From 3d2de963b5423a9f64a26f5ab47ee7d09070e741 Mon Sep 17 00:00:00 2001 From: Vegard Hagen Date: Sun, 20 Jul 2025 11:30:41 +0200 Subject: [PATCH] fix(netbird): clean up configuration Signed-off-by: Vegard Hagen --- k8s/infra/controllers/argocd/grpc-route.yaml | 13 ++++++ .../controllers/argocd/kustomization.yaml | 2 +- k8s/infra/vpn/netbird/agent/daemon-set.yaml | 10 ++-- k8s/infra/vpn/netbird/grpc-route.yaml | 19 ++++++++ k8s/infra/vpn/netbird/http-route.yaml | 46 ++++--------------- k8s/infra/vpn/netbird/kustomization.yaml | 1 + .../vpn/netbird/management/kustomization.yaml | 2 +- 7 files changed, 49 insertions(+), 44 deletions(-) create mode 100644 k8s/infra/controllers/argocd/grpc-route.yaml create mode 100644 k8s/infra/vpn/netbird/grpc-route.yaml diff --git a/k8s/infra/controllers/argocd/grpc-route.yaml b/k8s/infra/controllers/argocd/grpc-route.yaml new file mode 100644 index 0000000..5916234 --- /dev/null +++ b/k8s/infra/controllers/argocd/grpc-route.yaml @@ -0,0 +1,13 @@ +apiVersion: gateway.networking.k8s.io/v1 +kind: GRPCRoute +metadata: + name: argocd + namespace: argocd +spec: + parentRefs: + - { name: internal, namespace: gateway } + hostnames: [ argocd.stonegarden.dev ] + rules: + - backendRefs: [ { name: argocd-server, port: 443 } ] + matches: + - headers: [ { name: Content-Type, value: application/grpc } ] diff --git a/k8s/infra/controllers/argocd/kustomization.yaml b/k8s/infra/controllers/argocd/kustomization.yaml index 803b4e4..6133fbf 100644 --- a/k8s/infra/controllers/argocd/kustomization.yaml +++ b/k8s/infra/controllers/argocd/kustomization.yaml @@ -3,7 +3,7 @@ kind: Kustomization resources: - ns.yaml -# - http-route.yaml + - grpc-route.yaml - tls-route.yaml - oidc.yaml diff --git a/k8s/infra/vpn/netbird/agent/daemon-set.yaml b/k8s/infra/vpn/netbird/agent/daemon-set.yaml index 39164fe..e3f450f 100644 --- a/k8s/infra/vpn/netbird/agent/daemon-set.yaml +++ b/k8s/infra/vpn/netbird/agent/daemon-set.yaml @@ -15,11 +15,11 @@ spec: securityContext: seccompProfile: type: RuntimeDefault - sysctls: - # Considered unsafe, need to enable with kubelet argument. - # see https://kubernetes.io/docs/tasks/administer-cluster/sysctl-cluster/#enabling-unsafe-sysctls - - name: net.ipv4.conf.all.src_valid_mark - value: "1" +# sysctls: +# # Considered unsafe, need to enable with kubelet argument. +# # see https://kubernetes.io/docs/tasks/administer-cluster/sysctl-cluster/#enabling-unsafe-sysctls +# - name: net.ipv4.conf.all.src_valid_mark +# value: "1" containers: - name: agent image: docker.io/netbirdio/netbird:0.51.1 # renovate: docker=docker.io/netbirdio/netbird diff --git a/k8s/infra/vpn/netbird/grpc-route.yaml b/k8s/infra/vpn/netbird/grpc-route.yaml new file mode 100644 index 0000000..d84bd73 --- /dev/null +++ b/k8s/infra/vpn/netbird/grpc-route.yaml @@ -0,0 +1,19 @@ +apiVersion: gateway.networking.k8s.io/v1 +kind: GRPCRoute +metadata: + name: grpc-route + namespace: netbird +spec: + parentRefs: + - { name: external, namespace: gateway } + - { name: internal, namespace: gateway } + hostnames: [ "netbird.stonegarden.dev" ] + rules: + - backendRefs: [ { name: management, port: 80 } ] + matches: + - headers: [ { name: Content-Type, value: application/grpc } ] + - method: { service: management.ManagementService } + - backendRefs: [ { name: signal, port: 80 } ] + matches: + - headers: [ { name: Content-Type, value: application/grpc } ] + - method: { service: signalexchange.SignalExchange } diff --git a/k8s/infra/vpn/netbird/http-route.yaml b/k8s/infra/vpn/netbird/http-route.yaml index be3129b..5f85985 100644 --- a/k8s/infra/vpn/netbird/http-route.yaml +++ b/k8s/infra/vpn/netbird/http-route.yaml @@ -5,41 +5,13 @@ metadata: namespace: netbird spec: parentRefs: - - name: external - namespace: gateway - - name: internal - namespace: gateway - hostnames: - - "netbird.stonegarden.dev" + - { name: external, namespace: gateway } + - { name: internal, namespace: gateway } + hostnames: [ "netbird.stonegarden.dev" ] rules: - - backendRefs: - - name: dashboard - port: 80 - matches: - - path: - type: PathPrefix - value: / - - backendRefs: - - name: relay - port: 80 - matches: - - path: - type: PathPrefix - value: /relay - - backendRefs: - - name: management - port: 80 - matches: - - path: - type: PathPrefix - value: /api - - path: - type: PathPrefix - value: /management.ManagementService/ - - backendRefs: - - name: signal - port: 80 - matches: - - path: - type: PathPrefix - value: /signalexchange.SignalExchange/ + - backendRefs: [ { name: dashboard, port: 80 } ] + matches: [ { path: { type: PathPrefix, value: / } } ] + - backendRefs: [ { name: relay, port: 80 } ] + matches: [ { path: { type: PathPrefix, value: /relay } } ] + - backendRefs: [ { name: management, port: 80 } ] + matches: [ { path: { type: PathPrefix, value: /api } } ] diff --git a/k8s/infra/vpn/netbird/kustomization.yaml b/k8s/infra/vpn/netbird/kustomization.yaml index c0d4939..44a862e 100644 --- a/k8s/infra/vpn/netbird/kustomization.yaml +++ b/k8s/infra/vpn/netbird/kustomization.yaml @@ -4,6 +4,7 @@ kind: Kustomization resources: - ns.yaml - http-route.yaml + - grpc-route.yaml - relay-secret.yaml - coturn-credentials.yaml - authelia-oidc-credentials.yaml diff --git a/k8s/infra/vpn/netbird/management/kustomization.yaml b/k8s/infra/vpn/netbird/management/kustomization.yaml index ce13780..8efe273 100644 --- a/k8s/infra/vpn/netbird/management/kustomization.yaml +++ b/k8s/infra/vpn/netbird/management/kustomization.yaml @@ -12,7 +12,7 @@ configMapGenerator: literals: - AUTH_AUTHORITY="https://authelia.stonegarden.dev" - AUTH_USER_ID_CLAIM="preferred_username" - - AUTH_SUPPORTED_SCOPES="openid profile email" + - AUTH_SUPPORTED_SCOPES="openid profile email offline_access" - name: management-connection-config namespace: netbird literals: