From c4d73d83b14f3734fd930e8cb661cfca8b049c14 Mon Sep 17 00:00:00 2001
From: Maycon Santos <mlsmaycon@gmail.com>
Date: Sun, 30 Mar 2025 21:16:44 +0200
Subject: [PATCH] Feature/kubernetes api access (#17)

Co-authored-by: M Essam Hamed <github@messam.xyz>
---
 .../templates/kubernetes-nbresource.yaml      | 71 +++++++++++++++++++
 helm/kubernetes-operator/values.yaml          |  9 ++-
 internal/controller/service_controller.go     |  6 ++
 3 files changed, 85 insertions(+), 1 deletion(-)
 create mode 100644 helm/kubernetes-operator/templates/kubernetes-nbresource.yaml

diff --git a/helm/kubernetes-operator/templates/kubernetes-nbresource.yaml b/helm/kubernetes-operator/templates/kubernetes-nbresource.yaml
new file mode 100644
index 0000000..b9ec791
--- /dev/null
+++ b/helm/kubernetes-operator/templates/kubernetes-nbresource.yaml
@@ -0,0 +1,71 @@
+{{- if and .Values.ingress.enabled .Values.ingress.kubernetesAPI.enabled }}
+{{- $routerNS := .Release.Namespace }}
+{{- if .Values.ingress.namespacedNetworks }}
+{{- $routerNS = "default" }}
+{{- end }}
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: {{ include "kubernetes-operator.fullname" . }}-kubernetes-service-expose
+  labels:
+    app.kubernetes.io/component: operator
+    {{- include "kubernetes-operator.labels" . | nindent 4 }}
+  annotations:
+    helm.sh/hook: post-upgrade,post-install
+    helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
+spec:
+  backOffLimit: 3
+  template:
+    metadata:
+      name: {{ include "kubernetes-operator.fullname" . }}
+      labels:
+        app.kubernetes.io/component: operator
+        {{- include "kubernetes-operator.labels" . | nindent 8 }}
+        {{- with .Values.operator.podLabels }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
+    spec:
+      initContainers:
+      - name: wait-network-ready
+        image: "bitnami/kubectl:latest"
+        command:
+        - bash
+        - -c
+        args:
+        - kubectl wait --for 'jsonpath={.status.networkID}' -n {{ $routerNS }} nbroutingpeer router; 
+      containers:
+      - name: apply-nbresource
+        image: "bitnami/kubectl:latest"
+        env:
+        - name: NBRESOURCE_VALUE
+          value: |
+            apiVersion: netbird.io/v1
+            kind: NBResource
+            metadata:
+              finalizers:
+              - netbird.io/cleanup
+              name: kubernetes
+              namespace: default
+            spec:
+              address: kubernetes.default.{{.Values.cluster.dns}}
+              groups:
+              {{- if .Values.ingress.kubernetesAPI.groups }}
+              {{ toYaml .Values.ingress.kubernetesAPI.groups | nindent 2 }}
+              {{- else }}
+              - {{ .Values.cluster.name }}-default-kubernetes
+              {{- end }}
+              name: {{ .Values.ingress.kubernetesAPI.resourceName | default "default-kubernetes" }}
+              networkID: ${NETWORK_ID}
+              {{- if .Values.ingress.kubernetesAPI.policies }}
+              policyName: "{{ join "," .Values.ingress.kubernetesAPI.policies }}"
+              {{- end }}
+              tcpPorts:
+              - 443
+        command:
+        - bash
+        - -c
+        args:
+        - kubectl delete NBResource --ignore-not-found -n default kubernetes; export NETWORK_ID=$(kubectl get NBRoutingPeer -n {{ $routerNS }} router -o 'jsonpath={.status.networkID}'); echo "$NBRESOURCE_VALUE" | envsubst | kubectl apply -f -
+      serviceAccountName: {{ include "kubernetes-operator.serviceAccountName" . }}
+      restartPolicy: Never
+{{- end }}
diff --git a/helm/kubernetes-operator/values.yaml b/helm/kubernetes-operator/values.yaml
index d512b2d..02ef1aa 100644
--- a/helm/kubernetes-operator/values.yaml
+++ b/helm/kubernetes-operator/values.yaml
@@ -135,6 +135,13 @@ ingress:
   enabled: false
   # Create router per namespace, useful for strict networking requirements
   namespacedNetworks: false
+  kubernetesAPI:
+    enabled: false
+    groups: []
+    # - group1
+    # - group2
+    policies: []
+    # - default
   router:
     # Deploy routing peer(s)
     enabled: false
@@ -176,7 +183,7 @@ cluster:
   # Cluster DNS name (used for webhooks certificates and for network resource DNS names)
   dns: svc.cluster.local
   # Cluster name (used for generating network and network resource names in NetBird)
-  # name: kubernetes
+  name: kubernetes
 
 netbirdAPI: {}
   # NetBird Service Account Token
diff --git a/internal/controller/service_controller.go b/internal/controller/service_controller.go
index 59e870f..4bf1332 100644
--- a/internal/controller/service_controller.go
+++ b/internal/controller/service_controller.go
@@ -58,6 +58,12 @@ func (r *ServiceReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ct
 		return ctrl.Result{}, nil
 	}
 
+	// Special case for kubernetes API Service
+	// Handled by Helm chart
+	if svc.Namespace == "default" && svc.Name == "kubernetes" {
+		return ctrl.Result{}, nil
+	}
+
 	_, shouldExpose := svc.Annotations[ServiceExposeAnnotation]
 
 	// If Service is being deleted, un-expose