Skip to content
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.

Commit 86c8870

Browse files
mk-dkovachmk-dkovach
authoredDec 20, 2024··
defguard-gateway helm sub-chart (#69)
1 parent 404cffc commit 86c8870

15 files changed

+614
-26
lines changed
 

‎charts/defguard-gateway/.helmignore

+23
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
# Patterns to ignore when building packages.
2+
# This supports shell glob matching, relative path matching, and
3+
# negation (prefixed with !). Only one pattern per line.
4+
.DS_Store
5+
# Common VCS dirs
6+
.git/
7+
.gitignore
8+
.bzr/
9+
.bzrignore
10+
.hg/
11+
.hgignore
12+
.svn/
13+
# Common backup files
14+
*.swp
15+
*.bak
16+
*.tmp
17+
*.orig
18+
*~
19+
# Various IDEs
20+
.project
21+
.idea/
22+
*.tmproj
23+
.vscode/

‎charts/defguard-gateway/Chart.yaml

+7
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
apiVersion: v2
2+
name: defguard-gateway
3+
description: Defguard gateway is a public-facing VPN endpoint.
4+
5+
type: application
6+
version: 0.1.2
7+
appVersion: 1.1.0

‎charts/defguard-gateway/templates/NOTES.txt

+20
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
1. Get the application URL by running these commands:
2+
{{- if .Values.ingress.enabled }}
3+
{{- range $host := .Values.ingress.hosts }}
4+
http{{ if $.Values.ingress.tls }}s{{ end }}://{{ $host }}/
5+
{{- end }}
6+
{{- else if contains "NodePort" .Values.service.type }}
7+
export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ include "defguard-gateway.fullname" . }})
8+
export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}")
9+
echo http://$NODE_IP:$NODE_PORT
10+
{{- else if contains "LoadBalancer" .Values.service.type }}
11+
NOTE: It may take a few minutes for the LoadBalancer IP to be available.
12+
You can watch the status of by running 'kubectl get --namespace {{ .Release.Namespace }} svc -w {{ include "defguard-gateway.fullname" . }}'
13+
export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ include "defguard-gateway.fullname" . }} --template "{{"{{ range (index .status.loadBalancer.ingress 0) }}{{.}}{{ end }}"}}")
14+
echo http://$SERVICE_IP:{{ .Values.service.port }}
15+
{{- else if contains "ClusterIP" .Values.service.type }}
16+
export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "app.kubernetes.io/name={{ include "defguard-gateway.name" . }},app.kubernetes.io/instance={{ .Release.Name }}" -o jsonpath="{.items[0].metadata.name}")
17+
export CONTAINER_PORT=$(kubectl get pod --namespace {{ .Release.Namespace }} $POD_NAME -o jsonpath="{.spec.containers[0].ports[0].containerPort}")
18+
echo "Visit http://127.0.0.1:8080 to use your application"
19+
kubectl --namespace {{ .Release.Namespace }} port-forward $POD_NAME 8080:$CONTAINER_PORT
20+
{{- end }}

‎charts/defguard-gateway/templates/_helpers.tpl

+62
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
{{/*
2+
Expand the name of the chart.
3+
*/}}
4+
{{- define "defguard-gateway.name" -}}
5+
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
6+
{{- end }}
7+
8+
{{/*
9+
Create a default fully qualified app name.
10+
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
11+
If release name contains chart name it will be used as a full name.
12+
*/}}
13+
{{- define "defguard-gateway.fullname" -}}
14+
{{- if .Values.fullnameOverride }}
15+
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
16+
{{- else }}
17+
{{- $name := default .Chart.Name .Values.nameOverride }}
18+
{{- if contains $name .Release.Name }}
19+
{{- .Release.Name | trunc 63 | trimSuffix "-" }}
20+
{{- else }}
21+
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
22+
{{- end }}
23+
{{- end }}
24+
{{- end }}
25+
26+
{{/*
27+
Create chart name and version as used by the chart label.
28+
*/}}
29+
{{- define "defguard-gateway.chart" -}}
30+
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
31+
{{- end }}
32+
33+
{{/*
34+
Common labels
35+
*/}}
36+
{{- define "defguard-gateway.labels" -}}
37+
helm.sh/chart: {{ include "defguard-gateway.chart" . }}
38+
{{ include "defguard-gateway.selectorLabels" . }}
39+
{{- if .Chart.AppVersion }}
40+
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
41+
{{- end }}
42+
app.kubernetes.io/managed-by: {{ .Release.Service }}
43+
{{- end }}
44+
45+
{{/*
46+
Selector labels
47+
*/}}
48+
{{- define "defguard-gateway.selectorLabels" -}}
49+
app.kubernetes.io/name: {{ include "defguard-gateway.name" . }}
50+
app.kubernetes.io/instance: {{ .Release.Name }}
51+
{{- end }}
52+
53+
{{/*
54+
Create the name of the service account to use
55+
*/}}
56+
{{- define "defguard-gateway.serviceAccountName" -}}
57+
{{- if .Values.serviceAccount.create }}
58+
{{- default (include "defguard-gateway.fullname" .) .Values.serviceAccount.name }}
59+
{{- else }}
60+
{{- default "default" .Values.serviceAccount.name }}
61+
{{- end }}
62+
{{- end }}

‎charts/defguard-gateway/templates/config.yaml

+11
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
apiVersion: v1
2+
kind: ConfigMap
3+
metadata:
4+
name: {{ include "defguard-gateway.fullname" . }}-config
5+
labels:
6+
{{- include "defguard-gateway.labels" . | nindent 4 }}
7+
data:
8+
DEFGUARD_USERSPACE: {{ .Values.userspace | quote }}
9+
DEFGUARD_GRPC_URL: {{ .Values.grpcUrl | quote }}
10+
DEFGUARD_STATS_PERIOD: {{ .Values.statsPeriod | quote }}
11+
RUST_LOG: {{ .Values.logLevel | quote }}

‎charts/defguard-gateway/templates/deployment.yaml

+70
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,70 @@
1+
apiVersion: apps/v1
2+
kind: Deployment
3+
metadata:
4+
name: {{ include "defguard-gateway.fullname" . }}
5+
labels:
6+
{{- include "defguard-gateway.labels" . | nindent 4 }}
7+
spec:
8+
replicas: {{ .Values.replicaCount }}
9+
selector:
10+
matchLabels:
11+
{{- include "defguard-gateway.selectorLabels" . | nindent 6 }}
12+
template:
13+
metadata:
14+
{{- with .Values.podAnnotations }}
15+
annotations:
16+
{{- toYaml . | nindent 8 }}
17+
{{- end }}
18+
labels:
19+
{{- include "defguard-gateway.selectorLabels" . | nindent 8 }}
20+
spec:
21+
{{- with .Values.imagePullSecrets }}
22+
imagePullSecrets:
23+
{{- toYaml . | nindent 8 }}
24+
{{- end }}
25+
serviceAccountName: {{ include "defguard-gateway.serviceAccountName" . }}
26+
securityContext:
27+
{{- toYaml .Values.podSecurityContext | nindent 8 }}
28+
containers:
29+
- name: {{ .Chart.Name }}
30+
envFrom:
31+
- configMapRef:
32+
name: {{ include "defguard-gateway.fullname" . }}-config
33+
{{- if .Values.additionalEnvFromConfigMap }}
34+
- configMapRef:
35+
name: {{ .Values.additionalEnvFromConfigMap }}
36+
{{- end }}
37+
securityContext:
38+
{{- toYaml .Values.securityContext | nindent 12 }}
39+
image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
40+
imagePullPolicy: {{ .Values.image.pullPolicy }}
41+
ports:
42+
- name: grpc
43+
containerPort: {{ .Values.service.ports.grpc }}
44+
protocol: UDP
45+
resources:
46+
{{- toYaml .Values.resources | nindent 12 }}
47+
{{- if .Values.token }}
48+
env:
49+
- name: DEFGUARD_TOKEN
50+
value: {{ .Values.token }}
51+
{{- else if .Values.existingTokenSecret }}
52+
env:
53+
- name: DEFGUARD_TOKEN
54+
valueFrom:
55+
secretKeyRef:
56+
name: {{ .Values.existingTokenSecret }}
57+
key: {{ .Values.existingTokenSecretKey }}
58+
{{- end }}
59+
{{- with .Values.nodeSelector }}
60+
nodeSelector:
61+
{{- toYaml . | nindent 8 }}
62+
{{- end }}
63+
{{- with .Values.affinity }}
64+
affinity:
65+
{{- toYaml . | nindent 8 }}
66+
{{- end }}
67+
{{- with .Values.tolerations }}
68+
tolerations:
69+
{{- toYaml . | nindent 8 }}
70+
{{- end }}

‎charts/defguard-gateway/templates/grpc-service.yaml

+17
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
apiVersion: v1
2+
kind: Service
3+
metadata:
4+
annotations:
5+
traefik.ingress.kubernetes.io/service.serversscheme: h2c
6+
name: {{ include "defguard-gateway.fullname" . }}-grpc
7+
labels:
8+
{{- include "defguard-gateway.labels" . | nindent 4 }}
9+
spec:
10+
type: {{ .Values.service.type }}
11+
ports:
12+
- port: {{ .Values.service.ports.grpc }}
13+
targetPort: grpc
14+
protocol: UDP
15+
name: grpc
16+
selector:
17+
{{- include "defguard-gateway.selectorLabels" . | nindent 4 }}

‎charts/defguard-gateway/templates/ingress-grpc.yaml

+52
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{{- if .Values.ingress.grpc.enabled -}}
2+
{{- $fullName := include "defguard-gateway.fullname" . -}}
3+
{{- if and .Values.ingress.grpc.className (not (semverCompare ">=1.18-0" .Capabilities.KubeVersion.GitVersion)) }}
4+
{{- if not (hasKey .Values.ingress.grpc.annotations "kubernetes.io/ingress.class") }}
5+
{{- $_ := set .Values.ingress.grpc.annotations "kubernetes.io/ingress.class" .Values.ingress.grpc.className}}
6+
{{- end }}
7+
{{- end }}
8+
{{- if semverCompare ">=1.19-0" .Capabilities.KubeVersion.GitVersion -}}
9+
apiVersion: networking.k8s.io/v1
10+
{{- else if semverCompare ">=1.14-0" .Capabilities.KubeVersion.GitVersion -}}
11+
apiVersion: networking.k8s.io/v1beta1
12+
{{- else -}}
13+
apiVersion: extensions/v1beta1
14+
{{- end }}
15+
kind: Ingress
16+
metadata:
17+
name: {{ $fullName }}-grpc
18+
labels:
19+
{{- include "defguard-gateway.labels" . | nindent 4 }}
20+
{{- with .Values.ingress.grpc.annotations }}
21+
annotations:
22+
{{- toYaml . | nindent 4 }}
23+
{{- end }}
24+
spec:
25+
{{- if and .Values.ingress.grpc.className (semverCompare ">=1.18-0" .Capabilities.KubeVersion.GitVersion) }}
26+
ingressClassName: {{ .Values.ingress.grpc.className }}
27+
{{- end }}
28+
{{- if .Values.ingress.grpc.tls }}
29+
tls:
30+
- hosts:
31+
- {{ .Values.ingress.grpc.host | quote }}
32+
secretName: {{ printf "%s-grpc-tls" .Values.ingress.grpc.host }}
33+
{{- end }}
34+
rules:
35+
- host: {{ .Values.ingress.grpc.host | quote }}
36+
http:
37+
paths:
38+
- path: /
39+
{{- if semverCompare ">=1.18-0" $.Capabilities.KubeVersion.GitVersion }}
40+
pathType: ImplementationSpecific
41+
{{- end }}
42+
backend:
43+
{{- if semverCompare ">=1.19-0" $.Capabilities.KubeVersion.GitVersion }}
44+
service:
45+
name: {{ $fullName }}-grpc
46+
port:
47+
number: {{ .Values.service.ports.grpc }}
48+
{{- else }}
49+
serviceName: {{ $fullName }}-grpc
50+
servicePort: {{ .Values.service.ports.grpc }}
51+
{{- end }}
52+
{{- end }}

‎charts/defguard-gateway/templates/serviceaccount.yaml

+12
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
{{- if .Values.serviceAccount.create -}}
2+
apiVersion: v1
3+
kind: ServiceAccount
4+
metadata:
5+
name: {{ include "defguard-gateway.serviceAccountName" . }}
6+
labels:
7+
{{- include "defguard-gateway.labels" . | nindent 4 }}
8+
{{- with .Values.serviceAccount.annotations }}
9+
annotations:
10+
{{- toYaml . | nindent 4 }}
11+
{{- end }}
12+
{{- end }}

‎charts/defguard-gateway/values.yaml

+64
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
---
2+
# Use userspace wireguard implementation, useful on systems without native wireguard support. Set to true/false
3+
userspace: "false"
4+
# Defguard GRPC URL, e.g.: defguard-grpc.mycompany.com
5+
grpcUrl: ""
6+
# Token from Defguard app to secure gRPC connection, available on network page.
7+
# It is not recommended to use this. Create a secret yourself and use existingTokenSecret instead
8+
token: ""
9+
# Secret to get the token from
10+
existingTokenSecret: ""
11+
# Key to extract the token from in existingTokenSecret
12+
existingTokenSecretKey: ""
13+
# Defines how often (in seconds) should interface statistics be sent to Defguard server
14+
statsPeriod: 30
15+
# rust log level, default is debug
16+
logLevel: "debug"
17+
# defguard-gateway full name override
18+
fullnameOverride: ""
19+
# defguard-gateway name override
20+
nameOverride: ""
21+
# defguard-gateway container image configuration
22+
image:
23+
pullPolicy: IfNotPresent
24+
repository: ghcr.io/defguard/gateway
25+
tag: "" # overrides .Chart.AppVersion
26+
# defguard-gateway container image pull secrets
27+
imagePullSecrets: []
28+
# defguard-gateway container ingress configuration
29+
ingress:
30+
grpc:
31+
annotations: {}
32+
className: ""
33+
enabled: true
34+
host: defguard-gateway-grpc.local
35+
tls: false
36+
# defguard-gateway pod affinity configuration
37+
affinity: {}
38+
# defguard-gateway node selector configuration
39+
nodeSelector: {}
40+
# defguard-gateway pod tolerations
41+
tolerations: []
42+
# defguard-gateway pod annotations
43+
podAnnotations: {}
44+
# defguard-gateway pod labels
45+
podLabels: {}
46+
# defguard-gateway pod replica count
47+
replicaCount: 1
48+
# defguard-gateway pod resources
49+
resources: {}
50+
# defguard-gateway pod security context
51+
podSecurityContext: {}
52+
# defguard-gateway container security context
53+
securityContext: {}
54+
# defguard-gateway pod additional ENV from configmap
55+
additionalEnvFromConfigMap: ""
56+
# defguard-gateway service configuration
57+
service:
58+
ports:
59+
grpc: 50051
60+
type: ClusterIP
61+
# defguard-gateway serviceaccount configuration
62+
serviceAccount:
63+
annotations: {}
64+
create: true

0 commit comments

Comments
 (0)
Please sign in to comment.