Initial commit

infrastructure/netbird/manifests/api-exporter.yaml

@@ -0,0 +1,104 @@
+# Netbird API Exporter - Exposes peer status, groups, users as Prometheus metrics
+# Uses the Netbird management API to collect data
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: netbird-api-exporter
+  namespace: netbird
+  labels:
+    app.kubernetes.io/name: netbird-api-exporter
+    app.kubernetes.io/component: exporter
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: netbird-api-exporter
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: netbird-api-exporter
+        app.kubernetes.io/component: exporter
+    spec:
+      securityContext:
+        runAsUser: 10000
+        runAsGroup: 10000
+        runAsNonRoot: true
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+        - name: exporter
+          image: ghcr.io/matanbaruch/netbird-api-exporter:v0.1.46
+          ports:
+            - containerPort: 8080
+              name: metrics
+              protocol: TCP
+          env:
+            - name: NETBIRD_API_URL
+              value: "http://netbird-management.netbird.svc.cluster.local:80"
+            - name: NETBIRD_API_TOKEN
+              valueFrom:
+                secretKeyRef:
+                  name: netbird-api-token-secret
+                  key: api-token
+          resources:
+            limits:
+              memory: 128Mi
+            requests:
+              cpu: 10m
+              memory: 32Mi
+          securityContext:
+            runAsUser: 10000
+            runAsGroup: 10000
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+            readOnlyRootFilesystem: true
+            runAsNonRoot: true
+          livenessProbe:
+            httpGet:
+              path: /metrics
+              port: metrics
+            initialDelaySeconds: 10
+            periodSeconds: 30
+          readinessProbe:
+            httpGet:
+              path: /metrics
+              port: metrics
+            initialDelaySeconds: 5
+            periodSeconds: 10
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: netbird-api-exporter
+  namespace: netbird
+  labels:
+    app.kubernetes.io/name: netbird-api-exporter
+    app.kubernetes.io/component: exporter
+spec:
+  type: ClusterIP
+  ports:
+    - port: 8080
+      targetPort: metrics
+      protocol: TCP
+      name: metrics
+  selector:
+    app.kubernetes.io/name: netbird-api-exporter
+---
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: netbird-api-exporter
+  namespace: netbird
+  labels:
+    release: kube-prometheus-stack
+spec:
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: netbird-api-exporter
+  endpoints:
+    - port: metrics
+      path: /metrics
+      interval: 30s

infrastructure/netbird/manifests/api-token-external-secret.yaml

@@ -0,0 +1,21 @@
+# ExternalSecret for Netbird API token (used by API exporter)
+# Token is stored in Vault by scripts/setup-netbird-api-token.sh
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: netbird-api-token
+  namespace: netbird
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: vault-backend
+  target:
+    name: netbird-api-token-secret
+    creationPolicy: Owner
+  data:
+    - secretKey: api-token
+      remoteRef:
+        key: netbird-api-token
+        property: api-token

infrastructure/netbird/manifests/cluster-router.yaml

@@ -0,0 +1,67 @@
+---
+# ExternalSecret to pull router setup key from Vault
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: netbird-router-setup-key
+  namespace: netbird
+spec:
+  refreshInterval: "0"
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: vault-backend
+  target:
+    name: netbird-router-setup-key
+  data:
+    - secretKey: setup-key
+      remoteRef:
+        key: netbird-router-setup-key
+        property: setup-key
+---
+# Shared cluster-wide NetBird router deployment (2 replicas)
+# Routes traffic for all exposed K8s services through NetBird VPN
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: netbird-cluster-router
+  namespace: netbird
+  labels:
+    app.kubernetes.io/name: netbird-cluster-router
+spec:
+  replicas: 2
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: netbird-cluster-router
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: netbird-cluster-router
+      annotations:
+        # Router pods must opt out of ambient mesh — ztunnel iptables rules
+        # interfere with WireGuard packet forwarding (DNS and TCP).
+        # AuthorizationPolicies use ipBlocks for pod CIDR instead.
+        ambient.istio.io/redirection: disabled
+    spec:
+      containers:
+        - name: netbird
+          image: netbirdio/netbird:0.66.0
+          imagePullPolicy: IfNotPresent
+          env:
+            - name: NB_SETUP_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: netbird-router-setup-key
+                  key: setup-key
+            - name: NB_MANAGEMENT_URL
+              value: "https://netbird.kube.huskypup.net"
+          securityContext:
+            capabilities:
+              add:
+                - NET_ADMIN
+          resources:
+            requests:
+              cpu: 25m
+              memory: 64Mi
+            limits:
+              memory: 128Mi
+      terminationGracePeriodSeconds: 30

infrastructure/netbird/manifests/external-secret.yaml

@@ -0,0 +1,31 @@
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: netbird-oauth
+  namespace: netbird
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: vault-backend
+  target:
+    name: netbird-oauth-secret
+    creationPolicy: Owner
+  data:
+    - secretKey: client-id
+      remoteRef:
+        key: netbird-oauth
+        property: client-id
+    - secretKey: client-secret
+      remoteRef:
+        key: netbird-oauth
+        property: client-secret
+    - secretKey: service-username
+      remoteRef:
+        key: netbird-oauth
+        property: service-username
+    - secretKey: service-password
+      remoteRef:
+        key: netbird-oauth
+        property: service-password

infrastructure/netbird/manifests/istio-virtualservice.yaml

@@ -0,0 +1,59 @@
+apiVersion: networking.istio.io/v1beta1
+kind: VirtualService
+metadata:
+  name: netbird
+  namespace: netbird
+spec:
+  hosts:
+    - netbird.kube.huskypup.net
+  gateways:
+    - istio-system/edge
+  http:
+    # Management REST API
+    - match:
+        - uri:
+            prefix: /api
+      route:
+        - destination:
+            host: netbird-management.netbird.svc.cluster.local
+            port:
+              number: 80
+
+    # Management gRPC (listens on port 33073, separate from REST API on 80)
+    - match:
+        - uri:
+            prefix: /management.ManagementService/
+      route:
+        - destination:
+            host: netbird-management-grpc.netbird.svc.cluster.local
+            port:
+              number: 33073
+
+    # Signal gRPC
+    - match:
+        - uri:
+            prefix: /signalexchange.SignalExchange/
+      route:
+        - destination:
+            host: netbird-signal.netbird.svc.cluster.local
+            port:
+              number: 80
+
+    # Relay WebSocket
+    - match:
+        - uri:
+            prefix: /relay
+      route:
+        - destination:
+            host: netbird-relay.netbird.svc.cluster.local
+            port:
+              number: 33080
+
+    # Dashboard (all other paths go to dashboard nginx)
+    # No URI rewrite — the static export has .html and .txt files for every route.
+    # nginx try_files handles SPA fallback to /index.html.
+    - route:
+        - destination:
+            host: netbird-dashboard.netbird.svc.cluster.local
+            port:
+              number: 80

infrastructure/netbird/manifests/management-grpc-service.yaml

@@ -0,0 +1,18 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: netbird-management-grpc
+  namespace: netbird
+  labels:
+    app.kubernetes.io/name: netbird-management
+    app.kubernetes.io/instance: netbird
+spec:
+  type: ClusterIP
+  ports:
+    - name: grpc
+      port: 33073
+      targetPort: 33073
+      protocol: TCP
+  selector:
+    app.kubernetes.io/instance: netbird
+    app.kubernetes.io/name: netbird-management

infrastructure/netbird/manifests/oidc-trusted-domains.yaml

@@ -0,0 +1,25 @@
+---
+# Override OidcTrustedDomains.js template to include Authentik authority domain
+# The default template only includes $NETBIRD_MGMT_API_ENDPOINT, but @axa-fr/react-oidc
+# needs the OIDC authority domain (auth.kube.huskypup.net) in trusted domains to allow
+# discovery, token, and userinfo fetches.
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: netbird-oidc-trusted-domains
+  namespace: netbird
+data:
+  OidcTrustedDomains.js.tmpl: |
+    const trustedDomains = {
+        default:["$NETBIRD_MGMT_API_ENDPOINT", "$AUTH_AUTHORITY", "https://auth.kube.huskypup.net"],
+        auth0:[]
+    };
+  OidcServiceWorker.js: |
+    // Minimal no-op service worker for @axa-fr/react-oidc
+    // Prevents 404 which can hang the OIDC initialization
+    self.addEventListener('install', function(event) {
+      self.skipWaiting();
+    });
+    self.addEventListener('activate', function(event) {
+      event.waitUntil(self.clients.claim());
+    });

infrastructure/netbird/manifests/presync-job.yaml

@@ -0,0 +1,51 @@
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: netbird-presync
+  namespace: netbird
+  annotations:
+    argocd.argoproj.io/hook: PreSync
+    argocd.argoproj.io/hook-delete-policy: BeforeHookCreation
+spec:
+  backoffLimit: 3
+  template:
+    spec:
+      serviceAccountName: argocd-hook-sa
+      containers:
+        - name: presync
+          image: bitnami/kubectl:1.31
+          command:
+            - /bin/bash
+            - -c
+            - |
+              set -euo pipefail
+              echo "=== Netbird PreSync ==="
+
+              # Set PodSecurity to privileged (cluster routers need NET_ADMIN)
+              kubectl label namespace netbird pod-security.kubernetes.io/enforce=privileged --overwrite 2>/dev/null || true
+
+              # Wait for CNPG cluster
+              echo "Waiting for Netbird PostgreSQL cluster..."
+              for i in $(seq 1 60); do
+                PHASE=$(kubectl -n netbird get cluster pg-netbird -o jsonpath='{.status.phase}' 2>/dev/null || echo "")
+                if [ "$PHASE" = "Cluster in healthy state" ] || [ "$PHASE" = "Healthy" ]; then
+                  echo "  Netbird PostgreSQL cluster ready"
+                  break
+                fi
+                echo "  waiting for pg-netbird... (attempt $i/60, phase=$PHASE)"
+                sleep 5
+              done
+
+              # Wait for OAuth secret
+              echo "Waiting for netbird-oauth-secret..."
+              for i in $(seq 1 30); do
+                if kubectl -n netbird get secret netbird-oauth-secret >/dev/null 2>&1; then
+                  echo "  Netbird OAuth secret synced"
+                  break
+                fi
+                echo "  waiting for ExternalSecret sync... (attempt $i/30)"
+                sleep 2
+              done
+
+              echo "=== Netbird PreSync Complete ==="
+      restartPolicy: Never

infrastructure/netbird/manifests/servicemonitor.yaml

@@ -0,0 +1,54 @@
+# PodMonitors for Netbird native Prometheus metrics
+# Management, Signal, and Relay servers expose metrics on port 9090
+# when NB_METRICS_PORT is set
+---
+apiVersion: monitoring.coreos.com/v1
+kind: PodMonitor
+metadata:
+  name: netbird-management
+  namespace: netbird
+  labels:
+    release: kube-prometheus-stack
+spec:
+  selector:
+    matchLabels:
+      app.kubernetes.io/component: management
+      app.kubernetes.io/name: netbird
+  podMetricsEndpoints:
+    - port: "9090"
+      path: /metrics
+      interval: 30s
+---
+apiVersion: monitoring.coreos.com/v1
+kind: PodMonitor
+metadata:
+  name: netbird-signal
+  namespace: netbird
+  labels:
+    release: kube-prometheus-stack
+spec:
+  selector:
+    matchLabels:
+      app.kubernetes.io/component: signal
+      app.kubernetes.io/name: netbird
+  podMetricsEndpoints:
+    - port: "9090"
+      path: /metrics
+      interval: 30s
+---
+apiVersion: monitoring.coreos.com/v1
+kind: PodMonitor
+metadata:
+  name: netbird-relay
+  namespace: netbird
+  labels:
+    release: kube-prometheus-stack
+spec:
+  selector:
+    matchLabels:
+      app.kubernetes.io/component: relay
+      app.kubernetes.io/name: netbird
+  podMetricsEndpoints:
+    - port: "9090"
+      path: /metrics
+      interval: 30s