Skip to content

Commit 643d87f

Browse files
bryopsidabryopsida
authored
Add client connect test (#55)
1 parent 146ea71 commit 643d87f

File tree

10 files changed

+189
-5
lines changed

10 files changed

+189
-5
lines changed

‎.devcontainer/devcontainer.json‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
{
2+
"name": "WG-Chart Dev Container",
3+
"image": "mcr.microsoft.com/vscode/devcontainers/go:latest",
4+
"features": {
5+
"ghcr.io/devcontainers/features/github-cli:1": {},
6+
"ghcr.io/devcontainers/features/common-utils:2": {},
7+
"ghcr.io/devcontainers/features/docker-in-docker:2": {},
8+
"ghcr.io/devcontainers/features/kubectl-helm-minikube:1": {},
9+
"ghcr.io/mpriscella/features/kind:1": {},
10+
"ghcr.io/devcontainers-contrib/features/apt-packages:1": {
11+
"packages": "wireguard"
12+
}
13+
},
14+
"customizations": {
15+
"vscode": {
16+
"extensions": [
17+
"ms-kubernetes-tools.vscode-kubernetes-tools",
18+
"redhat.vscode-yaml",
19+
"github.vscode-pull-request-github",
20+
"github.vscode-github-actions",
21+
"ms-azuretools.vscode-docker",
22+
"johnpapa.vscode-peacock",
23+
"ms-vscode.makefile-tools"
24+
],
25+
"settings": {
26+
"editor.tabSize": 2,
27+
"terminal.integrated.defaultProfile.linux": "zsh",
28+
"terminal.integrated.profiles.linux": {
29+
"bash": {
30+
"path": "bash",
31+
"icon": "terminal-bash"
32+
},
33+
"zsh": {
34+
"path": "zsh"
35+
}
36+
}
37+
}
38+
},
39+
"postStartCommand": "git config --global --add safe.directory ${containerWorkspaceFolder} && curl -sS https://webinstall.dev/k9s | bash"
40+
}
41+
}

‎.github/workflows/helm-qa.yml‎

Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -9,8 +9,16 @@ on:
99
- '.github/workflows/helm-qa.yml'
1010
jobs:
1111
test:
12-
name: 'Helm'
12+
strategy:
13+
matrix:
14+
suite:
15+
- name: default
16+
ct_extra_args: >-
17+
--upgrade
18+
--helm-extra-set-args='--set=service.type=ClusterIP'
19+
name: 'Helm (${{ matrix.suite.name }})'
1320
uses: curium-rocks/flows/.github/workflows/helm-qa.yml@main
1421
with:
1522
charts_dir: 'helm'
16-
helm_extra_sets: '--set service.type=ClusterIP'
23+
ct_extra_args: ${{ matrix.suite.ct_extra_args }}
24+
run-kubeval: false

‎Makefile‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,15 @@ template:
1313
deploy:
1414
helm --namespace $(HELM_NAMESPACE) upgrade --install $(HELM_RELEASE_NAME) ./helm/wireguard/ -f $(OVERRIDE_PATH) $(HELM_EXTRA_ARGS)
1515

16+
test:
17+
helm --namespace $(HELM_NAMESPACE) test $(HELM_RELEASE_NAME)
18+
19+
cluster:
20+
kind create cluster
21+
22+
cluster-go-away:
23+
kind delete cluster
24+
1625
clean-secret:
1726
kubectl --namespace $(HELM_NAMESPACE) delete secret $(HELM_RELEASE_NAME)-wg-generated
1827

‎ci/test-with-1-replica.yaml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
service:
2+
type: ClusterIP
3+
replicaCount: 1
4+
autoscaling:
5+
enabled: false

‎helm/wireguard/.helmignore‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,3 +21,4 @@
2121
.idea/
2222
*.tmproj
2323
.vscode/
24+
ci

‎helm/wireguard/Chart.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ apiVersion: v2
22
name: wireguard
33
description: A Helm chart for managing a wireguard vpn in kubernetes
44
type: application
5-
version: 0.23.0
5+
version: 0.24.0
66
appVersion: "0.0.0"
77
maintainers:
88
- name: bryopsida

‎helm/wireguard/README.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
# wireguard
22

3-
![Version: 0.23.0](https://img.shields.io/badge/Version-0.23.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 0.0.0](https://img.shields.io/badge/AppVersion-0.0.0-informational?style=flat-square)
3+
![Version: 0.24.0](https://img.shields.io/badge/Version-0.24.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 0.0.0](https://img.shields.io/badge/AppVersion-0.0.0-informational?style=flat-square)
44

55
A Helm chart for managing a wireguard vpn in kubernetes
66

@@ -132,4 +132,4 @@ A Helm chart for managing a wireguard vpn in kubernetes
132132
| wireguard.serverCidr | string | `"10.34.0.0/24"` | Subnet for your VPN, take care not to clash with cluster POD cidr |
133133

134134
----------------------------------------------
135-
Autogenerated from chart metadata using [helm-docs v1.13.1](https://github.com/norwoodj/helm-docs/releases/v1.13.1)
135+
Autogenerated from chart metadata using [helm-docs v1.14.2](https://github.com/norwoodj/helm-docs/releases/v1.14.2)

‎helm/wireguard/ci/README.md‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
# What is this?
2+
3+
This is a set of value files that will be tested in the CI pipeline.
4+
5+
You can read more about the behavior [here](https://github.com/helm/charts/blob/master/test/README.md#providing-custom-test-values)

‎helm/wireguard/ci/default-values.yaml‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
# kics-scan ignore
2+
service:
3+
type: ClusterIP
4+
wireguard:
5+
clients:
6+
- AllowedIPs: 172.32.32.2/32
7+
# used for testing only
8+
PublicKey: NzYmaNXHi8+3NBpg7uoRFw7wO+fLG65gZToKqtecLAo=
9+
serverAddress: 172.32.32.1/24
10+
serverCidr: 172.32.32.0/24
11+
replicaCount: 1
12+
autoscaling:
13+
enabled: false
14+
deploymentStrategy:
15+
type: Recreate

‎helm/wireguard/templates/tests/client-connect.yaml‎

Lines changed: 100 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,100 @@
1+
# kics-scan ignore
2+
---
3+
apiVersion: batch/v1
4+
kind: Job
5+
metadata:
6+
name: wireguard-client-test
7+
namespace: {{ .Release.Namespace }}
8+
annotations:
9+
helm.sh/hook: test
10+
spec:
11+
template:
12+
spec:
13+
automountServiceAccountToken: false
14+
initContainers:
15+
- name: sysctls
16+
image: busybox:stable
17+
command:
18+
- sh
19+
- -c
20+
- sysctl -w net.ipv4.ip_forward=1 && sysctl -w net.ipv4.conf.all.forwarding=1
21+
securityContext:
22+
runAsNonRoot: false
23+
privileged: true
24+
resources:
25+
requests:
26+
memory: 64Mi
27+
cpu: "100m"
28+
limits:
29+
memory: 64Mi
30+
cpu: "100m"
31+
containers:
32+
- name: wireguard-client
33+
image: ghcr.io/bryopsida/wireguard:main
34+
securityContext:
35+
runAsNonRoot: {{ .Values.securityContext.runAsNonRoot | default true }}
36+
runAsUser: {{ .Values.securityContext.runAsUser | default 1000 }}
37+
readOnlyRootFilesystem: {{ .Values.securityContext.readOnlyRootFilesystem | default true }}
38+
allowPrivilegeEscalation: {{ .Values.securityContext.allowPrivilegeEscalation | default true }}
39+
privileged: {{ .Values.securityContext.privileged | default false }}
40+
capabilities:
41+
drop:
42+
- ALL
43+
add:
44+
- NET_ADMIN
45+
- NET_RAW
46+
- SETUID
47+
- SETGID
48+
env:
49+
- name: WG_PRIVATE_KEY
50+
value: "gILClOGWPR+w9q4f0A7hlTKdQHC0vHwXPrGLHPKJi2o="
51+
- name: WG_SERVER
52+
value: "{{ .Release.Name }}-wireguard.{{ .Release.Namespace }}.svc"
53+
- name: WG_SERVER_PORT
54+
value: "{{ .Values.service.port }}"
55+
- name: WG_SERVER_CIDR
56+
value: "{{ .Values.wireguard.serverCidr }}"
57+
- name: WG_CLIENT_IP
58+
value: "172.32.32.2/32"
59+
resources:
60+
requests:
61+
cpu: "100m"
62+
memory: "128Mi"
63+
limits:
64+
cpu: "500m"
65+
memory: "256Mi"
66+
command:
67+
- /bin/sh
68+
args:
69+
- -c
70+
- |
71+
set -e
72+
73+
cat <<EOF > /tmp/wg0.conf
74+
[Interface]
75+
PrivateKey = ${WG_PRIVATE_KEY}
76+
Address = ${WG_CLIENT_IP}
77+
78+
[Peer]
79+
PublicKey = $(cat /etc/wireguard-server/privatekey | wg pubkey)
80+
Endpoint = ${WG_SERVER}:${WG_SERVER_PORT}
81+
AllowedIPs = ${WG_SERVER_CIDR}
82+
EOF
83+
84+
wg-quick up /tmp/wg0.conf
85+
sleep 5
86+
sudo ping -c 1 -W 1 172.32.32.1
87+
volumeMounts:
88+
- name: wireguard-server-secret
89+
mountPath: /etc/wireguard-server/
90+
readOnly: true
91+
- name: tmp-volume
92+
mountPath: /tmp
93+
volumes:
94+
- name: wireguard-server-secret
95+
secret:
96+
secretName: {{ .Release.Name }}-wg-generated
97+
- name: tmp-volume
98+
emptyDir: {}
99+
restartPolicy: Never
100+
backoffLimit: 4

0 commit comments

Comments
 (0)