The majority of users are using the operator with an API key, so the
default should be to look for the secret. This change also removes the
option to set the api key in plain text as that is just bad practice.
Also bumps the chart version to prepare for a minor release.
This change adds a new SidecarProfile resource which allows configuring
client sidecar injection into pods. It replaces the older annotation
based solution. This removes any pod specific configuration from the
setup key and puts it all in this side car configuration.
Fixes#188
Signed-off-by: Philip Laine <philip.laine@gmail.com>
Using kubectl to manage configuration is not a sustainable solution and
not something that we want to promote users to do. This removes the
creation of the image and use of the image in the Helm charts.
This change adds support for TCPRoutes when using a private gateway
class. This is similar to annotating services today. It also moves the
gateway classes to the Helm chart as it makes things a lot simpler for
the end user as they no longer have to define them.
Signed-off-by: Philip Laine <philip.laine@gmail.com>
This changes the behavior of the Netbird resource so that they can be
shared between routes rather than having one unique created per route.
This is important as we may want to have different route types pointing
to the same service.
Signed-off-by: Philip Laine <philip.laine@gmail.com>
The webhook for the NBSetupKey does a mix of runtime validation and
configuration validation. The validation of secret key ref has been
switched to using CEL rules to achieve the same thing.
The other logic is just being removed as it is goes against common
practice in Kubernetes. We should not block secret deletion if a pod is
using the secret. Existing pods will keep running while new pods will
not be able to be created. This is expected behavior in other tools and
should be dealt with during reconcile.
Checking that secrets exist and other dependency problems should be done
during reconcile and then bubbled up with conditions instead.
Signed-off-by: Philip Laine <philip.laine@gmail.com>
Making the runtime namespace configurable makes it possible to run
locally outside of the cluster. This is useful for quick development
testing.
Signed-off-by: Philip Laine <philip.laine@gmail.com>
Minor adjustment to the NBPolicy template to make ports and protocols
render as lists instead of strings.
Previously a values file like
```yaml
policies:
demo-policy:
name: "Demo Policy"
sourceGroups:
- demogroup
- demogroup2
ports:
- 443
- 80
protocols:
- tcp
- udp
```
would result in a rendered manifest like
```yaml
spec:
bidirectional: false
name: Demo Policy
ports:
- 80 443
protocols:
- tcp udp
sourceGroups:
- demogroup
- demogroup2
```
(.spec.ports[0]: expected numeric (int or float), got string)
Docs PR: https://github.com/netbirdio/docs/pull/457
Changes:
* Split kubernetes-operator Chart to operator only chart
(kubernetes-operator) and configuration chart (netbird-operator-config)
* Remove delete validation webhooks for non-needed resources
* Allow abandoning Groups when still linked to a resource for over a
minute after deletion
* Fix duplciate Network Resource retrying heavily
* Fix SetupKey creation duplication
* Skip deleting routing peer since deleting network automatically
deletes it anyway
The reason for this PR is that currently if the secret doesn’t have the
key NB_API_KEY yet at deployment time, the deployment will still run and
pull in an env list that doesn’t include NB_API_KEY since the envFrom
will just pull any and all keys it finds in the secret and makes env
vars out of them. then at a later point, once the NB_API_KEY key is
populated in the secret, one has to bounce the pod to get the key to be
picked up.
if you use the env: valueFrom syntax using a named key, if that named
key doesn’t exist, the deployment should give an error and retry until
the secret key is available
Operator checks for existence of NetBird API key to create controllers
for Service, NBResource, NBPolicy ...etc, while the Helm chart checks
for Values.ingress.enabled, this causes crashes if NetBird API Key is
provided but ingress.enabled is set to `false`.
This fixes this discrepancy by checking NetBird API key in Helm instead
of ingress enabled value.
resolves#13
Goreleaser was causing issues when helm chart action created releases
for packaged helm chart, this PR replaces goreleaser with a much simpler
build and push model, and returns packaged helm charts to normal.
Philip LaineandGitHub
David FischerandGitHub
Bethuel MmbagaandGitHub
M. EssamandGitHub
athulandM. Essam
rarroubaandM. Essam
David FryandGitHub
Maycon SantosandGitHub
David FryandM. Essam
Mykola DzhamandM. Essam