e752d1587f
Bump github.com/netbirdio/netbird from 0.72.4 to 0.74.7 ( #376 )
...
Bumps
[github.com/netbirdio/netbird](https://github.com/netbirdio/netbird )
from 0.72.4 to 0.74.7.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/netbirdio/netbird/releases ">github.com/netbirdio/netbird's
releases</a>.</em></p>
<blockquote>
<h2>v0.74.7</h2>
<h2>What's Changed</h2>
<ul>
<li>[relay] Handle QUIC connections concurrently to prevent handshake
head-of-line blocking by <a
href="https://github.com/lixmal "><code>@lixmal</code></a> in <a
href="https://redirect.github.com/netbirdio/netbird/pull/6784 ">netbirdio/netbird#6784</a></li>
<li>[client] Reject leading hyphen in getent input to prevent flag
injection by <a
href="https://github.com/lixmal "><code>@lixmal</code></a> in <a
href="https://redirect.github.com/netbirdio/netbird/pull/6787 ">netbirdio/netbird#6787</a></li>
<li>[client] Sanitize peer FQDN/hostname in generated SSH config by <a
href="https://github.com/riccardomanfrin "><code>@riccardomanfrin</code></a>
in <a
href="https://redirect.github.com/netbirdio/netbird/pull/6805 ">netbirdio/netbird#6805</a></li>
<li>[client] Disable gVisor TCP RACK loss detection on Windows by <a
href="https://github.com/lixmal "><code>@lixmal</code></a> in <a
href="https://redirect.github.com/netbirdio/netbird/pull/6808 ">netbirdio/netbird#6808</a></li>
<li>[client] Rename isValidAccessToken to reflect audience-only check by
<a
href="https://github.com/riccardomanfrin "><code>@riccardomanfrin</code></a>
in <a
href="https://redirect.github.com/netbirdio/netbird/pull/6806 ">netbirdio/netbird#6806</a></li>
<li>[client] Bind netstack SOCKS5 proxy to 127.0.0.1 by default by <a
href="https://github.com/riccardomanfrin "><code>@riccardomanfrin</code></a>
in <a
href="https://redirect.github.com/netbirdio/netbird/pull/6812 ">netbirdio/netbird#6812</a></li>
<li>[client] Evaluate IP fragments against firewall ACLs by <a
href="https://github.com/lixmal "><code>@lixmal</code></a> in <a
href="https://redirect.github.com/netbirdio/netbird/pull/6781 ">netbirdio/netbird#6781</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/netbirdio/netbird/compare/v0.74.6...v0.74.7 ">https://github.com/netbirdio/netbird/compare/v0.74.6...v0.74.7 </a></p>
<h2>v0.74.6</h2>
<h2>What's Changed</h2>
<ul>
<li>[client] ios: preserve WireGuard key on interactive re-login (<a
href="https://redirect.github.com/netbirdio/netbird/issues/6777 ">#6777</a>)</li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/netbirdio/netbird/compare/v0.74.5...v0.74.6 ">https://github.com/netbirdio/netbird/compare/v0.74.5...v0.74.6 </a></p>
<h2>v0.74.5</h2>
<h2>What's Changed</h2>
<ul>
<li>[proxy] enforce model allowlist for URL-routed providers
(Bedrock/Vertex) by <a
href="https://github.com/mlsmaycon "><code>@mlsmaycon</code></a> in <a
href="https://redirect.github.com/netbirdio/netbird/pull/6764 ">netbirdio/netbird#6764</a></li>
<li>[management] Remove proxy peer stale deduplication logic by <a
href="https://github.com/mlsmaycon "><code>@mlsmaycon</code></a> in <a
href="https://redirect.github.com/netbirdio/netbird/pull/6768 ">netbirdio/netbird#6768</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/netbirdio/netbird/compare/v0.74.4...v0.74.5 ">https://github.com/netbirdio/netbird/compare/v0.74.4...v0.74.5 </a></p>
<h2>v0.74.4</h2>
<h2>What's Changed</h2>
<ul>
<li>[management] fix: prevent reverse proxy domain from being pushed as
DNS search domain by <a
href="https://github.com/blaugrau90 "><code>@blaugrau90</code></a> in <a
href="https://redirect.github.com/netbirdio/netbird/pull/6498 ">netbirdio/netbird#6498</a></li>
<li>[client] Recover from rosenpass key desync by <a
href="https://github.com/lixmal "><code>@lixmal</code></a> in <a
href="https://redirect.github.com/netbirdio/netbird/pull/6714 ">netbirdio/netbird#6714</a></li>
<li>[client] Bump golang.org/x/crypto to v0.54.0 by <a
href="https://github.com/lixmal "><code>@lixmal</code></a> in <a
href="https://redirect.github.com/netbirdio/netbird/pull/6709 ">netbirdio/netbird#6709</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a
href="https://github.com/blaugrau90 "><code>@blaugrau90</code></a> made
their first contribution in <a
href="https://redirect.github.com/netbirdio/netbird/pull/6498 ">netbirdio/netbird#6498</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/netbirdio/netbird/compare/v0.74.3...v0.74.4 ">https://github.com/netbirdio/netbird/compare/v0.74.3...v0.74.4 </a></p>
<h2>v0.74.3</h2>
<h2>What's Changed</h2>
<ul>
<li>[client] fix MDM managementURL conflict on default-port URL echo by
<a
href="https://github.com/riccardomanfrin "><code>@riccardomanfrin</code></a>
in <a
href="https://redirect.github.com/netbirdio/netbird/pull/6672 ">netbirdio/netbird#6672</a></li>
<li>[client] Update gopsutil to v4 by <a
href="https://github.com/mlsmaycon "><code>@mlsmaycon</code></a> in <a
href="https://redirect.github.com/netbirdio/netbird/pull/6688 ">netbirdio/netbird#6688</a></li>
<li>[client] Fix hanging status command during relay dial by <a
href="https://github.com/theodorsm "><code>@theodorsm</code></a> in <a
href="https://redirect.github.com/netbirdio/netbird/pull/6694 ">netbirdio/netbird#6694</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/netbirdio/netbird/compare/v0.74.2...v0.74.3 ">https://github.com/netbirdio/netbird/compare/v0.74.2...v0.74.3 </a></p>
<h2>v0.74.2</h2>
<h2>What's Changed</h2>
<ul>
<li>[management] Add vLLM e2e test by <a
href="https://github.com/braginini "><code>@braginini</code></a> in <a
href="https://redirect.github.com/netbirdio/netbird/pull/6649 ">netbirdio/netbird#6649</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/netbirdio/netbird/commit/a1c9427d8004576e2cbb9e546d409847fa9df318 "><code>a1c9427</code></a>
[client] Evaluate IP fragments against firewall ACLs (<a
href="https://redirect.github.com/netbirdio/netbird/issues/6781 ">#6781</a>)</li>
<li><a
href="https://github.com/netbirdio/netbird/commit/b7b0d5796e988ac5f369d51d3a16b162d5fb9522 "><code>b7b0d57</code></a>
[client] Bind netstack SOCKS5 proxy to 127.0.0.1 by default (<a
href="https://redirect.github.com/netbirdio/netbird/issues/6812 ">#6812</a>)</li>
<li><a
href="https://github.com/netbirdio/netbird/commit/3f8c4473783424e1642d2991b896add973249d97 "><code>3f8c447</code></a>
[client] Rename isValidAccessToken to reflect audience-only check (<a
href="https://redirect.github.com/netbirdio/netbird/issues/6806 ">#6806</a>)</li>
<li><a
href="https://github.com/netbirdio/netbird/commit/6e3f4d8722d1c3f4482c44aec725aaba80c4512c "><code>6e3f4d8</code></a>
[client] Disable gVisor TCP RACK loss detection on Windows (<a
href="https://redirect.github.com/netbirdio/netbird/issues/6808 ">#6808</a>)</li>
<li><a
href="https://github.com/netbirdio/netbird/commit/099ae4bc6cc8ab95ef16343acb87c33b8197711c "><code>099ae4b</code></a>
[client] Sanitize peer FQDN/hostname in generated SSH config (<a
href="https://redirect.github.com/netbirdio/netbird/issues/6805 ">#6805</a>)</li>
<li><a
href="https://github.com/netbirdio/netbird/commit/63d60ba490794eebd0ad5ce77e4d31269e9c793b "><code>63d60ba</code></a>
[client] Reject leading hyphen in getent input to prevent flag injection
(<a
href="https://redirect.github.com/netbirdio/netbird/issues/6787 ">#6787</a>)</li>
<li><a
href="https://github.com/netbirdio/netbird/commit/62fc8d254e636c3053ae8a21c4ea075558a8273f "><code>62fc8d2</code></a>
[relay] Handle QUIC connections concurrently to prevent handshake
head-of-lin...</li>
<li><a
href="https://github.com/netbirdio/netbird/commit/3a2f773d655d88d16ed953fc2a114a4e690a1b08 "><code>3a2f773</code></a>
[client] preserve WireGuard key on interactive re-login (<a
href="https://redirect.github.com/netbirdio/netbird/issues/6777 ">#6777</a>)</li>
<li><a
href="https://github.com/netbirdio/netbird/commit/f0eed7564f3a9138962da1408986e4666d7137b5 "><code>f0eed75</code></a>
[management] Remove proxy peer stale deduplication logic (<a
href="https://redirect.github.com/netbirdio/netbird/issues/6768 ">#6768</a>)</li>
<li><a
href="https://github.com/netbirdio/netbird/commit/277d8e4c5352950e1ec4fbd21a3266f0412b09fe "><code>277d8e4</code></a>
[proxy] enforce model allowlist for URL-routed providers
(Bedrock/Vertex) (<a
href="https://redirect.github.com/netbirdio/netbird/issues/6 ">#6</a>...</li>
<li>Additional commits viewable in <a
href="https://github.com/netbirdio/netbird/compare/v0.72.4...v0.74.7 ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
<!-- codesmith:footer -->
---
<a
href="https://app.blacksmith.sh/netbirdio/codesmith/kubernetes-operator/pr/376 "><picture><source
media="(prefers-color-scheme: dark)"
srcset="https://pr-comments-assets.blacksmith.sh/codesmith/view-with-codesmith-dark-v2.svg "><source
media="(prefers-color-scheme: light)"
srcset="https://pr-comments-assets.blacksmith.sh/codesmith/view-with-codesmith-light-v2.svg "><img
alt="View with Codesmith"
src="https://pr-comments-assets.blacksmith.sh/codesmith/view-with-codesmith-dark-v2.svg "></picture></a>
<a
href="https://backend.blacksmith.sh/track/enable-autofix?expires=1787085769&installation_id=146802194&pr_number=376&repository=netbirdio%2Fkubernetes-operator&return_to=https%3A%2F%2Fgithub.com%2Fnetbirdio%2Fkubernetes-operator%2Fpull%2F376&signature=2f50a4b5245bbba3f14f2249365f03c700d30db07e15709056766b6a716394dd "><picture><source
media="(prefers-color-scheme: dark)"
srcset="https://pr-comments-assets.blacksmith.sh/codesmith/autofix-with-codesmith-dark.svg "><source
media="(prefers-color-scheme: light)"
srcset="https://pr-comments-assets.blacksmith.sh/codesmith/autofix-with-codesmith-light.svg "><img
alt="Autofix with Codesmith"
src="https://pr-comments-assets.blacksmith.sh/codesmith/autofix-with-codesmith-dark.svg "></picture></a>
<sup>Need help on this PR? Tag <code>/codesmith</code> with what you
need. Autofix is disabled.</sup>
<!-- codesmith:autofix:disabled -->
<!-- /codesmith:footer -->
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-21 11:04:59 +02:00
Philip Laine and GitHub
ea2dafd5a3
Add network egress resource ( #357 )
...
This change adds a new import resource which enables exposing Netbird
resources as Kubernetes services. This remove the need to add sidecars
to every pod.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added a new `NetworkEgress` custom resource (`netbird.io/v1alpha1`)
with CRD, schema validation, and status/conditions.
* Extended controller functionality to create egress services and
translate egress rules into import `EndpointSlice` resources; egress
pods now include a kube-egress-forwarder sidecar.
* **Bug Fixes**
* Added missing deep-copy and declarative apply support for the new
`NetworkEgress` API types.
* **Documentation**
* Updated README/API reference and added example manifests for
`NetworkEgress` (including IP/FQDN target usage).
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Signed-off-by: Philip Laine <philip.laine@gmail.com >
2026-07-17 08:06:53 +02:00
Philip Laine and GitHub
305bc9ca34
Force ownership on apply to resolve conflicts with manual edits ( #309 )
...
If not set the apply will error if a resource has been manually edited.
This changes all apply calls to use force ownership.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Release Notes
* **Bug Fixes**
* Fixed resource ownership handling across multiple controllers to
ensure proper claim and management of Kubernetes resources during
deployment and reconciliation operations.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
2026-06-15 21:25:55 +02:00
Philip Laine and GitHub
c5eaa832d3
Fix noisy reconcile errors ( #275 )
...
Certain errors are better ignored to instead rely on the child resource
to trigger a new reconcile.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Release Notes
* **Bug Fixes**
* Enhanced error handling in group resolution to prevent silent failures
and ensure proper error notification
* Improved system resilience by gracefully handling missing or
unavailable Kubernetes resources without triggering reconciliation
failures
* Optimized setup key processing workflow to enhance overall system
robustness and reliability
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/netbirdio/kubernetes-operator/pull/275?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack )
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
2026-05-29 09:58:14 +02:00
Philip Laine and GitHub
0ffcaca94b
Make network router read only file system by default ( #213 )
...
This changes the router and sidecar to run with read only file system by
default. This is good practice in Kubernetes and often required in most
clusters.
Fixes #144
Fixes #114
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Enhanced DNS configuration handling in containerized deployments with
stricter filesystem access controls and improved security measures.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/netbirdio/kubernetes-operator/pull/213?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack )
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Signed-off-by: Philip Laine <philip.laine@gmail.com >
2026-05-18 11:21:35 +02:00
Philip Laine and GitHub
ea9f1cb081
Modernize for Go 1.26 ( #232 )
...
This change replaces all uses of pointer utils with the new `new`
function which does the same job.
Signed-off-by: Philip Laine <philip.laine@gmail.com >
2026-05-05 13:53:44 +02:00
Philip Laine and GitHub
69afe3aade
Fix SPDX license header ( #231 )
...
This change adds SPDX license headers to all files and eforces it with
the linter.
Signed-off-by: Philip Laine <philip.laine@gmail.com >
2026-05-05 12:59:36 +02:00
Philip Laine and GitHub
74012deb27
Enforce import ordering and aliases ( #216 )
...
This change ensures import ordering and aliases is standardized.
Something that is extra important when working with Kuberentes apis that
have "standard" import aliases.
Signed-off-by: Philip Laine <philip.laine@gmail.com >
2026-04-30 13:39:11 +02:00
Philip Laine and GitHub
37d48b5ca8
Set best practice defaults for network router deployment ( #214 )
...
This change sets some Kubernetes best practices as defaults. Such as
topology spread and pod disruption budget.
It also exposes log level and image settings in the root struct to make
it easier to override commonly configured settings.
Fixes #77
Fixes #162
Signed-off-by: Philip Laine <philip.laine@gmail.com >
2026-04-28 15:18:15 +02:00
Philip Laine and GitHub
91036022c0
Add path component to finalizer ( #202 )
...
The Kubernetes client warns about not having a path component in the
finalizer. This change adds a unqiue path component for each reconciler
kind.
2026-04-23 19:18:06 +02:00
Philip Laine and GitHub
876a0e1eb3
Update Gateway API to use new resources ( #201 )
...
We dont want to promote the use of the "old" resources with NB prefix so
the Gateway API integration should only support the new ones.
---------
Signed-off-by: Philip Laine <philip.laine@gmail.com >
2026-04-23 16:11:15 +02:00
Philip Laine and GitHub
99ef70603f
Allow references to groups by name ( #195 )
...
Group names are unique so we can safely use the name as a reference
method to groups. This makes assigning resources created in the cluster
to groups that already exist a lot easier.
2026-04-23 13:12:09 +02:00
Philip Laine and GitHub
6768a76c9c
Add network router and resource ( #189 )
...
This change adds two new resources, NetworkRouter and NetworkResource,
which enable clusters to expose Kubernetes services to Netbird.
The NetworkRouter is responsible for creating the network, group, setup
key and routing peer all of which are unique to the isntance. Along with
the deployment of the client in the cluster.
The NetworkResource exposes a service by linking to the specific router
it wants to expose to. This makes coupling between the resource and
network easy to understand.
Routers also set a DNS zone which is used to give names to resources
based on the name and namespace of the service being exposed.
Part of #172
Signed-off-by: Philip Laine <philip.laine@gmail.com >
2026-04-23 08:55:49 +02:00
Philip LaineandGitHub
