k8s上部署openvpn

一、openvpn源

# helm search repo openvpn

二、下载

# helm pull mirror/openvpn

三、修改配置文件

# tar -zxf openvpn-4.2.5.tgz

# cd openvpn

# egrep -v "^#|^$|^ *#" values.yaml 
replicaCount: 1
updateStrategy: {}
imagePullSecretName:
image:
  repository: jfelten/openvpn-docker
  tag: 1.1.0
  pullPolicy: IfNotPresent
service:
  type: NodePort
  externalPort: 443
  internalPort: 443
  externalIPs: [192.168.110.26]
  nodePort: 32085
  annotations: {}
podAnnotations: {}
ipForwardInitContainer: true
resources:
  limits:
    cpu: 500m
    memory: 1024Mi
  requests:
    cpu: 500m
    memory: 1024Mi
readinessProbe:
  initialDelaySeconds: 5
  periodSeconds: 5
  successThreshold: 2
persistence:
  enabled: true
  storageClass: "nfs-hdd"
  accessMode: ReadWriteOnce
  size: 2048M
openvpn:
  OVPN_NETWORK: 10.240.0.0
  OVPN_SUBNET: 255.255.0.0
  OVPN_PROTO: udp
  OVPN_K8S_POD_NETWORK: "10.244.0.0"
  OVPN_K8S_POD_SUBNET: "255.255.0.0"
  OVPN_K8S_SVC_NETWORK: 10.96.0.0
  OVPN_K8S_SVC_SUBNET: 255.240.0.0
  DEFAULT_ROUTE_ENABLED: true
  dhcpOptionDomain: true
  redirectGateway: true
  useCrl: false
  taKey: false
  cipher: AES-256-CBC
  serverConf: |
    max-clients 100
    client-to-client
  istio:
    enabled: false
    proxy:
      port: 15001
  iptablesExtra: []
  ccd:
    enabled: false
    config: {}
nodeSelector: {}
tolerations: []

四、部署

# helm upgrade --install openvpn -n openvpn ./ -f values.yaml

这里还修改了svc里面的dns:

# kubectl edit cm openvpn -n openvpn

五、生成客户端脚本

# cat create-client.sh 
#!/bin/bash
POD_NAME=$(kubectl get pods --namespace "openvpn" -l "app=openvpn,release=openvpn" -o jsonpath='{ .items[0].metadata.name }')
SERVICE_NAME=$(kubectl get svc --namespace "openvpn" -l "app=openvpn,release=openvpn" -o jsonpath='{ .items[0].metadata.name }')
SERVICE_IP=$(kubectl get svc --namespace "openvpn" "$SERVICE_NAME" -o go-template='{{ range $k, $v := (index .status.loadBalancer.ingress 0)}}{{ $v }}{{end}}')
KEY_NAME=kubeVPN16
kubectl --namespace "openvpn" exec -it "$POD_NAME" /etc/openvpn/setup/newClientCert.sh "$KEY_NAME" "$SERVICE_IP"
kubectl --namespace "openvpn" exec -it "$POD_NAME" cat "/etc/openvpn/certs/pki/$KEY_NAME.ovpn" > "$KEY_NAME.ovpn"


此脚本的SERVICE_IP是有问题的，这个可以在生成文件后修改。这个根据实际情况操作。

执行后会生成kubeVPN16.ovpn的文件：

如下：

公网：

内网：

六、客户端导入