ping
+              port: http
+          resources:
+            limits:
+              cpu: 500m
+              memory: 128Mi
+            requests:
+              cpu: 10m
+              memory: 32Mi
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+          volumeMounts:
+            - mountPath: /mnt/certs
+              name: certs
+            - mountPath: /mnt/ccd
+              name: ccd
+            - mountPath: /templates/client.conf.tpl
+              name: config
+              readOnly: true
+              subPath: client.conf.tpl
+        - command:
+            - /entrypoint.sh
+          env:
+            - name: CLUSTER_CIDR
+              value: 10.42.0.0/16
+            - name: SERVICE_CIDR
+              value: 10.43.0.0/16
+            - name: VPN_NETWORK
+              value: 10.8.0.0/24
+          image: ghcr.io/palark/ovpn-admin/openvpn:master@sha256:130657e1938675f9492dcb554fdf63357eaddad90a1514c73db9a433e3de77b6
+          name: openvpn
+          ports:
+            - containerPort: 1194
+              name: openvpn
+              protocol: UDP
+          resources:
+            limits:
+              cpu: "1"
+              memory: 128Mi
+            requests:
+              cpu: 10m
+              memory: 32Mi
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              add:
+                - MKNOD
+                - NET_ADMIN
+                - NET_RAW
+                - SETGID
+                - SETUID
+              drop:
+                - ALL
+          volumeMounts:
+            - mountPath: /dev/net
+              name: dev-net
+            - mountPath: /etc/openvpn/certs
+              name: certs
+              readOnly: true
+            - mountPath: /etc/openvpn/ccd
+              name: ccd
+              readOnly: true
+            - mountPath: /etc/openvpn/openvpn.conf
+              name: config
+              readOnly: true
+              subPath: openvpn.conf
+            - mountPath: /entrypoint.sh
+              name: entrypoint
+              readOnly: true
+              subPath: entrypoint.sh
+      dnsConfig:
+        nameservers:
+          - 192.168.2.1
+      dnsPolicy: None
+      serviceAccountName: openvpn
+      volumes:
+        - emptyDir:
+            medium: Memory
+          name: certs
+        - emptyDir: {}
+          name: ccd
+        - emptyDir: {}
+          name: dev-net
+        - configMap:
+            name: openvpn
+          name: config
+        - configMap:
+            defaultMode: 493
+            name: openvpn
+          name: entrypoint