Add ingress feature to controller (#5)

Co-authored-by: Maycon Santos <mlsmaycon@gmail.com>

helm/kubernetes-operator/Chart.yaml

@@ -2,5 +2,5 @@ apiVersion: v2
 name: kubernetes-operator
 description: A Helm chart for Kubernetes
 type: application
-version: 0.1.0
-appVersion: "v0.1.0"
+version: 0.1.2
+appVersion: "v0.1.0-rc.3"

helm/kubernetes-operator/crds/netbird.io_nbgroups.yaml

@@ -0,0 +1,95 @@
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    controller-gen.kubebuilder.io/version: v0.17.1
+  name: nbgroups.netbird.io
+spec:
+  group: netbird.io
+  names:
+    kind: NBGroup
+    listKind: NBGroupList
+    plural: nbgroups
+    singular: nbgroup
+  scope: Namespaced
+  versions:
+  - name: v1
+    schema:
+      openAPIV3Schema:
+        description: NBGroup is the Schema for the nbgroups API.
+        properties:
+          apiVersion:
+            description: |-
+              APIVersion defines the versioned schema of this representation of an object.
+              Servers should convert recognized schemas to the latest internal value, and
+              may reject unrecognized values.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+            type: string
+          kind:
+            description: |-
+              Kind is a string value representing the REST resource this object represents.
+              Servers may infer this from the endpoint the client submits requests to.
+              Cannot be updated.
+              In CamelCase.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+            type: string
+          metadata:
+            type: object
+          spec:
+            description: NBGroupSpec defines the desired state of NBGroup.
+            properties:
+              name:
+                minLength: 1
+                type: string
+                x-kubernetes-validations:
+                - message: Value is immutable
+                  rule: self == oldSelf
+            required:
+            - name
+            type: object
+          status:
+            description: NBGroupStatus defines the observed state of NBGroup.
+            properties:
+              conditions:
+                items:
+                  description: NBCondition defines a condition in NBSetupKey status.
+                  properties:
+                    lastProbeTime:
+                      description: Last time we probed the condition.
+                      format: date-time
+                      type: string
+                    lastTransitionTime:
+                      description: Last time the condition transitioned from one status
+                        to another.
+                      format: date-time
+                      type: string
+                    message:
+                      description: Human-readable message indicating details about
+                        last transition.
+                      type: string
+                    reason:
+                      description: Unique, one-word, CamelCase reason for the condition's
+                        last transition.
+                      type: string
+                    status:
+                      description: |-
+                        Status is the status of the condition.
+                        Can be True, False, Unknown.
+                      type: string
+                    type:
+                      description: Type is the type of the condition.
+                      type: string
+                  required:
+                  - status
+                  - type
+                  type: object
+                type: array
+              groupID:
+                type: string
+            type: object
+        type: object
+    served: true
+    storage: true
+    subresources:
+      status: {}

helm/kubernetes-operator/crds/netbird.io_nbpolicies.yaml

@@ -0,0 +1,131 @@
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    controller-gen.kubebuilder.io/version: v0.17.1
+  name: nbpolicies.netbird.io
+spec:
+  group: netbird.io
+  names:
+    kind: NBPolicy
+    listKind: NBPolicyList
+    plural: nbpolicies
+    singular: nbpolicy
+  scope: Cluster
+  versions:
+  - name: v1
+    schema:
+      openAPIV3Schema:
+        description: NBPolicy is the Schema for the nbpolicies API.
+        properties:
+          apiVersion:
+            description: |-
+              APIVersion defines the versioned schema of this representation of an object.
+              Servers should convert recognized schemas to the latest internal value, and
+              may reject unrecognized values.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+            type: string
+          kind:
+            description: |-
+              Kind is a string value representing the REST resource this object represents.
+              Servers may infer this from the endpoint the client submits requests to.
+              Cannot be updated.
+              In CamelCase.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+            type: string
+          metadata:
+            type: object
+          spec:
+            description: NBPolicySpec defines the desired state of NBPolicy.
+            properties:
+              bidirectional:
+                default: true
+                type: boolean
+              description:
+                type: string
+              destinationGroups:
+                items:
+                  minLength: 1
+                  type: string
+                type: array
+              name:
+                description: Name Policy name
+                minLength: 1
+                type: string
+              ports:
+                items:
+                  format: int32
+                  maximum: 65535
+                  minimum: 0
+                  type: integer
+                type: array
+              protocols:
+                items:
+                  enum:
+                  - tcp
+                  - udp
+                  type: string
+                type: array
+              sourceGroups:
+                items:
+                  minLength: 1
+                  type: string
+                type: array
+            required:
+            - name
+            type: object
+          status:
+            description: NBPolicyStatus defines the observed state of NBPolicy.
+            properties:
+              conditions:
+                items:
+                  description: NBCondition defines a condition in NBSetupKey status.
+                  properties:
+                    lastProbeTime:
+                      description: Last time we probed the condition.
+                      format: date-time
+                      type: string
+                    lastTransitionTime:
+                      description: Last time the condition transitioned from one status
+                        to another.
+                      format: date-time
+                      type: string
+                    message:
+                      description: Human-readable message indicating details about
+                        last transition.
+                      type: string
+                    reason:
+                      description: Unique, one-word, CamelCase reason for the condition's
+                        last transition.
+                      type: string
+                    status:
+                      description: |-
+                        Status is the status of the condition.
+                        Can be True, False, Unknown.
+                      type: string
+                    type:
+                      description: Type is the type of the condition.
+                      type: string
+                  required:
+                  - status
+                  - type
+                  type: object
+                type: array
+              lastUpdatedAt:
+                format: date-time
+                type: string
+              managedServiceList:
+                items:
+                  type: string
+                type: array
+              tcpPolicyID:
+                type: string
+              udpPolicyID:
+                type: string
+            type: object
+        type: object
+    served: true
+    storage: true
+    subresources:
+      status: {}

helm/kubernetes-operator/crds/netbird.io_nbresources.yaml

@@ -0,0 +1,136 @@
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    controller-gen.kubebuilder.io/version: v0.17.1
+  name: nbresources.netbird.io
+spec:
+  group: netbird.io
+  names:
+    kind: NBResource
+    listKind: NBResourceList
+    plural: nbresources
+    singular: nbresource
+  scope: Namespaced
+  versions:
+  - name: v1
+    schema:
+      openAPIV3Schema:
+        description: NBResource is the Schema for the nbresources API.
+        properties:
+          apiVersion:
+            description: |-
+              APIVersion defines the versioned schema of this representation of an object.
+              Servers should convert recognized schemas to the latest internal value, and
+              may reject unrecognized values.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+            type: string
+          kind:
+            description: |-
+              Kind is a string value representing the REST resource this object represents.
+              Servers may infer this from the endpoint the client submits requests to.
+              Cannot be updated.
+              In CamelCase.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+            type: string
+          metadata:
+            type: object
+          spec:
+            description: NBResourceSpec defines the desired state of NBResource.
+            properties:
+              address:
+                minLength: 1
+                type: string
+              groups:
+                items:
+                  minLength: 1
+                  type: string
+                type: array
+              name:
+                minLength: 1
+                type: string
+              networkID:
+                type: string
+                x-kubernetes-validations:
+                - message: Value is immutable
+                  rule: self == oldSelf
+              policyName:
+                type: string
+              tcpPorts:
+                items:
+                  format: int32
+                  type: integer
+                type: array
+              udpPorts:
+                items:
+                  format: int32
+                  type: integer
+                type: array
+            required:
+            - address
+            - groups
+            - name
+            - networkID
+            type: object
+          status:
+            description: NBResourceStatus defines the observed state of NBResource.
+            properties:
+              conditions:
+                items:
+                  description: NBCondition defines a condition in NBSetupKey status.
+                  properties:
+                    lastProbeTime:
+                      description: Last time we probed the condition.
+                      format: date-time
+                      type: string
+                    lastTransitionTime:
+                      description: Last time the condition transitioned from one status
+                        to another.
+                      format: date-time
+                      type: string
+                    message:
+                      description: Human-readable message indicating details about
+                        last transition.
+                      type: string
+                    reason:
+                      description: Unique, one-word, CamelCase reason for the condition's
+                        last transition.
+                      type: string
+                    status:
+                      description: |-
+                        Status is the status of the condition.
+                        Can be True, False, Unknown.
+                      type: string
+                    type:
+                      description: Type is the type of the condition.
+                      type: string
+                  required:
+                  - status
+                  - type
+                  type: object
+                type: array
+              groups:
+                items:
+                  type: string
+                type: array
+              networkResourceID:
+                type: string
+              policyName:
+                type: string
+              tcpPorts:
+                items:
+                  format: int32
+                  type: integer
+                type: array
+              udpPorts:
+                items:
+                  format: int32
+                  type: integer
+                type: array
+            type: object
+        type: object
+    served: true
+    storage: true
+    subresources:
+      status: {}

helm/kubernetes-operator/crds/netbird.io_nbroutingpeers.yaml

@@ -0,0 +1,203 @@
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    controller-gen.kubebuilder.io/version: v0.17.1
+  name: nbroutingpeers.netbird.io
+spec:
+  group: netbird.io
+  names:
+    kind: NBRoutingPeer
+    listKind: NBRoutingPeerList
+    plural: nbroutingpeers
+    singular: nbroutingpeer
+  scope: Namespaced
+  versions:
+  - name: v1
+    schema:
+      openAPIV3Schema:
+        description: NBRoutingPeer is the Schema for the nbroutingpeers API.
+        properties:
+          apiVersion:
+            description: |-
+              APIVersion defines the versioned schema of this representation of an object.
+              Servers should convert recognized schemas to the latest internal value, and
+              may reject unrecognized values.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+            type: string
+          kind:
+            description: |-
+              Kind is a string value representing the REST resource this object represents.
+              Servers may infer this from the endpoint the client submits requests to.
+              Cannot be updated.
+              In CamelCase.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+            type: string
+          metadata:
+            type: object
+          spec:
+            description: NBRoutingPeerSpec defines the desired state of NBRoutingPeer.
+            properties:
+              annotations:
+                additionalProperties:
+                  type: string
+                type: object
+              labels:
+                additionalProperties:
+                  type: string
+                type: object
+              nodeSelector:
+                additionalProperties:
+                  type: string
+                type: object
+              replicas:
+                format: int32
+                type: integer
+              resources:
+                description: ResourceRequirements describes the compute resource requirements.
+                properties:
+                  claims:
+                    description: |-
+                      Claims lists the names of resources, defined in spec.resourceClaims,
+                      that are used by this container.
+
+                      This is an alpha field and requires enabling the
+                      DynamicResourceAllocation feature gate.
+
+                      This field is immutable. It can only be set for containers.
+                    items:
+                      description: ResourceClaim references one entry in PodSpec.ResourceClaims.
+                      properties:
+                        name:
+                          description: |-
+                            Name must match the name of one entry in pod.spec.resourceClaims of
+                            the Pod where this field is used. It makes that resource available
+                            inside a container.
+                          type: string
+                        request:
+                          description: |-
+                            Request is the name chosen for a request in the referenced claim.
+                            If empty, everything from the claim is made available, otherwise
+                            only the result of this request.
+                          type: string
+                      required:
+                      - name
+                      type: object
+                    type: array
+                    x-kubernetes-list-map-keys:
+                    - name
+                    x-kubernetes-list-type: map
+                  limits:
+                    additionalProperties:
+                      anyOf:
+                      - type: integer
+                      - type: string
+                      pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                      x-kubernetes-int-or-string: true
+                    description: |-
+                      Limits describes the maximum amount of compute resources allowed.
+                      More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
+                    type: object
+                  requests:
+                    additionalProperties:
+                      anyOf:
+                      - type: integer
+                      - type: string
+                      pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                      x-kubernetes-int-or-string: true
+                    description: |-
+                      Requests describes the minimum amount of compute resources required.
+                      If Requests is omitted for a container, it defaults to Limits if that is explicitly specified,
+                      otherwise to an implementation-defined value. Requests cannot exceed Limits.
+                      More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
+                    type: object
+                type: object
+              tolerations:
+                items:
+                  description: |-
+                    The pod this Toleration is attached to tolerates any taint that matches
+                    the triple <key,value,effect> using the matching operator <operator>.
+                  properties:
+                    effect:
+                      description: |-
+                        Effect indicates the taint effect to match. Empty means match all taint effects.
+                        When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute.
+                      type: string
+                    key:
+                      description: |-
+                        Key is the taint key that the toleration applies to. Empty means match all taint keys.
+                        If the key is empty, operator must be Exists; this combination means to match all values and all keys.
+                      type: string
+                    operator:
+                      description: |-
+                        Operator represents a key's relationship to the value.
+                        Valid operators are Exists and Equal. Defaults to Equal.
+                        Exists is equivalent to wildcard for value, so that a pod can
+                        tolerate all taints of a particular category.
+                      type: string
+                    tolerationSeconds:
+                      description: |-
+                        TolerationSeconds represents the period of time the toleration (which must be
+                        of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default,
+                        it is not set, which means tolerate the taint forever (do not evict). Zero and
+                        negative values will be treated as 0 (evict immediately) by the system.
+                      format: int64
+                      type: integer
+                    value:
+                      description: |-
+                        Value is the taint value the toleration matches to.
+                        If the operator is Exists, the value should be empty, otherwise just a regular string.
+                      type: string
+                  type: object
+                type: array
+            type: object
+          status:
+            description: NBRoutingPeerStatus defines the observed state of NBRoutingPeer.
+            properties:
+              conditions:
+                items:
+                  description: NBCondition defines a condition in NBSetupKey status.
+                  properties:
+                    lastProbeTime:
+                      description: Last time we probed the condition.
+                      format: date-time
+                      type: string
+                    lastTransitionTime:
+                      description: Last time the condition transitioned from one status
+                        to another.
+                      format: date-time
+                      type: string
+                    message:
+                      description: Human-readable message indicating details about
+                        last transition.
+                      type: string
+                    reason:
+                      description: Unique, one-word, CamelCase reason for the condition's
+                        last transition.
+                      type: string
+                    status:
+                      description: |-
+                        Status is the status of the condition.
+                        Can be True, False, Unknown.
+                      type: string
+                    type:
+                      description: Type is the type of the condition.
+                      type: string
+                  required:
+                  - status
+                  - type
+                  type: object
+                type: array
+              networkID:
+                type: string
+              routerID:
+                type: string
+              setupKeyID:
+                type: string
+            type: object
+        type: object
+    served: true
+    storage: true
+    subresources:
+      status: {}

helm/kubernetes-operator/crds/netbird.io_nbsetupkeys.yaml

@@ -75,8 +75,7 @@ spec:
             properties:
               conditions:
                 items:
-                  description: NBSetupKeyCondition defines a condition in NBSetupKey
-                    status.
+                  description: NBCondition defines a condition in NBSetupKey status.
                   properties:
                     lastProbeTime:
                       description: Last time we probed the condition.

helm/kubernetes-operator/templates/_helpers.tpl

@@ -92,7 +92,7 @@ caCert: {{ index $secret.data "ca.crt" }}
 clientCert: {{ index $secret.data "tls.crt" }}
 clientKey: {{ index $secret.data "tls.key" }}
 {{- else -}}
-{{- $altNames := list (printf "%s.%s" $serviceName .Release.Namespace) (printf "%s.%s.svc" $serviceName .Release.Namespace) (printf "%s.%s.svc.%s" $serviceName .Release.Namespace .Values.webhook.cluster.dnsDomain) -}}
+{{- $altNames := list (printf "%s.%s" $serviceName .Release.Namespace) (printf "%s.%s.svc" $serviceName .Release.Namespace) (printf "%s.%s.%s" $serviceName .Release.Namespace .Values.cluster.dns) -}}
 {{- $ca := genCA "kubernetes-operator-ca" 3650 -}}
 {{- $cert := genSignedCert (include "kubernetes-operator.fullname" .) nil $altNames 3650 $ca -}}
 caCert: {{ $ca.Cert | b64enc }}

helm/kubernetes-operator/templates/deployment.yaml

@@ -48,6 +48,18 @@ spec:
           {{- if .Values.managementURL }}
           - --netbird-management-url={{.Values.managementURL}}
           {{- end }}
+          {{- if .Values.cluster.name }}
+          - --cluster-name={{.Values.cluster.name}}
+          {{- end }}
+          {{- if .Values.ingress.namespacedNetworks }}
+          - --namespaced-networks={{.Values.ingress.namespacedNetworks}}
+          {{- end }}
+          {{- if .Values.cluster.dns }}
+          - --cluster-dns={{.Values.cluster.dns}}
+          {{- end }}
+          {{- if or .Values.netbirdAPI.key .Values.netbirdAPI.keyFromSecret }}
+          - --netbird-api-key=$(NB_API_KEY)
+          {{- end }}
           ports:
             - name: webhook-server
               containerPort: {{ .Values.webhook.service.port }}
@@ -62,6 +74,15 @@ spec:
             periodSeconds: {{ .Values.operator.livenessProbe.periodSeconds }}
             successThreshold: {{ .Values.operator.livenessProbe.successThreshold }}
             timeoutSeconds: {{ .Values.operator.livenessProbe.timeoutSeconds }}
+          {{- if or .Values.netbirdAPI.key .Values.netbirdAPI.keyFromSecret }}
+          envFrom:
+            - secretRef:
+                {{- if .Values.netbirdAPI.keyFromSecret }}
+                name: {{.Values.netbirdAPI.keyFromSecret}}
+                {{- else }}
+                name: {{ include "kubernetes-operator.fullname" . }}
+                {{- end }}
+          {{- end }}
           readinessProbe:
             failureThreshold: 3
             httpGet:

helm/kubernetes-operator/templates/nbpolicies.yaml

@@ -0,0 +1,28 @@
+{{- range $k, $v := $.Values.ingress.policies }}
+---
+apiVersion: netbird.io/v1
+kind: NBPolicy
+metadata:
+  finalizers:
+    - netbird.io/cleanup
+  labels:
+    app.kubernetes.io/component: operator
+    {{- include "kubernetes-operator.labels" $ | nindent 4 }}
+  name: {{ $k }}
+spec:
+  name: {{ $v.name }}
+  sourceGroups:
+  {{ toYaml $v.sourceGroups | nindent 4}}
+  {{- if $v.description }}
+  description: {{ $v.description }}
+  {{- end }}
+  {{- if $v.protocols }}
+  protocols: {{ $v.protocols }}
+  {{- end }}
+  {{- if $v.ports }}
+  ports: {{ $v.ports }}
+  {{- end }}
+  {{- if hasKey $v "bidirectional" }}
+  bidirectional: {{ $v.bidirectional }}
+  {{- end }}
+{{- end }}

helm/kubernetes-operator/templates/nbroutingpeers.yaml

@@ -0,0 +1,75 @@
+{{- if and .Values.ingress.enabled .Values.ingress.router.enabled }}
+{{- if .Values.ingress.namespacedNetworks }}
+{{ $defaults := .Values.ingress.router }}
+{{ range $k, $v := .Values.ingress.router.namespaces }}
+apiVersion: netbird.io/v1
+kind: NBRoutingPeer
+metadata:
+  finalizers:
+    - netbird.io/cleanup
+  labels:
+    app.kubernetes.io/component: operator
+    {{- include "kubernetes-operator.labels" $ | nindent 4 }}
+  name: router
+  namespace: {{ $k }}
+{{ $spec := merge $defaults $v }}
+{{- if or (or (or $spec.replicas $spec.resources) (or $spec.labels $spec.annotations)) (or $spec.nodeSelector $spec.tolerations) }}
+spec:
+  {{- if $spec.replicas }}
+  replicas: {{ $spec.replicas }}
+  {{- end }}
+  {{- if $spec.resources }}
+  resources: {{ $spec.resources }}
+  {{- end }}
+  {{- if $spec.labels }}
+  labels: {{ $spec.labels }}
+  {{- end }}
+  {{- if $spec.annotations }}
+  annotations: {{ $spec.annotations }}
+  {{- end }}
+  {{- if $spec.nodeSelector }}
+  nodeSelector: {{ $spec.nodeSelector }}
+  {{- end }}
+  {{- if $spec.tolerations }}
+  tolerations: {{ $spec.tolerations }}
+  {{- end }}
+{{- end }}
+---
+{{- end }}
+{{- else }}
+{{- with .Values.ingress.router }}
+apiVersion: netbird.io/v1
+kind: NBRoutingPeer
+metadata:
+  finalizers:
+    - netbird.io/cleanup
+  labels:
+    app.kubernetes.io/component: operator
+    {{- include "kubernetes-operator.labels" $ | nindent 4 }}
+  name: router
+{{- if or (or (or .replicas .resources) (or .labels .annotations)) (or .nodeSelector .tolerations) }}
+spec:
+  {{- if .replicas }}
+  replicas: {{ .replicas }}
+  {{- end }}
+  {{- if .resources }}
+  resources: {{ .resources }}
+  {{- end }}
+  {{- if .labels }}
+  labels: {{ .labels }}
+  {{- end }}
+  {{- if .annotations }}
+  annotations: {{ .annotations }}
+  {{- end }}
+  {{- if .nodeSelector }}
+  nodeSelector: {{ .nodeSelector }}
+  {{- end }}
+  {{- if .tolerations }}
+  tolerations: {{ .tolerations }}
+  {{- end }}
+{{- else }}
+spec: {}
+{{- end }}
+{{- end }}
+{{- end }}
+{{- end }}

helm/kubernetes-operator/templates/pre-delete.yaml

@@ -0,0 +1,69 @@
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: {{ include "kubernetes-operator.fullname" . }}-delete-routers
+  labels:
+    app.kubernetes.io/component: operator
+    {{- include "kubernetes-operator.labels" . | nindent 4 }}
+  annotations:
+    helm.sh/hook: pre-delete
+    helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
+spec:
+  backOffLimit: 3
+  template:
+    metadata:
+      name: {{ include "kubernetes-operator.fullname" . }}
+      labels:
+        app.kubernetes.io/component: operator
+        {{- include "kubernetes-operator.labels" . | nindent 8 }}
+        {{- with .Values.operator.podLabels }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
+    spec:
+      containers:
+      - name: pre-delete
+        image: "bitnami/kubectl:latest"
+        args:
+        - delete
+        - --all
+        - -A
+        - --cascade=foreground
+        - --ignore-not-found
+        - NBRoutingPeer
+      serviceAccountName: {{ include "kubernetes-operator.serviceAccountName" . }}
+      restartPolicy: Never
+---
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: {{ include "kubernetes-operator.fullname" . }}-delete-policies
+  labels:
+    app.kubernetes.io/component: operator
+    {{- include "kubernetes-operator.labels" . | nindent 4 }}
+  annotations:
+    helm.sh/hook: pre-delete
+    helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
+spec:
+  backOffLimit: 3
+  template:
+    metadata:
+      name: {{ include "kubernetes-operator.fullname" . }}
+      labels:
+        app.kubernetes.io/component: operator
+        {{- include "kubernetes-operator.labels" . | nindent 8 }}
+        {{- with .Values.operator.podLabels }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
+    spec:
+      containers:
+      - name: pre-delete
+        image: "bitnami/kubectl:latest"
+        args:
+        - delete
+        - --all
+        - --cascade=foreground
+        - --ignore-not-found
+        - NBPolicy
+      serviceAccountName: {{ include "kubernetes-operator.serviceAccountName" . }}
+      restartPolicy: Never
+---

helm/kubernetes-operator/templates/rbac.yaml

@@ -27,6 +27,79 @@ rules:
   - get
   - patch
   - update
+{{- if .Values.ingress.enabled }}
+- apiGroups:
+  - netbird.io
+  resources:
+  - nbgroups
+  - nbresources
+  - nbroutingpeers
+  - nbpolicies
+  verbs:
+  - get
+  - patch
+  - update
+  - list
+  - watch
+  - create
+  - delete
+- apiGroups:
+  - netbird.io
+  resources:
+  - nbgroups/status
+  - nbresources/status
+  - nbroutingpeers/status
+  - nbpolicies/status
+  verbs:
+  - get
+  - patch
+  - update
+- apiGroups:
+  - netbird.io
+  resources:
+  - nbgroups/finalizers
+  - nbresources/finalizers
+  - nbroutingpeers/finalizers
+  - nbpolicies/finalizers
+  verbs:
+  - update
+- apiGroups:
+  - ""
+  resources:
+  - services
+  verbs:
+  - get
+  - list
+  - watch
+  - update
+  - patch
+- apiGroups:
+  - ""
+  resources:
+  - namespaces
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - ""
+  resources:
+  - services/finalizers
+  verbs:
+  - update
+- apiGroups:
+  - apps
+  resources:
+  - deployments
+  verbs:
+  - get
+  - patch
+  - update
+  - list
+  - watch
+  - create
+  - delete
+{{- end }}
 - apiGroups:
   - ""
   resources:
@@ -35,7 +108,7 @@ rules:
   - get
   - list
   - watch
-{{- if .Values.clusterSecretsPermissions.allowAllSecrets }}
+{{- if or .Values.ingress.enabled .Values.clusterSecretsPermissions.allowAllSecrets }}
 - apiGroups:
   - ""
   resources:
@@ -44,6 +117,12 @@ rules:
   - get
   - list
   - watch
+{{- if .Values.ingress.enabled }}
+  - patch
+  - update
+  - create
+  - delete
+{{- end }}
 {{- end }}
 ---
 apiVersion: rbac.authorization.k8s.io/v1

helm/kubernetes-operator/templates/secret.yaml

@@ -0,0 +1,11 @@
+{{- if .Values.netbirdAPI.key }}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ include "kubernetes-operator.fullname" . }}
+  labels:
+    app.kubernetes.io/component: operator
+    {{- include "kubernetes-operator.labels" . | nindent 4 }}
+stringData:
+  NB_API_KEY: {{ .Values.netbirdAPI.key }}
+{{- end }}

helm/kubernetes-operator/templates/webhook.yaml

@@ -12,7 +12,7 @@ metadata:
     {{- include "kubernetes-operator.labels" . | nindent 4 }}
 webhooks:
 - clientConfig:
-    {{- if not $.Values.webhook.enableCertManager -}}
+    {{- if not $.Values.webhook.enableCertManager }}
     caBundle: {{ $tls.caCert }}
     {{ end }}
     service:
@@ -64,7 +64,7 @@ metadata:
     {{- include "kubernetes-operator.labels" . | nindent 4 }}
 webhooks:
 - clientConfig:
-    {{- if not $.Values.webhook.enableCertManager -}}
+    {{- if not $.Values.webhook.enableCertManager }}
     caBundle: {{ $tls.caCert }}
     {{ end }}
     service:
@@ -89,8 +89,127 @@ webhooks:
     - CREATE
     - UPDATE
     resources:
-    - "*/*"
+    - "nbsetupkeys"
   sideEffects: None
+{{- if and $.Values.ingress.enabled (or .Values.netbirdAPI.key .Values.netbirdAPI.keyFromSecret) }}
+---
+apiVersion: admissionregistration.k8s.io/v1
+kind: ValidatingWebhookConfiguration
+metadata:
+{{- if $.Values.webhook.enableCertManager }}
+  annotations:
+    cert-manager.io/inject-ca-from: {{ .Release.Namespace }}/{{ template "kubernetes-operator.fullname" . }}-serving-cert
+{{- end }}
+  name: {{ include "kubernetes-operator.fullname" . }}-vnbresource-webhook
+  labels:
+    {{- include "kubernetes-operator.labels" . | nindent 4 }}
+webhooks:
+- clientConfig:
+    {{- if not $.Values.webhook.enableCertManager }}
+    caBundle: {{ $tls.caCert }}
+    {{ end }}
+    service:
+      name: {{ template "kubernetes-operator.webhookService" . }}
+      namespace: {{ $.Release.Namespace }}
+      path: /validate-netbird-io-v1-nbresource
+  failurePolicy: Fail
+  name: vnbresource-v1.netbird.io
+  admissionReviewVersions:
+  - v1
+  {{- if .Values.webhook.namespaceSelectors }}
+  namespaceSelector:
+    matchExpressions:
+    {{ toYaml .Values.webhook.namespaceSelectors | nindent 4 }}
+  {{ end }}
+  rules:
+  - apiGroups:
+    - netbird.io
+    apiVersions:
+    - v1
+    operations:
+    - DELETE
+    resources:
+    - "nbresources"
+  sideEffects: None
+---
+apiVersion: admissionregistration.k8s.io/v1
+kind: ValidatingWebhookConfiguration
+metadata:
+{{- if $.Values.webhook.enableCertManager }}
+  annotations:
+    cert-manager.io/inject-ca-from: {{ .Release.Namespace }}/{{ template "kubernetes-operator.fullname" . }}-serving-cert
+{{- end }}
+  name: {{ include "kubernetes-operator.fullname" . }}-vnbroutingpeer-webhook
+  labels:
+    {{- include "kubernetes-operator.labels" . | nindent 4 }}
+webhooks:
+- clientConfig:
+    {{- if not $.Values.webhook.enableCertManager }}
+    caBundle: {{ $tls.caCert }}
+    {{ end }}
+    service:
+      name: {{ template "kubernetes-operator.webhookService" . }}
+      namespace: {{ $.Release.Namespace }}
+      path: /validate-netbird-io-v1-nbroutingpeer
+  failurePolicy: Fail
+  name: vnbroutingpeer-v1.netbird.io
+  admissionReviewVersions:
+  - v1
+  {{- if .Values.webhook.namespaceSelectors }}
+  namespaceSelector:
+    matchExpressions:
+    {{ toYaml .Values.webhook.namespaceSelectors | nindent 4 }}
+  {{ end }}
+  rules:
+  - apiGroups:
+    - netbird.io
+    apiVersions:
+    - v1
+    operations:
+    - DELETE
+    resources:
+    - "nbroutingpeers"
+  sideEffects: None
+---
+apiVersion: admissionregistration.k8s.io/v1
+kind: ValidatingWebhookConfiguration
+metadata:
+{{- if $.Values.webhook.enableCertManager }}
+  annotations:
+    cert-manager.io/inject-ca-from: {{ .Release.Namespace }}/{{ template "kubernetes-operator.fullname" . }}-serving-cert
+{{- end }}
+  name: {{ include "kubernetes-operator.fullname" . }}-vnbgroup-webhook
+  labels:
+    {{- include "kubernetes-operator.labels" . | nindent 4 }}
+webhooks:
+- clientConfig:
+    {{- if not $.Values.webhook.enableCertManager }}
+    caBundle: {{ $tls.caCert }}
+    {{ end }}
+    service:
+      name: {{ template "kubernetes-operator.webhookService" . }}
+      namespace: {{ $.Release.Namespace }}
+      path: /validate-netbird-io-v1-nbgroup
+  failurePolicy: Fail
+  name: vnbgroup-v1.netbird.io
+  admissionReviewVersions:
+  - v1
+  {{- if .Values.webhook.namespaceSelectors }}
+  namespaceSelector:
+    matchExpressions:
+    {{ toYaml .Values.webhook.namespaceSelectors | nindent 4 }}
+  {{ end }}
+  rules:
+  - apiGroups:
+    - netbird.io
+    apiVersions:
+    - v1
+    operations:
+    - DELETE
+    resources:
+    - "nbgroups"
+  sideEffects: None
+{{- end }}
 ---
 {{- if not $.Values.webhook.enableCertManager }}
 apiVersion: v1
@@ -116,7 +235,7 @@ metadata:
 spec:
   dnsNames:
   - {{ template "kubernetes-operator.webhookService" . }}.{{ .Release.Namespace }}.svc
-  - {{ template "kubernetes-operator.webhookService" . }}.{{ .Release.Namespace }}.svc.{{ .Values.webhook.cluster.dnsDomain }}
+  - {{ template "kubernetes-operator.webhookService" . }}.{{ .Release.Namespace }}.{{ .Values.cluster.dns }}
   issuerRef:
     kind: Issuer
     name: {{ template "kubernetes-operator.fullname" . }}-selfsigned-issuer

helm/kubernetes-operator/values.yaml

@@ -1,4 +1,6 @@
 clusterSecretsPermissions:
+  # Required for NBSetupKey validation
+  # Required for Ingress functionality to create and validate secrets for routing peers
   allowAllSecrets: true
 
 webhook:
@@ -7,22 +9,21 @@ webhook:
     port: 443
     targetPort: 9443
 
-  cluster:
-    # Cluster DNS domain (required for requesting TLS certificates)
-    dnsDomain: cluster.local
-
   # TLS configuration for webhook
+  # Optional, unused if webhook.enableCertManager is set to true
   tls: {}
 
-  # Use cert-manager to provision webhook certificates
+  # Use cert-manager to provision webhook certificates (recommended)
   enableCertManager: true
 
+  # Narrow down validation and mutation webhooks namespaces
   namespaceSelectors: []
     # - key: foo
     #   operator: In
     #   values:
     #   - bar
 
+  # Narrow down validation and mutation webhooks objects
   objectSelector:
     matchExpressions: []
       # - key: app.kubernetes.io/name
@@ -128,3 +129,56 @@ operator:
   tolerations: []
 
   affinity: {}
+
+ingress:
+  # Enable ingress capabilities to expose services
+  enabled: false
+  # Create router per namespace, useful for strict networking requirements
+  namespacedNetworks: false
+  router:
+    # Deploy routing peer(s)
+    enabled: false
+    # replicas: 3
+    # resources:
+    #   requests:
+    #     cpu: 100m
+    #     memory: 100Mi
+    #   limits:
+    #     cpu: 100m
+    #     memory: 100Mi
+    # labels: {}
+    # annotations: {}
+    # nodeSelector: {}
+    # tolerations: []
+    # Only needed if namespacedNetworks is set to true
+    namespaces: {}
+      # default:
+        # replicas: 3
+        # resources:
+        #   requests:
+        #     cpu: 100m
+        #     memory: 100Mi
+        #   limits:
+        #     cpu: 100m
+        #     memory: 100Mi
+        # labels: {}
+        # annotations: {}
+        # nodeSelector: {}
+        # tolerations: []
+  # NetBird Policies for use with exposed services
+  policies: {}
+    # default:
+    #   name: Kubernetes Default Policy
+    #   sourceGroups:
+    #   - All
+
+cluster:
+  # Cluster DNS name (used for webhooks certificates and for network resource DNS names)
+  dns: svc.cluster.local
+  # Cluster name (used for generating network and network resource names in NetBird)
+  # name: kubernetes
+
+netbirdAPI: {}
+  # NetBird Service Account Token
+  # key: "nbp_m0LM9ZZvDUzFO0pY50iChDOTxJgKFM3DIqmZ"
+  # keyFromSecret: "Secret name with NB_API_KEY=Service Account Token"