139 lines
4.0 KiB
YAML
139 lines
4.0 KiB
YAML
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: openvpn
|
|
namespace: openvpn
|
|
spec:
|
|
replicas: 1
|
|
selector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: openvpn
|
|
strategy:
|
|
type: Recreate
|
|
template:
|
|
metadata:
|
|
annotations:
|
|
openvpn.whyredfire.dev/config-revision: "1"
|
|
labels:
|
|
app.kubernetes.io/name: openvpn
|
|
spec:
|
|
containers:
|
|
- args:
|
|
- |
|
|
# The sync API serves the PKI to replica servers, which this
|
|
# setup doesn't use, so lock it with a throwaway token.
|
|
exec /app/ovpn-admin \
|
|
--storage.backend=kubernetes.secrets \
|
|
--listen.port=8080 \
|
|
--mgmt=main=127.0.0.1:8989 \
|
|
--ccd \
|
|
--ccd.path=/mnt/ccd \
|
|
--easyrsa.path=/mnt/certs \
|
|
--ovpn.network=10.8.0.0/24 \
|
|
--ovpn.server=openvpn.whyredfire.dev:27299:udp \
|
|
--templates.clientconfig-path=/templates/client.conf.tpl \
|
|
--master.sync-token="$(head -c 32 /dev/urandom | od -An -tx1 | tr -d ' \n')"
|
|
command:
|
|
- /bin/sh
|
|
- -c
|
|
image: ghcr.io/palark/ovpn-admin/ovpn-admin:master@sha256:8487aec078954ba682fb22cd2882ec3e4faaa03a47cc3e06f786b3ec493ded79
|
|
name: ovpn-admin
|
|
ports:
|
|
- containerPort: 8080
|
|
name: http
|
|
readinessProbe:
|
|
httpGet:
|
|
path: /ping
|
|
port: http
|
|
resources:
|
|
limits:
|
|
cpu: 500m
|
|
memory: 128Mi
|
|
requests:
|
|
cpu: 10m
|
|
memory: 32Mi
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
capabilities:
|
|
drop:
|
|
- ALL
|
|
volumeMounts:
|
|
- mountPath: /mnt/certs
|
|
name: certs
|
|
- mountPath: /mnt/ccd
|
|
name: ccd
|
|
- mountPath: /templates/client.conf.tpl
|
|
name: config
|
|
readOnly: true
|
|
subPath: client.conf.tpl
|
|
- command:
|
|
- /entrypoint.sh
|
|
env:
|
|
- name: CLUSTER_CIDR
|
|
value: 10.42.0.0/16
|
|
- name: SERVICE_CIDR
|
|
value: 10.43.0.0/16
|
|
- name: VPN_NETWORK
|
|
value: 10.8.0.0/24
|
|
image: ghcr.io/palark/ovpn-admin/openvpn:master@sha256:130657e1938675f9492dcb554fdf63357eaddad90a1514c73db9a433e3de77b6
|
|
name: openvpn
|
|
ports:
|
|
- containerPort: 1194
|
|
name: openvpn
|
|
protocol: UDP
|
|
resources:
|
|
limits:
|
|
cpu: "1"
|
|
memory: 128Mi
|
|
requests:
|
|
cpu: 10m
|
|
memory: 32Mi
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
capabilities:
|
|
add:
|
|
- MKNOD
|
|
- NET_ADMIN
|
|
- NET_RAW
|
|
- SETGID
|
|
- SETUID
|
|
drop:
|
|
- ALL
|
|
volumeMounts:
|
|
- mountPath: /dev/net
|
|
name: dev-net
|
|
- mountPath: /etc/openvpn/certs
|
|
name: certs
|
|
readOnly: true
|
|
- mountPath: /etc/openvpn/ccd
|
|
name: ccd
|
|
readOnly: true
|
|
- mountPath: /etc/openvpn/openvpn.conf
|
|
name: config
|
|
readOnly: true
|
|
subPath: openvpn.conf
|
|
- mountPath: /entrypoint.sh
|
|
name: entrypoint
|
|
readOnly: true
|
|
subPath: entrypoint.sh
|
|
dnsConfig:
|
|
nameservers:
|
|
- 192.168.2.1
|
|
dnsPolicy: None
|
|
serviceAccountName: openvpn
|
|
volumes:
|
|
- emptyDir:
|
|
medium: Memory
|
|
name: certs
|
|
- emptyDir: {}
|
|
name: ccd
|
|
- emptyDir: {}
|
|
name: dev-net
|
|
- configMap:
|
|
name: openvpn
|
|
name: config
|
|
- configMap:
|
|
defaultMode: 493
|
|
name: openvpn
|
|
name: entrypoint
|