Set default API secret reference and remove plain text option (#203)

The majority of users are using the operator with an API key, so the
default should be to look for the secret. This change also removes the
option to set the api key in plain text as that is just bad practice.
Also bumps the chart version to prepare for a minor release.

helm/kubernetes-operator/Chart.yaml

@@ -2,5 +2,5 @@ apiVersion: v2
 name: kubernetes-operator
 description: NetBird Kubernetes Operator
 type: application
-version: 0.3.0-rc.2
-appVersion: "0.3.0-rc.2"
+version: "0.3.1"
+appVersion: "0.3.1"

helm/kubernetes-operator/templates/deployment.yaml

@@ -61,7 +61,7 @@ spec:
           {{- if .Values.cluster.dns }}
           - --cluster-dns={{.Values.cluster.dns}}
           {{- end }}
-          {{- if or .Values.netbirdAPI.key .Values.netbirdAPI.keyFromSecret }}
+          {{- if .Values.netbirdAPI.keyFromSecret }}
           - --netbird-api-key=$(NB_API_KEY)
           {{- end }}
           {{- if .Values.ingress.allowAutomaticPolicyCreation }}
@@ -96,7 +96,7 @@ spec:
               valueFrom:
                 fieldRef:
                   fieldPath: metadata.namespace
-          {{- if or .Values.netbirdAPI.key .Values.netbirdAPI.keyFromSecret }}
+          {{- if .Values.netbirdAPI.keyFromSecret }}
             - name: NB_API_KEY
               valueFrom:
                 secretKeyRef:

helm/kubernetes-operator/templates/rbac.yaml

@@ -121,7 +121,7 @@ rules:
   - get
   - list
   - watch
-{{- if or (or .Values.netbirdAPI.key .Values.netbirdAPI.keyFromSecret) .Values.clusterSecretsPermissions.allowAllSecrets }}
+{{- if or .Values.netbirdAPI.keyFromSecret .Values.clusterSecretsPermissions.allowAllSecrets }}
 - apiGroups:
   - ""
   resources:
@@ -130,7 +130,7 @@ rules:
   - get
   - list
   - watch
-{{- if or .Values.netbirdAPI.key .Values.netbirdAPI.keyFromSecret }}
+{{- if .Values.netbirdAPI.keyFromSecret }}
   - patch
   - update
   - create

helm/kubernetes-operator/templates/secret.yaml

@@ -1,11 +0,0 @@
-{{- if .Values.netbirdAPI.key }}
-apiVersion: v1
-kind: Secret
-metadata:
-  name: {{ include "kubernetes-operator.fullname" . }}
-  labels:
-    app.kubernetes.io/component: operator
-    {{- include "kubernetes-operator.labels" . | nindent 4 }}
-stringData:
-  NB_API_KEY: {{ .Values.netbirdAPI.key }}
-{{- end }}

helm/kubernetes-operator/templates/webhook.yaml

@@ -51,7 +51,7 @@ webhooks:
     resources:
     - pods
   sideEffects: None
-{{- if and $.Values.ingress.enabled (or .Values.netbirdAPI.key .Values.netbirdAPI.keyFromSecret) }}
+{{- if and $.Values.ingress.enabled .Values.netbirdAPI.keyFromSecret }}
 ---
 apiVersion: admissionregistration.k8s.io/v1
 kind: ValidatingWebhookConfiguration

helm/kubernetes-operator/values.yaml

@@ -148,12 +148,10 @@ cluster:
   # Cluster name (used for generating network and network resource names in NetBird)
   name: kubernetes
 
-netbirdAPI: {}
-  # NetBird Service Account Token
-  # key: "nbp_m0LM9ZZvDUzFO0pY50iChDOTxJgKFM3DIqmZ"
-  #keyFromSecret:
-  #  name: "Secret name"
-  #  key: "NB_API_KEY"
+netbirdAPI:
+  keyFromSecret:
+    name: "netbird-mgmt-api-key"
+    key: "NB_API_KEY"
 
 #routingClientImage: "netbirdio/netbird:latest"