diff --git a/k8s/apps/dev/whoami/http-route.yaml b/k8s/apps/dev/whoami/http-route.yaml new file mode 100644 index 0000000..f00a0e5 --- /dev/null +++ b/k8s/apps/dev/whoami/http-route.yaml @@ -0,0 +1,14 @@ +apiVersion: gateway.networking.k8s.io/v1 +kind: HTTPRoute +metadata: + name: whoami + namespace: whoami +spec: + parentRefs: + - { name: external, namespace: gateway } + - { name: internal, namespace: gateway } + hostnames: [ "whoami.stonegarden.dev" ] + rules: + - backendRefs: [ { name: whoami, port: 80 } ] + matches: + - path: { type: PathPrefix, value: / } diff --git a/k8s/apps/dev/whoami/kustomization.yaml b/k8s/apps/dev/whoami/kustomization.yaml index a7fe97d..673ced2 100644 --- a/k8s/apps/dev/whoami/kustomization.yaml +++ b/k8s/apps/dev/whoami/kustomization.yaml @@ -4,4 +4,5 @@ kind: Kustomization resources: - ns.yaml - svc.yaml + - http-route.yaml - deployment.yaml diff --git a/k8s/infra/network/cilium/values.yaml b/k8s/infra/network/cilium/values.yaml index d7dcf03..3c0a6d7 100644 --- a/k8s/infra/network/cilium/values.yaml +++ b/k8s/infra/network/cilium/values.yaml @@ -81,7 +81,7 @@ loadBalancer: gatewayAPI: enabled: true enableAlpn: true - # enableAppProtocol: true + enableAppProtocol: true envoy: prometheus: diff --git a/k8s/infra/vpn/netbird/agent/daemon-set.yaml b/k8s/infra/vpn/netbird/agent/daemon-set.yaml index 10c1f21..f5f2f36 100644 --- a/k8s/infra/vpn/netbird/agent/daemon-set.yaml +++ b/k8s/infra/vpn/netbird/agent/daemon-set.yaml @@ -12,6 +12,11 @@ spec: labels: app: agent spec: + dnsConfig: + nameservers: + - 10.96.0.12 # AdGuard Home + - 10.96.0.11 # Unbound + dnsPolicy: None securityContext: seccompProfile: type: RuntimeDefault diff --git a/k8s/infra/vpn/netbird/grpc-route.yaml b/k8s/infra/vpn/netbird/grpc-route.yaml index d84bd73..ef8c2b2 100644 --- a/k8s/infra/vpn/netbird/grpc-route.yaml +++ b/k8s/infra/vpn/netbird/grpc-route.yaml @@ -13,7 +13,7 @@ spec: matches: - headers: [ { name: Content-Type, value: application/grpc } ] - method: { service: management.ManagementService } - - backendRefs: [ { name: signal, port: 80 } ] + - backendRefs: [ { name: signal, port: 10000 } ] matches: - headers: [ { name: Content-Type, value: application/grpc } ] - method: { service: signalexchange.SignalExchange } diff --git a/k8s/infra/vpn/netbird/kustomization.yaml b/k8s/infra/vpn/netbird/kustomization.yaml index 44a862e..5f48021 100644 --- a/k8s/infra/vpn/netbird/kustomization.yaml +++ b/k8s/infra/vpn/netbird/kustomization.yaml @@ -13,3 +13,12 @@ resources: - management - relay - signal + +#helmCharts: +# - name: netbird +# repo: https://netbirdio.github.io/helms +# version: 1.9.0 # renovate: github-releases=netbirdio/helms +# releaseName: netbird +# includeCRDs: true +# namespace: netbird +# valuesFile: values.yaml diff --git a/k8s/infra/vpn/netbird/management/deployment.yaml b/k8s/infra/vpn/netbird/management/deployment.yaml index 4be1d92..98ef7da 100644 --- a/k8s/infra/vpn/netbird/management/deployment.yaml +++ b/k8s/infra/vpn/netbird/management/deployment.yaml @@ -20,7 +20,6 @@ spec: topology.kubernetes.io/zone: abel dnsConfig: nameservers: - - 172.20.10.153 # AdGuard Home - 10.96.0.12 # AdGuard Home - 10.96.0.11 # Unbound dnsPolicy: None diff --git a/k8s/infra/vpn/netbird/management/svc.yaml b/k8s/infra/vpn/netbird/management/svc.yaml index 722b620..07094dc 100644 --- a/k8s/infra/vpn/netbird/management/svc.yaml +++ b/k8s/infra/vpn/netbird/management/svc.yaml @@ -10,5 +10,5 @@ spec: ports: - name: http port: 80 - appProtocol: kubernetes.io/h2c targetPort: http + appProtocol: kubernetes.io/h2c diff --git a/k8s/infra/vpn/netbird/relay/svc.yaml b/k8s/infra/vpn/netbird/relay/svc.yaml index 449503f..a48a42a 100644 --- a/k8s/infra/vpn/netbird/relay/svc.yaml +++ b/k8s/infra/vpn/netbird/relay/svc.yaml @@ -3,8 +3,6 @@ kind: Service metadata: name: relay namespace: netbird - labels: - app.kubernetes.io/name: relay spec: type: ClusterIP selector: diff --git a/k8s/infra/vpn/netbird/signal/deployment.yaml b/k8s/infra/vpn/netbird/signal/deployment.yaml index 2da5ea7..d391509 100644 --- a/k8s/infra/vpn/netbird/signal/deployment.yaml +++ b/k8s/infra/vpn/netbird/signal/deployment.yaml @@ -39,6 +39,8 @@ spec: ports: - name: http containerPort: 80 + - name: legacy-grpc + containerPort: 10000 livenessProbe: tcpSocket: port: http diff --git a/k8s/infra/vpn/netbird/signal/svc.yaml b/k8s/infra/vpn/netbird/signal/svc.yaml index 207493f..914645c 100644 --- a/k8s/infra/vpn/netbird/signal/svc.yaml +++ b/k8s/infra/vpn/netbird/signal/svc.yaml @@ -10,5 +10,9 @@ spec: ports: - name: http port: 80 - appProtocol: kubernetes.io/h2c targetPort: http +# appProtocol: kubernetes.io/h2c + - name: grpc + port: 10000 + targetPort: legacy-grpc + appProtocol: kubernetes.io/h2c diff --git a/k8s/infra/vpn/netbird/values.yaml b/k8s/infra/vpn/netbird/values.yaml new file mode 100644 index 0000000..918623a --- /dev/null +++ b/k8s/infra/vpn/netbird/values.yaml @@ -0,0 +1,211 @@ +# https://github.com/netbirdio/helms/blob/main/charts/netbird/values.yaml + +fullnameOverride: netbird +management: + configmap: |- + { + "Stuns": [ + { + "Proto": "udp", + "URI": "{{ .STUN_SERVER }}", + "Username": "", + "Password": "" + } + ], + "TURNConfig": { + "TimeBasedCredentials": false, + "CredentialsTTL": "12h0m0s", + "Secret": "secret", + "Turns": [ + { + "Proto": "udp", + "URI": "{{ .TURN_SERVER }}", + "Username": "{{ .TURN_SERVER_USER }}", + "Password": "{{ .TURN_SERVER_PASSWORD }}" + } + ] + }, + "Relay": { + "Addresses": ["rels://netbird.example.com:443/relay"], + "CredentialsTTL": "24h", + "Secret": "{{ .RELAY_PASSWORD }}" + }, + "Signal": { + "Proto": "https", + "URI": "netbird.example.com:443", + "Username": "", + "Password": "" + }, + "Datadir": "/var/lib/netbird/", + "DataStoreEncryptionKey": "{{ .DATASTORE_ENCRYPTION_KEY }}", + "HttpConfig": { + "LetsEncryptDomain": "", + "CertFile": "", + "CertKey": "", + "AuthAudience": "{{ .IDP_CLIENT_ID }}", + "AuthIssuer": "https://idp.example.com/application/o/netbird/", + "AuthUserIDClaim": "", + "AuthKeysLocation": "https://idp.example.com/application/o/netbird/jwks/", + "OIDCConfigEndpoint": "https://idp.example.com/application/o/netbird/.well-known/openid-configuration", + "IdpSignKeyRefreshEnabled": false + }, + "IdpManagerConfig": { + "ManagerType": "authentik", + "ClientConfig": { + "Issuer": "https://idp.example.com/application/o/totmicro-traefik-netbird", + "TokenEndpoint": "https://idp.example.com/application/o/token/", + "ClientID": "{{ .IDP_CLIENT_ID }}", + "ClientSecret": "", + "GrantType": "client_credentials" + }, + "ExtraConfig": { + "Password": "{{ .IDP_SERVICE_ACCOUNT_PASSWORD }}", + "Username": "{{ .IDP_SERVICE_ACCOUNT_USER }}" + }, + "Auth0ClientCredentials": null, + "AzureClientCredentials": null, + "KeycloakClientCredentials": null, + "ZitadelClientCredentials": null + }, + "DeviceAuthorizationFlow": { + "Provider": "hosted", + "ProviderConfig": { + "ClientID": "{{ .IDP_CLIENT_ID }}", + "ClientSecret": "", + "Domain": "idp.example.com", + "Audience": "{{ .IDP_CLIENT_ID }}", + "TokenEndpoint": "https://idp.example.com/application/o/token/", + "DeviceAuthEndpoint": "https://idp.example.com/application/o/device/", + "AuthorizationEndpoint": "", + "Scope": "openid", + "UseIDToken": false, + "RedirectURLs": null + } + }, + "PKCEAuthorizationFlow": { + "ProviderConfig": { + "ClientID": "{{ .IDP_CLIENT_ID }}", + "ClientSecret": "", + "Domain": "", + "Audience": "{{ .IDP_CLIENT_ID }}", + "TokenEndpoint": "https://idp.example.com/application/o/token/", + "DeviceAuthEndpoint": "", + "AuthorizationEndpoint": "https://idp.example.com/application/o/authorize/", + "Scope": "openid profile email offline_access api", + "UseIDToken": false, + "RedirectURLs": ["http://localhost:53000"] + } + }, + "StoreConfig": { + "Engine": "postgres" + }, + "ReverseProxy": { + "TrustedHTTPProxies": null, + "TrustedHTTPProxiesCount": 0, + "TrustedPeers": null + } + } + + image: + tag: 0.32.0 + persistentVolume: + enabled: false + envFromSecret: + NETBIRD_STORE_ENGINE_POSTGRES_DSN: netbird/postgresDSN + STUN_SERVER: netbird/stunServer + TURN_SERVER: netbird/turnServer + TURN_SERVER_USER: netbird/turnServerUser + TURN_SERVER_PASSWORD: netbird/turnServerPassword + RELAY_PASSWORD: netbird/relayPassword + IDP_CLIENT_ID: netbird/idpClientID + IDP_SERVICE_ACCOUNT_USER: netbird/idpServiceAccountUser + IDP_SERVICE_ACCOUNT_PASSWORD: netbird/idpServiceAccountPassword + DATASTORE_ENCRYPTION_KEY: netbird/datastoreEncryptionKey + +signal: + image: + tag: 0.32.0 + +relay: + image: + tag: 0.32.0 + envFromSecret: + NB_AUTH_SECRET: netbird/relayPassword + env: + NB_LOG_LEVEL: info + NB_LISTEN_ADDRESS: ":33080" + NB_EXPOSED_ADDRESS: rels://netbird.example.com:443/relay + +dashboard: + enabled: true + image: + tag: v2.9.0 + env: + # Endpoints + NETBIRD_MGMT_API_ENDPOINT: https://netbird.example.com:443 + NETBIRD_MGMT_GRPC_API_ENDPOINT: https://netbird.example.com:443 + # OIDC + AUTH_CLIENT_SECRET: + AUTH_AUTHORITY: https://idp.example.com/application/o/netbird/ + USE_AUTH0: false + AUTH_SUPPORTED_SCOPES: openid profile email offline_access api + AUTH_REDIRECT_URI: + AUTH_SILENT_REDIRECT_URI: + NETBIRD_TOKEN_SOURCE: accessToken + NGINX_SSL_PORT: + LETSENCRYPT_DOMAIN: + LETSENCRYPT_EMAIL: + envFromSecret: + AUTH_CLIENT_ID: netbird/idpClientID + AUTH_AUDIENCE: netbird/idpClientID + +#extraManifests: +# - apiVersion: traefik.io/v1alpha1 +# kind: IngressRoute +# metadata: +# name: netbird-traefik +# labels: +# argocd.argoproj.io/instance: netbird-traefik +# spec: +# entryPoints: +# - websecure +# routes: +# - kind: Rule +# match: Host(`netbird.example.com`) && !PathPrefix(`/api`) && !PathPrefix(`/management`) && !PathPrefix(`/signalexchange`) && !PathPrefix(`/relay`) +# services: +# - name: netbird-traefik-dashboard +# namespace: netbird-traefik +# passHostHeader: true +# port: 80 +# - kind: Rule +# match: Host(`netbird.example.com`) && PathPrefix(`/api`) +# services: +# - name: netbird-traefik-management +# namespace: netbird-traefik +# passHostHeader: true +# port: 80 +# - kind: Rule +# match: Host(`netbird.example.com`) && PathPrefix(`/relay`) +# services: +# - name: netbird-traefik-relay +# namespace: netbird-traefik +# passHostHeader: true +# port: 33080 +# - kind: Rule +# match: Host(`netbird.example.com`) && PathPrefix(`/management`) +# services: +# - name: netbird-traefik-management +# namespace: netbird-traefik +# passHostHeader: true +# port: 80 +# scheme: h2c +# - kind: Rule +# match: Host(`netbird.example.com`) && PathPrefix(`/signalexchange`) +# services: +# - name: netbird-traefik-signal +# namespace: netbird-traefik +# passHostHeader: true +# port: 80 +# scheme: h2c +# tls: +# secretName: netbird-tls \ No newline at end of file