当前位置：首页 > news >正文

k8s上部署openvpn

news 来源：原创 2024/9/18 8:45:51

一、openvpn源

# helm search repo openvpn

二、下载

# helm pull mirror/openvpn

三、修改配置文件

# tar -zxf openvpn-4.2.5.tgz

# cd openvpn

# egrep -v "^#|^$|^ *#" values.yaml 
replicaCount: 1
updateStrategy: {}
imagePullSecretName:
image:repository: jfelten/openvpn-dockertag: 1.1.0pullPolicy: IfNotPresent
service:type: NodePortexternalPort: 443internalPort: 443externalIPs: [192.168.110.26]nodePort: 32085annotations: {}
podAnnotations: {}
ipForwardInitContainer: true
resources:limits:cpu: 500mmemory: 1024Mirequests:cpu: 500mmemory: 1024Mi
readinessProbe:initialDelaySeconds: 5periodSeconds: 5successThreshold: 2
persistence:enabled: truestorageClass: "nfs-hdd"accessMode: ReadWriteOncesize: 2048M
openvpn:OVPN_NETWORK: 10.240.0.0OVPN_SUBNET: 255.255.0.0OVPN_PROTO: udpOVPN_K8S_POD_NETWORK: "10.244.0.0"OVPN_K8S_POD_SUBNET: "255.255.0.0"OVPN_K8S_SVC_NETWORK: 10.96.0.0OVPN_K8S_SVC_SUBNET: 255.240.0.0DEFAULT_ROUTE_ENABLED: truedhcpOptionDomain: trueredirectGateway: trueuseCrl: falsetaKey: falsecipher: AES-256-CBCserverConf: |max-clients 100client-to-clientistio:enabled: falseproxy:port: 15001iptablesExtra: []ccd:enabled: falseconfig: {}
nodeSelector: {}
tolerations: []

四、部署

# helm upgrade --install openvpn -n openvpn ./ -f values.yaml

这里还修改了svc里面的dns:

# kubectl edit cm openvpn -n openvpn

五、生成客户端脚本

# cat create-client.sh 
#!/bin/bash
POD_NAME=$(kubectl get pods --namespace "openvpn" -l "app=openvpn,release=openvpn" -o jsonpath='{ .items[0].metadata.name }')
SERVICE_NAME=$(kubectl get svc --namespace "openvpn" -l "app=openvpn,release=openvpn" -o jsonpath='{ .items[0].metadata.name }')
SERVICE_IP=$(kubectl get svc --namespace "openvpn" "$SERVICE_NAME" -o go-template='{{ range $k, $v := (index .status.loadBalancer.ingress 0)}}{{ $v }}{{end}}')
KEY_NAME=kubeVPN16
kubectl --namespace "openvpn" exec -it "$POD_NAME" /etc/openvpn/setup/newClientCert.sh "$KEY_NAME" "$SERVICE_IP"
kubectl --namespace "openvpn" exec -it "$POD_NAME" cat "/etc/openvpn/certs/pki/$KEY_NAME.ovpn" > "$KEY_NAME.ovpn"此脚本的SERVICE_IP是有问题的，这个可以在生成文件后修改。这个根据实际情况操作。

执行后会生成kubeVPN16.ovpn的文件：