homelab-v/k8s/infra/vpn/netbird/management/deployment.yaml

apiVersion: apps/v1
kind: Deployment
metadata:
  name: management
  namespace: netbird
spec:
  strategy:
    type: Recreate
  selector:
    matchLabels:
      app.kubernetes.io/name: management
  template:
    metadata:
      labels:
        app.kubernetes.io/name: management
      annotations:
        kubectl.kubernetes.io/default-container: management
    spec:
      nodeSelector:
        topology.kubernetes.io/zone: abel
      dnsConfig:
        # Internal AdGuard Home DNS
        nameservers:
          - 192.168.1.253
      dnsPolicy: None
      securityContext:
        seccompProfile:
          type: RuntimeDefault
      initContainers:
        - name: configure
          image: ghcr.io/containeroo/renvsubst:0.10.0 # renovate: github-releases=containeroo/renvsubst
          args: [ -i, /tmp/netbird/management.json.tmpl, -o, /etc/netbird/management.json ]
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: false
            runAsNonRoot: false
            capabilities:
              drop: [ ALL ]
          envFrom:
            - configMapRef:
                name: management-auth-config
            - configMapRef:
                name: management-connection-config
            - secretRef:
                name: authelia-oidc-credentials
            - secretRef:
                name: relay-secret
            - secretRef:
                name: coturn-credentials
          volumeMounts:
            - name: config
              mountPath: /etc/netbird
            - name: config-template
              mountPath: /tmp/netbird
      containers:
        - name: management
          image: docker.io/netbirdio/management:0.59.8 # renovate: docker=docker.io/netbirdio/management
          args: [ --dns-domain, $(DNS_DOMAIN), --log-level, $(LOG_LEVEL), --log-file, console, --idp-sign-key-refresh-enabled ]
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: false
            runAsNonRoot: false
            capabilities:
              drop: [ ALL ]
              add: [ NET_ADMIN, NET_RAW, PERFMON, BPF ]
          envFrom:
            - configMapRef:
                name: management-runtime-config
          volumeMounts:
            - name: config
              mountPath: /etc/netbird
            - name: management
              mountPath: /var/lib/netbird
          ports:
            - name: http
              containerPort: 80
          resources:
            requests:
              memory: 64Mi
              cpu: 200m
            limits:
              memory: 512Mi
              cpu: 4000m
      volumes:
        - name: config
          emptyDir:
            medium: Memory
        - name: config-template
          configMap:
            defaultMode: 0644
            name: management-config-template
        - name: management
          persistentVolumeClaim:
            claimName: management