Address review feedback for netbird-proxy chart

- Add certVolume.existingSecret to mount a TLS Secret (cert-manager)
- Fix image repository to netbirdio/reverse-proxy
- Gate ACME HTTP port on http-01 challenge in service, deployment, networkpolicy
- Require proxyToken when existingSecret is not provided
- Allow Role/RoleBinding when serviceAccount.name is set without create
- Treat PDB minAvailable/maxUnavailable 0 as valid and fail on mutual exclusivity
- Omit HPA metrics block when no targets are set
- Document crowdsec.existingSecret requirement when top-level existingSecret is used

charts/netbird-proxy/templates/deployment.yaml

@@ -58,7 +58,7 @@ spec:
             - name: health
               containerPort: {{ include "netbird-proxy.port" .Values.health.address | default 8080 }}
               protocol: TCP
-            {{- if .Values.acme.enabled }}
+            {{- if and .Values.acme.enabled (eq .Values.acme.challengeType "http-01") }}
             - name: acme-http
               containerPort: {{ include "netbird-proxy.port" .Values.acme.address | default 80 }}
               protocol: TCP
@@ -262,6 +262,9 @@ spec:
           {{- else if .Values.certVolume.existingClaim }}
           persistentVolumeClaim:
             claimName: {{ .Values.certVolume.existingClaim }}
+          {{- else if .Values.certVolume.existingSecret }}
+          secret:
+            secretName: {{ .Values.certVolume.existingSecret }}
           {{- else if .Values.certVolume.enabled }}
           persistentVolumeClaim:
             claimName: {{ include "netbird-proxy.fullname" . }}-certs

charts/netbird-proxy/templates/hpa.yaml

@@ -12,6 +12,7 @@ spec:
     name: {{ include "netbird-proxy.fullname" . }}
   minReplicas: {{ .Values.autoscaling.minReplicas }}
   maxReplicas: {{ .Values.autoscaling.maxReplicas }}
+  {{- if or .Values.autoscaling.targetCPUUtilizationPercentage .Values.autoscaling.targetMemoryUtilizationPercentage }}
   metrics:
     {{- if .Values.autoscaling.targetCPUUtilizationPercentage }}
     - type: Resource
@@ -29,4 +30,5 @@ spec:
           type: Utilization
           averageUtilization: {{ .Values.autoscaling.targetMemoryUtilizationPercentage }}
     {{- end }}
+  {{- end }}
 {{- end }}

charts/netbird-proxy/templates/networkpolicy.yaml

@@ -15,7 +15,7 @@ spec:
     - ports:
         - port: https
           protocol: TCP
-        {{- if .Values.acme.enabled }}
+        {{- if and .Values.acme.enabled (eq .Values.acme.challengeType "http-01") }}
         - port: acme-http
           protocol: TCP
         {{- end }}

charts/netbird-proxy/templates/pdb.yaml

@@ -1,4 +1,7 @@
 {{- if .Values.podDisruptionBudget.enabled }}
+{{- if and (not (kindIs "invalid" .Values.podDisruptionBudget.minAvailable)) (not (kindIs "invalid" .Values.podDisruptionBudget.maxUnavailable)) }}
+{{- fail "podDisruptionBudget.minAvailable and podDisruptionBudget.maxUnavailable are mutually exclusive" }}
+{{- end }}
 apiVersion: policy/v1
 kind: PodDisruptionBudget
 metadata:
@@ -9,10 +12,10 @@ spec:
   selector:
     matchLabels:
       {{- include "netbird-proxy.selectorLabels" . | nindent 6 }}
-  {{- if .Values.podDisruptionBudget.minAvailable }}
+  {{- if not (kindIs "invalid" .Values.podDisruptionBudget.minAvailable) }}
   minAvailable: {{ .Values.podDisruptionBudget.minAvailable }}
   {{- end }}
-  {{- if .Values.podDisruptionBudget.maxUnavailable }}
+  {{- if not (kindIs "invalid" .Values.podDisruptionBudget.maxUnavailable) }}
   maxUnavailable: {{ .Values.podDisruptionBudget.maxUnavailable }}
   {{- end }}
 {{- end }}

charts/netbird-proxy/templates/pvc.yaml

@@ -1,4 +1,4 @@
-{{- if and .Values.certVolume.enabled (not .Values.certVolume.existingClaim) (not .Values.certVolume.hostPath) }}
+{{- if and .Values.certVolume.enabled (not .Values.certVolume.existingClaim) (not .Values.certVolume.existingSecret) (not .Values.certVolume.hostPath) }}
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:

charts/netbird-proxy/templates/role.yaml

@@ -1,4 +1,4 @@
-{{- if and .Values.rbac.create .Values.serviceAccount.create (eq .Values.acme.certLockMethod "k8s-lease") }}
+{{- if and .Values.rbac.create (eq .Values.acme.certLockMethod "k8s-lease") (or .Values.serviceAccount.create .Values.serviceAccount.name) }}
 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
 metadata:

charts/netbird-proxy/templates/rolebinding.yaml

@@ -1,4 +1,4 @@
-{{- if and .Values.rbac.create .Values.serviceAccount.create (eq .Values.acme.certLockMethod "k8s-lease") }}
+{{- if and .Values.rbac.create (eq .Values.acme.certLockMethod "k8s-lease") (or .Values.serviceAccount.create .Values.serviceAccount.name) }}
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
 metadata:

charts/netbird-proxy/templates/secret.yaml

@@ -7,7 +7,7 @@ metadata:
     {{- include "netbird-proxy.labels" . | nindent 4 }}
 type: Opaque
 data:
-  token: {{ .Values.proxyToken | b64enc | quote }}
+  token: {{ required "proxyToken must be set when existingSecret is not provided" .Values.proxyToken | b64enc | quote }}
   {{- if and .Values.crowdsec.apiKey (not .Values.crowdsec.existingSecret) }}
   crowdsec-api-key: {{ .Values.crowdsec.apiKey | b64enc | quote }}
   {{- end }}

charts/netbird-proxy/templates/service.yaml

@@ -34,7 +34,7 @@ spec:
       port: {{ .Values.service.port }}
       targetPort: https
       protocol: TCP
-    {{- if .Values.acme.enabled }}
+    {{- if and .Values.acme.enabled (eq .Values.acme.challengeType "http-01") }}
     - name: acme-http
       port: {{ .Values.service.acmePort }}
       targetPort: acme-http

charts/netbird-proxy/values.yaml

@@ -1,7 +1,7 @@
 replicaCount: 1
 
 image:
-  repository: netbird-proxy
+  repository: netbirdio/reverse-proxy
   tag: ""
   pullPolicy: IfNotPresent
 
@@ -58,6 +58,9 @@ crowdsec:
   apiKey: ""
   # -- Use an existing Secret for the CrowdSec bouncer API key.
   # The secret must contain a key named "crowdsec-api-key".
+  # Required when the top-level existingSecret is set, since the chart-managed
+  # Secret holding the proxy token is not rendered in that case and cannot
+  # carry crowdsec-api-key.
   existingSecret: ""
 
 # -- Use host networking. Required for TCP/UDP service passthrough in
@@ -155,8 +158,13 @@ certVolume:
   enabled: true
   # -- Mount an existing PVC instead of creating one.
   existingClaim: ""
+  # -- Mount an existing Secret as the certificate volume (e.g. a TLS Secret
+  # produced by cert-manager). Use with acme.enabled=false: ACME mode writes
+  # to this directory, which is read-only when backed by a Secret. The
+  # Secret keys should match tls.certFile and tls.keyFile.
+  existingSecret: ""
   # -- Use a hostPath volume instead of a PVC.
-  # Takes precedence over enabled and existingClaim.
+  # Takes precedence over enabled, existingClaim, and existingSecret.
   hostPath: ""
   # -- PVC access mode. ReadWriteMany is required for multi-replica ACME
   # (HTTP-01 challenges can arrive on any pod). ReadWriteOnce is fine for