From ed4e30dbb6e31633277c82e56b2e7a3e508a3f94 Mon Sep 17 00:00:00 2001 From: "M. Essam" Date: Wed, 4 Feb 2026 17:34:47 +0200 Subject: [PATCH] kubernetes-operator v0.2.0 (#26) --- .../test-chart-netbird-operator-config.yaml | 64 ++++++++++ charts/kubernetes-operator/Chart.yaml | 4 +- charts/kubernetes-operator/secretingress.yaml | 17 +++ .../templates/_helpers.tpl | 5 + .../templates/deployment.yaml | 7 ++ .../templates/kubernetes-nbresource.yaml | 10 +- .../templates/nbpolicies.yaml | 2 + .../templates/nbroutingpeers.yaml | 4 + .../templates/pre-delete.yaml | 110 +++++++----------- .../templates/webhook.yaml | 78 ------------- charts/kubernetes-operator/values.yaml | 13 ++- charts/netbird-operator-config/.helmignore | 23 ++++ charts/netbird-operator-config/Chart.yaml | 6 + .../templates/_helpers.tpl | 62 ++++++++++ .../templates/kubernetes-nbresource.yaml | 68 +++++++++++ .../templates/nbpolicies.yaml | 30 +++++ .../templates/nbroutingpeers.yaml | 83 +++++++++++++ .../templates/rbac.yaml | 45 +++++++ .../templates/serviceaccount.yaml | 13 +++ charts/netbird-operator-config/values.yaml | 57 +++++++++ 20 files changed, 543 insertions(+), 158 deletions(-) create mode 100644 .github/workflows/test-chart-netbird-operator-config.yaml create mode 100644 charts/kubernetes-operator/secretingress.yaml create mode 100644 charts/netbird-operator-config/.helmignore create mode 100644 charts/netbird-operator-config/Chart.yaml create mode 100644 charts/netbird-operator-config/templates/_helpers.tpl create mode 100644 charts/netbird-operator-config/templates/kubernetes-nbresource.yaml create mode 100644 charts/netbird-operator-config/templates/nbpolicies.yaml create mode 100644 charts/netbird-operator-config/templates/nbroutingpeers.yaml create mode 100644 charts/netbird-operator-config/templates/rbac.yaml create mode 100644 charts/netbird-operator-config/templates/serviceaccount.yaml create mode 100644 charts/netbird-operator-config/values.yaml diff --git a/.github/workflows/test-chart-netbird-operator-config.yaml b/.github/workflows/test-chart-netbird-operator-config.yaml new file mode 100644 index 0000000..71f3ea2 --- /dev/null +++ b/.github/workflows/test-chart-netbird-operator-config.yaml @@ -0,0 +1,64 @@ +name: Test netbird-operator-config Chart + +on: + push: + pull_request: + +jobs: + test-e2e: + name: Run on Ubuntu + runs-on: ubuntu-latest + steps: + - name: Clone the code + uses: actions/checkout@v4 + + - name: Install the latest version of kind + run: | + curl -Lo ./kind https://kind.sigs.k8s.io/dl/latest/kind-linux-amd64 + chmod +x ./kind + sudo mv ./kind /usr/local/bin/kind + + - name: Verify kind installation + run: kind version + + - name: Create kind cluster + run: kind create cluster + + - name: Install Helm + run: | + curl https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3 | bash + + - name: Verify Helm installation + run: helm version + + - name: Lint Helm Chart + run: | + helm lint ./charts/kubernetes-operator + + - name: Install cert-manager via Helm + run: | + helm repo add jetstack https://charts.jetstack.io + helm repo update + helm install cert-manager jetstack/cert-manager --namespace cert-manager --create-namespace --set installCRDs=true + + - name: Wait for cert-manager to be ready + run: | + kubectl wait --namespace cert-manager --for=condition=available --timeout=300s deployment/cert-manager + kubectl wait --namespace cert-manager --for=condition=available --timeout=300s deployment/cert-manager-cainjector + kubectl wait --namespace cert-manager --for=condition=available --timeout=300s deployment/cert-manager-webhook + + - name: Install Helm chart for project + run: | + helm install test-chart --create-namespace --namespace netbird --set 'operator.image.tag=debug' ./charts/kubernetes-operator + + - name: Check Helm release status + run: | + helm status test-chart --namespace netbird + + - name: Install config chart for project + run: | + helm install test-chart-config --create-namespace --namespace netbird ./charts/netbird-operator-config + + - name: Check config release status + run: | + helm status test-chart-config --namespace netbird diff --git a/charts/kubernetes-operator/Chart.yaml b/charts/kubernetes-operator/Chart.yaml index 29b99c0..ca9b941 100644 --- a/charts/kubernetes-operator/Chart.yaml +++ b/charts/kubernetes-operator/Chart.yaml @@ -2,5 +2,5 @@ apiVersion: v2 name: kubernetes-operator description: NetBird Kubernetes Operator type: application -version: 0.1.15 -appVersion: "0.1.5" +version: 0.2.0 +appVersion: "0.2.0" diff --git a/charts/kubernetes-operator/secretingress.yaml b/charts/kubernetes-operator/secretingress.yaml new file mode 100644 index 0000000..e23301e --- /dev/null +++ b/charts/kubernetes-operator/secretingress.yaml @@ -0,0 +1,17 @@ +fullnameOverride: "netbird-api-gateway" + +controller: + replicaCount: 1 + allowSnippetAnnotations: true + nodeSelector: + kubernetes.io/os: null + service: + type: ClusterIP + admissionWebhooks: + enabled: false + ingressClassResource: + name: netbird-api-gateway + controllerValue: k8s.io/netbird-api-gateway + ingressClass: netbird-api-gateway + config: + ssl-redirect: "true" diff --git a/charts/kubernetes-operator/templates/_helpers.tpl b/charts/kubernetes-operator/templates/_helpers.tpl index 2c98e59..ebef1ea 100644 --- a/charts/kubernetes-operator/templates/_helpers.tpl +++ b/charts/kubernetes-operator/templates/_helpers.tpl @@ -40,6 +40,11 @@ helm.sh/chart: {{ include "kubernetes-operator.chart" . }} app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} {{- end }} app.kubernetes.io/managed-by: {{ .Release.Service }} +{{- if .Values.general.labels }} +{{- range $key, $val := .Values.general.labels }} +{{ $key }}: "{{ $val }}" +{{- end }} +{{- end }} {{- end }} {{/* diff --git a/charts/kubernetes-operator/templates/deployment.yaml b/charts/kubernetes-operator/templates/deployment.yaml index 462f11e..117b3eb 100644 --- a/charts/kubernetes-operator/templates/deployment.yaml +++ b/charts/kubernetes-operator/templates/deployment.yaml @@ -66,6 +66,13 @@ spec: {{- if .Values.routingClientImage }} - --netbird-client-image={{.Values.routingClientImage}} {{- end }} + {{- if .Values.general.labels }} + {{- $list := list }} + {{- range $k, $v := .Values.general.labels }} + {{- $list = append $list (printf "%s=%s" $k $v) }} + {{- end }} + - --default-labels="{{ join ", " $list }}" + {{- end }} ports: - name: webhook-server containerPort: {{ .Values.webhook.service.port }} diff --git a/charts/kubernetes-operator/templates/kubernetes-nbresource.yaml b/charts/kubernetes-operator/templates/kubernetes-nbresource.yaml index dc54293..3448f74 100644 --- a/charts/kubernetes-operator/templates/kubernetes-nbresource.yaml +++ b/charts/kubernetes-operator/templates/kubernetes-nbresource.yaml @@ -27,15 +27,15 @@ spec: spec: initContainers: - name: wait-network-ready - image: {{ .Values.ingress.kubernetesAPI.customKubectlImage | default "registry.suse.com/suse/kubectl:latest"}} + image: "netbirdio/kubectl:latest" command: - - bash + - sh - -c args: - - kubectl wait --for 'jsonpath={.status.networkID}' -n {{ $routerNS }} nbroutingpeer router; + - kubectl wait --for 'jsonpath={.status.networkID}' -n {{ $routerNS }} nbroutingpeer router; containers: - name: apply-nbresource - image: {{ .Values.ingress.kubernetesAPI.customKubectlImage | default "registry.suse.com/suse/kubectl:latest"}} + image: "netbirdio/kubectl:latest" env: - name: NBRESOURCE_VALUE value: | @@ -62,7 +62,7 @@ spec: tcpPorts: - 443 command: - - bash + - sh - -c args: - kubectl delete NBResource --ignore-not-found -n default kubernetes; export NETWORK_ID=$(kubectl get NBRoutingPeer -n {{ $routerNS }} router -o 'jsonpath={.status.networkID}'); echo "$NBRESOURCE_VALUE" | envsubst | kubectl apply -f - diff --git a/charts/kubernetes-operator/templates/nbpolicies.yaml b/charts/kubernetes-operator/templates/nbpolicies.yaml index 5171b1f..0590b91 100644 --- a/charts/kubernetes-operator/templates/nbpolicies.yaml +++ b/charts/kubernetes-operator/templates/nbpolicies.yaml @@ -8,6 +8,8 @@ metadata: labels: app.kubernetes.io/component: operator {{- include "kubernetes-operator.labels" $ | nindent 4 }} + annotations: + helm.sh/resource-policy: keep name: {{ $k }} spec: name: {{ $v.name }} diff --git a/charts/kubernetes-operator/templates/nbroutingpeers.yaml b/charts/kubernetes-operator/templates/nbroutingpeers.yaml index 7742b41..505d3a7 100644 --- a/charts/kubernetes-operator/templates/nbroutingpeers.yaml +++ b/charts/kubernetes-operator/templates/nbroutingpeers.yaml @@ -10,6 +10,8 @@ metadata: labels: app.kubernetes.io/component: operator {{- include "kubernetes-operator.labels" $ | nindent 4 }} + annotations: + helm.sh/resource-policy: keep name: router namespace: {{ $k }} {{ $spec := merge $defaults $v }} @@ -51,6 +53,8 @@ metadata: labels: app.kubernetes.io/component: operator {{- include "kubernetes-operator.labels" $ | nindent 4 }} + annotations: + helm.sh/resource-policy: keep name: router {{- if or (or (or .replicas .resources) (or .labels .annotations)) (or .nodeSelector .tolerations) }} spec: diff --git a/charts/kubernetes-operator/templates/pre-delete.yaml b/charts/kubernetes-operator/templates/pre-delete.yaml index 0121b19..a13a0d1 100644 --- a/charts/kubernetes-operator/templates/pre-delete.yaml +++ b/charts/kubernetes-operator/templates/pre-delete.yaml @@ -1,69 +1,41 @@ -apiVersion: batch/v1 -kind: Job -metadata: - name: {{ include "kubernetes-operator.fullname" . }}-delete-routers - labels: - app.kubernetes.io/component: operator - {{- include "kubernetes-operator.labels" . | nindent 4 }} - annotations: - helm.sh/hook: pre-delete - helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded -spec: - backoffLimit: 3 - template: - metadata: - name: {{ include "kubernetes-operator.fullname" . }} - labels: - app.kubernetes.io/component: operator - {{- include "kubernetes-operator.labels" . | nindent 8 }} - {{- with .Values.operator.podLabels }} - {{- toYaml . | nindent 8 }} - {{- end }} - spec: - containers: - - name: pre-delete - image: {{ .Values.ingress.kubernetesAPI.customKubectlImage | default "registry.suse.com/suse/kubectl:latest"}} - args: - - delete - - --all - - -A - - --cascade=foreground - - --ignore-not-found - - NBRoutingPeer - serviceAccountName: {{ include "kubernetes-operator.serviceAccountName" . }} - restartPolicy: Never ---- -apiVersion: batch/v1 -kind: Job -metadata: - name: {{ include "kubernetes-operator.fullname" . }}-delete-policies - labels: - app.kubernetes.io/component: operator - {{- include "kubernetes-operator.labels" . | nindent 4 }} - annotations: - helm.sh/hook: pre-delete - helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded -spec: - backoffLimit: 3 - template: - metadata: - name: {{ include "kubernetes-operator.fullname" . }} - labels: - app.kubernetes.io/component: operator - {{- include "kubernetes-operator.labels" . | nindent 8 }} - {{- with .Values.operator.podLabels }} - {{- toYaml . | nindent 8 }} - {{- end }} - spec: - containers: - - name: pre-delete - image: {{ .Values.ingress.kubernetesAPI.customKubectlImage | default "registry.suse.com/suse/kubectl:latest"}} - args: - - delete - - --all - - --cascade=foreground - - --ignore-not-found - - NBPolicy - serviceAccountName: {{ include "kubernetes-operator.serviceAccountName" . }} - restartPolicy: Never ---- \ No newline at end of file +{{/*apiVersion: batch/v1*/}} +{{/*kind: Job*/}} +{{/*metadata:*/}} +{{/* name: {{ include "kubernetes-operator.fullname" . }}-delete-router-deployments*/}} +{{/* labels:*/}} +{{/* app.kubernetes.io/component: operator*/}} +{{/* {{- include "kubernetes-operator.labels" . | nindent 4 }}*/}} +{{/* annotations:*/}} +{{/* helm.sh/hook: pre-delete*/}} +{{/* helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded*/}} +{{/*spec:*/}} +{{/* backoffLimit: 3*/}} +{{/* template:*/}} +{{/* metadata:*/}} +{{/* name: {{ include "kubernetes-operator.fullname" . }}*/}} +{{/* labels:*/}} +{{/* app.kubernetes.io/component: operator*/}} +{{/* {{- include "kubernetes-operator.labels" . | nindent 8 }}*/}} +{{/* {{- with .Values.operator.podLabels }}*/}} +{{/* {{- toYaml . | nindent 8 }}*/}} +{{/* {{- end }}*/}} +{{/* spec:*/}} +{{/* containers:*/}} +{{/* - name: pre-delete*/}} +{{/* image: "netbirdio/kubectl:latest"*/}} +{{/* imagePullPolicy: {{ .Values.operator.image.pullPolicy }}*/}} +{{/* command:*/}} +{{/* - sh*/}} +{{/* - -c*/}} +{{/* args:*/}} +{{/* - kubectl get NBRoutingPeer -A --no-headers -o custom-columns=NAMESPACE:.metadata.namespace,NAME:.metadata.name | while read "L"; do kubectl patch --type=json -p '[{"op":"replace","path":"/spec/disableDeployment","value":true}]' NBRoutingPeer -n $(echo "$L" | awk '{print $1}') $(echo "$L" | awk '{print $2}'); done*/}} +{{/* - name: delete-wait*/}} +{{/* image: "netbirdio/kubectl:latest"*/}} +{{/* imagePullPolicy: {{ .Values.operator.image.pullPolicy }}*/}} +{{/* command:*/}} +{{/* - sh*/}} +{{/* - -c*/}} +{{/* args:*/}} +{{/* - kubectl get NBRoutingPeer -A --no-headers -o custom-columns=NAMESPACE:.metadata.namespace,NAME:.metadata.name | while read "L"; do kubectl wait --for=delete deployment -n $(echo "$L" | awk '{print $1}') $(echo "$L" | awk '{print $2}'); done*/}} +{{/* serviceAccountName: {{ include "kubernetes-operator.serviceAccountName" . }}*/}} +{{/* restartPolicy: Never*/}} diff --git a/charts/kubernetes-operator/templates/webhook.yaml b/charts/kubernetes-operator/templates/webhook.yaml index 3f55934..e96d8bc 100644 --- a/charts/kubernetes-operator/templates/webhook.yaml +++ b/charts/kubernetes-operator/templates/webhook.yaml @@ -96,84 +96,6 @@ webhooks: apiVersion: admissionregistration.k8s.io/v1 kind: ValidatingWebhookConfiguration metadata: -{{- if $.Values.webhook.enableCertManager }} - annotations: - cert-manager.io/inject-ca-from: {{ .Release.Namespace }}/{{ template "kubernetes-operator.fullname" . }}-serving-cert -{{- end }} - name: {{ include "kubernetes-operator.fullname" . }}-vnbresource-webhook - labels: - {{- include "kubernetes-operator.labels" . | nindent 4 }} -webhooks: -- clientConfig: - {{- if not $.Values.webhook.enableCertManager }} - caBundle: {{ $tls.caCert }} - {{ end }} - service: - name: {{ template "kubernetes-operator.webhookService" . }} - namespace: {{ $.Release.Namespace }} - path: /validate-netbird-io-v1-nbresource - failurePolicy: {{ .Values.webhook.failurePolicy }} - name: vnbresource-v1.netbird.io - admissionReviewVersions: - - v1 - {{- if .Values.webhook.namespaceSelectors }} - namespaceSelector: - matchExpressions: - {{ toYaml .Values.webhook.namespaceSelectors | nindent 4 }} - {{ end }} - rules: - - apiGroups: - - netbird.io - apiVersions: - - v1 - operations: - - DELETE - resources: - - "nbresources" - sideEffects: None ---- -apiVersion: admissionregistration.k8s.io/v1 -kind: ValidatingWebhookConfiguration -metadata: -{{- if $.Values.webhook.enableCertManager }} - annotations: - cert-manager.io/inject-ca-from: {{ .Release.Namespace }}/{{ template "kubernetes-operator.fullname" . }}-serving-cert -{{- end }} - name: {{ include "kubernetes-operator.fullname" . }}-vnbroutingpeer-webhook - labels: - {{- include "kubernetes-operator.labels" . | nindent 4 }} -webhooks: -- clientConfig: - {{- if not $.Values.webhook.enableCertManager }} - caBundle: {{ $tls.caCert }} - {{ end }} - service: - name: {{ template "kubernetes-operator.webhookService" . }} - namespace: {{ $.Release.Namespace }} - path: /validate-netbird-io-v1-nbroutingpeer - failurePolicy: {{ .Values.webhook.failurePolicy }} - name: vnbroutingpeer-v1.netbird.io - admissionReviewVersions: - - v1 - {{- if .Values.webhook.namespaceSelectors }} - namespaceSelector: - matchExpressions: - {{ toYaml .Values.webhook.namespaceSelectors | nindent 4 }} - {{ end }} - rules: - - apiGroups: - - netbird.io - apiVersions: - - v1 - operations: - - DELETE - resources: - - "nbroutingpeers" - sideEffects: None ---- -apiVersion: admissionregistration.k8s.io/v1 -kind: ValidatingWebhookConfiguration -metadata: {{- if $.Values.webhook.enableCertManager }} annotations: cert-manager.io/inject-ca-from: {{ .Release.Namespace }}/{{ template "kubernetes-operator.fullname" . }}-serving-cert diff --git a/charts/kubernetes-operator/values.yaml b/charts/kubernetes-operator/values.yaml index d238055..9bf315c 100644 --- a/charts/kubernetes-operator/values.yaml +++ b/charts/kubernetes-operator/values.yaml @@ -140,15 +140,14 @@ ingress: namespacedNetworks: false # Allow creating policies through Service annotations allowAutomaticPolicyCreation: false - kubernetesAPI: + kubernetesAPI: # DEPRECATED: Use netbirdio/netbird-operator-configs Chart instead enabled: false groups: [] # - group1 # - group2 policies: [] # - default - customKubectlImage: "registry.suse.com/suse/kubectl:latest" - router: + router: # DEPRECATED: Use netbirdio/netbird-operator-configs Chart instead # Deploy routing peer(s) enabled: false # replicas: 3 @@ -179,7 +178,7 @@ ingress: # nodeSelector: {} # tolerations: [] # NetBird Policies for use with exposed services - policies: {} + policies: {} # DEPRECATED: Use netbirdio/netbird-operator-configs Chart instead # default: # name: Kubernetes Default Policy # sourceGroups: @@ -199,3 +198,9 @@ netbirdAPI: {} # key: "NB_API_KEY" #routingClientImage: "netbirdio/netbird:latest" + +general: + # General labels, applied to all created K8s resources + labels: {} + # acme_com_managed_by: platform-engineering + # acme_com_owned_by: release-engineering diff --git a/charts/netbird-operator-config/.helmignore b/charts/netbird-operator-config/.helmignore new file mode 100644 index 0000000..0e8a0eb --- /dev/null +++ b/charts/netbird-operator-config/.helmignore @@ -0,0 +1,23 @@ +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*.orig +*~ +# Various IDEs +.project +.idea/ +*.tmproj +.vscode/ diff --git a/charts/netbird-operator-config/Chart.yaml b/charts/netbird-operator-config/Chart.yaml new file mode 100644 index 0000000..d1781cc --- /dev/null +++ b/charts/netbird-operator-config/Chart.yaml @@ -0,0 +1,6 @@ +apiVersion: v2 +name: netbird-operator-config +description: NetBird Operator Configuration +type: application +version: 0.1.0 +appVersion: "0.2.0" diff --git a/charts/netbird-operator-config/templates/_helpers.tpl b/charts/netbird-operator-config/templates/_helpers.tpl new file mode 100644 index 0000000..d560c83 --- /dev/null +++ b/charts/netbird-operator-config/templates/_helpers.tpl @@ -0,0 +1,62 @@ +{{/* +Create a default fully qualified app name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +If release name contains chart name it will be used as a full name. +*/}} +{{- define "netbird-operator-config.fullname" -}} +{{- if .Values.fullnameOverride }} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- $name := default .Chart.Name .Values.nameOverride }} +{{- if contains $name .Release.Name }} +{{- .Release.Name | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }} +{{- end }} +{{- end }} +{{- end }} + +{{/* +Expand the name of the chart. +*/}} +{{- define "netbird-operator-config.name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Create chart name and version as used by the chart label. +*/}} +{{- define "netbird-operator-config.chart" -}} +{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Common labels +*/}} +{{- define "netbird-operator-config.labels" -}} +helm.sh/chart: {{ include "netbird-operator-config.chart" . }} +{{ include "netbird-operator-config.selectorLabels" . }} +{{- if .Chart.AppVersion }} +app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} +{{- end }} +app.kubernetes.io/managed-by: {{ .Release.Service }} +{{- end }} + +{{/* +Selector labels +*/}} +{{- define "netbird-operator-config.selectorLabels" -}} +app.kubernetes.io/name: {{ include "netbird-operator-config.name" . }} +app.kubernetes.io/instance: {{ .Release.Name }} +{{- end }} + +{{/* +Create the name of the service account to use +*/}} +{{- define "netbird-operator-config.serviceAccountName" -}} +{{- if .Values.serviceAccount.create }} +{{- default (include "netbird-operator-config.fullname" .) .Values.serviceAccount.name }} +{{- else }} +{{- default "default" .Values.serviceAccount.name }} +{{- end }} +{{- end }} diff --git a/charts/netbird-operator-config/templates/kubernetes-nbresource.yaml b/charts/netbird-operator-config/templates/kubernetes-nbresource.yaml new file mode 100644 index 0000000..5241185 --- /dev/null +++ b/charts/netbird-operator-config/templates/kubernetes-nbresource.yaml @@ -0,0 +1,68 @@ +{{- if .Values.kubernetesAPI.enabled }} +{{- $routerNS := .Release.Namespace }} +{{- if .Values.namespacedNetworks }} +{{- $routerNS = "default" }} +{{- end }} +apiVersion: batch/v1 +kind: Job +metadata: + name: {{ include "netbird-operator-config.fullname" . }}-kubernetes-service-expose + labels: + app.kubernetes.io/component: operator + {{- include "netbird-operator-config.labels" . | nindent 4 }} + annotations: + helm.sh/hook: post-upgrade,post-install + helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded +spec: + backoffLimit: 3 + template: + metadata: + name: {{ include "netbird-operator-config.fullname" . }} + labels: + app.kubernetes.io/component: operator + {{- include "netbird-operator-config.labels" . | nindent 8 }} + spec: + initContainers: + - name: wait-network-ready + image: "netbirdio/kubectl:latest" + command: + - sh + - -c + args: + - kubectl wait --for 'jsonpath={.status.networkID}' -n {{ $routerNS }} nbroutingpeer router; + containers: + - name: apply-nbresource + image: "netbirdio/kubectl:latest" + env: + - name: NBRESOURCE_VALUE + value: | + apiVersion: netbird.io/v1 + kind: NBResource + metadata: + finalizers: + - netbird.io/cleanup + name: kubernetes + namespace: default + spec: + address: kubernetes.default.{{.Values.cluster.dns}} + groups: + {{- if .Values.kubernetesAPI.groups }} + {{ toYaml .Values.kubernetesAPI.groups }} + {{- else }} + - {{ .Values.cluster.name }}-default-api-access + {{- end }} + name: {{ .Values.kubernetesAPI.resourceName | default "default-kubernetes-api" }} + networkID: ${NETWORK_ID} + {{- if .Values.kubernetesAPI.policies }} + policyName: "{{ join "," .Values.kubernetesAPI.policies }}" + {{- end }} + tcpPorts: + - 443 + command: + - sh + - -c + args: + - kubectl delete NBResource --ignore-not-found -n default kubernetes; export NETWORK_ID=$(kubectl get NBRoutingPeer -n {{ $routerNS }} router -o 'jsonpath={.status.networkID}'); echo "$NBRESOURCE_VALUE" | envsubst | kubectl apply -f - + serviceAccountName: {{ include "netbird-operator-config.serviceAccountName" . }} + restartPolicy: Never +{{- end }} diff --git a/charts/netbird-operator-config/templates/nbpolicies.yaml b/charts/netbird-operator-config/templates/nbpolicies.yaml new file mode 100644 index 0000000..4dd0733 --- /dev/null +++ b/charts/netbird-operator-config/templates/nbpolicies.yaml @@ -0,0 +1,30 @@ +{{- range $k, $v := $.Values.policies }} +--- +apiVersion: netbird.io/v1 +kind: NBPolicy +metadata: + annotations: + helm.sh/resource-policy: keep + finalizers: + - netbird.io/cleanup + labels: + app.kubernetes.io/component: operator + {{- include "netbird-operator-config.labels" $ | nindent 4 }} + name: {{ $k }} +spec: + name: {{ $v.name }} + sourceGroups: + {{ toYaml $v.sourceGroups | nindent 4}} + {{- if $v.description }} + description: {{ $v.description }} + {{- end }} + {{- if $v.protocols }} + protocols: {{ $v.protocols }} + {{- end }} + {{- if $v.ports }} + ports: {{ $v.ports }} + {{- end }} + {{- if hasKey $v "bidirectional" }} + bidirectional: {{ $v.bidirectional }} + {{- end }} +{{- end }} diff --git a/charts/netbird-operator-config/templates/nbroutingpeers.yaml b/charts/netbird-operator-config/templates/nbroutingpeers.yaml new file mode 100644 index 0000000..940938f --- /dev/null +++ b/charts/netbird-operator-config/templates/nbroutingpeers.yaml @@ -0,0 +1,83 @@ +{{- if .Values.router.enabled }} +{{- if .Values.namespacedNetworks }} +{{ $defaults := .Values.router }} +{{ range $k, $v := .Values.router.namespaces }} +apiVersion: netbird.io/v1 +kind: NBRoutingPeer +metadata: + finalizers: + - netbird.io/cleanup + labels: + app.kubernetes.io/component: operator + {{- include "netbird-operator-config.labels" $ | nindent 4 }} + name: router + namespace: {{ $k }} +{{ $spec := merge $defaults $v }} +{{- if or (or (or $spec.replicas $spec.resources) (or $spec.labels $spec.annotations)) (or $spec.nodeSelector $spec.tolerations) }} +spec: + {{- if $spec.replicas }} + replicas: {{ $spec.replicas }} + {{- end }} + {{- if $spec.resources }} + resources: + {{- toYaml $spec.resources | nindent 4 }} + {{- end }} + {{- if $spec.labels }} + labels: + {{- toYaml $spec.labels | nindent 4 }} + {{- end }} + {{- if $spec.annotations }} + annotations: + {{- toYaml $spec.annotations | nindent 4 }} + {{- end }} + {{- if $spec.nodeSelector }} + nodeSelector: + {{- toYaml $spec.nodeSelector | nindent 4 }} + {{- end }} + {{- if $spec.tolerations }} + tolerations: + {{- toYaml $spec.tolerations | nindent 4 }} + {{- end }} +{{- end }} +--- +{{- end }} +{{- else }} +{{- with .Values.router }} +apiVersion: netbird.io/v1 +kind: NBRoutingPeer +metadata: + finalizers: + - netbird.io/cleanup + labels: + app.kubernetes.io/component: operator + {{- include "netbird-operator-config.labels" $ | nindent 4 }} + name: router +{{- if or (or (or .replicas .resources) (or .labels .annotations)) (or .nodeSelector .tolerations) }} +spec: + {{- if .replicas }} + replicas: {{ .replicas }} + {{- end }} + {{- if .resources }} + resources: + {{- toYaml .resources | nindent 4 }} + {{- end }} + {{- if .labels }} + labels: + {{- toYaml .labels | nindent 4 }} + {{- end }} + {{- if .annotations }} + annotations: + {{- toYaml .annotations | nindent 4 }} + {{- end }} + {{- if .nodeSelector }} + nodeSelector: + {{- toYaml .nodeSelector | nindent 4 }} + {{- end }} + {{- if .tolerations }} + tolerations: + {{- toYaml .tolerations | nindent 4 }} + {{- end }} +{{- end }} +{{- end }} +{{- end }} +{{- end }} diff --git a/charts/netbird-operator-config/templates/rbac.yaml b/charts/netbird-operator-config/templates/rbac.yaml new file mode 100644 index 0000000..56f2ea6 --- /dev/null +++ b/charts/netbird-operator-config/templates/rbac.yaml @@ -0,0 +1,45 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: {{ include "netbird-operator-config.fullname" . }} + labels: + {{- include "netbird-operator-config.labels" . | nindent 4 }} +rules: +- apiGroups: + - netbird.io + resources: + - nbresources + verbs: + - patch + - update + - list + - watch + - create + - delete +- apiGroups: + - netbird.io + resources: + - nbroutingpeers + verbs: + - get +- apiGroups: + - netbird.io + resources: + - nbresources/finalizers + verbs: + - update +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: {{ include "netbird-operator-config.fullname" . }} + labels: + {{- include "netbird-operator-config.labels" . | nindent 4 }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: {{ include "netbird-operator-config.fullname" . }} +subjects: +- kind: ServiceAccount + name: {{ include "netbird-operator-config.serviceAccountName" . }} + namespace: {{ .Release.Namespace }} diff --git a/charts/netbird-operator-config/templates/serviceaccount.yaml b/charts/netbird-operator-config/templates/serviceaccount.yaml new file mode 100644 index 0000000..2cb66f5 --- /dev/null +++ b/charts/netbird-operator-config/templates/serviceaccount.yaml @@ -0,0 +1,13 @@ +{{- if and .Values.kubernetesAPI.enabled .Values.serviceAccount.create -}} +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ include "netbird-operator-config.serviceAccountName" . }} + labels: + {{- include "netbird-operator-config.labels" . | nindent 4 }} + {{- with .Values.serviceAccount.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +automountServiceAccountToken: true +{{- end }} diff --git a/charts/netbird-operator-config/values.yaml b/charts/netbird-operator-config/values.yaml new file mode 100644 index 0000000..b9c187a --- /dev/null +++ b/charts/netbird-operator-config/values.yaml @@ -0,0 +1,57 @@ +cluster: + name: "kubernetes" + dns: "svc.cluster.local" + +# Create router per namespace, useful for strict networking requirements +namespacedNetworks: false + +router: + # Deploy routing peer(s) + enabled: false + # replicas: 3 + # resources: + # requests: + # cpu: 100m + # memory: 100Mi + # limits: + # cpu: 100m + # memory: 100Mi + # labels: {} + # annotations: {} + # nodeSelector: {} + # tolerations: [] + # Only needed if namespacedNetworks is set to true + namespaces: {} + # default: + # replicas: 3 + # resources: + # requests: + # cpu: 100m + # memory: 100Mi + # limits: + # cpu: 100m + # memory: 100Mi + # labels: {} + # annotations: {} + # nodeSelector: {} + # tolerations: [] +# NetBird Policies for use with exposed services +policies: {} + # default: + # name: Kubernetes Default Policy + # sourceGroups: +# - All + +kubernetesAPI: + enabled: false + groups: [] + # - group1 + # - group2 + policies: [] + # - default + # resourceName: "my-cluster-kubernetes" + +serviceAccount: + create: true + name: "" + annotations: {}