mirror of https://github.com/YuzuZensai/netbird-kubernetes-operator.git synced 2026-09-13 10:49:15 +00:00

T

81f7a2bd51 Bump sigs.k8s.io/controller-runtime from 0.20.0 to 0.23.3 (#134 )

Bumps
[sigs.k8s.io/controller-runtime](https://github.com/kubernetes-sigs/controller-runtime)
from 0.20.0 to 0.23.3.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/kubernetes-sigs/controller-runtime/releases">sigs.k8s.io/controller-runtime's
releases</a>.</em></p>
<blockquote>
<h2>v0.23.3</h2>
<h2>What's Changed</h2>
<ul>
<li>🐛 Ensure DefaulterRemoveUnknownOrOmitableFields is still working
even if objects are equal by <a
href="https://github.com/k8s-infra-cherrypick-robot"><code>@k8s-infra-cherrypick-robot</code></a>
in <a
href="https://redirect.github.com/kubernetes-sigs/controller-runtime/pull/3469">kubernetes-sigs/controller-runtime#3469</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/kubernetes-sigs/controller-runtime/compare/v0.23.2...v0.23.3">https://github.com/kubernetes-sigs/controller-runtime/compare/v0.23.2...v0.23.3</a></p>
<h2>v0.23.2</h2>
<h2>What's Changed</h2>
<ul>
<li>🐛 Fix fake client's SSA status patch resource version check by <a
href="https://github.com/k8s-infra-cherrypick-robot"><code>@k8s-infra-cherrypick-robot</code></a>
in <a
href="https://redirect.github.com/kubernetes-sigs/controller-runtime/pull/3446">kubernetes-sigs/controller-runtime#3446</a></li>
<li>✨ Reduce memory usage of default webhooks by <a
href="https://github.com/k8s-infra-cherrypick-robot"><code>@k8s-infra-cherrypick-robot</code></a>
in <a
href="https://redirect.github.com/kubernetes-sigs/controller-runtime/pull/3467">kubernetes-sigs/controller-runtime#3467</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/kubernetes-sigs/controller-runtime/compare/v0.23.1...v0.23.2">https://github.com/kubernetes-sigs/controller-runtime/compare/v0.23.1...v0.23.2</a></p>
<h2>v0.23.1</h2>
<h2>What's Changed</h2>
<ul>
<li>🐛 Cache reader: Wait for cache sync when ReaderFailOnMissingInformer
is true by <a
href="https://github.com/k8s-infra-cherrypick-robot"><code>@k8s-infra-cherrypick-robot</code></a>
in <a
href="https://redirect.github.com/kubernetes-sigs/controller-runtime/pull/3433">kubernetes-sigs/controller-runtime#3433</a></li>
<li>🐛 Fix panic when using CRs with embedded pointer structs by <a
href="https://github.com/k8s-infra-cherrypick-robot"><code>@k8s-infra-cherrypick-robot</code></a>
in <a
href="https://redirect.github.com/kubernetes-sigs/controller-runtime/pull/3436">kubernetes-sigs/controller-runtime#3436</a></li>
<li>🌱 Test cache reader waits for cache sync by <a
href="https://github.com/k8s-infra-cherrypick-robot"><code>@k8s-infra-cherrypick-robot</code></a>
in <a
href="https://redirect.github.com/kubernetes-sigs/controller-runtime/pull/3438">kubernetes-sigs/controller-runtime#3438</a></li>
<li>🐛 Fakeclient: Fix status apply if existing object has
managedFields set by <a
href="https://github.com/k8s-infra-cherrypick-robot"><code>@k8s-infra-cherrypick-robot</code></a>
in <a
href="https://redirect.github.com/kubernetes-sigs/controller-runtime/pull/3437">kubernetes-sigs/controller-runtime#3437</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/kubernetes-sigs/controller-runtime/compare/v0.23.0...v0.23.1">https://github.com/kubernetes-sigs/controller-runtime/compare/v0.23.0...v0.23.1</a></p>
<h2>v0.23.0</h2>
<h2>🔆 Highlights</h2>
<ul>
<li>Client: Add subresource Apply support by <a
href="https://github.com/alvaroaleman"><code>@alvaroaleman</code></a>
in <a
href="https://redirect.github.com/kubernetes-sigs/controller-runtime/pull/3321">kubernetes-sigs/controller-runtime#3321</a></li>
<li>Conversion: Enable implementation of conversion outside of API
packages by <a
href="https://github.com/sbueringer"><code>@sbueringer</code></a> in <a
href="https://redirect.github.com/kubernetes-sigs/controller-runtime/pull/3335">kubernetes-sigs/controller-runtime#3335</a></li>
<li>Priorityqueue: Various improvements, bug fixes and now enabled per
default</li>
<li>Webhooks: Generic Validator and Defaulter by <a
href="https://github.com/alvaroaleman"><code>@alvaroaleman</code></a>
in <a
href="https://redirect.github.com/kubernetes-sigs/controller-runtime/pull/3360">kubernetes-sigs/controller-runtime#3360</a></li>
</ul>
<h2>⚠️ Breaking changes</h2>
<ul>
<li>Dependencies: Update to k8s.io/* v1.35 by <a
href="https://github.com/alvaroaleman"><code>@alvaroaleman</code></a>
<a
href="https://github.com/dongjiang1989"><code>@dongjiang1989</code></a>
<a href="https://github.com/kannon92"><code>@kannon92</code></a> (<a
href="https://redirect.github.com/kubernetes-sigs/controller-runtime/issues/3316">#3316</a>,
<a
href="https://redirect.github.com/kubernetes-sigs/controller-runtime/issues/3349">#3349</a>,
<a
href="https://redirect.github.com/kubernetes-sigs/controller-runtime/issues/3386">#3386</a>,
<a
href="https://redirect.github.com/kubernetes-sigs/controller-runtime/issues/3391">#3391</a>,
<a
href="https://redirect.github.com/kubernetes-sigs/controller-runtime/issues/3401">#3401</a>)</li>
<li>Client: Add subresource Apply support by <a
href="https://github.com/alvaroaleman"><code>@alvaroaleman</code></a>
in <a
href="https://redirect.github.com/kubernetes-sigs/controller-runtime/pull/3321">kubernetes-sigs/controller-runtime#3321</a></li>
<li>Events: Migration to the new events API by <a
href="https://github.com/clebs"><code>@clebs</code></a> in <a
href="https://redirect.github.com/kubernetes-sigs/controller-runtime/pull/3262">kubernetes-sigs/controller-runtime#3262</a>
<ul>
<li>Using the new <code>GetEventRecorderFor</code> requires updating
your rbac for events to use the <code>events.k8s.io</code> apiGroup
rather than the `` (core) apiGroup</li>
</ul>
</li>
<li>Fakeclient: Set ResourceVersion for SSA Create by <a
href="https://github.com/alvaroaleman"><code>@alvaroaleman</code></a>
in <a
href="https://redirect.github.com/kubernetes-sigs/controller-runtime/pull/3311">kubernetes-sigs/controller-runtime#3311</a></li>
<li>Webhooks: Generic Validator and Defaulter by <a
href="https://github.com/alvaroaleman"><code>@alvaroaleman</code></a>
in <a
href="https://redirect.github.com/kubernetes-sigs/controller-runtime/pull/3360">kubernetes-sigs/controller-runtime#3360</a>
<ul>
<li>Existing code of the form
<code>builder.WebhookManagedBy(mgr).For(&amp;corev1.Deployment{})</code>
has to be changed to <code>builder.WebhookManagedBy(mgr,
&amp;appsv1.Deployment{})</code></li>
<li>Existing webhook implementations have to be changed to take the
concrete object rather than <code>runtime.Object</code>, for example
from <code>ValidateCreate(ctx context.Context, obj runtime.Object)
(admission.Warnings, error)</code> to <code>ValidateCreate(ctx
context.Context, obj *appsv1.Deployment) (admission.Warnings,
error)</code></li>
</ul>
</li>
</ul>
<h2>✨ Features</h2>
<ul>
<li>Cache: Allow fine-granular SyncPeriod configuration by <a
href="https://github.com/sbueringer"><code>@sbueringer</code></a> in <a
href="https://redirect.github.com/kubernetes-sigs/controller-runtime/pull/3376">kubernetes-sigs/controller-runtime#3376</a></li>
<li>Client: Add FieldOwner option to client.Options by <a
href="https://github.com/aerfio"><code>@aerfio</code></a> in <a
href="https://redirect.github.com/kubernetes-sigs/controller-runtime/pull/3389">kubernetes-sigs/controller-runtime#3389</a></li>
<li>Client: Add FieldValidation option to client.Options by <a
href="https://github.com/aerfio"><code>@aerfio</code></a> in <a
href="https://redirect.github.com/kubernetes-sigs/controller-runtime/pull/3393">kubernetes-sigs/controller-runtime#3393</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/kubernetes-sigs/controller-runtime/commit/f9589b9f2b9dddf8532b432bb8315f2820ab9971"><code>f9589b9</code></a>
Merge pull request <a
href="https://redirect.github.com/kubernetes-sigs/controller-runtime/issues/3469">#3469</a>
from k8s-infra-cherrypick-robot/cherry-pick-3468-to-...</li>
<li><a
href="https://github.com/kubernetes-sigs/controller-runtime/commit/25615ad1d1229db805cec6b0f3f29f284fe53be1"><code>25615ad</code></a>
Ensure DefaulterRemoveUnknownOrOmitableFields is still working even if
object...</li>
<li><a
href="https://github.com/kubernetes-sigs/controller-runtime/commit/8122a6266696b980fc9219c2fbb48bb4ce60d12b"><code>8122a62</code></a>
Merge pull request <a
href="https://redirect.github.com/kubernetes-sigs/controller-runtime/issues/3467">#3467</a>
from k8s-infra-cherrypick-robot/cherry-pick-3463-to-...</li>
<li><a
href="https://github.com/kubernetes-sigs/controller-runtime/commit/35093c6117da44c29f3a03d06e379d606814018d"><code>35093c6</code></a>
Reduce memory usage of default webhooks</li>
<li><a
href="https://github.com/kubernetes-sigs/controller-runtime/commit/4dbfa5c66aa24a35003c41507385c2a91e94d404"><code>4dbfa5c</code></a>
[release-0.23] 🐛 Fix fake client's SSA status patch resource version
check (#...</li>
<li><a
href="https://github.com/kubernetes-sigs/controller-runtime/commit/f52bbb8bb1a2275cbe90dec8d6c12d5cacb1a7de"><code>f52bbb8</code></a>
Merge pull request <a
href="https://redirect.github.com/kubernetes-sigs/controller-runtime/issues/3437">#3437</a>
from k8s-infra-cherrypick-robot/cherry-pick-3430-to-...</li>
<li><a
href="https://github.com/kubernetes-sigs/controller-runtime/commit/4f41337fdd898537c6633a174cd539cb2e0c4d15"><code>4f41337</code></a>
Merge pull request <a
href="https://redirect.github.com/kubernetes-sigs/controller-runtime/issues/3438">#3438</a>
from k8s-infra-cherrypick-robot/cherry-pick-3434-to-...</li>
<li><a
href="https://github.com/kubernetes-sigs/controller-runtime/commit/e29a1b93fae5c5f22c992c57b11dcf90ccc35c53"><code>e29a1b9</code></a>
seedling: Test cache reader waits for cache sync</li>
<li><a
href="https://github.com/kubernetes-sigs/controller-runtime/commit/83c8dc31c46c621c336c8a7749ee41658b6d17e1"><code>83c8dc3</code></a>
bug: Fakeclient: Fix status apply if existing object has managedFields
set</li>
<li><a
href="https://github.com/kubernetes-sigs/controller-runtime/commit/bf6bcd55b4d5eba00273426d61db313dcd2a6c7f"><code>bf6bcd5</code></a>
Merge pull request <a
href="https://redirect.github.com/kubernetes-sigs/controller-runtime/issues/3436">#3436</a>
from k8s-infra-cherrypick-robot/cherry-pick-3431-to-...</li>
<li>Additional commits viewable in <a
href="https://github.com/kubernetes-sigs/controller-runtime/compare/v0.20.0...v0.23.3">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=sigs.k8s.io/controller-runtime&package-manager=go_modules&previous-version=0.20.0&new-version=0.23.3)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

---------

Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: Philip Laine <philip.laine@gmail.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Philip Laine <philip.laine@gmail.com>

2026-03-11 14:18:09 +01:00

.github

Cleanup workflows and pin action versions (#118 )

2026-03-11 11:24:17 +01:00

api/v1

Add optional privileged mode to NBRoutingPeerSpec (#92 )

2026-03-03 08:29:52 +01:00

cmd

Fix flaky e2e tests (#120 )

2026-03-10 21:31:54 +01:00

crds

Bump chart version to 0.1.10 (#39 )

2025-05-02 19:37:36 +02:00

docs

Add support for running as a init sidecar container (#99 )

2026-02-11 15:20:52 +03:00

examples

Add support for running as a init sidecar container (#99 )

2026-02-11 15:20:52 +03:00

hack

Add initial version with help and admission controller (#1 )

2025-01-29 22:44:09 +01:00

helm

fix: rendering of protocols and ports in NBPolicy (#96 )

2026-03-03 08:58:50 +01:00

internal

Bump sigs.k8s.io/controller-runtime from 0.20.0 to 0.23.3 (#134 )

2026-03-11 14:18:09 +01:00

manifests

Add ingress feature to controller (#5 )

2025-03-06 09:57:45 +01:00

test

Fix flaky e2e tests (#120 )

2026-03-10 21:31:54 +01:00

.dockerignore

Add initial version with help and admission controller (#1 )

2025-01-29 22:44:09 +01:00

.gitignore

Add initial version with help and admission controller (#1 )

2025-01-29 22:44:09 +01:00

.golangci.yml

Bump sigs.k8s.io/controller-runtime from 0.20.0 to 0.23.3 (#134 )

2026-03-11 14:18:09 +01:00

CONTRIBUTOR_LICENSE_AGREEMENT.md

Add CLA (#15 )

2025-03-19 15:12:18 +01:00

Dockerfile

Update Netbird dependency and Golang version (#112 )

2026-03-03 10:31:38 +01:00

Dockerfile.kubectl

Add missing envsubst utility (#101 ) (#102 )

2026-03-03 08:30:27 +01:00

Dockerfile.release

Add initial version with help and admission controller (#1 )

2025-01-29 22:44:09 +01:00

go.mod

Bump sigs.k8s.io/controller-runtime from 0.20.0 to 0.23.3 (#134 )

2026-03-11 14:18:09 +01:00

go.sum

Bump sigs.k8s.io/controller-runtime from 0.20.0 to 0.23.3 (#134 )

2026-03-11 14:18:09 +01:00

LICENSE

Initial commit

2025-01-24 13:01:03 +01:00

Makefile

Remove goreleaser and fix helm packaging (#6 )

2025-03-05 09:03:04 +01:00

PROJECT

Add ingress feature to controller (#5 )

2025-03-06 09:57:45 +01:00

README.md

Add uninstallation doc to README

2025-08-08 14:14:25 +03:00

README.md

NetBird Kubernetes Operator

For easily provisioning access to Kubernetes resources using NetBird.

https://github.com/user-attachments/assets/5472a499-e63d-4301-a513-ad84cfe5ca7b

Description

This operator easily provides NetBird access on Kubernetes clusters, allowing users to access internal resources directly.

Getting Started

Prerequisites

(Recommended) helm version 3+
kubectl version v1.11.3+.
Access to a Kubernetes v1.11.3+ cluster.
(Recommended) Cert Manager.

Deployment

Add helm repository.

helm repo add netbirdio https://netbirdio.github.io/kubernetes-operator

(Recommended) Install cert-manager for k8s API to communicate with the NetBird operator.

kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.17.0/cert-manager.yaml

Add NetBird API token

kubectl create namespace netbird
kubectl -n netbird create secret generic netbird-mgmt-api-key --from-literal=NB_API_KEY=$(cat ~/nb-pat.secret)

(Recommended) Create a values.yaml file, check helm show values netbirdio/kubernetes-operator for more info.
Install using helm install --create-namespace -f values.yaml -n netbird netbird-operator netbirdio/kubernetes-operator.
(Recommended) Check pod status using kubectl get pods -n netbird.
(Optional) Create an exposed-nginx.yaml file to create a Nginx service for testing.
(Optional) Apply the Nginx service:

kubectl apply -f exposed-nginx.yaml

Learn more about the values.yaml options here and Granting controller access to NetBird Management.

Uninstallation

Important

Most operator resources are annotated with finalizers, attempting to delete the namespace will result in hanged deletion.

(If ingress mode is enabled) Remove all instances of netbird.io/expose annotation on Services.
Run helm uninstall -n netbird netbird-operator.
Wait for all deletion jobs to finish.

Version

We have developed and executed tests against Kubernetes v1.31, but it should work with most recent Kubernetes version.

Latest operator version: v0.1.1.

Tested against:

Distribution	Test status	Kubernetes Version
Google GKE	Pass	1.31.5
AWS EKS	Pass	1.31
Azure AKS	Not tested	N/A
OpenShift	Not tested	N/A

We would love community feedback to improve the test matrix. Please submit a PR with your test results.

Usage

Check the usage of usage.md and examples.

Contributing

Prerequisites

To be able to develop this project, you need to have the following tools installed:

Git.
Make.
Go programming language.
Docker CE.
Kubernetes cluster (v1.16+). KIND is recommended.
Kubebuilder.

Running tests

Running unit tests

make test

Running E2E tests

kind create cluster # If not already created, you can check with `kind get clusters`
make test-e2e