danny-waite/openvpn-k8s

Kuberenetes openvpn docker container

offlinehacker/openvpn-k8s

• Introduction
• Contributing
• Prerequisites
• Installation
• Quick Start
• Configuration Parameters

Introduction

Dockerfile to run openvpn inside kubernetes.

NOTE this fork attempts to detect service/pod subnets and DNS address/domain when hosted on Google Container Engine

Contributing

If you find this image useful you can help by doing one of the following:

• Send a Pull Request: you can add new features to the docker image, which will be integrated into the official image.
• Report a Bug: if you notice a bug, please issue a bug report at Issues, so we can fix it as soon as possible.

Installation

Automated builds of the image are available on Dockerhub and is the recommended method of installation.

docker pull offlinehacker/openvpn-k8s:latest

Alternatively you can build the image locally.

git clone https://github.com/offlinehacker/openvpn-k8s.git
cd openvpn
docker build -t offlinehacker/openvpn-k8s .

Quick Start

This image was created to simply have openvpn access to kubernetes cluster.

First you will need to create secret volume with dh params and server certificate in pkcs12 format.

• Create kubernetes secret volume:

openvpn-secrets.yaml file:

apiVersion: v1
kind: Secret
metadata:
  name: openvpn
data:
  dh.pem: <base64_encoded_dh_pem_file>
  certs.p12: <base64_encoded_certs_file>

kubectl create -f openvpn-secrets.yaml

• Create kubernetes replication controller:

openvpn-controller.yaml file:

apiVersion: v1
kind: ReplicationController
metadata:
  name: openvpn
  labels:
    name: openvpn
spec:
  replicas: 2
  selector:
    name: openvpn
  template:
    metadata:
      labels:
        name: openvpn
    spec:
      containers:
        - name: openvpn
          image: offlinehacker/openvpn-k8s
          securityContext:
            capabilities:
              add:
                - NET_ADMIN
          env:
            - name: OVPN_NETWORK
              value: 10.240.0.0
            - name: OVPN_SUBNET
              value: 255.255.0.0
            - name: OVPN_PROTO
              value: tcp
            - name: OVPN_K8S_SERVICE_NETWORK
              value: 10.241.240.0
            - name: OVPN_K8S_SERVICE_SUBNET
              value: 255.255.240.0
            - name: OVPN_K8S_DNS
              value: 10.241.240.10
          ports:
            - name: openvpn
              containerPort: 1194
          volumeMounts:
            - mountPath: /etc/openvpn/pki
              name: openvpn
      volumes:
        - name: openvpn
          secret:
            secretName: openvpn

• Create kubernetes service:

openvpn-service.yaml file:

kind: Service
apiVersion: v1
metadata:
  name: openvpn
spec:
  ports:
    - name: openvpn
      port: 1194
      targetPort: 1194
  selector:
    name: openvpn
  type: LoadBalancer

kubectl create -f openvpn-service.yaml

Configuration Parameters

Below is the complete list of available options that can be used to customize your packetbeat container instance.

• OVPN_NETWORK: Network allocated for openvpn clients (default: 10.240.0.0).
• OVPN_SUBNET: Network subnet allocated for openvpn client (default: 255.255.0.0).
• OVPN_PROTO: Protocol used by openvpn tcp or udp (default: udp).
• OVPN_NATDEVICE: Device connected to kuberentes service network (default: eth0).
• OVPN_K8S_SERVICE_NETWORK: Kubernetes service network (required).
• OVPN_K8S_SERVICE_SUBNET: Kubernetes service network subnet (required).
• OVPN_K8S_DOMAIN: Kuberentes cluster domain (default: cluster.local).
• OVPN_K8S_DNS: Kuberentes cluster dns server (required).
• OVPN_K8S_DH: Openvpn dh.pem file path (default: /etc/openvpn/pki/dh.pem).
• OVPN_K8S_CERTS: Openvpn certs.p12 file path (default: /etc/openvpn/pki/certs.p12).
• MORE_OPTS: Misc Openvpn options, one per line, for example duplicate-cn
• OVPN_K8S_POD_NETWORK: Kubernetes pod network (optional).
• OVPN_K8S_POD_SUBNET: Kubernetes pod network subnet (optional).