Add ingress feature to controller (#5)

Co-authored-by: Maycon Santos <mlsmaycon@gmail.com>

helm/kubernetes-operator/templates/_helpers.tpl

@@ -92,7 +92,7 @@ caCert: {{ index $secret.data "ca.crt" }}
 clientCert: {{ index $secret.data "tls.crt" }}
 clientKey: {{ index $secret.data "tls.key" }}
 {{- else -}}
-{{- $altNames := list (printf "%s.%s" $serviceName .Release.Namespace) (printf "%s.%s.svc" $serviceName .Release.Namespace) (printf "%s.%s.svc.%s" $serviceName .Release.Namespace .Values.webhook.cluster.dnsDomain) -}}
+{{- $altNames := list (printf "%s.%s" $serviceName .Release.Namespace) (printf "%s.%s.svc" $serviceName .Release.Namespace) (printf "%s.%s.%s" $serviceName .Release.Namespace .Values.cluster.dns) -}}
 {{- $ca := genCA "kubernetes-operator-ca" 3650 -}}
 {{- $cert := genSignedCert (include "kubernetes-operator.fullname" .) nil $altNames 3650 $ca -}}
 caCert: {{ $ca.Cert | b64enc }}

helm/kubernetes-operator/templates/deployment.yaml

@@ -48,6 +48,18 @@ spec:
           {{- if .Values.managementURL }}
           - --netbird-management-url={{.Values.managementURL}}
           {{- end }}
+          {{- if .Values.cluster.name }}
+          - --cluster-name={{.Values.cluster.name}}
+          {{- end }}
+          {{- if .Values.ingress.namespacedNetworks }}
+          - --namespaced-networks={{.Values.ingress.namespacedNetworks}}
+          {{- end }}
+          {{- if .Values.cluster.dns }}
+          - --cluster-dns={{.Values.cluster.dns}}
+          {{- end }}
+          {{- if or .Values.netbirdAPI.key .Values.netbirdAPI.keyFromSecret }}
+          - --netbird-api-key=$(NB_API_KEY)
+          {{- end }}
           ports:
             - name: webhook-server
               containerPort: {{ .Values.webhook.service.port }}
@@ -62,6 +74,15 @@ spec:
             periodSeconds: {{ .Values.operator.livenessProbe.periodSeconds }}
             successThreshold: {{ .Values.operator.livenessProbe.successThreshold }}
             timeoutSeconds: {{ .Values.operator.livenessProbe.timeoutSeconds }}
+          {{- if or .Values.netbirdAPI.key .Values.netbirdAPI.keyFromSecret }}
+          envFrom:
+            - secretRef:
+                {{- if .Values.netbirdAPI.keyFromSecret }}
+                name: {{.Values.netbirdAPI.keyFromSecret}}
+                {{- else }}
+                name: {{ include "kubernetes-operator.fullname" . }}
+                {{- end }}
+          {{- end }}
           readinessProbe:
             failureThreshold: 3
             httpGet:

helm/kubernetes-operator/templates/nbpolicies.yaml

@@ -0,0 +1,28 @@
+{{- range $k, $v := $.Values.ingress.policies }}
+---
+apiVersion: netbird.io/v1
+kind: NBPolicy
+metadata:
+  finalizers:
+    - netbird.io/cleanup
+  labels:
+    app.kubernetes.io/component: operator
+    {{- include "kubernetes-operator.labels" $ | nindent 4 }}
+  name: {{ $k }}
+spec:
+  name: {{ $v.name }}
+  sourceGroups:
+  {{ toYaml $v.sourceGroups | nindent 4}}
+  {{- if $v.description }}
+  description: {{ $v.description }}
+  {{- end }}
+  {{- if $v.protocols }}
+  protocols: {{ $v.protocols }}
+  {{- end }}
+  {{- if $v.ports }}
+  ports: {{ $v.ports }}
+  {{- end }}
+  {{- if hasKey $v "bidirectional" }}
+  bidirectional: {{ $v.bidirectional }}
+  {{- end }}
+{{- end }}

helm/kubernetes-operator/templates/nbroutingpeers.yaml

@@ -0,0 +1,75 @@
+{{- if and .Values.ingress.enabled .Values.ingress.router.enabled }}
+{{- if .Values.ingress.namespacedNetworks }}
+{{ $defaults := .Values.ingress.router }}
+{{ range $k, $v := .Values.ingress.router.namespaces }}
+apiVersion: netbird.io/v1
+kind: NBRoutingPeer
+metadata:
+  finalizers:
+    - netbird.io/cleanup
+  labels:
+    app.kubernetes.io/component: operator
+    {{- include "kubernetes-operator.labels" $ | nindent 4 }}
+  name: router
+  namespace: {{ $k }}
+{{ $spec := merge $defaults $v }}
+{{- if or (or (or $spec.replicas $spec.resources) (or $spec.labels $spec.annotations)) (or $spec.nodeSelector $spec.tolerations) }}
+spec:
+  {{- if $spec.replicas }}
+  replicas: {{ $spec.replicas }}
+  {{- end }}
+  {{- if $spec.resources }}
+  resources: {{ $spec.resources }}
+  {{- end }}
+  {{- if $spec.labels }}
+  labels: {{ $spec.labels }}
+  {{- end }}
+  {{- if $spec.annotations }}
+  annotations: {{ $spec.annotations }}
+  {{- end }}
+  {{- if $spec.nodeSelector }}
+  nodeSelector: {{ $spec.nodeSelector }}
+  {{- end }}
+  {{- if $spec.tolerations }}
+  tolerations: {{ $spec.tolerations }}
+  {{- end }}
+{{- end }}
+---
+{{- end }}
+{{- else }}
+{{- with .Values.ingress.router }}
+apiVersion: netbird.io/v1
+kind: NBRoutingPeer
+metadata:
+  finalizers:
+    - netbird.io/cleanup
+  labels:
+    app.kubernetes.io/component: operator
+    {{- include "kubernetes-operator.labels" $ | nindent 4 }}
+  name: router
+{{- if or (or (or .replicas .resources) (or .labels .annotations)) (or .nodeSelector .tolerations) }}
+spec:
+  {{- if .replicas }}
+  replicas: {{ .replicas }}
+  {{- end }}
+  {{- if .resources }}
+  resources: {{ .resources }}
+  {{- end }}
+  {{- if .labels }}
+  labels: {{ .labels }}
+  {{- end }}
+  {{- if .annotations }}
+  annotations: {{ .annotations }}
+  {{- end }}
+  {{- if .nodeSelector }}
+  nodeSelector: {{ .nodeSelector }}
+  {{- end }}
+  {{- if .tolerations }}
+  tolerations: {{ .tolerations }}
+  {{- end }}
+{{- else }}
+spec: {}
+{{- end }}
+{{- end }}
+{{- end }}
+{{- end }}

helm/kubernetes-operator/templates/pre-delete.yaml

@@ -0,0 +1,69 @@
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: {{ include "kubernetes-operator.fullname" . }}-delete-routers
+  labels:
+    app.kubernetes.io/component: operator
+    {{- include "kubernetes-operator.labels" . | nindent 4 }}
+  annotations:
+    helm.sh/hook: pre-delete
+    helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
+spec:
+  backOffLimit: 3
+  template:
+    metadata:
+      name: {{ include "kubernetes-operator.fullname" . }}
+      labels:
+        app.kubernetes.io/component: operator
+        {{- include "kubernetes-operator.labels" . | nindent 8 }}
+        {{- with .Values.operator.podLabels }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
+    spec:
+      containers:
+      - name: pre-delete
+        image: "bitnami/kubectl:latest"
+        args:
+        - delete
+        - --all
+        - -A
+        - --cascade=foreground
+        - --ignore-not-found
+        - NBRoutingPeer
+      serviceAccountName: {{ include "kubernetes-operator.serviceAccountName" . }}
+      restartPolicy: Never
+---
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: {{ include "kubernetes-operator.fullname" . }}-delete-policies
+  labels:
+    app.kubernetes.io/component: operator
+    {{- include "kubernetes-operator.labels" . | nindent 4 }}
+  annotations:
+    helm.sh/hook: pre-delete
+    helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
+spec:
+  backOffLimit: 3
+  template:
+    metadata:
+      name: {{ include "kubernetes-operator.fullname" . }}
+      labels:
+        app.kubernetes.io/component: operator
+        {{- include "kubernetes-operator.labels" . | nindent 8 }}
+        {{- with .Values.operator.podLabels }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
+    spec:
+      containers:
+      - name: pre-delete
+        image: "bitnami/kubectl:latest"
+        args:
+        - delete
+        - --all
+        - --cascade=foreground
+        - --ignore-not-found
+        - NBPolicy
+      serviceAccountName: {{ include "kubernetes-operator.serviceAccountName" . }}
+      restartPolicy: Never
+---

helm/kubernetes-operator/templates/rbac.yaml

@@ -27,6 +27,79 @@ rules:
   - get
   - patch
   - update
+{{- if .Values.ingress.enabled }}
+- apiGroups:
+  - netbird.io
+  resources:
+  - nbgroups
+  - nbresources
+  - nbroutingpeers
+  - nbpolicies
+  verbs:
+  - get
+  - patch
+  - update
+  - list
+  - watch
+  - create
+  - delete
+- apiGroups:
+  - netbird.io
+  resources:
+  - nbgroups/status
+  - nbresources/status
+  - nbroutingpeers/status
+  - nbpolicies/status
+  verbs:
+  - get
+  - patch
+  - update
+- apiGroups:
+  - netbird.io
+  resources:
+  - nbgroups/finalizers
+  - nbresources/finalizers
+  - nbroutingpeers/finalizers
+  - nbpolicies/finalizers
+  verbs:
+  - update
+- apiGroups:
+  - ""
+  resources:
+  - services
+  verbs:
+  - get
+  - list
+  - watch
+  - update
+  - patch
+- apiGroups:
+  - ""
+  resources:
+  - namespaces
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - ""
+  resources:
+  - services/finalizers
+  verbs:
+  - update
+- apiGroups:
+  - apps
+  resources:
+  - deployments
+  verbs:
+  - get
+  - patch
+  - update
+  - list
+  - watch
+  - create
+  - delete
+{{- end }}
 - apiGroups:
   - ""
   resources:
@@ -35,7 +108,7 @@ rules:
   - get
   - list
   - watch
-{{- if .Values.clusterSecretsPermissions.allowAllSecrets }}
+{{- if or .Values.ingress.enabled .Values.clusterSecretsPermissions.allowAllSecrets }}
 - apiGroups:
   - ""
   resources:
@@ -44,6 +117,12 @@ rules:
   - get
   - list
   - watch
+{{- if .Values.ingress.enabled }}
+  - patch
+  - update
+  - create
+  - delete
+{{- end }}
 {{- end }}
 ---
 apiVersion: rbac.authorization.k8s.io/v1

helm/kubernetes-operator/templates/secret.yaml

@@ -0,0 +1,11 @@
+{{- if .Values.netbirdAPI.key }}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ include "kubernetes-operator.fullname" . }}
+  labels:
+    app.kubernetes.io/component: operator
+    {{- include "kubernetes-operator.labels" . | nindent 4 }}
+stringData:
+  NB_API_KEY: {{ .Values.netbirdAPI.key }}
+{{- end }}

helm/kubernetes-operator/templates/webhook.yaml

@@ -12,7 +12,7 @@ metadata:
     {{- include "kubernetes-operator.labels" . | nindent 4 }}
 webhooks:
 - clientConfig:
-    {{- if not $.Values.webhook.enableCertManager -}}
+    {{- if not $.Values.webhook.enableCertManager }}
     caBundle: {{ $tls.caCert }}
     {{ end }}
     service:
@@ -64,7 +64,7 @@ metadata:
     {{- include "kubernetes-operator.labels" . | nindent 4 }}
 webhooks:
 - clientConfig:
-    {{- if not $.Values.webhook.enableCertManager -}}
+    {{- if not $.Values.webhook.enableCertManager }}
     caBundle: {{ $tls.caCert }}
     {{ end }}
     service:
@@ -89,8 +89,127 @@ webhooks:
     - CREATE
     - UPDATE
     resources:
-    - "*/*"
+    - "nbsetupkeys"
   sideEffects: None
+{{- if and $.Values.ingress.enabled (or .Values.netbirdAPI.key .Values.netbirdAPI.keyFromSecret) }}
+---
+apiVersion: admissionregistration.k8s.io/v1
+kind: ValidatingWebhookConfiguration
+metadata:
+{{- if $.Values.webhook.enableCertManager }}
+  annotations:
+    cert-manager.io/inject-ca-from: {{ .Release.Namespace }}/{{ template "kubernetes-operator.fullname" . }}-serving-cert
+{{- end }}
+  name: {{ include "kubernetes-operator.fullname" . }}-vnbresource-webhook
+  labels:
+    {{- include "kubernetes-operator.labels" . | nindent 4 }}
+webhooks:
+- clientConfig:
+    {{- if not $.Values.webhook.enableCertManager }}
+    caBundle: {{ $tls.caCert }}
+    {{ end }}
+    service:
+      name: {{ template "kubernetes-operator.webhookService" . }}
+      namespace: {{ $.Release.Namespace }}
+      path: /validate-netbird-io-v1-nbresource
+  failurePolicy: Fail
+  name: vnbresource-v1.netbird.io
+  admissionReviewVersions:
+  - v1
+  {{- if .Values.webhook.namespaceSelectors }}
+  namespaceSelector:
+    matchExpressions:
+    {{ toYaml .Values.webhook.namespaceSelectors | nindent 4 }}
+  {{ end }}
+  rules:
+  - apiGroups:
+    - netbird.io
+    apiVersions:
+    - v1
+    operations:
+    - DELETE
+    resources:
+    - "nbresources"
+  sideEffects: None
+---
+apiVersion: admissionregistration.k8s.io/v1
+kind: ValidatingWebhookConfiguration
+metadata:
+{{- if $.Values.webhook.enableCertManager }}
+  annotations:
+    cert-manager.io/inject-ca-from: {{ .Release.Namespace }}/{{ template "kubernetes-operator.fullname" . }}-serving-cert
+{{- end }}
+  name: {{ include "kubernetes-operator.fullname" . }}-vnbroutingpeer-webhook
+  labels:
+    {{- include "kubernetes-operator.labels" . | nindent 4 }}
+webhooks:
+- clientConfig:
+    {{- if not $.Values.webhook.enableCertManager }}
+    caBundle: {{ $tls.caCert }}
+    {{ end }}
+    service:
+      name: {{ template "kubernetes-operator.webhookService" . }}
+      namespace: {{ $.Release.Namespace }}
+      path: /validate-netbird-io-v1-nbroutingpeer
+  failurePolicy: Fail
+  name: vnbroutingpeer-v1.netbird.io
+  admissionReviewVersions:
+  - v1
+  {{- if .Values.webhook.namespaceSelectors }}
+  namespaceSelector:
+    matchExpressions:
+    {{ toYaml .Values.webhook.namespaceSelectors | nindent 4 }}
+  {{ end }}
+  rules:
+  - apiGroups:
+    - netbird.io
+    apiVersions:
+    - v1
+    operations:
+    - DELETE
+    resources:
+    - "nbroutingpeers"
+  sideEffects: None
+---
+apiVersion: admissionregistration.k8s.io/v1
+kind: ValidatingWebhookConfiguration
+metadata:
+{{- if $.Values.webhook.enableCertManager }}
+  annotations:
+    cert-manager.io/inject-ca-from: {{ .Release.Namespace }}/{{ template "kubernetes-operator.fullname" . }}-serving-cert
+{{- end }}
+  name: {{ include "kubernetes-operator.fullname" . }}-vnbgroup-webhook
+  labels:
+    {{- include "kubernetes-operator.labels" . | nindent 4 }}
+webhooks:
+- clientConfig:
+    {{- if not $.Values.webhook.enableCertManager }}
+    caBundle: {{ $tls.caCert }}
+    {{ end }}
+    service:
+      name: {{ template "kubernetes-operator.webhookService" . }}
+      namespace: {{ $.Release.Namespace }}
+      path: /validate-netbird-io-v1-nbgroup
+  failurePolicy: Fail
+  name: vnbgroup-v1.netbird.io
+  admissionReviewVersions:
+  - v1
+  {{- if .Values.webhook.namespaceSelectors }}
+  namespaceSelector:
+    matchExpressions:
+    {{ toYaml .Values.webhook.namespaceSelectors | nindent 4 }}
+  {{ end }}
+  rules:
+  - apiGroups:
+    - netbird.io
+    apiVersions:
+    - v1
+    operations:
+    - DELETE
+    resources:
+    - "nbgroups"
+  sideEffects: None
+{{- end }}
 ---
 {{- if not $.Values.webhook.enableCertManager }}
 apiVersion: v1
@@ -116,7 +235,7 @@ metadata:
 spec:
   dnsNames:
   - {{ template "kubernetes-operator.webhookService" . }}.{{ .Release.Namespace }}.svc
-  - {{ template "kubernetes-operator.webhookService" . }}.{{ .Release.Namespace }}.svc.{{ .Values.webhook.cluster.dnsDomain }}
+  - {{ template "kubernetes-operator.webhookService" . }}.{{ .Release.Namespace }}.{{ .Values.cluster.dns }}
   issuerRef:
     kind: Issuer
     name: {{ template "kubernetes-operator.fullname" . }}-selfsigned-issuer