Add privileged, iptables forwarding and nodeport configuration

charts/personal-ovpn/Chart.yaml

@@ -2,7 +2,7 @@ apiVersion: v2
 appVersion: "2.4"
 description: Roll your own OpenVPN server
 name: personal-ovpn
-version: 0.2.2
+version: 0.2.3
 type: application
 source:
   - https://github.com/suda/charts/tree/main/charts/personal-ovpn

charts/personal-ovpn/templates/deployment.yaml

@@ -33,6 +33,13 @@ spec:
             capabilities:
               add:
                 - NET_ADMIN
+            privileged: {{ .Values.security.privileged }}
+          lifecycle:
+            postStart:
+              exec:
+                command:
+                  - "sysctl"
+                  - "net.ipv4.ip_forward={{ .Values.security.ipForward }}"
           volumeMounts:
             {{- if .Values.automatic.enabled }}
             - name: data

charts/personal-ovpn/templates/service.yaml

@@ -16,6 +16,9 @@ spec:
     - port: {{ .Values.service.port }}
       targetPort: openvpn
       protocol: {{ .Values.service.protocol }}
+      {{- if .Values.service.nodePort }}
+      nodePort: {{ .Values.service.nodePort }}
+      {{- end }}
       name: openvpn
   selector:
     app.kubernetes.io/name: {{ include "personal-ovpn.name" . }}

charts/personal-ovpn/values.yaml

@@ -22,7 +22,14 @@ service:
   port: 31304
   # service.type -- Service type
   type: NodePort
+  # service.nodePort -- port binding for the node
+  port: 31304
+
 
+# securityContext -- security context for pod
+security:
+  privileged: false
+  ipForward: 0
 # limitTraficToNamespace -- limit network traffic just to OpenVPN namespace
 limitTraficToNamespace: true
 # limitedCidr -- CIDR to be blocked out