From fe715ae40c21170a66f830801611e5eee15be8d3 Mon Sep 17 00:00:00 2001
From: Philip Laine <philip.laine@gmail.com>
Date: Fri, 24 Apr 2026 16:14:34 +0200
Subject: [PATCH] Set default API secret reference and remove plain text option
 (#203)

The majority of users are using the operator with an API key, so the
default should be to look for the secret. This change also removes the
option to set the api key in plain text as that is just bad practice.
Also bumps the chart version to prepare for a minor release.
---
 helm/kubernetes-operator/Chart.yaml                |  4 ++--
 helm/kubernetes-operator/templates/deployment.yaml |  4 ++--
 helm/kubernetes-operator/templates/rbac.yaml       |  4 ++--
 helm/kubernetes-operator/templates/secret.yaml     | 11 -----------
 helm/kubernetes-operator/templates/webhook.yaml    |  2 +-
 helm/kubernetes-operator/values.yaml               | 10 ++++------
 6 files changed, 11 insertions(+), 24 deletions(-)
 delete mode 100644 helm/kubernetes-operator/templates/secret.yaml

diff --git a/helm/kubernetes-operator/Chart.yaml b/helm/kubernetes-operator/Chart.yaml
index fc0085e..8facf76 100644
--- a/helm/kubernetes-operator/Chart.yaml
+++ b/helm/kubernetes-operator/Chart.yaml
@@ -2,5 +2,5 @@ apiVersion: v2
 name: kubernetes-operator
 description: NetBird Kubernetes Operator
 type: application
-version: 0.3.0-rc.2
-appVersion: "0.3.0-rc.2"
+version: "0.3.1"
+appVersion: "0.3.1"
diff --git a/helm/kubernetes-operator/templates/deployment.yaml b/helm/kubernetes-operator/templates/deployment.yaml
index 27e03c0..31fe20b 100644
--- a/helm/kubernetes-operator/templates/deployment.yaml
+++ b/helm/kubernetes-operator/templates/deployment.yaml
@@ -61,7 +61,7 @@ spec:
           {{- if .Values.cluster.dns }}
           - --cluster-dns={{.Values.cluster.dns}}
           {{- end }}
-          {{- if or .Values.netbirdAPI.key .Values.netbirdAPI.keyFromSecret }}
+          {{- if .Values.netbirdAPI.keyFromSecret }}
           - --netbird-api-key=$(NB_API_KEY)
           {{- end }}
           {{- if .Values.ingress.allowAutomaticPolicyCreation }}
@@ -96,7 +96,7 @@ spec:
               valueFrom:
                 fieldRef:
                   fieldPath: metadata.namespace
-          {{- if or .Values.netbirdAPI.key .Values.netbirdAPI.keyFromSecret }}
+          {{- if .Values.netbirdAPI.keyFromSecret }}
             - name: NB_API_KEY
               valueFrom:
                 secretKeyRef:
diff --git a/helm/kubernetes-operator/templates/rbac.yaml b/helm/kubernetes-operator/templates/rbac.yaml
index 9da9cc0..50ec2a0 100644
--- a/helm/kubernetes-operator/templates/rbac.yaml
+++ b/helm/kubernetes-operator/templates/rbac.yaml
@@ -121,7 +121,7 @@ rules:
   - get
   - list
   - watch
-{{- if or (or .Values.netbirdAPI.key .Values.netbirdAPI.keyFromSecret) .Values.clusterSecretsPermissions.allowAllSecrets }}
+{{- if or .Values.netbirdAPI.keyFromSecret .Values.clusterSecretsPermissions.allowAllSecrets }}
 - apiGroups:
   - ""
   resources:
@@ -130,7 +130,7 @@ rules:
   - get
   - list
   - watch
-{{- if or .Values.netbirdAPI.key .Values.netbirdAPI.keyFromSecret }}
+{{- if .Values.netbirdAPI.keyFromSecret }}
   - patch
   - update
   - create
diff --git a/helm/kubernetes-operator/templates/secret.yaml b/helm/kubernetes-operator/templates/secret.yaml
deleted file mode 100644
index 099517e..0000000
--- a/helm/kubernetes-operator/templates/secret.yaml
+++ /dev/null
@@ -1,11 +0,0 @@
-{{- if .Values.netbirdAPI.key }}
-apiVersion: v1
-kind: Secret
-metadata:
-  name: {{ include "kubernetes-operator.fullname" . }}
-  labels:
-    app.kubernetes.io/component: operator
-    {{- include "kubernetes-operator.labels" . | nindent 4 }}
-stringData:
-  NB_API_KEY: {{ .Values.netbirdAPI.key }}
-{{- end }}
\ No newline at end of file
diff --git a/helm/kubernetes-operator/templates/webhook.yaml b/helm/kubernetes-operator/templates/webhook.yaml
index 9209de9..fc12f4f 100644
--- a/helm/kubernetes-operator/templates/webhook.yaml
+++ b/helm/kubernetes-operator/templates/webhook.yaml
@@ -51,7 +51,7 @@ webhooks:
     resources:
     - pods
   sideEffects: None
-{{- if and $.Values.ingress.enabled (or .Values.netbirdAPI.key .Values.netbirdAPI.keyFromSecret) }}
+{{- if and $.Values.ingress.enabled .Values.netbirdAPI.keyFromSecret }}
 ---
 apiVersion: admissionregistration.k8s.io/v1
 kind: ValidatingWebhookConfiguration
diff --git a/helm/kubernetes-operator/values.yaml b/helm/kubernetes-operator/values.yaml
index 3d0e32b..b9464f9 100644
--- a/helm/kubernetes-operator/values.yaml
+++ b/helm/kubernetes-operator/values.yaml
@@ -148,12 +148,10 @@ cluster:
   # Cluster name (used for generating network and network resource names in NetBird)
   name: kubernetes
 
-netbirdAPI: {}
-  # NetBird Service Account Token
-  # key: "nbp_m0LM9ZZvDUzFO0pY50iChDOTxJgKFM3DIqmZ"
-  #keyFromSecret:
-  #  name: "Secret name"
-  #  key: "NB_API_KEY"
+netbirdAPI:
+  keyFromSecret:
+    name: "netbird-mgmt-api-key"
+    key: "NB_API_KEY"
 
 #routingClientImage: "netbirdio/netbird:latest"