[helm] add option to specify an existingSecret or a specific nodePort

deploy/helm/wg-access-server/README.md

@@ -64,6 +64,7 @@ ingress:
 | web.service.type | string | `"ClusterIP"` |  |
 | wireguard.config.privateKey | string | "" | A wireguard private key. You can generate one using `$ wg genkey` |
 | wireguard.service.type | string | `"ClusterIP"` |  |
+| wireguard.service.nodePort | int | `nil` | When `NodePort` is used as `service.type`, a static nodePort can be added |
 | ingress.enabled | bool | `false` |  |
 | ingress.hosts | string | `nil` |  |
 | ingress.tls | list | `[]` |  |
@@ -84,3 +85,4 @@ ingress:
 | image.pullPolicy | string | `"IfNotPresent"` |  |
 | image.repository | string | `"place1/wg-access-server"` |  |
 | imagePullSecrets | list | `[]` |  |
+| existingSecret | string | `""` | Allow the use of an existing secret for admin username, password and private key |

deploy/helm/wg-access-server/templates/deployment.yaml

@@ -26,13 +26,27 @@ spec:
     {{- with .Values.imagePullSecrets }}
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}
+    {{- end }}
+    {{- with .Values.sysctlInitContainer }}
+      initContainers:
+      - command:
+        - sysctl
+        - -w
+        - net.ipv4.ip_forward=1
+        image: busybox
+        imagePullPolicy: IfNotPresent
+        name: init-sysctl
+        securityContext:
+          privileged: true
+          runAsNonRoot: false
+          runAsUser: 0
     {{- end }}
       containers:
         - name: {{ .Chart.Name }}
           securityContext:
             capabilities:
               add: ['NET_ADMIN']
-          image: "{{ .Values.image.repository }}:{{ .Chart.AppVersion }}"
+          image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
           imagePullPolicy: {{ .Values.image.pullPolicy }}
           ports:
             - name: http
@@ -41,28 +55,13 @@ spec:
             - name: wireguard
               containerPort: 51820
               protocol: UDP
-          env:
-            {{- if .Values.wireguard.config.privateKey }}
-            - name: WG_WIREGUARD_PRIVATE_KEY
-              valueFrom:
-                secretKeyRef:
-                  name: "{{ $fullName }}"
-                  key: privateKey
-            {{- end }}
-            {{- if .Values.web.config.adminUsername }}
-            - name: WG_ADMIN_USERNAME
-              valueFrom:
-                secretKeyRef:
-                  name: "{{ $fullName }}"
-                  key: adminUsername
-            {{- end}}
-            {{- if .Values.web.config.adminPassword }}
-            - name: WG_ADMIN_PASSWORD
-              valueFrom:
-                secretKeyRef:
-                  name: "{{ $fullName }}"
-                  key: adminPassword
-            {{- end}}
+          envFrom:
+          - secretRef:
+              {{- if .Values.existingSecret }}
+              name: {{ .Values.existingSecret }}
+              {{- else }}
+              name: {{ $fullName }}
+              {{- end }}
           volumeMounts:
             - name: tun
               mountPath: /dev/net/tun

deploy/helm/wg-access-server/templates/secret.yaml

@@ -1,5 +1,6 @@
 {{- $fullName := include "wg-access-server.fullname" . -}}
 {{- if .Values.wireguard.config.privateKey }}
+{{- if not .Values.existingSecret -}}
 apiVersion: v1
 kind: Secret
 metadata:
@@ -8,11 +9,12 @@ metadata:
     {{- include "wg-access-server.labels" . | nindent 4 }}
 type: Opaque
 data:
-  privateKey: {{ .Values.wireguard.config.privateKey | b64enc | quote }}
+  WG_WIREGUARD_PRIVATE_KEY: {{ .Values.wireguard.config.privateKey | b64enc | quote }}
   {{- if .Values.web.config.adminUsername }}
-  adminUsername: {{ .Values.web.config.adminUsername | b64enc | quote }}
+  WG_ADMIN_USERNAME: {{ .Values.web.config.adminUsername | b64enc | quote }}
   {{- end }}
   {{- if .Values.web.config.adminPassword }}
-  adminPassword: {{ .Values.web.config.adminPassword | b64enc | quote }}
+  WG_ADMIN_PASSWORD: {{ .Values.web.config.adminPassword | b64enc | quote }}
   {{- end }}
 {{- end }}
+{{- end }}

deploy/helm/wg-access-server/templates/service.yaml

@@ -51,5 +51,8 @@ spec:
       targetPort: 51820
       protocol: UDP
       name: wireguard
+      {{- if and ( eq .Values.wireguard.service.type "NodePort" ) .Values.wireguard.service.nodePort }}
+      nodePort: {{ .Values.wireguard.service.nodePort }}
+      {{- end }}
   selector:
     {{- include "wg-access-server.selectorLabels" . | nindent 4 }}

deploy/helm/wg-access-server/values.yaml

@@ -1,6 +1,20 @@
 # wg-access-server config
 config: {}
 
+## Provide an existing secret with the following keys:
+##
+## data:
+##   WG_ADMIN_PASSWORD: X
+##   WG_ADMIN_USERNAME: X
+##   WG_WIREGUARD_PRIVATE_KEY: X
+##
+## overrides:
+## web.config.adminUsername
+## web.config.adminPassword
+## wireguard.config.privateKey
+##
+# existingSecret: ""
+
 web:
   config:
     adminUsername: ""
@@ -13,6 +27,8 @@ wireguard:
     privateKey: ""
   service:
     type: ClusterIP
+    # type: NodePort
+    # nodePort: 51820
 
 persistence:
   enabled: false
@@ -51,6 +67,7 @@ imagePullSecrets: []
 
 image:
   repository: place1/wg-access-server
+  tag: v0.4.6
   pullPolicy: IfNotPresent
 
 # multiple replicas is only supported when using
@@ -79,3 +96,12 @@ nodeSelector: {}
 tolerations: []
 
 affinity: {}
+
+# sysctlInitContainer flag adds an initContainer named "init-sysctl" to wg-access-server deployment.
+# The goal is to set the sysctl net.ipv4.ip_forward=1 to allow packet routing through node.
+# This initContainer needs to run as privileged, but this is only limited to
+# the initContainer run time, the main container will remain unprivileged as expected.
+# Use case : 
+#   DNS is functionning properly through VPN but does not work for standard traffic. 
+# NB : If you have no problem with wireguard traffic, you should not enable this initContainer
+sysctlInitContainer: false