98 lines
2.6 KiB
YAML
98 lines
2.6 KiB
YAML
apiVersion: v1
|
|
data:
|
|
client.conf.tpl: |
|
|
client
|
|
dev tun
|
|
{{- range $server := .Hosts }}
|
|
remote {{ $server.Host }} {{ $server.Port }} {{ $server.Protocol }}
|
|
{{- end }}
|
|
nobind
|
|
persist-key
|
|
persist-tun
|
|
remote-cert-tls server
|
|
tls-version-min 1.2
|
|
verb 3
|
|
|
|
<ca>
|
|
{{ .CA -}}
|
|
</ca>
|
|
<cert>
|
|
{{ .Cert -}}
|
|
</cert>
|
|
<key>
|
|
{{ .Key -}}
|
|
</key>
|
|
<tls-crypt>
|
|
{{ .TLS -}}
|
|
</tls-crypt>
|
|
entrypoint.sh: |
|
|
#!/bin/sh
|
|
set -eu
|
|
|
|
# These rules live in the pod's network namespace, not the node's. VPN clients
|
|
# may reach the home LAN, but not this pod (ovpn-admin has no auth of its own),
|
|
# the pod network or the service network.
|
|
iptables -F INPUT
|
|
iptables -F FORWARD
|
|
iptables -t nat -F POSTROUTING
|
|
iptables -A INPUT -i tun0 -j DROP
|
|
iptables -A FORWARD -i tun0 -d "$CLUSTER_CIDR" -j DROP
|
|
iptables -A FORWARD -i tun0 -d "$SERVICE_CIDR" -j DROP
|
|
iptables -t nat -A POSTROUTING -s "$VPN_NETWORK" -o eth0 -j MASQUERADE
|
|
|
|
if [ "$(cat /proc/sys/net/ipv4/ip_forward)" != 1 ]; then
|
|
echo "net.ipv4.ip_forward is disabled in the pod network namespace" >&2
|
|
exit 1
|
|
fi
|
|
|
|
mkdir -p /dev/net
|
|
[ -c /dev/net/tun ] || mknod /dev/net/tun c 10 200
|
|
|
|
for f in ca.crt issued/server.crt private/server.key ta.key crl.pem; do
|
|
until [ -f "/etc/openvpn/certs/pki/$f" ]; do
|
|
echo "waiting for $f from ovpn-admin"
|
|
sleep 2
|
|
done
|
|
done
|
|
|
|
exec openvpn --config /etc/openvpn/openvpn.conf
|
|
openvpn.conf: |
|
|
# After editing this ConfigMap, bump openvpn.whyredfire.dev/config-revision
|
|
# on the Deployment to restart it.
|
|
port 1194
|
|
proto udp
|
|
dev tun0
|
|
topology subnet
|
|
server 10.8.0.0 255.255.255.0
|
|
client-config-dir /etc/openvpn/ccd
|
|
management 127.0.0.1 8989
|
|
|
|
# Written by ovpn-admin from the PKI it keeps in Kubernetes Secrets.
|
|
ca /etc/openvpn/certs/pki/ca.crt
|
|
cert /etc/openvpn/certs/pki/issued/server.crt
|
|
key /etc/openvpn/certs/pki/private/server.key
|
|
crl-verify /etc/openvpn/certs/pki/crl.pem
|
|
tls-crypt /etc/openvpn/certs/pki/ta.key
|
|
dh none
|
|
tls-version-min 1.2
|
|
remote-cert-tls client
|
|
|
|
# Split tunnel: only the home LAN goes through the VPN.
|
|
push "route 192.168.2.0 255.255.255.0"
|
|
push "dhcp-option DNS 192.168.2.1"
|
|
|
|
# DCO would need the ovpn kernel module on the node; plain tun keeps the pod self-contained.
|
|
disable-dco
|
|
keepalive 10 60
|
|
persist-key
|
|
persist-tun
|
|
explicit-exit-notify 1
|
|
user nobody
|
|
group nogroup
|
|
status /tmp/openvpn-status.log
|
|
verb 3
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: openvpn
|
|
namespace: openvpn
|