From 067781a2bd09bb509eb9ee4180ec67756c12b38c Mon Sep 17 00:00:00 2001 From: Viktor Liu Date: Sun, 17 May 2026 14:58:18 +0200 Subject: [PATCH] Address review feedback for netbird-proxy chart - Add certVolume.existingSecret to mount a TLS Secret (cert-manager) - Fix image repository to netbirdio/reverse-proxy - Gate ACME HTTP port on http-01 challenge in service, deployment, networkpolicy - Require proxyToken when existingSecret is not provided - Allow Role/RoleBinding when serviceAccount.name is set without create - Treat PDB minAvailable/maxUnavailable 0 as valid and fail on mutual exclusivity - Omit HPA metrics block when no targets are set - Document crowdsec.existingSecret requirement when top-level existingSecret is used --- charts/netbird-proxy/templates/deployment.yaml | 5 ++++- charts/netbird-proxy/templates/hpa.yaml | 2 ++ charts/netbird-proxy/templates/networkpolicy.yaml | 2 +- charts/netbird-proxy/templates/pdb.yaml | 7 +++++-- charts/netbird-proxy/templates/pvc.yaml | 2 +- charts/netbird-proxy/templates/role.yaml | 2 +- charts/netbird-proxy/templates/rolebinding.yaml | 2 +- charts/netbird-proxy/templates/secret.yaml | 2 +- charts/netbird-proxy/templates/service.yaml | 2 +- charts/netbird-proxy/values.yaml | 12 ++++++++++-- 10 files changed, 27 insertions(+), 11 deletions(-) diff --git a/charts/netbird-proxy/templates/deployment.yaml b/charts/netbird-proxy/templates/deployment.yaml index 278d1b7..000e87a 100644 --- a/charts/netbird-proxy/templates/deployment.yaml +++ b/charts/netbird-proxy/templates/deployment.yaml @@ -58,7 +58,7 @@ spec: - name: health containerPort: {{ include "netbird-proxy.port" .Values.health.address | default 8080 }} protocol: TCP - {{- if .Values.acme.enabled }} + {{- if and .Values.acme.enabled (eq .Values.acme.challengeType "http-01") }} - name: acme-http containerPort: {{ include "netbird-proxy.port" .Values.acme.address | default 80 }} protocol: TCP @@ -262,6 +262,9 @@ spec: {{- else if .Values.certVolume.existingClaim }} persistentVolumeClaim: claimName: {{ .Values.certVolume.existingClaim }} + {{- else if .Values.certVolume.existingSecret }} + secret: + secretName: {{ .Values.certVolume.existingSecret }} {{- else if .Values.certVolume.enabled }} persistentVolumeClaim: claimName: {{ include "netbird-proxy.fullname" . }}-certs diff --git a/charts/netbird-proxy/templates/hpa.yaml b/charts/netbird-proxy/templates/hpa.yaml index 6e2b5c1..45c4011 100644 --- a/charts/netbird-proxy/templates/hpa.yaml +++ b/charts/netbird-proxy/templates/hpa.yaml @@ -12,6 +12,7 @@ spec: name: {{ include "netbird-proxy.fullname" . }} minReplicas: {{ .Values.autoscaling.minReplicas }} maxReplicas: {{ .Values.autoscaling.maxReplicas }} + {{- if or .Values.autoscaling.targetCPUUtilizationPercentage .Values.autoscaling.targetMemoryUtilizationPercentage }} metrics: {{- if .Values.autoscaling.targetCPUUtilizationPercentage }} - type: Resource @@ -29,4 +30,5 @@ spec: type: Utilization averageUtilization: {{ .Values.autoscaling.targetMemoryUtilizationPercentage }} {{- end }} + {{- end }} {{- end }} diff --git a/charts/netbird-proxy/templates/networkpolicy.yaml b/charts/netbird-proxy/templates/networkpolicy.yaml index e51482b..9e6344f 100644 --- a/charts/netbird-proxy/templates/networkpolicy.yaml +++ b/charts/netbird-proxy/templates/networkpolicy.yaml @@ -15,7 +15,7 @@ spec: - ports: - port: https protocol: TCP - {{- if .Values.acme.enabled }} + {{- if and .Values.acme.enabled (eq .Values.acme.challengeType "http-01") }} - port: acme-http protocol: TCP {{- end }} diff --git a/charts/netbird-proxy/templates/pdb.yaml b/charts/netbird-proxy/templates/pdb.yaml index b6bf4af..e62463b 100644 --- a/charts/netbird-proxy/templates/pdb.yaml +++ b/charts/netbird-proxy/templates/pdb.yaml @@ -1,4 +1,7 @@ {{- if .Values.podDisruptionBudget.enabled }} +{{- if and (not (kindIs "invalid" .Values.podDisruptionBudget.minAvailable)) (not (kindIs "invalid" .Values.podDisruptionBudget.maxUnavailable)) }} +{{- fail "podDisruptionBudget.minAvailable and podDisruptionBudget.maxUnavailable are mutually exclusive" }} +{{- end }} apiVersion: policy/v1 kind: PodDisruptionBudget metadata: @@ -9,10 +12,10 @@ spec: selector: matchLabels: {{- include "netbird-proxy.selectorLabels" . | nindent 6 }} - {{- if .Values.podDisruptionBudget.minAvailable }} + {{- if not (kindIs "invalid" .Values.podDisruptionBudget.minAvailable) }} minAvailable: {{ .Values.podDisruptionBudget.minAvailable }} {{- end }} - {{- if .Values.podDisruptionBudget.maxUnavailable }} + {{- if not (kindIs "invalid" .Values.podDisruptionBudget.maxUnavailable) }} maxUnavailable: {{ .Values.podDisruptionBudget.maxUnavailable }} {{- end }} {{- end }} diff --git a/charts/netbird-proxy/templates/pvc.yaml b/charts/netbird-proxy/templates/pvc.yaml index 78d9b3d..767a45d 100644 --- a/charts/netbird-proxy/templates/pvc.yaml +++ b/charts/netbird-proxy/templates/pvc.yaml @@ -1,4 +1,4 @@ -{{- if and .Values.certVolume.enabled (not .Values.certVolume.existingClaim) (not .Values.certVolume.hostPath) }} +{{- if and .Values.certVolume.enabled (not .Values.certVolume.existingClaim) (not .Values.certVolume.existingSecret) (not .Values.certVolume.hostPath) }} apiVersion: v1 kind: PersistentVolumeClaim metadata: diff --git a/charts/netbird-proxy/templates/role.yaml b/charts/netbird-proxy/templates/role.yaml index abf054c..facf949 100644 --- a/charts/netbird-proxy/templates/role.yaml +++ b/charts/netbird-proxy/templates/role.yaml @@ -1,4 +1,4 @@ -{{- if and .Values.rbac.create .Values.serviceAccount.create (eq .Values.acme.certLockMethod "k8s-lease") }} +{{- if and .Values.rbac.create (eq .Values.acme.certLockMethod "k8s-lease") (or .Values.serviceAccount.create .Values.serviceAccount.name) }} apiVersion: rbac.authorization.k8s.io/v1 kind: Role metadata: diff --git a/charts/netbird-proxy/templates/rolebinding.yaml b/charts/netbird-proxy/templates/rolebinding.yaml index b42127b..85073a5 100644 --- a/charts/netbird-proxy/templates/rolebinding.yaml +++ b/charts/netbird-proxy/templates/rolebinding.yaml @@ -1,4 +1,4 @@ -{{- if and .Values.rbac.create .Values.serviceAccount.create (eq .Values.acme.certLockMethod "k8s-lease") }} +{{- if and .Values.rbac.create (eq .Values.acme.certLockMethod "k8s-lease") (or .Values.serviceAccount.create .Values.serviceAccount.name) }} apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: diff --git a/charts/netbird-proxy/templates/secret.yaml b/charts/netbird-proxy/templates/secret.yaml index 63ea729..4d8491d 100644 --- a/charts/netbird-proxy/templates/secret.yaml +++ b/charts/netbird-proxy/templates/secret.yaml @@ -7,7 +7,7 @@ metadata: {{- include "netbird-proxy.labels" . | nindent 4 }} type: Opaque data: - token: {{ .Values.proxyToken | b64enc | quote }} + token: {{ required "proxyToken must be set when existingSecret is not provided" .Values.proxyToken | b64enc | quote }} {{- if and .Values.crowdsec.apiKey (not .Values.crowdsec.existingSecret) }} crowdsec-api-key: {{ .Values.crowdsec.apiKey | b64enc | quote }} {{- end }} diff --git a/charts/netbird-proxy/templates/service.yaml b/charts/netbird-proxy/templates/service.yaml index dc40708..60c560c 100644 --- a/charts/netbird-proxy/templates/service.yaml +++ b/charts/netbird-proxy/templates/service.yaml @@ -34,7 +34,7 @@ spec: port: {{ .Values.service.port }} targetPort: https protocol: TCP - {{- if .Values.acme.enabled }} + {{- if and .Values.acme.enabled (eq .Values.acme.challengeType "http-01") }} - name: acme-http port: {{ .Values.service.acmePort }} targetPort: acme-http diff --git a/charts/netbird-proxy/values.yaml b/charts/netbird-proxy/values.yaml index 027ea08..c5639de 100644 --- a/charts/netbird-proxy/values.yaml +++ b/charts/netbird-proxy/values.yaml @@ -1,7 +1,7 @@ replicaCount: 1 image: - repository: netbird-proxy + repository: netbirdio/reverse-proxy tag: "" pullPolicy: IfNotPresent @@ -58,6 +58,9 @@ crowdsec: apiKey: "" # -- Use an existing Secret for the CrowdSec bouncer API key. # The secret must contain a key named "crowdsec-api-key". + # Required when the top-level existingSecret is set, since the chart-managed + # Secret holding the proxy token is not rendered in that case and cannot + # carry crowdsec-api-key. existingSecret: "" # -- Use host networking. Required for TCP/UDP service passthrough in @@ -155,8 +158,13 @@ certVolume: enabled: true # -- Mount an existing PVC instead of creating one. existingClaim: "" + # -- Mount an existing Secret as the certificate volume (e.g. a TLS Secret + # produced by cert-manager). Use with acme.enabled=false: ACME mode writes + # to this directory, which is read-only when backed by a Secret. The + # Secret keys should match tls.certFile and tls.keyFile. + existingSecret: "" # -- Use a hostPath volume instead of a PVC. - # Takes precedence over enabled and existingClaim. + # Takes precedence over enabled, existingClaim, and existingSecret. hostPath: "" # -- PVC access mode. ReadWriteMany is required for multi-replica ACME # (HTTP-01 challenges can arrive on any pod). ReadWriteOnce is fine for