Philip Laine and GitHub
c56f8de162
Fix sidecar injection when pod annotations is nil. ( #250 )
...
When a pod does not have any annotations the injector will fail. This
change adds a test for the case and also fixes the issue.
Fixes #246
Signed-off-by: Philip Laine <philip.laine@gmail.com >
2026-05-13 12:54:52 +02:00
Philip Laine and GitHub
69afe3aade
Fix SPDX license header ( #231 )
...
This change adds SPDX license headers to all files and eforces it with
the linter.
Signed-off-by: Philip Laine <philip.laine@gmail.com >
2026-05-05 12:59:36 +02:00
Philip Laine and GitHub
74012deb27
Enforce import ordering and aliases ( #216 )
...
This change ensures import ordering and aliases is standardized.
Something that is extra important when working with Kuberentes apis that
have "standard" import aliases.
Signed-off-by: Philip Laine <philip.laine@gmail.com >
2026-04-30 13:39:11 +02:00
Philip Laine and GitHub
9838f0dccc
Add sidecar profile ( #192 )
...
This change adds a new SidecarProfile resource which allows configuring
client sidecar injection into pods. It replaces the older annotation
based solution. This removes any pod specific configuration from the
setup key and puts it all in this side car configuration.
Fixes #188
Signed-off-by: Philip Laine <philip.laine@gmail.com >
2026-04-23 19:17:53 +02:00
81f7a2bd51
Bump sigs.k8s.io/controller-runtime from 0.20.0 to 0.23.3 ( #134 )
...
Bumps
[sigs.k8s.io/controller-runtime](https://github.com/kubernetes-sigs/controller-runtime )
from 0.20.0 to 0.23.3.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/kubernetes-sigs/controller-runtime/releases ">sigs.k8s.io/controller-runtime's
releases</a>.</em></p>
<blockquote>
<h2>v0.23.3</h2>
<h2>What's Changed</h2>
<ul>
<li>🐛 Ensure DefaulterRemoveUnknownOrOmitableFields is still working
even if objects are equal by <a
href="https://github.com/k8s-infra-cherrypick-robot "><code>@k8s-infra-cherrypick-robot</code></a>
in <a
href="https://redirect.github.com/kubernetes-sigs/controller-runtime/pull/3469 ">kubernetes-sigs/controller-runtime#3469</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/kubernetes-sigs/controller-runtime/compare/v0.23.2...v0.23.3 ">https://github.com/kubernetes-sigs/controller-runtime/compare/v0.23.2...v0.23.3 </a></p>
<h2>v0.23.2</h2>
<h2>What's Changed</h2>
<ul>
<li>🐛 Fix fake client's SSA status patch resource version check by <a
href="https://github.com/k8s-infra-cherrypick-robot "><code>@k8s-infra-cherrypick-robot</code></a>
in <a
href="https://redirect.github.com/kubernetes-sigs/controller-runtime/pull/3446 ">kubernetes-sigs/controller-runtime#3446</a></li>
<li>✨ Reduce memory usage of default webhooks by <a
href="https://github.com/k8s-infra-cherrypick-robot "><code>@k8s-infra-cherrypick-robot</code></a>
in <a
href="https://redirect.github.com/kubernetes-sigs/controller-runtime/pull/3467 ">kubernetes-sigs/controller-runtime#3467</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/kubernetes-sigs/controller-runtime/compare/v0.23.1...v0.23.2 ">https://github.com/kubernetes-sigs/controller-runtime/compare/v0.23.1...v0.23.2 </a></p>
<h2>v0.23.1</h2>
<h2>What's Changed</h2>
<ul>
<li>🐛 Cache reader: Wait for cache sync when ReaderFailOnMissingInformer
is true by <a
href="https://github.com/k8s-infra-cherrypick-robot "><code>@k8s-infra-cherrypick-robot</code></a>
in <a
href="https://redirect.github.com/kubernetes-sigs/controller-runtime/pull/3433 ">kubernetes-sigs/controller-runtime#3433</a></li>
<li>🐛 Fix panic when using CRs with embedded pointer structs by <a
href="https://github.com/k8s-infra-cherrypick-robot "><code>@k8s-infra-cherrypick-robot</code></a>
in <a
href="https://redirect.github.com/kubernetes-sigs/controller-runtime/pull/3436 ">kubernetes-sigs/controller-runtime#3436</a></li>
<li>🌱 Test cache reader waits for cache sync by <a
href="https://github.com/k8s-infra-cherrypick-robot "><code>@k8s-infra-cherrypick-robot</code></a>
in <a
href="https://redirect.github.com/kubernetes-sigs/controller-runtime/pull/3438 ">kubernetes-sigs/controller-runtime#3438</a></li>
<li>🐛 Fakeclient: Fix status apply if existing object has
managedFields set by <a
href="https://github.com/k8s-infra-cherrypick-robot "><code>@k8s-infra-cherrypick-robot</code></a>
in <a
href="https://redirect.github.com/kubernetes-sigs/controller-runtime/pull/3437 ">kubernetes-sigs/controller-runtime#3437</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/kubernetes-sigs/controller-runtime/compare/v0.23.0...v0.23.1 ">https://github.com/kubernetes-sigs/controller-runtime/compare/v0.23.0...v0.23.1 </a></p>
<h2>v0.23.0</h2>
<h2>🔆 Highlights</h2>
<ul>
<li>Client: Add subresource Apply support by <a
href="https://github.com/alvaroaleman "><code>@alvaroaleman</code></a>
in <a
href="https://redirect.github.com/kubernetes-sigs/controller-runtime/pull/3321 ">kubernetes-sigs/controller-runtime#3321</a></li>
<li>Conversion: Enable implementation of conversion outside of API
packages by <a
href="https://github.com/sbueringer "><code>@sbueringer</code></a> in <a
href="https://redirect.github.com/kubernetes-sigs/controller-runtime/pull/3335 ">kubernetes-sigs/controller-runtime#3335</a></li>
<li>Priorityqueue: Various improvements, bug fixes and now enabled per
default</li>
<li>Webhooks: Generic Validator and Defaulter by <a
href="https://github.com/alvaroaleman "><code>@alvaroaleman</code></a>
in <a
href="https://redirect.github.com/kubernetes-sigs/controller-runtime/pull/3360 ">kubernetes-sigs/controller-runtime#3360</a></li>
</ul>
<h2>⚠️ Breaking changes</h2>
<ul>
<li>Dependencies: Update to k8s.io/* v1.35 by <a
href="https://github.com/alvaroaleman "><code>@alvaroaleman</code></a>
<a
href="https://github.com/dongjiang1989 "><code>@dongjiang1989</code></a>
<a href="https://github.com/kannon92 "><code>@kannon92</code></a> (<a
href="https://redirect.github.com/kubernetes-sigs/controller-runtime/issues/3316 ">#3316</a>,
<a
href="https://redirect.github.com/kubernetes-sigs/controller-runtime/issues/3349 ">#3349</a>,
<a
href="https://redirect.github.com/kubernetes-sigs/controller-runtime/issues/3386 ">#3386</a>,
<a
href="https://redirect.github.com/kubernetes-sigs/controller-runtime/issues/3391 ">#3391</a>,
<a
href="https://redirect.github.com/kubernetes-sigs/controller-runtime/issues/3401 ">#3401</a>)</li>
<li>Client: Add subresource Apply support by <a
href="https://github.com/alvaroaleman "><code>@alvaroaleman</code></a>
in <a
href="https://redirect.github.com/kubernetes-sigs/controller-runtime/pull/3321 ">kubernetes-sigs/controller-runtime#3321</a></li>
<li>Events: Migration to the new events API by <a
href="https://github.com/clebs "><code>@clebs</code></a> in <a
href="https://redirect.github.com/kubernetes-sigs/controller-runtime/pull/3262 ">kubernetes-sigs/controller-runtime#3262</a>
<ul>
<li>Using the new <code>GetEventRecorderFor</code> requires updating
your rbac for events to use the <code>events.k8s.io</code> apiGroup
rather than the `` (core) apiGroup</li>
</ul>
</li>
<li>Fakeclient: Set ResourceVersion for SSA Create by <a
href="https://github.com/alvaroaleman "><code>@alvaroaleman</code></a>
in <a
href="https://redirect.github.com/kubernetes-sigs/controller-runtime/pull/3311 ">kubernetes-sigs/controller-runtime#3311</a></li>
<li>Webhooks: Generic Validator and Defaulter by <a
href="https://github.com/alvaroaleman "><code>@alvaroaleman</code></a>
in <a
href="https://redirect.github.com/kubernetes-sigs/controller-runtime/pull/3360 ">kubernetes-sigs/controller-runtime#3360</a>
<ul>
<li>Existing code of the form
<code>builder.WebhookManagedBy(mgr).For(&corev1.Deployment{})</code>
has to be changed to <code>builder.WebhookManagedBy(mgr,
&appsv1.Deployment{})</code></li>
<li>Existing webhook implementations have to be changed to take the
concrete object rather than <code>runtime.Object</code>, for example
from <code>ValidateCreate(ctx context.Context, obj runtime.Object)
(admission.Warnings, error)</code> to <code>ValidateCreate(ctx
context.Context, obj *appsv1.Deployment) (admission.Warnings,
error)</code></li>
</ul>
</li>
</ul>
<h2>✨ Features</h2>
<ul>
<li>Cache: Allow fine-granular SyncPeriod configuration by <a
href="https://github.com/sbueringer "><code>@sbueringer</code></a> in <a
href="https://redirect.github.com/kubernetes-sigs/controller-runtime/pull/3376 ">kubernetes-sigs/controller-runtime#3376</a></li>
<li>Client: Add FieldOwner option to client.Options by <a
href="https://github.com/aerfio "><code>@aerfio</code></a> in <a
href="https://redirect.github.com/kubernetes-sigs/controller-runtime/pull/3389 ">kubernetes-sigs/controller-runtime#3389</a></li>
<li>Client: Add FieldValidation option to client.Options by <a
href="https://github.com/aerfio "><code>@aerfio</code></a> in <a
href="https://redirect.github.com/kubernetes-sigs/controller-runtime/pull/3393 ">kubernetes-sigs/controller-runtime#3393</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/kubernetes-sigs/controller-runtime/commit/f9589b9f2b9dddf8532b432bb8315f2820ab9971 "><code>f9589b9</code></a>
Merge pull request <a
href="https://redirect.github.com/kubernetes-sigs/controller-runtime/issues/3469 ">#3469</a>
from k8s-infra-cherrypick-robot/cherry-pick-3468-to-...</li>
<li><a
href="https://github.com/kubernetes-sigs/controller-runtime/commit/25615ad1d1229db805cec6b0f3f29f284fe53be1 "><code>25615ad</code></a>
Ensure DefaulterRemoveUnknownOrOmitableFields is still working even if
object...</li>
<li><a
href="https://github.com/kubernetes-sigs/controller-runtime/commit/8122a6266696b980fc9219c2fbb48bb4ce60d12b "><code>8122a62</code></a>
Merge pull request <a
href="https://redirect.github.com/kubernetes-sigs/controller-runtime/issues/3467 ">#3467</a>
from k8s-infra-cherrypick-robot/cherry-pick-3463-to-...</li>
<li><a
href="https://github.com/kubernetes-sigs/controller-runtime/commit/35093c6117da44c29f3a03d06e379d606814018d "><code>35093c6</code></a>
Reduce memory usage of default webhooks</li>
<li><a
href="https://github.com/kubernetes-sigs/controller-runtime/commit/4dbfa5c66aa24a35003c41507385c2a91e94d404 "><code>4dbfa5c</code></a>
[release-0.23] 🐛 Fix fake client's SSA status patch resource version
check (#...</li>
<li><a
href="https://github.com/kubernetes-sigs/controller-runtime/commit/f52bbb8bb1a2275cbe90dec8d6c12d5cacb1a7de "><code>f52bbb8</code></a>
Merge pull request <a
href="https://redirect.github.com/kubernetes-sigs/controller-runtime/issues/3437 ">#3437</a>
from k8s-infra-cherrypick-robot/cherry-pick-3430-to-...</li>
<li><a
href="https://github.com/kubernetes-sigs/controller-runtime/commit/4f41337fdd898537c6633a174cd539cb2e0c4d15 "><code>4f41337</code></a>
Merge pull request <a
href="https://redirect.github.com/kubernetes-sigs/controller-runtime/issues/3438 ">#3438</a>
from k8s-infra-cherrypick-robot/cherry-pick-3434-to-...</li>
<li><a
href="https://github.com/kubernetes-sigs/controller-runtime/commit/e29a1b93fae5c5f22c992c57b11dcf90ccc35c53 "><code>e29a1b9</code></a>
seedling: Test cache reader waits for cache sync</li>
<li><a
href="https://github.com/kubernetes-sigs/controller-runtime/commit/83c8dc31c46c621c336c8a7749ee41658b6d17e1 "><code>83c8dc3</code></a>
bug: Fakeclient: Fix status apply if existing object has managedFields
set</li>
<li><a
href="https://github.com/kubernetes-sigs/controller-runtime/commit/bf6bcd55b4d5eba00273426d61db313dcd2a6c7f "><code>bf6bcd5</code></a>
Merge pull request <a
href="https://redirect.github.com/kubernetes-sigs/controller-runtime/issues/3436 ">#3436</a>
from k8s-infra-cherrypick-robot/cherry-pick-3431-to-...</li>
<li>Additional commits viewable in <a
href="https://github.com/kubernetes-sigs/controller-runtime/compare/v0.20.0...v0.23.3 ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
---------
Signed-off-by: dependabot[bot] <support@github.com >
Signed-off-by: Philip Laine <philip.laine@gmail.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Philip Laine <philip.laine@gmail.com >
2026-03-11 14:18:09 +01:00
Bethuel Mmbaga and GitHub
5fb144559c
Add support for running as a init sidecar container ( #99 )
...
Adds support for injecting the client as a [sidecar
container](https://kubernetes.io/docs/concepts/workloads/pods/sidecar-containers/ )
using the `netbird.io/init-sidecar: "true"` pod annotation.
2026-02-11 15:20:52 +03:00
Christian De Leon and GitHub
6c855c5d4e
Fix: extra-dns-labels not being applied to pods ( #82 )
...
# Fix: NetBird extra-dns-labels not being applied to pods
## Problem
The `netbird.io/extra-dns-labels` annotation was not working when
applied to pods. Despite the webhook detecting the annotation and adding
it to the NetBird container configuration, the extra DNS labels were not
appearing in the NetBird UI or being applied to registered peers.
## Root Cause
The pod webhook had two issues:
1. **Invalid setup key argument**: The webhook was passing
`--setup-key-file /etc/nbkey` to the NetBird client, but this file path
was never created. The setup key was already being passed via the
`NB_SETUP_KEY` environment variable, making the file-based approach
unnecessary and causing confusion in the client startup.
2. **NetBird CLI flag bug**: The webhook was using the
`--extra-dns-labels` command line flag, but NetBird has a known issue
([netbirdio/netbird#4282 ](https://github.com/netbirdio/netbird/issues/4282 ))
where this flag is not properly processed. The workaround is to use the
`NB_EXTRA_DNS_LABELS` environment variable instead.
## Solution
- Removed the `--setup-key-file` argument entirely since the setup key
is provided via environment variable
- Removed all command line arguments from the NetBird container
- Added `NB_EXTRA_DNS_LABELS` environment variable when the
`netbird.io/extra-dns-labels` annotation is present
- NetBird client now uses only environment variables for configuration,
which is more reliable and matches the pattern used by the NBRoutingPeer
controller
## Changes
**Before:**
```go
args := []string{
"--setup-key-file", "/etc/nbkey",
"-m", managementURL,
}
// ... add extra-dns-labels to args
```
**After:**
```go
envVars := []corev1.EnvVar{
{Name: "NB_SETUP_KEY", ValueFrom: ...},
{Name: "NB_MANAGEMENT_URL", Value: managementURL},
}
// ... conditionally add NB_EXTRA_DNS_LABELS to envVars
```
## Testing
1. Create a deployment with the `netbird.io/setup-key` and
`netbird.io/extra-dns-labels` annotations:
```yaml
annotations:
netbird.io/setup-key: my-setup-key
netbird.io/extra-dns-labels: "my-label,another-label"
```
2. Verify the environment variable is set:
```bash
kubectl get pod <pod-name> -o jsonpath='{.spec.containers[?(@.name=="netbird")].env[*]}' | jq .
```
3. Check the NetBird UI to confirm the extra DNS labels appear on the
registered peer
4. Verify the NetBird container logs show successful registration
without errors
## References
- NetBird issue: https://github.com/netbirdio/netbird/issues/4282
- Documentation: [Extra DNS
Labels](https://docs.netbird.io/how-to/routing-traffic-to-private-networks#extra-dns-labels )
---
This fix ensures that the `netbird.io/extra-dns-labels` annotation works
as documented and provides a more robust configuration method by using
environment variables consistently across all NetBird deployments in the
operator.
2025-11-24 19:00:58 +02:00
M Essam Hamed
20b3ba60ba
Add optional Volume mounting for Client containers
2025-08-10 10:25:13 +03:00
166091b8e0
Add ingress feature to controller ( #5 )
...
Co-authored-by: Maycon Santos <mlsmaycon@gmail.com >
2025-03-06 09:57:45 +01:00
Hakan Sariman
289d6f25d3
add extra dns labels annotation
2025-02-22 14:32:22 +03:00
M. Essam and GitHub
64091a6439
Add initial version with help and admission controller ( #1 )
...
- It adds a helm chart that will be hosted in the Github pages URL of this repository
- an admission controller operator
- Basic documentation for installing the operator, configuring CRDs and example pod configuration
2025-01-29 22:44:09 +01:00
Philip LaineandGitHub
Bethuel MmbagaandGitHub
Christian De LeonandGitHub
M Essam Hamed
Hakan Sariman