Tutorial: Deploy Access Server on Kubernetes with Helm⁠

1. Connect to the console and get root privileges.

2. Add the repository to your system:

   helm repo add as-helm-chart https://openvpn.github.io/as-helm-chart

3. Verify the Access Server Helm Chart is available:

   helm search repo as-helm-chart

   • Example output:

     # helm search repo as-helm-chart
     NAME                            CHART VERSION   APP VERSION     DESCRIPTION
     as-helm-chart/openvpn-as        0.1.1           latest          A Helm chart for OpenVPN Access Server

You've installed Access Server, and the container is running. You can now sign in to the Admin Web UI, a web-based GUI for managing your VPN server, with or without Linux knowledge.

The Admin Web UI is available at https://EXTERNAL-IP:943/admin.

1. Retrieve the EXTERNAL-IP:

   kubectl get svc

   • Example output:

     # kubectl get svc
     NAME                       TYPE           CLUSTER-IP      EXTERNAL-IP    PORT(S)                                      AGE
     kubernetes                 ClusterIP      10.108.64.1     <none>         443/TCP                                      24h
     my-openvpn-as-openvpn-as   LoadBalancer   10.108.79.160   203.0.113.5   943:31851/TCP,443:31305/TCP,1194:30865/UDP   4m1s

     1. 1

        The EXTERNAL-IP of this Access Server is 203.0.113.5.

The default admin username is openvpn. The temporary password is in the container logs.

1. Get the pod name:

   kubectl get pods

   • Example output:

     # kubectl get pods
     NAME                                        READY   STATUS    RESTARTS   AGE
     my-openvpn-as-openvpn-as-6b474c9757-jmjlc   1/1     Running   0          5m53s

2. Retrieve the logs using the pod name:

   kubectl logs <Pod Name>

   1. 1

      Replace <Pod Name> with your name from the previous command. Example my-openvpn-as-openvpn-as-6b474c9757-jmjlc.

   • The Access Server Initial Configuration Tool output displays.

3. Scroll through the output to find:

   Auto-generated pass = "<password>". Setting in db...

4. Use the password with the openvpn username to sign in.

1. Open a web browser.

2. Navigate to https://EXTERNAL-IP:943/admin.

3. Select through the security warning. Access Server uses a self-signed SSL certificate by default. We recommend replacing it with a signed certificate. See SSL Certificates.

4. Enter openvpn as the username with the temporary password from Step 4.

5. Review and accept the EULA to proceed to the Admin Web UI.

For end-user devices to connect to your VPN server, update the hostname or public IP address in Access Server:

1. Sign in to the Admin Web UI.

2. Select Configuration → Network Settings.

3. Enter the EXTERNAL-IP or your domain name in the Hostname or IP Address field.

4. Select Save Settings and Update Running Server.

When deploying Access Server via Helm Chart in your Kubernetes Cluster, you can run custom scripts to perform custom configuration, such as creating users, configuring rules, installing Web SSL certificates, etc

Here's an example of running sacli commands to create a new user with a password and grant them admin privileges. By following the procedure for our example below, you would push the following Bash Script:

#!/bin/sh
echo "Custom setup"
echo "[INFO] Running default post-start script for OpenVPN Access Server..."
# Waiting for AS service initialization
until /usr/local/openvpn_as/scripts/sacli status 2>/dev/null |grep -q '"api": "on"'
do
    sleep 2
done
sacli --user "admin" --key "type" --value "user_connect" UserPropPut
sacli --user "admin" --new_pass "secure123" SetLocalPassword
sacli --user "admin" --key "prop_superuser" --value "true" UserPropPut
sacli start

1. Add the Helm Chart Repository to your system:

   helm repo add as-helm-chart https://openvpn.github.io/as-helm-chart

2. Go to the ArtifactHub where the Access Server Helm Chart is allocated and click on the DEFAULT VALUES option on the right panel.

3. Copy the content of the values.yaml file.

4. Create a new file (example: my-values.yaml) where you'll be deploying your Access Server Helm Chart:

   nano my-values.yaml

5. Paste the copied contents from the values.yaml file.

6. Edit your new file and the postStart script section from this:

   postStart:
     enabled: false
   
     # Optional: inline override
     customScript: ""

   To this:

   postStart:
     enabled: true
   
     # Optional: inline override
     customScript: |
       #!/bin/sh
       echo "Custom setup"
       echo "[INFO] Running default post-start script for OpenVPN Access Server..."
       # Waiting for AS service initialization
       until /usr/local/openvpn_as/scripts/sacli status 2>/dev/null |grep -q '"api": "on"'
       do
           sleep 2
       done
       sacli --user "admin" --key "type" --value "user_connect" UserPropPut
       sacli --user "admin" --new_pass "secure123" SetLocalPassword
       sacli --user "admin" --key "prop_superuser" --value "true" UserPropPut
       sacli start

7. Save and exit (Ctrl+x, then y).

8. Install the Access Server Helm Chart with your new custom file. (Example: my-values.yaml.)

   helm install my-openvpn-as as-helm-chart/openvpn-as -f my-values.yaml

   • Access Server will be successfully deployed with the custom commands pushed by the Bash script.

9. Verify that Access Server was installed correctly by identifying the pod name:

   helm status my-openvpn-as --show-resources

   • Example output:

     # helm status my-openvpn-as --show-resources
     NAME: my-openvpn-as
     LAST DEPLOYED: Wed Sep  3 17:06:26 2025
     NAMESPACE: default
     STATUS: deployed
     REVISION: 1
     RESOURCES:
     ==> v1/Secret
     NAME                                 TYPE     DATA   AGE
     my-openvpn-as-openvpn-as-poststart   Opaque   1      2d23h
     
     ==> v1/PersistentVolumeClaim
     NAME                           STATUS   VOLUME                                     CAPACITY   ACCESS MODES   STORAGECLASS       VOLUMEATTRIBUTESCLASS   AGE
     my-openvpn-as-openvpn-as-pvc   Bound    pvc-256c79ba-97e9-474b-8b7c-8008187bb2fb   5Gi        RWO            do-block-storage   <unset>                 2d23h
     
     ==> v1/Service
     NAME                       TYPE           CLUSTER-IP      EXTERNAL-IP       PORT(S)                                      AGE
     my-openvpn-as-openvpn-as   LoadBalancer   10.108.92.231   203.0.113.5   943:30479/TCP,443:31010/TCP,1194:31020/UDP   2d23h
     
     ==> v1/Deployment
     NAME                       READY   UP-TO-DATE   AVAILABLE   AGE
     my-openvpn-as-openvpn-as   1/1     1            1           2d23h
     
     ==> v1/Pod(related)
     NAME                                        READY   STATUS    RESTARTS   AGE
     my-openvpn-as-openvpn-as-6b474c9757-jmjlc   1/1     Running   0          2d23h

10. And using the Pod Name and the sacli tool to check Access Server:

    kubectl exec -it <Pod Name> -- /bin/bash sacli UserPropGet

    1. 1

       Replace <Pod Name> with your pod name. From our example: my-openvpn-as-openvpn-as-6b474c9757-jmjlc.

    • Example output:

      # kubectl exec -it my-openvpn-as-openvpn-as-6b474c9757-jmjlc -- /bin/bash sacli UserPropGet
      {
        "__DEFAULT__": {
          "prop_autogenerate": "true",
          "type": "user_default"
        },
        "admin": {
          "prop_superuser": "true",
          "pvt_password_digest": "$P$zIggWugxu9qv/LZid+np+Q==$0+RZiz4UK6y4c1+A3aG8gBBS08sFAmX3x23U+vxqP1c=",
          "type": "user_compile"
        },
        "openvpn": {
          "prop_superuser": "true",
          "pvt_password_digest": "$P$zYL2GZ3tRzUDw0/rWj6EPA==$QNQmZLQqkR0T1o4drQVkCGLDopr4tY0TIerl2yMmRo0=",
          "type": "user_compile",
          "user_auth_type": "local"
        }
      }

• Run the command below to uninstall the Access Server Helm Chart:

  helm delete my-openvpn-as

• Run the command below to remove the Access Server Helm Chart completely:

  helm repo remove as-helm-chart

The following are known issues or limitations if you deploy Access Server from a Docker image:

• Failover mode: This feature isn't supported.

• Layer 2 (bridging): This mode isn't supported.

• Fixed license keys: This license key model isn't supported. Using fixed keys can cause license invalidation because the hardware specification fingerprint isn't persistent.

• DCO: DCO support depends on the Linux kernel version running on your Docker host:

  • Linux kernel 6.16 or newer: The latest Access Server Docker image ships with Access Server 3.2.2, which includes DCO support built into the kernel. No additional installation is needed on the Docker host as Access Server uses DCO automatically.

  • Linux kernel older than 6.16: To use DCO, you need to install it manually on the Docker host before running the container. See Step 1: Install DCO for instructions.

• Clustering: You can use Access Servers, deployed from Docker images, to build cluster functionality with the following limitations:

  • You can only run one cluster node per Host system at a time.

  • Hosts must be available directly from the internet, not via a load balancer, proxy, or ingress controller.

• Performance: The additional abstraction layer can cause performance degradation and increase latency. We don't recommend deploying highly loaded installations using Docker.

• PAM authentication method: We recommend avoiding PAM as your authentication method because user credentials stored inside the container aren't persistent.

• Logs: Access Server forwards logs to Docker, so it can't handle logging in the Access Server configuration. See the Docker logging documentation to set up rotation, forwarding, etc.

• IPv6: We don't recommend Access Server inside a Docker container if you plan to use IPv6 for VPN clients because IPv6 support in the Docker network toolset is limited/experimental.

Submit a support ticket if you need assistance.

• Check pod status:

  kubectl get pods

• If a pod fails to start:

  kubectl describe pod <Pod Name>
  kubectl logs <Pod Name>

  This displays events, errors, and useful debugging information.