feat: add builder

.kube/Chart.yaml

@@ -0,0 +1,4 @@
+apiVersion: v2
+name: freeradius
+version: 1.0.1
+appVersion: 3.2.0

.kube/templates/00-pullsecret.yaml

@@ -0,0 +1,8 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{.Release.Name}}-registry-key
+  namespace: {{.Release.Namespace}}
+data:
+  .dockerconfigjson: "{{.Values.registryAuthBase64}}"
+type: kubernetes.io/dockerconfigjson

.kube/templates/cm-configs.yaml

@@ -0,0 +1,168 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ .Release.Name }}-configs
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app: clickhouse-operator
+data:
+  default: |
+    server default {
+      listen {
+          type = auth
+          ipaddr = *
+          port = {{.Values.ports.main}}
+          limit {
+                max_connections = 16
+                lifetime = 0
+                idle_timeout = 30
+          }
+      }
+
+      listen {
+          ipaddr = *
+          port = {{.Values.ports.second}}
+          type = acct
+
+          limit {
+          }
+      }
+
+      authorize {
+          filter_username
+          preprocess
+          chap
+          mschap
+          digest
+          expiration
+          logintime
+          pap
+          Autz-Type New-TLS-Connection {
+                ok
+          }
+      }
+      authenticate {
+          Auth-Type PAP {
+              pap
+          }
+          Auth-Type CHAP {
+              chap
+          }
+          digest
+      }
+
+      preacct {
+          preprocess
+          acct_unique
+          suffix
+          files
+      }
+      accounting {
+          detail
+          unix
+          -sql
+          exec
+          attr_filter.accounting_response
+      }
+      session {
+      }
+      post-auth {
+          if (session-state:User-Name && reply:User-Name && request:User-Name && (reply:User-Name == request:User-Name)) {
+              update reply {
+                  &User-Name !* ANY
+              }
+          }
+          update {
+              &reply: += &session-state:
+          }
+          -sql
+          exec
+          remove_reply_message_if_eap
+          Post-Auth-Type REJECT {
+              -sql
+              attr_filter.access_reject
+              remove_reply_message_if_eap
+          }
+          Post-Auth-Type Client-Lost {
+          }
+          if (EAP-Key-Name && &reply:EAP-Session-Id) {
+              update reply {
+                  &EAP-Key-Name := &reply:EAP-Session-Id
+              }
+          }
+      }
+      pre-proxy {
+      }
+      post-proxy {
+      }
+    }
+
+
+  sql: |
+    sql {
+        dialect = "postgresql"
+        driver = "rlm_sql_${dialect}"
+        postgresql {
+            send_application_name = yes
+        }
+
+        server = "{{.Values.db.host}}"
+        port = {{.Values.db.port}}
+        login = "{{.Values.db.user}}"
+        password = "{{.Values.db.password}}"
+        radius_db = "{{.Values.db.name}}"
+
+        acct_table1 = "radacct"
+        acct_table2 = "radacct"
+        postauth_table = "radpostauth"
+        authcheck_table = "radcheck"
+        groupcheck_table = "radgroupcheck"
+        authreply_table = "radreply"
+        groupreply_table = "radgroupreply"
+        usergroup_table = "radusergroup"
+
+        delete_stale_sessions = yes
+
+        pool {
+            start = ${thread[pool].start_servers}
+            min = ${thread[pool].min_spare_servers}
+            max = ${thread[pool].max_servers}
+            spare = ${thread[pool].max_spare_servers}
+            uses = 0
+            retry_delay = 30
+            lifetime = 0
+            idle_timeout = 60
+        }
+
+        client_table = "nas"
+        group_attribute = "SQL-Group"
+        $INCLUDE ${modconfdir}/${.:name}/main/${dialect}/queries.conf
+    }
+
+  rest: |
+    rest {
+        tls {
+        }
+        connect_uri = "http://{{.Values.api.host}}:{{.Values.api.port}}/"
+        authorize {
+            uri = "${..connect_uri}radius/auth"
+            method = 'post'
+            body = 'json'
+            data = '{"ip": "%{Packet-Src-IP-Address}", "hotspot-group": "%{raw:Called-Station-Id}", "hotspot-id": "%{raw:NAS-Identifier}"}'
+            force_to = 'json'
+            auth = 'none'
+            require_auth = no
+            timeout = 4.000000
+        }
+        pool {
+            start = ${thread[pool].start_servers}
+            min = ${thread[pool].min_spare_servers}
+            max = ${thread[pool].max_servers}
+            spare = ${thread[pool].max_spare_servers}
+            uses = 0
+            retry_delay = 30
+            lifetime = 0
+            idle_timeout = 60
+        }
+    }
+

.kube/templates/deployment.yaml

@@ -0,0 +1,69 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{.Release.Name}}
+  namespace: {{.Release.Namespace}}
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: {{.Release.Name}}
+  template:
+    metadata:
+      labels:
+        app: {{.Release.Name}}
+    spec:
+      nodeSelector:
+        freeradius: enabled
+      tolerations:
+        - key: freeradius
+          operator: Equal
+          value: enabled
+          effect: NoSchedule
+      imagePullSecrets:
+        - name: {{.Release.Name}}-registry-key
+{{/*      securityContext:*/}}
+{{/*        runAsUser: 108*/}}
+{{/*        runAsGroup: 112*/}}
+{{/*        fsGroup: 108*/}}
+      containers:
+        - name: {{.Release.Name}}
+          image: {{.Values.image.name}}
+          imagePullPolicy: {{.Values.image.pullPolicy}}
+          env:
+            - name: MY_POD_NAME
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.name
+
+            - name: TZ
+              value: UTC
+            - name: HOSTNAME
+              value: freeradius
+          ports:
+            - containerPort: {{.Values.ports.main}}
+            - containerPort: {{.Values.ports.second}}
+          volumeMounts:
+            - mountPath: /etc/freeradius/certs
+              name: freeradius-cert-data
+              readOnly: false
+            - name: configs-volume
+              mountPath: "/configs/default"
+              subPath: default
+              readOnly: true
+            - name: configs-volume
+              mountPath: "/configs/sql"
+              subPath: sql
+              readOnly: true
+            - name: configs-volume
+              mountPath: "/configs/rest"
+              subPath: rest
+              readOnly: true
+      volumes:
+        - name: configs-volume
+          configMap:
+            name: {{ .Release.Name }}-configs
+            defaultMode: 488
+        - name: freeradius-cert-data
+          persistentVolumeClaim:
+            claimName: freeradius-data-claim

.kube/templates/service.yaml

@@ -0,0 +1,19 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{.Release.Name}}-external
+  namespace: {{.Release.Namespace}}
+spec:
+  type: NodePort
+  externalTrafficPolicy: Local
+  ports:
+  - port: {{.Values.ports.main}}
+    nodePort: {{.Values.ports.main}}
+    protocol: UDP
+    name: freerad-first
+  - port: {{.Values.ports.second}}
+    nodePort: {{.Values.ports.second}}
+    protocol: UDP
+    name: freerad-second
+  selector:
+    app: {{ .Chart.Name }}

.kube/templates/volumes.yaml

@@ -0,0 +1,26 @@
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: freeradius-data-disk
+  namespace: {{.Release.Namespace}}
+spec:
+  capacity:
+    storage: 10Mi
+  accessModes:
+    - ReadWriteOnce
+  persistentVolumeReclaimPolicy: Retain
+  hostPath:
+    path: {{.Values.storageBase}}/{{.Chart.Name}}
+---
+kind: PersistentVolumeClaim
+apiVersion: v1
+metadata:
+  name: freeradius-data-claim
+  namespace: {{.Release.Namespace}}
+spec:
+  volumeName: freeradius-data-disk
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 10Mi

.kube/values.yaml

@@ -0,0 +1,20 @@
+image:
+  name: ${CONTAINER_IMAGE}
+  pullPolicy: "IfNotPresent"
+registryAuthBase64: ${REGISTRY_AUTH}
+storageBase: ${STORAGE_BASE}
+
+ports:
+  main: 31812
+  second: 31813
+
+db:
+  host: "postgresql-pgbouncer"
+  port: 6432
+  user: "admin"
+  password: "radius_db"
+  name: "radius_db"
+
+api:
+  host: "hotspotter"
+  port: 8080