feat: expose radsec-agent agent-check port via NodePort service

Adds agentCheck.nodePort to values and the freeradius Service so HAProxy
can reach the agent-check TCP listener from outside the cluster.

Author: mbillow

chart/templates/freeradius-service.yaml

@@ -27,4 +27,10 @@ spec:
       name: status
       nodePort: {{ .Values.freeradius.statusServer.nodePort }}
     {{- end }}
+    {{- if and .Values.freeradius.agentCheck.enabled .Values.freeradius.agentCheck.nodePort }}
+    - port: {{ .Values.freeradius.agentCheck.port }}
+      targetPort: agent-check
+      name: agent-check
+      nodePort: {{ .Values.freeradius.agentCheck.nodePort }}
+    {{- end }}
 {{- end }}

chart/values-dev.yaml

@@ -31,6 +31,8 @@ freeradius:
     enabled: true
     clientCIDR: "0.0.0.0/0"
     nodePort: 31181
+  agentCheck:
+    nodePort: 32084
   securityContext:
     runAsNonRoot: true
     runAsUser: 101

chart/values.yaml

@@ -96,7 +96,8 @@ freeradius:
   # making raw RadSec connections that produce "unknown client" errors.
   agentCheck:
     enabled: true
-    port: 2084  # must match agent-port in the HAProxy backend config
+    port: 2084    # must match agent-port in the HAProxy backend config
+    nodePort: null  # set to expose agent-check port via NodePort (required for HAProxy to reach it)
   securityContext:
     runAsNonRoot: true
     allowPrivilegeEscalation: false