Add optional privileged mode to NBRoutingPeerSpec (#92)

Introduced a new optional boolean field `Privileged` in the
`NBRoutingPeerSpec` to allow deployments to specify if containers should
run in privileged mode. Updated the CRD, Helm templates, and controller
logic to support this feature.

A new function `buildSecurityContext` was added to handle the creation
of the appropriate security context based on the `Privileged` setting.
Tests were updated to cover scenarios where privileged mode is enabled,
disabled, or unspecified. This change allows more granular control over
container security settings, potentially increasing compatibility with
certain workloads that require elevated privileges.

see https://github.com/netbirdio/kubernetes-operator/issues/90

**Note:**
I am not a Go developer and have no experience with this architecture. I
may have overlooked some things.
This commit is contained in:
Jan
2026-03-03 08:29:52 +01:00
committed by GitHub
parent 8ec7c8ded8
commit cbe0e3a2a1
7 changed files with 180 additions and 19 deletions
@@ -13,7 +13,7 @@ metadata:
name: router
namespace: {{ $k }}
{{ $spec := merge $defaults $v }}
{{- if or (or (or $spec.replicas $spec.resources) (or $spec.labels $spec.annotations)) (or $spec.nodeSelector $spec.tolerations) }}
{{- if or (or (or $spec.replicas $spec.resources) (or $spec.labels $spec.annotations)) (or (or $spec.nodeSelector $spec.tolerations) $spec.privileged) }}
spec:
{{- if $spec.replicas }}
replicas: {{ $spec.replicas }}
@@ -38,6 +38,9 @@ spec:
tolerations:
{{- toYaml $spec.tolerations | nindent 4 }}
{{- end }}
{{- if $spec.privileged }}
privileged: {{ $spec.privileged }}
{{- end }}
{{- end }}
---
{{- end }}
@@ -52,7 +55,7 @@ metadata:
app.kubernetes.io/component: operator
{{- include "netbird-operator-config.labels" $ | nindent 4 }}
name: router
{{- if or (or (or .replicas .resources) (or .labels .annotations)) (or .nodeSelector .tolerations) }}
{{- if or (or (or .replicas .resources) (or .labels .annotations)) (or (or .nodeSelector .tolerations) .privileged) }}
spec:
{{- if .replicas }}
replicas: {{ .replicas }}
@@ -77,6 +80,9 @@ spec:
tolerations:
{{- toYaml .tolerations | nindent 4 }}
{{- end }}
{{- if .privileged }}
privileged: {{ .privileged }}
{{- end }}
{{- end }}
{{- end }}
{{- end }}
+3 -1
View File
@@ -20,6 +20,7 @@ router:
# annotations: {}
# nodeSelector: {}
# tolerations: []
# privileged: false
# Only needed if namespacedNetworks is set to true
namespaces: {}
# default:
@@ -34,7 +35,8 @@ router:
# labels: {}
# annotations: {}
# nodeSelector: {}
# tolerations: []
# tolerations: []
# privileged: false
# NetBird Policies for use with exposed services
policies: {}
# default: