I am looking at how to make OpenVPN client work on a pod's container, I explain what I do, but you can skip all my explanation and offer your solution directly, I don't care replacing all the below with your steps if it works, I want to make my container to use a VPN (ExpressVPN for example) in a way that both external and internal networking works.
I have a docker image that is an OpenVPN Client, it works fine with the command:
docker run --rm -it --cap-add=NET_ADMIN --device=/dev/net/tun my-app /bin/bash
The docker image had an entry point bash script:
curl https://vpnvendor/configurations.zip -o /app/configurations.zip
mkdir -p /app/open_vpn/ip_vanish/config
unzip /app/configurations.zip -d /app/open_vpn/config
printf "username\npassword\n" > /app/open_vpn/vpn-auth.conf
cd /app/open_vpn/config
openvpn --config ./config.ovpn --auth-user-pass /app/open_vpn/vpn-auth.conf
It works fine, but when I deploy it as a container in a K8S Pod, it breaks, it is understandable, K8S clusters need internal network communication between the nodes, so the VPN breaks it ... how do I make it work? the Google search was frustrating, none of the solutions worked and there were just a few, there is one with similar issue: OpenVPN-Client Pod on K8s - Local network unreachable But did not understand it very well, please help.
Since IPVanish is well known, let's take their ovpn example, I use other vendor but had access to an IPVanish account and it does not work either:
client
dev tun
proto udp
remote lon-a52.ipvanish.com 443
resolv-retry infinite
nobind
persist-key
persist-tun
persist-remote-ip
ca ca.ipvanish.com.crt
verify-x509-name lon-a52.ipvanish.com name
auth-user-pass
comp-lzo
verb 3
auth SHA256
cipher AES-256-CBC
keysize 256
tls-cipher TLS-DHE-RSA-WITH-AES-256-CBC-SHA:TLS-DHE-DSS-WITH-AES-256-CBC-SHA:TLS-RSA-WITH-AES-256-CBC-SHA
I accept responses in Golang or YAML it does not matter, although I use go-client, my code for pod creation is:
podObj := &v1.Pod{
ObjectMeta: metav1.ObjectMeta{
Name: "mypod",
Namespace: "default",
},
Spec: v1.PodSpec{
Containers: []v1.Container{
{
Name: "worker1",
Image: "192.168.1.138:5000/myimage",
ImagePullPolicy: v1.PullAlways,
Stdin: true,
TTY: true,
/* Trying to simulate --device=/dev/net/tun I copied the below, but it does not work
// https://garunski.medium.com/openvpn-and-minikube-25511099f8de
VolumeMounts: []v1.VolumeMount{
{
ReadOnly: true,
Name: "dev-tun",
MountPath: "/dev/net/tun",
},
},*/
SecurityContext: &v1.SecurityContext{
// Taken from https://caveofcode.com/how-to-setup-a-vpn-connection-from-inside-a-pod-in-kubernetes/
Privileged: boolPtr(true),
Capabilities: &v1.Capabilities{
Add: []v1.Capability{
"NET_ADMIN",
},
},
},
},
},
NodeName: "worker-node01",
},
}
clientset.CoreV1().Pods("default").Create(context.Background(), podObj, metav1.CreateOptions{})
I can add the NET_ADMIN
capability, but I need also to give access to the /dev/net/tun
device and that's the problem, but even If I find a way, it will break internal networking.
Update one
I made external networking work, by adding the following two lines in my docker's entry point:
# Taken from https://caveofcode.com/how-to-setup-a-vpn-connection-from-inside-a-pod-in-kubernetes/
mknod /dev/net/tun c 10 200
chmod 600 /dev/net/tun
10.43.0.0/16
and10.42.0.0/16
respectively, but it is better to check that. For example, using this lineroute 10.42.0.0 255.255.0.0 net_gateway
you are telling that to reach any IP in10.42.0.0/16
, the packet should go via the default gateway and NOT VPN tunnel. In other words, all traffic goes through the VPN except for IPs in10.42.0.0/16
.route 192.168.0.0 255.255.0.0 net_gateway
and also your two lines above (10.43.0.0 and 10.42.0.0 just in case), as a test I had a http server on the host on port 3002, trying curl 192.168.1.138 does not work with VPN, without VPN works this is the output for route pre and post: gist.github.com/melardev/9a1c9653ac41835625469ed1e5b6b77bcurl
command that you used along withtraceroute
example and I'll look into this later.