Please do check:
https://unfix.org/projects/chromeos-openvpn-onc/
which is a WebUI thingy I wrote to solve exactly that problem.
[disclaimer: "advertising" tool I wrote]
Neat tool, and glad it's here for others to see. It doesn't look like it matches the specific kind of ovpn setup I'm using (for example, I don't have a client key/cert).
When I last looked at the situation, I couldn't find an ONC equivalent for some of the options in the .ovpn file. It might be the docs or even functionality have gotten better. (I remember looking at some PDF, for example, and now there's https://chromium.googlesource.com/chromium/src/+/master/comp...) It's also possible I just missed something last time. Either way I should take another look.
What about non-OpenVPN? Any good option that works well with Chromebook?
Pulse Secure, Cisco, F5, Palo Alto and SonicWALL provide VPN clients for Chrome OS. The Cisco AnyConnect client will also work with the open source openconnect vpn server although doing so is a violation of the client's license. L2TP/IPsec VPNs are supported out of the box.
As there is a Linux kernel underneath, basically anything could in theory work; but non-standard options require 'developer mode' operation which kinda destroys the security model of ChromeOS.
Android apps (on some models of the laptops) might work though.
Having support for Wireguard would be pretty neat, but afaik not possible yet.
OpenVPN works quite fine for my use cases up to now.
If you leave the GUI, you can also run openvpn yourself on a good old .ovpn file, but you lose some of the nice security properties you get with the default Chrome OS setup, you have to do cros-specific hacks to make it work (https://github.com/dnschneid/crouton/issues/2215#issuecommen... plus switching back and forth between VPN and non-VPN DNS by hand), and last I checked it made ARC (Play Store) apps' networking stop working.
I would consider paying a premium just to get my Chromebook connecting to work's VPN smoothly, though of course I'd love it if improved VPN functionality were available to everyone by default.
At some point I'm probably also going to take a second look at the latest ONC docs. It looks like they've improved since I first looked at VPN setup a while back.