apps/kubevpn
1
0
Fork 0
mirror of https://github.com/kubenetworks/kubevpn.git synced 2025-12-24 11:51:13 +08:00
Code Issues Packages Projects Releases Wiki Activity

feat: encrypt with tls 1.3 (#522)

Browse Source
This commit is contained in:
naison
2025-04-12 12:30:05 +08:00
committed by GitHub
parent 7e4e9e1e0d
commit ca333fcdaf
20 changed files with 391 additions and 66 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
pkg/inject/controller.go
View File

@@ -38,7 +38,7 @@ func RemoveContainers(spec *v1.PodTemplateSpec) {
}
// AddMeshContainer todo envoy support ipv6
func AddMeshContainer(spec *v1.PodTemplateSpec, ns, nodeId string, c util.PodRouteConfig, ipv6 bool, connectNamespace string) {
func AddMeshContainer(spec *v1.PodTemplateSpec, ns, nodeId string, c util.PodRouteConfig, ipv6 bool, connectNamespace string, secret *v1.Secret) {
// remove envoy proxy containers if already exist
RemoveContainers(spec)
@@ -98,6 +98,18 @@ kubevpn server -l "tun:/localhost:8422?net=${TunIPv4}&net6=${TunIPv6}&route=${CI
},
},
},
{
Name: config.TLSServerName,
Value: string(secret.Data[config.TLSServerName]),
},
{
Name: config.TLSCertKey,
Value: string(secret.Data[config.TLSCertKey]),
},
{
Name: config.TLSPrivateKeyKey,
Value: string(secret.Data[config.TLSPrivateKeyKey]),
},
},
Resources: v1.ResourceRequirements{
Requests: map[v1.ResourceName]resource.Quantity{
@@ -159,7 +171,7 @@ kubevpn server -l "tun:/localhost:8422?net=${TunIPv4}&net6=${TunIPv6}&route=${CI
})
}
func AddEnvoyContainer(spec *v1.PodTemplateSpec, ns, nodeId string, ipv6 bool, connectNamespace string) {
func AddEnvoyContainer(spec *v1.PodTemplateSpec, ns, nodeId string, ipv6 bool, connectNamespace string, secret *v1.Secret) {
// remove envoy proxy containers if already exist
RemoveContainers(spec)

14
pkg/inject/exchange.go
View File

@@ -20,7 +20,7 @@ func RemoveContainer(spec *corev1.PodSpec) {
}
}
func AddContainer(spec *corev1.PodSpec, c util.PodRouteConfig, connectNamespace string) {
func AddContainer(spec *corev1.PodSpec, c util.PodRouteConfig, connectNamespace string, secret *corev1.Secret) {
// remove vpn container if already exist
RemoveContainer(spec)
spec.Containers = append(spec.Containers, corev1.Container{
@@ -71,6 +71,18 @@ func AddContainer(spec *corev1.PodSpec, c util.PodRouteConfig, connectNamespace
},
},
},
{
Name: config.TLSServerName,
Value: string(secret.Data[config.TLSServerName]),
},
{
Name: config.TLSCertKey,
Value: string(secret.Data[config.TLSCertKey]),
},
{
Name: config.TLSPrivateKeyKey,
Value: string(secret.Data[config.TLSPrivateKeyKey]),
},
},
Command: []string{"/bin/sh", "-c"},
// https://www.netfilter.org/documentation/HOWTO/NAT-HOWTO-6.html#ss6.2

4
pkg/inject/fargate.go
View File

@@ -28,7 +28,7 @@ import (
// InjectEnvoySidecar patch a sidecar, using iptables to do port-forward let this pod decide should go to 233.254.254.100 or request to 127.0.0.1
// https://istio.io/latest/docs/ops/deployment/requirements/#ports-used-by-istio
func InjectEnvoySidecar(ctx context.Context, f cmdutil.Factory, clientset *kubernetes.Clientset, connectNamespace string, object *runtimeresource.Info, headers map[string]string, portMap []string) (err error) {
func InjectEnvoySidecar(ctx context.Context, f cmdutil.Factory, clientset *kubernetes.Clientset, connectNamespace string, object *runtimeresource.Info, headers map[string]string, portMap []string, secret *v1.Secret) (err error) {
u := object.Object.(*unstructured.Unstructured)
var templateSpec *v1.PodTemplateSpec
var path []string
@@ -66,7 +66,7 @@ func InjectEnvoySidecar(ctx context.Context, f cmdutil.Factory, clientset *kuber
enableIPv6, _ := util.DetectPodSupportIPv6(ctx, f, connectNamespace)
// (1) add mesh container
AddEnvoyContainer(templateSpec, object.Namespace, nodeID, enableIPv6, connectNamespace)
AddEnvoyContainer(templateSpec, object.Namespace, nodeID, enableIPv6, connectNamespace, secret)
helper := pkgresource.NewHelper(object.Client, object.Mapping)
ps := []P{
{

4
pkg/inject/mesh.go
View File

@@ -31,7 +31,7 @@ import (
// https://istio.io/latest/docs/ops/deployment/requirements/#ports-used-by-istio
// InjectVPNAndEnvoySidecar patch a sidecar, using iptables to do port-forward let this pod decide should go to 233.254.254.100 or request to 127.0.0.1
func InjectVPNAndEnvoySidecar(ctx context.Context, f cmdutil.Factory, mapInterface v12.ConfigMapInterface, connectNamespace string, object *runtimeresource.Info, c util.PodRouteConfig, headers map[string]string, portMaps []string) (err error) {
func InjectVPNAndEnvoySidecar(ctx context.Context, f cmdutil.Factory, mapInterface v12.ConfigMapInterface, connectNamespace string, object *runtimeresource.Info, c util.PodRouteConfig, headers map[string]string, portMaps []string, secret *v1.Secret) (err error) {
u := object.Object.(*unstructured.Unstructured)
var templateSpec *v1.PodTemplateSpec
var path []string
@@ -90,7 +90,7 @@ func InjectVPNAndEnvoySidecar(ctx context.Context, f cmdutil.Factory, mapInterfa
enableIPv6, _ := util.DetectPodSupportIPv6(ctx, f, connectNamespace)
// (1) add mesh container
AddMeshContainer(templateSpec, object.Namespace, nodeID, c, enableIPv6, connectNamespace)
AddMeshContainer(templateSpec, object.Namespace, nodeID, c, enableIPv6, connectNamespace, secret)
helper := pkgresource.NewHelper(object.Client, object.Mapping)
ps := []P{
{

4
pkg/inject/proxy.go
View File

@@ -24,7 +24,7 @@ import (
util2 "github.com/wencaiwulue/kubevpn/v2/pkg/util"
)
func InjectVPNSidecar(ctx context.Context, f util.Factory, connectNamespace string, object *resource.Info, c util2.PodRouteConfig) error {
func InjectVPNSidecar(ctx context.Context, f util.Factory, connectNamespace string, object *resource.Info, c util2.PodRouteConfig, secret *v1.Secret) error {
u := object.Object.(*unstructured.Unstructured)
podTempSpec, path, err := util2.GetPodTemplateSpecPath(u)
@@ -51,7 +51,7 @@ func InjectVPNSidecar(ctx context.Context, f util.Factory, connectNamespace stri
return err
}
AddContainer(&podTempSpec.Spec, c, connectNamespace)
AddContainer(&podTempSpec.Spec, c, connectNamespace, secret)
workload := fmt.Sprintf("%s/%s", object.Mapping.Resource.Resource, object.Name)
helper := resource.NewHelper(object.Client, object.Mapping)