fix(netbird): clean up configuration

Signed-off-by: Vegard Hagen <[email protected]>

k8s/infra/controllers/argocd/grpc-route.yaml

@@ -0,0 +1,13 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: GRPCRoute
+metadata:
+  name: argocd
+  namespace: argocd
+spec:
+  parentRefs:
+    - { name: internal, namespace: gateway }
+  hostnames: [ argocd.stonegarden.dev ]
+  rules:
+    - backendRefs: [ { name: argocd-server, port: 443 } ]
+      matches:
+        - headers: [ { name: Content-Type, value: application/grpc } ]

k8s/infra/controllers/argocd/kustomization.yaml

@@ -3,7 +3,7 @@ kind: Kustomization
 
 resources:
   - ns.yaml
-#  - http-route.yaml
+  - grpc-route.yaml
   - tls-route.yaml
   - oidc.yaml
 

k8s/infra/vpn/netbird/agent/daemon-set.yaml

@@ -15,11 +15,11 @@ spec:
       securityContext:
         seccompProfile:
           type: RuntimeDefault
-        sysctls:
+#        sysctls:
-          # Considered unsafe, need to enable with kubelet argument.
+#          # Considered unsafe, need to enable with kubelet argument.
-          # see https://kubernetes.io/docs/tasks/administer-cluster/sysctl-cluster/#enabling-unsafe-sysctls
+#          # see https://kubernetes.io/docs/tasks/administer-cluster/sysctl-cluster/#enabling-unsafe-sysctls
-          - name: net.ipv4.conf.all.src_valid_mark
+#          - name: net.ipv4.conf.all.src_valid_mark
-            value: "1"
+#            value: "1"
       containers:
         - name: agent
           image: docker.io/netbirdio/netbird:0.51.1 # renovate: docker=docker.io/netbirdio/netbird

k8s/infra/vpn/netbird/grpc-route.yaml

@@ -0,0 +1,19 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: GRPCRoute
+metadata:
+  name: grpc-route
+  namespace: netbird
+spec:
+  parentRefs:
+    - { name: external, namespace: gateway }
+    - { name: internal, namespace: gateway }
+  hostnames: [ "netbird.stonegarden.dev" ]
+  rules:
+    - backendRefs: [ { name: management, port: 80 } ]
+      matches:
+        - headers: [ { name: Content-Type, value: application/grpc } ]
+        - method: { service: management.ManagementService }
+    - backendRefs: [ { name: signal, port: 80 } ]
+      matches:
+        - headers: [ { name: Content-Type, value: application/grpc } ]
+        - method: { service: signalexchange.SignalExchange }

k8s/infra/vpn/netbird/http-route.yaml

@@ -5,41 +5,13 @@ metadata:
   namespace: netbird
 spec:
   parentRefs:
-    - name: external
+    - { name: external, namespace: gateway }
-      namespace: gateway
+    - { name: internal, namespace: gateway }
-    - name: internal
+  hostnames: [ "netbird.stonegarden.dev" ]
-      namespace: gateway
-  hostnames:
-    - "netbird.stonegarden.dev"
   rules:
-    - backendRefs:
+    - backendRefs: [ { name: dashboard, port: 80 } ]
-        - name: dashboard
+      matches: [ { path: { type: PathPrefix, value: / } } ]
-          port: 80
+    - backendRefs: [ { name: relay, port: 80 } ]
-      matches:
+      matches: [ { path: { type: PathPrefix, value: /relay } } ]
-        - path:
+    - backendRefs: [ { name: management, port: 80 } ]
-            type: PathPrefix
+      matches: [ { path: { type: PathPrefix, value: /api } } ]
-            value: /
-    - backendRefs:
-        - name: relay
-          port: 80
-      matches:
-        - path:
-            type: PathPrefix
-            value: /relay
-    - backendRefs:
-        - name: management
-          port: 80
-      matches:
-        - path:
-            type: PathPrefix
-            value: /api
-        - path:
-            type: PathPrefix
-            value: /management.ManagementService/
-    - backendRefs:
-        - name: signal
-          port: 80
-      matches:
-        - path:
-            type: PathPrefix
-            value: /signalexchange.SignalExchange/

k8s/infra/vpn/netbird/kustomization.yaml

@@ -4,6 +4,7 @@ kind: Kustomization
 resources:
   - ns.yaml
   - http-route.yaml
+  - grpc-route.yaml
   - relay-secret.yaml
   - coturn-credentials.yaml
   - authelia-oidc-credentials.yaml

k8s/infra/vpn/netbird/management/kustomization.yaml

@@ -12,7 +12,7 @@ configMapGenerator:
     literals:
       - AUTH_AUTHORITY="https://authelia.stonegarden.dev"
       - AUTH_USER_ID_CLAIM="preferred_username"
-      - AUTH_SUPPORTED_SCOPES="openid profile email"
+      - AUTH_SUPPORTED_SCOPES="openid profile email offline_access"
   - name: management-connection-config
     namespace: netbird
     literals: