Dim innactive panes

the test

.drone.yml

@@ -1,4 +1,85 @@
 ---
+kind: pipeline
+type: docker
+name: Lint the chart
+trigger:
+  event:
+    - push
+
+environment:
+  KIND_VERSION: v0.20.0
+  HELM_VERSION: v3.12.1
+  KUBECTL_VERSION: v1.28.3
+  CT_VERSION: 3.10.1
+
+steps:
+  # ---------------------------------------------------------------------
+  # -- Prepare dependencies
+  # ---------------------------------------------------------------------
+
+  - name: Download dependencies
+    image: ghcr.io/allanger/dumb-downloader:latest
+    commands:
+      - mkdir .bin
+      # -- Download kind
+      - dudo -l "https://kind.sigs.k8s.io/dl/{{ version }}/kind-{{ os }}-{{ arch }}" -d .bin/kind -p $KIND_VERSION
+      - chmod +x .bin/kind
+
+  - name: Check changed charts
+    image: quay.io/helmpack/chart-testing
+    volumes:
+      - name: dockersock
+        path: /var/run
+    commands:
+      - export KUBECONFIG=$PWD/kubeconfig
+      - git fetch origin
+      - |
+        if [[ -n "$(ct list-changed --chart-dirs . --target-branch main)" ]]; then
+          touch .changed
+        fi
+
+  - name: Lint changed charts
+    image: quay.io/helmpack/chart-testing
+    volumes:
+      - name: dockersock
+        path: /var/run
+    commands:
+      - git fetch origin
+      - |
+        if [ -e .changed ]; then
+        ct lint --target-branch main --validate-maintainers=false --chart-dirs .
+        fi
+
+  - name: Test changed charts
+    image: quay.io/helmpack/chart-testing
+    volumes:
+      - name: dockersock
+        path: /var/run
+    commands:
+      - export PATH=$PWD/.bin:$PATH
+      - apk update && apk add docker
+      - kind create cluster --config kind.yaml
+      - sed -i -E -e 's/localhost|0\.0\.0\.0/docker/g' ~/.kube/config
+      - kubectl get storageclass
+      - git fetch origin
+      - |
+        if [ -e .changed ]; then
+          ct install --target-branch main --chart-dirs .
+          ct install --target-branch main --chart-dirs . --upgrade
+        fi
+
+services:
+  - name: docker
+    image: docker:dind
+    privileged: true
+    volumes:
+      - name: dockersock
+        path: /var/run
+
+volumes:
+  - name: dockersock
+    temp: {}
+---
 # ----------------------------------------------
 # -- Build an image and push it to the registry
 # ----------------------------------------------
@@ -31,7 +112,7 @@ steps:
       GITEA_TOKEN:
         from_secret: GITEA_TOKEN
       CONTAINERFILE: ./containerfiles/Containerfile
-      CUSTOM_TAG: v2.6.5
+      CUSTOM_TAG: v2.6.8
     commands:
       - build-container
 

.woodpecker/.check-workflow.yml

@@ -0,0 +1,18 @@
+---
+steps:
+  deps:
+    name: Download dependencies
+    image: alpine
+    commands:
+      - echo 1
+  mail:
+    image: deblan/woodpecker-email
+    settings:
+      from.address: noreply@github.com
+      from.name: John Smith
+      host: smtp.mailgun.org
+      username: 
+        from_secret: check
+      password: 12345
+      recipients:
+        - octocat@github.com

.woodpecker/.test.yml

@@ -0,0 +1,82 @@
+---
+clone:
+  git:
+    image: woodpeckerci/plugin-git
+    settings:
+      partial: false
+steps:
+  deps:
+    name: Download dependencies
+    image: ghcr.io/allanger/dumb-downloader:latest
+    environment:
+      KIND_VERSION: v0.20.0
+      HELM_VERSION: v3.12.1
+      KUBECTL_VERSION: v1.28.3
+      CT_VERSION: 3.10.1
+    commands:
+      - mkdir .bin
+      # -- Download kind
+      - dudo -l "https://kind.sigs.k8s.io/dl/{{ version }}/kind-{{ os }}-{{ arch }}" -d .bin/kind -p $KIND_VERSION
+      - chmod +x .bin/kind
+
+  changed:
+    name: Check changed charts
+    image: quay.io/helmpack/chart-testing
+    commands:
+      - git fetch origin
+      - ls -la
+      - ct help
+      - ct lint --chart-dirs . --target-branch main --print-config --debug
+      - |
+        if [[ -n "$(ct list-changed --chart-dirs . --target-branch main)" ]]; then
+          touch .changed
+        fi
+
+  lint:
+    name: Lint charts
+    image: quay.io/helmpack/chart-testing
+    commands:
+      - git fetch origin
+      - |
+        if [ -e .changed ]; then
+          ct lint --target-branch main --validate-maintainers=false --chart-dirs .
+        fi
+
+  test:
+    name: Test charts
+    image: quay.io/helmpack/chart-testing
+    environment:
+      - DOCKER_HOST=tcp://docker:2375
+    commands:
+      - export PATH=$PWD/.bin:$PATH
+      - apk update && apk add docker curl bash
+      - curl -s https://raw.githubusercontent.com/k3d-io/k3d/main/install.sh | bash
+      - k3d cluster create test --api-port 16443 --k3s-arg="kubelet-args=\"--allowed-unsafe-sysctls=net.ipv4.ip_forward\""@all
+      - sed -i -E -e 's/localhost|0\.0\.0\.0/docker/g' ~/.kube/config
+      - kubectl get storageclass
+      - git fetch origin
+      - |
+        if [ -e .changed ]; then
+          ct install --target-branch main --chart-dirs .
+          ct install --target-branch main --chart-dirs . --upgrade
+        fi
+
+services:
+  docker:
+    image: docker:dind
+    commands:
+      - echo "1" >  /proc/sys/net/ipv4/ip_forward
+      - dockerd -H tcp://0.0.0.0:2375 --tls=false
+    privileged: true
+    ports:
+      - 2375
+      - 16443
+    backend_options:
+      kubernetes:
+        resources:
+          requests:
+            memory: 500Mi
+            cpu: 500m
+          limits:
+            memory: 1000Mi
+            cpu: 1000m

containerfiles/Containerfile

@@ -1,5 +1,5 @@
 FROM ghcr.io/allanger/dumb-downloader as dudo
-ENV OPENVPN_VERSION=2.6.5
+ENV OPENVPN_VERSION=2.6.8
 RUN apt update && apt install gnupg tar -y
 RUN mkdir /output
 # ------------------------------------------------------
@@ -20,7 +20,7 @@ FROM ubuntu as builder
 # ------------------------------------------------------
 # -- TODO: Define it only once
 # ------------------------------------------------------
-ENV OPENVPN_VERSION=2.6.5
+ENV OPENVPN_VERSION=2.6.8
 COPY --from=dudo /output /src
 RUN apt-get update &&\
       apt-get install -y wget tar unzip build-essential \
@@ -63,4 +63,5 @@ COPY --chmod='755' ./bin /usr/local/bin
 # -- Add support for OTP authentication using a PAM module
 # -- I have no idea how it works yet
 # -----------------------------------------------------------
+WORKDIR /etc/openvpn
 COPY ./otp/openvpn /etc/pam.d/

containerfiles/Containerfile-XOR

@@ -75,4 +75,5 @@ COPY --chmod='755' ./bin /usr/local/bin
 # -- Add support for OTP authentication using a PAM module
 # -- I have no idea how it works yet
 # -----------------------------------------------------------
+WORKDIR /etc/openvpn
 COPY ./otp/openvpn /etc/pam.d/

helm/Chart.yaml

@@ -3,8 +3,8 @@ apiVersion: v2
 name: openvpn
 description: A Helm chart for deploying OpenVPN
 type: application
-version: 1.0.6
-appVersion: "2.6.5"
+version: 1.0.8
+appVersion: 2.6.5
 
 sources:
   - https://git.badhouseplants.net/allanger/container-openvpn-xor

helm/templates/deployment.yaml

@@ -39,7 +39,6 @@ spec:
         - name: {{ .Chart.Name }}
           image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
           imagePullPolicy: {{ .Values.image.pullPolicy }}
-
           resources:
             {{- toYaml .Values.resources | nindent 12 }}
           volumeMounts:
@@ -48,8 +47,10 @@ spec:
             - mountPath: /scripts
               name: pki-scripts
           env:
-          - name: OVPN_SERVER
-            value: "{{ .Values.openvpn.proto }}://{{ .Values.openvpn.host }}:{{ .Values.openvpn.port }}"
+            - name: OVPN_SERVER
+              value: "{{ .Values.openvpn.proto }}://{{ .Values.openvpn.host }}:{{ .Values.openvpn.port }}"
+            - name: OPENVPN
+              value: "/etc/openvpn"
           securityContext:
             capabilities:
               add:
@@ -60,6 +61,7 @@ spec:
         # ----------------------------------------------------------------------
         - name: 0-ovpn-genconfig
           image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
           volumeMounts:
             - mountPath: "/etc/openvpn"
               name: pvc-openvpn
@@ -67,7 +69,9 @@ spec:
             - name: OVPN_SERVER_URL
               value: "{{ .Values.openvpn.proto }}://{{ .Values.openvpn.host }}:{{ .Values.openvpn.port }}"
             - name: OVPN_DATA
-              value: "/etc/openvpn" 
+              value: "/etc/openvpn"
+            - name: OPENVPN
+              value: "/etc/openvpn"
           command: 
             - sh
             - -c 
@@ -76,6 +80,8 @@ spec:
           env:
             - name: OVPN_DATA
               value: /etc/openvpn
+            - name: OPENVPN
+              value: "/etc/openvpn"
             - name: EASYRSA_REQ_CN
               value: {{ .Values.easyrsa.cn }}
             - name: EASYRSA_REQ_COUNTRY
@@ -104,6 +110,7 @@ spec:
             - mountPath: /scripts
               name: pki-scripts
           image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
           command: 
             - bash
             - /scripts/init_pki.sh

helm/templates/pvc.yaml

@@ -5,7 +5,13 @@ metadata:
   labels:
     {{- include "openvpn-chart.labels" . | nindent 4 }}
 spec:
-  storageClassName: {{ .Values.storage.class }}
+  {{- if .Values.storage.class }}
+  {{- if (eq "-" .Values.storage.class) }}
+  storageClassName: ""
+  {{- else }}
+  storageClassName: "{{ .Values.storage.class }}"
+  {{- end }}
+  {{- end }}
   accessModes:
     - ReadWriteOnce
   resources:

helm/templates/tests/test-connection.yaml

@@ -1,15 +1,200 @@
+
+{{- $version := semver .Capabilities.KubeVersion.Version }}
+{{- if .Values.tests.enabled }}
+# ---------------------------------------------------------------------
+# -- Test that CRDs are installed
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ include "openvpn-chart.fullname" . }}-test-script
+  labels:
+    {{- include "openvpn-chart.selectorLabels" . | nindent 4 }}
+  annotations:
+    "helm.sh/hook": test
+    {{- if .Values.tests.cleanup }}
+    "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
+    {{- end }}
+    "helm.sh/hook-weight": "6"
+data:
+  get_config.sh: |-
+    #!/bin/bash
+    kubectl rollout status deployment/{{ include "openvpn-chart.fullname" . }}
+    kubectl exec deployment/{{ include "openvpn-chart.fullname" . }} -- ovpn_genclientcert test nopass
+    kubectl exec deployment/{{ include "openvpn-chart.fullname" . }} -- ovpn_getclient test > /data/test.ovpn
+  test_connection.sh : |-
+    sed -i "s/127.0.0.1/{{ include "openvpn-chart.fullname" . }}/g" /data/test.ovpn
+    mkdir -p /dev/net
+    mknod /dev/net/tun c 10 200
+    chmod 600 /dev/net/tun
+    openvpn --config /data/test.ovpn --daemon --log-append /tmp/ovpnlog
+    tail -n0 -f /tmp/ovpnlog | sed '/Initialization Sequence Completed/ q'
+    
+--- 
+# ---------------------------------------------------------------------
+# -- Prepare roles and bindings to access k8s resources from the test
+# ---------------------------------------------------------------------
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ include "openvpn-chart.fullname" . }}-test-role
+  labels:
+    {{- include "openvpn-chart.selectorLabels" . | nindent 4 }}
+  annotations:
+    "helm.sh/hook": test
+    {{- if .Values.tests.cleanup }}
+    "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
+    {{- end }}
+    "helm.sh/hook-weight": "1"
+rules:
+- apiGroups: ["*"]
+  resources: ["*"]
+  verbs: ["*"]
+
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ include "openvpn-chart.fullname" . }}-gsql-dbin-sa
+  labels:
+    {{- include "openvpn-chart.selectorLabels" . | nindent 4 }}
+  annotations:
+    "helm.sh/hook": test
+    {{- if .Values.tests.cleanup }}
+    "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
+    {{- end }}
+    "helm.sh/hook-weight": "1"
+automountServiceAccountToken: true
+
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ include "openvpn-chart.fullname" . }}-gsql-dbin-rb
+  labels:
+    {{- include "openvpn-chart.selectorLabels" . | nindent 4 }}
+  annotations:
+    "helm.sh/hook": test
+    {{- if .Values.tests.cleanup }}
+    "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
+    {{- end }}
+    "helm.sh/hook-weight": "1"
+subjects:
+- kind: ServiceAccount
+  name: {{ include "openvpn-chart.fullname" . }}-gsql-dbin-sa
+  namespace: {{ .Release.Namespace }}
+roleRef:
+  kind: ClusterRole
+  name: {{ include "openvpn-chart.fullname" . }}-test-role
+  apiGroup: rbac.authorization.k8s.io
+
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: {{ include "openvpn-chart.fullname" . }}-test
+  annotations:
+    "helm.sh/hook": test
+    {{- if .Values.tests.cleanup }}
+    "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
+    {{- end }}
+    "helm.sh/hook-weight": "7"
+  labels:
+    {{- include "openvpn-chart.labels" . | nindent 4 }}
+spec:
+  storageClassName: {{ .Values.storage.class }}
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 512Mi
+
+---
 apiVersion: v1
 kind: Pod
 metadata:
-  name: "{{ include "openvpn-chart.fullname" . }}-test-connection"
+  name: {{ include "openvpn-chart.fullname" . }}-test
   labels:
-    {{- include "openvpn-chart.labels" . | nindent 4 }}
+    {{- include "openvpn-chart.selectorLabels" . | nindent 4 }}
   annotations:
     "helm.sh/hook": test
+    {{- if .Values.tests.cleanup }}
+    "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
+    {{- end }}
+    "helm.sh/hook-weight": "7"
 spec:
+  serviceAccountName: {{ include "openvpn-chart.fullname" . }}-gsql-dbin-sa
+  automountServiceAccountToken: true
+  volumes:
+    - name: test-script
+      configMap:
+        name: {{ include "openvpn-chart.fullname" . }}-test-script
+    - name: data
+      persistentVolumeClaim:
+        claimName: {{ include "openvpn-chart.fullname" . }}-test
   containers:
-    - name: wget
-      image: busybox
-      command: ['wget']
-      args: ['{{ include "openvpn-chart.fullname" . }}:{{ .Values.service.port }}']
+    - name: tester
+      image: alpine/k8s:{{ $version.Major }}.{{ $version.Minor }}.{{ $version.Patch }}
+      volumeMounts:
+        - name: test-script
+          readOnly: true
+          mountPath: /get_config.sh
+          subPath: get_config.sh
+        - name: data
+          readOnly: false
+          mountPath: /data
+      command: 
+        - bash
+      args:
+        - -e
+        - /get_config.sh
   restartPolicy: Never
+
+---
+apiVersion: v1
+kind: Pod
+metadata:
+  name: {{ include "openvpn-chart.fullname" . }}-test-connection
+  labels:
+    {{- include "openvpn-chart.selectorLabels" . | nindent 4 }}
+  annotations:
+    "helm.sh/hook": test
+    {{- if .Values.tests.cleanup }}
+    "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
+    {{- end }}
+    "helm.sh/hook-weight": "7"
+spec:
+  serviceAccountName: {{ include "openvpn-chart.fullname" . }}-gsql-dbin-sa
+  automountServiceAccountToken: true
+  volumes:
+    - name: data
+      persistentVolumeClaim:
+        claimName: {{ include "openvpn-chart.fullname" . }}-test
+    - name: test-script
+      configMap:
+        name: {{ include "openvpn-chart.fullname" . }}-test-script
+  containers:
+    - name: tester
+      image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
+      imagePullPolicy: {{ .Values.image.pullPolicy }}
+      volumeMounts:
+        - name: data
+          readOnly: false
+          mountPath: /data
+        - name: test-script
+          readOnly: true
+          mountPath: /test_connection.sh
+          subPath: test_connection.sh
+      command: 
+        - bash
+      args:
+        - -e
+        - /test_connection.sh
+      securityContext:
+        capabilities:
+          add:
+            - NET_ADMIN
+
+  restartPolicy: Never
+
+{{- end }}

helm/values.yaml

@@ -1,41 +1,43 @@
 # Default values for openvpn-chart.
 image:
   repository: git.badhouseplants.net/allanger/container-openvpn
-  pullPolicy: IfNotPresent
+  pullPolicy: Always
   # -------------------------------------------
   # -- TODO: Switch to proper versions
   # -------------------------------------------
-  tag: v2.6.6
-
-# ----------------------------- 
-# -- Open VPN configuration 
+  # tag: ""
+# -----------------------------
+# -- Open VPN configuration
 # -----------------------------
 openvpn:
-  proto: udp
+  proto: tcp
   host: 127.0.0.1
   port: 1194
+# ---------------------------------------
+# -- Deploy OpenVPN admin
+# -- https://github.com/flant/ovpn-admin
+# ---------------------------------------
+openvpn_admin:
+  enabled: true
 # -----------------------------
 # -- Easy RSA configuration
 # -----------------------------
-easyrsa: 
-  cn: . # -- EASYRSA_REQ_CN
-  country: . # -- EASYRSA_REQ_COUNTRY
-  province: . # -- EASYRSA_REQ_PROVINCE
-  city: . # -- EASYRSA_REQ_CITY
-  org: . # -- EASYRSA_REQ_ORG
-  email: . # -- EASYRSA_REQ_EMAIL
-  ou: Community # -- EASYRSA_REQ_OU
-  algo: ec # -- EASYRSA_ALGO
-  digest: sha512 # -- EASYRSA_DIGEST 
-
+easyrsa:
+  cn: .  # --  EASYRSA_REQ_CN
+  country: .  # --  EASYRSA_REQ_COUNTRY
+  province: .  # --  EASYRSA_REQ_PROVINCE
+  city: .  # --  EASYRSA_REQ_CITY
+  org: .  # --  EASYRSA_REQ_ORG
+  email: .  # --  EASYRSA_REQ_EMAIL
+  ou: Community  # --  EASYRSA_REQ_OU
+  algo: ec  # --  EASYRSA_ALGO
+  digest: sha512  # --  EASYRSA_DIGEST
 replicaCount: 1
-
-
 imagePullSecrets: []
 nameOverride: ""
 fullnameOverride: ""
 storage:
-  class: microk8s-hostpath
+  class: ""
   size: 1Gi
 serviceAccount:
   # Specifies whether a service account should be created
@@ -45,36 +47,33 @@ serviceAccount:
   # The name of the service account to use.
   # If not set and create is true, a name is generated using the fullname template
   name: ""
-
 podAnnotations: {}
-
 podSecurityContext: {}
-  # fsGroup: 2000
+# fsGroup: 2000
 
 securityContext: {}
-  # capabilities:
-  #   drop:
-  #   - ALL
-  # readOnlyRootFilesystem: true
-  # runAsNonRoot: true
-  # runAsUser: 1000
+# capabilities:
+#   drop:
+#   - ALL
+# readOnlyRootFilesystem: true
+# runAsNonRoot: true
+# runAsUser: 1000
 
 service:
-  type: LoadBalancer
+  type: ClusterIP
   port: 1194
-
-
+  protocol: TCP
 resources: {}
-  # We usually recommend not to specify default resources and to leave this as a conscious
-  # choice for the user. This also increases chances charts run on environments with little
-  # resources, such as Minikube. If you do want to specify resources, uncomment the following
-  # lines, adjust them as necessary, and remove the curly braces after 'resources:'.
-  # limits:
-  #   cpu: 100m
-  #   memory: 128Mi
-  # requests:
-  #   cpu: 100m
-  #   memory: 128Mi
+# We usually recommend not to specify default resources and to leave this as a conscious
+# choice for the user. This also increases chances charts run on environments with little
+# resources, such as Minikube. If you do want to specify resources, uncomment the following
+# lines, adjust them as necessary, and remove the curly braces after 'resources:'.
+# limits:
+#   cpu: 100m
+#   memory: 128Mi
+# requests:
+#   cpu: 100m
+#   memory: 128Mi
 
 autoscaling:
   enabled: false
@@ -82,9 +81,9 @@ autoscaling:
   maxReplicas: 100
   targetCPUUtilizationPercentage: 80
   # targetMemoryUtilizationPercentage: 80
-
 nodeSelector: {}
-
 tolerations: []
-
 affinity: {}
+tests:
+  enabled: false
+  cleanup: true

kind.yaml

@@ -0,0 +1,21 @@
+apiVersion: kind.x-k8s.io/v1alpha4
+kind: Cluster
+name: test
+networking:
+  apiServerAddress: "0.0.0.0"
+  apiServerPort: 16443
+kubeadmConfigPatches:
+  - |
+    kind: InitConfiguration
+    nodeRegistration:
+      kubeletExtraArgs:
+          allowed-unsafe-sysctls: net.ipv4.ip_forward
+nodes:
+  - role: control-plane
+    kubeadmConfigPatches:
+      - |
+        kind: ClusterConfiguration
+        apiServer:
+          certSANs:
+          - "docker"
+  - role: worker