mirror of
https://github.com/netbirdio/helms.git
synced 2026-05-22 17:13:06 -07:00
Add reverse proxy helm chart
This commit is contained in:
Viktor Liu
@@ -0,0 +1,6 @@
|
||||
apiVersion: v2
|
||||
name: netbird-proxy
|
||||
description: NetBird reverse proxy with ACME certificate management
|
||||
type: application
|
||||
version: 0.1.0
|
||||
appVersion: "0.1.0"
|
||||
@@ -0,0 +1,32 @@
|
||||
NetBird Proxy has been deployed.
|
||||
|
||||
{{- if eq .Values.service.type "LoadBalancer" }}
|
||||
|
||||
The proxy is exposed via a LoadBalancer service.
|
||||
It may take a few minutes for the external IP to be provisioned.
|
||||
|
||||
kubectl get svc {{ include "netbird-proxy.fullname" . }} -n {{ .Release.Namespace }} -w
|
||||
|
||||
{{- else if eq .Values.service.type "NodePort" }}
|
||||
|
||||
The proxy is exposed via NodePort.
|
||||
|
||||
export NODE_PORT=$(kubectl get svc {{ include "netbird-proxy.fullname" . }} -n {{ .Release.Namespace }} -o jsonpath='{.spec.ports[?(@.name=="https")].nodePort}')
|
||||
export NODE_IP=$(kubectl get nodes -o jsonpath='{.items[0].status.addresses[?(@.type=="ExternalIP")].address}')
|
||||
echo "https://${NODE_IP}:${NODE_PORT}"
|
||||
|
||||
{{- else }}
|
||||
|
||||
The proxy is using a ClusterIP service. To access it from outside the cluster,
|
||||
configure an Ingress resource or use port-forwarding:
|
||||
|
||||
kubectl port-forward svc/{{ include "netbird-proxy.fullname" . }} {{ .Values.service.port }}:{{ .Values.service.port }} -n {{ .Release.Namespace }}
|
||||
|
||||
{{- end }}
|
||||
|
||||
{{- if .Values.acme.enabled }}
|
||||
|
||||
ACME certificate management is enabled ({{ .Values.acme.directory }}).
|
||||
Certificates are stored in {{ .Values.certDir }}.
|
||||
Lock method: {{ .Values.acme.certLockMethod }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,92 @@
|
||||
{{/*
|
||||
Expand the name of the chart.
|
||||
*/}}
|
||||
{{- define "netbird-proxy.name" -}}
|
||||
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Create a default fully qualified app name.
|
||||
*/}}
|
||||
{{- define "netbird-proxy.fullname" -}}
|
||||
{{- if .Values.fullnameOverride }}
|
||||
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
|
||||
{{- else }}
|
||||
{{- $name := default .Chart.Name .Values.nameOverride }}
|
||||
{{- if contains $name .Release.Name }}
|
||||
{{- .Release.Name | trunc 63 | trimSuffix "-" }}
|
||||
{{- else }}
|
||||
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Create chart name and version as used by the chart label.
|
||||
*/}}
|
||||
{{- define "netbird-proxy.chart" -}}
|
||||
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Common labels.
|
||||
*/}}
|
||||
{{- define "netbird-proxy.labels" -}}
|
||||
helm.sh/chart: {{ include "netbird-proxy.chart" . }}
|
||||
{{ include "netbird-proxy.selectorLabels" . }}
|
||||
app.kubernetes.io/component: proxy
|
||||
{{- if .Chart.AppVersion }}
|
||||
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
|
||||
{{- end }}
|
||||
app.kubernetes.io/managed-by: {{ .Release.Service }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Selector labels.
|
||||
*/}}
|
||||
{{- define "netbird-proxy.selectorLabels" -}}
|
||||
app: {{ include "netbird-proxy.fullname" . }}
|
||||
app.kubernetes.io/name: {{ include "netbird-proxy.name" . }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Create the name of the service account to use.
|
||||
*/}}
|
||||
{{- define "netbird-proxy.serviceAccountName" -}}
|
||||
{{- if .Values.serviceAccount.create }}
|
||||
{{- default (include "netbird-proxy.fullname" .) .Values.serviceAccount.name }}
|
||||
{{- else }}
|
||||
{{- default "default" .Values.serviceAccount.name }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Name of the Secret containing the proxy token.
|
||||
*/}}
|
||||
{{- define "netbird-proxy.secretName" -}}
|
||||
{{- if .Values.existingSecret }}
|
||||
{{- .Values.existingSecret }}
|
||||
{{- else }}
|
||||
{{- include "netbird-proxy.fullname" . }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Extract the port number from an address string.
|
||||
Handles ":8443", "0.0.0.0:8443", and "[::1]:8443".
|
||||
*/}}
|
||||
{{- define "netbird-proxy.port" -}}
|
||||
{{- mustRegexFind "[0-9]+$" . -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Name of the Secret containing the OIDC client secret.
|
||||
*/}}
|
||||
{{- define "netbird-proxy.oidcSecretName" -}}
|
||||
{{- if .Values.oidc.existingOidcSecret }}
|
||||
{{- .Values.oidc.existingOidcSecret }}
|
||||
{{- else }}
|
||||
{{- printf "%s-oidc" (include "netbird-proxy.fullname" .) }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,227 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: {{ include "netbird-proxy.fullname" . }}
|
||||
labels:
|
||||
{{- include "netbird-proxy.labels" . | nindent 4 }}
|
||||
spec:
|
||||
{{- if not .Values.autoscaling.enabled }}
|
||||
replicas: {{ .Values.replicaCount }}
|
||||
{{- end }}
|
||||
selector:
|
||||
matchLabels:
|
||||
{{- include "netbird-proxy.selectorLabels" . | nindent 6 }}
|
||||
template:
|
||||
metadata:
|
||||
annotations:
|
||||
checksum/secret: {{ include (print $.Template.BasePath "/secret.yaml") . | sha256sum }}
|
||||
{{- with .Values.podAnnotations }}
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
labels:
|
||||
{{- include "netbird-proxy.selectorLabels" . | nindent 8 }}
|
||||
{{- with .Values.podLabels }}
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
# Shutdown budget: 5s pre-stop LB drain + 30s HTTPS drain + 5s service stop + 30s client stop + 5s buffer
|
||||
terminationGracePeriodSeconds: 75
|
||||
{{- with .Values.imagePullSecrets }}
|
||||
imagePullSecrets:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
serviceAccountName: {{ include "netbird-proxy.serviceAccountName" . }}
|
||||
{{- with .Values.hostAliases }}
|
||||
hostAliases:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
securityContext:
|
||||
{{- toYaml .Values.podSecurityContext | nindent 8 }}
|
||||
{{- with .Values.initContainers }}
|
||||
initContainers:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
containers:
|
||||
- name: proxy
|
||||
securityContext:
|
||||
{{- toYaml .Values.securityContext | nindent 12 }}
|
||||
image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
|
||||
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
||||
ports:
|
||||
- name: https
|
||||
containerPort: {{ include "netbird-proxy.port" .Values.proxy.address | default 8443 }}
|
||||
protocol: TCP
|
||||
- name: health
|
||||
containerPort: {{ include "netbird-proxy.port" .Values.health.address | default 8080 }}
|
||||
protocol: TCP
|
||||
{{- if .Values.acme.enabled }}
|
||||
- name: acme-http
|
||||
containerPort: {{ include "netbird-proxy.port" .Values.acme.address | default 80 }}
|
||||
protocol: TCP
|
||||
{{- end }}
|
||||
{{- if .Values.debug.enabled }}
|
||||
- name: debug
|
||||
containerPort: {{ include "netbird-proxy.port" .Values.debug.address | default 8444 }}
|
||||
protocol: TCP
|
||||
{{- end }}
|
||||
env:
|
||||
- name: USER
|
||||
value: "netbird"
|
||||
- name: HOME
|
||||
value: "/tmp"
|
||||
- name: NB_PROXY_ADDRESS
|
||||
value: {{ .Values.proxy.address | quote }}
|
||||
- name: NB_PROXY_MANAGEMENT_ADDRESS
|
||||
value: {{ .Values.managementAddress | quote }}
|
||||
- name: NB_PROXY_HEALTH_ADDRESS
|
||||
value: {{ .Values.health.address | quote }}
|
||||
- name: NB_PROXY_CERTIFICATE_DIRECTORY
|
||||
value: {{ .Values.certDir | quote }}
|
||||
- name: NB_PROXY_TOKEN
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ include "netbird-proxy.secretName" . }}
|
||||
key: token
|
||||
{{- if .Values.allowInsecure }}
|
||||
- name: NB_PROXY_ALLOW_INSECURE
|
||||
value: "true"
|
||||
{{- end }}
|
||||
{{- if .Values.logging.debug }}
|
||||
- name: NB_PROXY_DEBUG_LOGS
|
||||
value: "true"
|
||||
{{- end }}
|
||||
{{- if .Values.proxy.url }}
|
||||
- name: NB_PROXY_URL
|
||||
value: {{ .Values.proxy.url | quote }}
|
||||
{{- end }}
|
||||
{{- if and .Values.proxy.forwardedProto (ne .Values.proxy.forwardedProto "auto") }}
|
||||
- name: NB_PROXY_FORWARDED_PROTO
|
||||
value: {{ .Values.proxy.forwardedProto | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.proxy.trustedProxies }}
|
||||
- name: NB_PROXY_TRUSTED_PROXIES
|
||||
value: {{ .Values.proxy.trustedProxies | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.acme.enabled }}
|
||||
- name: NB_PROXY_ACME_CERTIFICATES
|
||||
value: "true"
|
||||
- name: NB_PROXY_ACME_ADDRESS
|
||||
value: {{ .Values.acme.address | quote }}
|
||||
- name: NB_PROXY_ACME_DIRECTORY
|
||||
value: {{ .Values.acme.directory | quote }}
|
||||
- name: NB_PROXY_CERT_LOCK_METHOD
|
||||
value: {{ .Values.acme.certLockMethod | quote }}
|
||||
{{- else }}
|
||||
- name: NB_PROXY_CERTIFICATE_FILE
|
||||
value: {{ .Values.tls.certFile | quote }}
|
||||
- name: NB_PROXY_CERTIFICATE_KEY_FILE
|
||||
value: {{ .Values.tls.keyFile | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.oidc.clientId }}
|
||||
- name: NB_PROXY_OIDC_CLIENT_ID
|
||||
value: {{ .Values.oidc.clientId | quote }}
|
||||
{{- end }}
|
||||
{{- if or .Values.oidc.clientSecret .Values.oidc.existingOidcSecret }}
|
||||
- name: NB_PROXY_OIDC_CLIENT_SECRET
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ include "netbird-proxy.oidcSecretName" . }}
|
||||
key: oidc-client-secret
|
||||
{{- end }}
|
||||
{{- if .Values.oidc.endpoint }}
|
||||
- name: NB_PROXY_OIDC_ENDPOINT
|
||||
value: {{ .Values.oidc.endpoint | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.oidc.scopes }}
|
||||
- name: NB_PROXY_OIDC_SCOPES
|
||||
value: {{ .Values.oidc.scopes | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.debug.enabled }}
|
||||
- name: NB_PROXY_DEBUG_ENDPOINT
|
||||
value: "true"
|
||||
- name: NB_PROXY_DEBUG_ENDPOINT_ADDRESS
|
||||
value: {{ .Values.debug.address | quote }}
|
||||
{{- end }}
|
||||
{{- with .Values.extraEnv }}
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
volumeMounts:
|
||||
- name: certs
|
||||
mountPath: {{ .Values.certDir }}
|
||||
- name: tmp
|
||||
mountPath: /tmp
|
||||
{{- with .Values.extraVolumeMounts }}
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /healthz/live
|
||||
port: health
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 5
|
||||
failureThreshold: 3
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /healthz/ready
|
||||
port: health
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 5
|
||||
failureThreshold: 3
|
||||
startupProbe:
|
||||
httpGet:
|
||||
path: /healthz/startup
|
||||
port: health
|
||||
periodSeconds: 2
|
||||
timeoutSeconds: 10
|
||||
# 60 * 2s = 120s for ACME certs + management sync + client startup
|
||||
failureThreshold: 60
|
||||
resources:
|
||||
{{- toYaml .Values.resources | nindent 12 }}
|
||||
volumes:
|
||||
- name: certs
|
||||
{{- if .Values.certVolume.hostPath }}
|
||||
hostPath:
|
||||
path: {{ .Values.certVolume.hostPath }}
|
||||
type: DirectoryOrCreate
|
||||
{{- else if .Values.certVolume.existingClaim }}
|
||||
persistentVolumeClaim:
|
||||
claimName: {{ .Values.certVolume.existingClaim }}
|
||||
{{- else if .Values.certVolume.enabled }}
|
||||
persistentVolumeClaim:
|
||||
claimName: {{ include "netbird-proxy.fullname" . }}-certs
|
||||
{{- else }}
|
||||
emptyDir: {}
|
||||
{{- end }}
|
||||
- name: tmp
|
||||
emptyDir: {}
|
||||
{{- with .Values.extraVolumes }}
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if not .Values.affinity }}
|
||||
affinity:
|
||||
podAntiAffinity:
|
||||
preferredDuringSchedulingIgnoredDuringExecution:
|
||||
- weight: 100
|
||||
podAffinityTerm:
|
||||
labelSelector:
|
||||
matchLabels:
|
||||
{{- include "netbird-proxy.selectorLabels" . | nindent 20 }}
|
||||
topologyKey: kubernetes.io/hostname
|
||||
{{- else }}
|
||||
affinity:
|
||||
{{- toYaml .Values.affinity | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.topologySpreadConstraints }}
|
||||
topologySpreadConstraints:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.nodeSelector }}
|
||||
nodeSelector:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.tolerations }}
|
||||
tolerations:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,32 @@
|
||||
{{- if .Values.autoscaling.enabled }}
|
||||
apiVersion: autoscaling/v2
|
||||
kind: HorizontalPodAutoscaler
|
||||
metadata:
|
||||
name: {{ include "netbird-proxy.fullname" . }}
|
||||
labels:
|
||||
{{- include "netbird-proxy.labels" . | nindent 4 }}
|
||||
spec:
|
||||
scaleTargetRef:
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
name: {{ include "netbird-proxy.fullname" . }}
|
||||
minReplicas: {{ .Values.autoscaling.minReplicas }}
|
||||
maxReplicas: {{ .Values.autoscaling.maxReplicas }}
|
||||
metrics:
|
||||
{{- if .Values.autoscaling.targetCPUUtilizationPercentage }}
|
||||
- type: Resource
|
||||
resource:
|
||||
name: cpu
|
||||
target:
|
||||
type: Utilization
|
||||
averageUtilization: {{ .Values.autoscaling.targetCPUUtilizationPercentage }}
|
||||
{{- end }}
|
||||
{{- if .Values.autoscaling.targetMemoryUtilizationPercentage }}
|
||||
- type: Resource
|
||||
resource:
|
||||
name: memory
|
||||
target:
|
||||
type: Utilization
|
||||
averageUtilization: {{ .Values.autoscaling.targetMemoryUtilizationPercentage }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,31 @@
|
||||
{{- if .Values.networkPolicy.enabled }}
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: NetworkPolicy
|
||||
metadata:
|
||||
name: {{ include "netbird-proxy.fullname" . }}
|
||||
labels:
|
||||
{{- include "netbird-proxy.labels" . | nindent 4 }}
|
||||
spec:
|
||||
podSelector:
|
||||
matchLabels:
|
||||
{{- include "netbird-proxy.selectorLabels" . | nindent 6 }}
|
||||
policyTypes:
|
||||
- Ingress
|
||||
ingress:
|
||||
- ports:
|
||||
- port: https
|
||||
protocol: TCP
|
||||
{{- if .Values.acme.enabled }}
|
||||
- port: acme-http
|
||||
protocol: TCP
|
||||
{{- end }}
|
||||
- port: health
|
||||
protocol: TCP
|
||||
{{- if .Values.debug.enabled }}
|
||||
- port: debug
|
||||
protocol: TCP
|
||||
{{- end }}
|
||||
{{- with .Values.networkPolicy.additionalIngress }}
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,18 @@
|
||||
{{- if .Values.podDisruptionBudget.enabled }}
|
||||
apiVersion: policy/v1
|
||||
kind: PodDisruptionBudget
|
||||
metadata:
|
||||
name: {{ include "netbird-proxy.fullname" . }}
|
||||
labels:
|
||||
{{- include "netbird-proxy.labels" . | nindent 4 }}
|
||||
spec:
|
||||
selector:
|
||||
matchLabels:
|
||||
{{- include "netbird-proxy.selectorLabels" . | nindent 6 }}
|
||||
{{- if .Values.podDisruptionBudget.minAvailable }}
|
||||
minAvailable: {{ .Values.podDisruptionBudget.minAvailable }}
|
||||
{{- end }}
|
||||
{{- if .Values.podDisruptionBudget.maxUnavailable }}
|
||||
maxUnavailable: {{ .Values.podDisruptionBudget.maxUnavailable }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,17 @@
|
||||
{{- if and .Values.certVolume.enabled (not .Values.certVolume.existingClaim) (not .Values.certVolume.hostPath) }}
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: {{ include "netbird-proxy.fullname" . }}-certs
|
||||
labels:
|
||||
{{- include "netbird-proxy.labels" . | nindent 4 }}
|
||||
spec:
|
||||
accessModes:
|
||||
- {{ .Values.certVolume.accessMode | default "ReadWriteMany" }}
|
||||
{{- if .Values.certVolume.storageClass }}
|
||||
storageClassName: {{ .Values.certVolume.storageClass }}
|
||||
{{- end }}
|
||||
resources:
|
||||
requests:
|
||||
storage: {{ .Values.certVolume.size | default "256Mi" }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,12 @@
|
||||
{{- if and .Values.rbac.create .Values.serviceAccount.create (eq .Values.acme.certLockMethod "k8s-lease") }}
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: {{ include "netbird-proxy.fullname" . }}
|
||||
labels:
|
||||
{{- include "netbird-proxy.labels" . | nindent 4 }}
|
||||
rules:
|
||||
- apiGroups: ["coordination.k8s.io"]
|
||||
resources: ["leases"]
|
||||
verbs: ["get", "create", "update"]
|
||||
{{- end }}
|
||||
@@ -0,0 +1,16 @@
|
||||
{{- if and .Values.rbac.create .Values.serviceAccount.create (eq .Values.acme.certLockMethod "k8s-lease") }}
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: {{ include "netbird-proxy.fullname" . }}
|
||||
labels:
|
||||
{{- include "netbird-proxy.labels" . | nindent 4 }}
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ include "netbird-proxy.serviceAccountName" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
roleRef:
|
||||
kind: Role
|
||||
name: {{ include "netbird-proxy.fullname" . }}
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
{{- end }}
|
||||
@@ -0,0 +1,23 @@
|
||||
{{- if not .Values.existingSecret }}
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ include "netbird-proxy.fullname" . }}
|
||||
labels:
|
||||
{{- include "netbird-proxy.labels" . | nindent 4 }}
|
||||
type: Opaque
|
||||
data:
|
||||
token: {{ .Values.proxyToken | b64enc | quote }}
|
||||
{{- end }}
|
||||
---
|
||||
{{- if and .Values.oidc.clientSecret (not .Values.oidc.existingOidcSecret) }}
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ include "netbird-proxy.oidcSecretName" . }}
|
||||
labels:
|
||||
{{- include "netbird-proxy.labels" . | nindent 4 }}
|
||||
type: Opaque
|
||||
data:
|
||||
oidc-client-secret: {{ .Values.oidc.clientSecret | b64enc | quote }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,45 @@
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ include "netbird-proxy.fullname" . }}
|
||||
labels:
|
||||
{{- include "netbird-proxy.labels" . | nindent 4 }}
|
||||
{{- with .Values.service.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
type: {{ .Values.service.type }}
|
||||
{{- if and (eq .Values.service.type "LoadBalancer") .Values.service.loadBalancer.ip }}
|
||||
loadBalancerIP: {{ .Values.service.loadBalancer.ip }}
|
||||
{{- end }}
|
||||
{{- if and (eq .Values.service.type "LoadBalancer") .Values.service.loadBalancer.sourceRanges }}
|
||||
loadBalancerSourceRanges:
|
||||
{{- toYaml .Values.service.loadBalancer.sourceRanges | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- if and (eq .Values.service.type "LoadBalancer") .Values.service.loadBalancer.externalTrafficPolicy }}
|
||||
externalTrafficPolicy: {{ .Values.service.loadBalancer.externalTrafficPolicy }}
|
||||
{{- end }}
|
||||
selector:
|
||||
{{- include "netbird-proxy.selectorLabels" . | nindent 4 }}
|
||||
ports:
|
||||
- name: https
|
||||
port: {{ .Values.service.port }}
|
||||
targetPort: https
|
||||
protocol: TCP
|
||||
{{- if .Values.acme.enabled }}
|
||||
- name: acme-http
|
||||
port: {{ .Values.service.acmePort }}
|
||||
targetPort: acme-http
|
||||
protocol: TCP
|
||||
{{- end }}
|
||||
- name: health
|
||||
port: {{ include "netbird-proxy.port" .Values.health.address | default 8080 }}
|
||||
targetPort: health
|
||||
protocol: TCP
|
||||
{{- if .Values.debug.enabled }}
|
||||
- name: debug
|
||||
port: {{ include "netbird-proxy.port" .Values.debug.address | default 8444 }}
|
||||
targetPort: debug
|
||||
protocol: TCP
|
||||
{{- end }}
|
||||
@@ -0,0 +1,13 @@
|
||||
{{- if .Values.serviceAccount.create }}
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: {{ include "netbird-proxy.serviceAccountName" . }}
|
||||
labels:
|
||||
{{- include "netbird-proxy.labels" . | nindent 4 }}
|
||||
{{- with .Values.serviceAccount.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
automountServiceAccountToken: {{ .Values.serviceAccount.automount | default true }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,32 @@
|
||||
{{- if .Values.serviceMonitor.enabled }}
|
||||
apiVersion: monitoring.coreos.com/v1
|
||||
kind: ServiceMonitor
|
||||
metadata:
|
||||
name: {{ include "netbird-proxy.fullname" . }}
|
||||
labels:
|
||||
{{- include "netbird-proxy.labels" . | nindent 4 }}
|
||||
{{- with .Values.serviceMonitor.labels }}
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- with .Values.serviceMonitor.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
selector:
|
||||
matchLabels:
|
||||
{{- include "netbird-proxy.selectorLabels" . | nindent 6 }}
|
||||
endpoints:
|
||||
- port: health
|
||||
path: {{ .Values.serviceMonitor.path }}
|
||||
{{- with .Values.serviceMonitor.interval }}
|
||||
interval: {{ . }}
|
||||
{{- end }}
|
||||
{{- with .Values.serviceMonitor.scrapeTimeout }}
|
||||
scrapeTimeout: {{ . }}
|
||||
{{- end }}
|
||||
{{- with .Values.serviceMonitor.namespaceSelector }}
|
||||
namespaceSelector:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,235 @@
|
||||
replicaCount: 2
|
||||
|
||||
image:
|
||||
repository: netbird-proxy
|
||||
tag: ""
|
||||
pullPolicy: IfNotPresent
|
||||
|
||||
imagePullSecrets: []
|
||||
nameOverride: ""
|
||||
fullnameOverride: ""
|
||||
|
||||
# -- Proxy token for management server authentication.
|
||||
# Ignored if existingSecret is set.
|
||||
proxyToken: ""
|
||||
|
||||
# -- Use an existing Secret for the proxy token.
|
||||
# The secret must contain a key named "token".
|
||||
existingSecret: ""
|
||||
|
||||
managementAddress: "https://api.netbird.io:443"
|
||||
|
||||
# -- Allow proxy token over non-TLS management connections.
|
||||
allowInsecure: false
|
||||
|
||||
proxy:
|
||||
# -- Listen address for the HTTPS reverse proxy.
|
||||
address: ":8443"
|
||||
# -- Public URL of the proxy (used for ACME and client access).
|
||||
# Leave empty to auto-derive from the proxy address.
|
||||
url: ""
|
||||
# -- X-Forwarded-Proto behaviour: auto, http, or https.
|
||||
forwardedProto: "auto"
|
||||
# -- Comma-separated CIDR ranges of trusted upstream proxies.
|
||||
trustedProxies: ""
|
||||
|
||||
acme:
|
||||
# -- Enable ACME certificate generation.
|
||||
enabled: true
|
||||
# -- HTTP-01 challenge listen address.
|
||||
address: ":80"
|
||||
# -- ACME directory URL.
|
||||
directory: "https://acme-v02.api.letsencrypt.org/directory"
|
||||
# -- Certificate lock method: auto, flock, or k8s-lease.
|
||||
certLockMethod: "k8s-lease"
|
||||
|
||||
# -- Static TLS certificate configuration (used when acme.enabled=false).
|
||||
tls:
|
||||
certFile: "tls.crt"
|
||||
keyFile: "tls.key"
|
||||
|
||||
oidc:
|
||||
clientId: "netbird-proxy"
|
||||
# -- OIDC client secret. Ignored if existingOidcSecret is set.
|
||||
# For production, consider using existingOidcSecret with sealed-secrets
|
||||
# or external-secrets-operator instead of storing the secret in values.
|
||||
clientSecret: ""
|
||||
# -- Use an existing Secret for the OIDC client secret.
|
||||
# The secret must contain a key named "oidc-client-secret".
|
||||
existingOidcSecret: ""
|
||||
endpoint: "https://api.netbird.io/oauth2"
|
||||
scopes: "openid,profile,email"
|
||||
|
||||
debug:
|
||||
# -- Enable the debug HTTP endpoint.
|
||||
enabled: false
|
||||
# -- Debug endpoint listen address.
|
||||
address: ":8444"
|
||||
|
||||
health:
|
||||
# -- Health probe listen address.
|
||||
address: ":8080"
|
||||
|
||||
logging:
|
||||
# -- Enable debug-level logging.
|
||||
debug: false
|
||||
|
||||
# -- Directory where certificates are stored inside the container.
|
||||
certDir: "/certs"
|
||||
|
||||
# -- Certificate volume configuration.
|
||||
# ACME mode with multiple replicas requires a shared volume (RWX) because autocert
|
||||
# uses a DirCache and HTTP-01 challenges can arrive on any pod.
|
||||
# Set enabled=true to auto-provision a PVC, or supply an existingClaim.
|
||||
# For a single replica, emptyDir works but certs are lost on restart.
|
||||
certVolume:
|
||||
# -- Enable persistent certificate storage via PVC.
|
||||
# Defaults to true when acme is enabled; override to false for single-replica emptyDir.
|
||||
enabled: true
|
||||
# -- Mount an existing PVC instead of creating one.
|
||||
existingClaim: ""
|
||||
# -- Use a hostPath volume instead of a PVC.
|
||||
# Takes precedence over enabled and existingClaim.
|
||||
hostPath: ""
|
||||
# -- PVC access mode. ReadWriteMany is required for multi-replica ACME
|
||||
# (HTTP-01 challenges can arrive on any pod). ReadWriteOnce is fine for
|
||||
# a single replica. Note: changing this on an existing release requires
|
||||
# deleting and recreating the PVC (access modes are immutable).
|
||||
accessMode: "ReadWriteMany"
|
||||
# -- Storage class. Leave empty for the cluster default.
|
||||
storageClass: ""
|
||||
# -- PVC size.
|
||||
size: "256Mi"
|
||||
|
||||
serviceAccount:
|
||||
# -- Create a ServiceAccount.
|
||||
create: true
|
||||
# -- Annotations to add to the ServiceAccount.
|
||||
annotations: {}
|
||||
# -- Override the ServiceAccount name.
|
||||
name: ""
|
||||
# -- Automount the ServiceAccount token. Required when using k8s-lease cert locking.
|
||||
# Set to false if ACME is disabled or certLockMethod is not k8s-lease.
|
||||
automount: true
|
||||
|
||||
rbac:
|
||||
# -- Create RBAC resources for k8s-lease cert locking.
|
||||
create: true
|
||||
|
||||
podAnnotations: {}
|
||||
podLabels: {}
|
||||
|
||||
podSecurityContext:
|
||||
fsGroup: 1000
|
||||
|
||||
securityContext:
|
||||
runAsNonRoot: true
|
||||
runAsUser: 1000
|
||||
runAsGroup: 1000
|
||||
readOnlyRootFilesystem: true
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop: ["ALL"]
|
||||
|
||||
service:
|
||||
# -- Service type: ClusterIP, LoadBalancer, or NodePort.
|
||||
type: ClusterIP
|
||||
# -- Annotations for the Service (e.g. cloud LB annotations).
|
||||
annotations: {}
|
||||
# -- HTTPS proxy port.
|
||||
port: 443
|
||||
# -- ACME HTTP-01 challenge port (only exposed if acme.enabled).
|
||||
acmePort: 80
|
||||
|
||||
loadBalancer:
|
||||
# -- Source ranges allowed to reach the LoadBalancer.
|
||||
sourceRanges: []
|
||||
# -- Request a specific LoadBalancer IP.
|
||||
ip: ""
|
||||
# -- External traffic policy: Cluster or Local.
|
||||
# Local preserves client source IP but may cause imbalanced traffic.
|
||||
externalTrafficPolicy: ""
|
||||
|
||||
resources:
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 64Mi
|
||||
limits:
|
||||
cpu: 500m
|
||||
memory: 256Mi
|
||||
|
||||
# -- Host aliases to inject into /etc/hosts.
|
||||
hostAliases: []
|
||||
# - ip: "192.168.100.1"
|
||||
# hostnames:
|
||||
# - "host.docker.internal"
|
||||
|
||||
# -- Pod topology spread constraints.
|
||||
topologySpreadConstraints: []
|
||||
|
||||
# -- Node selector.
|
||||
nodeSelector: {}
|
||||
|
||||
# -- Tolerations.
|
||||
tolerations: []
|
||||
|
||||
# -- Affinity overrides. When empty, a default pod anti-affinity
|
||||
# (preferredDuringSchedulingIgnoredDuringExecution on hostname) is applied.
|
||||
affinity: {}
|
||||
|
||||
podDisruptionBudget:
|
||||
# -- Create a PodDisruptionBudget.
|
||||
enabled: true
|
||||
# -- Minimum available pods.
|
||||
minAvailable: 1
|
||||
# -- Maximum unavailable pods (mutually exclusive with minAvailable).
|
||||
# maxUnavailable: 1
|
||||
|
||||
serviceMonitor:
|
||||
# -- Create a Prometheus ServiceMonitor resource.
|
||||
enabled: false
|
||||
# -- Extra labels for ServiceMonitor selector matching.
|
||||
labels: {}
|
||||
# -- Annotations on the ServiceMonitor.
|
||||
annotations: {}
|
||||
# -- Metrics endpoint path.
|
||||
path: /metrics
|
||||
# -- Scrape interval (e.g. "30s"). Uses Prometheus default if empty.
|
||||
interval: ""
|
||||
# -- Scrape timeout (e.g. "10s"). Uses Prometheus default if empty.
|
||||
scrapeTimeout: ""
|
||||
# -- Namespace selector for cross-namespace monitoring.
|
||||
namespaceSelector: {}
|
||||
|
||||
networkPolicy:
|
||||
# -- Create a NetworkPolicy restricting ingress to proxy ports.
|
||||
enabled: false
|
||||
# -- Additional ingress rules to append.
|
||||
additionalIngress: []
|
||||
|
||||
autoscaling:
|
||||
enabled: false
|
||||
minReplicas: 2
|
||||
maxReplicas: 10
|
||||
targetCPUUtilizationPercentage: 70
|
||||
targetMemoryUtilizationPercentage: 80
|
||||
|
||||
# -- Extra environment variables to add to the proxy container.
|
||||
extraEnv: []
|
||||
# - name: SSL_CERT_FILE
|
||||
# value: "/pebble-ca/pebble-ca.pem"
|
||||
|
||||
# -- Extra volumes to add to the pod.
|
||||
extraVolumes: []
|
||||
# - name: pebble-ca
|
||||
# secret:
|
||||
# secretName: pebble-ca
|
||||
|
||||
# -- Extra volume mounts to add to the proxy container.
|
||||
extraVolumeMounts: []
|
||||
# - name: pebble-ca
|
||||
# mountPath: /pebble-ca
|
||||
# readOnly: true
|
||||
|
||||
# -- Init containers to add to the pod.
|
||||
initContainers: []
|
||||
Reference in New Issue
Block a user