This change adds an option to specify groups a cluster proxy peer is a
member of.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added optional `spec.groups` to the ClusterProxy custom resource to
associate group references by `id`, `name`, or `localRef`.
* CRD schema includes OpenAPI validation to enforce that each group
reference specifies exactly one selector.
* **Bug Fixes**
* Improved deep-copy behavior for ClusterProxy spec so group references
are copied safely and don’t share underlying slices.
* **Documentation**
* Updated API reference docs and README API table to include the new
`groups` field.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
This change updates the api proxy version and configures a readiness
probe.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Release Notes
* **Improvements**
* Enhanced cluster proxy health monitoring with readiness checks.
* Increased cluster proxy replicas to 3 for improved availability and
resilience.
* Updated kubeapi-proxy to the latest version.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
If not set the apply will error if a resource has been manually edited.
This changes all apply calls to use force ownership.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Release Notes
* **Bug Fixes**
* Fixed resource ownership handling across multiple controllers to
ensure proper claim and management of Kubernetes resources during
deployment and reconciliation operations.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Adds more unit tests to sections that are easy to test.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Tests**
* Added unit tests for Kubernetes owner-reference and finalizer helper
functions to ensure correct behavior.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
This ensures that we can always upgrade from the latest release. Covers
easy mistakes like changes to the Helm chart modifying label selectors.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Tests**
* Enhanced E2E test setup with improved Helm chart integration
* Added support for OCI registry chart downloads in test deployments
* E2E tests now support both development and production deployment
scenarios
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated code coverage configuration to refine coverage reporting
accuracy.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Adds code coverage to Go unit tests.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Integrated automated unit test coverage reporting with Codecov
integration
* Restructured test execution to separate unit and end-to-end tests into
distinct workflows
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Certain errors are better ignored to instead rely on the child resource
to trigger a new reconcile.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Release Notes
* **Bug Fixes**
* Enhanced error handling in group resolution to prevent silent failures
and ensure proper error notification
* Improved system resilience by gracefully handling missing or
unavailable Kubernetes resources without triggering reconciliation
failures
* Optimized setup key processing workflow to enhance overall system
robustness and reliability
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/netbirdio/kubernetes-operator/pull/275?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
When a pod does not have any annotations the injector will fail. This
change adds a test for the case and also fixes the issue.
Fixes#246
Signed-off-by: Philip Laine <philip.laine@gmail.com>
This changes the CRD directory and makes sure it stays up to date. The
Helm chart will update the CRDs by copying them from the config
directory.
Signed-off-by: Philip Laine <philip.laine@gmail.com>
This change does a few things, none of these are breaking.
It changes the registry from Docker Hub to GHCR, as we dont have the
same rate limiting issues with unauthenticated pulls.
It changes the release process to push the Helm chart as an OCI artifact
removing the need for GH pages.
It renames both the image and chart from kubernetes-operator to
netbird-operator. This name is cleaner and easier for people to
understand in a sea of Helm charts. Funnily enough this is not a
breaking change as the release name is used and not the chart name. So
in place upgrades just work.
Fixes#207
Signed-off-by: Philip Laine <philip.laine@gmail.com>
This change replaces all uses of pointer utils with the new `new`
function which does the same job.
Signed-off-by: Philip Laine <philip.laine@gmail.com>
This is a minimal version of #228 which just spins up a cluster and
verifies that the operator starts. Once this is merged expanding the e2e
tests will be easier. In the meantime we have some validation that the
Helm chart will run in a cluster.
Signed-off-by: Philip Laine <philip.laine@gmail.com>
This changes the group reconcile to get the existing group first and
then update it in place. If not done like this peers will be removed
from the group on the next reconcile.
Fixes#221
This changes the default client image from latest to a pinned digest. It
also enforces that the default image version tag matches the version of
the Netbird dependency.
This makes testing a lot easier and also ensures that we wont get
untested behavior introduced if the client makes a breaking change.
Signed-off-by: Philip Laine <philip.laine@gmail.com>
This change moves building the Go binary out of the Dockerfile, and also
fixes some issues in the makefile. These things will speed up build
times and avoid rebuilding when not needed. Additionally it will make
getting version data easier to use as part of the user agent.
Signed-off-by: Philip Laine <philip.laine@gmail.com>
This change ensures import ordering and aliases is standardized.
Something that is extra important when working with Kuberentes apis that
have "standard" import aliases.
Signed-off-by: Philip Laine <philip.laine@gmail.com>
Managing the Golang CI Lint version is a bit cumbersome when it is hard
coded in the Makefile. This switches to using the local version. In the
end the version specified in the GH actions flow with be the authority.
This change sets some Kubernetes best practices as defaults. Such as
topology spread and pod disruption budget.
It also exposes log level and image settings in the root struct to make
it easier to override commonly configured settings.
Fixes#77Fixes#162
Signed-off-by: Philip Laine <philip.laine@gmail.com>
The e2e tests that existed before are flaky and test the old resources.
This change removes them until we have implemented new e2e tests for the
new resources.
Part of #209
This updates the documentation and examples to use the new resources. It
also adds automatic documentation creation for the api reference.
Signed-off-by: Philip Laine <philip.laine@gmail.com>
The majority of users are using the operator with an API key, so the
default should be to look for the secret. This change also removes the
option to set the api key in plain text as that is just bad practice.
Also bumps the chart version to prepare for a minor release.
This change adds a new SidecarProfile resource which allows configuring
client sidecar injection into pods. It replaces the older annotation
based solution. This removes any pod specific configuration from the
setup key and puts it all in this side car configuration.
Fixes#188
Signed-off-by: Philip Laine <philip.laine@gmail.com>
We dont want to promote the use of the "old" resources with NB prefix so
the Gateway API integration should only support the new ones.
---------
Signed-off-by: Philip Laine <philip.laine@gmail.com>
Group names are unique so we can safely use the name as a reference
method to groups. This makes assigning resources created in the cluster
to groups that already exist a lot easier.
This change updates the dependabot interval to run weekly. It also
groups all Github Actions update into a single PR. This will make
dependency updates a bit easier to manage without spamming too many PRs.
Network resource names are unique per Netbird account. This change moves
the existing name to the description and uses the UID for the name of
the resource instead.
Using kubectl to manage configuration is not a sustainable solution and
not something that we want to promote users to do. This removes the
creation of the image and use of the image in the Helm charts.
This change adds two new resources, NetworkRouter and NetworkResource,
which enable clusters to expose Kubernetes services to Netbird.
The NetworkRouter is responsible for creating the network, group, setup
key and routing peer all of which are unique to the isntance. Along with
the deployment of the client in the cluster.
The NetworkResource exposes a service by linking to the specific router
it wants to expose to. This makes coupling between the resource and
network easy to understand.
Routers also set a DNS zone which is used to give names to resources
based on the name and namespace of the service being exposed.
Part of #172
Signed-off-by: Philip Laine <philip.laine@gmail.com>
This change adds a ready condition. It also sets a standard for status
fields and documentation. It makes use of helper functions from FluxCD
to better manage patching of finalizers and status.
Signed-off-by: Philip Laine <philip.laine@gmail.com>
This makes testing of the operator a lot simpler by enabling a quick way
to implement the crud endpoints for all the resources used.
Signed-off-by: Philip Laine <philip.laine@gmail.com>
This change implements a new group resource.
It also sets the standard for a resource reference will be done through
out the controller. A resource reference can either be done by ID or as
a local named reference to the actual resource. This allows end users to
chose if they want to manage things completely in the cluster or not.
Part of #172
Signed-off-by: Philip Laine <philip.laine@gmail.com>
This change implements a new resource called SetupKey that manages the
lifecycle of setup keys and stores them in secrets.
A major change here is that we are also switching to using SSA for
resource management.
Part of #172
Signed-off-by: Philip Laine <philip.laine@gmail.com>
This refactors the deployment creation for the routing peer to use the
create or update method. Keeping this a lot cleaner. It also changes to
set controller reference using the util method.
This change adds support for TCPRoutes when using a private gateway
class. This is similar to annotating services today. It also moves the
gateway classes to the Helm chart as it makes things a lot simpler for
the end user as they no longer have to define them.
Signed-off-by: Philip Laine <philip.laine@gmail.com>
This just changes how a routing peer is referenced. In my head this
model makes more sense, especially as we need at least one listener
right now.
Signed-off-by: Philip Laine <philip.laine@gmail.com>
This changes the behavior of the Netbird resource so that they can be
shared between routes rather than having one unique created per route.
This is important as we may want to have different route types pointing
to the same service.
Signed-off-by: Philip Laine <philip.laine@gmail.com>
The webhook for the NBSetupKey does a mix of runtime validation and
configuration validation. The validation of secret key ref has been
switched to using CEL rules to achieve the same thing.
The other logic is just being removed as it is goes against common
practice in Kubernetes. We should not block secret deletion if a pod is
using the secret. Existing pods will keep running while new pods will
not be able to be created. This is expected behavior in other tools and
should be dealt with during reconcile.
Checking that secrets exist and other dependency problems should be done
during reconcile and then bubbled up with conditions instead.
Signed-off-by: Philip Laine <philip.laine@gmail.com>
This change adds support for the new proxy service to the operator
through Gateway API. This change attempts to standardize concepts around
the Gateway API to allow for compatibility with other projects.
Fixes#111Fixes#44
Signed-off-by: Philip Laine <philip.laine@gmail.com>
Making the runtime namespace configurable makes it possible to run
locally outside of the cluster. This is useful for quick development
testing.
Signed-off-by: Philip Laine <philip.laine@gmail.com>
HTTP2 was disabled to mitigate security risks from CVE-2023-44487 and
CVE-2023-39325 which have long since been fixed in Go. Removing the
option that was false by default enables http2 and also reduces some
confusion about why it is an option in the first place.
Signed-off-by: Philip Laine <philip.laine@gmail.com>
Manifest generation has drifted from what is committed to the repo. This
change adds checks for both manifests and code generation to make sure
it is up to date in every PR.
This change does some cleanup of the actions workflows to makes them
faster to run and easier to debug. It pins all of the actions workflows
to specific commit hashes. Dependabot will be enabled in a separate PR
to manage updates.
Signed-off-by: Philip Laine <philip.laine@gmail.com>
This change fixes flaky e2e tests with two changes. The first is that
the manager container is checked for ready condition rather than
running. The second is that the webhook server has been registered as
part of the health check to verify it is running before reporting ready
state.
Signed-off-by: Philip Laine <philip.laine@gmail.com>
This change updates the Netbird dependency to the latest version to
enabled #111 to be implemented with future API additions. This change
requires updating the Go version as the upstream dependency requires it.
An interesting aspect that was required was to pin the dex dependency to
v2. It seems like the Netbird go.mod is doing something unexpected with
their version.
Signed-off-by: Philip Laine <philip.laine@gmail.com>
This change updates Golang CI Lint to the latest version and fixes new
linter errors that came along with the update.
These changes were split out of #112 and are required to update the Go
version.
Philip LaineandGitHub
