Philip Laine and GitHub
627e388cb3
Change GC label to avoid triggering reconcile when updating timestamp ( #380 )
...
This removes the use of timestamp to do GC for orphaned endpoint slices.
Instead we delete any endpoint slice copy that no longer exist by
including the upstream endpoint slice name in a label. This has the same
effect as the timestamp but avoids updating the label value on each
reconcile.
Supersedes #377
<!-- codesmith:footer -->
---
<a
href="https://app.blacksmith.sh/netbirdio/codesmith/kubernetes-operator/pr/380 "><picture><source
media="(prefers-color-scheme: dark)"
srcset="https://pr-comments-assets.blacksmith.sh/codesmith/view-with-codesmith-dark-v2.svg "><source
media="(prefers-color-scheme: light)"
srcset="https://pr-comments-assets.blacksmith.sh/codesmith/view-with-codesmith-light-v2.svg "><img
alt="View with Codesmith"
src="https://pr-comments-assets.blacksmith.sh/codesmith/view-with-codesmith-dark-v2.svg "></picture></a>
<a
href="https://backend.blacksmith.sh/track/enable-autofix?expires=1787313622&installation_model_id=427504&pr_number=380&repository=netbirdio%2Fkubernetes-operator&return_to=https%3A%2F%2Fgithub.com%2Fnetbirdio%2Fkubernetes-operator%2Fpull%2F380&signature=f09d17ae5a5b00dcedbdbb84ceb75de82025ba1bec2039d1f7ebd63f47bf8dd0 "><picture><source
media="(prefers-color-scheme: dark)"
srcset="https://pr-comments-assets.blacksmith.sh/codesmith/autofix-with-codesmith-dark.svg "><source
media="(prefers-color-scheme: light)"
srcset="https://pr-comments-assets.blacksmith.sh/codesmith/autofix-with-codesmith-light.svg "><img
alt="Autofix with Codesmith"
src="https://pr-comments-assets.blacksmith.sh/codesmith/autofix-with-codesmith-dark.svg "></picture></a>
<sup>Need help on this PR? Tag <code>/codesmith</code> with what you
need. Autofix is disabled.</sup>
<!-- codesmith:autofix:disabled -->
<!-- /codesmith:footer -->
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Improved cleanup of stale egress endpoint slices without relying on
time-based labels.
* Ensured managed endpoint slices keep stable, deterministic
identification across reconciliations.
* Reduced unnecessary endpoint-slice replacement during updates.
* **Refactor**
* Reorganized egress port computation to simplify reconciliation logic.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
2026-07-23 16:29:06 +02:00
e752d1587f
Bump github.com/netbirdio/netbird from 0.72.4 to 0.74.7 ( #376 )
...
Bumps
[github.com/netbirdio/netbird](https://github.com/netbirdio/netbird )
from 0.72.4 to 0.74.7.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/netbirdio/netbird/releases ">github.com/netbirdio/netbird's
releases</a>.</em></p>
<blockquote>
<h2>v0.74.7</h2>
<h2>What's Changed</h2>
<ul>
<li>[relay] Handle QUIC connections concurrently to prevent handshake
head-of-line blocking by <a
href="https://github.com/lixmal "><code>@lixmal</code></a> in <a
href="https://redirect.github.com/netbirdio/netbird/pull/6784 ">netbirdio/netbird#6784</a></li>
<li>[client] Reject leading hyphen in getent input to prevent flag
injection by <a
href="https://github.com/lixmal "><code>@lixmal</code></a> in <a
href="https://redirect.github.com/netbirdio/netbird/pull/6787 ">netbirdio/netbird#6787</a></li>
<li>[client] Sanitize peer FQDN/hostname in generated SSH config by <a
href="https://github.com/riccardomanfrin "><code>@riccardomanfrin</code></a>
in <a
href="https://redirect.github.com/netbirdio/netbird/pull/6805 ">netbirdio/netbird#6805</a></li>
<li>[client] Disable gVisor TCP RACK loss detection on Windows by <a
href="https://github.com/lixmal "><code>@lixmal</code></a> in <a
href="https://redirect.github.com/netbirdio/netbird/pull/6808 ">netbirdio/netbird#6808</a></li>
<li>[client] Rename isValidAccessToken to reflect audience-only check by
<a
href="https://github.com/riccardomanfrin "><code>@riccardomanfrin</code></a>
in <a
href="https://redirect.github.com/netbirdio/netbird/pull/6806 ">netbirdio/netbird#6806</a></li>
<li>[client] Bind netstack SOCKS5 proxy to 127.0.0.1 by default by <a
href="https://github.com/riccardomanfrin "><code>@riccardomanfrin</code></a>
in <a
href="https://redirect.github.com/netbirdio/netbird/pull/6812 ">netbirdio/netbird#6812</a></li>
<li>[client] Evaluate IP fragments against firewall ACLs by <a
href="https://github.com/lixmal "><code>@lixmal</code></a> in <a
href="https://redirect.github.com/netbirdio/netbird/pull/6781 ">netbirdio/netbird#6781</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/netbirdio/netbird/compare/v0.74.6...v0.74.7 ">https://github.com/netbirdio/netbird/compare/v0.74.6...v0.74.7 </a></p>
<h2>v0.74.6</h2>
<h2>What's Changed</h2>
<ul>
<li>[client] ios: preserve WireGuard key on interactive re-login (<a
href="https://redirect.github.com/netbirdio/netbird/issues/6777 ">#6777</a>)</li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/netbirdio/netbird/compare/v0.74.5...v0.74.6 ">https://github.com/netbirdio/netbird/compare/v0.74.5...v0.74.6 </a></p>
<h2>v0.74.5</h2>
<h2>What's Changed</h2>
<ul>
<li>[proxy] enforce model allowlist for URL-routed providers
(Bedrock/Vertex) by <a
href="https://github.com/mlsmaycon "><code>@mlsmaycon</code></a> in <a
href="https://redirect.github.com/netbirdio/netbird/pull/6764 ">netbirdio/netbird#6764</a></li>
<li>[management] Remove proxy peer stale deduplication logic by <a
href="https://github.com/mlsmaycon "><code>@mlsmaycon</code></a> in <a
href="https://redirect.github.com/netbirdio/netbird/pull/6768 ">netbirdio/netbird#6768</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/netbirdio/netbird/compare/v0.74.4...v0.74.5 ">https://github.com/netbirdio/netbird/compare/v0.74.4...v0.74.5 </a></p>
<h2>v0.74.4</h2>
<h2>What's Changed</h2>
<ul>
<li>[management] fix: prevent reverse proxy domain from being pushed as
DNS search domain by <a
href="https://github.com/blaugrau90 "><code>@blaugrau90</code></a> in <a
href="https://redirect.github.com/netbirdio/netbird/pull/6498 ">netbirdio/netbird#6498</a></li>
<li>[client] Recover from rosenpass key desync by <a
href="https://github.com/lixmal "><code>@lixmal</code></a> in <a
href="https://redirect.github.com/netbirdio/netbird/pull/6714 ">netbirdio/netbird#6714</a></li>
<li>[client] Bump golang.org/x/crypto to v0.54.0 by <a
href="https://github.com/lixmal "><code>@lixmal</code></a> in <a
href="https://redirect.github.com/netbirdio/netbird/pull/6709 ">netbirdio/netbird#6709</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a
href="https://github.com/blaugrau90 "><code>@blaugrau90</code></a> made
their first contribution in <a
href="https://redirect.github.com/netbirdio/netbird/pull/6498 ">netbirdio/netbird#6498</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/netbirdio/netbird/compare/v0.74.3...v0.74.4 ">https://github.com/netbirdio/netbird/compare/v0.74.3...v0.74.4 </a></p>
<h2>v0.74.3</h2>
<h2>What's Changed</h2>
<ul>
<li>[client] fix MDM managementURL conflict on default-port URL echo by
<a
href="https://github.com/riccardomanfrin "><code>@riccardomanfrin</code></a>
in <a
href="https://redirect.github.com/netbirdio/netbird/pull/6672 ">netbirdio/netbird#6672</a></li>
<li>[client] Update gopsutil to v4 by <a
href="https://github.com/mlsmaycon "><code>@mlsmaycon</code></a> in <a
href="https://redirect.github.com/netbirdio/netbird/pull/6688 ">netbirdio/netbird#6688</a></li>
<li>[client] Fix hanging status command during relay dial by <a
href="https://github.com/theodorsm "><code>@theodorsm</code></a> in <a
href="https://redirect.github.com/netbirdio/netbird/pull/6694 ">netbirdio/netbird#6694</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/netbirdio/netbird/compare/v0.74.2...v0.74.3 ">https://github.com/netbirdio/netbird/compare/v0.74.2...v0.74.3 </a></p>
<h2>v0.74.2</h2>
<h2>What's Changed</h2>
<ul>
<li>[management] Add vLLM e2e test by <a
href="https://github.com/braginini "><code>@braginini</code></a> in <a
href="https://redirect.github.com/netbirdio/netbird/pull/6649 ">netbirdio/netbird#6649</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/netbirdio/netbird/commit/a1c9427d8004576e2cbb9e546d409847fa9df318 "><code>a1c9427</code></a>
[client] Evaluate IP fragments against firewall ACLs (<a
href="https://redirect.github.com/netbirdio/netbird/issues/6781 ">#6781</a>)</li>
<li><a
href="https://github.com/netbirdio/netbird/commit/b7b0d5796e988ac5f369d51d3a16b162d5fb9522 "><code>b7b0d57</code></a>
[client] Bind netstack SOCKS5 proxy to 127.0.0.1 by default (<a
href="https://redirect.github.com/netbirdio/netbird/issues/6812 ">#6812</a>)</li>
<li><a
href="https://github.com/netbirdio/netbird/commit/3f8c4473783424e1642d2991b896add973249d97 "><code>3f8c447</code></a>
[client] Rename isValidAccessToken to reflect audience-only check (<a
href="https://redirect.github.com/netbirdio/netbird/issues/6806 ">#6806</a>)</li>
<li><a
href="https://github.com/netbirdio/netbird/commit/6e3f4d8722d1c3f4482c44aec725aaba80c4512c "><code>6e3f4d8</code></a>
[client] Disable gVisor TCP RACK loss detection on Windows (<a
href="https://redirect.github.com/netbirdio/netbird/issues/6808 ">#6808</a>)</li>
<li><a
href="https://github.com/netbirdio/netbird/commit/099ae4bc6cc8ab95ef16343acb87c33b8197711c "><code>099ae4b</code></a>
[client] Sanitize peer FQDN/hostname in generated SSH config (<a
href="https://redirect.github.com/netbirdio/netbird/issues/6805 ">#6805</a>)</li>
<li><a
href="https://github.com/netbirdio/netbird/commit/63d60ba490794eebd0ad5ce77e4d31269e9c793b "><code>63d60ba</code></a>
[client] Reject leading hyphen in getent input to prevent flag injection
(<a
href="https://redirect.github.com/netbirdio/netbird/issues/6787 ">#6787</a>)</li>
<li><a
href="https://github.com/netbirdio/netbird/commit/62fc8d254e636c3053ae8a21c4ea075558a8273f "><code>62fc8d2</code></a>
[relay] Handle QUIC connections concurrently to prevent handshake
head-of-lin...</li>
<li><a
href="https://github.com/netbirdio/netbird/commit/3a2f773d655d88d16ed953fc2a114a4e690a1b08 "><code>3a2f773</code></a>
[client] preserve WireGuard key on interactive re-login (<a
href="https://redirect.github.com/netbirdio/netbird/issues/6777 ">#6777</a>)</li>
<li><a
href="https://github.com/netbirdio/netbird/commit/f0eed7564f3a9138962da1408986e4666d7137b5 "><code>f0eed75</code></a>
[management] Remove proxy peer stale deduplication logic (<a
href="https://redirect.github.com/netbirdio/netbird/issues/6768 ">#6768</a>)</li>
<li><a
href="https://github.com/netbirdio/netbird/commit/277d8e4c5352950e1ec4fbd21a3266f0412b09fe "><code>277d8e4</code></a>
[proxy] enforce model allowlist for URL-routed providers
(Bedrock/Vertex) (<a
href="https://redirect.github.com/netbirdio/netbird/issues/6 ">#6</a>...</li>
<li>Additional commits viewable in <a
href="https://github.com/netbirdio/netbird/compare/v0.72.4...v0.74.7 ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
<!-- codesmith:footer -->
---
<a
href="https://app.blacksmith.sh/netbirdio/codesmith/kubernetes-operator/pr/376 "><picture><source
media="(prefers-color-scheme: dark)"
srcset="https://pr-comments-assets.blacksmith.sh/codesmith/view-with-codesmith-dark-v2.svg "><source
media="(prefers-color-scheme: light)"
srcset="https://pr-comments-assets.blacksmith.sh/codesmith/view-with-codesmith-light-v2.svg "><img
alt="View with Codesmith"
src="https://pr-comments-assets.blacksmith.sh/codesmith/view-with-codesmith-dark-v2.svg "></picture></a>
<a
href="https://backend.blacksmith.sh/track/enable-autofix?expires=1787085769&installation_id=146802194&pr_number=376&repository=netbirdio%2Fkubernetes-operator&return_to=https%3A%2F%2Fgithub.com%2Fnetbirdio%2Fkubernetes-operator%2Fpull%2F376&signature=2f50a4b5245bbba3f14f2249365f03c700d30db07e15709056766b6a716394dd "><picture><source
media="(prefers-color-scheme: dark)"
srcset="https://pr-comments-assets.blacksmith.sh/codesmith/autofix-with-codesmith-dark.svg "><source
media="(prefers-color-scheme: light)"
srcset="https://pr-comments-assets.blacksmith.sh/codesmith/autofix-with-codesmith-light.svg "><img
alt="Autofix with Codesmith"
src="https://pr-comments-assets.blacksmith.sh/codesmith/autofix-with-codesmith-dark.svg "></picture></a>
<sup>Need help on this PR? Tag <code>/codesmith</code> with what you
need. Autofix is disabled.</sup>
<!-- codesmith:autofix:disabled -->
<!-- /codesmith:footer -->
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-21 11:04:59 +02:00
Philip Laine and GitHub
ea2dafd5a3
Add network egress resource ( #357 )
...
This change adds a new import resource which enables exposing Netbird
resources as Kubernetes services. This remove the need to add sidecars
to every pod.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added a new `NetworkEgress` custom resource (`netbird.io/v1alpha1`)
with CRD, schema validation, and status/conditions.
* Extended controller functionality to create egress services and
translate egress rules into import `EndpointSlice` resources; egress
pods now include a kube-egress-forwarder sidecar.
* **Bug Fixes**
* Added missing deep-copy and declarative apply support for the new
`NetworkEgress` API types.
* **Documentation**
* Updated README/API reference and added example manifests for
`NetworkEgress` (including IP/FQDN target usage).
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Signed-off-by: Philip Laine <philip.laine@gmail.com >
2026-07-17 08:06:53 +02:00
Philip Laine and GitHub
84e9bff602
Add Gateway API CRDs to controller test data ( #340 )
...
The PR #335 is adding controller tests for the HTTP route which means it
needs the CRDs. So simplify future testing work we will vendor the CRDs
from the release inside of the testdata directory. This is setup so that
changes to the GW API version will force generate to be run again.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated the generated Gateway API artifacts used in the build pipeline
to ensure the latest `standard-install.yaml` content is bundled.
* Kept the bundled Gateway API version synchronized automatically by
deriving it from the project’s module version and regenerating the asset
when dependencies change.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
2026-06-25 10:45:09 +02:00
Philip Laine and GitHub
447bbc76cd
Ensure netbird sidecar container starts first ( #339 )
...
This changes the webhook from appending the container to the end to the
beginning.
Fixes #323
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Fixed pod injection ordering: injected components are now placed at
the start of their respective lists to ensure correct initialization.
* Updated injected sidecar behavior, including setting the restart
policy to keep it running consistently.
* Adjusted init-container ordering to ensure DNS-related initialization
runs first.
* **Tests**
* Improved coverage by validating both container and sidecar injection
modes, including restart policy and injected annotation behavior.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
2026-06-25 10:44:53 +02:00
Philip Laine and GitHub
b82544250f
Make sidecar profile containers read only by default ( #333 )
...
This applies the same changes made to the network router to the sidecar
profile container. Majority of users want read only containers so it
should be the default.
Fixes #312
Fixes #292
Fixes #144
2026-06-23 16:12:40 +02:00
Philip Laine and GitHub
10f40da0e7
Add NetBird server to test connections ( #328 )
...
This change adds a NetBird server to the e2e test and ensures that
cluster proxy peers can start and connect to the server.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Changes**
* Updated the `ClusterProxy` `spec.apiServer` default to include a
trailing `/` when omitted, aligning operator behavior with the
Kubernetes in-cluster API URL.
* **Documentation**
* Refreshed the `ClusterProxySpec.apiServer` API reference to reflect
the trailing `/` default.
* **Tests**
* Improved end-to-end coverage with a dynamically provisioned management
URL, more robust readiness polling, and enhanced `ClusterProxy`
validation.
* **Chores**
* Updated the end-to-end test Go configuration and CI to use the
e2e-specific Go settings/toolchain.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
2026-06-23 14:50:47 +02:00
Philip Laine and GitHub
da90b6ae42
Add groups option to cluster proxy ( #297 )
...
This change adds an option to specify groups a cluster proxy peer is a
member of.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added optional `spec.groups` to the ClusterProxy custom resource to
associate group references by `id`, `name`, or `localRef`.
* CRD schema includes OpenAPI validation to enforce that each group
reference specifies exactly one selector.
* **Bug Fixes**
* Improved deep-copy behavior for ClusterProxy spec so group references
are copied safely and don’t share underlying slices.
* **Documentation**
* Updated API reference docs and README API table to include the new
`groups` field.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
2026-06-16 10:49:57 +02:00
Philip Laine and GitHub
67e0ce4e40
Update version of api proxy ( #310 )
...
This change updates the api proxy version and configures a readiness
probe.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Release Notes
* **Improvements**
* Enhanced cluster proxy health monitoring with readiness checks.
* Increased cluster proxy replicas to 3 for improved availability and
resilience.
* Updated kubeapi-proxy to the latest version.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
2026-06-16 10:39:59 +02:00
Philip Laine and GitHub
305bc9ca34
Force ownership on apply to resolve conflicts with manual edits ( #309 )
...
If not set the apply will error if a resource has been manually edited.
This changes all apply calls to use force ownership.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Release Notes
* **Bug Fixes**
* Fixed resource ownership handling across multiple controllers to
ensure proper claim and management of Kubernetes resources during
deployment and reconciliation operations.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
2026-06-15 21:25:55 +02:00
07212d1f72
Bump github.com/netbirdio/netbird from 0.72.2 to 0.72.4 ( #304 )
...
Bumps
[github.com/netbirdio/netbird](https://github.com/netbirdio/netbird )
from 0.72.2 to 0.72.4.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/netbirdio/netbird/releases ">github.com/netbirdio/netbird's
releases</a>.</em></p>
<blockquote>
<h2>v0.72.4</h2>
<h2>What's Changed</h2>
<ul>
<li>[client] Index peer tunnel IPs for faster PeerStateByIP lookup by <a
href="https://github.com/mlsmaycon "><code>@mlsmaycon</code></a> in <a
href="https://redirect.github.com/netbirdio/netbird/pull/6412 ">netbirdio/netbird#6412</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/netbirdio/netbird/compare/v0.72.3...v0.72.4 ">https://github.com/netbirdio/netbird/compare/v0.72.3...v0.72.4 </a></p>
<h2>v0.72.3</h2>
<h2>Release Notes for v0.72.3</h2>
<h3>What's New</h3>
<h4>Client Improvements</h4>
<ul>
<li>Added commands to <strong>discover and write Kubernetes
configuration</strong>. <code>experimental</code>
<a
href="https://redirect.github.com/netbirdio/netbird/pull/6260 ">netbirdio/netbird#6260</a></li>
<li>Masked <strong>sensitive data during debug bundle
creation</strong>.<br />
<a
href="https://redirect.github.com/netbirdio/netbird/pull/6364 ">netbirdio/netbird#6364</a></li>
<li>Preserved <strong>user deselect-all route preferences across
management syncs</strong>.<br />
<a
href="https://redirect.github.com/netbirdio/netbird/pull/6363 ">netbirdio/netbird#6363</a></li>
<li>Fixed <strong>state manager crashes caused by concurrent iptables
map access</strong>.<br />
<a
href="https://redirect.github.com/netbirdio/netbird/pull/6345 ">netbirdio/netbird#6345</a></li>
<li>Added <strong>WebSocket relay fallback</strong> when QUIC datagrams
exceed transport limits.<br />
<a
href="https://redirect.github.com/netbirdio/netbird/pull/6339 ">netbirdio/netbird#6339</a></li>
<li>Filtered <strong>DNS fallback upstreams matching NetBird server
IPs</strong> to prevent loops.<br />
<a
href="https://redirect.github.com/netbirdio/netbird/pull/6183 ">netbirdio/netbird#6183</a></li>
<li>Preserved <strong>posture checks on configuration-only sync
updates</strong>.<br />
<a
href="https://redirect.github.com/netbirdio/netbird/pull/6373 ">netbirdio/netbird#6373</a></li>
<li>Improved embedded client shutdown by <strong>canceling context
before stopping the engine</strong>.<br />
<a
href="https://redirect.github.com/netbirdio/netbird/pull/6397 ">netbirdio/netbird#6397</a></li>
</ul>
<h4>Management Improvements</h4>
<ul>
<li>Added <strong>IPv6 default permit rules for exit node
routes</strong>.<br />
<a
href="https://redirect.github.com/netbirdio/netbird/pull/6368 ">netbirdio/netbird#6368</a></li>
<li>Logged <strong>user agent information and returned request
IDs</strong>.<br />
<a
href="https://redirect.github.com/netbirdio/netbird/pull/6380 ">netbirdio/netbird#6380</a></li>
<li>Added <strong>version gating to stop sending deprecated RemotePeers
field</strong>.<br />
<a
href="https://redirect.github.com/netbirdio/netbird/pull/6371 ">netbirdio/netbird#6371</a></li>
<li>Fixed <strong>L4 service updates when no custom port is
configured</strong>.<br />
<a
href="https://redirect.github.com/netbirdio/netbird/pull/6396 ">netbirdio/netbird#6396</a></li>
</ul>
<h4>Proxy Enhancements</h4>
<ul>
<li>Added <strong>non-blocking mapping updates</strong>.<br />
<a
href="https://redirect.github.com/netbirdio/netbird/pull/6369 ">netbirdio/netbird#6369</a></li>
<li>Improved certificate handling by <strong>notifying readiness for
domains covered by static certificates</strong>.<br />
<a
href="https://redirect.github.com/netbirdio/netbird/pull/6389 ">netbirdio/netbird#6389</a></li>
<li>Switched <strong>proxy ID generation to UUIDs</strong>.<br />
<a
href="https://redirect.github.com/netbirdio/netbird/pull/6391 ">netbirdio/netbird#6391</a></li>
</ul>
<h4>Infrastructure & Tooling</h4>
<ul>
<li>Improved support for <strong>atomic Linux distributions</strong> in
install scripts and fixed Docker-related issues in
getting-started.sh.</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/netbirdio/netbird/commit/8ff3b06cf1295661bbb293a73733d06b05b49959 "><code>8ff3b06</code></a>
[client] Index peer tunnel IPs for faster PeerStateByIP lookup (<a
href="https://redirect.github.com/netbirdio/netbird/issues/6412 ">#6412</a>)</li>
<li><a
href="https://github.com/netbirdio/netbird/commit/d7703767d5f211fa41f516340e191b9e609e4f45 "><code>d770376</code></a>
[client, proxy] cancel context before stopping engine on embedded client
(<a
href="https://redirect.github.com/netbirdio/netbird/issues/6397 ">#6397</a>)</li>
<li><a
href="https://github.com/netbirdio/netbird/commit/7feda907ca2357b3a6a54d00208ef84bf3a0836d "><code>7feda90</code></a>
[management] fix L4 service update when no custom port (<a
href="https://redirect.github.com/netbirdio/netbird/issues/6396 ">#6396</a>)</li>
<li><a
href="https://github.com/netbirdio/netbird/commit/62da4821334b99dc2a7020986776c5fcb901feba "><code>62da482</code></a>
[management] Add version gate to stop sending deprecated RemotePeers
field (#...</li>
<li><a
href="https://github.com/netbirdio/netbird/commit/079bce3c2f29964d315549bd63b3fb44335fdf9b "><code>079bce3</code></a>
Add commands to discover and write Kubernetes configuration (<a
href="https://redirect.github.com/netbirdio/netbird/issues/6260 ">#6260</a>)</li>
<li><a
href="https://github.com/netbirdio/netbird/commit/1a09aa671566016ee1fe7d24f4cce7b2cf6da0b9 "><code>1a09aa6</code></a>
[misc] Update Go toolchain version in go.mod (<a
href="https://redirect.github.com/netbirdio/netbird/issues/6377 ">#6377</a>)</li>
<li><a
href="https://github.com/netbirdio/netbird/commit/61abf5b9ea379bff206309ceb3c5da7962d59639 "><code>61abf5b</code></a>
[proxy] Use UUID for proxy ID generation (<a
href="https://redirect.github.com/netbirdio/netbird/issues/6391 ">#6391</a>)</li>
<li><a
href="https://github.com/netbirdio/netbird/commit/e229050ba3f353c0086172f8e0093130ca01b618 "><code>e229050</code></a>
[proxy] Notify certificate ready for domains covered by the static
certificat...</li>
<li><a
href="https://github.com/netbirdio/netbird/commit/e919b2d55d191daffd70e7f048667efefee6b789 "><code>e919b2d</code></a>
[client] Preserve posture checks on config-only sync updates (<a
href="https://redirect.github.com/netbirdio/netbird/issues/6373 ">#6373</a>)</li>
<li><a
href="https://github.com/netbirdio/netbird/commit/a40028092debb75a7a42e89c126d49882045fd65 "><code>a400280</code></a>
[management] log user agent and return request id (<a
href="https://redirect.github.com/netbirdio/netbird/issues/6380 ">#6380</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/netbirdio/netbird/compare/v0.72.2...v0.72.4 ">compare
view</a></li>
</ul>
</details>
<br />
---------
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Philip Laine <philip.laine@gmail.com >
2026-06-15 14:44:03 +02:00
Philip Laine and GitHub
5e5e37a153
Add tests to k8sutil ( #296 )
...
Adds more unit tests to sections that are easy to test.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Tests**
* Added unit tests for Kubernetes owner-reference and finalizer helper
functions to ensure correct behavior.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
2026-06-15 13:57:14 +02:00
c1401dbb51
Bump github.com/netbirdio/netbird from 0.71.4 to 0.72.2 ( #288 )
...
Bumps
[github.com/netbirdio/netbird](https://github.com/netbirdio/netbird )
from 0.71.4 to 0.72.2.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/netbirdio/netbird/releases ">github.com/netbirdio/netbird's
releases</a>.</em></p>
<blockquote>
<h2>v0.72.2</h2>
<h2>What's Changed</h2>
<ul>
<li>[management] resolve private services on custom domains in
synthesized DNS zones by <a
href="https://github.com/mlsmaycon "><code>@mlsmaycon</code></a> in <a
href="https://redirect.github.com/netbirdio/netbird/pull/6348 ">netbirdio/netbird#6348</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/netbirdio/netbird/compare/v0.72.1...v0.72.2 ">https://github.com/netbirdio/netbird/compare/v0.72.1...v0.72.2 </a></p>
<h2>v0.72.1</h2>
<h2>What's Changed</h2>
<ul>
<li>[management] Copy private field on shallowCloneMapping by <a
href="https://github.com/mlsmaycon "><code>@mlsmaycon</code></a> in <a
href="https://redirect.github.com/netbirdio/netbird/pull/6347 ">netbirdio/netbird#6347</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/netbirdio/netbird/compare/v0.72.0...v0.72.1 ">https://github.com/netbirdio/netbird/compare/v0.72.0...v0.72.1 </a></p>
<h2>v0.72.0</h2>
<h2>Release Notes for v0.72.0</h2>
<h3>What's New</h3>
<h4>Private Service Expose & Reverse Proxy</h4>
<ul>
<li>Added support to <strong>expose NetBird-only services over tunnel
peers</strong> across management, client, and proxy.<br />
<a
href="https://redirect.github.com/netbirdio/netbird/pull/6226 ">netbirdio/netbird#6226</a></li>
<li>Added follow-up fixes for <strong>private reverse-proxy
services</strong>.<br />
<a
href="https://redirect.github.com/netbirdio/netbird/pull/6268 ">netbirdio/netbird#6268</a></li>
<li>Added <strong>private service expose</strong> support in the
dashboard.<br />
<a
href="https://redirect.github.com/netbirdio/dashboard/pull/646 ">netbirdio/dashboard#646</a></li>
<li>Updated <strong>reverse proxy modals</strong> in the dashboard.<br
/>
<a
href="https://redirect.github.com/netbirdio/dashboard/pull/661 ">netbirdio/dashboard#661</a></li>
<li>Bound <strong>embed client WireGuard per-device memory</strong>
across proxy and client.<br />
<a
href="https://redirect.github.com/netbirdio/netbird/pull/5962 ">netbirdio/netbird#5962</a></li>
</ul>
<h4>Client Improvements</h4>
<ul>
<li>Filtered <strong>scoped/cloned default routes from BSD network
monitor</strong>.<br />
<a
href="https://redirect.github.com/netbirdio/netbird/pull/6208 ">netbirdio/netbird#6208</a></li>
<li>Matched <strong>DNS wildcard handlers on label
boundaries</strong>.<br />
<a
href="https://redirect.github.com/netbirdio/netbird/pull/6255 ">netbirdio/netbird#6255</a></li>
<li>Refactored <strong>Linux system info to use syscalls</strong>.<br />
<a
href="https://redirect.github.com/netbirdio/netbird/pull/6230 ">netbirdio/netbird#6230</a></li>
<li>Released <strong>WASM js.FuncOf callbacks in SSH and RDP
paths</strong>.<br />
<a
href="https://redirect.github.com/netbirdio/netbird/pull/5982 ">netbirdio/netbird#5982</a></li>
<li>Fixed possible <strong>deadlock in statemanager Stop</strong>.<br />
<a
href="https://redirect.github.com/netbirdio/netbird/pull/6228 ">netbirdio/netbird#6228</a></li>
<li>Improved <strong>Rosenpass support</strong>.<br />
<a
href="https://redirect.github.com/netbirdio/netbird/pull/6136 ">netbirdio/netbird#6136</a></li>
<li>Recognized <strong>NetBird DNS forwarder port in capture text
format</strong>.<br />
<a
href="https://redirect.github.com/netbirdio/netbird/pull/6177 ">netbirdio/netbird#6177</a></li>
<li>Applied <strong>netroute default-gateway workaround on
Android</strong>.<br />
<a
href="https://redirect.github.com/netbirdio/netbird/pull/6192 ">netbirdio/netbird#6192</a></li>
<li>Captured <strong>injected ICMPv6 echo replies in debug
capture</strong>.<br />
<a
href="https://redirect.github.com/netbirdio/netbird/pull/6321 ">netbirdio/netbird#6321</a></li>
<li>Gated <strong>DNS forwarder on BlockInbound</strong>.</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/netbirdio/netbird/commit/1e7b16db0aee0002dc1b1ee2b5733d965baeac08 "><code>1e7b16d</code></a>
[management] resolve private services on custom domains in synthesized
DNS zo...</li>
<li><a
href="https://github.com/netbirdio/netbird/commit/b377d9993334bc5fd73d64c6c468a60653996148 "><code>b377d99</code></a>
[management] Copy private field on shallowCloneMapping (<a
href="https://redirect.github.com/netbirdio/netbird/issues/6347 ">#6347</a>)</li>
<li><a
href="https://github.com/netbirdio/netbird/commit/512899d82d884bb5451e9cd540db324dbe5d2144 "><code>512899d</code></a>
[client] Prevent corruption from competing log rotation and improve
debug bun...</li>
<li><a
href="https://github.com/netbirdio/netbird/commit/5993ec6e435aca0917a80fbf28c8001b1208759d "><code>5993ec6</code></a>
[client] Allow wireguard port to be zero in UI and show port in status
comman...</li>
<li><a
href="https://github.com/netbirdio/netbird/commit/eac6d501c344933fdd2aad48f6a26b7da7558b94 "><code>eac6d50</code></a>
[infrastructure] allow docker image overrides for getting started (<a
href="https://redirect.github.com/netbirdio/netbird/issues/6335 ">#6335</a>)</li>
<li><a
href="https://github.com/netbirdio/netbird/commit/deeae306121a2c304a6f044933fdc5e3fe6f0cba "><code>deeae30</code></a>
[misc] Add Codecov integration and coverage reporting across workflows
(<a
href="https://redirect.github.com/netbirdio/netbird/issues/6333 ">#6333</a>)</li>
<li><a
href="https://github.com/netbirdio/netbird/commit/f3cdf163e1487686e3b7c5bf577a8f96f0c9a8e6 "><code>f3cdf16</code></a>
[management] Export ResolveDomain (<a
href="https://redirect.github.com/netbirdio/netbird/issues/6334 ">#6334</a>)</li>
<li><a
href="https://github.com/netbirdio/netbird/commit/3e61ccb162cd36d1ba48b966bf6dfa84714f957c "><code>3e61ccb</code></a>
[client] Persist sync response via pluggable store (disk on iOS) (<a
href="https://redirect.github.com/netbirdio/netbird/issues/6331 ">#6331</a>)</li>
<li><a
href="https://github.com/netbirdio/netbird/commit/a48c20d8d898901f8622bf7791d3f473e4c27624 "><code>a48c20d</code></a>
[client] Gate DNS forwarder on BlockInbound (<a
href="https://redirect.github.com/netbirdio/netbird/issues/6257 ">#6257</a>)</li>
<li><a
href="https://github.com/netbirdio/netbird/commit/2b57a7d43bd5c914d238e321a2cdb998213b3b91 "><code>2b57a7d</code></a>
[client, management, misc] expose VCS revision in dev build version
output (#...</li>
<li>Additional commits viewable in <a
href="https://github.com/netbirdio/netbird/compare/v0.71.4...v0.72.2 ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-06-09 15:02:21 +02:00
Luuk Blankenstijn and GitHub
13c7bba3f3
Pass management URL to ClusterProxy ( #289 )
...
The proxy container defaults `--management-url` to
`https://api.netbird.io `, so on self-hosted NetBird the proxy talks to
SaaS and rejects the setup key as invalid.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added support for configuring a management URL for the cluster proxy
service.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
2026-06-09 14:55:34 +02:00
Philip Laine and GitHub
5dd73dcc80
Add new resource for Kubernetes API proxy ( #279 )
...
This adds a new resource which deploys a Kubernetes API server proxy
that can be used to access the API server without tokens through
Netbird.
Part of #274
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added ClusterProxy custom resource for cluster API proxying
capabilities
* **Documentation**
* Added ClusterProxy API reference documentation with schema details
* **Examples**
* Added example ClusterProxy configuration and RBAC setup for cluster
proxy targets
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/netbirdio/kubernetes-operator/pull/279?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack )
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
2026-06-01 11:41:48 +02:00
Philip Laine and GitHub
c5eaa832d3
Fix noisy reconcile errors ( #275 )
...
Certain errors are better ignored to instead rely on the child resource
to trigger a new reconcile.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Release Notes
* **Bug Fixes**
* Enhanced error handling in group resolution to prevent silent failures
and ensure proper error notification
* Improved system resilience by gracefully handling missing or
unavailable Kubernetes resources without triggering reconciliation
failures
* Optimized setup key processing workflow to enhance overall system
robustness and reliability
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/netbirdio/kubernetes-operator/pull/275?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack )
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
2026-05-29 09:58:14 +02:00
pallieter-verhoeven-glbnxt and GitHub
dcd9dfdb4e
Add AllowExtraDnsLabels to setupKey CRD ( #277 )
...
This option was hardcoded to false.
It is now configurable in the SetupKey CRD with a default false value.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* New allowExtraDnsLabels setting for Setup Keys to control whether
peers may include extra DNS labels (disabled by default, immutable after
creation).
* **Documentation**
* API reference updated to document the new allowExtraDnsLabels field
and its default/behavior.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/netbirdio/kubernetes-operator/pull/277?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack )
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
2026-05-27 18:45:07 +02:00
fef05e4569
Bump github.com/netbirdio/netbird from 0.71.2 to 0.71.4 ( #272 )
...
Bumps
[github.com/netbirdio/netbird](https://github.com/netbirdio/netbird )
from 0.71.2 to 0.71.4.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/netbirdio/netbird/releases ">github.com/netbirdio/netbird's
releases</a>.</em></p>
<blockquote>
<h2>v0.71.4</h2>
<h2>What's Changed</h2>
<ul>
<li>[client] Revert legacy registry cleanup on Windows install by <a
href="https://github.com/lixmal "><code>@lixmal</code></a> in <a
href="https://redirect.github.com/netbirdio/netbird/pull/6232 ">netbirdio/netbird#6232</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/netbirdio/netbird/compare/v0.71.3...v0.71.4 ">https://github.com/netbirdio/netbird/compare/v0.71.3...v0.71.4 </a></p>
<h2>v0.71.3</h2>
<h2>What's Changed</h2>
<ul>
<li>[management] fix: device redirect uri wasn't registered by <a
href="https://github.com/jnfrati "><code>@jnfrati</code></a> in <a
href="https://redirect.github.com/netbirdio/netbird/pull/6191 ">netbirdio/netbird#6191</a></li>
<li>[management] Fence peer status updates with a session token by <a
href="https://github.com/mlsmaycon "><code>@mlsmaycon</code></a> in <a
href="https://redirect.github.com/netbirdio/netbird/pull/6193 ">netbirdio/netbird#6193</a></li>
<li>[management] Add metrics for peer status updates and ephemeral
cleanup by <a
href="https://github.com/mlsmaycon "><code>@mlsmaycon</code></a> in <a
href="https://redirect.github.com/netbirdio/netbird/pull/6196 ">netbirdio/netbird#6196</a></li>
<li>[management] Ensure SessionStartedAt has a default value by <a
href="https://github.com/mlsmaycon "><code>@mlsmaycon</code></a> in <a
href="https://redirect.github.com/netbirdio/netbird/pull/6211 ">netbirdio/netbird#6211</a></li>
<li>[proxy] clusters API surfaces type, online status, and capability
flags by <a
href="https://github.com/mlsmaycon "><code>@mlsmaycon</code></a> in <a
href="https://redirect.github.com/netbirdio/netbird/pull/6148 ">netbirdio/netbird#6148</a></li>
<li>[misc] Update contribution guidelines by <a
href="https://github.com/mlsmaycon "><code>@mlsmaycon</code></a> in <a
href="https://redirect.github.com/netbirdio/netbird/pull/6219 ">netbirdio/netbird#6219</a></li>
<li>[client] Bump macOS sleep callback timeout to 20s by <a
href="https://github.com/lixmal "><code>@lixmal</code></a> in <a
href="https://redirect.github.com/netbirdio/netbird/pull/6220 ">netbirdio/netbird#6220</a></li>
<li>[doc] Clean up README by <a
href="https://github.com/lixmal "><code>@lixmal</code></a> in <a
href="https://redirect.github.com/netbirdio/netbird/pull/6178 ">netbirdio/netbird#6178</a></li>
<li>[proxy] concurrent proxy snapshot apply by <a
href="https://github.com/pascal-fischer "><code>@pascal-fischer</code></a>
in <a
href="https://redirect.github.com/netbirdio/netbird/pull/6207 ">netbirdio/netbird#6207</a></li>
<li>[management] scope network router update call by <a
href="https://github.com/pascal-fischer "><code>@pascal-fischer</code></a>
in <a
href="https://redirect.github.com/netbirdio/netbird/pull/6222 ">netbirdio/netbird#6222</a></li>
<li>[client] Fix nil channel panic in external chain monitor stop by <a
href="https://github.com/lixmal "><code>@lixmal</code></a> in <a
href="https://redirect.github.com/netbirdio/netbird/pull/6224 ">netbirdio/netbird#6224</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/netbirdio/netbird/compare/v0.71.2...v0.71.3 ">https://github.com/netbirdio/netbird/compare/v0.71.2...v0.71.3 </a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/netbirdio/netbird/commit/0358be23136da50e829ba99a83e54ef555071a7f "><code>0358be2</code></a>
[client] Revert "Clean up legacy 32-bit and HKCU registry entries
on Windows ...</li>
<li><a
href="https://github.com/netbirdio/netbird/commit/37052fd5bc050f8eaf80b986d511f3c278233cca "><code>37052fd</code></a>
[client] Fix nil channel panic in external chain monitor stop (<a
href="https://redirect.github.com/netbirdio/netbird/issues/6224 ">#6224</a>)</li>
<li><a
href="https://github.com/netbirdio/netbird/commit/454ff66518feaef2d9ceb10fb1960da28f14fd87 "><code>454ff66</code></a>
[management] scope network router update call (<a
href="https://redirect.github.com/netbirdio/netbird/issues/6222 ">#6222</a>)</li>
<li><a
href="https://github.com/netbirdio/netbird/commit/6137a1fcc53ad0ea0f5048ac97369168f1116a69 "><code>6137a1f</code></a>
[proxy] concurrent proxy snapshot apply (<a
href="https://redirect.github.com/netbirdio/netbird/issues/6207 ">#6207</a>)</li>
<li><a
href="https://github.com/netbirdio/netbird/commit/4955c345d53f63394266305744841c4e1bff8123 "><code>4955c34</code></a>
Clean up README header, key features table, and self-hosted quickstart
(<a
href="https://redirect.github.com/netbirdio/netbird/issues/6178 ">#6178</a>)</li>
<li><a
href="https://github.com/netbirdio/netbird/commit/9192b4f029f8f0eeaad77fff8625c34ba9849668 "><code>9192b4f</code></a>
[client] Bump macOS sleep callback timeout to 20s (<a
href="https://redirect.github.com/netbirdio/netbird/issues/6220 ">#6220</a>)</li>
<li><a
href="https://github.com/netbirdio/netbird/commit/c784b0255063b9cbfde830c78670de2400e46c1c "><code>c784b02</code></a>
[misc] Update contribution guidelines (<a
href="https://redirect.github.com/netbirdio/netbird/issues/6219 ">#6219</a>)</li>
<li><a
href="https://github.com/netbirdio/netbird/commit/d250f92c435bac83fd55f00fad3ee2c292eee910 "><code>d250f92</code></a>
feat(reverse-proxy): clusters API surfaces type, online status, and
capabilit...</li>
<li><a
href="https://github.com/netbirdio/netbird/commit/80966ab1b09bd86b7a526d9402b6a47438bc0943 "><code>80966ab</code></a>
[management] Ensure SessionStartedAt has a default value (<a
href="https://redirect.github.com/netbirdio/netbird/issues/6211 ">#6211</a>)</li>
<li><a
href="https://github.com/netbirdio/netbird/commit/af24fd779640538c05c5f261a1e9fdf20fe7773f "><code>af24fd7</code></a>
[management] Add metrics for peer status updates and ephemeral cleanup
(<a
href="https://redirect.github.com/netbirdio/netbird/issues/6196 ">#6196</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/netbirdio/netbird/compare/v0.71.2...v0.71.4 ">compare
view</a></li>
</ul>
</details>
<br />
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-05-26 16:34:02 +02:00
Philip Laine and GitHub
0ffcaca94b
Make network router read only file system by default ( #213 )
...
This changes the router and sidecar to run with read only file system by
default. This is good practice in Kubernetes and often required in most
clusters.
Fixes #144
Fixes #114
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Enhanced DNS configuration handling in containerized deployments with
stricter filesystem access controls and improved security measures.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/netbirdio/kubernetes-operator/pull/213?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack )
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Signed-off-by: Philip Laine <philip.laine@gmail.com >
2026-05-18 11:21:35 +02:00
7744dc08f5
Bump github.com/netbirdio/netbird from 0.70.4 to 0.71.2 ( #260 )
...
Bumps
[github.com/netbirdio/netbird](https://github.com/netbirdio/netbird )
from 0.70.4 to 0.71.2.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/netbirdio/netbird/releases ">github.com/netbirdio/netbird's
releases</a>.</em></p>
<blockquote>
<h2>v0.71.2</h2>
<h2>What's Changed</h2>
<ul>
<li>[management] Avoid peer IP reallocation when account settings update
preserves the network range by <a
href="https://github.com/lixmal "><code>@lixmal</code></a> in <a
href="https://redirect.github.com/netbirdio/netbird/pull/6173 ">netbirdio/netbird#6173</a></li>
<li>[management] Avoid context cancellation in
<code>cancelPeerRoutines</code> by <a
href="https://github.com/mlsmaycon "><code>@mlsmaycon</code></a> in <a
href="https://redirect.github.com/netbirdio/netbird/pull/6175 ">netbirdio/netbird#6175</a></li>
<li>[client] Clean up legacy 32-bit and HKCU registry entries on Windows
install by <a href="https://github.com/lixmal "><code>@lixmal</code></a>
in <a
href="https://redirect.github.com/netbirdio/netbird/pull/6176 ">netbirdio/netbird#6176</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/netbirdio/netbird/compare/v0.71.1...v0.71.2 ">https://github.com/netbirdio/netbird/compare/v0.71.1...v0.71.2 </a></p>
<h2>v0.71.1</h2>
<h2>What's Changed</h2>
<ul>
<li>[client] Mirror v4 exit selection onto v6 pair and honour
SkipAutoApply per route by <a
href="https://github.com/lixmal "><code>@lixmal</code></a> in <a
href="https://redirect.github.com/netbirdio/netbird/pull/6150 ">netbirdio/netbird#6150</a></li>
<li>[client] Drop DNS probes for passive health projection by <a
href="https://github.com/lixmal "><code>@lixmal</code></a> in <a
href="https://redirect.github.com/netbirdio/netbird/pull/5971 ">netbirdio/netbird#5971</a></li>
<li>[proxy] auth token generation on mapping by <a
href="https://github.com/crn4 "><code>@crn4</code></a> in <a
href="https://redirect.github.com/netbirdio/netbird/pull/6157 ">netbirdio/netbird#6157</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/netbirdio/netbird/compare/v0.71.0...v0.71.1 ">https://github.com/netbirdio/netbird/compare/v0.71.0...v0.71.1 </a></p>
<h2>v0.71.0</h2>
<h2>Release Notes for v0.71.0</h2>
<h3>What's New</h3>
<p><strong>IPv6 overlay addressing</strong>
NetBird's overlay is now dual-stack. Every account gets its own IPv6
prefix (default <code>/64</code>, configurable from <code>/48</code> to
<code>/120</code>), and peers can receive both an IPv4 and an IPv6
overlay address. DNS serves AAAA
and reverse PTR records alongside A records, ACLs apply to both families
automatically, network routes accept IPv6 CIDRs (with masquerade), exit
nodes that route <code>0.0.0.0/0</code> get a matching <code>::/0</code>
route, and
domain routes resolve both A and AAAA.</p>
<p>Rollout is group-gated: new accounts enable IPv6 for the
<strong>All</strong> group by default; existing accounts opt in under
<strong>Settings > Network</strong>. Assignment is also gated on a
per-peer capability, so older clients keep
working on IPv4 until they upgrade. Hosts can opt out individually with
<code>netbird up --disable-ipv6</code></p>
<p>Read more in the <a
href="https://netbird.io/knowledge-hub/ipv6-overlay-addressing ">IPv6
Overlay Addressing announcement</a> and the <a
href="https://docs.netbird.io/manage/settings/ipv6 ">IPv6
documentation</a>.
<a
href="https://redirect.github.com/netbirdio/netbird/pull/5631 ">netbirdio/netbird#5631</a>
by <a href="https://github.com/lixmal "><code>@lixmal</code></a></p>
<p><strong>MFA for local users</strong>
Local users (non-IdP) can now enable multi-factor authentication,
closing a gap for deployments that don't federate auth through an
external provider.
<a
href="https://redirect.github.com/netbirdio/netbird/pull/5804 ">netbirdio/netbird#5804</a>
by <a href="https://github.com/jnfrati "><code>@jnfrati</code></a></p>
<p><strong>Bring your own proxy (backend ready)</strong>
Backend support for per-account reverse-proxy lifecycle has landed:
proxy tokens, per-account cluster allow-lists, conflict detection, and
one-proxy-per-account enforcement. Full rollout (dashboard, docs) comes
in a later release.
<a
href="https://redirect.github.com/netbirdio/netbird/pull/5627 ">netbirdio/netbird#5627</a>
by <a href="https://github.com/crn4 "><code>@crn4</code></a></p>
<h4>Client Improvements</h4>
<ul>
<li>Included <strong>MTU and SSH auth config in debug bundle</strong> by
<a href="https://github.com/lixmal "><code>@lixmal</code></a>.
<a
href="https://redirect.github.com/netbirdio/netbird/pull/6071 ">netbirdio/netbird#6071</a></li>
<li>Added <strong>public key to debug bundle config.txt</strong> by <a
href="https://github.com/lixmal "><code>@lixmal</code></a>.
<a
href="https://redirect.github.com/netbirdio/netbird/pull/6092 ">netbirdio/netbird#6092</a></li>
<li>iOS: <strong>structured ResolvedIPs collection for domain
routes</strong> by <a
href="https://github.com/pappz "><code>@pappz</code></a>.
<a
href="https://redirect.github.com/netbirdio/netbird/pull/6090 ">netbirdio/netbird#6090</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/netbirdio/netbird/commit/3f91f49277e1841bdfccda06ae7baa0430e6de2e "><code>3f91f49</code></a>
Clean up legacy 32-bit and HKCU registry entries on Windows install (<a
href="https://redirect.github.com/netbirdio/netbird/issues/6176 ">#6176</a>)</li>
<li><a
href="https://github.com/netbirdio/netbird/commit/347c5bf317794729a044ce9f866f29e357d386d9 "><code>347c5bf</code></a>
Avoid context cancellation in <code>cancelPeerRoutines</code> (<a
href="https://redirect.github.com/netbirdio/netbird/issues/6175 ">#6175</a>)</li>
<li><a
href="https://github.com/netbirdio/netbird/commit/22e2519d7113dffec718198e54474cc0a6d71c87 "><code>22e2519</code></a>
[management] Avoid peer IP reallocation when account settings update
preserve...</li>
<li><a
href="https://github.com/netbirdio/netbird/commit/e916f12cca508dfea584e7b72cf99a135acebc2b "><code>e916f12</code></a>
[proxy] auth token generation on mapping (<a
href="https://redirect.github.com/netbirdio/netbird/issues/6157 ">#6157</a>)</li>
<li><a
href="https://github.com/netbirdio/netbird/commit/9ed2e2a5b463077f8abe3e3926695f5dc9411e29 "><code>9ed2e2a</code></a>
[client] Drop DNS probes for passive health projection (<a
href="https://redirect.github.com/netbirdio/netbird/issues/5971 ">#5971</a>)</li>
<li><a
href="https://github.com/netbirdio/netbird/commit/2ccae7ec479c106efb6d7a7edff4bb55affb2aa4 "><code>2ccae7e</code></a>
[client] Mirror v4 exit selection onto v6 pair and honour SkipAutoApply
per r...</li>
<li><a
href="https://github.com/netbirdio/netbird/commit/07e5450117dd0451aaeefc18729a822115587e69 "><code>07e5450</code></a>
[management] Bracket IPv6 reverse-proxy target hosts when building URL
Host f...</li>
<li><a
href="https://github.com/netbirdio/netbird/commit/3f914090cbb345707a88b5edb20d9c1351873b4c "><code>3f91409</code></a>
[client] Bracket IPv6 in embed listeners, expand debug bundle (<a
href="https://redirect.github.com/netbirdio/netbird/issues/6134 ">#6134</a>)</li>
<li><a
href="https://github.com/netbirdio/netbird/commit/ea9fab4396fc5513f7c62e3465dd361dc8bb9e91 "><code>ea9fab4</code></a>
[management] Allocate and preserve IPv6 overlay addresses for embedded
proxy ...</li>
<li><a
href="https://github.com/netbirdio/netbird/commit/77b479286e399660ef2bdcbe7983363946660574 "><code>77b4792</code></a>
[management] fix offline statuses for public proxy clusters (<a
href="https://redirect.github.com/netbirdio/netbird/issues/6133 ">#6133</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/netbirdio/netbird/compare/v0.70.4...v0.71.2 ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Signed-off-by: Philip Laine <philip.laine@gmail.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-05-18 11:02:55 +02:00
Philip Laine and GitHub
c56f8de162
Fix sidecar injection when pod annotations is nil. ( #250 )
...
When a pod does not have any annotations the injector will fail. This
change adds a test for the case and also fixes the issue.
Fixes #246
Signed-off-by: Philip Laine <philip.laine@gmail.com >
2026-05-13 12:54:52 +02:00
Philip Laine and GitHub
360ef52aa3
Add build version to NetBird client user agent. ( #248 )
...
This also fix the runtime import aliases to avoid conflicts with stdlib
runtime.
2026-05-13 12:43:46 +02:00
Philip Laine and GitHub
ae34898735
Rename Helm chart and Docker image and move to GHCR ( #233 )
...
This change does a few things, none of these are breaking.
It changes the registry from Docker Hub to GHCR, as we dont have the
same rate limiting issues with unauthenticated pulls.
It changes the release process to push the Helm chart as an OCI artifact
removing the need for GH pages.
It renames both the image and chart from kubernetes-operator to
netbird-operator. This name is cleaner and easier for people to
understand in a sea of Helm charts. Funnily enough this is not a
breaking change as the release name is used and not the chart name. So
in place upgrades just work.
Fixes #207
Signed-off-by: Philip Laine <philip.laine@gmail.com >
2026-05-06 12:26:32 +02:00
Philip Laine and GitHub
ea9f1cb081
Modernize for Go 1.26 ( #232 )
...
This change replaces all uses of pointer utils with the new `new`
function which does the same job.
Signed-off-by: Philip Laine <philip.laine@gmail.com >
2026-05-05 13:53:44 +02:00
Philip Laine and GitHub
69afe3aade
Fix SPDX license header ( #231 )
...
This change adds SPDX license headers to all files and eforces it with
the linter.
Signed-off-by: Philip Laine <philip.laine@gmail.com >
2026-05-05 12:59:36 +02:00
Philip Laine and GitHub
0c542db9d7
Fix group reconcile removing peers ( #226 )
...
This changes the group reconcile to get the existing group first and
then update it in place. If not done like this peers will be removed
from the group on the next reconcile.
Fixes #221
2026-05-05 11:12:50 +02:00
Philip Laine and GitHub
f8a383f533
Pin the default client image with digest ( #227 )
...
This changes the default client image from latest to a pinned digest. It
also enforces that the default image version tag matches the version of
the Netbird dependency.
This makes testing a lot easier and also ensures that we wont get
untested behavior introduced if the client makes a breaking change.
Signed-off-by: Philip Laine <philip.laine@gmail.com >
2026-05-05 11:12:37 +02:00
Philip Laine and GitHub
74012deb27
Enforce import ordering and aliases ( #216 )
...
This change ensures import ordering and aliases is standardized.
Something that is extra important when working with Kuberentes apis that
have "standard" import aliases.
Signed-off-by: Philip Laine <philip.laine@gmail.com >
2026-04-30 13:39:11 +02:00
Philip Laine and GitHub
37d48b5ca8
Set best practice defaults for network router deployment ( #214 )
...
This change sets some Kubernetes best practices as defaults. Such as
topology spread and pod disruption budget.
It also exposes log level and image settings in the root struct to make
it easier to override commonly configured settings.
Fixes #77
Fixes #162
Signed-off-by: Philip Laine <philip.laine@gmail.com >
2026-04-28 15:18:15 +02:00
Philip Laine and GitHub
91036022c0
Add path component to finalizer ( #202 )
...
The Kubernetes client warns about not having a path component in the
finalizer. This change adds a unqiue path component for each reconciler
kind.
2026-04-23 19:18:06 +02:00
Philip Laine and GitHub
9838f0dccc
Add sidecar profile ( #192 )
...
This change adds a new SidecarProfile resource which allows configuring
client sidecar injection into pods. It replaces the older annotation
based solution. This removes any pod specific configuration from the
setup key and puts it all in this side car configuration.
Fixes #188
Signed-off-by: Philip Laine <philip.laine@gmail.com >
2026-04-23 19:17:53 +02:00
Philip Laine and GitHub
876a0e1eb3
Update Gateway API to use new resources ( #201 )
...
We dont want to promote the use of the "old" resources with NB prefix so
the Gateway API integration should only support the new ones.
---------
Signed-off-by: Philip Laine <philip.laine@gmail.com >
2026-04-23 16:11:15 +02:00
Philip Laine and GitHub
99ef70603f
Allow references to groups by name ( #195 )
...
Group names are unique so we can safely use the name as a reference
method to groups. This makes assigning resources created in the cluster
to groups that already exist a lot easier.
2026-04-23 13:12:09 +02:00
Philip Laine and GitHub
1daeb670ba
Make network resource names unique ( #196 )
...
Network resource names are unique per Netbird account. This change moves
the existing name to the description and uses the UID for the name of
the resource instead.
2026-04-23 11:59:07 +02:00
b77bcd74ab
Bump github.com/netbirdio/netbird from 0.66.4 to 0.69.0 ( #187 )
...
Bumps
[github.com/netbirdio/netbird](https://github.com/netbirdio/netbird )
from 0.66.4 to 0.69.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/netbirdio/netbird/releases ">github.com/netbirdio/netbird's
releases</a>.</em></p>
<blockquote>
<h2>v0.69.0</h2>
<h2>Release Notes for v0.69.0</h2>
<h3>What's New</h3>
<p><strong>Reverse Proxy IP Reputation Integration</strong>
Now you can use CrowdSec to block malicious traffic based on IP
reputation on your exposed service in the reverse proxy.</p>
<p>This feature requires self-hosted installations to add another
container to their deployment. See instructions in the <a
href="https://docs.netbird.io/selfhosted/migration/enable-reverse-proxy#step-7-optional-enable-crowd-sec-ip-reputation ">reverse
proxy migration documentation</a>.</p>
<blockquote>
<p>For Cloud users, support is coming soon.</p>
</blockquote>
<p>Learn more about <a
href="https://docs.netbird.io/manage/reverse-proxy ">here</a>.</p>
<p><strong>macOS p2p connectivity improvements</strong>
We've improved macOS p2p connectivity with a better routing exclusion
mechanism to avoid loops. Now the client doesn't add /32 routes per
remote candidate addresses avoiding limitations on accessing remote
peer's local addresses via tunnel connections. Learn more about <a
href="https://redirect.github.com/netbirdio/netbird/pull/5918 ">this
change</a>.</p>
<blockquote>
<p>To use the old behavior run:</p>
<p><code>sudo netbird service reconfigure --service-env
"NB_USE_LEGACY_ROUTING=true"</code></p>
</blockquote>
<h4>Client Improvements</h4>
<ul>
<li>Added <strong>PCP support</strong>. This change adds support for the
PCP protocol to the client to improve the rate of P2P connectivity.
<a
href="https://redirect.github.com/netbirdio/netbird/pull/5219 ">netbirdio/netbird#5219</a></li>
<li>Added <strong>--disable-networks flag</strong> to block network
selection for users.<br />
<a
href="https://redirect.github.com/netbirdio/netbird/pull/5896 ">netbirdio/netbird#5896</a></li>
<li>Fixed <strong>clearing service env vars with --service-env
""</strong>.<br />
<a
href="https://redirect.github.com/netbirdio/netbird/pull/5893 ">netbirdio/netbird#5893</a></li>
<li>Guarded against <strong>container DNAT bypass of ACL rules in
iptables</strong>.<br />
<a
href="https://redirect.github.com/netbirdio/netbird/pull/5697 ">netbirdio/netbird#5697</a></li>
<li>Populated <strong>NetworkAddresses on iOS for posture
checks</strong>.<br />
<a
href="https://redirect.github.com/netbirdio/netbird/pull/5900 ">netbirdio/netbird#5900</a></li>
<li>Reconnected <strong>conntrack netlink listener on error</strong>.<br
/>
<a
href="https://redirect.github.com/netbirdio/netbird/pull/5885 ">netbirdio/netbird#5885</a></li>
<li>Replaced <strong>exclusion routes with scoped default + IP_BOUND_IF
on macOS</strong>.<br />
<a
href="https://redirect.github.com/netbirdio/netbird/pull/5918 ">netbirdio/netbird#5918</a></li>
<li>Fixed <strong>incorrect SSH client config combining Host and Match
directives</strong>.<br />
<a
href="https://redirect.github.com/netbirdio/netbird/pull/5903 ">netbirdio/netbird#5903</a></li>
<li>Fixed <strong>WGIface.Close deadlock when DNS filter hook re-enters
GetDevice</strong>.<br />
<a
href="https://redirect.github.com/netbirdio/netbird/pull/5916 ">netbirdio/netbird#5916</a></li>
</ul>
<h4>Management Improvements</h4>
<ul>
<li>Enforced <strong>peer or peer groups requirement for network
routers</strong>.<br />
<a
href="https://redirect.github.com/netbirdio/netbird/pull/5894 ">netbirdio/netbird#5894</a></li>
<li>Reused <strong>single cache store across all management server
consumers</strong>.<br />
<a
href="https://redirect.github.com/netbirdio/netbird/pull/5889 ">netbirdio/netbird#5889</a></li>
<li>Fixed <strong>lint error on Google Workspace
integration</strong>.<br />
<a
href="https://redirect.github.com/netbirdio/netbird/pull/5907 ">netbirdio/netbird#5907</a></li>
</ul>
<h4>Proxy Enhancements</h4>
<ul>
<li>Added <strong>CrowdSec IP reputation integration for reverse
proxy</strong>.</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/netbirdio/netbird/commit/3098f48b25e2a613d8f70466243d992c498e0fd2 "><code>3098f48</code></a>
[client] fix ios network addresses mac filter (<a
href="https://redirect.github.com/netbirdio/netbird/issues/5906 ">#5906</a>)</li>
<li><a
href="https://github.com/netbirdio/netbird/commit/7f023ce8014084385e677e67c541677336e25431 "><code>7f023ce</code></a>
[client] Android debug bundle support (<a
href="https://redirect.github.com/netbirdio/netbird/issues/5888 ">#5888</a>)</li>
<li><a
href="https://github.com/netbirdio/netbird/commit/e3611265159bd372f77ca404d32c86127e036525 "><code>e361126</code></a>
[client] Fix WGIface.Close deadlock when DNS filter hook re-enters
GetDevice ...</li>
<li><a
href="https://github.com/netbirdio/netbird/commit/95213f715714177b7c9672b3f264f84c9a31cf04 "><code>95213f7</code></a>
[client] Use Match host+exec instead of Host+Match in SSH client config
(<a
href="https://redirect.github.com/netbirdio/netbird/issues/5903 ">#5903</a>)</li>
<li><a
href="https://github.com/netbirdio/netbird/commit/2e0e3a3601d90a5d7a6b39dc16ebde2522fdf580 "><code>2e0e3a3</code></a>
[client] Replace exclusion routes with scoped default + IP_BOUND_IF on
macOS ...</li>
<li><a
href="https://github.com/netbirdio/netbird/commit/8ae8f2098fb4bb7a9177b3f2d8d908a413b8fc49 "><code>8ae8f20</code></a>
[management] chores: fix lint error on google workspace (<a
href="https://redirect.github.com/netbirdio/netbird/issues/5907 ">#5907</a>)</li>
<li><a
href="https://github.com/netbirdio/netbird/commit/a39787d6796ee26e1f6ad9c67ea33a9da7bf8d66 "><code>a39787d</code></a>
[infrastructure] Add CrowdSec LAPI container to self-hosted setup script
(<a
href="https://redirect.github.com/netbirdio/netbird/issues/5880 ">#5880</a>)</li>
<li><a
href="https://github.com/netbirdio/netbird/commit/53b04e512af0d94f619e870467115c43d200830b "><code>53b04e5</code></a>
[management] Reuse a single cache store across all management server
consumer...</li>
<li><a
href="https://github.com/netbirdio/netbird/commit/633dde8d1f5985afc52071462c42857cb844b9ac "><code>633dde8</code></a>
[client] Reconnect conntrack netlink listener on error (<a
href="https://redirect.github.com/netbirdio/netbird/issues/5885 ">#5885</a>)</li>
<li><a
href="https://github.com/netbirdio/netbird/commit/7e4542adde54ebe71a3a47f5228c5915c9c1052a "><code>7e4542a</code></a>
fix(client): populate NetworkAddresses on iOS for posture checks (<a
href="https://redirect.github.com/netbirdio/netbird/issues/5900 ">#5900</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/netbirdio/netbird/compare/v0.66.4...v0.69.0 ">compare
view</a></li>
</ul>
</details>
<br />
---------
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Philip Laine <philip.laine@gmail.com >
2026-04-23 09:50:41 +02:00
Philip Laine and GitHub
6768a76c9c
Add network router and resource ( #189 )
...
This change adds two new resources, NetworkRouter and NetworkResource,
which enable clusters to expose Kubernetes services to Netbird.
The NetworkRouter is responsible for creating the network, group, setup
key and routing peer all of which are unique to the isntance. Along with
the deployment of the client in the cluster.
The NetworkResource exposes a service by linking to the specific router
it wants to expose to. This makes coupling between the resource and
network easy to understand.
Routers also set a DNS zone which is used to give names to resources
based on the name and namespace of the service being exposed.
Part of #172
Signed-off-by: Philip Laine <philip.laine@gmail.com >
2026-04-23 08:55:49 +02:00
Philip Laine and GitHub
af11e31b28
Add ready conditon and cleanup finalizer and status patching ( #186 )
...
This change adds a ready condition. It also sets a standard for status
fields and documentation. It makes use of helper functions from FluxCD
to better manage patching of finalizers and status.
Signed-off-by: Philip Laine <philip.laine@gmail.com >
2026-04-21 15:42:11 +02:00
Philip Laine and GitHub
1bcd58a7cd
Implement mock for Netbird API and client ( #184 )
...
This makes testing of the operator a lot simpler by enabling a quick way
to implement the crud endpoints for all the resources used.
Signed-off-by: Philip Laine <philip.laine@gmail.com >
2026-04-15 10:25:45 +02:00
Philip Laine and GitHub
9c4ca73712
Implement group resource ( #181 )
...
This change implements a new group resource.
It also sets the standard for a resource reference will be done through
out the controller. A resource reference can either be done by ID or as
a local named reference to the actual resource. This allows end users to
chose if they want to manage things completely in the cluster or not.
Part of #172
Signed-off-by: Philip Laine <philip.laine@gmail.com >
2026-04-15 10:16:10 +02:00
Philip Laine and GitHub
26479a19c0
Implement new setup key resource ( #178 )
...
This change implements a new resource called SetupKey that manages the
lifecycle of setup keys and stores them in secrets.
A major change here is that we are also switching to using SSA for
resource management.
Part of #172
Signed-off-by: Philip Laine <philip.laine@gmail.com >
2026-04-13 12:20:35 +02:00
Philip Laine and GitHub
f1c382e6f2
Revert "Cleanup routing peer deployment creation" ( #159 )
...
Reverts netbirdio/kubernetes-operator#155
2026-03-23 17:56:43 +01:00
Philip Laine and GitHub
a20570b692
Cleanup resource delete reconcile ( #158 )
...
This fixes resource delete to always run even when there are no
finalizers.
2026-03-23 15:52:14 +01:00
Philip Laine and GitHub
3a36cb6961
Cleanup routing peer deployment creation ( #155 )
...
This refactors the deployment creation for the routing peer to use the
create or update method. Keeping this a lot cleaner. It also changes to
set controller reference using the util method.
2026-03-23 11:44:09 +01:00
Philip Laine and GitHub
8adc8855e5
Add support for private gateway ( #154 )
...
This change adds support for TCPRoutes when using a private gateway
class. This is similar to annotating services today. It also moves the
gateway classes to the Helm chart as it makes things a lot simpler for
the end user as they no longer have to define them.
Signed-off-by: Philip Laine <philip.laine@gmail.com >
2026-03-23 09:59:48 +01:00
Philip Laine and GitHub
54b2ab8efc
Use Gateway listener to reference routing peer ( #150 )
...
This just changes how a routing peer is referenced. In my head this
model makes more sense, especially as we need at least one listener
right now.
Signed-off-by: Philip Laine <philip.laine@gmail.com >
2026-03-20 10:01:06 +01:00
Philip Laine and GitHub
39ab189fae
Share NBResource between different routes ( #149 )
...
This changes the behavior of the Netbird resource so that they can be
shared between routes rather than having one unique created per route.
This is important as we may want to have different route types pointing
to the same service.
Signed-off-by: Philip Laine <philip.laine@gmail.com >
2026-03-19 18:28:35 +01:00
Philip Laine and GitHub
e83dc472e2
Remove webhook for setup key resource ( #148 )
...
The webhook for the NBSetupKey does a mix of runtime validation and
configuration validation. The validation of secret key ref has been
switched to using CEL rules to achieve the same thing.
The other logic is just being removed as it is goes against common
practice in Kubernetes. We should not block secret deletion if a pod is
using the secret. Existing pods will keep running while new pods will
not be able to be created. This is expected behavior in other tools and
should be dealt with during reconcile.
Checking that secrets exist and other dependency problems should be done
during reconcile and then bubbled up with conditions instead.
Signed-off-by: Philip Laine <philip.laine@gmail.com >
2026-03-19 15:48:38 +01:00
Philip Laine and GitHub
7acd175882
Gateway API support ( #117 )
...
This change adds support for the new proxy service to the operator
through Gateway API. This change attempts to standardize concepts around
the Gateway API to allow for compatibility with other projects.
Fixes #111
Fixes #44
Signed-off-by: Philip Laine <philip.laine@gmail.com >
2026-03-19 13:01:58 +01:00
Philip Laine and GitHub
9313fef43d
Share Netbird client between all reconcilers ( #122 )
...
This changes the reconcilers to take a netbird client rather than
creating their own on setup.
Signed-off-by: Philip Laine <philip.laine@gmail.com >
2026-03-16 11:23:26 +01:00
Philip Laine and GitHub
47b1f55c45
Set Go toolchain to v1.26.1 and apply modernizations ( #138 )
...
This change makes sure that we use the latest Go version when building
and applies some modernization fixes.
2026-03-12 21:40:36 +01:00
Philip LaineandGitHub
Luuk BlankenstijnandGitHub
pallieter-verhoeven-glbnxtandGitHub
