Skip to content

Commit 146ea71

Browse files
bryopsidabryopsida
authored
Add pass through options for extra side cars and service ports (#53)
1 parent eb630e5 commit 146ea71

File tree

8 files changed

+160
-8
lines changed

8 files changed

+160
-8
lines changed

‎ci/test-with-extra-sidecar.yaml‎

Lines changed: 83 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,83 @@
1+
# with host network used, a service object is not needed
2+
service:
3+
enabled: false
4+
replicaCount: 1
5+
autoscaling:
6+
enabled: false
7+
deploymentStrategy:
8+
type: "Recreate"
9+
# create storage volumes for wg-portal sql lite database
10+
extraStorage:
11+
- name: wg-portal-data
12+
storage: 8Gi
13+
# omitting storage class and using default, if you need
14+
# to target a particular storage class specify this
15+
# storageClassName: some-storage-class
16+
accessModes:
17+
# ReadWriteOnce is used for easy testing,
18+
# if you are going to run multiple pods this needs to be
19+
# ReadWriteMany and you'll need a storage system that supports this
20+
- ReadWriteOnce
21+
volumeMode: Filesystem
22+
# wg-portal docs use host network and NET_ADMIN
23+
runPodOnHostNetwork: true
24+
extraConfigMaps:
25+
- name: wg-portal-config
26+
data:
27+
# this is from the sample config file in the wg-portal repo
28+
# as a placeholder in testing
29+
# be sure to adjust the external_url to something appropriate for your
30+
# network
31+
config.yml: |
32+
advanced:
33+
log_level: trace
34+
35+
core:
36+
admin_user: admin
37+
admin_password: wgportal
38+
create_default_peer: true
39+
create_default_peer_on_creation: false
40+
41+
web:
42+
external_url: http://localhost:8888
43+
request_logging: true
44+
# we need to mount/attach the storage to the pod
45+
volumes:
46+
- name: wg-portal-data
47+
persistentVolumeClaim:
48+
claimName: wg-portal-data
49+
- name: wg-portal-config
50+
configMap:
51+
name: wg-portal-config
52+
# add wg-portal side car
53+
extraSideCars:
54+
- name: wg-portal
55+
image: wgportal/wg-portal
56+
imagePullPolicy: Always
57+
securityContext:
58+
# wg-portal runs as root and enumerates devices
59+
# as far as I can tell it requires high level access to the node
60+
# to function
61+
runAsNonRoot: false
62+
capabilities:
63+
add:
64+
- NET_ADMIN
65+
ports:
66+
- containerPort: 8888
67+
protocol: TCP
68+
name: http
69+
# we need to mount the pod volume into the side car
70+
volumeMounts:
71+
- mountPath: "/app/config"
72+
name: wg-portal-config
73+
- mountPath: "/app/data"
74+
name: wg-portal-data
75+
# assuming the generated wg key secret is used
76+
# and the default wg0.conf management is used
77+
# need to project the following into /etc/wireguard for wg-portal
78+
- name: config
79+
mountPath: /etc/wireguard/wg0.conf
80+
subPath: wg0.conf
81+
- name: privatekey
82+
mountPath: /etc/wireguard/privatekey
83+
subPath: privatekey

‎helm/wireguard/Chart.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ apiVersion: v2
22
name: wireguard
33
description: A Helm chart for managing a wireguard vpn in kubernetes
44
type: application
5-
version: 0.22.0
5+
version: 0.23.0
66
appVersion: "0.0.0"
77
maintainers:
88
- name: bryopsida

‎helm/wireguard/README.md‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
# wireguard
22

3-
![Version: 0.22.0](https://img.shields.io/badge/Version-0.22.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 0.0.0](https://img.shields.io/badge/AppVersion-0.0.0-informational?style=flat-square)
3+
![Version: 0.23.0](https://img.shields.io/badge/Version-0.23.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 0.0.0](https://img.shields.io/badge/AppVersion-0.0.0-informational?style=flat-square)
44

55
A Helm chart for managing a wireguard vpn in kubernetes
66

@@ -29,7 +29,10 @@ A Helm chart for managing a wireguard vpn in kubernetes
2929
| disablePrivateKeyManagement | bool | `false` | Disable creation and any mounting of a private key, this assumes another mechanism is provided/used at the container level to fetch the private key |
3030
| disruptionBudget.enabled | bool | `true` | |
3131
| disruptionBudget.minAvailable | int | `2` | |
32+
| extraConfigMaps | list | `[]` | Create additional configmaps that may be used in sidecars |
3233
| extraEnv | object | `{}` | Provide additional environment variables to the wireguard container |
34+
| extraSideCars | list | `[]` | Provide additional sidecars to the wireguard pod, these are directly attached to the pod and must be well formed ContainerSpec |
35+
| extraStorage | list | `[]` | Create storage claims that can be used by side cars |
3336
| healthSideCar.enabled | bool | `false` | Opt in side car to expose a http health end point for external load balancers that are not kubernetes aware, in most cases this is not needed |
3437
| healthSideCar.hostPort | int | `13000` | When useHostPort is true this is the host port defined |
3538
| healthSideCar.image.pullPolicy | string | `"Always"` | Pull Policy always to avoid cached rolling tags, if you change this you should use a non rolling tag |
@@ -103,6 +106,7 @@ A Helm chart for managing a wireguard vpn in kubernetes
103106
| resources.limits.memory | string | `"256Mi"` | |
104107
| resources.requests.cpu | string | `"100m"` | |
105108
| resources.requests.memory | string | `"256Mi"` | |
109+
| runPodOnHostNetwork | bool | `false` | Run pod on host network |
106110
| runtimeClassName | string | `nil` | Override the default runtime class of the container, if not provided `runc` will most likely be used |
107111
| secretName | string | `nil` | Name of a secret with a wireguard private key on key privatekey, if not provided on first install a hook generates one. |
108112
| securityContext.allowPrivilegeEscalation | bool | `true` | |
@@ -113,6 +117,7 @@ A Helm chart for managing a wireguard vpn in kubernetes
113117
| service.annotations | object | `{}` | Annotations |
114118
| service.enabled | bool | `true` | Whether the service will be created or not |
115119
| service.externalTrafficPolicy | string | `""` | External Traffic Policy for the service |
120+
| service.extraPorts | list | `[]` | Extra ports that can be attached to the service object, these are passed directly to the port array on the service and must be well formed to the specification |
116121
| service.loadBalancerIP | string | `""` | IP to assign to the LoadBalancer service |
117122
| service.nodePort | int | `31820` | Node port, only valid with service type: NodePort |
118123
| service.port | int | `51820` | Service port, default is 51820 UDP |

‎helm/wireguard/templates/deployment.yaml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -105,6 +105,9 @@ spec:
105105
- pod-template-hash
106106
{{- end }}
107107
automountServiceAccountToken: {{ .Values.healthSideCar.enabled }}
108+
{{- if .Values.runPodOnHostNetwork }}
109+
hostNetwork: true
110+
{{- end }}
108111
securityContext:
109112
fsGroup: {{ .Values.securityContext.runAsUser | default 1000 }}
110113
fsGroupChangePolicy: "OnRootMismatch"
@@ -265,6 +268,9 @@ spec:
265268
hostPort: {{ .Values.healthSideCar.hostPort }}
266269
{{- end }}
267270
{{- end }}
271+
{{- if .Values.extraSideCars }}
272+
{{- .Values.extraSideCars | toYaml | nindent 8 }}
273+
{{- end }}
268274
volumes:
269275
- name: run
270276
emptyDir: {}

‎helm/wireguard/templates/extra-config-maps.yaml‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
{{- if .Values.extraConfigMaps }}
2+
{{- range .Values.extraConfigMaps }}
3+
---
4+
apiVersion: v1
5+
kind: ConfigMap
6+
metadata:
7+
name: {{ .name }}
8+
namespace: {{ $.Release.Namespace }}
9+
data: {{ .data | toYaml | nindent 2 }}
10+
{{- end }}
11+
{{- end }}

‎helm/wireguard/templates/extra-storage.yaml‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
{{- if .Values.extraStorage }}
2+
{{- range .Values.extraStorage }}
3+
---
4+
apiVersion: v1
5+
kind: PersistentVolumeClaim
6+
metadata:
7+
name: {{ .name }}
8+
namespace: {{ $.Release.Namespace }}
9+
annotations:
10+
"helm.sh/resource-policy": keep
11+
spec:
12+
{{- if .storageClassName }}
13+
storageClassName: {{ .storageClassName }}
14+
{{- end }}
15+
{{- if .volumeName }}
16+
volumeName: {{ .volumeName }}
17+
{{- end }}
18+
accessModes: {{ .accessModes | toYaml | nindent 4 }}
19+
volumeMode: {{ .volumeMode }}
20+
resources:
21+
requests:
22+
storage: {{ .storage }}
23+
{{- end }}
24+
{{- end }}

‎helm/wireguard/templates/service.yaml‎

Lines changed: 9 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -12,12 +12,15 @@ metadata:
1212
spec:
1313
type: {{ .Values.service.type }}
1414
ports:
15-
- name: wg
16-
protocol: UDP
17-
port: {{ .Values.service.port }}
18-
targetPort: 51820
19-
{{- if .Values.service.type | eq "NodePort" }}
20-
nodePort: {{ .Values.service.nodePort }}
15+
- name: wg
16+
protocol: UDP
17+
port: {{ .Values.service.port }}
18+
targetPort: 51820
19+
{{- if .Values.service.type | eq "NodePort" }}
20+
nodePort: {{ .Values.service.nodePort }}
21+
{{- end }}
22+
{{- if .Values.service.extraPorts }}
23+
{{- .Values.service.extraPorts | toYaml | nindent 4 }}
2124
{{- end }}
2225
selector:
2326
app: "{{ .Release.Name }}-wireguard"

‎helm/wireguard/values.yaml‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,8 @@ keygenJob:
3030
extraEnv: {}
3131
podAnnotations: {}
3232
labels: {}
33+
# -- Run pod on host network
34+
runPodOnHostNetwork: false
3335
# -- Expose VPN service on hostPort
3436
useHostPort: false
3537
# -- Host port to expose the VPN service on
@@ -72,6 +74,8 @@ service:
7274
loadBalancerIP: ""
7375
# -- Annotations
7476
annotations: {}
77+
# -- Extra ports that can be attached to the service object, these are passed directly to the port array on the service and must be well formed to the specification
78+
extraPorts: []
7579
# -- Name of a secret with a wireguard private key on key privatekey, if not provided on first install a hook generates one.
7680
secretName: ~
7781
replicaCount: 3
@@ -100,6 +104,22 @@ autoscaling:
100104
# -- Provide additional environment variables to the wireguard container
101105
extraEnv: {}
102106
# TEST_ENV_VAR: test-value
107+
# -- Provide additional sidecars to the wireguard pod, these are directly attached to the pod and must be well formed ContainerSpec
108+
extraSideCars: []
109+
# -- Create storage claims that can be used by side cars
110+
extraStorage: []
111+
# - name: conf
112+
# storageClassName: default
113+
# storage: 8Gi
114+
# accessModes:
115+
# - ReadWriteMany
116+
# volumeMode: Filesystem
117+
# -- Create additional configmaps that may be used in sidecars
118+
extraConfigMaps: []
119+
# - name: some-config
120+
# data:
121+
# key1: |
122+
# some config file data
103123
# -- If provided, this secret will be used instead of the config created from the helm value scope
104124
configSecretName: ~
105125
# -- The property/key on the secret holding the wireguard configuration file

0 commit comments

Comments
 (0)