Importing my fork of the helm chart
Signed-off-by: Martyn Ranyard <m@rtyn.berlin>
This commit is contained in:
parent
2dfd935366
commit
06001b4216
|
|
@ -0,0 +1,23 @@
|
|||
# Patterns to ignore when building packages.
|
||||
# This supports shell glob matching, relative path matching, and
|
||||
# negation (prefixed with !). Only one pattern per line.
|
||||
.DS_Store
|
||||
# Common VCS dirs
|
||||
.git/
|
||||
.gitignore
|
||||
.bzr/
|
||||
.bzrignore
|
||||
.hg/
|
||||
.hgignore
|
||||
.svn/
|
||||
# Common backup files
|
||||
*.swp
|
||||
*.bak
|
||||
*.tmp
|
||||
*.orig
|
||||
*~
|
||||
# Various IDEs
|
||||
.project
|
||||
.idea/
|
||||
*.tmproj
|
||||
.vscode/
|
||||
|
|
@ -0,0 +1,5 @@
|
|||
apiVersion: v2
|
||||
appVersion: v0.8.0
|
||||
description: A Wireguard VPN Access Server
|
||||
name: wg-access-server
|
||||
version: v0.8.0
|
||||
|
|
@ -0,0 +1,86 @@
|
|||
## Installing the Chart
|
||||
|
||||
To install the chart with the release name `my-release`:
|
||||
|
||||
```bash
|
||||
$ helm install my-release --repo https://place1.github.io/wg-access-server wg-access-server
|
||||
```
|
||||
|
||||
The command deploys wg-access-server on the Kubernetes cluster in the default configuration. The configuration section lists the parameters that can be configured during installation.
|
||||
|
||||
By default an in-memory wireguard private key will be generated and devices will not persist
|
||||
between pod restarts.
|
||||
|
||||
## Uninstalling the Chart
|
||||
|
||||
To uninstall/delete the my-release deployment:
|
||||
|
||||
```bash
|
||||
$ helm delete my-release
|
||||
```
|
||||
|
||||
The command removes all the Kubernetes components associated with the chart and deletes the release.
|
||||
|
||||
## Example values.yaml
|
||||
|
||||
```yaml
|
||||
config:
|
||||
wireguard:
|
||||
externalHost: "<loadbalancer-ip>"
|
||||
|
||||
# wg access server is an http server without TLS. Exposing it via a loadbalancer is NOT secure!
|
||||
# Uncomment the following section only if you are running on private network or simple testing.
|
||||
# A much better option would be TLS terminating ingress controller or reverse-proxy.
|
||||
# web:
|
||||
# service:
|
||||
# type: "LoadBalancer"
|
||||
# loadBalancerIP: "<loadbalancer-ip>"
|
||||
|
||||
wireguard:
|
||||
config:
|
||||
privateKey: "<wireguard-private-key>"
|
||||
service:
|
||||
type: "LoadBalancer"
|
||||
loadBalancerIP: "<loadbalancer-ip>"
|
||||
|
||||
persistence:
|
||||
enabled: true
|
||||
|
||||
ingress:
|
||||
enabled: true
|
||||
hosts: ["vpn.example.com"]
|
||||
tls:
|
||||
- hosts: ["vpn.example.com"]
|
||||
secretName: "tls-wg-access-server"
|
||||
```
|
||||
|
||||
|
||||
|
||||
## All Configuration
|
||||
|
||||
| Key | Type | Default | Description |
|
||||
|-----|------|---------|-------------|
|
||||
| config | object | `{}` | inline wg-access-server config (config.yaml) |
|
||||
| web.service.type | string | `"ClusterIP"` | |
|
||||
| wireguard.config.privateKey | string | "" | A wireguard private key. You can generate one using `$ wg genkey` |
|
||||
| wireguard.service.type | string | `"ClusterIP"` | |
|
||||
| ingress.enabled | bool | `false` | |
|
||||
| ingress.hosts | string | `nil` | |
|
||||
| ingress.tls | list | `[]` | |
|
||||
| ingress.annotations | object | `{}` | |
|
||||
| persistence.enabled | bool | `false` | |
|
||||
| persistence.existingClaim | string | `""` | Use existing PVC claim for persistence instead |
|
||||
| persistence.size | string | `"100Mi"` | |
|
||||
| persistence.subPath | string | `""` | |
|
||||
| persistence.annotations | object | `{}` | |
|
||||
| persistence.accessModes[0] | string | `"ReadWriteOnce"` | |
|
||||
| strategy.type | string | `"Recreate"` | |
|
||||
| resources | object | `{}` | pod cpu/memory resource requests and limits |
|
||||
| nameOverride | string | `""` | |
|
||||
| fullnameOverride | string | `""` | |
|
||||
| affinity | object | `{}` | |
|
||||
| nodeSelector | object | `{}` | |
|
||||
| tolerations | list | `[]` | |
|
||||
| image.pullPolicy | string | `"IfNotPresent"` | |
|
||||
| image.repository | string | `"place1/wg-access-server"` | |
|
||||
| imagePullSecrets | list | `[]` | |
|
||||
|
|
@ -0,0 +1,64 @@
|
|||
{{/* vim: set filetype=mustache: */}}
|
||||
{{/*
|
||||
Expand the name of the chart.
|
||||
*/}}
|
||||
{{- define "wg-access-server.name" -}}
|
||||
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Create a default fully qualified app name.
|
||||
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
|
||||
If release name contains chart name it will be used as a full name.
|
||||
*/}}
|
||||
{{- define "wg-access-server.fullname" -}}
|
||||
{{- if .Values.fullnameOverride -}}
|
||||
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}}
|
||||
{{- else -}}
|
||||
{{- $name := default .Chart.Name .Values.nameOverride -}}
|
||||
{{- if contains $name .Release.Name -}}
|
||||
{{- .Release.Name | trunc 63 | trimSuffix "-" -}}
|
||||
{{- else -}}
|
||||
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Create chart name and version as used by the chart label.
|
||||
*/}}
|
||||
{{- define "wg-access-server.chart" -}}
|
||||
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Common labels
|
||||
*/}}
|
||||
{{- define "wg-access-server.labels" -}}
|
||||
helm.sh/chart: {{ include "wg-access-server.chart" . }}
|
||||
{{ include "wg-access-server.selectorLabels" . }}
|
||||
{{- if .Chart.AppVersion }}
|
||||
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
|
||||
{{- end }}
|
||||
app.kubernetes.io/managed-by: {{ .Release.Service }}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Selector labels
|
||||
*/}}
|
||||
{{- define "wg-access-server.selectorLabels" -}}
|
||||
app: {{ include "wg-access-server.name" . }}
|
||||
app.kubernetes.io/name: {{ include "wg-access-server.name" . }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Create the name of the service account to use
|
||||
*/}}
|
||||
{{- define "wg-access-server.serviceAccountName" -}}
|
||||
{{- if .Values.serviceAccount.create -}}
|
||||
{{ default (include "wg-access-server.fullname" .) .Values.serviceAccount.name }}
|
||||
{{- else -}}
|
||||
{{ default "default" .Values.serviceAccount.name }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
|
@ -0,0 +1,11 @@
|
|||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: {{ include "wg-access-server.fullname" . }}
|
||||
labels:
|
||||
{{- include "wg-access-server.labels" . | nindent 4 }}
|
||||
data:
|
||||
config.yaml: |-
|
||||
{{- if .Values.config }}
|
||||
{{ toYaml .Values.config | indent 4 }}
|
||||
{{- end }}
|
||||
|
|
@ -0,0 +1,107 @@
|
|||
{{- $fullName := include "wg-access-server.fullname" . -}}
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: {{ include "wg-access-server.fullname" . }}
|
||||
labels:
|
||||
{{- include "wg-access-server.labels" . | nindent 4 }}
|
||||
spec:
|
||||
replicas: {{ .Values.replicas }}
|
||||
strategy:
|
||||
{{- if .Values.persistence.enabled }}
|
||||
type: {{ .Values.strategy.type | default "Recreate" | quote }}
|
||||
{{- else }}
|
||||
type: {{ .Values.strategy.type | default "RollingUpdate" | quote }}
|
||||
{{- end }}
|
||||
selector:
|
||||
matchLabels:
|
||||
{{- include "wg-access-server.selectorLabels" . | nindent 6 }}
|
||||
template:
|
||||
metadata:
|
||||
annotations:
|
||||
checksum/configmap: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }}
|
||||
labels:
|
||||
{{- include "wg-access-server.selectorLabels" . | nindent 8 }}
|
||||
spec:
|
||||
{{- with .Values.imagePullSecrets }}
|
||||
imagePullSecrets:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
containers:
|
||||
- name: {{ .Chart.Name }}
|
||||
securityContext:
|
||||
capabilities:
|
||||
add: ['NET_ADMIN']
|
||||
image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
|
||||
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
||||
ports:
|
||||
- name: http
|
||||
containerPort: 8000
|
||||
protocol: TCP
|
||||
- name: wireguard
|
||||
containerPort: 51820
|
||||
protocol: UDP
|
||||
env:
|
||||
{{- if .Values.wireguard.config.privateKey }}
|
||||
- name: WG_WIREGUARD_PRIVATE_KEY
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: "{{ $fullName }}"
|
||||
key: privateKey
|
||||
{{- end }}
|
||||
{{- if .Values.web.config.adminUsername }}
|
||||
- name: WG_ADMIN_USERNAME
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: "{{ $fullName }}"
|
||||
key: adminUsername
|
||||
{{- end}}
|
||||
{{- if .Values.web.config.adminPassword }}
|
||||
- name: WG_ADMIN_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: "{{ $fullName }}"
|
||||
key: adminPassword
|
||||
{{- end}}
|
||||
volumeMounts:
|
||||
- name: tun
|
||||
mountPath: /dev/net/tun
|
||||
- name: data
|
||||
mountPath: /data
|
||||
- name: config
|
||||
mountPath: /config.yaml
|
||||
subPath: config.yaml
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /
|
||||
port: http
|
||||
resources:
|
||||
{{- toYaml .Values.resources | nindent 12 }}
|
||||
volumes:
|
||||
- name: tun
|
||||
hostPath:
|
||||
type: 'CharDevice'
|
||||
path: /dev/net/tun
|
||||
- name: data
|
||||
{{- if .Values.persistence.enabled }}
|
||||
persistentVolumeClaim:
|
||||
claimName: {{ if .Values.persistence.existingClaim }}{{ .Values.persistence.existingClaim }}{{- else }}{{ $fullName }}{{- end }}
|
||||
{{- end }}
|
||||
{{- if not .Values.persistence.enabled }}
|
||||
emptyDir: {}
|
||||
{{- end }}
|
||||
- name: config
|
||||
configMap:
|
||||
name: "{{ $fullName }}"
|
||||
{{- with .Values.nodeSelector }}
|
||||
nodeSelector:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.affinity }}
|
||||
affinity:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.tolerations }}
|
||||
tolerations:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
|
|
@ -0,0 +1,34 @@
|
|||
{{- if .Values.ingress.enabled -}}
|
||||
{{- $fullName := include "wg-access-server.fullname" . -}}
|
||||
apiVersion: networking.k8s.io/v1beta1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: {{ $fullName }}
|
||||
labels:
|
||||
{{- include "wg-access-server.labels" . | nindent 4 }}
|
||||
{{- with .Values.ingress.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- if .Values.ingress.tls }}
|
||||
tls:
|
||||
{{- range .Values.ingress.tls }}
|
||||
- hosts:
|
||||
{{- range .hosts }}
|
||||
- {{ . | quote }}
|
||||
{{- end }}
|
||||
secretName: {{ .secretName }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
rules:
|
||||
{{- range .Values.ingress.hosts }}
|
||||
- host: {{ . | quote }}
|
||||
http:
|
||||
paths:
|
||||
- path: /
|
||||
backend:
|
||||
serviceName: {{ $fullName }}-web
|
||||
servicePort: 80
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
|
@ -0,0 +1,29 @@
|
|||
{{- if .Values.persistence.enabled -}}
|
||||
{{- $fullName := include "wg-access-server.fullname" . -}}
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: "{{ $fullName }}"
|
||||
labels:
|
||||
{{- include "wg-access-server.labels" . | nindent 4 }}
|
||||
{{- with .Values.persistence.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
accessModes:
|
||||
{{ toYaml .Values.persistence.accessModes | indent 4 }}
|
||||
{{- if .Values.persistence.storageClass }}
|
||||
{{- if (eq "-" .Values.persistence.storageClass) }}
|
||||
storageClassName: ""
|
||||
{{- else }}
|
||||
storageClassName: "{{ .Values.persistence.storageClass }}"
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.persistence.volumeBindingMode }}
|
||||
volumeBindingModeName: "{{ .Values.persistence.volumeBindingMode }}"
|
||||
{{- end }}
|
||||
resources:
|
||||
requests:
|
||||
storage: "{{ .Values.persistence.size }}"
|
||||
{{- end -}}
|
||||
|
|
@ -0,0 +1,18 @@
|
|||
{{- $fullName := include "wg-access-server.fullname" . -}}
|
||||
{{- if .Values.wireguard.config.privateKey }}
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: "{{ $fullName }}"
|
||||
labels:
|
||||
{{- include "wg-access-server.labels" . | nindent 4 }}
|
||||
type: Opaque
|
||||
data:
|
||||
privateKey: {{ .Values.wireguard.config.privateKey | b64enc | quote }}
|
||||
{{- if .Values.web.config.adminUsername }}
|
||||
adminUsername: {{ .Values.web.config.adminUsername | b64enc | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.web.config.adminPassword }}
|
||||
adminPassword: {{ .Values.web.config.adminPassword | b64enc | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
|
@ -0,0 +1,55 @@
|
|||
{{- $fullName := include "wg-access-server.fullname" . -}}
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ $fullName }}-web
|
||||
labels:
|
||||
{{- include "wg-access-server.labels" . | nindent 4 }}
|
||||
{{- if .Values.web.service.annotations }}
|
||||
annotations:
|
||||
{{ toYaml .Values.web.service.annotations | indent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- if .Values.web.service.externalTrafficPolicy }}
|
||||
externalTrafficPolicy: {{ .Values.web.service.externalTrafficPolicy }}
|
||||
{{- end }}
|
||||
type: {{ .Values.web.service.type }}
|
||||
{{- if .Values.web.service.loadBalancerIP }}
|
||||
loadBalancerIP: {{ .Values.web.service.loadBalancerIP }}
|
||||
{{- end }}
|
||||
ports:
|
||||
- port: 80
|
||||
targetPort: 8000
|
||||
protocol: TCP
|
||||
name: http
|
||||
selector:
|
||||
{{- include "wg-access-server.selectorLabels" . | nindent 4 }}
|
||||
|
||||
---
|
||||
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ $fullName }}-wireguard
|
||||
labels:
|
||||
{{- include "wg-access-server.labels" . | nindent 4 }}
|
||||
{{- if .Values.wireguard.service.annotations }}
|
||||
annotations:
|
||||
{{ toYaml .Values.wireguard.service.annotations | indent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
type: {{ .Values.wireguard.service.type }}
|
||||
sessionAffinity: ClientIP
|
||||
{{- if .Values.wireguard.service.externalTrafficPolicy }}
|
||||
externalTrafficPolicy: {{ .Values.wireguard.service.externalTrafficPolicy }}
|
||||
{{- end }}
|
||||
{{- if .Values.wireguard.service.loadBalancerIP }}
|
||||
loadBalancerIP: {{ .Values.wireguard.service.loadBalancerIP }}
|
||||
{{- end }}
|
||||
ports:
|
||||
- port: 51820
|
||||
targetPort: 51820
|
||||
protocol: UDP
|
||||
name: wireguard
|
||||
selector:
|
||||
{{- include "wg-access-server.selectorLabels" . | nindent 4 }}
|
||||
|
|
@ -0,0 +1,83 @@
|
|||
# wg-access-server config
|
||||
config: {}
|
||||
|
||||
web:
|
||||
config:
|
||||
adminUsername: ""
|
||||
adminPassword: ""
|
||||
service:
|
||||
type: ClusterIP
|
||||
|
||||
wireguard:
|
||||
config:
|
||||
privateKey: ""
|
||||
service:
|
||||
type: ClusterIP
|
||||
|
||||
persistence:
|
||||
enabled: false
|
||||
## Persistent Volume Storage Class
|
||||
## If defined, storageClassName: <storageClass>
|
||||
## If set to "-", storageClassName: "", which disables dynamic provisioning
|
||||
## If undefined (the default) or set to null, no storageClassName spec is
|
||||
## set, choosing the default provisioner. (gp2 on AWS, standard on
|
||||
## GKE, AWS & OpenStack)
|
||||
##
|
||||
# storageClass: "-"
|
||||
size: 100Mi
|
||||
annotations: {}
|
||||
accessModes:
|
||||
- ReadWriteOnce
|
||||
subPath: ""
|
||||
|
||||
|
||||
ingress:
|
||||
enabled: false
|
||||
annotations: {}
|
||||
# kubernetes.io/ingress.class: nginx
|
||||
# kubernetes.io/tls-acme: "true"
|
||||
hosts:
|
||||
# - www.example.com
|
||||
tls: []
|
||||
# - secretName: chart-example-tls
|
||||
# hosts:
|
||||
# - chart-example.local
|
||||
|
||||
nameOverride: ""
|
||||
|
||||
fullnameOverride: ""
|
||||
|
||||
imagePullSecrets: []
|
||||
|
||||
image:
|
||||
repository: ghcr.io/freifunkmuc/wg-access-server
|
||||
pullPolicy: IfNotPresent
|
||||
# This is kinda a bad default but other options are worse
|
||||
tag: latest
|
||||
|
||||
# multiple replicas is only supported when using
|
||||
# a supported highly-available storage backend (i.e. postgresql)
|
||||
replicas: 1
|
||||
|
||||
strategy: {}
|
||||
# the deployment strategy type will default to "Recreate" when persistence is enabled
|
||||
# or "RollingUpdate" when persistence is not enabled.
|
||||
# type: Recreate
|
||||
|
||||
resources: {}
|
||||
# We usually recommend not to specify default resources and to leave this as a conscious
|
||||
# choice for the user. This also increases chances charts run on environments with little
|
||||
# resources, such as Minikube. If you do want to specify resources, uncomment the following
|
||||
# lines, adjust them as necessary, and remove the curly braces after 'resources:'.
|
||||
# limits:
|
||||
# cpu: 100m
|
||||
# memory: 128Mi
|
||||
# requests:
|
||||
# cpu: 100m
|
||||
# memory: 128Mi
|
||||
|
||||
nodeSelector: {}
|
||||
|
||||
tolerations: []
|
||||
|
||||
affinity: {}
|
||||
Loading…
Reference in New Issue