apiVersion: apps/v1
kind: Deployment
metadata:
  name: openvpn
  namespace: openvpn
spec:
  replicas: 1
  selector:
    matchLabels:
      app.kubernetes.io/name: openvpn
  strategy:
    type: Recreate
  template:
    metadata:
      annotations:
        openvpn.whyredfire.dev/config-revision: "1"
      labels:
        app.kubernetes.io/name: openvpn
    spec:
      containers:
        - args:
            - |
              # The sync API serves the PKI to replica servers, which this
              # setup doesn't use, so lock it with a throwaway token.
              exec /app/ovpn-admin \
                --storage.backend=kubernetes.secrets \
                --listen.port=8080 \
                --mgmt=main=127.0.0.1:8989 \
                --ccd \
                --ccd.path=/mnt/ccd \
                --easyrsa.path=/mnt/certs \
                --ovpn.network=10.8.0.0/24 \
                --ovpn.server=openvpn.whyredfire.dev:27299:udp \
                --templates.clientconfig-path=/templates/client.conf.tpl \
                --master.sync-token="$(head -c 32 /dev/urandom | od -An -tx1 | tr -d ' \n')"
          command:
            - /bin/sh
            - -c
          image: ghcr.io/palark/ovpn-admin/ovpn-admin:master@sha256:8487aec078954ba682fb22cd2882ec3e4faaa03a47cc3e06f786b3ec493ded79
          name: ovpn-admin
          ports:
            - containerPort: 8080
              name: http
          readinessProbe:
            httpGet:
              path: /ping
              port: http
          resources:
            limits:
              cpu: 500m
              memory: 128Mi
            requests:
              cpu: 10m
              memory: 32Mi
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
                - ALL
          volumeMounts:
            - mountPath: /mnt/certs
              name: certs
            - mountPath: /mnt/ccd
              name: ccd
            - mountPath: /templates/client.conf.tpl
              name: config
              readOnly: true
              subPath: client.conf.tpl
        - command:
            - /entrypoint.sh
          env:
            - name: CLUSTER_CIDR
              value: 10.42.0.0/16
            - name: SERVICE_CIDR
              value: 10.43.0.0/16
            - name: VPN_NETWORK
              value: 10.8.0.0/24
          image: ghcr.io/palark/ovpn-admin/openvpn:master@sha256:130657e1938675f9492dcb554fdf63357eaddad90a1514c73db9a433e3de77b6
          name: openvpn
          ports:
            - containerPort: 1194
              name: openvpn
              protocol: UDP
          resources:
            limits:
              cpu: "1"
              memory: 128Mi
            requests:
              cpu: 10m
              memory: 32Mi
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              add:
                - MKNOD
                - NET_ADMIN
                - NET_RAW
                - SETGID
                - SETUID
              drop:
                - ALL
          volumeMounts:
            - mountPath: /dev/net
              name: dev-net
            - mountPath: /etc/openvpn/certs
              name: certs
              readOnly: true
            - mountPath: /etc/openvpn/ccd
              name: ccd
              readOnly: true
            - mountPath: /etc/openvpn/openvpn.conf
              name: config
              readOnly: true
              subPath: openvpn.conf
            - mountPath: /entrypoint.sh
              name: entrypoint
              readOnly: true
              subPath: entrypoint.sh
      dnsConfig:
        nameservers:
          - 192.168.2.1
      dnsPolicy: None
      serviceAccountName: openvpn
      volumes:
        - emptyDir:
            medium: Memory
          name: certs
        - emptyDir: {}
          name: ccd
        - emptyDir: {}
          name: dev-net
        - configMap:
            name: openvpn
          name: config
        - configMap:
            defaultMode: 493
            name: openvpn
          name: entrypoint