mirror of
https://github.com/YuzuZensai/netbird-kubernetes-operator.git
synced 2026-09-13 10:49:15 +00:00
dependabot[bot]GitHubdependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>Philip LaineBumps [github.com/netbirdio/netbird](https://github.com/netbirdio/netbird) from 0.66.4 to 0.69.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/netbirdio/netbird/releases">github.com/netbirdio/netbird's releases</a>.</em></p> <blockquote> <h2>v0.69.0</h2> <h2>Release Notes for v0.69.0</h2> <h3>What's New</h3> <p><strong>Reverse Proxy IP Reputation Integration</strong> Now you can use CrowdSec to block malicious traffic based on IP reputation on your exposed service in the reverse proxy.</p> <p>This feature requires self-hosted installations to add another container to their deployment. See instructions in the <a href="https://docs.netbird.io/selfhosted/migration/enable-reverse-proxy#step-7-optional-enable-crowd-sec-ip-reputation">reverse proxy migration documentation</a>.</p> <blockquote> <p>For Cloud users, support is coming soon.</p> </blockquote> <p>Learn more about <a href="https://docs.netbird.io/manage/reverse-proxy">here</a>.</p> <p><strong>macOS p2p connectivity improvements</strong> We've improved macOS p2p connectivity with a better routing exclusion mechanism to avoid loops. Now the client doesn't add /32 routes per remote candidate addresses avoiding limitations on accessing remote peer's local addresses via tunnel connections. Learn more about <a href="https://redirect.github.com/netbirdio/netbird/pull/5918">this change</a>.</p> <blockquote> <p>To use the old behavior run:</p> <p><code>sudo netbird service reconfigure --service-env "NB_USE_LEGACY_ROUTING=true"</code></p> </blockquote> <h4>Client Improvements</h4> <ul> <li>Added <strong>PCP support</strong>. This change adds support for the PCP protocol to the client to improve the rate of P2P connectivity. <a href="https://redirect.github.com/netbirdio/netbird/pull/5219">netbirdio/netbird#5219</a></li> <li>Added <strong>--disable-networks flag</strong> to block network selection for users.<br /> <a href="https://redirect.github.com/netbirdio/netbird/pull/5896">netbirdio/netbird#5896</a></li> <li>Fixed <strong>clearing service env vars with --service-env ""</strong>.<br /> <a href="https://redirect.github.com/netbirdio/netbird/pull/5893">netbirdio/netbird#5893</a></li> <li>Guarded against <strong>container DNAT bypass of ACL rules in iptables</strong>.<br /> <a href="https://redirect.github.com/netbirdio/netbird/pull/5697">netbirdio/netbird#5697</a></li> <li>Populated <strong>NetworkAddresses on iOS for posture checks</strong>.<br /> <a href="https://redirect.github.com/netbirdio/netbird/pull/5900">netbirdio/netbird#5900</a></li> <li>Reconnected <strong>conntrack netlink listener on error</strong>.<br /> <a href="https://redirect.github.com/netbirdio/netbird/pull/5885">netbirdio/netbird#5885</a></li> <li>Replaced <strong>exclusion routes with scoped default + IP_BOUND_IF on macOS</strong>.<br /> <a href="https://redirect.github.com/netbirdio/netbird/pull/5918">netbirdio/netbird#5918</a></li> <li>Fixed <strong>incorrect SSH client config combining Host and Match directives</strong>.<br /> <a href="https://redirect.github.com/netbirdio/netbird/pull/5903">netbirdio/netbird#5903</a></li> <li>Fixed <strong>WGIface.Close deadlock when DNS filter hook re-enters GetDevice</strong>.<br /> <a href="https://redirect.github.com/netbirdio/netbird/pull/5916">netbirdio/netbird#5916</a></li> </ul> <h4>Management Improvements</h4> <ul> <li>Enforced <strong>peer or peer groups requirement for network routers</strong>.<br /> <a href="https://redirect.github.com/netbirdio/netbird/pull/5894">netbirdio/netbird#5894</a></li> <li>Reused <strong>single cache store across all management server consumers</strong>.<br /> <a href="https://redirect.github.com/netbirdio/netbird/pull/5889">netbirdio/netbird#5889</a></li> <li>Fixed <strong>lint error on Google Workspace integration</strong>.<br /> <a href="https://redirect.github.com/netbirdio/netbird/pull/5907">netbirdio/netbird#5907</a></li> </ul> <h4>Proxy Enhancements</h4> <ul> <li>Added <strong>CrowdSec IP reputation integration for reverse proxy</strong>.</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/netbirdio/netbird/commit/3098f48b25e2a613d8f70466243d992c498e0fd2"><code>3098f48</code></a> [client] fix ios network addresses mac filter (<a href="https://redirect.github.com/netbirdio/netbird/issues/5906">#5906</a>)</li> <li><a href="https://github.com/netbirdio/netbird/commit/7f023ce8014084385e677e67c541677336e25431"><code>7f023ce</code></a> [client] Android debug bundle support (<a href="https://redirect.github.com/netbirdio/netbird/issues/5888">#5888</a>)</li> <li><a href="https://github.com/netbirdio/netbird/commit/e3611265159bd372f77ca404d32c86127e036525"><code>e361126</code></a> [client] Fix WGIface.Close deadlock when DNS filter hook re-enters GetDevice ...</li> <li><a href="https://github.com/netbirdio/netbird/commit/95213f715714177b7c9672b3f264f84c9a31cf04"><code>95213f7</code></a> [client] Use Match host+exec instead of Host+Match in SSH client config (<a href="https://redirect.github.com/netbirdio/netbird/issues/5903">#5903</a>)</li> <li><a href="https://github.com/netbirdio/netbird/commit/2e0e3a3601d90a5d7a6b39dc16ebde2522fdf580"><code>2e0e3a3</code></a> [client] Replace exclusion routes with scoped default + IP_BOUND_IF on macOS ...</li> <li><a href="https://github.com/netbirdio/netbird/commit/8ae8f2098fb4bb7a9177b3f2d8d908a413b8fc49"><code>8ae8f20</code></a> [management] chores: fix lint error on google workspace (<a href="https://redirect.github.com/netbirdio/netbird/issues/5907">#5907</a>)</li> <li><a href="https://github.com/netbirdio/netbird/commit/a39787d6796ee26e1f6ad9c67ea33a9da7bf8d66"><code>a39787d</code></a> [infrastructure] Add CrowdSec LAPI container to self-hosted setup script (<a href="https://redirect.github.com/netbirdio/netbird/issues/5880">#5880</a>)</li> <li><a href="https://github.com/netbirdio/netbird/commit/53b04e512af0d94f619e870467115c43d200830b"><code>53b04e5</code></a> [management] Reuse a single cache store across all management server consumer...</li> <li><a href="https://github.com/netbirdio/netbird/commit/633dde8d1f5985afc52071462c42857cb844b9ac"><code>633dde8</code></a> [client] Reconnect conntrack netlink listener on error (<a href="https://redirect.github.com/netbirdio/netbird/issues/5885">#5885</a>)</li> <li><a href="https://github.com/netbirdio/netbird/commit/7e4542adde54ebe71a3a47f5228c5915c9c1052a"><code>7e4542a</code></a> fix(client): populate NetworkAddresses on iOS for posture checks (<a href="https://redirect.github.com/netbirdio/netbird/issues/5900">#5900</a>)</li> <li>Additional commits viewable in <a href="https://github.com/netbirdio/netbird/compare/v0.66.4...v0.69.0">compare view</a></li> </ul> </details> <br /> --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Philip Laine <philip.laine@gmail.com>
NetBird Kubernetes Operator
For easily provisioning access to Kubernetes resources using NetBird.
https://github.com/user-attachments/assets/5472a499-e63d-4301-a513-ad84cfe5ca7b
Description
This operator easily provides NetBird access on Kubernetes clusters, allowing users to access internal resources directly.
Getting Started
Prerequisites
- (Recommended) helm version 3+
- kubectl version v1.11.3+.
- Access to a Kubernetes v1.11.3+ cluster.
- (Recommended) Cert Manager.
Deployment
- Add helm repository.
helm repo add netbirdio https://netbirdio.github.io/kubernetes-operator
- (Recommended) Install cert-manager for k8s API to communicate with the NetBird operator.
kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.17.0/cert-manager.yaml
- Add NetBird API token
kubectl create namespace netbird
kubectl -n netbird create secret generic netbird-mgmt-api-key --from-literal=NB_API_KEY=$(cat ~/nb-pat.secret)
- (Recommended) Create a
values.yamlfile, checkhelm show values netbirdio/kubernetes-operatorfor more info. - Install using
helm install --create-namespace -f values.yaml -n netbird netbird-operator netbirdio/kubernetes-operator. - (Recommended) Check pod status using
kubectl get pods -n netbird. - (Optional) Create an
exposed-nginx.yamlfile to create a Nginx service for testing. - (Optional) Apply the Nginx service:
kubectl apply -f exposed-nginx.yaml
Learn more about the values.yaml options here and Granting controller access to NetBird Management.
Uninstallation
Important
Most operator resources are annotated with finalizers, attempting to delete the namespace will result in hanged deletion.
- (If ingress mode is enabled) Remove all instances of
netbird.io/exposeannotation on Services. - Run
helm uninstall -n netbird netbird-operator. - Wait for all deletion jobs to finish.
Version
We have developed and executed tests against Kubernetes v1.31, but it should work with most recent Kubernetes version.
Latest operator version: v0.1.1.
Tested against:
| Distribution | Test status | Kubernetes Version |
|---|---|---|
| Google GKE | Pass | 1.31.5 |
| AWS EKS | Pass | 1.31 |
| Azure AKS | Not tested | N/A |
| OpenShift | Not tested | N/A |
We would love community feedback to improve the test matrix. Please submit a PR with your test results.
Usage
Check the usage of usage.md and examples.
Contributing
Prerequisites
To be able to develop this project, you need to have the following tools installed:
- Git.
- Make.
- Go programming language.
- Docker CE.
- Kubernetes cluster (v1.16+). KIND is recommended.
- Kubebuilder.
Running tests
Running unit tests
make test
Running E2E tests
kind create cluster # If not already created, you can check with `kind get clusters`
make test-e2e