blob: 70873b324610f984094180506881de78f1d0cff6 [file] [log] [blame]
local kube = import "../../../kube/kube.libsonnet";
{
PKI(namespace):: {
local env = self,
namespace:: namespace,
selfSignedIssuer: kube.Issuer("pki-selfsigned") {
metadata+: {
namespace: env.namespace,
},
spec: {
selfSigned: {},
},
},
selfSignedCert: kube.Certificate("pki-selfsigned") {
metadata+: {
namespace: env.namespace,
},
spec: {
secretName: "pki-selfsigned-cert",
duration: "43800h0m0s", // 5 years,
isCA: true,
issuerRef: {
name: env.selfSignedIssuer.metadata.name,
},
commonName: "pki-ca",
},
},
issuer: kube.Issuer("pki-ca") {
metadata+: {
namespace: env.namespace,
},
spec: {
ca: {
secretName: env.selfSignedCert.spec.secretName,
},
},
},
},
Client(name, server):: {
local client = self,
metadata:: {
namespace: server.cfg.namespace,
},
cert: kube.Certificate(name + "-cert") {
metadata+: client.metadata,
spec: {
secretName: name + "-cert",
duration: "35040h0m0s", // 4 years
issuerRef: {
name: server.pki.issuer.metadata.name,
kind: "Issuer",
},
commonName: "client-%s.%s" % [name, server.cfg.namespace],
},
},
},
Server(name, port, pki):: {
local server = self,
local cfg = server.cfg,
pki: pki,
cfg:: {
namespace: error "namespace must be set",
storageClassName: "waw-hdd-redundant-3",
image: "nixery.dev/shell/openvpn",
configFile: error "configFile must be set",
},
namespace: kube.Namespace(cfg.namespace),
metadata:: {
namespace: cfg.namespace,
},
config: kube.ConfigMap(name + "-config") {
metadata+: server.metadata,
data: {
"openvpn.conf": cfg.configFile,
}
},
cert: kube.Certificate(name + "-cert") {
metadata+: server.metadata,
spec: {
secretName: name + "-cert",
duration: "35040h0m0s", // 4 years
issuerRef: {
name: pki.issuer.metadata.name,
kind: "Issuer",
},
commonName: "server.%s.%s" % [name, cfg.namespace],
//dnsNames: [
//"%s" % [component.svc.metadata.name ],
//"%s.%s" % [component.svc.metadata.name, component.svc.metadata.namespace ],
//"%s.%s.svc" % [component.svc.metadata.name, component.svc.metadata.namespace ],
//"%s.%s.svc.cluster.local" % [component.svc.metadata.name, component.svc.metadata.namespace ],
//"%s.%s.svc.%s" % [component.svc.metadata.name, component.svc.metadata.namespace, env.pkiClusterFQDN ],
//],
},
},
deployment: kube.Deployment(name) {
metadata+: server.metadata,
spec+: {
template+: {
spec+: {
volumes_: {
config: kube.ConfigMapVolume(server.config),
pki: {
secret: { secretName: server.cert.spec.secretName },
},
},
containers_: {
server: kube.Container("server") {
image: cfg.image,
env_: {
},
command: [
"/bin/openvpn", "--config", "/config/openvpn.conf"
],
ports_: {
client: { containerPort: port },
},
volumeMounts_: {
config: { mountPath: "/config" },
pki: { mountPath: "/mnt/pki" },
},
resources: {
requests: {
cpu: "250m",
memory: "100Mi",
},
limits: {
cpu: "500m",
memory: "512Mi",
},
},
securityContext: {
privileged: true,
},
},
},
},
},
},
},
svc: kube.Service(name) {
metadata+: server.metadata,
target_pod:: server.deployment.spec.template,
spec+: {
ports: [
{ name: "client", port: port, targetPort: port, protocol: "UDP" },
],
type: "LoadBalancer",
externalTrafficPolicy: "Local",
},
},
},
}