wireguard-chart
wireguard-chart copied to clipboard
Optional toggle to use k8s-wireguard-mgr for keygen hook
What
When running through a system such as argo, which doesn't correctly handle the helm hook directives and always runs the install phase hook, more graceful handling of the case of the secret already existing is needed. This is also beneficial for cases where the release has been uninstalled and one wants to re-use the existing key on a new install.
This introduces a new boolean toggle to opt into using the k8s-wireguard-mgr image found here:
https://github.com/bryopsida/k8s-wireguard-mgr
This image generates the server key, if an error is returned from the kubernetes API it inspects the reason, if the reason is already exists, it exits with status code 0. The reason it always attempts to create the secret is to avoid giving the hook/job serviceaccount access to read secrets.
The toggle is enabled with the value keygenJob.useWireguardManager, the image used can be customized with
- keygenJob.wireguardMgrImage.repository
- keygenJob.wireguardMgrImage.tag
Relates to: #46
Introducing client connection test in: https://github.com/bryopsida/wireguard-chart/pull/55
Once that is integrated this will just need a test case added with the appropriate values toggled on to use the key mgr sidecar.