Skip to content

Latest commit

 

History

History
49 lines (32 loc) · 2.09 KB

readme.md

File metadata and controls

49 lines (32 loc) · 2.09 KB

Automatically Inject Gluetun with Kyverno ClusterPolicy

This guide demonstrates how to automatically inject Gluetun as a sidecar container into deployments using a Kyverno cluster policy. Kyverno acts as an admission control, enforcing policies on kubernetes resources before they are admitted into the cluster.

Prerequisites

  • A Kubernetes cluster (Amazon EKS was used in this example)

Steps

  1. Install Kyverno

    helm repo add kyverno https://kyverno.github.io/kyverno/
helm repo update
helm install kyverno --namespace kyverno kyverno/kyverno --create-namespace

  2. Create Gluetun Configuration Secret

    Create a Kubernetes secret named vpn in the default namespace to store Gluetun configuration details. Replace the placeholders with your actual values:

    kubectl create secret generic vpn -n default \
    --from-literal=FIREWALL_OUTBOUND_SUBNETS='10.128.0.0/16,172.20.0.0/16' \
    --from-literal=VPN_SERVICE_PROVIDER='your_vpn_service_provider' \
    --from-literal=OPENVPN_USER='your_openvpn_username' \
    --from-literal=OPENVPN_PASSWORD='your_openvpn_password'
    • The FIREWALL_OUTBOUND_SUBNETS option specifies comma-separated network CIDRs that should not be routed through the VPN.

  3. Create Kyverno ClusterPolicy

    Apply the kyverno-clusterpolicy.yaml file containing the Kyverno policy definition. This policy will look for deployments with the annotation vpn/gluetun-inject: "true" and automatically inject the Gluetun sidecar container.

    kubectl apply -f kyverno-clusterpolicy.yaml

  4. Test with Deployment Example

    Deploy a test deployment with the vpn/gluetun-inject: "true" annotation in the deployment.yaml file and apply it to the default namespace. Kyverno will automatically inject the Gluetun container during deployment.

    kubectl apply -f deployment.yaml -n default

This process automates Gluetun injection for deployments marked for the sidecar container, simplifying your configuration management and ensuring consistent VPN protection for your workloads.