From b660bbf457f4ce6e60e6294df6dd4d6ad11cf9af Mon Sep 17 00:00:00 2001 From: Kjeld Schouten-Lebbing Date: Sun, 12 Sep 2021 17:39:01 +0200 Subject: [PATCH] improv: improve dns and vpn values.yaml syntaxis (#970) * improv: improve dns and vpn values.yaml syntaxis * hmm * fix tests * no message --- charts/library/common/Chart.yaml | 2 +- charts/library/common/templates/_all.tpl | 2 +- .../common/templates/addons/vpn/_vpn.tpl | 2 +- .../addons/vpn/openvpn/_container.tpl | 16 +++++++-- .../addons/vpn/wireguard/_container.tpl | 34 ++++++++++++++++-- .../common/templates/lib/controller/_pod.tpl | 16 +++++++-- charts/library/common/tests/addon_vpn_test.go | 2 +- charts/library/common/values.yaml | 36 ++++++++++--------- 8 files changed, 82 insertions(+), 28 deletions(-) diff --git a/charts/library/common/Chart.yaml b/charts/library/common/Chart.yaml index 3cb656277e5..b66fdc1a931 100644 --- a/charts/library/common/Chart.yaml +++ b/charts/library/common/Chart.yaml @@ -18,4 +18,4 @@ maintainers: name: common sources: null type: library -version: 7.0.3 +version: 7.0.4 diff --git a/charts/library/common/templates/_all.tpl b/charts/library/common/templates/_all.tpl index 581c27a7dfc..8a7f56a7a8b 100644 --- a/charts/library/common/templates/_all.tpl +++ b/charts/library/common/templates/_all.tpl @@ -11,7 +11,7 @@ Main entrypoint for the common library chart. It will render all underlying temp {{- end -}} {{- /* Enable VPN add-on if required */ -}} - {{- if .Values.addons.vpn.enabled }} + {{- if ne "disabled" .Values.addons.vpn.type -}} {{- include "common.addon.vpn" . }} {{- end -}} diff --git a/charts/library/common/templates/addons/vpn/_vpn.tpl b/charts/library/common/templates/addons/vpn/_vpn.tpl index fc25c63b461..5f537c6a015 100644 --- a/charts/library/common/templates/addons/vpn/_vpn.tpl +++ b/charts/library/common/templates/addons/vpn/_vpn.tpl @@ -3,7 +3,7 @@ Template to render VPN addon It will include / inject the required templates based on the given values. */}} {{- define "common.addon.vpn" -}} -{{- if .Values.addons.vpn.enabled -}} +{{- if ne "disabled" .Values.addons.vpn.type -}} {{- if eq "openvpn" .Values.addons.vpn.type -}} {{- include "common.addon.openvpn" . }} {{- end -}} diff --git a/charts/library/common/templates/addons/vpn/openvpn/_container.tpl b/charts/library/common/templates/addons/vpn/openvpn/_container.tpl index 0e7b3f96bdb..6cf7d46b2dc 100644 --- a/charts/library/common/templates/addons/vpn/openvpn/_container.tpl +++ b/charts/library/common/templates/addons/vpn/openvpn/_container.tpl @@ -5,12 +5,24 @@ The OpenVPN sidecar container to be inserted. name: openvpn image: "{{ .Values.openvpnImage.repository }}:{{ .Values.openvpnImage.tag }}" imagePullPolicy: {{ .Values.openvpnImage.pullPolicy }} -{{- with .Values.addons.vpn.securityContext }} securityContext: + capabilities: + add: + - NET_ADMIN + - SYS_MODULE +{{- with .Values.addons.vpn.securityContext }} {{- toYaml . | nindent 2 }} {{- end }} -{{- with .Values.addons.vpn.env }} env: +{{- range $envList := .Values.addons.vpn.envList }} + {{- if and $envList.name $envList.value }} + - name: {{ $envList.name }} + value: {{ $envList.value | quote }} + {{- else }} + {{- fail "Please specify name/value for VPN environment variable" }} + {{- end }} +{{- end}} +{{- with .Values.addons.vpn.env }} {{- range $k, $v := . }} - name: {{ $k }} value: {{ $v | quote }} diff --git a/charts/library/common/templates/addons/vpn/wireguard/_container.tpl b/charts/library/common/templates/addons/vpn/wireguard/_container.tpl index 3c5496675eb..3df48abc790 100644 --- a/charts/library/common/templates/addons/vpn/wireguard/_container.tpl +++ b/charts/library/common/templates/addons/vpn/wireguard/_container.tpl @@ -5,16 +5,46 @@ The Wireguard sidecar container to be inserted. name: wireguard image: "{{ .Values.wireguardImage.repository }}:{{ .Values.wireguardImage.tag }}" imagePullPolicy: {{ .Values.wireguardImage.pullPolicy }} -{{- with .Values.addons.vpn.securityContext }} securityContext: + runAsUser: 568 + runAsGroup: 568 + fsGroup: 568 + capabilities: + add: + - NET_ADMIN + - SYS_MODULE +{{- with .Values.addons.vpn.securityContext }} {{- toYaml . | nindent 2 }} {{- end }} -{{- with .Values.addons.vpn.env }} env: +{{- range $envList := .Values.addons.vpn.envList }} + {{- if and $envList.name $envList.value }} + - name: {{ $envList.name }} + value: {{ $envList.value | quote }} + {{- else }} + {{- fail "Please specify name/value for VPN environment variable" }} + {{- end }} +{{- end}} +{{- with .Values.addons.vpn.env }} {{- range $k, $v := . }} - name: {{ $k }} value: {{ $v | quote }} {{- end }} + - name: SEPARATOR + value: ";" +{{- if .Values.addons.vpn.wireguard.KILLSWITCH }} + - name: KILLSWITCH + value: "true" +{{- if .Values.addons.vpn.wireguard.KILLSWITCH_EXCLUDEDNETWORKS_IPV4 }} + - name: KILLSWITCH_EXCLUDEDNETWORKS_IPV4 + value: {{ .Values.addons.vpn.wireguard.KILLSWITCH_EXCLUDEDNETWORKS_IPV4 | quote }} +{{- end }} +{{- if .Values.addons.vpn.wireguard.KILLSWITCH_EXCLUDEDNETWORKS_IPV6 }} + - name: KILLSWITCH_EXCLUDEDNETWORKS_IPV4 + value: {{ .Values.addons.vpn.wireguard.KILLSWITCH_EXCLUDEDNETWORKS_IPV6 | quote }} +{{- end }} +{{- end }} + {{- end }} {{- if or .Values.addons.vpn.configFile .Values.addons.vpn.scripts.up .Values.addons.vpn.scripts.down .Values.addons.vpn.additionalVolumeMounts .Values.persistence.shared.enabled }} volumeMounts: diff --git a/charts/library/common/templates/lib/controller/_pod.tpl b/charts/library/common/templates/lib/controller/_pod.tpl index 0c91a5dc63c..a81e4c8f6ec 100644 --- a/charts/library/common/templates/lib/controller/_pod.tpl +++ b/charts/library/common/templates/lib/controller/_pod.tpl @@ -30,10 +30,21 @@ dnsPolicy: ClusterFirstWithHostNet {{- else }} dnsPolicy: ClusterFirst {{- end }} - {{- with .Values.dnsConfig }} +{{- if or .Values.dnsConfig.options .Values.dnsConfig.nameservers .Values.dnsConfig.searches }} dnsConfig: - {{- toYaml . | nindent 2 }} + {{- with .Values.dnsConfig.options }} + options: + {{- toYaml . | nindent 4 }} {{- end }} + {{- with .Values.dnsConfig.nameservers }} + nameservers: [] + {{- toYaml . | nindent 4 }} + {{- end }} + {{- with .Values.dnsConfig.searches }} + searches: [] + {{- toYaml . | nindent 4 }} + {{- end }} +{{- end }} enableServiceLinks: {{ .Values.enableServiceLinks }} {{- with .Values.termination.gracePeriodSeconds }} terminationGracePeriodSeconds: {{ . }} @@ -51,7 +62,6 @@ initContainers: {{- end }} {{- tpl (toYaml $initContainers) $ | nindent 2 }} {{- end }} - containers: {{- include "common.controller.mainContainer" . | nindent 2 }} {{- with .Values.additionalContainers }} diff --git a/charts/library/common/tests/addon_vpn_test.go b/charts/library/common/tests/addon_vpn_test.go index cd67c451219..6573c17b4ef 100644 --- a/charts/library/common/tests/addon_vpn_test.go +++ b/charts/library/common/tests/addon_vpn_test.go @@ -17,7 +17,7 @@ type AddonVpnTestSuite struct { func (suite *AddonVpnTestSuite) SetupSuite() { suite.Chart = helmunit.New("common-test", "../../common-test") suite.Chart.UpdateDependencies() - suite.baseValues = []string{"addons.vpn.enabled=true"} + suite.baseValues = []string{"addons.vpn.type=openvpn"} } // We need this function to kick off the test suite, otherwise diff --git a/charts/library/common/values.yaml b/charts/library/common/values.yaml index 9a556f1bc7d..1069064c713 100644 --- a/charts/library/common/values.yaml +++ b/charts/library/common/values.yaml @@ -237,10 +237,10 @@ hostNetwork: false dnsPolicy: # ClusterFirst # -- Optional DNS settings, configuring the ndots option may resolve nslookup issues on some Kubernetes setups. -dnsConfig: {} -# options: -# - name: ndots -# value: "1" +dnsConfig: + options: [] + nameservers: [] + searches: [] # -- Enable/disable the generation of environment variables for services. # [[ref]](https://kubernetes.io/docs/concepts/services-networking/connect-applications-service/#accessing-the-service) @@ -686,11 +686,9 @@ addons: # For more info, check out [our docs](http://docs.k8s-at-home.com/our-helm-charts/common-library-add-ons/#wireguard-vpn) # @default -- See values.yaml vpn: - # -- Enable running a VPN in the pod to route traffic through a VPN - enabled: false - # -- Specify the VPN type. Valid options are openvpn or wireguard - type: openvpn + # -- Specify the VPN type. Valid options are disabled, openvpn or wireguard + type: disabled # -- OpenVPN specific configuration # @default -- See below @@ -700,23 +698,27 @@ addons: # -- Optionally specify an existing secret that contains the credentials. # Credentials should be stored under the `VPN_AUTH` key authSecret: # my-vpn-secret - # -- WireGuard specific configuration - # @default -- See below - wireguard: {} - # -- Set the VPN container securityContext + wireguard: + KILLSWITCH: true + KILLSWITCH_EXCLUDEDNETWORKS_IPV4: + - 192.168.0.0.1 + # -- Set the VPN container specific securityContext # @default -- See values.yaml - securityContext: - capabilities: - add: - - NET_ADMIN - - SYS_MODULE + securityContext: {} # -- All variables specified here will be added to the vpn sidecar container # See the documentation of the VPN image for all config values env: {} # TZ: UTC + # -- All variables specified here will be added to the vpn sidecar container + # See the documentation of the VPN image for all config values + envList: [] + # name: someenv + # value: somevalue + + # -- Provide a customized vpn configuration file to be used by the VPN. configFile: enabled: false