feat: add openconnect extension

[jadiaheno]

Summary

• Add OpenConnect multi-protocol SSL VPN client extension for Talos Linux
• Supports Cisco AnyConnect, Juniper, GlobalProtect, Pulse Secure, F5, Fortinet, and Array Networks protocols
• Includes Go wrapper for configuration via environment variables

Changes

• network/vars.yaml: Add OpenConnect version variables (v9.12)
• network/openconnect/: New extension directory with:
  • Build configuration using OpenSSL for TLS
  • Service configuration with TUN device and networking mounts
  • Go wrapper for environment-based configuration
  • User documentation with examples for all protocols

Configuration

The extension is configured via ExtensionServiceConfig:

apiVersion: v1alpha1
kind: ExtensionServiceConfig
name: openconnect
environment:
  - OPENCONNECT_SERVER=vpn.example.com
  - OPENCONNECT_PROTOCOL=anyconnect
  - OPENCONNECT_USER=username
  - OPENCONNECT_PASSWORD=password
  - OPENCONNECT_SERVERCERT=pin-sha256:ABC123...

Supported Environment Variables

Variable	Description	Required
OPENCONNECT_SERVER	VPN server URL	Yes
OPENCONNECT_PROTOCOL	Protocol (anyconnect, nc, gp, pulse, f5, fortinet, array)	No
OPENCONNECT_USER	Username	No
OPENCONNECT_PASSWORD	Password	No
OPENCONNECT_CERTIFICATE	Client certificate path	No
OPENCONNECT_PRIVATE_KEY	Private key path	No
OPENCONNECT_SERVERCERT	Server cert fingerprint	Recommended
OPENCONNECT_EXTRA_ARGS	Additional CLI args	No

Test plan

• Build extension: make openconnect PLATFORM=linux/amd64
• Verify static/dynamic linking of binary
• Run extensions-validator on built rootfs
• Deploy to Talos test node and verify tunnel creation

🤖 Generated with Claude Code