From 56d2a42b9df670bfe0b450afc2c65fc2ab39d220 Mon Sep 17 00:00:00 2001 From: Vegard Hagen Date: Sun, 5 Jan 2025 10:00:03 +0100 Subject: [PATCH] feat(netbird): replace backend helm chart with plain manifests no need for all the patching anymore --- k8s/infra/vpn/netbird/agent/daemon-set.yaml | 7 + .../vpn/netbird/backend/kustomization.yaml | 25 ---- .../patches/add-oidc-key-checker-sidecar.yaml | 68 ---------- .../backend/patches/add-relay-config.yaml | 92 ------------- .../deployment-strategy-management.yaml | 7 - .../patches/deployment-strategy-signal.yaml | 7 - .../backend/patches/dns-management.yaml | 11 -- k8s/infra/vpn/netbird/backend/values.yaml | 50 ------- .../vpn/netbird/dashboard/deployment.yaml | 3 +- k8s/infra/vpn/netbird/http-route.yaml | 4 +- k8s/infra/vpn/netbird/kustomization.yaml | 7 +- .../management/config/check-oidc-keys.sh | 40 ++++++ .../management/config/management.tmpl.json | 67 ++++++++++ .../vpn/netbird/management/deployment.yaml | 123 ++++++++++++++++++ .../vpn/netbird/management/kustomization.yaml | 57 ++++++++ .../oidc-credentials.yaml | 0 .../pvc.yaml} | 8 +- .../secret-coturn-credentials.yaml | 0 k8s/infra/vpn/netbird/management/svc.yaml | 13 ++ .../x-oidc-client.yaml | 0 k8s/infra/vpn/netbird/signal/deployment.yaml | 48 +++++++ .../vpn/netbird/signal/kustomization.yaml | 14 ++ .../pvc.yaml} | 8 +- k8s/infra/vpn/netbird/signal/svc.yaml | 13 ++ 24 files changed, 402 insertions(+), 270 deletions(-) delete mode 100644 k8s/infra/vpn/netbird/backend/kustomization.yaml delete mode 100644 k8s/infra/vpn/netbird/backend/patches/add-oidc-key-checker-sidecar.yaml delete mode 100644 k8s/infra/vpn/netbird/backend/patches/add-relay-config.yaml delete mode 100644 k8s/infra/vpn/netbird/backend/patches/deployment-strategy-management.yaml delete mode 100644 k8s/infra/vpn/netbird/backend/patches/deployment-strategy-signal.yaml delete mode 100644 k8s/infra/vpn/netbird/backend/patches/dns-management.yaml delete mode 100644 k8s/infra/vpn/netbird/backend/values.yaml create mode 100644 k8s/infra/vpn/netbird/management/config/check-oidc-keys.sh create mode 100644 k8s/infra/vpn/netbird/management/config/management.tmpl.json create mode 100644 k8s/infra/vpn/netbird/management/deployment.yaml create mode 100644 k8s/infra/vpn/netbird/management/kustomization.yaml rename k8s/infra/vpn/netbird/{backend => management}/oidc-credentials.yaml (100%) rename k8s/infra/vpn/netbird/{backend/patches/pvc-backend-management.yaml => management/pvc.yaml} (51%) rename k8s/infra/vpn/netbird/{backend => management}/secret-coturn-credentials.yaml (100%) create mode 100644 k8s/infra/vpn/netbird/management/svc.yaml rename k8s/infra/vpn/netbird/{backend => management}/x-oidc-client.yaml (100%) create mode 100644 k8s/infra/vpn/netbird/signal/deployment.yaml create mode 100644 k8s/infra/vpn/netbird/signal/kustomization.yaml rename k8s/infra/vpn/netbird/{backend/patches/pvc-backend-signal.yaml => signal/pvc.yaml} (51%) create mode 100644 k8s/infra/vpn/netbird/signal/svc.yaml diff --git a/k8s/infra/vpn/netbird/agent/daemon-set.yaml b/k8s/infra/vpn/netbird/agent/daemon-set.yaml index a0d6724..c801710 100644 --- a/k8s/infra/vpn/netbird/agent/daemon-set.yaml +++ b/k8s/infra/vpn/netbird/agent/daemon-set.yaml @@ -36,6 +36,13 @@ spec: volumeMounts: - name: config mountPath: /config + resources: + requests: + memory: 192Mi + cpu: 100m + limits: + memory: 256Mi + cpu: 4000m volumes: - name: config emptyDir: { } diff --git a/k8s/infra/vpn/netbird/backend/kustomization.yaml b/k8s/infra/vpn/netbird/backend/kustomization.yaml deleted file mode 100644 index 55f0d83..0000000 --- a/k8s/infra/vpn/netbird/backend/kustomization.yaml +++ /dev/null @@ -1,25 +0,0 @@ -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization -namespace: netbird - -resources: - - secret-coturn-credentials.yaml - - oidc-credentials.yaml - - x-oidc-client.yaml - -helmCharts: - - name: netbird - repo: https://charts.jaconi.io - releaseName: netbird-backend - namespace: netbird - version: 0.14.2 - valuesFile: values.yaml - -patches: - - path: patches/add-oidc-key-checker-sidecar.yaml - - path: patches/add-relay-config.yaml - - path: patches/dns-management.yaml # resolve auth admin-endpoint to internal gateway - - path: patches/deployment-strategy-management.yaml - - path: patches/deployment-strategy-signal.yaml - - path: patches/pvc-backend-management.yaml - - path: patches/pvc-backend-signal.yaml diff --git a/k8s/infra/vpn/netbird/backend/patches/add-oidc-key-checker-sidecar.yaml b/k8s/infra/vpn/netbird/backend/patches/add-oidc-key-checker-sidecar.yaml deleted file mode 100644 index 35466f8..0000000 --- a/k8s/infra/vpn/netbird/backend/patches/add-oidc-key-checker-sidecar.yaml +++ /dev/null @@ -1,68 +0,0 @@ -apiVersion: apps/v1 -kind: Deployment -metadata: - name: netbird-backend-management -spec: - template: - metadata: - annotations: - kubectl.kubernetes.io/default-container: netbird-management - spec: - containers: - - name: oidc-key-checker - image: registry.gitlab.com/gitlab-ci-utils/curl-jq:3.1.0 # renovate: docker=registry.gitlab.com/gitlab-ci-utils/curl-jq - command: ["/bin/bash"] - args: - - -c - - | - #!/bin/bash - OIDC_ENDPOINT=$(jq -r '.HttpConfig.OIDCConfigEndpoint' /etc/netbird/management.json) - CHECK_INTERVAL="${CHECK_INTERVAL:-3600}" - KEYS_FILE="/data/oidc_keys.json" - - fetch_keys() { - config=$(curl -s "$OIDC_ENDPOINT") - jwks_uri=$(echo "$config" | jq -r '.jwks_uri') - curl -s "$jwks_uri" - } - - keys_changed() { - local new_keys="$1" - if [ ! -f "$KEYS_FILE" ]; then - return 0 - fi - local old_keys=$(cat "$KEYS_FILE") - [ "$new_keys" != "$old_keys" ] - } - - restart_pod() { - echo "Restarting pod..." - kill 1 - } - - while true; do - echo "Fetching OIDC keys..." - new_keys=$(fetch_keys) - - if keys_changed "$new_keys"; then - echo "Keys have changed. Updating stored keys..." - echo "$new_keys" > "$KEYS_FILE" - restart_pod - else - echo "Keys have not changed. No action required." - fi - - echo "Sleeping for $CHECK_INTERVAL seconds..." - sleep "$CHECK_INTERVAL" - done - env: - - name: CHECK_INTERVAL - value: "900" - volumeMounts: - - name: config - mountPath: /etc/netbird - - name: data - mountPath: /data - volumes: - - name: data - emptyDir: {} diff --git a/k8s/infra/vpn/netbird/backend/patches/add-relay-config.yaml b/k8s/infra/vpn/netbird/backend/patches/add-relay-config.yaml deleted file mode 100644 index 2c23f63..0000000 --- a/k8s/infra/vpn/netbird/backend/patches/add-relay-config.yaml +++ /dev/null @@ -1,92 +0,0 @@ ---- -apiVersion: v1 -kind: ConfigMap -metadata: - name: netbird-backend-management -data: - management.tmpl.json: |- - { - "Stuns": [ - { - "Proto": "udp", - "URI": "${NETBIRD_STUN_URI}", - "Username": "", - "Password": null - } - ], - "TURNConfig": { - "Turns": [ - { - "Proto": "udp", - "URI": "${NETBIRD_TURN_URI}", - "Username": "${NETBIRD_TURN_USER}", - "Password": "${NETBIRD_TURN_PASSWORD}" - } - ], - "CredentialsTTL": "12h", - "Secret": "secret", - "TimeBasedCredentials": false - }, - "Signal": { - "Proto": "${NETBIRD_SIGNAL_PROTOCOL}", - "URI": "${NETBIRD_SIGNAL_URI}", - "Username": "", - "Password": null - }, - "Datadir": "", - "HttpConfig": { - "Address": "0.0.0.0:80", - "AuthAudience": "${NETBIRD_AUTH_AUDIENCE}", - "AuthUserIDClaim": "${NETBIRD_AUTH_USER_ID_CLAIM:-sub}", - "CertFile": "${NETBIRD_MGMT_API_CERT_FILE}", - "CertKey": "${NETBIRD_MGMT_API_CERT_KEY_FILE}", - "OIDCConfigEndpoint": "${NETBIRD_AUTH_OIDC_CONFIGURATION_ENDPOINT}" - }, - "IdpManagerConfig": { - "ManagerType": "${NETBIRD_IDP_MANAGER_TYPE}", - "${NETBIRD_IDP_MANAGER_TYPE^}ClientCredentials": { - "ClientID": "${NETBIRD_IDP_CLIENT_ID}", - "ClientSecret": "${NETBIRD_IDP_CLIENT_SECRET}", - "GrantType": "${NETBIRD_IDP_GRANT_TYPE}", - "Audience": "${NETBIRD_IDP_AUTH0_AUDIENCE}", - "AuthIssuer": "${NETBIRD_IDP_AUTH0_AUTH_ISSUER}", - "AdminEndpoint": "${NETBIRD_IDP_KEYCLOAK_ADMIN_ENDPOINT}", - "TokenEndpoint": "${NETBIRD_IDP_KEYCLOAK_TOKEN_ENDPOINT}" - } - }, - "DeviceAuthorizationFlow": { - "Provider": "${NETBIRD_AUTH_DEVICE_AUTH_PROVIDER}", - "ProviderConfig": { - "Audience": "${NETBIRD_AUTH_DEVICE_AUTH_AUDIENCE}", - "ClientID": "${NETBIRD_AUTH_DEVICE_AUTH_CLIENT_ID}", - "DeviceAuthEndpoint": "${NETBIRD_AUTH_DEVICE_AUTH_DEVICE_AUTHORIZATION_ENDPOINT}", - "Domain": "${NETBIRD_AUTH_DEVICE_AUTH_AUTHORITY}", - "TokenEndpoint": "${NETBIRD_AUTH_DEVICE_AUTH_TOKEN_ENDPOINT}", - "Scope": "${NETBIRD_AUTH_DEVICE_AUTH_SCOPE}", - "UseIDToken": "${NETBIRD_AUTH_DEVICE_AUTH_USE_ID_TOKEN:-false}" - } - }, - "Relay": { - "Addresses": ["${NETBIRD_RELAY_URI}"], - "CredentialsTTL": "24h", - "Secret": "${NETBIRD_RELAY_SECRET}" - } - } ---- -apiVersion: apps/v1 -kind: Deployment -metadata: - name: netbird-backend-management -spec: - template: - spec: - initContainers: - - name: configure - env: - - name: NETBIRD_RELAY_URI - value: "rels://netbird.stonegarden.dev:443" - - name: NETBIRD_RELAY_SECRET - valueFrom: - secretKeyRef: - key: authSecret - name: netbird-relay-credentials diff --git a/k8s/infra/vpn/netbird/backend/patches/deployment-strategy-management.yaml b/k8s/infra/vpn/netbird/backend/patches/deployment-strategy-management.yaml deleted file mode 100644 index 66c8f4c..0000000 --- a/k8s/infra/vpn/netbird/backend/patches/deployment-strategy-management.yaml +++ /dev/null @@ -1,7 +0,0 @@ -apiVersion: apps/v1 -kind: Deployment -metadata: - name: netbird-backend-management -spec: - strategy: - type: Recreate diff --git a/k8s/infra/vpn/netbird/backend/patches/deployment-strategy-signal.yaml b/k8s/infra/vpn/netbird/backend/patches/deployment-strategy-signal.yaml deleted file mode 100644 index 5dcd5c4..0000000 --- a/k8s/infra/vpn/netbird/backend/patches/deployment-strategy-signal.yaml +++ /dev/null @@ -1,7 +0,0 @@ -apiVersion: apps/v1 -kind: Deployment -metadata: - name: netbird-backend-signal -spec: - strategy: - type: Recreate diff --git a/k8s/infra/vpn/netbird/backend/patches/dns-management.yaml b/k8s/infra/vpn/netbird/backend/patches/dns-management.yaml deleted file mode 100644 index ebfcc98..0000000 --- a/k8s/infra/vpn/netbird/backend/patches/dns-management.yaml +++ /dev/null @@ -1,11 +0,0 @@ -apiVersion: apps/v1 -kind: Deployment -metadata: - name: netbird-backend-management -spec: - template: - spec: - dnsConfig: - nameservers: - - 192.168.1.253 # AdGuardHome - dnsPolicy: None diff --git a/k8s/infra/vpn/netbird/backend/values.yaml b/k8s/infra/vpn/netbird/backend/values.yaml deleted file mode 100644 index 32e73f8..0000000 --- a/k8s/infra/vpn/netbird/backend/values.yaml +++ /dev/null @@ -1,50 +0,0 @@ -auth: - authority: https://keycloak.stonegarden.dev/realms/homelab - audience: netbird-dashboard - device: - provider: hosted - audience: netbird-dashboard - authority: https://keycloak.stonegarden.dev/realms/homelab - clientID: netbird-dashboard - deviceAuthorizationEndpoint: https://keycloak.stonegarden.dev/realms/homelab/protocol/openid-connect/auth - tokenEndpoint: https://keycloak.stonegarden.dev/realms/homelab/protocol/openid-connect/token - scope: openid - useIDToken: false - -idp: - managerType: keycloak - clientID: netbird-backend - secretKeyRef: - name: netbird-backend-oidc-credentials - key: clientSecret - grantType: client_credentials - adminEndpoint: https://keycloak.stonegarden.dev/admin/realms/homelab - tokenEndpoint: https://keycloak.stonegarden.dev/realms/homelab/protocol/openid-connect/token - -management: - image: - tag: 0.35.2 # renovate: docker=docker.io/netbirdio/management - nodeSelector: - topology.kubernetes.io/zone: abel - ingress: - enabled: false - -signal: - image: - tag: 0.35.2 # renovate: docker=docker.io/netbirdio/signal - nodeSelector: - topology.kubernetes.io/zone: abel - uri: netbird.stonegarden.dev:443 - protocol: https - ingress: - enabled: false - -stun: - uri: stun:coturn.stonegarden.dev:3478 - -turn: - uri: turn:coturn.stonegarden.dev:3478 - user: netbird - secretKeyRef: - name: netbird-turn-credentials - key: password diff --git a/k8s/infra/vpn/netbird/dashboard/deployment.yaml b/k8s/infra/vpn/netbird/dashboard/deployment.yaml index a80afc3..1ba00d3 100644 --- a/k8s/infra/vpn/netbird/dashboard/deployment.yaml +++ b/k8s/infra/vpn/netbird/dashboard/deployment.yaml @@ -22,7 +22,6 @@ spec: - name: http containerPort: 80 readinessProbe: - failureThreshold: 3 httpGet: path: / port: http @@ -32,4 +31,4 @@ spec: cpu: 10m limits: memory: 128Mi - cpu: 2000m \ No newline at end of file + cpu: 2000m diff --git a/k8s/infra/vpn/netbird/http-route.yaml b/k8s/infra/vpn/netbird/http-route.yaml index e48d182..c39eaf4 100644 --- a/k8s/infra/vpn/netbird/http-route.yaml +++ b/k8s/infra/vpn/netbird/http-route.yaml @@ -27,7 +27,7 @@ spec: type: PathPrefix value: /relay - backendRefs: - - name: netbird-backend-management + - name: management port: 80 matches: - path: @@ -37,7 +37,7 @@ spec: type: PathPrefix value: /management.ManagementService/ - backendRefs: - - name: netbird-backend-signal + - name: signal port: 80 matches: - path: diff --git a/k8s/infra/vpn/netbird/kustomization.yaml b/k8s/infra/vpn/netbird/kustomization.yaml index fdbbdcb..092268b 100644 --- a/k8s/infra/vpn/netbird/kustomization.yaml +++ b/k8s/infra/vpn/netbird/kustomization.yaml @@ -1,12 +1,11 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization -#commonLabels: -# - app.kubernetes.io/part-of: netbird resources: - ns.yaml - http-route.yaml - - backend - - dashboard - agent + - dashboard + - management - relay + - signal diff --git a/k8s/infra/vpn/netbird/management/config/check-oidc-keys.sh b/k8s/infra/vpn/netbird/management/config/check-oidc-keys.sh new file mode 100644 index 0000000..6ce53c7 --- /dev/null +++ b/k8s/infra/vpn/netbird/management/config/check-oidc-keys.sh @@ -0,0 +1,40 @@ +#!/bin/bash +OIDC_ENDPOINT=$(jq -r '.HttpConfig.OIDCConfigEndpoint' /etc/netbird/management.json) +KEY_CHECK_INTERVAL_SECONDS="${KEY_CHECK_INTERVAL_SECONDS:-3600}" +KEYS_FILE="/data/oidc_keys.json" + +fetch_keys() { + config=$(curl -s "$OIDC_ENDPOINT") + jwks_uri=$(echo "$config" | jq -r '.jwks_uri') + curl -s "$jwks_uri" +} + +keys_changed() { + local new_keys="$1" + if [ ! -f "$KEYS_FILE" ]; then + return 0 + fi + local old_keys=$(cat "$KEYS_FILE") + [ "$new_keys" != "$old_keys" ] +} + +restart_pod() { + echo "Restarting pod..." + kill 1 +} + +while true; do + echo "Fetching OIDC keys..." + new_keys=$(fetch_keys) + + if keys_changed "$new_keys"; then + echo "Keys have changed. Updating stored keys..." + echo "$new_keys" > "$KEYS_FILE" + restart_pod + else + echo "Keys have not changed. No action required." + fi + + echo "Sleeping for $KEY_CHECK_INTERVAL_SECONDS seconds..." + sleep "$KEY_CHECK_INTERVAL_SECONDS" +done diff --git a/k8s/infra/vpn/netbird/management/config/management.tmpl.json b/k8s/infra/vpn/netbird/management/config/management.tmpl.json new file mode 100644 index 0000000..79d9c88 --- /dev/null +++ b/k8s/infra/vpn/netbird/management/config/management.tmpl.json @@ -0,0 +1,67 @@ +{ + "Stuns": [ + { + "Proto": "udp", + "URI": "${NETBIRD_STUN_URI}", + "Username": "", + "Password": null + } + ], + "TURNConfig": { + "Turns": [ + { + "Proto": "udp", + "URI": "${NETBIRD_TURN_URI}", + "Username": "${NETBIRD_TURN_USER}", + "Password": "${NETBIRD_TURN_PASSWORD}" + } + ], + "CredentialsTTL": "12h", + "Secret": "secret", + "TimeBasedCredentials": false + }, + "Signal": { + "Proto": "${NETBIRD_SIGNAL_PROTOCOL}", + "URI": "${NETBIRD_SIGNAL_URI}", + "Username": "", + "Password": null + }, + "Datadir": "", + "HttpConfig": { + "Address": "0.0.0.0:80", + "AuthAudience": "${NETBIRD_AUTH_AUDIENCE}", + "AuthUserIDClaim": "${NETBIRD_AUTH_USER_ID_CLAIM:-sub}", + "CertFile": "${NETBIRD_MGMT_API_CERT_FILE}", + "CertKey": "${NETBIRD_MGMT_API_CERT_KEY_FILE}", + "OIDCConfigEndpoint": "${NETBIRD_AUTH_OIDC_CONFIGURATION_ENDPOINT}" + }, + "IdpManagerConfig": { + "ManagerType": "${NETBIRD_IDP_MANAGER_TYPE}", + "${NETBIRD_IDP_MANAGER_TYPE^}ClientCredentials": { + "ClientID": "${NETBIRD_IDP_CLIENT_ID}", + "ClientSecret": "${NETBIRD_IDP_CLIENT_SECRET}", + "GrantType": "${NETBIRD_IDP_GRANT_TYPE}", + "Audience": "${NETBIRD_IDP_AUTH0_AUDIENCE}", + "AuthIssuer": "${NETBIRD_IDP_AUTH0_AUTH_ISSUER}", + "AdminEndpoint": "${NETBIRD_IDP_KEYCLOAK_ADMIN_ENDPOINT}", + "TokenEndpoint": "${NETBIRD_IDP_KEYCLOAK_TOKEN_ENDPOINT}" + } + }, + "DeviceAuthorizationFlow": { + "Provider": "${NETBIRD_AUTH_DEVICE_AUTH_PROVIDER}", + "ProviderConfig": { + "Audience": "${NETBIRD_AUTH_DEVICE_AUTH_AUDIENCE}", + "ClientID": "${NETBIRD_AUTH_DEVICE_AUTH_CLIENT_ID}", + "DeviceAuthEndpoint": "${NETBIRD_AUTH_DEVICE_AUTH_DEVICE_AUTHORIZATION_ENDPOINT}", + "Domain": "${NETBIRD_AUTH_DEVICE_AUTH_AUTHORITY}", + "TokenEndpoint": "${NETBIRD_AUTH_DEVICE_AUTH_TOKEN_ENDPOINT}", + "Scope": "${NETBIRD_AUTH_DEVICE_AUTH_SCOPE}", + "UseIDToken": ${NETBIRD_AUTH_DEVICE_AUTH_USE_ID_TOKEN:-false} + } + }, + "Relay": { + "Addresses": ["${NETBIRD_RELAY_URI}"], + "CredentialsTTL": "24h", + "Secret": "${NETBIRD_RELAY_SECRET}" + } +} diff --git a/k8s/infra/vpn/netbird/management/deployment.yaml b/k8s/infra/vpn/netbird/management/deployment.yaml new file mode 100644 index 0000000..3a28a0d --- /dev/null +++ b/k8s/infra/vpn/netbird/management/deployment.yaml @@ -0,0 +1,123 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: management + namespace: netbird +spec: + strategy: + type: Recreate + selector: + matchLabels: + app.kubernetes.io/name: management + template: + metadata: + labels: + app.kubernetes.io/name: management + annotations: + kubectl.kubernetes.io/default-container: management + spec: + nodeSelector: + topology.kubernetes.io/zone: abel + dnsConfig: + # Internal AdGuard Home DNS + nameservers: + - 192.168.1.253 + dnsPolicy: None + initContainers: + - name: configure + image: golang:latest + command: [ /bin/sh, -c ] + args: + - > + go install github.com/drone/envsubst/cmd/envsubst@latest && + envsubst < /tmp/netbird/management.tmpl.json > /etc/netbird/management.json + envFrom: + - configMapRef: + name: management-auth-config + - configMapRef: + name: management-connection-config + - configMapRef: + name: management-idp-config + env: + - name: NETBIRD_RELAY_SECRET + valueFrom: + secretKeyRef: + key: authSecret + name: netbird-relay-credentials + - name: NETBIRD_TURN_PASSWORD + valueFrom: + secretKeyRef: + key: password + name: netbird-turn-credentials + - name: NETBIRD_IDP_CLIENT_SECRET + valueFrom: + secretKeyRef: + key: clientSecret + name: netbird-backend-oidc-credentials + volumeMounts: + - name: config + mountPath: /etc/netbird + - name: config-template + mountPath: /tmp/netbird + containers: + - name: oidc-key-checker + image: registry.gitlab.com/gitlab-ci-utils/curl-jq:3.1.0 # renovate: docker=registry.gitlab.com/gitlab-ci-utils/curl-jq + command: [ /bin/bash, -c ] + args: [ /opt/bin/check-oidc-keys.sh ] + envFrom: + - configMapRef: + name: management-oidc-key-check-config + optional: true + volumeMounts: + - name: check-oidc-keys + mountPath: /opt/bin/check-oidc-keys.sh + subPath: check-oidc-keys.sh + - name: config + mountPath: /etc/netbird + - name: data + mountPath: /data + resources: + requests: + memory: 16Mi + cpu: 10m + limits: + memory: 64Mi + cpu: 200m + - name: management + image: docker.io/netbirdio/management:0.35.2 # renovate: docker=docker.io/netbirdio/management + args: [ --dns-domain, $(DNS_DOMAIN), --log-level, $(LOG_LEVEL), --log-file, console ] + envFrom: + - configMapRef: + name: management-runtime-config + volumeMounts: + - name: config + mountPath: /etc/netbird + - name: management + mountPath: /var/lib/netbird + ports: + - name: http + containerPort: 80 + resources: + requests: + memory: 256Mi + cpu: 200m + limits: + memory: 512Mi + cpu: 4000m + volumes: + - name: data + emptyDir: { } + - name: config + emptyDir: + medium: Memory + - name: config-template + configMap: + defaultMode: 0644 + name: management-config-template + - name: check-oidc-keys + configMap: + defaultMode: 0744 + name: check-oidc-keys + - name: management + persistentVolumeClaim: + claimName: management \ No newline at end of file diff --git a/k8s/infra/vpn/netbird/management/kustomization.yaml b/k8s/infra/vpn/netbird/management/kustomization.yaml new file mode 100644 index 0000000..74fe282 --- /dev/null +++ b/k8s/infra/vpn/netbird/management/kustomization.yaml @@ -0,0 +1,57 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization + +configMapGenerator: + - name: check-oidc-keys + namespace: netbird + files: + - config/check-oidc-keys.sh + - name: management-config-template + namespace: netbird + files: + - config/management.tmpl.json + - name: management-auth-config + namespace: netbird + literals: + - NETBIRD_AUTH_OIDC_CONFIGURATION_ENDPOINT="https://keycloak.stonegarden.dev/realms/homelab/.well-known/openid-configuration" + - NETBIRD_AUTH_DEVICE_AUTH_PROVIDER="hosted" + - NETBIRD_AUTH_DEVICE_AUTH_AUDIENCE="netbird-dashboard" + - NETBIRD_AUTH_DEVICE_AUTH_AUTHORITY="https://keycloak.stonegarden.dev/realms/homelab" + - NETBIRD_AUTH_DEVICE_AUTH_CLIENT_ID="netbird-dashboard" + - NETBIRD_AUTH_DEVICE_AUTH_DEVICE_AUTHORIZATION_ENDPOINT="https://keycloak.stonegarden.dev/realms/homelab/protocol/openid-connect/auth" + - NETBIRD_AUTH_DEVICE_AUTH_TOKEN_ENDPOINT="https://keycloak.stonegarden.dev/realms/homelab/protocol/openid-connect/token" + - NETBIRD_AUTH_DEVICE_AUTH_SCOPE="openid" + - NETBIRD_AUTH_DEVICE_AUTH_USE_ID_TOKEN="false" + - name: management-connection-config + namespace: netbird + literals: + - NETBIRD_RELAY_URI="rels://netbird.stonegarden.dev:443" + - NETBIRD_SIGNAL_URI="netbird.stonegarden.dev:443" + - NETBIRD_SIGNAL_PROTOCOL="https" + - NETBIRD_STUN_URI="stun:coturn.stonegarden.dev:3478" + - NETBIRD_TURN_URI="turn:coturn.stonegarden.dev:3478" + - name: management-idp-config + namespace: netbird + literals: + - NETBIRD_IDP_MANAGER_TYPE="keycloak" + - NETBIRD_IDP_CLIENT_ID="netbird-backend" + - NETBIRD_IDP_GRANT_TYPE="client_credentials" + - NETBIRD_IDP_KEYCLOAK_ADMIN_ENDPOINT="https://keycloak.stonegarden.dev/admin/realms/homelab" + - NETBIRD_IDP_KEYCLOAK_TOKEN_ENDPOINT="https://keycloak.stonegarden.dev/realms/homelab/protocol/openid-connect/token" + - name: management-runtime-config + namespace: netbird + literals: + - LOG_LEVEL="info" + - DNS_DOMAIN="stonegarden.dev" + - name: management-oidc-key-check-config + namespace: netbird + literals: + - KEY_CHECK_INTERVAL_SECONDS="900" + +resources: + - deployment.yaml + - svc.yaml + - pvc.yaml + - secret-coturn-credentials.yaml + - oidc-credentials.yaml + - x-oidc-client.yaml diff --git a/k8s/infra/vpn/netbird/backend/oidc-credentials.yaml b/k8s/infra/vpn/netbird/management/oidc-credentials.yaml similarity index 100% rename from k8s/infra/vpn/netbird/backend/oidc-credentials.yaml rename to k8s/infra/vpn/netbird/management/oidc-credentials.yaml diff --git a/k8s/infra/vpn/netbird/backend/patches/pvc-backend-management.yaml b/k8s/infra/vpn/netbird/management/pvc.yaml similarity index 51% rename from k8s/infra/vpn/netbird/backend/patches/pvc-backend-management.yaml rename to k8s/infra/vpn/netbird/management/pvc.yaml index 2614bd2..e10723a 100644 --- a/k8s/infra/vpn/netbird/backend/patches/pvc-backend-management.yaml +++ b/k8s/infra/vpn/netbird/management/pvc.yaml @@ -1,7 +1,13 @@ kind: PersistentVolumeClaim apiVersion: v1 metadata: - name: netbird-backend-management + name: management + namespace: netbird spec: storageClassName: proxmox-csi volumeName: pv-netbird-management + accessModes: + - ReadWriteOnce + resources: + requests: + storage: 512M diff --git a/k8s/infra/vpn/netbird/backend/secret-coturn-credentials.yaml b/k8s/infra/vpn/netbird/management/secret-coturn-credentials.yaml similarity index 100% rename from k8s/infra/vpn/netbird/backend/secret-coturn-credentials.yaml rename to k8s/infra/vpn/netbird/management/secret-coturn-credentials.yaml diff --git a/k8s/infra/vpn/netbird/management/svc.yaml b/k8s/infra/vpn/netbird/management/svc.yaml new file mode 100644 index 0000000..2c2dfde --- /dev/null +++ b/k8s/infra/vpn/netbird/management/svc.yaml @@ -0,0 +1,13 @@ +apiVersion: v1 +kind: Service +metadata: + name: management + namespace: netbird +spec: + type: ClusterIP + selector: + app.kubernetes.io/name: management + ports: + - name: http + port: 80 + targetPort: http diff --git a/k8s/infra/vpn/netbird/backend/x-oidc-client.yaml b/k8s/infra/vpn/netbird/management/x-oidc-client.yaml similarity index 100% rename from k8s/infra/vpn/netbird/backend/x-oidc-client.yaml rename to k8s/infra/vpn/netbird/management/x-oidc-client.yaml diff --git a/k8s/infra/vpn/netbird/signal/deployment.yaml b/k8s/infra/vpn/netbird/signal/deployment.yaml new file mode 100644 index 0000000..83225b4 --- /dev/null +++ b/k8s/infra/vpn/netbird/signal/deployment.yaml @@ -0,0 +1,48 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: signal + namespace: netbird +spec: + strategy: + type: Recreate + selector: + matchLabels: + app.kubernetes.io/name: signal + template: + metadata: + labels: + app.kubernetes.io/name: signal + spec: + nodeSelector: + topology.kubernetes.io/zone: abel + containers: + - name: signal + image: docker.io/netbirdio/signal:0.35.2 # renovate: docker=docker.io/netbirdio/signal + args: [--port, $(PORT), --log-level, $(LOG_LEVEL), --log-file, console] + envFrom: + - configMapRef: + name: signal-config + volumeMounts: + - name: signal + mountPath: /var/lib/netbird + ports: + - name: http + containerPort: 80 + livenessProbe: + tcpSocket: + port: http + readinessProbe: + tcpSocket: + port: http + resources: + requests: + memory: 16Mi + cpu: 10m + limits: + memory: 64Mi + cpu: 2000m + volumes: + - name: signal + persistentVolumeClaim: + claimName: signal diff --git a/k8s/infra/vpn/netbird/signal/kustomization.yaml b/k8s/infra/vpn/netbird/signal/kustomization.yaml new file mode 100644 index 0000000..578afdb --- /dev/null +++ b/k8s/infra/vpn/netbird/signal/kustomization.yaml @@ -0,0 +1,14 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization + +configMapGenerator: + - name: signal-config + namespace: netbird + literals: + - LOG_LEVEL="info" + - PORT="80" + +resources: + - deployment.yaml + - pvc.yaml + - svc.yaml diff --git a/k8s/infra/vpn/netbird/backend/patches/pvc-backend-signal.yaml b/k8s/infra/vpn/netbird/signal/pvc.yaml similarity index 51% rename from k8s/infra/vpn/netbird/backend/patches/pvc-backend-signal.yaml rename to k8s/infra/vpn/netbird/signal/pvc.yaml index 25360f5..a4d331d 100644 --- a/k8s/infra/vpn/netbird/backend/patches/pvc-backend-signal.yaml +++ b/k8s/infra/vpn/netbird/signal/pvc.yaml @@ -1,7 +1,13 @@ kind: PersistentVolumeClaim apiVersion: v1 metadata: - name: netbird-backend-signal + name: signal + namespace: netbird spec: storageClassName: proxmox-csi volumeName: pv-netbird-signal + accessModes: + - ReadWriteOnce + resources: + requests: + storage: 512M diff --git a/k8s/infra/vpn/netbird/signal/svc.yaml b/k8s/infra/vpn/netbird/signal/svc.yaml new file mode 100644 index 0000000..3f4dfce --- /dev/null +++ b/k8s/infra/vpn/netbird/signal/svc.yaml @@ -0,0 +1,13 @@ +apiVersion: v1 +kind: Service +metadata: + name: signal + namespace: netbird +spec: + type: ClusterIP + selector: + app.kubernetes.io/name: signal + ports: + - name: http + port: 80 + targetPort: http