This change adds a NetBird server to the e2e test and ensures that
cluster proxy peers can start and connect to the server.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Changes**
* Updated the `ClusterProxy` `spec.apiServer` default to include a
trailing `/` when omitted, aligning operator behavior with the
Kubernetes in-cluster API URL.
* **Documentation**
* Refreshed the `ClusterProxySpec.apiServer` API reference to reflect
the trailing `/` default.
* **Tests**
* Improved end-to-end coverage with a dynamically provisioned management
URL, more robust readiness polling, and enhanced `ClusterProxy`
validation.
* **Chores**
* Updated the end-to-end test Go configuration and CI to use the
e2e-specific Go settings/toolchain.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
The proxy container defaults `--management-url` to
`https://api.netbird.io`, so on self-hosted NetBird the proxy talks to
SaaS and rejects the setup key as invalid.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added support for configuring a management URL for the cluster proxy
service.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
This changes the default client image from latest to a pinned digest. It
also enforces that the default image version tag matches the version of
the Netbird dependency.
This makes testing a lot easier and also ensures that we wont get
untested behavior introduced if the client makes a breaking change.
Signed-off-by: Philip Laine <philip.laine@gmail.com>
This change ensures import ordering and aliases is standardized.
Something that is extra important when working with Kuberentes apis that
have "standard" import aliases.
Signed-off-by: Philip Laine <philip.laine@gmail.com>
We dont want to promote the use of the "old" resources with NB prefix so
the Gateway API integration should only support the new ones.
---------
Signed-off-by: Philip Laine <philip.laine@gmail.com>
This change adds two new resources, NetworkRouter and NetworkResource,
which enable clusters to expose Kubernetes services to Netbird.
The NetworkRouter is responsible for creating the network, group, setup
key and routing peer all of which are unique to the isntance. Along with
the deployment of the client in the cluster.
The NetworkResource exposes a service by linking to the specific router
it wants to expose to. This makes coupling between the resource and
network easy to understand.
Routers also set a DNS zone which is used to give names to resources
based on the name and namespace of the service being exposed.
Part of #172
Signed-off-by: Philip Laine <philip.laine@gmail.com>
This change implements a new group resource.
It also sets the standard for a resource reference will be done through
out the controller. A resource reference can either be done by ID or as
a local named reference to the actual resource. This allows end users to
chose if they want to manage things completely in the cluster or not.
Part of #172
Signed-off-by: Philip Laine <philip.laine@gmail.com>
This change implements a new resource called SetupKey that manages the
lifecycle of setup keys and stores them in secrets.
A major change here is that we are also switching to using SSA for
resource management.
Part of #172
Signed-off-by: Philip Laine <philip.laine@gmail.com>
This change adds support for TCPRoutes when using a private gateway
class. This is similar to annotating services today. It also moves the
gateway classes to the Helm chart as it makes things a lot simpler for
the end user as they no longer have to define them.
Signed-off-by: Philip Laine <philip.laine@gmail.com>
This changes the behavior of the Netbird resource so that they can be
shared between routes rather than having one unique created per route.
This is important as we may want to have different route types pointing
to the same service.
Signed-off-by: Philip Laine <philip.laine@gmail.com>
The webhook for the NBSetupKey does a mix of runtime validation and
configuration validation. The validation of secret key ref has been
switched to using CEL rules to achieve the same thing.
The other logic is just being removed as it is goes against common
practice in Kubernetes. We should not block secret deletion if a pod is
using the secret. Existing pods will keep running while new pods will
not be able to be created. This is expected behavior in other tools and
should be dealt with during reconcile.
Checking that secrets exist and other dependency problems should be done
during reconcile and then bubbled up with conditions instead.
Signed-off-by: Philip Laine <philip.laine@gmail.com>
This change adds support for the new proxy service to the operator
through Gateway API. This change attempts to standardize concepts around
the Gateway API to allow for compatibility with other projects.
Fixes#111Fixes#44
Signed-off-by: Philip Laine <philip.laine@gmail.com>
Making the runtime namespace configurable makes it possible to run
locally outside of the cluster. This is useful for quick development
testing.
Signed-off-by: Philip Laine <philip.laine@gmail.com>
HTTP2 was disabled to mitigate security risks from CVE-2023-44487 and
CVE-2023-39325 which have long since been fixed in Go. Removing the
option that was false by default enables http2 and also reduces some
confusion about why it is an option in the first place.
Signed-off-by: Philip Laine <philip.laine@gmail.com>
This change fixes flaky e2e tests with two changes. The first is that
the manager container is checked for ready condition rather than
running. The second is that the webhook server has been registered as
part of the health check to verify it is running before reporting ready
state.
Signed-off-by: Philip Laine <philip.laine@gmail.com>
This change updates Golang CI Lint to the latest version and fixes new
linter errors that came along with the update.
These changes were split out of #112 and are required to update the Go
version.
Docs PR: https://github.com/netbirdio/docs/pull/457
Changes:
* Split kubernetes-operator Chart to operator only chart
(kubernetes-operator) and configuration chart (netbird-operator-config)
* Remove delete validation webhooks for non-needed resources
* Allow abandoning Groups when still linked to a resource for over a
minute after deletion
* Fix duplciate Network Resource retrying heavily
* Fix SetupKey creation duplication
* Skip deleting routing peer since deleting network automatically
deletes it anyway
- It adds a helm chart that will be hosted in the Github pages URL of this repository
- an admission controller operator
- Basic documentation for installing the operator, configuring CRDs and example pod configuration
Philip LaineandGitHub
Luuk BlankenstijnandGitHub
Bethuel MmbagaandGitHub
M. EssamandGitHub
