Web interfaces associated with the module: openvpn-admin

The openvpn module allows peers to authenticate each other using certificates and provides a simple web interface.

Using the web interface, you can:

  • issue certificates;
  • revoke certificates;
  • cancel certificate revocation;
  • get a ready-to-use custom configuration file.

The web interface is integrated with the user-authn module, allowing you to manage user access to this web interface.

Exposing the VPN service

Generally, one or more external IP addresses are used for a connection. The following connection methods are supported:

  • External IP-based (ExternalIP) — when there are nodes with public IPs.
  • LoadBalancer-based (LoadBalancer) — AWS, Google Cloud and other LBs are supported.
  • Direct — for non-standard cases; this method allows you to manually configure the way traffic is routed from the cluster entry to the OpenVPN Pod.

Available cluster resources after connecting to the VPN

The following parameters are pushed to the user’s computer after connecting to the VPN:

  • the kube-dns address is added to the client’s DNS servers to allow direct access to Kubernetes services via FQDN;
  • a route to the local network;
  • a route to the cluster service network;
  • a route to the Pod network.

User’s traffic audit

The module can log user’s activity via VPN in JSON format. Traffic is grouped by src_ip, dst_ip, src_port, dst_port, ip_proto fields. Container logs can be collected and sent to storage for further audit using the log-shipper module.