feat(netbird): replace backend helm chart with plain manifests

no need for all the patching anymore
2026-08-25 14:53:19 +00:00 · 2025-01-05 11:34:25 +01:00
parent 0149a02e4c
commit 56d2a42b9d
24 changed files with 402 additions and 270 deletions
@@ -36,6 +36,13 @@ spec:
          volumeMounts:
            - name: config
              mountPath: /config
+          resources:
+            requests:
+              memory: 192Mi
+              cpu: 100m
+            limits:
+              memory: 256Mi
+              cpu: 4000m
      volumes:
        - name: config
          emptyDir: { }
@@ -1,25 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-namespace: netbird
-
-resources:
-  - secret-coturn-credentials.yaml
-  - oidc-credentials.yaml
-  - x-oidc-client.yaml
-
-helmCharts:
-  - name: netbird
-    repo: https://charts.jaconi.io
-    releaseName: netbird-backend
-    namespace: netbird
-    version: 0.14.2
-    valuesFile: values.yaml
-
-patches:
-  - path: patches/add-oidc-key-checker-sidecar.yaml
-  - path: patches/add-relay-config.yaml
-  - path: patches/dns-management.yaml # resolve auth admin-endpoint to internal gateway
-  - path: patches/deployment-strategy-management.yaml
-  - path: patches/deployment-strategy-signal.yaml
-  - path: patches/pvc-backend-management.yaml
-  - path: patches/pvc-backend-signal.yaml
@@ -1,68 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: netbird-backend-management
-spec:
-  template:
-    metadata:
-      annotations:
-        kubectl.kubernetes.io/default-container: netbird-management
-    spec:
-      containers:
-        - name: oidc-key-checker
-          image: registry.gitlab.com/gitlab-ci-utils/curl-jq:3.1.0 # renovate: docker=registry.gitlab.com/gitlab-ci-utils/curl-jq
-          command: ["/bin/bash"]
-          args:
-            - -c
-            - |
-              #!/bin/bash
-              OIDC_ENDPOINT=$(jq -r '.HttpConfig.OIDCConfigEndpoint' /etc/netbird/management.json)
-              CHECK_INTERVAL="${CHECK_INTERVAL:-3600}"
-              KEYS_FILE="/data/oidc_keys.json"
-
-              fetch_keys() {
-                config=$(curl -s "$OIDC_ENDPOINT")
-                jwks_uri=$(echo "$config" | jq -r '.jwks_uri')
-                curl -s "$jwks_uri"
-              }
-
-              keys_changed() {
-                local new_keys="$1"
-                if [ ! -f "$KEYS_FILE" ]; then
-                  return 0
-                fi
-                local old_keys=$(cat "$KEYS_FILE")
-                [ "$new_keys" != "$old_keys" ]
-              }
-
-              restart_pod() {
-                echo "Restarting pod..."
-                kill 1
-              }
-
-              while true; do
-                echo "Fetching OIDC keys..."
-                new_keys=$(fetch_keys)
-
-                if keys_changed "$new_keys"; then
-                  echo "Keys have changed. Updating stored keys..."
-                  echo "$new_keys" > "$KEYS_FILE"
-                  restart_pod
-                else
-                  echo "Keys have not changed. No action required."
-                fi
-
-                echo "Sleeping for $CHECK_INTERVAL seconds..."
-                sleep "$CHECK_INTERVAL"
-              done
-          env:
-            - name: CHECK_INTERVAL
-              value: "900"
-          volumeMounts:
-            - name: config
-              mountPath: /etc/netbird
-            - name: data
-              mountPath: /data
-      volumes:
-        - name: data
-          emptyDir: {}
@@ -1,92 +0,0 @@
---
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: netbird-backend-management
-data:
-  management.tmpl.json: |-
-    {
-        "Stuns": [
-            {
-                "Proto": "udp",
-                "URI": "${NETBIRD_STUN_URI}",
-                "Username": "",
-                "Password": null
-            }
-        ],
-        "TURNConfig": {
-            "Turns": [
-                {
-                    "Proto": "udp",
-                    "URI": "${NETBIRD_TURN_URI}",
-                    "Username": "${NETBIRD_TURN_USER}",
-                    "Password": "${NETBIRD_TURN_PASSWORD}"
-                }
-            ],
-            "CredentialsTTL": "12h",
-            "Secret": "secret",
-            "TimeBasedCredentials": false
-        },
-        "Signal": {
-            "Proto": "${NETBIRD_SIGNAL_PROTOCOL}",
-            "URI": "${NETBIRD_SIGNAL_URI}",
-            "Username": "",
-            "Password": null
-        },
-        "Datadir": "",
-        "HttpConfig": {
-            "Address": "0.0.0.0:80",
-            "AuthAudience": "${NETBIRD_AUTH_AUDIENCE}",
-            "AuthUserIDClaim": "${NETBIRD_AUTH_USER_ID_CLAIM:-sub}",
-            "CertFile": "${NETBIRD_MGMT_API_CERT_FILE}",
-            "CertKey": "${NETBIRD_MGMT_API_CERT_KEY_FILE}",
-            "OIDCConfigEndpoint": "${NETBIRD_AUTH_OIDC_CONFIGURATION_ENDPOINT}"
-        },
-        "IdpManagerConfig": {
-            "ManagerType": "${NETBIRD_IDP_MANAGER_TYPE}",
-            "${NETBIRD_IDP_MANAGER_TYPE^}ClientCredentials": {
-                "ClientID": "${NETBIRD_IDP_CLIENT_ID}",
-                "ClientSecret": "${NETBIRD_IDP_CLIENT_SECRET}",
-                "GrantType": "${NETBIRD_IDP_GRANT_TYPE}",
-                "Audience": "${NETBIRD_IDP_AUTH0_AUDIENCE}",
-                "AuthIssuer": "${NETBIRD_IDP_AUTH0_AUTH_ISSUER}",
-                "AdminEndpoint": "${NETBIRD_IDP_KEYCLOAK_ADMIN_ENDPOINT}",
-                "TokenEndpoint": "${NETBIRD_IDP_KEYCLOAK_TOKEN_ENDPOINT}"
-            }
-        },
-        "DeviceAuthorizationFlow": {
-            "Provider": "${NETBIRD_AUTH_DEVICE_AUTH_PROVIDER}",
-            "ProviderConfig": {
-                "Audience": "${NETBIRD_AUTH_DEVICE_AUTH_AUDIENCE}",
-                "ClientID": "${NETBIRD_AUTH_DEVICE_AUTH_CLIENT_ID}",
-                "DeviceAuthEndpoint": "${NETBIRD_AUTH_DEVICE_AUTH_DEVICE_AUTHORIZATION_ENDPOINT}",
-                "Domain": "${NETBIRD_AUTH_DEVICE_AUTH_AUTHORITY}",
-                "TokenEndpoint": "${NETBIRD_AUTH_DEVICE_AUTH_TOKEN_ENDPOINT}",
-                "Scope": "${NETBIRD_AUTH_DEVICE_AUTH_SCOPE}",
-                "UseIDToken": "${NETBIRD_AUTH_DEVICE_AUTH_USE_ID_TOKEN:-false}"
-            }
-        },
-        "Relay": {
-            "Addresses": ["${NETBIRD_RELAY_URI}"],
-            "CredentialsTTL": "24h",
-            "Secret": "${NETBIRD_RELAY_SECRET}"
-        }
-    }
---
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: netbird-backend-management
-spec:
-  template:
-    spec:
-      initContainers:
-      - name: configure
-        env:
-        - name: NETBIRD_RELAY_URI
-          value: "rels://netbird.stonegarden.dev:443"
-        - name: NETBIRD_RELAY_SECRET
-          valueFrom:
-            secretKeyRef:
-              key: authSecret
-              name: netbird-relay-credentials
@@ -1,7 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: netbird-backend-management
-spec:
-  strategy:
-    type: Recreate
@@ -1,7 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: netbird-backend-signal
-spec:
-  strategy:
-    type: Recreate
@@ -1,11 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: netbird-backend-management
-spec:
-  template:
-    spec:
-      dnsConfig:
-        nameservers:
-          - 192.168.1.253 # AdGuardHome
-      dnsPolicy: None
@@ -1,50 +0,0 @@
-auth:
-  authority: https://keycloak.stonegarden.dev/realms/homelab
-  audience: netbird-dashboard
-  device:
-    provider: hosted
-    audience: netbird-dashboard
-    authority: https://keycloak.stonegarden.dev/realms/homelab
-    clientID: netbird-dashboard
-    deviceAuthorizationEndpoint: https://keycloak.stonegarden.dev/realms/homelab/protocol/openid-connect/auth
-    tokenEndpoint: https://keycloak.stonegarden.dev/realms/homelab/protocol/openid-connect/token
-    scope: openid
-    useIDToken: false
-
-idp:
-  managerType: keycloak
-  clientID: netbird-backend
-  secretKeyRef:
-    name: netbird-backend-oidc-credentials
-    key: clientSecret
-  grantType: client_credentials
-  adminEndpoint: https://keycloak.stonegarden.dev/admin/realms/homelab
-  tokenEndpoint: https://keycloak.stonegarden.dev/realms/homelab/protocol/openid-connect/token
-
-management:
-  image:
-    tag: 0.35.2 # renovate: docker=docker.io/netbirdio/management
-  nodeSelector:
-    topology.kubernetes.io/zone: abel
-  ingress:
-    enabled: false
-
-signal:
-  image:
-    tag: 0.35.2 # renovate: docker=docker.io/netbirdio/signal
-  nodeSelector:
-    topology.kubernetes.io/zone: abel
-  uri: netbird.stonegarden.dev:443
-  protocol: https
-  ingress:
-    enabled: false
-
-stun:
-  uri: stun:coturn.stonegarden.dev:3478
-
-turn:
-  uri: turn:coturn.stonegarden.dev:3478
-  user: netbird
-  secretKeyRef:
-    name: netbird-turn-credentials
-    key: password
@@ -22,7 +22,6 @@ spec:
        - name: http
          containerPort: 80
        readinessProbe:
-          failureThreshold: 3
          httpGet:
            path: /
            port: http
@@ -27,7 +27,7 @@ spec:
              type: PathPrefix
              value: /relay
    - backendRefs:
-        - name: netbird-backend-management
+        - name: management
          port: 80
      matches:
        - path:
@@ -37,7 +37,7 @@ spec:
            type: PathPrefix
            value: /management.ManagementService/
    - backendRefs:
-        - name: netbird-backend-signal
+        - name: signal
          port: 80
      matches:
        - path:
@@ -1,12 +1,11 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
-#commonLabels:
-#  - app.kubernetes.io/part-of: netbird

 resources:
  - ns.yaml
  - http-route.yaml
-  - backend
-  - dashboard
  - agent
+  - dashboard
+  - management
  - relay
+  - signal
@@ -0,0 +1,40 @@
+#!/bin/bash
+OIDC_ENDPOINT=$(jq -r '.HttpConfig.OIDCConfigEndpoint' /etc/netbird/management.json)
+KEY_CHECK_INTERVAL_SECONDS="${KEY_CHECK_INTERVAL_SECONDS:-3600}"
+KEYS_FILE="/data/oidc_keys.json"
+
+fetch_keys() {
+  config=$(curl -s "$OIDC_ENDPOINT")
+  jwks_uri=$(echo "$config" | jq -r '.jwks_uri')
+  curl -s "$jwks_uri"
+}
+
+keys_changed() {
+  local new_keys="$1"
+  if [ ! -f "$KEYS_FILE" ]; then
+    return 0
+  fi
+  local old_keys=$(cat "$KEYS_FILE")
+  [ "$new_keys" != "$old_keys" ]
+}
+
+restart_pod() {
+  echo "Restarting pod..."
+  kill 1
+}
+
+while true; do
+  echo "Fetching OIDC keys..."
+  new_keys=$(fetch_keys)
+
+  if keys_changed "$new_keys"; then
+    echo "Keys have changed. Updating stored keys..."
+    echo "$new_keys" > "$KEYS_FILE"
+    restart_pod
+  else
+    echo "Keys have not changed. No action required."
+  fi
+
+  echo "Sleeping for $KEY_CHECK_INTERVAL_SECONDS seconds..."
+  sleep "$KEY_CHECK_INTERVAL_SECONDS"
+done
@@ -0,0 +1,67 @@
+{
+  "Stuns": [
+    {
+      "Proto": "udp",
+      "URI": "${NETBIRD_STUN_URI}",
+      "Username": "",
+      "Password": null
+    }
+  ],
+  "TURNConfig": {
+    "Turns": [
+      {
+        "Proto": "udp",
+        "URI": "${NETBIRD_TURN_URI}",
+        "Username": "${NETBIRD_TURN_USER}",
+        "Password": "${NETBIRD_TURN_PASSWORD}"
+      }
+    ],
+    "CredentialsTTL": "12h",
+    "Secret": "secret",
+    "TimeBasedCredentials": false
+  },
+  "Signal": {
+    "Proto": "${NETBIRD_SIGNAL_PROTOCOL}",
+    "URI": "${NETBIRD_SIGNAL_URI}",
+    "Username": "",
+    "Password": null
+  },
+  "Datadir": "",
+  "HttpConfig": {
+    "Address": "0.0.0.0:80",
+    "AuthAudience": "${NETBIRD_AUTH_AUDIENCE}",
+    "AuthUserIDClaim": "${NETBIRD_AUTH_USER_ID_CLAIM:-sub}",
+    "CertFile": "${NETBIRD_MGMT_API_CERT_FILE}",
+    "CertKey": "${NETBIRD_MGMT_API_CERT_KEY_FILE}",
+    "OIDCConfigEndpoint": "${NETBIRD_AUTH_OIDC_CONFIGURATION_ENDPOINT}"
+  },
+  "IdpManagerConfig": {
+    "ManagerType": "${NETBIRD_IDP_MANAGER_TYPE}",
+    "${NETBIRD_IDP_MANAGER_TYPE^}ClientCredentials": {
+      "ClientID": "${NETBIRD_IDP_CLIENT_ID}",
+      "ClientSecret": "${NETBIRD_IDP_CLIENT_SECRET}",
+      "GrantType": "${NETBIRD_IDP_GRANT_TYPE}",
+      "Audience": "${NETBIRD_IDP_AUTH0_AUDIENCE}",
+      "AuthIssuer": "${NETBIRD_IDP_AUTH0_AUTH_ISSUER}",
+      "AdminEndpoint": "${NETBIRD_IDP_KEYCLOAK_ADMIN_ENDPOINT}",
+      "TokenEndpoint": "${NETBIRD_IDP_KEYCLOAK_TOKEN_ENDPOINT}"
+    }
+  },
+  "DeviceAuthorizationFlow": {
+    "Provider": "${NETBIRD_AUTH_DEVICE_AUTH_PROVIDER}",
+    "ProviderConfig": {
+      "Audience": "${NETBIRD_AUTH_DEVICE_AUTH_AUDIENCE}",
+      "ClientID": "${NETBIRD_AUTH_DEVICE_AUTH_CLIENT_ID}",
+      "DeviceAuthEndpoint": "${NETBIRD_AUTH_DEVICE_AUTH_DEVICE_AUTHORIZATION_ENDPOINT}",
+      "Domain": "${NETBIRD_AUTH_DEVICE_AUTH_AUTHORITY}",
+      "TokenEndpoint": "${NETBIRD_AUTH_DEVICE_AUTH_TOKEN_ENDPOINT}",
+      "Scope": "${NETBIRD_AUTH_DEVICE_AUTH_SCOPE}",
+      "UseIDToken": ${NETBIRD_AUTH_DEVICE_AUTH_USE_ID_TOKEN:-false}
+    }
+  },
+  "Relay": {
+    "Addresses": ["${NETBIRD_RELAY_URI}"],
+    "CredentialsTTL": "24h",
+    "Secret": "${NETBIRD_RELAY_SECRET}"
+  }
+}
@@ -0,0 +1,123 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: management
+  namespace: netbird
+spec:
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: management
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: management
+      annotations:
+        kubectl.kubernetes.io/default-container: management
+    spec:
+      nodeSelector:
+        topology.kubernetes.io/zone: abel
+      dnsConfig:
+        # Internal AdGuard Home DNS
+        nameservers:
+          - 192.168.1.253
+      dnsPolicy: None
+      initContainers:
+        - name: configure
+          image: golang:latest
+          command: [ /bin/sh, -c ]
+          args:
+            - >
+              go install github.com/drone/envsubst/cmd/envsubst@latest &&
+              envsubst < /tmp/netbird/management.tmpl.json > /etc/netbird/management.json
+          envFrom:
+            - configMapRef:
+                name: management-auth-config
+            - configMapRef:
+                name: management-connection-config
+            - configMapRef:
+                name: management-idp-config
+          env:
+            - name: NETBIRD_RELAY_SECRET
+              valueFrom:
+                secretKeyRef:
+                  key: authSecret
+                  name: netbird-relay-credentials
+            - name: NETBIRD_TURN_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  key: password
+                  name: netbird-turn-credentials
+            - name: NETBIRD_IDP_CLIENT_SECRET
+              valueFrom:
+                secretKeyRef:
+                  key: clientSecret
+                  name: netbird-backend-oidc-credentials
+          volumeMounts:
+            - name: config
+              mountPath: /etc/netbird
+            - name: config-template
+              mountPath: /tmp/netbird
+      containers:
+        - name: oidc-key-checker
+          image: registry.gitlab.com/gitlab-ci-utils/curl-jq:3.1.0 # renovate: docker=registry.gitlab.com/gitlab-ci-utils/curl-jq
+          command: [ /bin/bash, -c ]
+          args: [ /opt/bin/check-oidc-keys.sh ]
+          envFrom:
+            - configMapRef:
+                name: management-oidc-key-check-config
+                optional: true
+          volumeMounts:
+            - name: check-oidc-keys
+              mountPath: /opt/bin/check-oidc-keys.sh
+              subPath: check-oidc-keys.sh
+            - name: config
+              mountPath: /etc/netbird
+            - name: data
+              mountPath: /data
+          resources:
+            requests:
+              memory: 16Mi
+              cpu: 10m
+            limits:
+              memory: 64Mi
+              cpu: 200m
+        - name: management
+          image: docker.io/netbirdio/management:0.35.2 # renovate: docker=docker.io/netbirdio/management
+          args: [ --dns-domain, $(DNS_DOMAIN), --log-level, $(LOG_LEVEL), --log-file, console ]
+          envFrom:
+            - configMapRef:
+                name: management-runtime-config
+          volumeMounts:
+            - name: config
+              mountPath: /etc/netbird
+            - name: management
+              mountPath: /var/lib/netbird
+          ports:
+            - name: http
+              containerPort: 80
+          resources:
+            requests:
+              memory: 256Mi
+              cpu: 200m
+            limits:
+              memory: 512Mi
+              cpu: 4000m
+      volumes:
+        - name: data
+          emptyDir: { }
+        - name: config
+          emptyDir:
+            medium: Memory
+        - name: config-template
+          configMap:
+            defaultMode: 0644
+            name: management-config-template
+        - name: check-oidc-keys
+          configMap:
+            defaultMode: 0744
+            name: check-oidc-keys
+        - name: management
+          persistentVolumeClaim:
+            claimName: management
@@ -0,0 +1,57 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+configMapGenerator:
+  - name: check-oidc-keys
+    namespace: netbird
+    files:
+      - config/check-oidc-keys.sh
+  - name: management-config-template
+    namespace: netbird
+    files:
+      - config/management.tmpl.json
+  - name: management-auth-config
+    namespace: netbird
+    literals:
+      - NETBIRD_AUTH_OIDC_CONFIGURATION_ENDPOINT="https://keycloak.stonegarden.dev/realms/homelab/.well-known/openid-configuration"
+      - NETBIRD_AUTH_DEVICE_AUTH_PROVIDER="hosted"
+      - NETBIRD_AUTH_DEVICE_AUTH_AUDIENCE="netbird-dashboard"
+      - NETBIRD_AUTH_DEVICE_AUTH_AUTHORITY="https://keycloak.stonegarden.dev/realms/homelab"
+      - NETBIRD_AUTH_DEVICE_AUTH_CLIENT_ID="netbird-dashboard"
+      - NETBIRD_AUTH_DEVICE_AUTH_DEVICE_AUTHORIZATION_ENDPOINT="https://keycloak.stonegarden.dev/realms/homelab/protocol/openid-connect/auth"
+      - NETBIRD_AUTH_DEVICE_AUTH_TOKEN_ENDPOINT="https://keycloak.stonegarden.dev/realms/homelab/protocol/openid-connect/token"
+      - NETBIRD_AUTH_DEVICE_AUTH_SCOPE="openid"
+      - NETBIRD_AUTH_DEVICE_AUTH_USE_ID_TOKEN="false"
+  - name: management-connection-config
+    namespace: netbird
+    literals:
+      - NETBIRD_RELAY_URI="rels://netbird.stonegarden.dev:443"
+      - NETBIRD_SIGNAL_URI="netbird.stonegarden.dev:443"
+      - NETBIRD_SIGNAL_PROTOCOL="https"
+      - NETBIRD_STUN_URI="stun:coturn.stonegarden.dev:3478"
+      - NETBIRD_TURN_URI="turn:coturn.stonegarden.dev:3478"
+  - name: management-idp-config
+    namespace: netbird
+    literals:
+      - NETBIRD_IDP_MANAGER_TYPE="keycloak"
+      - NETBIRD_IDP_CLIENT_ID="netbird-backend"
+      - NETBIRD_IDP_GRANT_TYPE="client_credentials"
+      - NETBIRD_IDP_KEYCLOAK_ADMIN_ENDPOINT="https://keycloak.stonegarden.dev/admin/realms/homelab"
+      - NETBIRD_IDP_KEYCLOAK_TOKEN_ENDPOINT="https://keycloak.stonegarden.dev/realms/homelab/protocol/openid-connect/token"
+  - name: management-runtime-config
+    namespace: netbird
+    literals:
+      - LOG_LEVEL="info"
+      - DNS_DOMAIN="stonegarden.dev"
+  - name: management-oidc-key-check-config
+    namespace: netbird
+    literals:
+      - KEY_CHECK_INTERVAL_SECONDS="900"
+
+resources:
+  - deployment.yaml
+  - svc.yaml
+  - pvc.yaml
+  - secret-coturn-credentials.yaml
+  - oidc-credentials.yaml
+  - x-oidc-client.yaml
@@ -1,7 +1,13 @@
 kind: PersistentVolumeClaim
 apiVersion: v1
 metadata:
-  name: netbird-backend-management
+  name: management
+  namespace: netbird
 spec:
  storageClassName: proxmox-csi
  volumeName: pv-netbird-management
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 512M
@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: management
+  namespace: netbird
+spec:
+  type: ClusterIP
+  selector:
+    app.kubernetes.io/name: management
+  ports:
+  - name: http
+    port: 80
+    targetPort: http
@@ -0,0 +1,48 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: signal
+  namespace: netbird
+spec:
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: signal
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: signal
+    spec:
+      nodeSelector:
+        topology.kubernetes.io/zone: abel
+      containers:
+      - name: signal
+        image: docker.io/netbirdio/signal:0.35.2 # renovate: docker=docker.io/netbirdio/signal
+        args: [--port, $(PORT), --log-level, $(LOG_LEVEL), --log-file, console]
+        envFrom:
+          - configMapRef:
+              name: signal-config
+        volumeMounts:
+          - name: signal
+            mountPath: /var/lib/netbird
+        ports:
+        - name: http
+          containerPort: 80
+        livenessProbe:
+          tcpSocket:
+            port: http
+        readinessProbe:
+          tcpSocket:
+            port: http
+        resources:
+          requests:
+            memory: 16Mi
+            cpu: 10m
+          limits:
+            memory: 64Mi
+            cpu: 2000m
+      volumes:
+        - name: signal
+          persistentVolumeClaim:
+            claimName: signal
@@ -0,0 +1,14 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+configMapGenerator:
+  - name: signal-config
+    namespace: netbird
+    literals:
+      - LOG_LEVEL="info"
+      - PORT="80"
+
+resources:
+  - deployment.yaml
+  - pvc.yaml
+  - svc.yaml
@@ -1,7 +1,13 @@
 kind: PersistentVolumeClaim
 apiVersion: v1
 metadata:
-  name: netbird-backend-signal
+  name: signal
+  namespace: netbird
 spec:
  storageClassName: proxmox-csi
  volumeName: pv-netbird-signal
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 512M
@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: signal
+  namespace: netbird
+spec:
+  type: ClusterIP
+  selector:
+    app.kubernetes.io/name: signal
+  ports:
+  - name: http
+    port: 80
+    targetPort: http