[pod-gateway]: The container will not get persistance mounts

[samip5]

I need to mount eg /dev to the gluetun container, but the template doesn't allow for that.

(Talos 1.8 alpha)

[psych0d0g]

adding resources definition to your values.yaml would fix that with a device-plugin as documented here: https://www.talos.dev/v1.8/kubernetes-guides/configuration/device-plugins/

after deploying the device plugin, put the following into your addon: vpn block in your values.yaml:

        resources:
          limits:
            squat.ai/tun: "1"

this at least fixes the pod-gateway deployment for me, the target pod that should be routed through VPN failes in its init container tho:

--- 10.244.3.29 ping statistics ---
1 packets transmitted, 0 packets received, 100% packet loss

solved, the second issue at least for me was due to upstream gluetun changing the firewall parameter env var name:
qdm12/gluetun@e7381b3

[TheAceMan]

I was able to mount a configMap to the gluten container, assume you could mount persistent storage this way as well. This appears to mount the volume to both the pod-gateway and gluetun containers. The important parts are to create the persistence and add an additionalVolumeMounts to the gluetun specs. Below is the relevant parts of my config, I am mounting additional iptables rules I needed to get it working.

apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
  name: gateway
spec:
  interval: 30m
  chart:
    spec:
      chart: pod-gateway
      version: 6.5.1
      interval: 30m
      sourceRef:
        kind: HelmRepository
        name: angelnu
        namespace: flux-system

  values:
    image:
      repository: ghcr.io/angelnu/pod-gateway
      tag: v1.13.0

    addons:
      vpn:
        enabled: true
        type: gluetun
        gluetun:
          image:
            repository: ghcr.io/qdm12/gluetun
            tag: v3.40.0@sha256:2b42bfa046757145a5155acece417b65b4443c8033fb88661a8e9dcf7fda5a00

        additionalVolumeMounts:
          - mountPath: /iptables/post-rules.txt
            name: iptables
            readOnly: true
            subPath: post-rules.txt

    webhook:
      image:
        repository: ghcr.io/angelnu/gateway-admision-controller
        tag: v3.12.0

    persistence:
      iptables:
        enabled: true
        type: configMap
        name: pod-gateway-post-rules
        subPath: post-rules.txt
        mountPath: "/iptables/post-rules.txt"
        readOnly: true

[Dopingus]

Thanks for showing how to mount the configMap, this solved my issue with pinging from the gateway-init (sidecar) container.

Unfortunately, the dhcp requests get stuck now. When I disable the firewall in gluetun entirely ("FIREWALL_ENABLED_DISABLING_IT_SHOOTS_YOU_IN_YOUR_FOOT" set to "OFF"), dhcp successfully gets a lease.

I have the following rules added through the config map:

    iptables -A INPUT -p icmp -j ACCEPT
    iptables -A INPUT -p udp --sport=68 --dport=67 -j ACCEPT
    iptables -A OUTPUT -p udp --sport=67 --dport=68 -j ACCEPT

I guess some rule is still missing to allow the dhcp request to succeed. I would appreciate any help on this.

[samip5]

Just rely on Kubernetes network policies instead of gluetun’s firewall.