Overview of Podlily

Kubernetes has become a common standard to run applications on but it is not (yet) a general practice to run a VPN system on Kubernetes. With podlily we are exploring this deployment method. Naturally there are still hardening issues that we will address in the future, e.g. rootless containers.
This overview shows the current podlily setup, which helm charts install which pods, which pods run on which nodes on which cluster.

Currently podlily relies on 4 helm-charts: helm-backend, helm-gateway, kube-prometheus-stack and Grafana Alloy. You can install these helm-charts on k3s clusters. K3s is a lightweight kubernetes distribution.

graph
  subgraph "grafana-alloy"
      alloy(alloy)
  end
  subgraph "kube-prometheus-stack"
      alertmanager(alertmanager)
      node-exporter(node Exporter)
      operator(prometheus Operator)
      state-metrics(kube state metrics)
      grafana(grafana)
  end
  subgraph "helm-gateway"
      gw-openvpn(openvpn)
      gw-menshen-agent(openvpn menshen-agent)
      gw-obfsvpn(obfsvpn)
      gw-ovpn-addons[kresd, openvpn prometheus exporter]
  end
  subgraph "helm-backend"
      traefik(traefik)
      menshen(menshen)
  end

In order to provide best global scalability, podlily’s default architecture requires at least 2 different clusters. The first one contains the backend components such as the provider’s configuration API menshen, system monitoring and alerting. The second cluster is a single-node cluster serving as a gateway. The following diagram shows the nodes in each cluster.

graph TD
  subgraph "gateway-cluster 1 location B"
    gatewayB1((gateway-B-1))
  end

  subgraph "gateway-cluster 1 location A"
    gatewayA1((gateway-A-1))
  end

  subgraph "backend-cluster"
    monitoring((Monitoring))
    controller((Controller))
    backend((Menshen))
  end