wip(netbird): fix config

vehagn · vehagn · commit b1e4caabc825 · 2025-10-29T22:48:10.000+01:00
Signed-off-by: Vegard Hagen &lt;vegard@stonegarden.dev&gt;
diff --git a/k8s/apps/dev/whoami/http-route.yaml b/k8s/apps/dev/whoami/http-route.yaml
@@ -0,0 +1,14 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: whoami
+  namespace: whoami
+spec:
+  parentRefs:
+    - { name: external, namespace: gateway }
+    - { name: internal, namespace: gateway }
+  hostnames: [ "whoami.stonegarden.dev" ]
+  rules:
+    - backendRefs: [ { name: whoami, port: 80 } ]
+      matches:
+        - path: { type: PathPrefix, value: / }
diff --git a/k8s/apps/dev/whoami/kustomization.yaml b/k8s/apps/dev/whoami/kustomization.yaml
@@ -4,4 +4,5 @@ kind: Kustomization
 resources:
   - ns.yaml
   - svc.yaml
+  - http-route.yaml
   - deployment.yaml
diff --git a/k8s/infra/network/cilium/values.yaml b/k8s/infra/network/cilium/values.yaml
@@ -78,7 +78,7 @@ loadBalancer:
 gatewayAPI:
   enabled: true
   enableAlpn: true
-  # enableAppProtocol: true
+  enableAppProtocol: true
 
 envoy:
   prometheus:
diff --git a/k8s/infra/vpn/netbird/agent/daemon-set.yaml b/k8s/infra/vpn/netbird/agent/daemon-set.yaml
@@ -12,6 +12,11 @@ spec:
       labels:
         app: agent
     spec:
+      dnsConfig:
+        nameservers:
+          - 10.96.0.12 # AdGuard Home
+          - 10.96.0.11 # Unbound
+      dnsPolicy: None
       securityContext:
         seccompProfile:
           type: RuntimeDefault
diff --git a/k8s/infra/vpn/netbird/grpc-route.yaml b/k8s/infra/vpn/netbird/grpc-route.yaml
@@ -13,7 +13,7 @@ spec:
       matches:
         - headers: [ { name: Content-Type, value: application/grpc } ]
         - method: { service: management.ManagementService }
-    - backendRefs: [ { name: signal, port: 80 } ]
+    - backendRefs: [ { name: signal, port: 10000 } ]
       matches:
         - headers: [ { name: Content-Type, value: application/grpc } ]
         - method: { service: signalexchange.SignalExchange }
diff --git a/k8s/infra/vpn/netbird/kustomization.yaml b/k8s/infra/vpn/netbird/kustomization.yaml
@@ -13,3 +13,12 @@ resources:
   - management
   - relay
   - signal
+
+#helmCharts:
+#  - name: netbird
+#    repo: https://netbirdio.github.io/helms
+#    version: 1.9.0 # renovate: github-releases=netbirdio/helms
+#    releaseName: netbird
+#    includeCRDs: true
+#    namespace: netbird
+#    valuesFile: values.yaml
diff --git a/k8s/infra/vpn/netbird/management/deployment.yaml b/k8s/infra/vpn/netbird/management/deployment.yaml
@@ -20,7 +20,6 @@ spec:
         topology.kubernetes.io/zone: abel
       dnsConfig:
         nameservers:
-          - 172.20.10.153 # AdGuard Home
           - 10.96.0.12 # AdGuard Home
           - 10.96.0.11 # Unbound
       dnsPolicy: None
diff --git a/k8s/infra/vpn/netbird/management/svc.yaml b/k8s/infra/vpn/netbird/management/svc.yaml
@@ -10,5 +10,5 @@ spec:
   ports:
     - name: http
       port: 80
-      appProtocol: kubernetes.io/h2c
       targetPort: http
+      appProtocol: kubernetes.io/h2c
diff --git a/k8s/infra/vpn/netbird/relay/svc.yaml b/k8s/infra/vpn/netbird/relay/svc.yaml
@@ -3,8 +3,6 @@ kind: Service
 metadata:
   name: relay
   namespace: netbird
-  labels:
-    app.kubernetes.io/name: relay
 spec:
   type: ClusterIP
   selector:
diff --git a/k8s/infra/vpn/netbird/signal/deployment.yaml b/k8s/infra/vpn/netbird/signal/deployment.yaml
@@ -39,6 +39,8 @@ spec:
           ports:
             - name: http
               containerPort: 80
+            - name: legacy-grpc
+              containerPort: 10000
           livenessProbe:
             tcpSocket:
               port: http
diff --git a/k8s/infra/vpn/netbird/signal/svc.yaml b/k8s/infra/vpn/netbird/signal/svc.yaml
@@ -10,5 +10,9 @@ spec:
   ports:
     - name: http
       port: 80
-      appProtocol: kubernetes.io/h2c
       targetPort: http
+#      appProtocol: kubernetes.io/h2c
+    - name: grpc
+      port: 10000
+      targetPort: legacy-grpc
+      appProtocol: kubernetes.io/h2c
diff --git a/k8s/infra/vpn/netbird/values.yaml b/k8s/infra/vpn/netbird/values.yaml
@@ -0,0 +1,211 @@
+# https://github.com/netbirdio/helms/blob/main/charts/netbird/values.yaml
+
+fullnameOverride: netbird
+management:
+  configmap: |-
+    {
+      "Stuns": [
+        {
+          "Proto": "udp",
+          "URI": "{{ .STUN_SERVER }}",
+          "Username": "",
+          "Password": ""
+        }
+      ],
+      "TURNConfig": {
+        "TimeBasedCredentials": false,
+        "CredentialsTTL": "12h0m0s",
+        "Secret": "secret",
+        "Turns": [
+          {
+            "Proto": "udp",
+            "URI": "{{ .TURN_SERVER }}",
+            "Username": "{{ .TURN_SERVER_USER }}",
+            "Password": "{{ .TURN_SERVER_PASSWORD }}"
+          }
+        ]
+      },
+      "Relay": {
+        "Addresses": ["rels://netbird.example.com:443/relay"],
+        "CredentialsTTL": "24h",
+        "Secret": "{{ .RELAY_PASSWORD }}"
+      },
+      "Signal": {
+        "Proto": "https",
+        "URI": "netbird.example.com:443",
+        "Username": "",
+        "Password": ""
+      },
+      "Datadir": "/var/lib/netbird/",
+      "DataStoreEncryptionKey": "{{ .DATASTORE_ENCRYPTION_KEY }}",
+      "HttpConfig": {
+        "LetsEncryptDomain": "",
+        "CertFile": "",
+        "CertKey": "",
+        "AuthAudience": "{{ .IDP_CLIENT_ID }}",
+        "AuthIssuer": "https://idp.example.com/application/o/netbird/",
+        "AuthUserIDClaim": "",
+        "AuthKeysLocation": "https://idp.example.com/application/o/netbird/jwks/",
+        "OIDCConfigEndpoint": "https://idp.example.com/application/o/netbird/.well-known/openid-configuration",
+        "IdpSignKeyRefreshEnabled": false
+      },
+      "IdpManagerConfig": {
+        "ManagerType": "authentik",
+        "ClientConfig": {
+          "Issuer": "https://idp.example.com/application/o/totmicro-traefik-netbird",
+          "TokenEndpoint": "https://idp.example.com/application/o/token/",
+          "ClientID": "{{ .IDP_CLIENT_ID }}",
+          "ClientSecret": "",
+          "GrantType": "client_credentials"
+        },
+        "ExtraConfig": {
+          "Password": "{{ .IDP_SERVICE_ACCOUNT_PASSWORD }}",
+          "Username": "{{ .IDP_SERVICE_ACCOUNT_USER }}"
+        },
+        "Auth0ClientCredentials": null,
+        "AzureClientCredentials": null,
+        "KeycloakClientCredentials": null,
+        "ZitadelClientCredentials": null
+      },
+      "DeviceAuthorizationFlow": {
+        "Provider": "hosted",
+        "ProviderConfig": {
+          "ClientID": "{{ .IDP_CLIENT_ID }}",
+          "ClientSecret": "",
+          "Domain": "idp.example.com",
+          "Audience": "{{ .IDP_CLIENT_ID }}",
+          "TokenEndpoint": "https://idp.example.com/application/o/token/",
+          "DeviceAuthEndpoint": "https://idp.example.com/application/o/device/",
+          "AuthorizationEndpoint": "",
+          "Scope": "openid",
+          "UseIDToken": false,
+          "RedirectURLs": null
+        }
+      },
+      "PKCEAuthorizationFlow": {
+        "ProviderConfig": {
+          "ClientID": "{{ .IDP_CLIENT_ID }}",
+          "ClientSecret": "",
+          "Domain": "",
+          "Audience": "{{ .IDP_CLIENT_ID }}",
+          "TokenEndpoint": "https://idp.example.com/application/o/token/",
+          "DeviceAuthEndpoint": "",
+          "AuthorizationEndpoint": "https://idp.example.com/application/o/authorize/",
+          "Scope": "openid profile email offline_access api",
+          "UseIDToken": false,
+          "RedirectURLs": ["http://localhost:53000"]
+        }
+      },
+      "StoreConfig": {
+        "Engine": "postgres"
+      },
+      "ReverseProxy": {
+        "TrustedHTTPProxies": null,
+        "TrustedHTTPProxiesCount": 0,
+        "TrustedPeers": null
+      }
+    }
+
+  image:
+    tag: 0.32.0
+  persistentVolume:
+    enabled: false
+  envFromSecret:
+    NETBIRD_STORE_ENGINE_POSTGRES_DSN: netbird/postgresDSN
+    STUN_SERVER: netbird/stunServer
+    TURN_SERVER: netbird/turnServer
+    TURN_SERVER_USER: netbird/turnServerUser
+    TURN_SERVER_PASSWORD: netbird/turnServerPassword
+    RELAY_PASSWORD: netbird/relayPassword
+    IDP_CLIENT_ID: netbird/idpClientID
+    IDP_SERVICE_ACCOUNT_USER: netbird/idpServiceAccountUser
+    IDP_SERVICE_ACCOUNT_PASSWORD: netbird/idpServiceAccountPassword
+    DATASTORE_ENCRYPTION_KEY: netbird/datastoreEncryptionKey
+
+signal:
+  image:
+    tag: 0.32.0
+
+relay:
+  image:
+    tag: 0.32.0
+  envFromSecret:
+    NB_AUTH_SECRET: netbird/relayPassword
+  env:
+    NB_LOG_LEVEL: info
+    NB_LISTEN_ADDRESS: ":33080"
+    NB_EXPOSED_ADDRESS: rels://netbird.example.com:443/relay
+
+dashboard:
+  enabled: true
+  image:
+    tag: v2.9.0
+  env:
+    # Endpoints
+    NETBIRD_MGMT_API_ENDPOINT: https://netbird.example.com:443
+    NETBIRD_MGMT_GRPC_API_ENDPOINT: https://netbird.example.com:443
+    # OIDC
+    AUTH_CLIENT_SECRET:
+    AUTH_AUTHORITY: https://idp.example.com/application/o/netbird/
+    USE_AUTH0: false
+    AUTH_SUPPORTED_SCOPES: openid profile email offline_access api
+    AUTH_REDIRECT_URI:
+    AUTH_SILENT_REDIRECT_URI:
+    NETBIRD_TOKEN_SOURCE: accessToken
+    NGINX_SSL_PORT:
+    LETSENCRYPT_DOMAIN:
+    LETSENCRYPT_EMAIL:
+  envFromSecret:
+    AUTH_CLIENT_ID: netbird/idpClientID
+    AUTH_AUDIENCE: netbird/idpClientID
+
+#extraManifests:
+#  - apiVersion: traefik.io/v1alpha1
+#    kind: IngressRoute
+#    metadata:
+#      name: netbird-traefik
+#      labels:
+#        argocd.argoproj.io/instance: netbird-traefik
+#    spec:
+#      entryPoints:
+#        - websecure
+#      routes:
+#        - kind: Rule
+#          match: Host(`netbird.example.com`) && !PathPrefix(`/api`) && !PathPrefix(`/management`) && !PathPrefix(`/signalexchange`) && !PathPrefix(`/relay`)
+#          services:
+#            - name: netbird-traefik-dashboard
+#              namespace: netbird-traefik
+#              passHostHeader: true
+#              port: 80
+#        - kind: Rule
+#          match: Host(`netbird.example.com`) && PathPrefix(`/api`)
+#          services:
+#            - name: netbird-traefik-management
+#              namespace: netbird-traefik
+#              passHostHeader: true
+#              port: 80
+#        - kind: Rule
+#          match: Host(`netbird.example.com`) && PathPrefix(`/relay`)
+#          services:
+#            - name: netbird-traefik-relay
+#              namespace: netbird-traefik
+#              passHostHeader: true
+#              port: 33080
+#        - kind: Rule
+#          match: Host(`netbird.example.com`) && PathPrefix(`/management`)
+#          services:
+#            - name: netbird-traefik-management
+#              namespace: netbird-traefik
+#              passHostHeader: true
+#              port: 80
+#              scheme: h2c
+#        - kind: Rule
+#          match: Host(`netbird.example.com`) && PathPrefix(`/signalexchange`)
+#          services:
+#            - name: netbird-traefik-signal
+#              namespace: netbird-traefik
+#              passHostHeader: true
+#              port: 80
+#              scheme: h2c
+#      tls:
+#        secretName: netbird-tls
