Restrict the amount of work being done in a privileged container in the reversed vpn client.

[ScheererJ]

How to categorize this PR?

/area networking
/kind cleanup

What this PR does / why we need it:
Restrict the amount of work being done in a privileged container in the reversed vpn client.

It is not necessary for the vpn-seed-server to run as privileged container. The tun
device required for vpn operation can be mounted into the container namespace. The
remaining work requiring privileged work can be moved into an init container.
In case the container should run as non-root user in the future, it might help to
create a separate tun device in a privileged init container as described in
https://community.openvpn.net/openvpn/wiki/UnprivilegedUser#TUNTAPDevice .

Which issue(s) this PR fixes:
Partially addresses gardener-attic/vpn#41.

Special notes for your reviewer:

Release note:

The vpn-shoot/vpn-shoot container no longer runs in privileged mode (when ReversedVPN feature gate is enabled). As it still needs to still modify some kernel settings, this part is moved to init container that still has to run in privileged but the risk to cluster security is minimal because of the ephemeral nature of init containers.

[ScheererJ]

/cc @DockToFuture @marwinski @ialidzhikov
/hold until #6349 is merged

[DockToFuture]

/lgtm

[ialidzhikov]

@marwinski can you also review this PR as it is related to #6346?

[DockToFuture]

/lgtm

[ialidzhikov]

@ScheererJ can you rebase after #6349 is merged?

[ScheererJ]

@ScheererJ can you rebase after #6349 is merged?

@ialidzhikov I sure can even though I do not quite understand why it would be required (as the changes are in unrelated files).

[ialidzhikov]

@ialidzhikov I sure can even though I do not quite understand why it would be required (as the changes are in unrelated files).

How I am supposed to test locally this PR as it relies on new env vars like DO_NOT_CONFIGURE_KERNEL_SETTINGS and EXIT_AFTER_CONFIGURING_KERNEL_SETTINGS that are introduced with the version bump in #6349? Shouldn't the e2e test about shoot creation fail for the same reason?

[ScheererJ]

@ialidzhikov The end-to-end test will likely fail as the init container will not stop with the old image version. You can test it locally be referencing the new vpn2 release instead of the existing one.

[ScheererJ]

@ialidzhikov Rebased as requested.

[ScheererJ]

/retest

[marwinski]

I wasn't able to test this from from the /dev/net/tun point of view this will work. The way the init container is implemented looks a bit like a hack due to the environment variable control. Maybe a separate script would have been more appropriate but this is minor.

[gardener-prow]

@marwinski: adding LGTM is restricted to approvers and reviewers in OWNERS files.

In response to this:

I wasn't able to test this from from the /dev/net/tun point of view this will work. The way the init container is implemented looks a bit like a hack due to the environment variable control. Maybe a separate script would have been more appropriate but this is minor.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[ScheererJ]

/retest

[ialidzhikov]

/unhold
/lgtm
/approve

[gardener-prow]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: DockToFuture, ialidzhikov, marwinski

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [ialidzhikov]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment