Meerkat
Meerkat is a Kubernetes Operator that facilitates the deployment of OpenVPN in a Kubernetes cluster. By leveraging Hashicorp Vault, Meerkat securely manages the underlying PKI.
Features
Meerkat revolves around two CRDs, namely OvpnServer and OvpnClient. There may exist arbitrarily many servers while clients are always associated with a single server. These two CRDs give rise to the following features:
- Generation of shared secrets for TLS Auth
- Creation of a PKI for each server independently with secure private key
- Dynamic OVPN server configuration
- Rendering of
ovpnclient files for each client - Revocation of client certificates as an
OvpnClientis deleted
Usage
This section gives a very brief overview of how Meerkat may be installed in your cluster.
Prerequisites
In order to use Meerkat, you must have access to a Vault instance. It requires the following:
- Kubernetes Auth has to be enabled and a role for Meerkat has to be defined
- A service account must be configured with a policy to manage PKIs at a specified path (and its subpaths).
Operator Deployment
Then, you can deploy the operator using Helm:
helm repo add borchero https://charts.borchero.com
helm install meerkat borchero/meerkat \
--set rbac.serviceAccountName=${SERVICE_ACCOUNT_NAME} \
--set vault.auth.config.role=${KUBERNETES_ROLE} \
--set vault.pkiPath=${PKI_PATH}
You can also leave all of these fields blank and they choose sensible defaults. Consult the values file for further details.
Custom Resources
Once the operator is running, you can install the custom resources, creating a server and your clients. Have a look at the example manifests.
Once a client is created, there exists a secret with the client's name, containing the client's OVPN certificate. It can be retrieved by using kubectl:
kubectl get secret <SECRET_NAME> -o json | jq -r '.data."certificate.ovpn"' | base64 -d
License
Meerkat is licensed under the MIT License.
