mirror of
https://github.com/YuzuZensai/netbird-kubernetes-operator.git
synced 2026-09-13 10:49:15 +00:00
Christian De LeonandGitHub
6c855c5d4e
# Fix: NetBird extra-dns-labels not being applied to pods ## Problem The `netbird.io/extra-dns-labels` annotation was not working when applied to pods. Despite the webhook detecting the annotation and adding it to the NetBird container configuration, the extra DNS labels were not appearing in the NetBird UI or being applied to registered peers. ## Root Cause The pod webhook had two issues: 1. **Invalid setup key argument**: The webhook was passing `--setup-key-file /etc/nbkey` to the NetBird client, but this file path was never created. The setup key was already being passed via the `NB_SETUP_KEY` environment variable, making the file-based approach unnecessary and causing confusion in the client startup. 2. **NetBird CLI flag bug**: The webhook was using the `--extra-dns-labels` command line flag, but NetBird has a known issue ([netbirdio/netbird#4282](https://github.com/netbirdio/netbird/issues/4282)) where this flag is not properly processed. The workaround is to use the `NB_EXTRA_DNS_LABELS` environment variable instead. ## Solution - Removed the `--setup-key-file` argument entirely since the setup key is provided via environment variable - Removed all command line arguments from the NetBird container - Added `NB_EXTRA_DNS_LABELS` environment variable when the `netbird.io/extra-dns-labels` annotation is present - NetBird client now uses only environment variables for configuration, which is more reliable and matches the pattern used by the NBRoutingPeer controller ## Changes **Before:** ```go args := []string{ "--setup-key-file", "/etc/nbkey", "-m", managementURL, } // ... add extra-dns-labels to args ``` **After:** ```go envVars := []corev1.EnvVar{ {Name: "NB_SETUP_KEY", ValueFrom: ...}, {Name: "NB_MANAGEMENT_URL", Value: managementURL}, } // ... conditionally add NB_EXTRA_DNS_LABELS to envVars ``` ## Testing 1. Create a deployment with the `netbird.io/setup-key` and `netbird.io/extra-dns-labels` annotations: ```yaml annotations: netbird.io/setup-key: my-setup-key netbird.io/extra-dns-labels: "my-label,another-label" ``` 2. Verify the environment variable is set: ```bash kubectl get pod <pod-name> -o jsonpath='{.spec.containers[?(@.name=="netbird")].env[*]}' | jq . ``` 3. Check the NetBird UI to confirm the extra DNS labels appear on the registered peer 4. Verify the NetBird container logs show successful registration without errors ## References - NetBird issue: https://github.com/netbirdio/netbird/issues/4282 - Documentation: [Extra DNS Labels](https://docs.netbird.io/how-to/routing-traffic-to-private-networks#extra-dns-labels) --- This fix ensures that the `netbird.io/extra-dns-labels` annotation works as documented and provides a more robust configuration method by using environment variables consistently across all NetBird deployments in the operator.
NetBird Kubernetes Operator
For easily provisioning access to Kubernetes resources using NetBird.
https://github.com/user-attachments/assets/5472a499-e63d-4301-a513-ad84cfe5ca7b
Description
This operator easily provides NetBird access on Kubernetes clusters, allowing users to access internal resources directly.
Getting Started
Prerequisites
- (Recommended) helm version 3+
- kubectl version v1.11.3+.
- Access to a Kubernetes v1.11.3+ cluster.
- (Recommended) Cert Manager.
Deployment
- Add helm repository.
helm repo add netbirdio https://netbirdio.github.io/kubernetes-operator
- (Recommended) Install cert-manager for k8s API to communicate with the NetBird operator.
kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.17.0/cert-manager.yaml
- Add NetBird API token
kubectl create namespace netbird
kubectl -n netbird create secret generic netbird-mgmt-api-key --from-literal=NB_API_KEY=$(cat ~/nb-pat.secret)
- (Recommended) Create a
values.yamlfile, checkhelm show values netbirdio/kubernetes-operatorfor more info. - Install using
helm install --create-namespace -f values.yaml -n netbird netbird-operator netbirdio/kubernetes-operator. - (Recommended) Check pod status using
kubectl get pods -n netbird. - (Optional) Create an
exposed-nginx.yamlfile to create a Nginx service for testing. - (Optional) Apply the Nginx service:
kubectl apply -f exposed-nginx.yaml
Learn more about the values.yaml options here and Granting controller access to NetBird Management.
Uninstallation
Important
Most operator resources are annotated with finalizers, attempting to delete the namespace will result in hanged deletion.
- (If ingress mode is enabled) Remove all instances of
netbird.io/exposeannotation on Services. - Run
helm uninstall -n netbird netbird-operator. - Wait for all deletion jobs to finish.
Version
We have developed and executed tests against Kubernetes v1.31, but it should work with most recent Kubernetes version.
Latest operator version: v0.1.1.
Tested against:
| Distribution | Test status | Kubernetes Version |
|---|---|---|
| Google GKE | Pass | 1.31.5 |
| AWS EKS | Pass | 1.31 |
| Azure AKS | Not tested | N/A |
| OpenShift | Not tested | N/A |
We would love community feedback to improve the test matrix. Please submit a PR with your test results.
Usage
Check the usage of usage.md and examples.
Contributing
Prerequisites
To be able to develop this project, you need to have the following tools installed:
- Git.
- Make.
- Go programming language.
- Docker CE.
- Kubernetes cluster (v1.16+). KIND is recommended.
- Kubebuilder.
Running tests
Running unit tests
make test
Running E2E tests
kind create cluster # If not already created, you can check with `kind get clusters`
make test-e2e