Add CrowdSec support to netbird-proxy helm chart

charts/netbird-proxy/templates/deployment.yaml

@@ -203,6 +203,17 @@ spec:
             - name: NB_PROXY_DEBUG_ENDPOINT_ADDRESS
               value: {{ .Values.debug.address | quote }}
             {{- end }}
+            {{- if .Values.crowdsec.apiUrl }}
+            - name: NB_PROXY_CROWDSEC_API_URL
+              value: {{ .Values.crowdsec.apiUrl | quote }}
+            {{- end }}
+            {{- if or .Values.crowdsec.apiKey .Values.crowdsec.existingSecret }}
+            - name: NB_PROXY_CROWDSEC_API_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.crowdsec.existingSecret | default (include "netbird-proxy.fullname" .) }}
+                  key: crowdsec-api-key
+            {{- end }}
             {{- with .Values.extraEnv }}
             {{- toYaml . | nindent 12 }}
             {{- end }}

charts/netbird-proxy/templates/secret.yaml

@@ -8,6 +8,9 @@ metadata:
 type: Opaque
 data:
   token: {{ .Values.proxyToken | b64enc | quote }}
+  {{- if and .Values.crowdsec.apiKey (not .Values.crowdsec.existingSecret) }}
+  crowdsec-api-key: {{ .Values.crowdsec.apiKey | b64enc | quote }}
+  {{- end }}
 {{- end }}
 ---
 {{- if and .Values.oidc.clientSecret (not .Values.oidc.existingOidcSecret) }}

charts/netbird-proxy/values.yaml

@@ -50,6 +50,16 @@ supportsCustomPorts: true
 # the cluster domain.
 requireSubdomain: false
 
+# -- CrowdSec IP reputation integration.
+crowdsec:
+  # -- CrowdSec LAPI URL. Empty disables CrowdSec.
+  apiUrl: ""
+  # -- Bouncer API key. Empty disables CrowdSec.
+  apiKey: ""
+  # -- Use an existing Secret for the CrowdSec bouncer API key.
+  # The secret must contain a key named "crowdsec-api-key".
+  existingSecret: ""
+
 # -- Use host networking. Required for TCP/UDP service passthrough in
 # Kubernetes, since dynamically bound ports cannot be declared in the
 # Service manifest. When enabled, the container shares the host's