borchero / meerkat

Kubernetes Operator for a Cloud-Native OpenVPN Deployment.

Meerkat

Meerkat is a Kubernetes Operator that facilitates the deployment of OpenVPN in a Kubernetes cluster. By leveraging Hashicorp Vault, Meerkat securely manages the underlying PKI.

Features

Meerkat revolves around two CRDs, namely OvpnServer and OvpnClient. There may exist arbitrarily many servers while clients are always associated with a single server. These two CRDs give rise to the following features:

• Generation of shared secrets for TLS Auth
• Creation of a PKI for each server independently with secure private key
• Dynamic OVPN server configuration
• Rendering of ovpn client files for each client
• Revocation of client certificates as an OvpnClient is deleted

Usage

This section gives a very brief overview of how Meerkat may be installed in your cluster.

Prerequisites

In order to use Meerkat, you must have access to a Vault instance. It requires the following:

• Kubernetes Auth has to be enabled and a role for Meerkat has to be defined
• A service account must be configured with a policy to manage PKIs at a specified path (and its subpaths).

Operator Deployment

Then, you can deploy the operator using Helm:

helm repo add borchero https://charts.borchero.com
helm install meerkat borchero/meerkat \
    --set rbac.serviceAccountName=${SERVICE_ACCOUNT_NAME} \
    --set vault.auth.config.role=${KUBERNETES_ROLE} \
    --set vault.pkiPath=${PKI_PATH}

You can also leave all of these fields blank and they choose sensible defaults. Consult the values file for further details.

Custom Resources

Once the operator is running, you can install the custom resources, creating a server and your clients. Have a look at the example manifests.

Once a client is created, there exists a secret with the client's name, containing the client's OVPN certificate. It can be retrieved by using kubectl:

kubectl get secret <SECRET_NAME> -o json | jq -r '.data."certificate.ovpn"' | base64 -d

License

Meerkat is licensed under the MIT License.

meerkat's Issues

Secret with client cert not generated

The README says something about a secret being made named after the client which should contain the client certificate. I made a ovpnserver and ovpnclient resource like such:

❯ kubectl -n production get ovpnservers
NAME      AGE
prodvpn   8m18s

❯ kubectl -n production get ovpnclients
NAME      AGE
merlin    6m30s

❯ kubectl -n production describe ovpnclients/merlin
Name:         merlin
Namespace:    production
Labels:       <none>
Annotations:  API Version:  meerkat.borchero.com/v1alpha1
Kind:         OvpnClient
[...]
  Common Name:  merlin.hvs.saphyre.net
  Server Name:  prodvpn

however there appears to be no secret named merlin:

❯ kubectl -n production get secret merlin -o json | jq -r '.data."certificate.ovpn"' | base64 -d
Error from server (NotFound): secrets "merlin" not found

Am I missing something?